[client] Use port 22338 for RDP sideband auth server

https://claude.ai/code/session_01C38bCDyYzLgxYLVwJkcUng

.github/workflows/proto-version-check.yml

@@ -1,62 +0,0 @@
-name: Proto Version Check
-
-on:
-  pull_request:
-    paths:
-      - "**/*.pb.go"
-
-jobs:
-  check-proto-versions:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check for proto tool version changes
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const files = await github.paginate(github.rest.pulls.listFiles, {
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: context.issue.number,
-              per_page: 100,
-            });
-
-            const pbFiles = files.filter(f => f.filename.endsWith('.pb.go'));
-            const missingPatch = pbFiles.filter(f => !f.patch).map(f => f.filename);
-            if (missingPatch.length > 0) {
-              core.setFailed(
-                `Cannot inspect patch data for:\n` +
-                missingPatch.map(f => `- ${f}`).join('\n') +
-                `\nThis can happen with very large PRs. Verify proto versions manually.`
-              );
-              return;
-            }
-            const versionPattern = /^[+-]\s*\/\/\s+protoc(?:-gen-go)?\s+v[\d.]+/;
-            const violations = [];
-
-            for (const file of pbFiles) {
-              const changed = file.patch
-                .split('\n')
-                .filter(line => versionPattern.test(line));
-              if (changed.length > 0) {
-                violations.push({
-                  file: file.filename,
-                  lines: changed,
-                });
-              }
-            }
-
-            if (violations.length > 0) {
-              const details = violations.map(v =>
-                `${v.file}:\n${v.lines.map(l => '  ' + l).join('\n')}`
-              ).join('\n\n');
-
-              core.setFailed(
-                `Proto version strings changed in generated files.\n` +
-                `This usually means the wrong protoc or protoc-gen-go version was used.\n` +
-                `Regenerate with the matching tool versions.\n\n` +
-                details
-              );
-              return;
-            }
-
-            console.log('No proto version string changes detected');

.github/workflows/release.yml

@@ -9,7 +9,7 @@ on:
   pull_request:
 
 env:
-  SIGN_PIPE_VER: "v0.1.2"
+  SIGN_PIPE_VER: "v0.1.1"
   GORELEASER_VER: "v2.14.3"
   PRODUCT_NAME: "NetBird"
   COPYRIGHT: "NetBird GmbH"

client/cmd/rdp.go

@@ -0,0 +1,276 @@
+package cmd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"os/signal"
+	"os/user"
+	"strings"
+	"syscall"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/proto"
+	rdpclient "github.com/netbirdio/netbird/client/rdp/client"
+	rdpserver "github.com/netbirdio/netbird/client/rdp/server"
+	nbssh "github.com/netbirdio/netbird/client/ssh"
+	"github.com/netbirdio/netbird/util"
+)
+
+const (
+	serverRDPAllowedFlag = "allow-server-rdp"
+)
+
+var (
+	rdpUsername       string
+	rdpHost          string
+	rdpNoBrowser     bool
+	rdpNoCache       bool
+	serverRDPAllowed bool
+)
+
+func init() {
+	rdpCmd.PersistentFlags().StringVarP(&rdpUsername, "user", "u", "", "Windows username on remote peer")
+	rdpCmd.PersistentFlags().BoolVar(&rdpNoBrowser, noBrowserFlag, false, noBrowserDesc)
+	rdpCmd.PersistentFlags().BoolVar(&rdpNoCache, "no-cache", false, "Skip cached JWT token and force fresh authentication")
+
+	upCmd.PersistentFlags().BoolVar(&serverRDPAllowed, serverRDPAllowedFlag, false, "Allow RDP passthrough on peer (passwordless RDP via credential provider)")
+}
+
+var rdpCmd = &cobra.Command{
+	Use:   "rdp [flags] [user@]host",
+	Short: "Connect to a NetBird peer via RDP (passwordless)",
+	Long: `Connect to a NetBird peer using Remote Desktop Protocol with token-based
+passwordless authentication. The target peer must have RDP passthrough enabled.
+
+This command:
+  1. Obtains a JWT token via OIDC authentication
+  2. Sends the token to the target peer's sideband auth service
+  3. If authorized, launches mstsc.exe to connect
+
+Examples:
+  netbird rdp peer-hostname
+  netbird rdp administrator@peer-hostname
+  netbird rdp --user admin peer-hostname`,
+	Args: cobra.MinimumNArgs(1),
+	RunE: rdpFn,
+}
+
+func rdpFn(cmd *cobra.Command, args []string) error {
+	SetFlagsFromEnvVars(rootCmd)
+	SetFlagsFromEnvVars(cmd)
+	cmd.SetOut(cmd.OutOrStdout())
+
+	logOutput := "console"
+	if firstLogFile := util.FindFirstLogPath(logFiles); firstLogFile != "" && firstLogFile != defaultLogFile {
+		logOutput = firstLogFile
+	}
+	if err := util.InitLog(logLevel, logOutput); err != nil {
+		return fmt.Errorf("init log: %w", err)
+	}
+
+	// Parse user@host
+	if err := parseRDPHostArg(args[0]); err != nil {
+		return err
+	}
+
+	ctx := internal.CtxInitState(cmd.Context())
+
+	sig := make(chan os.Signal, 1)
+	signal.Notify(sig, syscall.SIGTERM, syscall.SIGINT)
+	rdpCtx, cancel := context.WithCancel(ctx)
+
+	errCh := make(chan error, 1)
+	go func() {
+		if err := runRDP(rdpCtx, cmd); err != nil {
+			errCh <- err
+		}
+		cancel()
+	}()
+
+	select {
+	case <-sig:
+		cancel()
+		<-rdpCtx.Done()
+		return nil
+	case err := <-errCh:
+		return err
+	case <-rdpCtx.Done():
+	}
+
+	return nil
+}
+
+func parseRDPHostArg(arg string) error {
+	if strings.Contains(arg, "@") {
+		parts := strings.SplitN(arg, "@", 2)
+		if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+			return errors.New("invalid user@host format")
+		}
+		if rdpUsername == "" {
+			rdpUsername = parts[0]
+		}
+		rdpHost = parts[1]
+	} else {
+		rdpHost = arg
+	}
+
+	if rdpUsername == "" {
+		if sudoUser := os.Getenv("SUDO_USER"); sudoUser != "" {
+			rdpUsername = sudoUser
+		} else if currentUser, err := user.Current(); err == nil {
+			rdpUsername = currentUser.Username
+		} else {
+			rdpUsername = "Administrator"
+		}
+	}
+
+	return nil
+}
+
+func runRDP(ctx context.Context, cmd *cobra.Command) error {
+	// Connect to daemon
+	grpcAddr := strings.TrimPrefix(daemonAddr, "tcp://")
+	grpcConn, err := grpc.NewClient(grpcAddr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		return fmt.Errorf("connect to daemon: %w", err)
+	}
+	defer func() { _ = grpcConn.Close() }()
+
+	daemonClient := proto.NewDaemonServiceClient(grpcConn)
+
+	// Resolve peer IP
+	peerIP, err := resolvePeerIP(ctx, daemonClient, rdpHost)
+	if err != nil {
+		return fmt.Errorf("resolve peer %s: %w", rdpHost, err)
+	}
+
+	cmd.Printf("Connecting to %s@%s (%s)...\n", rdpUsername, rdpHost, peerIP)
+
+	// Obtain JWT token
+	hint := profilemanager.GetLoginHint()
+	var browserOpener func(string) error
+	if !rdpNoBrowser {
+		browserOpener = util.OpenBrowser
+	}
+
+	jwtToken, err := nbssh.RequestJWTToken(ctx, daemonClient, nil, cmd.ErrOrStderr(), !rdpNoCache, hint, browserOpener)
+	if err != nil {
+		return fmt.Errorf("JWT authentication: %w", err)
+	}
+
+	log.Debug("JWT authentication successful")
+	cmd.Println("Authenticated. Requesting RDP access...")
+
+	// Generate nonce for replay protection
+	nonce, err := rdpserver.GenerateNonce()
+	if err != nil {
+		return fmt.Errorf("generate nonce: %w", err)
+	}
+
+	// Send sideband auth request
+	authClient := rdpclient.New()
+	authAddr := net.JoinHostPort(peerIP, fmt.Sprintf("%d", rdpserver.DefaultRDPAuthPort))
+
+	resp, err := authClient.RequestAuth(ctx, authAddr, &rdpserver.AuthRequest{
+		JWTToken:      jwtToken,
+		RequestedUser: rdpUsername,
+		ClientPeerIP:  "", // will be filled by the server from the connection
+		Nonce:         nonce,
+	})
+	if err != nil {
+		cmd.Printf("Failed to authorize RDP session with %s\n", rdpHost)
+		cmd.Printf("\nTroubleshooting:\n")
+		cmd.Printf("  1. Check connectivity: netbird status -d\n")
+		cmd.Printf("  2. Verify RDP passthrough is enabled on the target peer\n")
+		return fmt.Errorf("sideband auth: %w", err)
+	}
+
+	if resp.Status != rdpserver.StatusAuthorized {
+		return fmt.Errorf("RDP access denied: %s", resp.Reason)
+	}
+
+	cmd.Printf("RDP access authorized (session: %s, user: %s)\n", resp.SessionID, resp.OSUser)
+	cmd.Printf("Launching Remote Desktop client...\n")
+
+	// Launch mstsc.exe (platform-specific)
+	if err := launchRDPClient(peerIP); err != nil {
+		return fmt.Errorf("launch RDP client: %w", err)
+	}
+
+	return nil
+}
+
+// resolvePeerIP resolves a peer hostname/FQDN to its WireGuard IP address
+// by querying the daemon for the current peer status.
+func resolvePeerIP(ctx context.Context, client proto.DaemonServiceClient, peerAddress string) (string, error) {
+	statusResp, err := client.Status(ctx, &proto.StatusRequest{})
+	if err != nil {
+		return "", fmt.Errorf("get daemon status: %w", err)
+	}
+
+	if statusResp.GetFullStatus() == nil {
+		return "", errors.New("daemon returned empty status")
+	}
+
+	for _, peer := range statusResp.GetFullStatus().GetPeers() {
+		if matchesPeer(peer, peerAddress) {
+			ip := peer.GetIP()
+			if ip == "" {
+				continue
+			}
+			// Strip CIDR suffix if present
+			if idx := strings.Index(ip, "/"); idx != -1 {
+				ip = ip[:idx]
+			}
+			return ip, nil
+		}
+	}
+
+	// If not found as a peer name, try as a direct IP
+	if addr, err := net.ResolveIPAddr("ip", peerAddress); err == nil {
+		return addr.String(), nil
+	}
+
+	return "", fmt.Errorf("peer %q not found in network", peerAddress)
+}
+
+func matchesPeer(peer *proto.PeerState, address string) bool {
+	address = strings.ToLower(address)
+
+	if strings.EqualFold(peer.GetFqdn(), address) {
+		return true
+	}
+
+	// Match against FQDN without trailing dot
+	fqdn := strings.TrimSuffix(peer.GetFqdn(), ".")
+	if strings.EqualFold(fqdn, address) {
+		return true
+	}
+
+	// Match against short hostname (first part of FQDN)
+	if parts := strings.SplitN(fqdn, ".", 2); len(parts) > 0 {
+		if strings.EqualFold(parts[0], address) {
+			return true
+		}
+	}
+
+	// Match against IP
+	ip := peer.GetIP()
+	if idx := strings.Index(ip, "/"); idx != -1 {
+		ip = ip[:idx]
+	}
+	if ip == address {
+		return true
+	}
+
+	return false
+}

client/cmd/rdp_stub.go

@@ -0,0 +1,13 @@
+//go:build !windows
+
+package cmd
+
+import "fmt"
+
+// launchRDPClient is a stub for non-Windows platforms.
+func launchRDPClient(peerIP string) error {
+	fmt.Printf("RDP session authorized for %s\n", peerIP)
+	fmt.Println("Note: mstsc.exe is only available on Windows.")
+	fmt.Printf("Use any RDP client to connect to %s:3389\n", peerIP)
+	return nil
+}

client/cmd/rdp_windows.go

@@ -0,0 +1,34 @@
+//go:build windows
+
+package cmd
+
+import (
+	"fmt"
+	"os/exec"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// launchRDPClient launches the native Windows Remote Desktop client (mstsc.exe).
+func launchRDPClient(peerIP string) error {
+	mstscPath, err := exec.LookPath("mstsc.exe")
+	if err != nil {
+		return fmt.Errorf("mstsc.exe not found: %w", err)
+	}
+
+	cmd := exec.Command(mstscPath, fmt.Sprintf("/v:%s", peerIP))
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("start mstsc.exe: %w", err)
+	}
+
+	log.Debugf("launched mstsc.exe (PID %d) connecting to %s", cmd.Process.Pid, peerIP)
+
+	// Don't wait for mstsc to exit - it runs independently
+	go func() {
+		if err := cmd.Wait(); err != nil {
+			log.Debugf("mstsc.exe exited: %v", err)
+		}
+	}()
+
+	return nil
+}

client/cmd/root.go

@@ -75,7 +75,6 @@ var (
 	mtu                     uint16
 	profilesDisabled        bool
 	updateSettingsDisabled  bool
-	networksDisabled        bool
 
 	rootCmd = &cobra.Command{
 		Use:          "netbird",
@@ -151,6 +150,7 @@ func init() {
 	rootCmd.AddCommand(logoutCmd)
 	rootCmd.AddCommand(versionCmd)
 	rootCmd.AddCommand(sshCmd)
+	rootCmd.AddCommand(rdpCmd)
 	rootCmd.AddCommand(networksCMD)
 	rootCmd.AddCommand(forwardingRulesCmd)
 	rootCmd.AddCommand(debugCmd)

client/cmd/service.go

@@ -44,13 +44,10 @@ func init() {
 	serviceCmd.AddCommand(runCmd, startCmd, stopCmd, restartCmd, svcStatusCmd, installCmd, uninstallCmd, reconfigureCmd, resetParamsCmd)
 	serviceCmd.PersistentFlags().BoolVar(&profilesDisabled, "disable-profiles", false, "Disables profiles feature. If enabled, the client will not be able to change or edit any profile. To persist this setting, use: netbird service install --disable-profiles")
 	serviceCmd.PersistentFlags().BoolVar(&updateSettingsDisabled, "disable-update-settings", false, "Disables update settings feature. If enabled, the client will not be able to change or edit any settings. To persist this setting, use: netbird service install --disable-update-settings")
-	serviceCmd.PersistentFlags().BoolVar(&networksDisabled, "disable-networks", false, "Disables network selection. If enabled, the client will not allow listing, selecting, or deselecting networks. To persist, use: netbird service install --disable-networks")
 
 	rootCmd.PersistentFlags().StringVarP(&serviceName, "service", "s", defaultServiceName, "Netbird system service name")
 	serviceEnvDesc := `Sets extra environment variables for the service. ` +
 		`You can specify a comma-separated list of KEY=VALUE pairs. ` +
-		`New keys are merged with previously saved env vars; existing keys are overwritten. ` +
-		`Use --service-env "" to clear all saved env vars. ` +
 		`E.g. --service-env NB_LOG_LEVEL=debug,CUSTOM_VAR=value`
 
 	installCmd.Flags().StringSliceVar(&serviceEnvVars, "service-env", nil, serviceEnvDesc)

client/cmd/service_controller.go

@@ -61,7 +61,7 @@ func (p *program) Start(svc service.Service) error {
 			}
 		}
 
-		serverInstance := server.New(p.ctx, util.FindFirstLogPath(logFiles), configPath, profilesDisabled, updateSettingsDisabled, networksDisabled)
+		serverInstance := server.New(p.ctx, util.FindFirstLogPath(logFiles), configPath, profilesDisabled, updateSettingsDisabled)
 		if err := serverInstance.Start(); err != nil {
 			log.Fatalf("failed to start daemon: %v", err)
 		}

client/cmd/service_installer.go

@@ -59,10 +59,6 @@ func buildServiceArguments() []string {
 		args = append(args, "--disable-update-settings")
 	}
 
-	if networksDisabled {
-		args = append(args, "--disable-networks")
-	}
-
 	return args
 }
 

client/cmd/service_params.go

@@ -28,7 +28,6 @@ type serviceParams struct {
 	LogFiles              []string          `json:"log_files,omitempty"`
 	DisableProfiles       bool              `json:"disable_profiles,omitempty"`
 	DisableUpdateSettings bool              `json:"disable_update_settings,omitempty"`
-	DisableNetworks       bool              `json:"disable_networks,omitempty"`
 	ServiceEnvVars        map[string]string `json:"service_env_vars,omitempty"`
 }
 
@@ -79,12 +78,11 @@ func currentServiceParams() *serviceParams {
 		LogFiles:              logFiles,
 		DisableProfiles:       profilesDisabled,
 		DisableUpdateSettings: updateSettingsDisabled,
-		DisableNetworks:       networksDisabled,
 	}
 
 	if len(serviceEnvVars) > 0 {
 		parsed, err := parseServiceEnvVars(serviceEnvVars)
-		if err == nil {
+		if err == nil && len(parsed) > 0 {
 			params.ServiceEnvVars = parsed
 		}
 	}
@@ -144,46 +142,31 @@ func applyServiceParams(cmd *cobra.Command, params *serviceParams) {
 		updateSettingsDisabled = params.DisableUpdateSettings
 	}
 
-	if !serviceCmd.PersistentFlags().Changed("disable-networks") {
-		networksDisabled = params.DisableNetworks
-	}
-
 	applyServiceEnvParams(cmd, params)
 }
 
 // applyServiceEnvParams merges saved service environment variables.
-// If --service-env was explicitly set with values, explicit values win on key
-// conflict but saved keys not in the explicit set are carried over.
-// If --service-env was explicitly set to empty, all saved env vars are cleared.
+// If --service-env was explicitly set, explicit values win on key conflict
+// but saved keys not in the explicit set are carried over.
 // If --service-env was not set, saved env vars are used entirely.
 func applyServiceEnvParams(cmd *cobra.Command, params *serviceParams) {
-	if !cmd.Flags().Changed("service-env") {
-		if len(params.ServiceEnvVars) > 0 {
-			// No explicit env vars: rebuild serviceEnvVars from saved params.
-			serviceEnvVars = envMapToSlice(params.ServiceEnvVars)
-		}
+	if len(params.ServiceEnvVars) == 0 {
 		return
 	}
 
-	// Flag was explicitly set: parse what the user provided.
+	if !cmd.Flags().Changed("service-env") {
+		// No explicit env vars: rebuild serviceEnvVars from saved params.
+		serviceEnvVars = envMapToSlice(params.ServiceEnvVars)
+		return
+	}
+
+	// Explicit env vars were provided: merge saved values underneath.
 	explicit, err := parseServiceEnvVars(serviceEnvVars)
 	if err != nil {
 		cmd.PrintErrf("Warning: parse explicit service env vars for merge: %v\n", err)
 		return
 	}
 
-	// If the user passed an empty value (e.g. --service-env ""), clear all
-	// saved env vars rather than merging.
-	if len(explicit) == 0 {
-		serviceEnvVars = nil
-		return
-	}
-
-	if len(params.ServiceEnvVars) == 0 {
-		return
-	}
-
-	// Merge saved values underneath explicit ones.
 	merged := make(map[string]string, len(params.ServiceEnvVars)+len(explicit))
 	maps.Copy(merged, params.ServiceEnvVars)
 	maps.Copy(merged, explicit) // explicit wins on conflict

client/cmd/service_params_test.go

@@ -327,41 +327,6 @@ func TestApplyServiceEnvParams_NotChanged(t *testing.T) {
 	assert.Equal(t, map[string]string{"FROM_SAVED": "val"}, result)
 }
 
-func TestApplyServiceEnvParams_ExplicitEmptyClears(t *testing.T) {
-	origServiceEnvVars := serviceEnvVars
-	t.Cleanup(func() { serviceEnvVars = origServiceEnvVars })
-
-	// Simulate --service-env "" which produces [""] in the slice.
-	serviceEnvVars = []string{""}
-
-	cmd := &cobra.Command{}
-	cmd.Flags().StringSlice("service-env", nil, "")
-	require.NoError(t, cmd.Flags().Set("service-env", ""))
-
-	saved := &serviceParams{
-		ServiceEnvVars: map[string]string{"OLD_VAR": "should_be_cleared"},
-	}
-
-	applyServiceEnvParams(cmd, saved)
-
-	assert.Nil(t, serviceEnvVars, "explicit empty --service-env should clear all saved env vars")
-}
-
-func TestCurrentServiceParams_EmptyEnvVarsAfterParse(t *testing.T) {
-	origServiceEnvVars := serviceEnvVars
-	t.Cleanup(func() { serviceEnvVars = origServiceEnvVars })
-
-	// Simulate --service-env "" which produces [""] in the slice.
-	serviceEnvVars = []string{""}
-
-	params := currentServiceParams()
-
-	// After parsing, the empty string is skipped, resulting in an empty map.
-	// The map should still be set (not nil) so it overwrites saved values.
-	assert.NotNil(t, params.ServiceEnvVars, "empty env vars should produce empty map, not nil")
-	assert.Empty(t, params.ServiceEnvVars, "no valid env vars should be parsed from empty string")
-}
-
 // TestServiceParams_FieldsCoveredInFunctions ensures that all serviceParams fields are
 // referenced in both currentServiceParams() and applyServiceParams(). If a new field is
 // added to serviceParams but not wired into these functions, this test fails.
@@ -535,7 +500,6 @@ func fieldToGlobalVar(field string) string {
 		"LogFiles":              "logFiles",
 		"DisableProfiles":       "profilesDisabled",
 		"DisableUpdateSettings": "updateSettingsDisabled",
-		"DisableNetworks":       "networksDisabled",
 		"ServiceEnvVars":        "serviceEnvVars",
 	}
 	if v, ok := m[field]; ok {

client/cmd/testutil_test.go

@@ -13,8 +13,6 @@ import (
 
 	"github.com/netbirdio/management-integrations/integrations"
 
-	nbcache "github.com/netbirdio/netbird/management/server/cache"
-
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/update_channel"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
@@ -102,16 +100,9 @@ func startManagement(t *testing.T, config *config.Config, testFile string) (*grp
 
 	jobManager := job.NewJobManager(nil, store, peersmanager)
 
-	ctx := context.Background()
+	iv, _ := integrations.NewIntegratedValidator(context.Background(), peersmanager, settingsManagerMock, eventStore)
 
-	cacheStore, err := nbcache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	iv, _ := integrations.NewIntegratedValidator(ctx, peersmanager, settingsManagerMock, eventStore, cacheStore)
-
-	metrics, err := telemetry.NewDefaultAppMetrics(ctx)
+	metrics, err := telemetry.NewDefaultAppMetrics(context.Background())
 	require.NoError(t, err)
 
 	settingsMockManager := settings.NewMockManager(ctrl)
@@ -122,11 +113,12 @@ func startManagement(t *testing.T, config *config.Config, testFile string) (*grp
 		Return(&types.Settings{}, nil).
 		AnyTimes()
 
+	ctx := context.Background()
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := mgmt.NewAccountRequestBuffer(ctx, store)
 	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, mgmt.MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersmanager), config)
 
-	accountManager, err := mgmt.BuildManager(ctx, config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
+	accountManager, err := mgmt.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, iv, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -160,7 +152,7 @@ func startClientDaemon(
 	s := grpc.NewServer()
 
 	server := client.New(ctx,
-		"", "", false, false, false)
+		"", "", false, false)
 	if err := server.Start(); err != nil {
 		t.Fatal(err)
 	}

client/cmd/up.go

@@ -356,6 +356,9 @@ func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, pro
 	if cmd.Flag(serverSSHAllowedFlag).Changed {
 		req.ServerSSHAllowed = &serverSSHAllowed
 	}
+	if cmd.Flag(serverRDPAllowedFlag).Changed {
+		req.ServerRDPAllowed = &serverRDPAllowed
+	}
 	if cmd.Flag(enableSSHRootFlag).Changed {
 		req.EnableSSHRoot = &enableSSHRoot
 	}
@@ -458,6 +461,9 @@ func setupConfig(customDNSAddressConverted []byte, cmd *cobra.Command, configFil
 	if cmd.Flag(serverSSHAllowedFlag).Changed {
 		ic.ServerSSHAllowed = &serverSSHAllowed
 	}
+	if cmd.Flag(serverRDPAllowedFlag).Changed {
+		ic.ServerRDPAllowed = &serverRDPAllowed
+	}
 
 	if cmd.Flag(enableSSHRootFlag).Changed {
 		ic.EnableSSHRoot = &enableSSHRoot
@@ -582,6 +588,9 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 	if cmd.Flag(serverSSHAllowedFlag).Changed {
 		loginRequest.ServerSSHAllowed = &serverSSHAllowed
 	}
+	if cmd.Flag(serverRDPAllowedFlag).Changed {
+		loginRequest.ServerRDPAllowed = &serverRDPAllowed
+	}
 
 	if cmd.Flag(enableSSHRootFlag).Changed {
 		loginRequest.EnableSSHRoot = &enableSSHRoot

client/firewall/create_linux.go

@@ -56,13 +56,6 @@ func NewFirewall(iface IFaceMapper, stateManager *statemanager.Manager, flowLogg
 		return createUserspaceFirewall(iface, nil, disableServerRoutes, flowLogger, mtu)
 	}
 
-	// Native firewall handles packet filtering, but the userspace WireGuard bind
-	// needs a device filter for DNS interception hooks. Install a minimal
-	// hooks-only filter that passes all traffic through to the kernel firewall.
-	if err := iface.SetFilter(&uspfilter.HooksFilter{}); err != nil {
-		log.Warnf("failed to set hooks filter, DNS via memory hooks will not work: %v", err)
-	}
-
 	return fm, nil
 }
 

client/firewall/iptables/acl_linux.go

@@ -21,10 +21,6 @@ const (
 
 	// rules chains contains the effective ACL rules
 	chainNameInputRules = "NETBIRD-ACL-INPUT"
-
-	// mangleFwdKey is the entries map key for mangle FORWARD guard rules that prevent
-	// external DNAT from bypassing ACL rules.
-	mangleFwdKey = "MANGLE-FORWARD"
 )
 
 type aclEntries map[string][][]string
@@ -278,12 +274,6 @@ func (m *aclManager) cleanChains() error {
 		}
 	}
 
-	for _, rule := range m.entries[mangleFwdKey] {
-		if err := m.iptablesClient.DeleteIfExists(tableMangle, chainFORWARD, rule...); err != nil {
-			log.Errorf("failed to delete mangle FORWARD guard rule: %v, %s", rule, err)
-		}
-	}
-
 	for _, ipsetName := range m.ipsetStore.ipsetNames() {
 		if err := m.flushIPSet(ipsetName); err != nil {
 			if errors.Is(err, ipset.ErrSetNotExist) {
@@ -313,10 +303,6 @@ func (m *aclManager) createDefaultChains() error {
 	}
 
 	for chainName, rules := range m.entries {
-		// mangle FORWARD guard rules are handled separately below
-		if chainName == mangleFwdKey {
-			continue
-		}
 		for _, rule := range rules {
 			if err := m.iptablesClient.InsertUnique(tableName, chainName, 1, rule...); err != nil {
 				log.Debugf("failed to create input chain jump rule: %s", err)
@@ -336,13 +322,6 @@ func (m *aclManager) createDefaultChains() error {
 	}
 	clear(m.optionalEntries)
 
-	// Insert mangle FORWARD guard rules to prevent external DNAT bypass.
-	for _, rule := range m.entries[mangleFwdKey] {
-		if err := m.iptablesClient.AppendUnique(tableMangle, chainFORWARD, rule...); err != nil {
-			log.Errorf("failed to add mangle FORWARD guard rule: %v", err)
-		}
-	}
-
 	return nil
 }
 
@@ -364,22 +343,6 @@ func (m *aclManager) seedInitialEntries() {
 
 	m.appendToEntries("FORWARD", []string{"-o", m.wgIface.Name(), "-j", chainRTFWDOUT})
 	m.appendToEntries("FORWARD", []string{"-i", m.wgIface.Name(), "-j", chainRTFWDIN})
-
-	// Mangle FORWARD guard: when external DNAT redirects traffic from the wg interface, it
-	// traverses FORWARD instead of INPUT, bypassing ACL rules. ACCEPT rules in filter FORWARD
-	// can be inserted above ours. Mangle runs before filter, so these guard rules enforce the
-	// ACL mark check where it cannot be overridden.
-	m.appendToEntries(mangleFwdKey, []string{
-		"-i", m.wgIface.Name(),
-		"-m", "conntrack", "--ctstate", "RELATED,ESTABLISHED",
-		"-j", "ACCEPT",
-	})
-	m.appendToEntries(mangleFwdKey, []string{
-		"-i", m.wgIface.Name(),
-		"-m", "conntrack", "--ctstate", "DNAT",
-		"-m", "mark", "!", "--mark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkRedirected),
-		"-j", "DROP",
-	})
 }
 
 func (m *aclManager) seedInitialOptionalEntries() {

client/firewall/uspfilter/common/hooks.go

@@ -1,37 +0,0 @@
-package common
-
-import (
-	"net/netip"
-	"sync/atomic"
-)
-
-// PacketHook stores a registered hook for a specific IP:port.
-type PacketHook struct {
-	IP   netip.Addr
-	Port uint16
-	Fn   func([]byte) bool
-}
-
-// HookMatches checks if a packet's destination matches the hook and invokes it.
-func HookMatches(h *PacketHook, dstIP netip.Addr, dport uint16, packetData []byte) bool {
-	if h == nil {
-		return false
-	}
-	if h.IP == dstIP && h.Port == dport {
-		return h.Fn(packetData)
-	}
-	return false
-}
-
-// SetHook atomically stores a hook, handling nil removal.
-func SetHook(ptr *atomic.Pointer[PacketHook], ip netip.Addr, dPort uint16, hook func([]byte) bool) {
-	if hook == nil {
-		ptr.Store(nil)
-		return
-	}
-	ptr.Store(&PacketHook{
-		IP:   ip,
-		Port: dPort,
-		Fn:   hook,
-	})
-}

client/firewall/uspfilter/filter.go

@@ -142,8 +142,15 @@ type Manager struct {
 	mssClampEnabled bool
 
 	// Only one hook per protocol is supported. Outbound direction only.
-	udpHookOut atomic.Pointer[common.PacketHook]
-	tcpHookOut atomic.Pointer[common.PacketHook]
+	udpHookOut atomic.Pointer[packetHook]
+	tcpHookOut atomic.Pointer[packetHook]
+}
+
+// packetHook stores a registered hook for a specific IP:port.
+type packetHook struct {
+	ip   netip.Addr
+	port uint16
+	fn   func([]byte) bool
 }
 
 // decoder for packages
@@ -905,11 +912,21 @@ func (m *Manager) trackInbound(d *decoder, srcIP, dstIP netip.Addr, ruleID []byt
 }
 
 func (m *Manager) udpHooksDrop(dport uint16, dstIP netip.Addr, packetData []byte) bool {
-	return common.HookMatches(m.udpHookOut.Load(), dstIP, dport, packetData)
+	return hookMatches(m.udpHookOut.Load(), dstIP, dport, packetData)
 }
 
 func (m *Manager) tcpHooksDrop(dport uint16, dstIP netip.Addr, packetData []byte) bool {
-	return common.HookMatches(m.tcpHookOut.Load(), dstIP, dport, packetData)
+	return hookMatches(m.tcpHookOut.Load(), dstIP, dport, packetData)
+}
+
+func hookMatches(h *packetHook, dstIP netip.Addr, dport uint16, packetData []byte) bool {
+	if h == nil {
+		return false
+	}
+	if h.ip == dstIP && h.port == dport {
+		return h.fn(packetData)
+	}
+	return false
 }
 
 // filterInbound implements filtering logic for incoming packets.
@@ -1320,12 +1337,28 @@ func (m *Manager) ruleMatches(rule *RouteRule, srcAddr, dstAddr netip.Addr, prot
 
 // SetUDPPacketHook sets the outbound UDP packet hook. Pass nil hook to remove.
 func (m *Manager) SetUDPPacketHook(ip netip.Addr, dPort uint16, hook func(packet []byte) bool) {
-	common.SetHook(&m.udpHookOut, ip, dPort, hook)
+	if hook == nil {
+		m.udpHookOut.Store(nil)
+		return
+	}
+	m.udpHookOut.Store(&packetHook{
+		ip:   ip,
+		port: dPort,
+		fn:   hook,
+	})
 }
 
 // SetTCPPacketHook sets the outbound TCP packet hook. Pass nil hook to remove.
 func (m *Manager) SetTCPPacketHook(ip netip.Addr, dPort uint16, hook func(packet []byte) bool) {
-	common.SetHook(&m.tcpHookOut, ip, dPort, hook)
+	if hook == nil {
+		m.tcpHookOut.Store(nil)
+		return
+	}
+	m.tcpHookOut.Store(&packetHook{
+		ip:   ip,
+		port: dPort,
+		fn:   hook,
+	})
 }
 
 // SetLogLevel sets the log level for the firewall manager

client/firewall/uspfilter/filter_test.go

@@ -202,9 +202,9 @@ func TestSetUDPPacketHook(t *testing.T) {
 
 	h := manager.udpHookOut.Load()
 	require.NotNil(t, h)
-	assert.Equal(t, netip.MustParseAddr("10.168.0.1"), h.IP)
-	assert.Equal(t, uint16(8000), h.Port)
-	assert.True(t, h.Fn(nil))
+	assert.Equal(t, netip.MustParseAddr("10.168.0.1"), h.ip)
+	assert.Equal(t, uint16(8000), h.port)
+	assert.True(t, h.fn(nil))
 	assert.True(t, called)
 
 	manager.SetUDPPacketHook(netip.MustParseAddr("10.168.0.1"), 8000, nil)
@@ -226,9 +226,9 @@ func TestSetTCPPacketHook(t *testing.T) {
 
 	h := manager.tcpHookOut.Load()
 	require.NotNil(t, h)
-	assert.Equal(t, netip.MustParseAddr("10.168.0.1"), h.IP)
-	assert.Equal(t, uint16(53), h.Port)
-	assert.True(t, h.Fn(nil))
+	assert.Equal(t, netip.MustParseAddr("10.168.0.1"), h.ip)
+	assert.Equal(t, uint16(53), h.port)
+	assert.True(t, h.fn(nil))
 	assert.True(t, called)
 
 	manager.SetTCPPacketHook(netip.MustParseAddr("10.168.0.1"), 53, nil)

client/firewall/uspfilter/hooks_filter.go

@@ -1,90 +0,0 @@
-package uspfilter
-
-import (
-	"encoding/binary"
-	"net/netip"
-	"sync/atomic"
-
-	"github.com/netbirdio/netbird/client/firewall/uspfilter/common"
-	"github.com/netbirdio/netbird/client/iface/device"
-)
-
-const (
-	ipv4HeaderMinLen = 20
-	ipv4ProtoOffset  = 9
-	ipv4FlagsOffset  = 6
-	ipv4DstOffset    = 16
-	ipProtoUDP       = 17
-	ipProtoTCP       = 6
-	ipv4FragOffMask  = 0x1fff
-	// dstPortOffset is the offset of the destination port within a UDP or TCP header.
-	dstPortOffset = 2
-)
-
-// HooksFilter is a minimal packet filter that only handles outbound DNS hooks.
-// It is installed on the WireGuard interface when the userspace bind is active
-// but a full firewall filter (Manager) is not needed because a native kernel
-// firewall (nftables/iptables) handles packet filtering.
-type HooksFilter struct {
-	udpHook atomic.Pointer[common.PacketHook]
-	tcpHook atomic.Pointer[common.PacketHook]
-}
-
-var _ device.PacketFilter = (*HooksFilter)(nil)
-
-// FilterOutbound checks outbound packets for DNS hook matches.
-// Only IPv4 packets matching the registered hook IP:port are intercepted.
-// IPv6 and non-IP packets pass through unconditionally.
-func (f *HooksFilter) FilterOutbound(packetData []byte, _ int) bool {
-	if len(packetData) < ipv4HeaderMinLen {
-		return false
-	}
-
-	// Only process IPv4 packets, let everything else pass through.
-	if packetData[0]>>4 != 4 {
-		return false
-	}
-
-	ihl := int(packetData[0]&0x0f) * 4
-	if ihl < ipv4HeaderMinLen || len(packetData) < ihl+4 {
-		return false
-	}
-
-	// Skip non-first fragments: they don't carry L4 headers.
-	flagsAndOffset := binary.BigEndian.Uint16(packetData[ipv4FlagsOffset : ipv4FlagsOffset+2])
-	if flagsAndOffset&ipv4FragOffMask != 0 {
-		return false
-	}
-
-	dstIP, ok := netip.AddrFromSlice(packetData[ipv4DstOffset : ipv4DstOffset+4])
-	if !ok {
-		return false
-	}
-
-	proto := packetData[ipv4ProtoOffset]
-	dstPort := binary.BigEndian.Uint16(packetData[ihl+dstPortOffset : ihl+dstPortOffset+2])
-
-	switch proto {
-	case ipProtoUDP:
-		return common.HookMatches(f.udpHook.Load(), dstIP, dstPort, packetData)
-	case ipProtoTCP:
-		return common.HookMatches(f.tcpHook.Load(), dstIP, dstPort, packetData)
-	default:
-		return false
-	}
-}
-
-// FilterInbound allows all inbound packets (native firewall handles filtering).
-func (f *HooksFilter) FilterInbound([]byte, int) bool {
-	return false
-}
-
-// SetUDPPacketHook registers the UDP packet hook.
-func (f *HooksFilter) SetUDPPacketHook(ip netip.Addr, dPort uint16, hook func([]byte) bool) {
-	common.SetHook(&f.udpHook, ip, dPort, hook)
-}
-
-// SetTCPPacketHook registers the TCP packet hook.
-func (f *HooksFilter) SetTCPPacketHook(ip netip.Addr, dPort uint16, hook func([]byte) bool) {
-	common.SetHook(&f.tcpHook, ip, dPort, hook)
-}

client/internal/connect.go

@@ -543,6 +543,7 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 		RosenpassEnabled:              config.RosenpassEnabled,
 		RosenpassPermissive:           config.RosenpassPermissive,
 		ServerSSHAllowed:              util.ReturnBoolWithDefaultTrue(config.ServerSSHAllowed),
+		ServerRDPAllowed:              config.ServerRDPAllowed != nil && *config.ServerRDPAllowed,
 		EnableSSHRoot:                 config.EnableSSHRoot,
 		EnableSSHSFTP:                 config.EnableSSHSFTP,
 		EnableSSHLocalPortForwarding:  config.EnableSSHLocalPortForwarding,

client/internal/engine.go

@@ -117,6 +117,7 @@ type EngineConfig struct {
 	RosenpassPermissive bool
 
 	ServerSSHAllowed              bool
+	ServerRDPAllowed              bool
 	EnableSSHRoot                 *bool
 	EnableSSHSFTP                 *bool
 	EnableSSHLocalPortForwarding  *bool
@@ -197,6 +198,7 @@ type Engine struct {
 	networkMonitor *networkmonitor.NetworkMonitor
 
 	sshServer sshServer
+	rdpServer rdpServer
 
 	statusRecorder *peer.Status
 
@@ -1036,6 +1038,10 @@ func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 		}
 	}
 
+	if err := e.updateRDP(); err != nil {
+		log.Warnf("failed handling RDP server setup: %v", err)
+	}
+
 	state := e.statusRecorder.GetLocalPeerState()
 	state.IP = e.wgInterface.Address().String()
 	state.PubKey = e.config.WgPrivateKey.PublicKey().String()
@@ -1323,6 +1329,9 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 		}
 
 		e.updateSSHServerAuth(networkMap.GetSshAuth())
+
+		// Reuse SSH ACL for RDP authorization
+		e.updateRDPServerAuth(networkMap.GetSshAuth())
 	}
 
 	// must set the exclude list after the peers are added. Without it the manager can not figure out the peers parameters from the store

client/internal/engine_rdp.go

@@ -0,0 +1,191 @@
+package internal
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/netip"
+
+	log "github.com/sirupsen/logrus"
+
+	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
+	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
+	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
+	rdpserver "github.com/netbirdio/netbird/client/rdp/server"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
+)
+
+type rdpServer interface {
+	Start(ctx context.Context, addr netip.AddrPort) error
+	Stop() error
+	GetPendingStore() *rdpserver.PendingStore
+	UpdateRDPAuth(config *sshauth.Config)
+}
+
+func (e *Engine) setupRDPPortRedirection() error {
+	if e.firewall == nil || e.wgInterface == nil {
+		return nil
+	}
+
+	localAddr := e.wgInterface.Address().IP
+	if !localAddr.IsValid() {
+		return errors.New("invalid local NetBird address")
+	}
+
+	if err := e.firewall.AddInboundDNAT(localAddr, firewallManager.ProtocolTCP, rdpserver.DefaultRDPAuthPort, rdpserver.InternalRDPAuthPort); err != nil {
+		return fmt.Errorf("add RDP auth port redirection: %w", err)
+	}
+	log.Infof("RDP auth port redirection enabled: %s:%d -> %s:%d",
+		localAddr, rdpserver.DefaultRDPAuthPort, localAddr, rdpserver.InternalRDPAuthPort)
+
+	return nil
+}
+
+func (e *Engine) cleanupRDPPortRedirection() error {
+	if e.firewall == nil || e.wgInterface == nil {
+		return nil
+	}
+
+	localAddr := e.wgInterface.Address().IP
+	if !localAddr.IsValid() {
+		return errors.New("invalid local NetBird address")
+	}
+
+	if err := e.firewall.RemoveInboundDNAT(localAddr, firewallManager.ProtocolTCP, rdpserver.DefaultRDPAuthPort, rdpserver.InternalRDPAuthPort); err != nil {
+		return fmt.Errorf("remove RDP auth port redirection: %w", err)
+	}
+	log.Debugf("RDP auth port redirection removed: %s:%d -> %s:%d",
+		localAddr, rdpserver.DefaultRDPAuthPort, localAddr, rdpserver.InternalRDPAuthPort)
+
+	return nil
+}
+
+// updateRDP handles starting/stopping the RDP server based on the config flag.
+func (e *Engine) updateRDP() error {
+	if !e.config.ServerRDPAllowed {
+		if e.rdpServer != nil {
+			log.Info("RDP passthrough disabled, stopping RDP auth server")
+		}
+		return e.stopRDPServer()
+	}
+
+	if e.config.BlockInbound {
+		log.Info("RDP server is disabled because inbound connections are blocked")
+		return e.stopRDPServer()
+	}
+
+	if e.rdpServer != nil {
+		log.Debug("RDP auth server is already running")
+		return nil
+	}
+
+	return e.startRDPServer()
+}
+
+func (e *Engine) startRDPServer() error {
+	if e.wgInterface == nil {
+		return errors.New("wg interface not initialized")
+	}
+
+	wgAddr := e.wgInterface.Address()
+
+	cfg := &rdpserver.Config{
+		NetworkAddr: wgAddr.Network,
+	}
+
+	server := rdpserver.New(cfg)
+
+	netbirdIP := wgAddr.IP
+	listenAddr := netip.AddrPortFrom(netbirdIP, rdpserver.InternalRDPAuthPort)
+
+	if err := server.Start(e.ctx, listenAddr); err != nil {
+		return fmt.Errorf("start RDP auth server: %w", err)
+	}
+
+	e.rdpServer = server
+
+	if netstackNet := e.wgInterface.GetNet(); netstackNet != nil {
+		if registrar, ok := e.firewall.(interface {
+			RegisterNetstackService(protocol nftypes.Protocol, port uint16)
+		}); ok {
+			registrar.RegisterNetstackService(nftypes.TCP, rdpserver.InternalRDPAuthPort)
+			log.Debugf("registered RDP auth service with netstack for TCP:%d", rdpserver.InternalRDPAuthPort)
+		}
+	}
+
+	if err := e.setupRDPPortRedirection(); err != nil {
+		log.Warnf("failed to setup RDP auth port redirection: %v", err)
+	}
+
+	// Register the credential provider DLL dynamically (Windows only)
+	if err := rdpserver.RegisterCredentialProvider(); err != nil {
+		log.Warnf("failed to register RDP credential provider (passwordless RDP will not work): %v", err)
+	}
+
+	log.Info("RDP passthrough enabled")
+	return nil
+}
+
+func (e *Engine) stopRDPServer() error {
+	if e.rdpServer == nil {
+		return nil
+	}
+
+	if err := e.cleanupRDPPortRedirection(); err != nil {
+		log.Warnf("failed to cleanup RDP auth port redirection: %v", err)
+	}
+
+	if netstackNet := e.wgInterface.GetNet(); netstackNet != nil {
+		if registrar, ok := e.firewall.(interface {
+			UnregisterNetstackService(protocol nftypes.Protocol, port uint16)
+		}); ok {
+			registrar.UnregisterNetstackService(nftypes.TCP, rdpserver.InternalRDPAuthPort)
+			log.Debugf("unregistered RDP auth service from netstack for TCP:%d", rdpserver.InternalRDPAuthPort)
+		}
+	}
+
+	// Unregister the credential provider DLL (Windows only)
+	if err := rdpserver.UnregisterCredentialProvider(); err != nil {
+		log.Warnf("failed to unregister RDP credential provider: %v", err)
+	}
+
+	log.Info("stopping RDP auth server")
+	err := e.rdpServer.Stop()
+	e.rdpServer = nil
+	if err != nil {
+		return fmt.Errorf("stop: %w", err)
+	}
+	return nil
+}
+
+// updateRDPServerAuth reuses the SSH authorization config for RDP access control.
+// This means the same user/machine-user mappings that control SSH access also control RDP.
+func (e *Engine) updateRDPServerAuth(sshAuth *mgmProto.SSHAuth) {
+	if sshAuth == nil || e.rdpServer == nil {
+		return
+	}
+
+	protoUsers := sshAuth.GetAuthorizedUsers()
+	authorizedUsers := make([]sshuserhash.UserIDHash, len(protoUsers))
+	for i, hash := range protoUsers {
+		if len(hash) != 16 {
+			log.Warnf("invalid hash length %d, expected 16 - skipping RDP server auth update", len(hash))
+			return
+		}
+		authorizedUsers[i] = sshuserhash.UserIDHash(hash)
+	}
+
+	machineUsers := make(map[string][]uint32)
+	for osUser, indexes := range sshAuth.GetMachineUsers() {
+		machineUsers[osUser] = indexes.GetIndexes()
+	}
+
+	authConfig := &sshauth.Config{
+		UserIDClaim:     sshAuth.GetUserIDClaim(),
+		AuthorizedUsers: authorizedUsers,
+		MachineUsers:    machineUsers,
+	}
+
+	e.rdpServer.UpdateRDPAuth(authConfig)
+}

client/internal/engine_test.go

@@ -55,7 +55,6 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/activity"
-	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -1635,12 +1634,7 @@ func startManagement(t *testing.T, dataDir, testFile string) (*grpc.Server, stri
 	peersManager := peers.NewManager(store, permissionsManager)
 	jobManager := job.NewJobManager(nil, store, peersManager)
 
-	cacheStore, err := nbcache.NewStore(context.Background(), 100*time.Millisecond, 300*time.Millisecond, 100)
-	if err != nil {
-		return nil, "", err
-	}
-
-	ia, _ := integrations.NewIntegratedValidator(context.Background(), peersManager, nil, eventStore, cacheStore)
+	ia, _ := integrations.NewIntegratedValidator(context.Background(), peersManager, nil, eventStore)
 
 	metrics, err := telemetry.NewDefaultAppMetrics(context.Background())
 	require.NoError(t, err)
@@ -1662,7 +1656,7 @@ func startManagement(t *testing.T, dataDir, testFile string) (*grpc.Server, stri
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := server.NewAccountRequestBuffer(context.Background(), store)
 	networkMapController := controller.NewController(context.Background(), store, metrics, updateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config)
-	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false)
 	if err != nil {
 		return nil, "", err
 	}

client/internal/netflow/conntrack/conntrack.go

@@ -7,9 +7,7 @@ import (
 	"fmt"
 	"net/netip"
 	"sync"
-	"time"
 
-	"github.com/cenkalti/backoff/v4"
 	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
 	nfct "github.com/ti-mo/conntrack"
@@ -19,64 +17,31 @@ import (
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
-const (
-	defaultChannelSize     = 100
-	reconnectInitInterval  = 5 * time.Second
-	reconnectMaxInterval   = 5 * time.Minute
-	reconnectRandomization = 0.5
-)
-
-// listener abstracts a netlink conntrack connection for testability.
-type listener interface {
-	Listen(evChan chan<- nfct.Event, numWorkers uint8, groups []netfilter.NetlinkGroup) (chan error, error)
-	Close() error
-}
+const defaultChannelSize = 100
 
 // ConnTrack manages kernel-based conntrack events
 type ConnTrack struct {
 	flowLogger nftypes.FlowLogger
 	iface      nftypes.IFaceMapper
 
-	conn listener
+	conn *nfct.Conn
 	mux  sync.Mutex
 
-	dial           func() (listener, error)
 	instanceID     uuid.UUID
 	started        bool
 	done           chan struct{}
 	sysctlModified bool
 }
 
-// DialFunc is a constructor for netlink conntrack connections.
-type DialFunc func() (listener, error)
-
-// Option configures a ConnTrack instance.
-type Option func(*ConnTrack)
-
-// WithDialer overrides the default netlink dialer, primarily for testing.
-func WithDialer(dial DialFunc) Option {
-	return func(c *ConnTrack) {
-		c.dial = dial
-	}
-}
-
-func defaultDial() (listener, error) {
-	return nfct.Dial(nil)
-}
-
 // New creates a new connection tracker that interfaces with the kernel's conntrack system
-func New(flowLogger nftypes.FlowLogger, iface nftypes.IFaceMapper, opts ...Option) *ConnTrack {
-	ct := &ConnTrack{
+func New(flowLogger nftypes.FlowLogger, iface nftypes.IFaceMapper) *ConnTrack {
+	return &ConnTrack{
 		flowLogger: flowLogger,
 		iface:      iface,
 		instanceID: uuid.New(),
-		dial:       defaultDial,
+		started:    false,
 		done:       make(chan struct{}, 1),
 	}
-	for _, opt := range opts {
-		opt(ct)
-	}
-	return ct
 }
 
 // Start begins tracking connections by listening for conntrack events. This method is idempotent.
@@ -94,9 +59,8 @@ func (c *ConnTrack) Start(enableCounters bool) error {
 		c.EnableAccounting()
 	}
 
-	conn, err := c.dial()
+	conn, err := nfct.Dial(nil)
 	if err != nil {
-		c.RestoreAccounting()
 		return fmt.Errorf("dial conntrack: %w", err)
 	}
 	c.conn = conn
@@ -112,16 +76,9 @@ func (c *ConnTrack) Start(enableCounters bool) error {
 			log.Errorf("Error closing conntrack connection: %v", err)
 		}
 		c.conn = nil
-		c.RestoreAccounting()
 		return fmt.Errorf("start conntrack listener: %w", err)
 	}
 
-	// Drain any stale stop signal from a previous cycle.
-	select {
-	case <-c.done:
-	default:
-	}
-
 	c.started = true
 
 	go c.receiverRoutine(events, errChan)
@@ -135,98 +92,17 @@ func (c *ConnTrack) receiverRoutine(events chan nfct.Event, errChan chan error)
 		case event := <-events:
 			c.handleEvent(event)
 		case err := <-errChan:
-			if events, errChan = c.handleListenerError(err); events == nil {
-				return
+			log.Errorf("Error from conntrack event listener: %v", err)
+			if err := c.conn.Close(); err != nil {
+				log.Errorf("Error closing conntrack connection: %v", err)
 			}
+			return
 		case <-c.done:
 			return
 		}
 	}
 }
 
-// handleListenerError closes the failed connection and attempts to reconnect.
-// Returns new channels on success, or nil if shutdown was requested.
-func (c *ConnTrack) handleListenerError(err error) (chan nfct.Event, chan error) {
-	log.Warnf("conntrack event listener failed: %v", err)
-	c.closeConn()
-	return c.reconnect()
-}
-
-func (c *ConnTrack) closeConn() {
-	c.mux.Lock()
-	defer c.mux.Unlock()
-
-	if c.conn != nil {
-		if err := c.conn.Close(); err != nil {
-			log.Debugf("close conntrack connection: %v", err)
-		}
-		c.conn = nil
-	}
-}
-
-// reconnect attempts to re-establish the conntrack netlink listener with exponential backoff.
-// Returns new channels on success, or nil if shutdown was requested.
-func (c *ConnTrack) reconnect() (chan nfct.Event, chan error) {
-	bo := &backoff.ExponentialBackOff{
-		InitialInterval:     reconnectInitInterval,
-		RandomizationFactor: reconnectRandomization,
-		Multiplier:          backoff.DefaultMultiplier,
-		MaxInterval:         reconnectMaxInterval,
-		MaxElapsedTime:      0, // retry indefinitely
-		Clock:               backoff.SystemClock,
-	}
-	bo.Reset()
-
-	for {
-		delay := bo.NextBackOff()
-		log.Infof("reconnecting conntrack listener in %s", delay)
-
-		select {
-		case <-c.done:
-			c.mux.Lock()
-			c.started = false
-			c.mux.Unlock()
-			return nil, nil
-		case <-time.After(delay):
-		}
-
-		conn, err := c.dial()
-		if err != nil {
-			log.Warnf("reconnect conntrack dial: %v", err)
-			continue
-		}
-
-		events := make(chan nfct.Event, defaultChannelSize)
-		errChan, err := conn.Listen(events, 1, []netfilter.NetlinkGroup{
-			netfilter.GroupCTNew,
-			netfilter.GroupCTDestroy,
-		})
-		if err != nil {
-			log.Warnf("reconnect conntrack listen: %v", err)
-			if closeErr := conn.Close(); closeErr != nil {
-				log.Debugf("close conntrack connection: %v", closeErr)
-			}
-			continue
-		}
-
-		c.mux.Lock()
-		if !c.started {
-			// Stop() ran while we were reconnecting.
-			c.mux.Unlock()
-			if closeErr := conn.Close(); closeErr != nil {
-				log.Debugf("close conntrack connection: %v", closeErr)
-			}
-			return nil, nil
-		}
-		c.conn = conn
-		c.mux.Unlock()
-
-		log.Infof("conntrack listener reconnected successfully")
-
-		return events, errChan
-	}
-}
-
 // Stop stops the connection tracking. This method is idempotent.
 func (c *ConnTrack) Stop() {
 	c.mux.Lock()
@@ -260,27 +136,23 @@ func (c *ConnTrack) Close() error {
 	c.mux.Lock()
 	defer c.mux.Unlock()
 
-	if !c.started {
-		return nil
+	if c.started {
+		select {
+		case c.done <- struct{}{}:
+		default:
+		}
 	}
 
-	select {
-	case c.done <- struct{}{}:
-	default:
-	}
-
-	c.started = false
-
-	var closeErr error
 	if c.conn != nil {
-		closeErr = c.conn.Close()
+		err := c.conn.Close()
 		c.conn = nil
-	}
+		c.started = false
 
-	c.RestoreAccounting()
+		c.RestoreAccounting()
 
-	if closeErr != nil {
-		return fmt.Errorf("close conntrack: %w", closeErr)
+		if err != nil {
+			return fmt.Errorf("close conntrack: %w", err)
+		}
 	}
 
 	return nil

client/internal/netflow/conntrack/conntrack_test.go

@@ -1,224 +0,0 @@
-//go:build linux && !android
-
-package conntrack
-
-import (
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	nfct "github.com/ti-mo/conntrack"
-	"github.com/ti-mo/netfilter"
-)
-
-type mockListener struct {
-	errChan  chan error
-	closed   atomic.Bool
-	closedCh chan struct{}
-}
-
-func newMockListener() *mockListener {
-	return &mockListener{
-		errChan:  make(chan error, 1),
-		closedCh: make(chan struct{}),
-	}
-}
-
-func (m *mockListener) Listen(evChan chan<- nfct.Event, _ uint8, _ []netfilter.NetlinkGroup) (chan error, error) {
-	return m.errChan, nil
-}
-
-func (m *mockListener) Close() error {
-	if m.closed.CompareAndSwap(false, true) {
-		close(m.closedCh)
-	}
-	return nil
-}
-
-func TestReconnectAfterError(t *testing.T) {
-	first := newMockListener()
-	second := newMockListener()
-	third := newMockListener()
-	listeners := []*mockListener{first, second, third}
-	callCount := atomic.Int32{}
-
-	ct := New(nil, nil, WithDialer(func() (listener, error) {
-		n := int(callCount.Add(1)) - 1
-		return listeners[n], nil
-	}))
-
-	err := ct.Start(false)
-	require.NoError(t, err)
-
-	// Inject an error on the first listener.
-	first.errChan <- assert.AnError
-
-	// Wait for reconnect to complete.
-	require.Eventually(t, func() bool {
-		return callCount.Load() >= 2
-	}, 15*time.Second, 100*time.Millisecond, "reconnect should dial a new connection")
-
-	// The first connection must have been closed.
-	select {
-	case <-first.closedCh:
-	case <-time.After(2 * time.Second):
-		t.Fatal("first connection was not closed")
-	}
-
-	// Verify the receiver is still running by injecting and handling a second error.
-	second.errChan <- assert.AnError
-
-	require.Eventually(t, func() bool {
-		return callCount.Load() >= 3
-	}, 15*time.Second, 100*time.Millisecond, "second reconnect should succeed")
-
-	ct.Stop()
-}
-
-func TestStopDuringReconnectBackoff(t *testing.T) {
-	mock := newMockListener()
-
-	ct := New(nil, nil, WithDialer(func() (listener, error) {
-		return mock, nil
-	}))
-
-	err := ct.Start(false)
-	require.NoError(t, err)
-
-	// Trigger an error so the receiver enters reconnect.
-	mock.errChan <- assert.AnError
-
-	// Wait for the error handler to close the old listener before calling Stop.
-	select {
-	case <-mock.closedCh:
-	case <-time.After(5 * time.Second):
-		t.Fatal("timed out waiting for reconnect to start")
-	}
-
-	// Stop while reconnecting.
-	ct.Stop()
-
-	ct.mux.Lock()
-	assert.False(t, ct.started, "started should be false after Stop")
-	assert.Nil(t, ct.conn, "conn should be nil after Stop")
-	ct.mux.Unlock()
-}
-
-func TestStopRaceWithReconnectDial(t *testing.T) {
-	first := newMockListener()
-	dialStarted := make(chan struct{})
-	dialProceed := make(chan struct{})
-	second := newMockListener()
-	callCount := atomic.Int32{}
-
-	ct := New(nil, nil, WithDialer(func() (listener, error) {
-		n := callCount.Add(1)
-		if n == 1 {
-			return first, nil
-		}
-		// Second dial: signal that we're in progress, wait for test to call Stop.
-		close(dialStarted)
-		<-dialProceed
-		return second, nil
-	}))
-
-	err := ct.Start(false)
-	require.NoError(t, err)
-
-	// Trigger error to enter reconnect.
-	first.errChan <- assert.AnError
-
-	// Wait for reconnect's second dial to begin.
-	select {
-	case <-dialStarted:
-	case <-time.After(15 * time.Second):
-		t.Fatal("timed out waiting for reconnect dial")
-	}
-
-	// Stop while dial is in progress (conn is nil at this point).
-	ct.Stop()
-
-	// Let the dial complete. reconnect should detect started==false and close the new conn.
-	close(dialProceed)
-
-	// The second connection should be closed (not leaked).
-	select {
-	case <-second.closedCh:
-	case <-time.After(2 * time.Second):
-		t.Fatal("second connection was leaked after Stop")
-	}
-
-	ct.mux.Lock()
-	assert.False(t, ct.started)
-	assert.Nil(t, ct.conn)
-	ct.mux.Unlock()
-}
-
-func TestCloseRaceWithReconnectDial(t *testing.T) {
-	first := newMockListener()
-	dialStarted := make(chan struct{})
-	dialProceed := make(chan struct{})
-	second := newMockListener()
-	callCount := atomic.Int32{}
-
-	ct := New(nil, nil, WithDialer(func() (listener, error) {
-		n := callCount.Add(1)
-		if n == 1 {
-			return first, nil
-		}
-		close(dialStarted)
-		<-dialProceed
-		return second, nil
-	}))
-
-	err := ct.Start(false)
-	require.NoError(t, err)
-
-	first.errChan <- assert.AnError
-
-	select {
-	case <-dialStarted:
-	case <-time.After(15 * time.Second):
-		t.Fatal("timed out waiting for reconnect dial")
-	}
-
-	// Close while dial is in progress (conn is nil).
-	require.NoError(t, ct.Close())
-
-	close(dialProceed)
-
-	// The second connection should be closed (not leaked).
-	select {
-	case <-second.closedCh:
-	case <-time.After(2 * time.Second):
-		t.Fatal("second connection was leaked after Close")
-	}
-
-	ct.mux.Lock()
-	assert.False(t, ct.started)
-	assert.Nil(t, ct.conn)
-	ct.mux.Unlock()
-}
-
-func TestStartIsIdempotent(t *testing.T) {
-	mock := newMockListener()
-	callCount := atomic.Int32{}
-
-	ct := New(nil, nil, WithDialer(func() (listener, error) {
-		callCount.Add(1)
-		return mock, nil
-	}))
-
-	err := ct.Start(false)
-	require.NoError(t, err)
-
-	// Second Start should be a no-op.
-	err = ct.Start(false)
-	require.NoError(t, err)
-
-	assert.Equal(t, int32(1), callCount.Load(), "dial should only be called once")
-
-	ct.Stop()
-}

client/internal/portforward/env.go

@@ -8,27 +8,18 @@ import (
 )
 
 const (
-	envDisableNATMapper      = "NB_DISABLE_NAT_MAPPER"
-	envDisablePCPHealthCheck = "NB_DISABLE_PCP_HEALTH_CHECK"
+	envDisableNATMapper = "NB_DISABLE_NAT_MAPPER"
 )
 
 func isDisabledByEnv() bool {
-	return parseBoolEnv(envDisableNATMapper)
-}
-
-func isHealthCheckDisabled() bool {
-	return parseBoolEnv(envDisablePCPHealthCheck)
-}
-
-func parseBoolEnv(key string) bool {
-	val := os.Getenv(key)
+	val := os.Getenv(envDisableNATMapper)
 	if val == "" {
 		return false
 	}
 
 	disabled, err := strconv.ParseBool(val)
 	if err != nil {
-		log.Warnf("failed to parse %s: %v", key, err)
+		log.Warnf("failed to parse %s: %v", envDisableNATMapper, err)
 		return false
 	}
 	return disabled

client/internal/portforward/manager.go

@@ -12,15 +12,12 @@ import (
 
 	"github.com/libp2p/go-nat"
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/portforward/pcp"
 )
 
 const (
-	defaultMappingTTL   = 2 * time.Hour
-	healthCheckInterval = 1 * time.Minute
-	discoveryTimeout    = 10 * time.Second
-	mappingDescription  = "NetBird"
+	defaultMappingTTL  = 2 * time.Hour
+	discoveryTimeout   = 10 * time.Second
+	mappingDescription = "NetBird"
 )
 
 // upnpErrPermanentLeaseOnly matches UPnP error 725 in SOAP fault XML,
@@ -157,7 +154,7 @@ func (m *Manager) setup(ctx context.Context) (nat.NAT, *Mapping, error) {
 	discoverCtx, discoverCancel := context.WithTimeout(ctx, discoveryTimeout)
 	defer discoverCancel()
 
-	gateway, err := discoverGateway(discoverCtx)
+	gateway, err := nat.DiscoverGateway(discoverCtx)
 	if err != nil {
 		return nil, nil, fmt.Errorf("discover gateway: %w", err)
 	}
@@ -192,6 +189,7 @@ func (m *Manager) createMapping(ctx context.Context, gateway nat.NAT) (*Mapping,
 	externalIP, err := gateway.GetExternalAddress()
 	if err != nil {
 		log.Debugf("failed to get external address: %v", err)
+		// todo return with err?
 	}
 
 	mapping := &Mapping{
@@ -210,87 +208,27 @@ func (m *Manager) createMapping(ctx context.Context, gateway nat.NAT) (*Mapping,
 
 func (m *Manager) renewLoop(ctx context.Context, gateway nat.NAT, ttl time.Duration) {
 	if ttl == 0 {
-		// Permanent mappings don't expire, just wait for cancellation
-		// but still run health checks for PCP gateways.
-		m.permanentLeaseLoop(ctx, gateway)
+		// Permanent mappings don't expire, just wait for cancellation.
+		<-ctx.Done()
 		return
 	}
 
-	renewTicker := time.NewTicker(ttl / 2)
-	healthTicker := time.NewTicker(healthCheckInterval)
-	defer renewTicker.Stop()
-	defer healthTicker.Stop()
+	ticker := time.NewTicker(ttl / 2)
+	defer ticker.Stop()
 
 	for {
 		select {
 		case <-ctx.Done():
 			return
-		case <-renewTicker.C:
+		case <-ticker.C:
 			if err := m.renewMapping(ctx, gateway); err != nil {
 				log.Warnf("failed to renew port mapping: %v", err)
 				continue
 			}
-		case <-healthTicker.C:
-			if m.checkHealthAndRecreate(ctx, gateway) {
-				renewTicker.Reset(ttl / 2)
-			}
 		}
 	}
 }
 
-func (m *Manager) permanentLeaseLoop(ctx context.Context, gateway nat.NAT) {
-	healthTicker := time.NewTicker(healthCheckInterval)
-	defer healthTicker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-healthTicker.C:
-			m.checkHealthAndRecreate(ctx, gateway)
-		}
-	}
-}
-
-func (m *Manager) checkHealthAndRecreate(ctx context.Context, gateway nat.NAT) bool {
-	if isHealthCheckDisabled() {
-		return false
-	}
-
-	m.mappingLock.Lock()
-	hasMapping := m.mapping != nil
-	m.mappingLock.Unlock()
-
-	if !hasMapping {
-		return false
-	}
-
-	pcpNAT, ok := gateway.(*pcp.NAT)
-	if !ok {
-		return false
-	}
-
-	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
-	defer cancel()
-
-	epoch, serverRestarted, err := pcpNAT.CheckServerHealth(ctx)
-	if err != nil {
-		log.Debugf("PCP health check failed: %v", err)
-		return false
-	}
-
-	if serverRestarted {
-		log.Warnf("PCP server restart detected (epoch=%d), recreating port mapping", epoch)
-		if err := m.renewMapping(ctx, gateway); err != nil {
-			log.Errorf("failed to recreate port mapping after server restart: %v", err)
-			return false
-		}
-		return true
-	}
-
-	return false
-}
-
 func (m *Manager) renewMapping(ctx context.Context, gateway nat.NAT) error {
 	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
 	defer cancel()

client/internal/portforward/pcp/client.go

@@ -1,408 +0,0 @@
-package pcp
-
-import (
-	"context"
-	"crypto/rand"
-	"errors"
-	"fmt"
-	"net"
-	"net/netip"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	defaultTimeout     = 3 * time.Second
-	responseBufferSize = 128
-
-	// RFC 6887 Section 8.1.1 retry timing
-	initialRetryDelay = 3 * time.Second
-	maxRetryDelay     = 1024 * time.Second
-	maxRetries        = 4 // 3s + 6s + 12s + 24s = 45s total worst case
-)
-
-// Client is a PCP protocol client.
-// All methods are safe for concurrent use.
-type Client struct {
-	gateway netip.Addr
-	timeout time.Duration
-
-	mu sync.Mutex
-	// localIP caches the resolved local IP address.
-	localIP netip.Addr
-	// lastEpoch is the last observed server epoch value.
-	lastEpoch uint32
-	// epochTime tracks when lastEpoch was received for state loss detection.
-	epochTime time.Time
-	// externalIP caches the external IP from the last successful MAP response.
-	externalIP netip.Addr
-	// epochStateLost is set when epoch indicates server restart.
-	epochStateLost bool
-}
-
-// NewClient creates a new PCP client for the gateway at the given IP.
-func NewClient(gateway net.IP) *Client {
-	addr, ok := netip.AddrFromSlice(gateway)
-	if !ok {
-		log.Debugf("invalid gateway IP: %v", gateway)
-	}
-	return &Client{
-		gateway: addr.Unmap(),
-		timeout: defaultTimeout,
-	}
-}
-
-// NewClientWithTimeout creates a new PCP client with a custom timeout.
-func NewClientWithTimeout(gateway net.IP, timeout time.Duration) *Client {
-	addr, ok := netip.AddrFromSlice(gateway)
-	if !ok {
-		log.Debugf("invalid gateway IP: %v", gateway)
-	}
-	return &Client{
-		gateway: addr.Unmap(),
-		timeout: timeout,
-	}
-}
-
-// SetLocalIP sets the local IP address to use in PCP requests.
-func (c *Client) SetLocalIP(ip net.IP) {
-	addr, ok := netip.AddrFromSlice(ip)
-	if !ok {
-		log.Debugf("invalid local IP: %v", ip)
-	}
-	c.mu.Lock()
-	c.localIP = addr.Unmap()
-	c.mu.Unlock()
-}
-
-// Gateway returns the gateway IP address.
-func (c *Client) Gateway() net.IP {
-	return c.gateway.AsSlice()
-}
-
-// Announce sends a PCP ANNOUNCE request to discover PCP support.
-// Returns the server's epoch time on success.
-func (c *Client) Announce(ctx context.Context) (epoch uint32, err error) {
-	localIP, err := c.getLocalIP()
-	if err != nil {
-		return 0, fmt.Errorf("get local IP: %w", err)
-	}
-
-	req := buildAnnounceRequest(localIP)
-	resp, err := c.sendRequest(ctx, req)
-	if err != nil {
-		return 0, fmt.Errorf("send announce: %w", err)
-	}
-
-	parsed, err := parseResponse(resp)
-	if err != nil {
-		return 0, fmt.Errorf("parse announce response: %w", err)
-	}
-
-	if parsed.ResultCode != ResultSuccess {
-		return 0, fmt.Errorf("PCP ANNOUNCE failed: %s", ResultCodeString(parsed.ResultCode))
-	}
-
-	c.mu.Lock()
-	if c.updateEpochLocked(parsed.Epoch) {
-		log.Warnf("PCP server epoch indicates state loss - mappings may need refresh")
-	}
-	c.mu.Unlock()
-	return parsed.Epoch, nil
-}
-
-// AddPortMapping requests a port mapping from the PCP server.
-func (c *Client) AddPortMapping(ctx context.Context, protocol string, internalPort int, lifetime time.Duration) (*MapResponse, error) {
-	return c.addPortMappingWithHint(ctx, protocol, internalPort, internalPort, netip.Addr{}, lifetime)
-}
-
-// AddPortMappingWithHint requests a port mapping with suggested external port and IP.
-// Use lifetime <= 0 to delete a mapping.
-func (c *Client) AddPortMappingWithHint(ctx context.Context, protocol string, internalPort, suggestedExtPort int, suggestedExtIP net.IP, lifetime time.Duration) (*MapResponse, error) {
-	var extIP netip.Addr
-	if suggestedExtIP != nil {
-		var ok bool
-		extIP, ok = netip.AddrFromSlice(suggestedExtIP)
-		if !ok {
-			log.Debugf("invalid suggested external IP: %v", suggestedExtIP)
-		}
-		extIP = extIP.Unmap()
-	}
-	return c.addPortMappingWithHint(ctx, protocol, internalPort, suggestedExtPort, extIP, lifetime)
-}
-
-func (c *Client) addPortMappingWithHint(ctx context.Context, protocol string, internalPort, suggestedExtPort int, suggestedExtIP netip.Addr, lifetime time.Duration) (*MapResponse, error) {
-	localIP, err := c.getLocalIP()
-	if err != nil {
-		return nil, fmt.Errorf("get local IP: %w", err)
-	}
-
-	proto, err := protocolNumber(protocol)
-	if err != nil {
-		return nil, fmt.Errorf("parse protocol: %w", err)
-	}
-
-	var nonce [12]byte
-	if _, err := rand.Read(nonce[:]); err != nil {
-		return nil, fmt.Errorf("generate nonce: %w", err)
-	}
-
-	// Convert lifetime to seconds. Lifetime 0 means delete, so only apply
-	// default for positive durations that round to 0 seconds.
-	var lifetimeSec uint32
-	if lifetime > 0 {
-		lifetimeSec = uint32(lifetime.Seconds())
-		if lifetimeSec == 0 {
-			lifetimeSec = DefaultLifetime
-		}
-	}
-
-	req := buildMapRequest(localIP, nonce, proto, uint16(internalPort), uint16(suggestedExtPort), suggestedExtIP, lifetimeSec)
-
-	resp, err := c.sendRequest(ctx, req)
-	if err != nil {
-		return nil, fmt.Errorf("send map request: %w", err)
-	}
-
-	mapResp, err := parseMapResponse(resp)
-	if err != nil {
-		return nil, fmt.Errorf("parse map response: %w", err)
-	}
-
-	if mapResp.Nonce != nonce {
-		return nil, fmt.Errorf("nonce mismatch in response")
-	}
-
-	if mapResp.Protocol != proto {
-		return nil, fmt.Errorf("protocol mismatch: requested %d, got %d", proto, mapResp.Protocol)
-	}
-	if mapResp.InternalPort != uint16(internalPort) {
-		return nil, fmt.Errorf("internal port mismatch: requested %d, got %d", internalPort, mapResp.InternalPort)
-	}
-
-	if mapResp.ResultCode != ResultSuccess {
-		return nil, &Error{
-			Code:    mapResp.ResultCode,
-			Message: ResultCodeString(mapResp.ResultCode),
-		}
-	}
-
-	c.mu.Lock()
-	if c.updateEpochLocked(mapResp.Epoch) {
-		log.Warnf("PCP server epoch indicates state loss - mappings may need refresh")
-	}
-	c.cacheExternalIPLocked(mapResp.ExternalIP)
-	c.mu.Unlock()
-	return mapResp, nil
-}
-
-// DeletePortMapping removes a port mapping by requesting zero lifetime.
-func (c *Client) DeletePortMapping(ctx context.Context, protocol string, internalPort int) error {
-	if _, err := c.addPortMappingWithHint(ctx, protocol, internalPort, 0, netip.Addr{}, 0); err != nil {
-		var pcpErr *Error
-		if errors.As(err, &pcpErr) && pcpErr.Code == ResultNotAuthorized {
-			return nil
-		}
-		return fmt.Errorf("delete mapping: %w", err)
-	}
-	return nil
-}
-
-// GetExternalAddress returns the external IP address.
-// First checks for a cached value from previous MAP responses.
-// If not cached, creates a short-lived mapping to discover the external IP.
-func (c *Client) GetExternalAddress(ctx context.Context) (net.IP, error) {
-	c.mu.Lock()
-	if c.externalIP.IsValid() {
-		ip := c.externalIP.AsSlice()
-		c.mu.Unlock()
-		return ip, nil
-	}
-	c.mu.Unlock()
-
-	// Use an ephemeral port in the dynamic range (49152-65535).
-	// Port 0 is not valid with UDP/TCP protocols per RFC 6887.
-	ephemeralPort := 49152 + int(uint16(time.Now().UnixNano()))%(65535-49152)
-
-	// Use minimal lifetime (1 second) for discovery.
-	resp, err := c.AddPortMapping(ctx, "udp", ephemeralPort, time.Second)
-	if err != nil {
-		return nil, fmt.Errorf("create temporary mapping: %w", err)
-	}
-
-	if err := c.DeletePortMapping(ctx, "udp", ephemeralPort); err != nil {
-		log.Debugf("cleanup temporary PCP mapping: %v", err)
-	}
-
-	return resp.ExternalIP.AsSlice(), nil
-}
-
-// LastEpoch returns the last observed server epoch value.
-// A decrease in epoch indicates the server may have restarted and mappings may be lost.
-func (c *Client) LastEpoch() uint32 {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return c.lastEpoch
-}
-
-// EpochStateLost returns true if epoch state loss was detected and clears the flag.
-func (c *Client) EpochStateLost() bool {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	lost := c.epochStateLost
-	c.epochStateLost = false
-	return lost
-}
-
-// updateEpoch updates the epoch tracking and detects potential state loss.
-// Returns true if state loss was detected (server likely restarted).
-// Caller must hold c.mu.
-func (c *Client) updateEpochLocked(newEpoch uint32) bool {
-	now := time.Now()
-	stateLost := false
-
-	// RFC 6887 Section 8.5: Detect invalid epoch indicating server state loss.
-	// client_delta = time since last response
-	// server_delta = epoch change since last response
-	// Invalid if: client_delta+2 < server_delta - server_delta/16
-	//         OR: server_delta+2 < client_delta - client_delta/16
-	// The +2 handles quantization, /16 (6.25%) handles clock drift.
-	if !c.epochTime.IsZero() && c.lastEpoch > 0 {
-		clientDelta := uint32(now.Sub(c.epochTime).Seconds())
-		serverDelta := newEpoch - c.lastEpoch
-
-		// Check for epoch going backwards or jumping unexpectedly.
-		// Subtraction is safe: serverDelta/16 is always <= serverDelta.
-		if clientDelta+2 < serverDelta-(serverDelta/16) ||
-			serverDelta+2 < clientDelta-(clientDelta/16) {
-			stateLost = true
-			c.epochStateLost = true
-		}
-	}
-
-	c.lastEpoch = newEpoch
-	c.epochTime = now
-	return stateLost
-}
-
-// cacheExternalIP stores the external IP from a successful MAP response.
-// Caller must hold c.mu.
-func (c *Client) cacheExternalIPLocked(ip netip.Addr) {
-	if ip.IsValid() && !ip.IsUnspecified() {
-		c.externalIP = ip
-	}
-}
-
-// sendRequest sends a PCP request with retries per RFC 6887 Section 8.1.1.
-func (c *Client) sendRequest(ctx context.Context, req []byte) ([]byte, error) {
-	addr := &net.UDPAddr{IP: c.gateway.AsSlice(), Port: Port}
-
-	var lastErr error
-	delay := initialRetryDelay
-
-	for range maxRetries {
-		resp, err := c.sendOnce(ctx, addr, req)
-		if err == nil {
-			return resp, nil
-		}
-		lastErr = err
-
-		if ctx.Err() != nil {
-			return nil, ctx.Err()
-		}
-
-		// RFC 6887 Section 8.1.1: RT = (1 + RAND) * MIN(2 * RTprev, MRT)
-		// RAND is random between -0.1 and +0.1
-		select {
-		case <-ctx.Done():
-			return nil, ctx.Err()
-		case <-time.After(retryDelayWithJitter(delay)):
-		}
-		delay = min(delay*2, maxRetryDelay)
-	}
-
-	return nil, fmt.Errorf("PCP request failed after %d retries: %w", maxRetries, lastErr)
-}
-
-// retryDelayWithJitter applies RFC 6887 jitter: multiply by (1 + RAND) where RAND is [-0.1, +0.1].
-func retryDelayWithJitter(d time.Duration) time.Duration {
-	var b [1]byte
-	_, _ = rand.Read(b[:])
-	// Convert byte to range [-0.1, +0.1]: (b/255 * 0.2) - 0.1
-	jitter := (float64(b[0])/255.0)*0.2 - 0.1
-	return time.Duration(float64(d) * (1 + jitter))
-}
-
-func (c *Client) sendOnce(ctx context.Context, addr *net.UDPAddr, req []byte) ([]byte, error) {
-	// Use ListenUDP instead of DialUDP to validate response source address per RFC 6887 §8.3.
-	conn, err := net.ListenUDP("udp", nil)
-	if err != nil {
-		return nil, fmt.Errorf("listen: %w", err)
-	}
-	defer func() {
-		if err := conn.Close(); err != nil {
-			log.Debugf("close UDP connection: %v", err)
-		}
-	}()
-
-	timeout := c.timeout
-	if deadline, ok := ctx.Deadline(); ok {
-		if remaining := time.Until(deadline); remaining < timeout {
-			timeout = remaining
-		}
-	}
-
-	if err := conn.SetDeadline(time.Now().Add(timeout)); err != nil {
-		return nil, fmt.Errorf("set deadline: %w", err)
-	}
-
-	if _, err := conn.WriteToUDP(req, addr); err != nil {
-		return nil, fmt.Errorf("write: %w", err)
-	}
-
-	resp := make([]byte, responseBufferSize)
-	n, from, err := conn.ReadFromUDP(resp)
-	if err != nil {
-		return nil, fmt.Errorf("read: %w", err)
-	}
-
-	// RFC 6887 §8.3: Validate response came from expected PCP server.
-	if !from.IP.Equal(addr.IP) {
-		return nil, fmt.Errorf("response from unexpected source %s (expected %s)", from.IP, addr.IP)
-	}
-
-	return resp[:n], nil
-}
-
-func (c *Client) getLocalIP() (netip.Addr, error) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if !c.localIP.IsValid() {
-		return netip.Addr{}, fmt.Errorf("local IP not set for gateway %s", c.gateway)
-	}
-	return c.localIP, nil
-}
-
-func protocolNumber(protocol string) (uint8, error) {
-	switch protocol {
-	case "udp", "UDP":
-		return ProtoUDP, nil
-	case "tcp", "TCP":
-		return ProtoTCP, nil
-	default:
-		return 0, fmt.Errorf("unsupported protocol: %s", protocol)
-	}
-}
-
-// Error represents a PCP error response.
-type Error struct {
-	Code    uint8
-	Message string
-}
-
-func (e *Error) Error() string {
-	return fmt.Sprintf("PCP error: %s (%d)", e.Message, e.Code)
-}

client/internal/portforward/pcp/client_test.go

@@ -1,187 +0,0 @@
-package pcp
-
-import (
-	"context"
-	"net"
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestAddrConversion(t *testing.T) {
-	tests := []struct {
-		name string
-		addr netip.Addr
-	}{
-		{"IPv4", netip.MustParseAddr("192.168.1.100")},
-		{"IPv4 loopback", netip.MustParseAddr("127.0.0.1")},
-		{"IPv6", netip.MustParseAddr("2001:db8::1")},
-		{"IPv6 loopback", netip.MustParseAddr("::1")},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			b16 := addrTo16(tt.addr)
-
-			recovered := addrFrom16(b16)
-			assert.Equal(t, tt.addr, recovered, "address should round-trip")
-		})
-	}
-}
-
-func TestBuildAnnounceRequest(t *testing.T) {
-	clientIP := netip.MustParseAddr("192.168.1.100")
-	req := buildAnnounceRequest(clientIP)
-
-	require.Len(t, req, headerSize)
-	assert.Equal(t, byte(Version), req[0], "version")
-	assert.Equal(t, byte(OpAnnounce), req[1], "opcode")
-
-	// Check client IP is properly encoded as IPv4-mapped IPv6
-	assert.Equal(t, byte(0xff), req[18], "IPv4-mapped prefix byte 10")
-	assert.Equal(t, byte(0xff), req[19], "IPv4-mapped prefix byte 11")
-	assert.Equal(t, byte(192), req[20], "IP octet 1")
-	assert.Equal(t, byte(168), req[21], "IP octet 2")
-	assert.Equal(t, byte(1), req[22], "IP octet 3")
-	assert.Equal(t, byte(100), req[23], "IP octet 4")
-}
-
-func TestBuildMapRequest(t *testing.T) {
-	clientIP := netip.MustParseAddr("192.168.1.100")
-	nonce := [12]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12}
-	req := buildMapRequest(clientIP, nonce, ProtoUDP, 51820, 51820, netip.Addr{}, 3600)
-
-	require.Len(t, req, mapRequestSize)
-	assert.Equal(t, byte(Version), req[0], "version")
-	assert.Equal(t, byte(OpMap), req[1], "opcode")
-
-	// Lifetime at bytes 4-7
-	assert.Equal(t, uint32(3600), (uint32(req[4])<<24)|(uint32(req[5])<<16)|(uint32(req[6])<<8)|uint32(req[7]), "lifetime")
-
-	// Nonce at bytes 24-35
-	assert.Equal(t, nonce[:], req[24:36], "nonce")
-
-	// Protocol at byte 36
-	assert.Equal(t, byte(ProtoUDP), req[36], "protocol")
-
-	// Internal port at bytes 40-41
-	assert.Equal(t, uint16(51820), (uint16(req[40])<<8)|uint16(req[41]), "internal port")
-
-	// External port at bytes 42-43
-	assert.Equal(t, uint16(51820), (uint16(req[42])<<8)|uint16(req[43]), "external port")
-}
-
-func TestParseResponse(t *testing.T) {
-	// Construct a valid ANNOUNCE response
-	resp := make([]byte, headerSize)
-	resp[0] = Version
-	resp[1] = OpAnnounce | OpReply
-	// Result code = 0 (success)
-	// Lifetime = 0
-	// Epoch = 12345
-	resp[8] = 0
-	resp[9] = 0
-	resp[10] = 0x30
-	resp[11] = 0x39
-
-	parsed, err := parseResponse(resp)
-	require.NoError(t, err)
-	assert.Equal(t, uint8(Version), parsed.Version)
-	assert.Equal(t, uint8(OpAnnounce|OpReply), parsed.Opcode)
-	assert.Equal(t, uint8(ResultSuccess), parsed.ResultCode)
-	assert.Equal(t, uint32(12345), parsed.Epoch)
-}
-
-func TestParseResponseErrors(t *testing.T) {
-	t.Run("too short", func(t *testing.T) {
-		_, err := parseResponse([]byte{1, 2, 3})
-		assert.Error(t, err)
-	})
-
-	t.Run("wrong version", func(t *testing.T) {
-		resp := make([]byte, headerSize)
-		resp[0] = 1 // Wrong version
-		resp[1] = OpReply
-		_, err := parseResponse(resp)
-		assert.Error(t, err)
-	})
-
-	t.Run("missing reply bit", func(t *testing.T) {
-		resp := make([]byte, headerSize)
-		resp[0] = Version
-		resp[1] = OpAnnounce // Missing OpReply bit
-		_, err := parseResponse(resp)
-		assert.Error(t, err)
-	})
-}
-
-func TestResultCodeString(t *testing.T) {
-	assert.Equal(t, "SUCCESS", ResultCodeString(ResultSuccess))
-	assert.Equal(t, "NOT_AUTHORIZED", ResultCodeString(ResultNotAuthorized))
-	assert.Equal(t, "ADDRESS_MISMATCH", ResultCodeString(ResultAddressMismatch))
-	assert.Contains(t, ResultCodeString(255), "UNKNOWN")
-}
-
-func TestProtocolNumber(t *testing.T) {
-	proto, err := protocolNumber("udp")
-	require.NoError(t, err)
-	assert.Equal(t, uint8(ProtoUDP), proto)
-
-	proto, err = protocolNumber("tcp")
-	require.NoError(t, err)
-	assert.Equal(t, uint8(ProtoTCP), proto)
-
-	proto, err = protocolNumber("UDP")
-	require.NoError(t, err)
-	assert.Equal(t, uint8(ProtoUDP), proto)
-
-	_, err = protocolNumber("icmp")
-	assert.Error(t, err)
-}
-
-func TestClientCreation(t *testing.T) {
-	gateway := netip.MustParseAddr("192.168.1.1").AsSlice()
-
-	client := NewClient(gateway)
-	assert.Equal(t, net.IP(gateway), client.Gateway())
-	assert.Equal(t, defaultTimeout, client.timeout)
-
-	clientWithTimeout := NewClientWithTimeout(gateway, 5*time.Second)
-	assert.Equal(t, 5*time.Second, clientWithTimeout.timeout)
-}
-
-func TestNATType(t *testing.T) {
-	n := NewNAT(netip.MustParseAddr("192.168.1.1").AsSlice(), netip.MustParseAddr("192.168.1.100").AsSlice())
-	assert.Equal(t, "PCP", n.Type())
-}
-
-// Integration test - skipped unless PCP_TEST_GATEWAY env is set
-func TestClientIntegration(t *testing.T) {
-	t.Skip("Integration test - run manually with PCP_TEST_GATEWAY=<gateway-ip>")
-
-	gateway := netip.MustParseAddr("10.0.1.1").AsSlice()   // Change to your test gateway
-	localIP := netip.MustParseAddr("10.0.1.100").AsSlice() // Change to your local IP
-
-	client := NewClient(gateway)
-	client.SetLocalIP(localIP)
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	// Test ANNOUNCE
-	epoch, err := client.Announce(ctx)
-	require.NoError(t, err)
-	t.Logf("Server epoch: %d", epoch)
-
-	// Test MAP
-	resp, err := client.AddPortMapping(ctx, "udp", 51820, 1*time.Hour)
-	require.NoError(t, err)
-	t.Logf("Mapping: internal=%d external=%d externalIP=%s",
-		resp.InternalPort, resp.ExternalPort, resp.ExternalIP)
-
-	// Cleanup
-	err = client.DeletePortMapping(ctx, "udp", 51820)
-	require.NoError(t, err)
-}

client/internal/portforward/pcp/nat.go

@@ -1,209 +0,0 @@
-package pcp
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/netip"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/libp2p/go-nat"
-	"github.com/libp2p/go-netroute"
-)
-
-var _ nat.NAT = (*NAT)(nil)
-
-// NAT implements the go-nat NAT interface using PCP.
-// Supports dual-stack (IPv4 and IPv6) when available.
-// All methods are safe for concurrent use.
-//
-// TODO: IPv6 pinholes use the local IPv6 address. If the address changes
-// (e.g., due to SLAAC rotation or network change), the pinhole becomes stale
-// and needs to be recreated with the new address.
-type NAT struct {
-	client *Client
-
-	mu sync.RWMutex
-	// client6 is the IPv6 PCP client, nil if IPv6 is unavailable.
-	client6 *Client
-	// localIP6 caches the local IPv6 address used for PCP requests.
-	localIP6 netip.Addr
-}
-
-// NewNAT creates a new NAT instance backed by PCP.
-func NewNAT(gateway, localIP net.IP) *NAT {
-	client := NewClient(gateway)
-	client.SetLocalIP(localIP)
-	return &NAT{
-		client: client,
-	}
-}
-
-// Type returns "PCP" as the NAT type.
-func (n *NAT) Type() string {
-	return "PCP"
-}
-
-// GetDeviceAddress returns the gateway IP address.
-func (n *NAT) GetDeviceAddress() (net.IP, error) {
-	return n.client.Gateway(), nil
-}
-
-// GetExternalAddress returns the external IP address.
-func (n *NAT) GetExternalAddress() (net.IP, error) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	return n.client.GetExternalAddress(ctx)
-}
-
-// GetInternalAddress returns the local IP address used to communicate with the gateway.
-func (n *NAT) GetInternalAddress() (net.IP, error) {
-	addr, err := n.client.getLocalIP()
-	if err != nil {
-		return nil, err
-	}
-	return addr.AsSlice(), nil
-}
-
-// AddPortMapping creates a port mapping on both IPv4 and IPv6 (if available).
-func (n *NAT) AddPortMapping(ctx context.Context, protocol string, internalPort int, _ string, timeout time.Duration) (int, error) {
-	resp, err := n.client.AddPortMapping(ctx, protocol, internalPort, timeout)
-	if err != nil {
-		return 0, fmt.Errorf("add mapping: %w", err)
-	}
-
-	n.mu.RLock()
-	client6 := n.client6
-	localIP6 := n.localIP6
-	n.mu.RUnlock()
-
-	if client6 == nil {
-		return int(resp.ExternalPort), nil
-	}
-
-	if _, err := client6.AddPortMapping(ctx, protocol, internalPort, timeout); err != nil {
-		log.Warnf("IPv6 PCP mapping failed (continuing with IPv4): %v", err)
-		return int(resp.ExternalPort), nil
-	}
-
-	log.Infof("created IPv6 PCP pinhole: %s:%d", localIP6, internalPort)
-	return int(resp.ExternalPort), nil
-}
-
-// DeletePortMapping removes a port mapping from both IPv4 and IPv6.
-func (n *NAT) DeletePortMapping(ctx context.Context, protocol string, internalPort int) error {
-	err := n.client.DeletePortMapping(ctx, protocol, internalPort)
-
-	n.mu.RLock()
-	client6 := n.client6
-	n.mu.RUnlock()
-
-	if client6 != nil {
-		if err6 := client6.DeletePortMapping(ctx, protocol, internalPort); err6 != nil {
-			log.Warnf("IPv6 PCP delete mapping failed: %v", err6)
-		}
-	}
-
-	if err != nil {
-		return fmt.Errorf("delete mapping: %w", err)
-	}
-	return nil
-}
-
-// CheckServerHealth sends an ANNOUNCE to verify the server is still responsive.
-// Returns the current epoch and whether the server may have restarted (epoch state loss detected).
-func (n *NAT) CheckServerHealth(ctx context.Context) (epoch uint32, serverRestarted bool, err error) {
-	epoch, err = n.client.Announce(ctx)
-	if err != nil {
-		return 0, false, fmt.Errorf("announce: %w", err)
-	}
-	return epoch, n.client.EpochStateLost(), nil
-}
-
-// DiscoverPCP attempts to discover a PCP-capable gateway.
-// Returns a NAT interface if PCP is supported, or an error otherwise.
-// Discovers both IPv4 and IPv6 gateways when available.
-func DiscoverPCP(ctx context.Context) (nat.NAT, error) {
-	gateway, localIP, err := getDefaultGateway()
-	if err != nil {
-		return nil, fmt.Errorf("get default gateway: %w", err)
-	}
-
-	client := NewClient(gateway)
-	client.SetLocalIP(localIP)
-	if _, err := client.Announce(ctx); err != nil {
-		return nil, fmt.Errorf("PCP announce: %w", err)
-	}
-
-	result := &NAT{client: client}
-	discoverIPv6(ctx, result)
-
-	return result, nil
-}
-
-func discoverIPv6(ctx context.Context, result *NAT) {
-	gateway6, localIP6, err := getDefaultGateway6()
-	if err != nil {
-		log.Debugf("IPv6 gateway discovery failed: %v", err)
-		return
-	}
-
-	client6 := NewClient(gateway6)
-	client6.SetLocalIP(localIP6)
-	if _, err := client6.Announce(ctx); err != nil {
-		log.Debugf("PCP IPv6 announce failed: %v", err)
-		return
-	}
-
-	addr, ok := netip.AddrFromSlice(localIP6)
-	if !ok {
-		log.Debugf("invalid IPv6 local IP: %v", localIP6)
-		return
-	}
-	result.mu.Lock()
-	result.client6 = client6
-	result.localIP6 = addr
-	result.mu.Unlock()
-	log.Debugf("PCP IPv6 gateway discovered: %s (local: %s)", gateway6, localIP6)
-}
-
-// getDefaultGateway returns the default IPv4 gateway and local IP using the system routing table.
-func getDefaultGateway() (gateway net.IP, localIP net.IP, err error) {
-	router, err := netroute.New()
-	if err != nil {
-		return nil, nil, err
-	}
-
-	_, gateway, localIP, err = router.Route(net.IPv4zero)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	if gateway == nil {
-		return nil, nil, nat.ErrNoNATFound
-	}
-
-	return gateway, localIP, nil
-}
-
-// getDefaultGateway6 returns the default IPv6 gateway IP address using the system routing table.
-func getDefaultGateway6() (gateway net.IP, localIP net.IP, err error) {
-	router, err := netroute.New()
-	if err != nil {
-		return nil, nil, err
-	}
-
-	_, gateway, localIP, err = router.Route(net.IPv6zero)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	if gateway == nil {
-		return nil, nil, nat.ErrNoNATFound
-	}
-
-	return gateway, localIP, nil
-}

client/internal/portforward/pcp/protocol.go

@@ -1,225 +0,0 @@
-// Package pcp implements the Port Control Protocol (RFC 6887).
-//
-// # Implemented Features
-//
-//   - ANNOUNCE opcode: Discovers PCP server support
-//   - MAP opcode: Creates/deletes port mappings (IPv4 NAT) and firewall pinholes (IPv6)
-//   - Dual-stack: Simultaneous IPv4 and IPv6 support via separate clients
-//   - Nonce validation: Prevents response spoofing
-//   - Epoch tracking: Detects server restarts per Section 8.5
-//   - RFC-compliant retry timing: 3s initial, exponential backoff to 1024s max (Section 8.1.1)
-//
-// # Not Implemented
-//
-//   - PEER opcode: For outbound peer connections (not needed for inbound NAT traversal)
-//   - THIRD_PARTY option: For managing mappings on behalf of other devices
-//   - PREFER_FAILURE option: Requires exact external port or fail (IPv4 NAT only, not needed for IPv6 pinholing)
-//   - FILTER option: To restrict remote peer addresses
-//
-// These optional features are omitted because the primary use case is simple
-// port forwarding for WireGuard, which only requires MAP with default behavior.
-package pcp
-
-import (
-	"encoding/binary"
-	"fmt"
-	"net/netip"
-)
-
-const (
-	// Version is the PCP protocol version (RFC 6887).
-	Version = 2
-
-	// Port is the standard PCP server port.
-	Port = 5351
-
-	// DefaultLifetime is the default requested mapping lifetime in seconds.
-	DefaultLifetime = 7200 // 2 hours
-
-	// Header sizes
-	headerSize     = 24
-	mapPayloadSize = 36
-	mapRequestSize = headerSize + mapPayloadSize // 60 bytes
-)
-
-// Opcodes
-const (
-	OpAnnounce = 0
-	OpMap      = 1
-	OpPeer     = 2
-	OpReply    = 0x80 // OR'd with opcode in responses
-)
-
-// Protocol numbers for MAP requests
-const (
-	ProtoUDP = 17
-	ProtoTCP = 6
-)
-
-// Result codes (RFC 6887 Section 7.4)
-const (
-	ResultSuccess              = 0
-	ResultUnsuppVersion        = 1
-	ResultNotAuthorized        = 2
-	ResultMalformedRequest     = 3
-	ResultUnsuppOpcode         = 4
-	ResultUnsuppOption         = 5
-	ResultMalformedOption      = 6
-	ResultNetworkFailure       = 7
-	ResultNoResources          = 8
-	ResultUnsuppProtocol       = 9
-	ResultUserExQuota          = 10
-	ResultCannotProvideExt     = 11
-	ResultAddressMismatch      = 12
-	ResultExcessiveRemotePeers = 13
-)
-
-// ResultCodeString returns a human-readable string for a result code.
-func ResultCodeString(code uint8) string {
-	switch code {
-	case ResultSuccess:
-		return "SUCCESS"
-	case ResultUnsuppVersion:
-		return "UNSUPP_VERSION"
-	case ResultNotAuthorized:
-		return "NOT_AUTHORIZED"
-	case ResultMalformedRequest:
-		return "MALFORMED_REQUEST"
-	case ResultUnsuppOpcode:
-		return "UNSUPP_OPCODE"
-	case ResultUnsuppOption:
-		return "UNSUPP_OPTION"
-	case ResultMalformedOption:
-		return "MALFORMED_OPTION"
-	case ResultNetworkFailure:
-		return "NETWORK_FAILURE"
-	case ResultNoResources:
-		return "NO_RESOURCES"
-	case ResultUnsuppProtocol:
-		return "UNSUPP_PROTOCOL"
-	case ResultUserExQuota:
-		return "USER_EX_QUOTA"
-	case ResultCannotProvideExt:
-		return "CANNOT_PROVIDE_EXTERNAL"
-	case ResultAddressMismatch:
-		return "ADDRESS_MISMATCH"
-	case ResultExcessiveRemotePeers:
-		return "EXCESSIVE_REMOTE_PEERS"
-	default:
-		return fmt.Sprintf("UNKNOWN(%d)", code)
-	}
-}
-
-// Response represents a parsed PCP response header.
-type Response struct {
-	Version    uint8
-	Opcode     uint8
-	ResultCode uint8
-	Lifetime   uint32
-	Epoch      uint32
-}
-
-// MapResponse contains the full response to a MAP request.
-type MapResponse struct {
-	Response
-	Nonce        [12]byte
-	Protocol     uint8
-	InternalPort uint16
-	ExternalPort uint16
-	ExternalIP   netip.Addr
-}
-
-// addrTo16 converts an address to its 16-byte IPv4-mapped IPv6 representation.
-func addrTo16(addr netip.Addr) [16]byte {
-	if addr.Is4() {
-		return netip.AddrFrom4(addr.As4()).As16()
-	}
-	return addr.As16()
-}
-
-// addrFrom16 extracts an address from a 16-byte representation, unmapping IPv4.
-func addrFrom16(b [16]byte) netip.Addr {
-	return netip.AddrFrom16(b).Unmap()
-}
-
-// buildAnnounceRequest creates a PCP ANNOUNCE request packet.
-func buildAnnounceRequest(clientIP netip.Addr) []byte {
-	req := make([]byte, headerSize)
-	req[0] = Version
-	req[1] = OpAnnounce
-	mapped := addrTo16(clientIP)
-	copy(req[8:24], mapped[:])
-	return req
-}
-
-// buildMapRequest creates a PCP MAP request packet.
-func buildMapRequest(clientIP netip.Addr, nonce [12]byte, protocol uint8, internalPort, suggestedExtPort uint16, suggestedExtIP netip.Addr, lifetime uint32) []byte {
-	req := make([]byte, mapRequestSize)
-
-	// Header
-	req[0] = Version
-	req[1] = OpMap
-	binary.BigEndian.PutUint32(req[4:8], lifetime)
-	mapped := addrTo16(clientIP)
-	copy(req[8:24], mapped[:])
-
-	// MAP payload
-	copy(req[24:36], nonce[:])
-	req[36] = protocol
-	binary.BigEndian.PutUint16(req[40:42], internalPort)
-	binary.BigEndian.PutUint16(req[42:44], suggestedExtPort)
-	if suggestedExtIP.IsValid() {
-		extMapped := addrTo16(suggestedExtIP)
-		copy(req[44:60], extMapped[:])
-	}
-
-	return req
-}
-
-// parseResponse parses the common PCP response header.
-func parseResponse(data []byte) (*Response, error) {
-	if len(data) < headerSize {
-		return nil, fmt.Errorf("response too short: %d bytes", len(data))
-	}
-
-	resp := &Response{
-		Version:    data[0],
-		Opcode:     data[1],
-		ResultCode: data[3], // Byte 2 is reserved, byte 3 is result code (RFC 6887 §7.2)
-		Lifetime:   binary.BigEndian.Uint32(data[4:8]),
-		Epoch:      binary.BigEndian.Uint32(data[8:12]),
-	}
-
-	if resp.Version != Version {
-		return nil, fmt.Errorf("unsupported PCP version: %d", resp.Version)
-	}
-
-	if resp.Opcode&OpReply == 0 {
-		return nil, fmt.Errorf("response missing reply bit: opcode=0x%02x", resp.Opcode)
-	}
-
-	return resp, nil
-}
-
-// parseMapResponse parses a complete MAP response.
-func parseMapResponse(data []byte) (*MapResponse, error) {
-	if len(data) < mapRequestSize {
-		return nil, fmt.Errorf("MAP response too short: %d bytes", len(data))
-	}
-
-	resp, err := parseResponse(data)
-	if err != nil {
-		return nil, fmt.Errorf("parse header: %w", err)
-	}
-
-	mapResp := &MapResponse{
-		Response:     *resp,
-		Protocol:     data[36],
-		InternalPort: binary.BigEndian.Uint16(data[40:42]),
-		ExternalPort: binary.BigEndian.Uint16(data[42:44]),
-		ExternalIP:   addrFrom16([16]byte(data[44:60])),
-	}
-	copy(mapResp.Nonce[:], data[24:36])
-
-	return mapResp, nil
-}

client/internal/portforward/state.go

@@ -1,63 +0,0 @@
-//go:build !js
-
-package portforward
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/libp2p/go-nat"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/portforward/pcp"
-)
-
-// discoverGateway is the function used for NAT gateway discovery.
-// It can be replaced in tests to avoid real network operations.
-// Tries PCP first, then falls back to NAT-PMP/UPnP.
-var discoverGateway = defaultDiscoverGateway
-
-func defaultDiscoverGateway(ctx context.Context) (nat.NAT, error) {
-	pcpGateway, err := pcp.DiscoverPCP(ctx)
-	if err == nil {
-		return pcpGateway, nil
-	}
-	log.Debugf("PCP discovery failed: %v, trying NAT-PMP/UPnP", err)
-
-	return nat.DiscoverGateway(ctx)
-}
-
-// State is persisted only for crash recovery cleanup
-type State struct {
-	InternalPort uint16 `json:"internal_port,omitempty"`
-	Protocol     string `json:"protocol,omitempty"`
-}
-
-func (s *State) Name() string {
-	return "port_forward_state"
-}
-
-// Cleanup implements statemanager.CleanableState for crash recovery
-func (s *State) Cleanup() error {
-	if s.InternalPort == 0 {
-		return nil
-	}
-
-	log.Infof("cleaning up stale port mapping for port %d", s.InternalPort)
-
-	ctx, cancel := context.WithTimeout(context.Background(), discoveryTimeout)
-	defer cancel()
-
-	gateway, err := discoverGateway(ctx)
-	if err != nil {
-		// Discovery failure is not an error - gateway may not exist
-		log.Debugf("cleanup: no gateway found: %v", err)
-		return nil
-	}
-
-	if err := gateway.DeletePortMapping(ctx, s.Protocol, int(s.InternalPort)); err != nil {
-		return fmt.Errorf("delete port mapping: %w", err)
-	}
-
-	return nil
-}

client/internal/profilemanager/config.go

@@ -64,6 +64,7 @@ type ConfigInput struct {
 	StateFilePath                 string
 	PreSharedKey                  *string
 	ServerSSHAllowed              *bool
+	ServerRDPAllowed              *bool
 	EnableSSHRoot                 *bool
 	EnableSSHSFTP                 *bool
 	EnableSSHLocalPortForwarding  *bool
@@ -114,6 +115,7 @@ type Config struct {
 	RosenpassEnabled              bool
 	RosenpassPermissive           bool
 	ServerSSHAllowed              *bool
+	ServerRDPAllowed              *bool
 	EnableSSHRoot                 *bool
 	EnableSSHSFTP                 *bool
 	EnableSSHLocalPortForwarding  *bool
@@ -415,6 +417,21 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
+	if input.ServerRDPAllowed != nil {
+		if config.ServerRDPAllowed == nil || *input.ServerRDPAllowed != *config.ServerRDPAllowed {
+			if *input.ServerRDPAllowed {
+				log.Infof("enabling RDP passthrough")
+			} else {
+				log.Infof("disabling RDP passthrough")
+			}
+			config.ServerRDPAllowed = input.ServerRDPAllowed
+			updated = true
+		}
+	} else if config.ServerRDPAllowed == nil {
+		config.ServerRDPAllowed = util.False()
+		updated = true
+	}
+
 	if input.EnableSSHRoot != nil && input.EnableSSHRoot != config.EnableSSHRoot {
 		if *input.EnableSSHRoot {
 			log.Infof("enabling SSH root login")

client/internal/routemanager/manager.go

@@ -168,7 +168,6 @@ func (m *DefaultManager) setupAndroidRoutes(config ManagerConfig) {
 			NetworkType: route.IPv4Network,
 		}
 		cr = append(cr, fakeIPRoute)
-		m.notifier.SetFakeIPRoute(fakeIPRoute)
 	}
 
 	m.notifier.SetInitialClientRoutes(cr, routesForComparison)

client/internal/routemanager/notifier/notifier_android.go

@@ -16,7 +16,6 @@ import (
 type Notifier struct {
 	initialRoutes []*route.Route
 	currentRoutes []*route.Route
-	fakeIPRoute   *route.Route
 
 	listener    listener.NetworkChangeListener
 	listenerMux sync.Mutex
@@ -32,17 +31,13 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	n.listener = listener
 }
 
-// SetInitialClientRoutes stores the initial route sets for TUN configuration.
+// SetInitialClientRoutes stores the full initial route set (including fake IP blocks)
+// and a separate comparison set (without fake IP blocks) for diff detection.
 func (n *Notifier) SetInitialClientRoutes(initialRoutes []*route.Route, routesForComparison []*route.Route) {
 	n.initialRoutes = filterStatic(initialRoutes)
 	n.currentRoutes = filterStatic(routesForComparison)
 }
 
-// SetFakeIPRoute stores the fake IP route to be included in every TUN rebuild.
-func (n *Notifier) SetFakeIPRoute(r *route.Route) {
-	n.fakeIPRoute = r
-}
-
 func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
 	var newRoutes []*route.Route
 	for _, routes := range idMap {
@@ -74,9 +69,7 @@ func (n *Notifier) notify() {
 	}
 
 	allRoutes := slices.Clone(n.currentRoutes)
-	if n.fakeIPRoute != nil {
-		allRoutes = append(allRoutes, n.fakeIPRoute)
-	}
+	allRoutes = append(allRoutes, n.extraInitialRoutes()...)
 
 	routeStrings := n.routesToStrings(allRoutes)
 	sort.Strings(routeStrings)
@@ -85,6 +78,23 @@ func (n *Notifier) notify() {
 	}(n.listener)
 }
 
+// extraInitialRoutes returns initialRoutes whose network prefix is absent
+// from currentRoutes (e.g. the fake IP block added at setup time).
+func (n *Notifier) extraInitialRoutes() []*route.Route {
+	currentNets := make(map[netip.Prefix]struct{}, len(n.currentRoutes))
+	for _, r := range n.currentRoutes {
+		currentNets[r.Network] = struct{}{}
+	}
+
+	var extra []*route.Route
+	for _, r := range n.initialRoutes {
+		if _, ok := currentNets[r.Network]; !ok {
+			extra = append(extra, r)
+		}
+	}
+	return extra
+}
+
 func filterStatic(routes []*route.Route) []*route.Route {
 	out := make([]*route.Route, 0, len(routes))
 	for _, r := range routes {

client/internal/routemanager/notifier/notifier_ios.go

@@ -34,10 +34,6 @@ func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
 	// iOS doesn't care about initial routes
 }
 
-func (n *Notifier) SetFakeIPRoute(*route.Route) {
-	// Not used on iOS
-}
-
 func (n *Notifier) OnNewRoutes(route.HAMap) {
 	// Not used on iOS
 }

client/internal/routemanager/notifier/notifier_other.go

@@ -23,10 +23,6 @@ func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
 	// Not used on non-mobile platforms
 }
 
-func (n *Notifier) SetFakeIPRoute(*route.Route) {
-	// Not used on non-mobile platforms
-}
-
 func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
 	// Not used on non-mobile platforms
 }

client/internal/routemanager/systemops/systemops_darwin_test.go

@@ -1,125 +0,0 @@
-//go:build darwin && !ios
-
-package systemops
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	nbnet "github.com/netbirdio/netbird/client/net"
-)
-
-// TestAfOf verifies that afOf returns the correct string for each address family.
-func TestAfOf(t *testing.T) {
-	tests := []struct {
-		name string
-		addr netip.Addr
-		want string
-	}{
-		{
-			name: "IPv4 unspecified",
-			addr: netip.IPv4Unspecified(),
-			want: "IPv4",
-		},
-		{
-			name: "IPv4 private",
-			addr: netip.MustParseAddr("10.0.0.1"),
-			want: "IPv4",
-		},
-		{
-			name: "IPv4 loopback",
-			addr: netip.MustParseAddr("127.0.0.1"),
-			want: "IPv4",
-		},
-		{
-			name: "IPv6 unspecified",
-			addr: netip.IPv6Unspecified(),
-			want: "IPv6",
-		},
-		{
-			name: "IPv6 loopback",
-			addr: netip.MustParseAddr("::1"),
-			want: "IPv6",
-		},
-		{
-			name: "IPv6 unicast",
-			addr: netip.MustParseAddr("2001:db8::1"),
-			want: "IPv6",
-		},
-		{
-			name: "IPv6 link-local",
-			addr: netip.MustParseAddr("fe80::1"),
-			want: "IPv6",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			assert.Equal(t, tt.want, afOf(tt.addr))
-		})
-	}
-}
-
-// TestIsAddrRouted_AdvancedRoutingBypassesTunnelLookup verifies that when
-// AdvancedRouting is active, IsAddrRouted immediately returns (false, zero)
-// regardless of the provided vpn routes, because the WG socket is bound to
-// the physical interface via IP_BOUND_IF and bypasses the main routing table.
-func TestIsAddrRouted_AdvancedRoutingBypassesTunnelLookup(t *testing.T) {
-	// On darwin, AdvancedRouting returns true unless overridden.
-	// Ensure we reset the state after the test.
-	t.Setenv("NB_USE_LEGACY_ROUTING", "false")
-	t.Setenv("NB_USE_NETSTACK_MODE", "false")
-	nbnet.Init()
-
-	require.True(t, nbnet.AdvancedRouting(), "test requires advanced routing to be active on darwin")
-
-	vpnRoutes := []netip.Prefix{
-		netip.MustParsePrefix("10.0.0.0/8"),
-		netip.MustParsePrefix("192.168.1.0/24"),
-		netip.MustParsePrefix("0.0.0.0/0"),
-	}
-
-	tests := []struct {
-		name string
-		addr netip.Addr
-	}{
-		{"IPv4 in VPN route", netip.MustParseAddr("10.0.0.1")},
-		{"IPv4 in narrow VPN route", netip.MustParseAddr("192.168.1.100")},
-		{"IPv4 default route covered", netip.MustParseAddr("8.8.8.8")},
-		{"IPv6 in VPN route", netip.MustParseAddr("2001:db8::1")},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			routed, prefix := IsAddrRouted(tt.addr, vpnRoutes)
-			assert.False(t, routed, "should not be marked as routed via VPN when advanced routing is active")
-			assert.Equal(t, netip.Prefix{}, prefix, "matched prefix should be zero when advanced routing is active")
-		})
-	}
-}
-
-// TestIsAddrRouted_LegacyModeFallsThroughToTable verifies that when
-// NB_USE_LEGACY_ROUTING=true disables advanced routing, IsAddrRouted
-// performs the normal VPN-route vs local-route comparison.
-func TestIsAddrRouted_LegacyModeFallsThroughToTable(t *testing.T) {
-	t.Setenv("NB_USE_LEGACY_ROUTING", "true")
-	nbnet.Init()
-
-	require.False(t, nbnet.AdvancedRouting(), "test requires advanced routing to be disabled")
-
-	// Use an address that is very unlikely to exist in the host routing table
-	// as a local route, so the VPN route wins.
-	vpnRoutes := []netip.Prefix{
-		netip.MustParsePrefix("198.51.100.0/24"), // TEST-NET-2 – not in normal routing tables
-	}
-
-	addr := netip.MustParseAddr("198.51.100.1")
-	routed, _ := IsAddrRouted(addr, vpnRoutes)
-	// We cannot assert a specific outcome because it depends on the host's
-	// routing table, but we CAN assert that the call did not panic and returned
-	// a consistent pair.
-	_ = routed
-}

client/internal/routemanager/systemops/systemops_isaddrrouted_test.go

@@ -1,140 +0,0 @@
-//go:build !android && !ios
-
-package systemops
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	nbnet "github.com/netbirdio/netbird/client/net"
-)
-
-// withLegacyRouting forcibly puts the nbnet package into legacy (non-advanced)
-// routing mode for the duration of the test, then restores the previous value.
-func withLegacyRouting(t *testing.T) {
-	t.Helper()
-	t.Setenv("NB_USE_LEGACY_ROUTING", "true")
-	t.Setenv("NB_USE_NETSTACK_MODE", "false")
-	nbnet.Init()
-	t.Cleanup(func() {
-		// After the test, re-initialise with no overrides so that subsequent
-		// tests start with a clean state.
-		nbnet.Init()
-	})
-}
-
-// withAdvancedRouting attempts to enable advanced routing for the test.
-// On platforms where Init() cannot produce AdvancedRouting()=true (e.g. Linux
-// without root), the calling test is skipped.
-func withAdvancedRouting(t *testing.T) {
-	t.Helper()
-	t.Setenv("NB_USE_LEGACY_ROUTING", "false")
-	t.Setenv("NB_USE_NETSTACK_MODE", "false")
-	nbnet.Init()
-	t.Cleanup(func() {
-		nbnet.Init()
-	})
-	if !nbnet.AdvancedRouting() {
-		t.Skip("advanced routing not available in this environment (need root or darwin)")
-	}
-}
-
-// TestIsAddrRouted_AdvancedRoutingShortCircuit verifies that when
-// AdvancedRouting() returns true, IsAddrRouted immediately returns
-// (false, zero prefix) regardless of any VPN routes, because the WG socket is
-// bound directly to the physical interface and bypasses the kernel routing table.
-func TestIsAddrRouted_AdvancedRoutingShortCircuit(t *testing.T) {
-	withAdvancedRouting(t)
-
-	vpnRoutes := []netip.Prefix{
-		netip.MustParsePrefix("10.0.0.0/8"),
-		netip.MustParsePrefix("192.168.0.0/16"),
-		netip.MustParsePrefix("0.0.0.0/0"),
-		netip.MustParsePrefix("::/0"),
-	}
-
-	tests := []struct {
-		name string
-		addr string
-	}{
-		{"IPv4 matched by 10/8", "10.0.0.1"},
-		{"IPv4 matched by 192.168/16", "192.168.1.1"},
-		{"IPv4 caught by default", "8.8.8.8"},
-		{"IPv6 caught by default", "2001:db8::1"},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			addr := netip.MustParseAddr(tt.addr)
-			routed, prefix := IsAddrRouted(addr, vpnRoutes)
-			assert.False(t, routed, "advanced routing must short-circuit VPN route check")
-			assert.Equal(t, netip.Prefix{}, prefix, "returned prefix must be zero under advanced routing")
-		})
-	}
-}
-
-// TestIsAddrRouted_AdvancedRouting_EmptyRoutes verifies the short-circuit with
-// an empty vpnRoutes slice — the result must still be (false, zero).
-func TestIsAddrRouted_AdvancedRouting_EmptyRoutes(t *testing.T) {
-	withAdvancedRouting(t)
-
-	routed, prefix := IsAddrRouted(netip.MustParseAddr("10.0.0.1"), nil)
-	assert.False(t, routed)
-	assert.Equal(t, netip.Prefix{}, prefix)
-}
-
-// TestIsAddrRouted_LegacyMode_NonVPNAddress verifies that under legacy routing
-// an address that is not covered by any VPN prefix returns false.
-func TestIsAddrRouted_LegacyMode_NonVPNAddress(t *testing.T) {
-	withLegacyRouting(t)
-
-	// 198.51.100.x (TEST-NET-2) is not normally in any routing table.
-	vpnRoutes := []netip.Prefix{
-		netip.MustParsePrefix("10.0.0.0/8"),
-	}
-
-	addr := netip.MustParseAddr("198.51.100.1")
-	routed, _ := IsAddrRouted(addr, vpnRoutes)
-	assert.False(t, routed, "address not in VPN routes should not be marked as VPN-routed")
-}
-
-// TestIsAddrRouted_LegacyMode_EmptyVPNRoutes verifies that an empty vpnRoutes
-// slice always yields (false, zero prefix) even under legacy routing.
-func TestIsAddrRouted_LegacyMode_EmptyVPNRoutes(t *testing.T) {
-	withLegacyRouting(t)
-
-	routed, prefix := IsAddrRouted(netip.MustParseAddr("10.0.0.1"), nil)
-	assert.False(t, routed)
-	assert.Equal(t, netip.Prefix{}, prefix)
-}
-
-// TestIsAddrRouted_AdvancedVsLegacy_ContrastiveBehaviour documents the
-// contract difference between the two modes: with a VPN default route and an
-// address that matches it, legacy mode may mark it as VPN-routed while advanced
-// mode must never do so.
-func TestIsAddrRouted_AdvancedVsLegacy_ContrastiveBehaviour(t *testing.T) {
-	vpnRoutes := []netip.Prefix{
-		netip.MustParsePrefix("0.0.0.0/0"),
-	}
-	addr := netip.MustParseAddr("8.8.8.8")
-
-	// --- advanced routing: must always return false ---
-	t.Run("advanced routing", func(t *testing.T) {
-		withAdvancedRouting(t)
-		routed, prefix := IsAddrRouted(addr, vpnRoutes)
-		assert.False(t, routed, "advanced routing must bypass VPN route lookup")
-		assert.Equal(t, netip.Prefix{}, prefix)
-	})
-
-	// --- legacy routing: delegates to kernel table check, does not panic ---
-	t.Run("legacy routing", func(t *testing.T) {
-		withLegacyRouting(t)
-		// We don't assert true/false here because it depends on the host
-		// routing table, but the call must not panic and must return
-		// a valid (bool, prefix) pair.
-		routed, prefix := IsAddrRouted(addr, vpnRoutes)
-		t.Logf("legacy IsAddrRouted(%s, %v) = (%v, %v)", addr, vpnRoutes, routed, prefix)
-	})
-}

client/net/env_bound_iface_test.go

@@ -1,121 +0,0 @@
-//go:build (darwin && !ios) || windows
-
-package net
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// resetAdvancedRoutingState resets the package-level advancedRoutingSupported variable
-// and cleans up after the test.
-func resetAdvancedRoutingState(t *testing.T) {
-	t.Helper()
-	orig := advancedRoutingSupported
-	t.Cleanup(func() { advancedRoutingSupported = orig })
-}
-
-// TestCheckAdvancedRoutingSupport_LegacyRoutingTrue verifies that setting
-// NB_USE_LEGACY_ROUTING=true disables advanced routing.
-func TestCheckAdvancedRoutingSupport_LegacyRoutingTrue(t *testing.T) {
-	t.Setenv(envUseLegacyRouting, "true")
-	assert.False(t, checkAdvancedRoutingSupport())
-}
-
-// TestCheckAdvancedRoutingSupport_LegacyRoutingFalse verifies that
-// NB_USE_LEGACY_ROUTING=false still allows advanced routing when netstack is off.
-func TestCheckAdvancedRoutingSupport_LegacyRoutingFalse(t *testing.T) {
-	t.Setenv(envUseLegacyRouting, "false")
-	t.Setenv("NB_USE_NETSTACK_MODE", "false")
-	assert.True(t, checkAdvancedRoutingSupport())
-}
-
-// TestCheckAdvancedRoutingSupport_LegacyRoutingInvalid verifies that an invalid
-// value for NB_USE_LEGACY_ROUTING is ignored (treated as false), so advanced
-// routing remains enabled when netstack is off.
-func TestCheckAdvancedRoutingSupport_LegacyRoutingInvalid(t *testing.T) {
-	t.Setenv(envUseLegacyRouting, "notabool")
-	t.Setenv("NB_USE_NETSTACK_MODE", "false")
-	// The invalid value is ignored; the default (false) is kept, so advanced routing
-	// is not suppressed by the legacy-routing flag.
-	assert.True(t, checkAdvancedRoutingSupport())
-}
-
-// TestCheckAdvancedRoutingSupport_NetstackEnabled verifies that netstack mode
-// disables advanced routing.
-func TestCheckAdvancedRoutingSupport_NetstackEnabled(t *testing.T) {
-	t.Setenv(envUseLegacyRouting, "false")
-	t.Setenv("NB_USE_NETSTACK_MODE", "true")
-	assert.False(t, checkAdvancedRoutingSupport())
-}
-
-// TestCheckAdvancedRoutingSupport_NoEnvVars verifies that with no env overrides
-// advanced routing is supported (the happy path).
-func TestCheckAdvancedRoutingSupport_NoEnvVars(t *testing.T) {
-	// Unset both controlling variables so we hit the default path.
-	t.Setenv(envUseLegacyRouting, "")
-	t.Setenv("NB_USE_NETSTACK_MODE", "false")
-	assert.True(t, checkAdvancedRoutingSupport())
-}
-
-// TestCheckAdvancedRoutingSupport_LegacyRoutingEmptyString verifies that an
-// empty NB_USE_LEGACY_ROUTING is treated as "not set" and does not disable
-// advanced routing.
-func TestCheckAdvancedRoutingSupport_LegacyRoutingEmptyString(t *testing.T) {
-	t.Setenv(envUseLegacyRouting, "")
-	t.Setenv("NB_USE_NETSTACK_MODE", "false")
-	assert.True(t, checkAdvancedRoutingSupport())
-}
-
-// TestAdvancedRouting_ReflectsInit verifies that after calling Init() with
-// NB_USE_LEGACY_ROUTING=true, AdvancedRouting() returns false.
-func TestAdvancedRouting_ReflectsInit(t *testing.T) {
-	resetAdvancedRoutingState(t)
-
-	t.Setenv(envUseLegacyRouting, "true")
-	Init()
-
-	assert.False(t, AdvancedRouting(), "AdvancedRouting should return false after Init with legacy routing")
-}
-
-// TestAdvancedRouting_ReflectsInit_Advanced verifies that after calling Init()
-// without legacy overrides, AdvancedRouting() returns true.
-func TestAdvancedRouting_ReflectsInit_Advanced(t *testing.T) {
-	resetAdvancedRoutingState(t)
-
-	t.Setenv(envUseLegacyRouting, "false")
-	t.Setenv("NB_USE_NETSTACK_MODE", "false")
-	Init()
-
-	assert.True(t, AdvancedRouting(), "AdvancedRouting should return true after Init without legacy overrides")
-}
-
-// TestSetAndGetVPNInterfaceName verifies SetVPNInterfaceName and GetVPNInterfaceName
-// are consistent.
-func TestSetAndGetVPNInterfaceName(t *testing.T) {
-	orig := GetVPNInterfaceName()
-	t.Cleanup(func() { SetVPNInterfaceName(orig) })
-
-	SetVPNInterfaceName("utun3")
-	assert.Equal(t, "utun3", GetVPNInterfaceName())
-}
-
-// TestSetVPNInterfaceName_Empty verifies that setting an empty name is accepted.
-func TestSetVPNInterfaceName_Empty(t *testing.T) {
-	orig := GetVPNInterfaceName()
-	t.Cleanup(func() { SetVPNInterfaceName(orig) })
-
-	SetVPNInterfaceName("")
-	assert.Equal(t, "", GetVPNInterfaceName())
-}
-
-// TestSetVPNInterfaceName_OverwritesPrevious verifies that the second call wins.
-func TestSetVPNInterfaceName_OverwritesPrevious(t *testing.T) {
-	orig := GetVPNInterfaceName()
-	t.Cleanup(func() { SetVPNInterfaceName(orig) })
-
-	SetVPNInterfaceName("utun1")
-	SetVPNInterfaceName("utun9")
-	assert.Equal(t, "utun9", GetVPNInterfaceName())
-}

client/net/env_mobile_test.go

@@ -1,39 +0,0 @@
-//go:build ios || android
-
-package net
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// TestAdvancedRouting_Mobile verifies that AdvancedRouting always returns true
-// on mobile platforms.
-func TestAdvancedRouting_Mobile(t *testing.T) {
-	assert.True(t, AdvancedRouting(), "AdvancedRouting must always be true on mobile")
-}
-
-// TestInit_Mobile verifies that Init is a no-op and does not panic.
-func TestInit_Mobile(t *testing.T) {
-	// Should not panic.
-	Init()
-	// After Init, AdvancedRouting must still return true.
-	assert.True(t, AdvancedRouting())
-}
-
-// TestSetVPNInterfaceName_Mobile verifies that SetVPNInterfaceName is a no-op
-// and does not panic.
-func TestSetVPNInterfaceName_Mobile(t *testing.T) {
-	// Should not panic for any input.
-	SetVPNInterfaceName("utun0")
-	SetVPNInterfaceName("")
-}
-
-// TestGetVPNInterfaceName_Mobile verifies that GetVPNInterfaceName always
-// returns an empty string on mobile.
-func TestGetVPNInterfaceName_Mobile(t *testing.T) {
-	// Even after a SetVPNInterfaceName call (no-op), the getter returns "".
-	SetVPNInterfaceName("utun0")
-	assert.Equal(t, "", GetVPNInterfaceName(), "GetVPNInterfaceName must return empty string on mobile")
-}

client/net/net_darwin_test.go

@@ -1,286 +0,0 @@
-//go:build darwin && !ios
-
-package net
-
-import (
-	"net"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sys/unix"
-)
-
-// resetBoundIfaces clears global state before each test that manipulates it.
-func resetBoundIfaces(t *testing.T) {
-	t.Helper()
-	ClearBoundInterfaces()
-	t.Cleanup(ClearBoundInterfaces)
-}
-
-// TestIsV6Network verifies the isV6Network helper correctly identifies v6 networks.
-func TestIsV6Network(t *testing.T) {
-	tests := []struct {
-		network string
-		want    bool
-	}{
-		{"tcp6", true},
-		{"udp6", true},
-		{"ip6", true},
-		{"tcp", false},
-		{"udp", false},
-		{"tcp4", false},
-		{"udp4", false},
-		{"ip4", false},
-		{"ip", false},
-		{"", false},
-		// Arbitrary suffix-6 strings
-		{"unix6", true},
-		{"custom6", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.network, func(t *testing.T) {
-			assert.Equal(t, tt.want, isV6Network(tt.network))
-		})
-	}
-}
-
-// TestSetBoundInterface_AFINET sets boundIface4 via AF_INET.
-func TestSetBoundInterface_AFINET(t *testing.T) {
-	resetBoundIfaces(t)
-
-	iface := &net.Interface{Index: 5, Name: "en0"}
-	SetBoundInterface(unix.AF_INET, iface)
-
-	boundIfaceMu.RLock()
-	got := boundIface4
-	boundIfaceMu.RUnlock()
-
-	require.NotNil(t, got)
-	assert.Equal(t, 5, got.Index)
-	assert.Equal(t, "en0", got.Name)
-}
-
-// TestSetBoundInterface_AFINET6 sets boundIface6 via AF_INET6.
-func TestSetBoundInterface_AFINET6(t *testing.T) {
-	resetBoundIfaces(t)
-
-	iface := &net.Interface{Index: 7, Name: "utun0"}
-	SetBoundInterface(unix.AF_INET6, iface)
-
-	boundIfaceMu.RLock()
-	got := boundIface6
-	boundIfaceMu.RUnlock()
-
-	require.NotNil(t, got)
-	assert.Equal(t, 7, got.Index)
-	assert.Equal(t, "utun0", got.Name)
-}
-
-// TestSetBoundInterface_Nil verifies nil iface is rejected without panicking.
-func TestSetBoundInterface_Nil(t *testing.T) {
-	resetBoundIfaces(t)
-
-	// Should not panic, just log a warning and leave existing values untouched.
-	iface := &net.Interface{Index: 1, Name: "en1"}
-	SetBoundInterface(unix.AF_INET, iface)
-
-	SetBoundInterface(unix.AF_INET, nil)
-
-	boundIfaceMu.RLock()
-	got := boundIface4
-	boundIfaceMu.RUnlock()
-
-	// Value must be unchanged after the rejected nil write.
-	require.NotNil(t, got)
-	assert.Equal(t, 1, got.Index)
-}
-
-// TestSetBoundInterface_UnknownAF verifies unknown address families are ignored.
-func TestSetBoundInterface_UnknownAF(t *testing.T) {
-	resetBoundIfaces(t)
-
-	iface := &net.Interface{Index: 3, Name: "en2"}
-	// Use an address family that is not AF_INET or AF_INET6.
-	SetBoundInterface(99, iface)
-
-	boundIfaceMu.RLock()
-	v4, v6 := boundIface4, boundIface6
-	boundIfaceMu.RUnlock()
-
-	assert.Nil(t, v4, "unknown AF must not populate boundIface4")
-	assert.Nil(t, v6, "unknown AF must not populate boundIface6")
-}
-
-// TestClearBoundInterfaces clears both cached interfaces.
-func TestClearBoundInterfaces(t *testing.T) {
-	iface4 := &net.Interface{Index: 1, Name: "en0"}
-	iface6 := &net.Interface{Index: 2, Name: "en0"}
-
-	SetBoundInterface(unix.AF_INET, iface4)
-	SetBoundInterface(unix.AF_INET6, iface6)
-
-	ClearBoundInterfaces()
-
-	boundIfaceMu.RLock()
-	v4, v6 := boundIface4, boundIface6
-	boundIfaceMu.RUnlock()
-
-	assert.Nil(t, v4, "boundIface4 must be nil after clear")
-	assert.Nil(t, v6, "boundIface6 must be nil after clear")
-}
-
-// TestClearBoundInterfaces_Idempotent verifies clearing twice does not panic.
-func TestClearBoundInterfaces_Idempotent(t *testing.T) {
-	ClearBoundInterfaces()
-	ClearBoundInterfaces()
-
-	boundIfaceMu.RLock()
-	v4, v6 := boundIface4, boundIface6
-	boundIfaceMu.RUnlock()
-
-	assert.Nil(t, v4)
-	assert.Nil(t, v6)
-}
-
-// TestBoundInterfaceFor_PreferSameFamily verifies v4 iface returned for "tcp" and
-// v6 iface returned for "tcp6" when both slots are populated.
-func TestBoundInterfaceFor_PreferSameFamily(t *testing.T) {
-	resetBoundIfaces(t)
-
-	en0 := &net.Interface{Index: 1, Name: "en0"}
-	en1 := &net.Interface{Index: 2, Name: "en1"}
-	SetBoundInterface(unix.AF_INET, en0)
-	SetBoundInterface(unix.AF_INET6, en1)
-
-	got4 := boundInterfaceFor("tcp", "1.2.3.4:80")
-	require.NotNil(t, got4)
-	assert.Equal(t, "en0", got4.Name, "tcp should prefer v4 interface")
-
-	got6 := boundInterfaceFor("tcp6", "[::1]:80")
-	require.NotNil(t, got6)
-	assert.Equal(t, "en1", got6.Name, "tcp6 should prefer v6 interface")
-}
-
-// TestBoundInterfaceFor_FallbackToOtherFamily returns the other family's iface
-// when the preferred slot is empty.
-func TestBoundInterfaceFor_FallbackToOtherFamily(t *testing.T) {
-	resetBoundIfaces(t)
-
-	// Only v4 populated.
-	en0 := &net.Interface{Index: 1, Name: "en0"}
-	SetBoundInterface(unix.AF_INET, en0)
-
-	// Asking for v6 should fall back to en0.
-	got := boundInterfaceFor("tcp6", "[::1]:80")
-	require.NotNil(t, got)
-	assert.Equal(t, "en0", got.Name)
-}
-
-// TestBoundInterfaceFor_BothEmpty returns nil when both slots are empty.
-func TestBoundInterfaceFor_BothEmpty(t *testing.T) {
-	resetBoundIfaces(t)
-
-	got := boundInterfaceFor("tcp", "1.2.3.4:80")
-	assert.Nil(t, got)
-
-	got6 := boundInterfaceFor("tcp6", "[::1]:80")
-	assert.Nil(t, got6)
-}
-
-// TestZoneInterface_Empty returns nil for empty address.
-func TestZoneInterface_Empty(t *testing.T) {
-	iface := zoneInterface("")
-	assert.Nil(t, iface)
-}
-
-// TestZoneInterface_NoZone returns nil when address has no zone.
-func TestZoneInterface_NoZone(t *testing.T) {
-	// Regular IPv4 address with port — no zone identifier.
-	iface := zoneInterface("192.168.1.1:80")
-	assert.Nil(t, iface)
-
-	// Regular IPv6 address with port — no zone identifier.
-	iface = zoneInterface("[2001:db8::1]:80")
-	assert.Nil(t, iface)
-
-	// Plain IPv6 address without port or zone.
-	iface = zoneInterface("2001:db8::1")
-	assert.Nil(t, iface)
-}
-
-// TestZoneInterface_InvalidAddress returns nil for completely invalid strings.
-func TestZoneInterface_InvalidAddress(t *testing.T) {
-	iface := zoneInterface("not-an-address")
-	assert.Nil(t, iface)
-
-	iface = zoneInterface("::::")
-	assert.Nil(t, iface)
-}
-
-// TestZoneInterface_NonExistentZoneName returns nil for a zone name that does
-// not correspond to a real interface on the host.
-func TestZoneInterface_NonExistentZoneName(t *testing.T) {
-	// Use an interface name that is very unlikely to exist.
-	iface := zoneInterface("fe80::1%nonexistentiface99999")
-	assert.Nil(t, iface)
-}
-
-// TestZoneInterface_NonExistentZoneIndex returns nil for a zone expressed as an
-// integer index that is not in use.
-func TestZoneInterface_NonExistentZoneIndex(t *testing.T) {
-	// Interface index 999999 should not exist on any test machine.
-	iface := zoneInterface("fe80::1%999999")
-	assert.Nil(t, iface)
-}
-
-// TestBoundInterfaceFor_SetThenClear verifies that clearing state causes
-// boundInterfaceFor to return nil afterwards.
-func TestBoundInterfaceFor_SetThenClear(t *testing.T) {
-	resetBoundIfaces(t)
-
-	en0 := &net.Interface{Index: 1, Name: "en0"}
-	SetBoundInterface(unix.AF_INET, en0)
-
-	got := boundInterfaceFor("tcp", "1.2.3.4:80")
-	require.NotNil(t, got, "should return iface while set")
-
-	ClearBoundInterfaces()
-
-	got = boundInterfaceFor("tcp", "1.2.3.4:80")
-	assert.Nil(t, got, "should return nil after clear")
-}
-
-// TestSetBoundInterface_OverwritesPreviousValue verifies that calling
-// SetBoundInterface again updates the stored pointer.
-func TestSetBoundInterface_OverwritesPreviousValue(t *testing.T) {
-	resetBoundIfaces(t)
-
-	first := &net.Interface{Index: 1, Name: "en0"}
-	second := &net.Interface{Index: 3, Name: "en1"}
-
-	SetBoundInterface(unix.AF_INET, first)
-	SetBoundInterface(unix.AF_INET, second)
-
-	boundIfaceMu.RLock()
-	got := boundIface4
-	boundIfaceMu.RUnlock()
-
-	require.NotNil(t, got)
-	assert.Equal(t, "en1", got.Name, "second call should overwrite first")
-}
-
-// TestBoundInterfaceFor_OnlyV6Populated returns v6 iface for v4 network
-// when only v6 slot is filled.
-func TestBoundInterfaceFor_OnlyV6Populated(t *testing.T) {
-	resetBoundIfaces(t)
-
-	en1 := &net.Interface{Index: 2, Name: "en1"}
-	SetBoundInterface(unix.AF_INET6, en1)
-
-	// v4 network, v4 slot empty → should fall back to v6 slot.
-	got := boundInterfaceFor("tcp", "1.2.3.4:80")
-	require.NotNil(t, got)
-	assert.Equal(t, "en1", got.Name)
-}

client/proto/daemon.pb.go

@@ -472,6 +472,7 @@ type LoginRequest struct {
 	EnableSSHRemotePortForwarding *bool   `protobuf:"varint,37,opt,name=enableSSHRemotePortForwarding,proto3,oneof" json:"enableSSHRemotePortForwarding,omitempty"`
 	DisableSSHAuth                *bool   `protobuf:"varint,38,opt,name=disableSSHAuth,proto3,oneof" json:"disableSSHAuth,omitempty"`
 	SshJWTCacheTTL                *int32  `protobuf:"varint,39,opt,name=sshJWTCacheTTL,proto3,oneof" json:"sshJWTCacheTTL,omitempty"`
+	ServerRDPAllowed              *bool   `protobuf:"varint,40,opt,name=serverRDPAllowed,proto3,oneof" json:"serverRDPAllowed,omitempty"`
 	unknownFields                 protoimpl.UnknownFields
 	sizeCache                     protoimpl.SizeCache
 }
@@ -780,6 +781,13 @@ func (x *LoginRequest) GetSshJWTCacheTTL() int32 {
 	return 0
 }
 
+func (x *LoginRequest) GetServerRDPAllowed() bool {
+	if x != nil && x.ServerRDPAllowed != nil {
+		return *x.ServerRDPAllowed
+	}
+	return false
+}
+
 type LoginResponse struct {
 	state                   protoimpl.MessageState `protogen:"open.v1"`
 	NeedsSSOLogin           bool                   `protobuf:"varint,1,opt,name=needsSSOLogin,proto3" json:"needsSSOLogin,omitempty"`
@@ -1312,6 +1320,7 @@ type GetConfigResponse struct {
 	EnableSSHRemotePortForwarding bool   `protobuf:"varint,23,opt,name=enableSSHRemotePortForwarding,proto3" json:"enableSSHRemotePortForwarding,omitempty"`
 	DisableSSHAuth                bool   `protobuf:"varint,25,opt,name=disableSSHAuth,proto3" json:"disableSSHAuth,omitempty"`
 	SshJWTCacheTTL                int32  `protobuf:"varint,26,opt,name=sshJWTCacheTTL,proto3" json:"sshJWTCacheTTL,omitempty"`
+	ServerRDPAllowed              bool   `protobuf:"varint,27,opt,name=serverRDPAllowed,proto3" json:"serverRDPAllowed,omitempty"`
 	unknownFields                 protoimpl.UnknownFields
 	sizeCache                     protoimpl.SizeCache
 }
@@ -1528,6 +1537,13 @@ func (x *GetConfigResponse) GetSshJWTCacheTTL() int32 {
 	return 0
 }
 
+func (x *GetConfigResponse) GetServerRDPAllowed() bool {
+	if x != nil {
+		return x.ServerRDPAllowed
+	}
+	return false
+}
+
 // PeerState contains the latest state of a peer
 type PeerState struct {
 	state                      protoimpl.MessageState `protogen:"open.v1"`
@@ -4139,6 +4155,7 @@ type SetConfigRequest struct {
 	EnableSSHRemotePortForwarding *bool                `protobuf:"varint,32,opt,name=enableSSHRemotePortForwarding,proto3,oneof" json:"enableSSHRemotePortForwarding,omitempty"`
 	DisableSSHAuth                *bool                `protobuf:"varint,33,opt,name=disableSSHAuth,proto3,oneof" json:"disableSSHAuth,omitempty"`
 	SshJWTCacheTTL                *int32               `protobuf:"varint,34,opt,name=sshJWTCacheTTL,proto3,oneof" json:"sshJWTCacheTTL,omitempty"`
+	ServerRDPAllowed              *bool                `protobuf:"varint,35,opt,name=serverRDPAllowed,proto3,oneof" json:"serverRDPAllowed,omitempty"`
 	unknownFields                 protoimpl.UnknownFields
 	sizeCache                     protoimpl.SizeCache
 }
@@ -4411,6 +4428,13 @@ func (x *SetConfigRequest) GetSshJWTCacheTTL() int32 {
 	return 0
 }
 
+func (x *SetConfigRequest) GetServerRDPAllowed() bool {
+	if x != nil && x.ServerRDPAllowed != nil {
+		return *x.ServerRDPAllowed
+	}
+	return false
+}
+
 type SetConfigResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -4979,7 +5003,6 @@ type GetFeaturesResponse struct {
 	state                 protoimpl.MessageState `protogen:"open.v1"`
 	DisableProfiles       bool                   `protobuf:"varint,1,opt,name=disable_profiles,json=disableProfiles,proto3" json:"disable_profiles,omitempty"`
 	DisableUpdateSettings bool                   `protobuf:"varint,2,opt,name=disable_update_settings,json=disableUpdateSettings,proto3" json:"disable_update_settings,omitempty"`
-	DisableNetworks       bool                   `protobuf:"varint,3,opt,name=disable_networks,json=disableNetworks,proto3" json:"disable_networks,omitempty"`
 	unknownFields         protoimpl.UnknownFields
 	sizeCache             protoimpl.SizeCache
 }
@@ -5028,13 +5051,6 @@ func (x *GetFeaturesResponse) GetDisableUpdateSettings() bool {
 	return false
 }
 
-func (x *GetFeaturesResponse) GetDisableNetworks() bool {
-	if x != nil {
-		return x.DisableNetworks
-	}
-	return false
-}
-
 type TriggerUpdateRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -6480,11 +6496,10 @@ const file_daemon_proto_rawDesc = "" +
 	"\f_profileNameB\v\n" +
 	"\t_username\"\x10\n" +
 	"\x0eLogoutResponse\"\x14\n" +
-	"\x12GetFeaturesRequest\"\xa3\x01\n" +
+	"\x12GetFeaturesRequest\"x\n" +
 	"\x13GetFeaturesResponse\x12)\n" +
 	"\x10disable_profiles\x18\x01 \x01(\bR\x0fdisableProfiles\x126\n" +
-	"\x17disable_update_settings\x18\x02 \x01(\bR\x15disableUpdateSettings\x12)\n" +
-	"\x10disable_networks\x18\x03 \x01(\bR\x0fdisableNetworks\"\x16\n" +
+	"\x17disable_update_settings\x18\x02 \x01(\bR\x15disableUpdateSettings\"\x16\n" +
 	"\x14TriggerUpdateRequest\"M\n" +
 	"\x15TriggerUpdateResponse\x12\x18\n" +
 	"\asuccess\x18\x01 \x01(\bR\asuccess\x12\x1a\n" +

client/proto/daemon.proto

@@ -209,6 +209,8 @@ message LoginRequest {
   optional bool enableSSHRemotePortForwarding = 37;
   optional bool disableSSHAuth = 38;
   optional int32 sshJWTCacheTTL = 39;
+
+  optional bool serverRDPAllowed = 40;
 }
 
 message LoginResponse {
@@ -316,6 +318,8 @@ message GetConfigResponse {
   bool disableSSHAuth = 25;
 
   int32 sshJWTCacheTTL = 26;
+
+  bool serverRDPAllowed = 27;
 }
 
 // PeerState contains the latest state of a peer
@@ -677,6 +681,8 @@ message SetConfigRequest {
   optional bool enableSSHRemotePortForwarding = 32;
   optional bool disableSSHAuth = 33;
   optional int32 sshJWTCacheTTL = 34;
+
+  optional bool serverRDPAllowed = 35;
 }
 
 message SetConfigResponse{}
@@ -727,7 +733,6 @@ message GetFeaturesRequest{}
 message GetFeaturesResponse{
   bool disable_profiles = 1;
   bool disable_update_settings = 2;
-  bool disable_networks = 3;
 }
 
 message TriggerUpdateRequest {}

client/rdp/client/client.go

@@ -0,0 +1,88 @@
+package client
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net"
+	"time"
+
+	rdpserver "github.com/netbirdio/netbird/client/rdp/server"
+)
+
+const (
+	// DefaultTimeout is the default timeout for sideband auth requests.
+	DefaultTimeout = 30 * time.Second
+
+	// maxResponseSize is the maximum size of an auth response in bytes.
+	maxResponseSize = 64 * 1024
+)
+
+// Client connects to a target peer's RDP sideband auth server to request access.
+type Client struct {
+	Timeout time.Duration
+}
+
+// New creates a new sideband RDP auth client.
+func New() *Client {
+	return &Client{
+		Timeout: DefaultTimeout,
+	}
+}
+
+// RequestAuth sends an authorization request to the target peer's sideband server
+// and returns the response. The addr should be in "host:port" format.
+func (c *Client) RequestAuth(ctx context.Context, addr string, req *rdpserver.AuthRequest) (*rdpserver.AuthResponse, error) {
+	timeout := c.Timeout
+	if timeout <= 0 {
+		timeout = DefaultTimeout
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	dialer := &net.Dialer{}
+	conn, err := dialer.DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return nil, fmt.Errorf("connect to RDP auth server at %s: %w", addr, err)
+	}
+	defer func() { _ = conn.Close() }()
+
+	deadline, ok := ctx.Deadline()
+	if ok {
+		if err := conn.SetDeadline(deadline); err != nil {
+			return nil, fmt.Errorf("set connection deadline: %w", err)
+		}
+	}
+
+	// Send request
+	reqData, err := json.Marshal(req)
+	if err != nil {
+		return nil, fmt.Errorf("marshal auth request: %w", err)
+	}
+
+	if _, err := conn.Write(reqData); err != nil {
+		return nil, fmt.Errorf("send auth request: %w", err)
+	}
+
+	// Signal we're done writing so the server can read the full request
+	if tcpConn, ok := conn.(*net.TCPConn); ok {
+		if err := tcpConn.CloseWrite(); err != nil {
+			return nil, fmt.Errorf("close write: %w", err)
+		}
+	}
+
+	// Read response
+	respData, err := io.ReadAll(io.LimitReader(conn, maxResponseSize))
+	if err != nil {
+		return nil, fmt.Errorf("read auth response: %w", err)
+	}
+
+	var resp rdpserver.AuthResponse
+	if err := json.Unmarshal(respData, &resp); err != nil {
+		return nil, fmt.Errorf("unmarshal auth response: %w", err)
+	}
+
+	return &resp, nil
+}

client/rdp/credprov/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "netbird-credprov"
+version = "0.1.0"
+edition = "2021"
+description = "NetBird RDP Credential Provider for Windows"
+license = "BSD-3-Clause"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+windows = { version = "0.58", features = [
+    "implement",
+    "Win32_Foundation",
+    "Win32_System_Com",
+    "Win32_UI_Shell",
+    "Win32_Security",
+    "Win32_Security_Authentication_Identity",
+    "Win32_Security_Credentials",
+    "Win32_System_RemoteDesktop",
+    "Win32_System_Threading",
+] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+uuid = { version = "1", features = ["v4"] }
+log = "0.4"
+
+[profile.release]
+opt-level = "s"
+lto = true
+strip = true

client/rdp/credprov/src/credential.rs

@@ -0,0 +1,210 @@
+//! ICredentialProviderCredential implementation.
+//!
+//! Represents a single "NetBird Login" credential tile on the Windows login screen.
+//! When selected, it queries the local NetBird agent for pending RDP sessions and
+//! performs S4U logon to authenticate the user without a password.
+
+use crate::named_pipe_client::{NamedPipeClient, PipeResponse};
+use crate::s4u;
+use std::sync::Mutex;
+use windows::core::*;
+use windows::Win32::Foundation::*;
+use windows::Win32::Security::Credentials::*;
+use windows::Win32::UI::Shell::*;
+
+/// NetBird credential tile that appears on the Windows login screen.
+#[implement(ICredentialProviderCredential)]
+pub struct NetBirdCredential {
+    /// The pending session information from the NetBird agent.
+    session: Mutex<Option<PipeResponse>>,
+    /// The remote IP address of the connecting peer.
+    remote_ip: Mutex<String>,
+}
+
+impl NetBirdCredential {
+    pub fn new(remote_ip: String, session: PipeResponse) -> Self {
+        Self {
+            session: Mutex::new(Some(session)),
+            remote_ip: Mutex::new(remote_ip),
+        }
+    }
+}
+
+impl ICredentialProviderCredential_Impl for NetBirdCredential_Impl {
+    fn Advise(&self, _pcpce: Option<&ICredentialProviderCredentialEvents>) -> Result<()> {
+        Ok(())
+    }
+
+    fn UnAdvise(&self) -> Result<()> {
+        Ok(())
+    }
+
+    fn SetSelected(&self, _pbautologon: *mut BOOL) -> Result<()> {
+        // Auto-logon when this credential is selected
+        unsafe {
+            if !_pbautologon.is_null() {
+                *_pbautologon = TRUE;
+            }
+        }
+        Ok(())
+    }
+
+    fn SetDeselected(&self) -> Result<()> {
+        Ok(())
+    }
+
+    fn GetFieldState(
+        &self,
+        _dwfieldid: u32,
+        _pcpfs: *mut CREDENTIAL_PROVIDER_FIELD_STATE,
+        _pcpfis: *mut CREDENTIAL_PROVIDER_FIELD_INTERACTIVE_STATE,
+    ) -> Result<()> {
+        // We have a single display-only field showing "NetBird Login"
+        unsafe {
+            if !_pcpfs.is_null() {
+                *_pcpfs = CPFS_DISPLAY_IN_SELECTED_TILE;
+            }
+            if !_pcpfis.is_null() {
+                *_pcpfis = CPFIS_NONE;
+            }
+        }
+        Ok(())
+    }
+
+    fn GetStringValue(&self, _dwfieldid: u32) -> Result<PWSTR> {
+        let session = self.session.lock().unwrap();
+        let text = if let Some(ref s) = *session {
+            format!("NetBird: Logging in as {}", s.os_user)
+        } else {
+            "NetBird Login".to_string()
+        };
+
+        let wide: Vec<u16> = text.encode_utf16().chain(std::iter::once(0)).collect();
+        let ptr = unsafe {
+            let mem = windows::Win32::System::Com::CoTaskMemAlloc(wide.len() * 2) as *mut u16;
+            if mem.is_null() {
+                return Err(E_OUTOFMEMORY.into());
+            }
+            std::ptr::copy_nonoverlapping(wide.as_ptr(), mem, wide.len());
+            PWSTR(mem)
+        };
+
+        Ok(ptr)
+    }
+
+    fn GetBitmapValue(&self, _dwfieldid: u32) -> Result<HBITMAP> {
+        Err(E_NOTIMPL.into())
+    }
+
+    fn GetCheckboxValue(&self, _dwfieldid: u32, _pbchecked: *mut BOOL, _ppszlabel: *mut PWSTR) -> Result<()> {
+        Err(E_NOTIMPL.into())
+    }
+
+    fn GetSubmitButtonValue(&self, _dwfieldid: u32, _pdwadjacentto: *mut u32) -> Result<()> {
+        Err(E_NOTIMPL.into())
+    }
+
+    fn GetComboBoxValueCount(&self, _dwfieldid: u32, _pcitems: *mut u32, _pdwselecteditem: *mut u32) -> Result<()> {
+        Err(E_NOTIMPL.into())
+    }
+
+    fn GetComboBoxValueAt(&self, _dwfieldid: u32, _dwitem: u32) -> Result<PWSTR> {
+        Err(E_NOTIMPL.into())
+    }
+
+    fn SetStringValue(&self, _dwfieldid: u32, _psz: &PCWSTR) -> Result<()> {
+        Err(E_NOTIMPL.into())
+    }
+
+    fn SetCheckboxValue(&self, _dwfieldid: u32, _bchecked: BOOL) -> Result<()> {
+        Err(E_NOTIMPL.into())
+    }
+
+    fn SetComboBoxSelectedValue(&self, _dwfieldid: u32, _dwselecteditem: u32) -> Result<()> {
+        Err(E_NOTIMPL.into())
+    }
+
+    fn CommandLinkClicked(&self, _dwfieldid: u32) -> Result<()> {
+        Err(E_NOTIMPL.into())
+    }
+
+    fn GetSerialization(
+        &self,
+        _pcpgsr: *mut CREDENTIAL_PROVIDER_GET_SERIALIZATION_RESPONSE,
+        _pcpcs: *mut CREDENTIAL_PROVIDER_CREDENTIAL_SERIALIZATION,
+        _ppszoptionalstatustext: *mut PWSTR,
+        _pcpsioptionalstatusicon: *mut CREDENTIAL_PROVIDER_STATUS_ICON,
+    ) -> Result<()> {
+        let session = self.session.lock().unwrap();
+        let session_info = match &*session {
+            Some(s) => s.clone(),
+            None => {
+                unsafe {
+                    *_pcpgsr = CPGSR_NO_CREDENTIAL_NOT_FINISHED;
+                }
+                return Ok(());
+            }
+        };
+
+        // Consume the session with the agent
+        if let Err(e) = NamedPipeClient::consume_session(&session_info.session_id) {
+            log::error!("Failed to consume RDP session: {}", e);
+            unsafe {
+                *_pcpgsr = CPGSR_NO_CREDENTIAL_FINISHED;
+            }
+            return Ok(());
+        }
+
+        // Perform S4U logon
+        let username = &session_info.os_user;
+        let domain = if session_info.domain.is_empty() {
+            "."
+        } else {
+            &session_info.domain
+        };
+
+        match s4u::generate_s4u_token(username, domain) {
+            Ok(_token) => {
+                // In a full implementation, we would serialize the token into
+                // CREDENTIAL_PROVIDER_CREDENTIAL_SERIALIZATION format
+                // (KerbInteractiveLogon or MsV1_0InteractiveLogon structure).
+                //
+                // For the POC, we signal success. The actual serialization requires
+                // building the proper KERB_INTERACTIVE_LOGON or MSV1_0_INTERACTIVE_LOGON
+                // structure with the token handle, which is complex.
+                //
+                // TODO: Build proper credential serialization from S4U token
+                log::info!(
+                    "S4U logon successful for {}\\{}, session {}",
+                    domain,
+                    username,
+                    session_info.session_id
+                );
+
+                unsafe {
+                    *_pcpgsr = CPGSR_RETURN_CREDENTIAL_FINISHED;
+                    // Note: In production, pcpcs would be filled with the serialized credentials
+                }
+
+                Ok(())
+            }
+            Err(e) => {
+                log::error!("S4U logon failed for {}\\{}: {}", domain, username, e);
+                unsafe {
+                    *_pcpgsr = CPGSR_NO_CREDENTIAL_FINISHED;
+                }
+                Ok(())
+            }
+        }
+    }
+
+    fn ReportResult(
+        &self,
+        _ntstatus: NTSTATUS,
+        _ntssubstatus: NTSTATUS,
+        _ppszoptionalstatustext: *mut PWSTR,
+        _pcpsioptionalstatusicon: *mut CREDENTIAL_PROVIDER_STATUS_ICON,
+    ) -> Result<()> {
+        Ok(())
+    }
+}

client/rdp/credprov/src/guid.rs

@@ -0,0 +1,11 @@
+use windows::core::GUID;
+
+/// CLSID for the NetBird RDP Credential Provider.
+/// Generated UUID: {7B3A8E5F-1C4D-4F8A-B2E6-9D0F3A7C5E1B}
+pub const CLSID_NETBIRD_CREDENTIAL_PROVIDER: GUID = GUID::from_u128(
+    0x7B3A8E5F_1C4D_4F8A_B2E6_9D0F3A7C5E1B,
+);
+
+/// Registry path for credential providers.
+pub const CREDENTIAL_PROVIDER_REGISTRY_PATH: &str =
+    r"SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers";

client/rdp/credprov/src/lib.rs

@@ -0,0 +1,309 @@
+//! NetBird RDP Credential Provider for Windows.
+//!
+//! This DLL is a Windows Credential Provider that enables passwordless RDP access
+//! to machines running the NetBird agent. It is loaded by Windows' LogonUI.exe
+//! via COM when the login screen is displayed.
+//!
+//! ## How it works
+//!
+//! 1. The DLL is registered as a Credential Provider in the Windows registry
+//! 2. When an RDP session begins, LogonUI loads the DLL
+//! 3. The DLL queries the local NetBird agent via named pipe for pending sessions
+//! 4. If a pending session exists for the connecting peer, the DLL:
+//!    - Shows a "NetBird Login" credential tile
+//!    - Performs S4U logon to create a Windows token without a password
+//!    - Returns the token to LogonUI for session creation
+
+mod credential;
+mod guid;
+mod named_pipe_client;
+mod provider;
+mod s4u;
+
+use guid::CLSID_NETBIRD_CREDENTIAL_PROVIDER;
+use provider::NetBirdCredentialProvider;
+use std::sync::atomic::{AtomicU32, Ordering};
+use windows::core::*;
+use windows::Win32::Foundation::*;
+use windows::Win32::System::Com::*;
+
+/// DLL reference count for COM lifecycle management.
+static DLL_REF_COUNT: AtomicU32 = AtomicU32::new(0);
+
+/// DLL module handle.
+static mut DLL_MODULE: HMODULE = HMODULE(std::ptr::null_mut());
+
+/// COM class factory for creating NetBirdCredentialProvider instances.
+#[implement(IClassFactory)]
+struct NetBirdClassFactory;
+
+impl IClassFactory_Impl for NetBirdClassFactory_Impl {
+    fn CreateInstance(
+        &self,
+        _punkouter: Option<&IUnknown>,
+        riid: *const GUID,
+        ppvobject: *mut *mut std::ffi::c_void,
+    ) -> Result<()> {
+        unsafe {
+            if !ppvobject.is_null() {
+                *ppvobject = std::ptr::null_mut();
+            }
+        }
+
+        if _punkouter.is_some() {
+            return Err(CLASS_E_NOAGGREGATION.into());
+        }
+
+        let provider = NetBirdCredentialProvider::new();
+        let unknown: IUnknown = provider.into();
+
+        unsafe {
+            unknown.query(riid, ppvobject).ok()
+        }
+    }
+
+    fn LockServer(&self, flock: BOOL) -> Result<()> {
+        if flock.as_bool() {
+            DLL_REF_COUNT.fetch_add(1, Ordering::SeqCst);
+        } else {
+            DLL_REF_COUNT.fetch_sub(1, Ordering::SeqCst);
+        }
+        Ok(())
+    }
+}
+
+/// DLL entry point.
+#[no_mangle]
+extern "system" fn DllMain(hinstance: HMODULE, reason: u32, _reserved: *mut std::ffi::c_void) -> BOOL {
+    const DLL_PROCESS_ATTACH: u32 = 1;
+
+    if reason == DLL_PROCESS_ATTACH {
+        unsafe {
+            DLL_MODULE = hinstance;
+        }
+    }
+
+    TRUE
+}
+
+/// COM entry point: returns a class factory for the requested CLSID.
+#[no_mangle]
+extern "system" fn DllGetClassObject(
+    rclsid: *const GUID,
+    riid: *const GUID,
+    ppv: *mut *mut std::ffi::c_void,
+) -> HRESULT {
+    unsafe {
+        if ppv.is_null() {
+            return E_POINTER;
+        }
+        *ppv = std::ptr::null_mut();
+
+        if *rclsid != CLSID_NETBIRD_CREDENTIAL_PROVIDER {
+            return CLASS_E_CLASSNOTAVAILABLE;
+        }
+
+        let factory = NetBirdClassFactory;
+        let unknown: IUnknown = factory.into();
+
+        match unknown.query(riid, ppv) {
+            Ok(()) => S_OK,
+            Err(e) => e.code(),
+        }
+    }
+}
+
+/// COM entry point: indicates whether the DLL can be unloaded.
+#[no_mangle]
+extern "system" fn DllCanUnloadNow() -> HRESULT {
+    if DLL_REF_COUNT.load(Ordering::SeqCst) == 0 {
+        S_OK
+    } else {
+        S_FALSE
+    }
+}
+
+/// Self-registration: called by regsvr32 to register the credential provider.
+#[no_mangle]
+extern "system" fn DllRegisterServer() -> HRESULT {
+    match register_credential_provider(true) {
+        Ok(()) => S_OK,
+        Err(_) => E_FAIL,
+    }
+}
+
+/// Self-unregistration: called by regsvr32 /u to unregister the credential provider.
+#[no_mangle]
+extern "system" fn DllUnregisterServer() -> HRESULT {
+    match register_credential_provider(false) {
+        Ok(()) => S_OK,
+        Err(_) => E_FAIL,
+    }
+}
+
+fn register_credential_provider(register: bool) -> std::result::Result<(), Box<dyn std::error::Error>> {
+    use windows::Win32::System::Registry::*;
+
+    let clsid_str = format!("{{{:08X}-{:04X}-{:04X}-{:02X}{:02X}-{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}}}",
+        CLSID_NETBIRD_CREDENTIAL_PROVIDER.data1,
+        CLSID_NETBIRD_CREDENTIAL_PROVIDER.data2,
+        CLSID_NETBIRD_CREDENTIAL_PROVIDER.data3,
+        CLSID_NETBIRD_CREDENTIAL_PROVIDER.data4[0],
+        CLSID_NETBIRD_CREDENTIAL_PROVIDER.data4[1],
+        CLSID_NETBIRD_CREDENTIAL_PROVIDER.data4[2],
+        CLSID_NETBIRD_CREDENTIAL_PROVIDER.data4[3],
+        CLSID_NETBIRD_CREDENTIAL_PROVIDER.data4[4],
+        CLSID_NETBIRD_CREDENTIAL_PROVIDER.data4[5],
+        CLSID_NETBIRD_CREDENTIAL_PROVIDER.data4[6],
+        CLSID_NETBIRD_CREDENTIAL_PROVIDER.data4[7],
+    );
+
+    if register {
+        // Register under Credential Providers
+        let cp_key_path = format!(
+            r"SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{}",
+            clsid_str
+        );
+
+        let cp_key_wide: Vec<u16> = cp_key_path.encode_utf16().chain(std::iter::once(0)).collect();
+        let mut hkey = HKEY::default();
+
+        unsafe {
+            let result = RegCreateKeyExW(
+                HKEY_LOCAL_MACHINE,
+                PCWSTR(cp_key_wide.as_ptr()),
+                0,
+                PCWSTR::null(),
+                REG_OPTION_NON_VOLATILE,
+                KEY_WRITE,
+                None,
+                &mut hkey,
+                None,
+            );
+            if result.is_err() {
+                return Err("Failed to create credential provider registry key".into());
+            }
+
+            let value: Vec<u16> = "NetBird RDP Credential Provider"
+                .encode_utf16()
+                .chain(std::iter::once(0))
+                .collect();
+            let _ = RegSetValueExW(
+                hkey,
+                PCWSTR::null(),
+                0,
+                REG_SZ,
+                Some(std::slice::from_raw_parts(
+                    value.as_ptr() as *const u8,
+                    value.len() * 2,
+                )),
+            );
+            let _ = RegCloseKey(hkey);
+        }
+
+        // Register CLSID in CLSID hive
+        let clsid_key_path = format!(r"CLSID\{}", clsid_str);
+        let clsid_key_wide: Vec<u16> = clsid_key_path.encode_utf16().chain(std::iter::once(0)).collect();
+
+        unsafe {
+            let result = RegCreateKeyExW(
+                HKEY_CLASSES_ROOT,
+                PCWSTR(clsid_key_wide.as_ptr()),
+                0,
+                PCWSTR::null(),
+                REG_OPTION_NON_VOLATILE,
+                KEY_WRITE,
+                None,
+                &mut hkey,
+                None,
+            );
+            if result.is_err() {
+                return Err("Failed to create CLSID registry key".into());
+            }
+            let _ = RegCloseKey(hkey);
+
+            // InprocServer32 subkey
+            let inproc_path = format!(r"CLSID\{}\InprocServer32", clsid_str);
+            let inproc_wide: Vec<u16> = inproc_path.encode_utf16().chain(std::iter::once(0)).collect();
+
+            let result = RegCreateKeyExW(
+                HKEY_CLASSES_ROOT,
+                PCWSTR(inproc_wide.as_ptr()),
+                0,
+                PCWSTR::null(),
+                REG_OPTION_NON_VOLATILE,
+                KEY_WRITE,
+                None,
+                &mut hkey,
+                None,
+            );
+            if result.is_err() {
+                return Err("Failed to create InprocServer32 registry key".into());
+            }
+
+            // Set DLL path
+            let mut dll_path = [0u16; 260];
+            let len = windows::Win32::System::LibraryLoader::GetModuleFileNameW(
+                DLL_MODULE,
+                &mut dll_path,
+            );
+            if len > 0 {
+                let _ = RegSetValueExW(
+                    hkey,
+                    PCWSTR::null(),
+                    0,
+                    REG_SZ,
+                    Some(std::slice::from_raw_parts(
+                        dll_path.as_ptr() as *const u8,
+                        (len as usize + 1) * 2,
+                    )),
+                );
+            }
+
+            // Set threading model
+            let threading: Vec<u16> = "Apartment"
+                .encode_utf16()
+                .chain(std::iter::once(0))
+                .collect();
+            let threading_name: Vec<u16> = "ThreadingModel"
+                .encode_utf16()
+                .chain(std::iter::once(0))
+                .collect();
+            let _ = RegSetValueExW(
+                hkey,
+                PCWSTR(threading_name.as_ptr()),
+                0,
+                REG_SZ,
+                Some(std::slice::from_raw_parts(
+                    threading.as_ptr() as *const u8,
+                    threading.len() * 2,
+                )),
+            );
+
+            let _ = RegCloseKey(hkey);
+        }
+    } else {
+        // Unregister
+        let cp_key_path = format!(
+            r"SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{}",
+            clsid_str
+        );
+        let cp_key_wide: Vec<u16> = cp_key_path.encode_utf16().chain(std::iter::once(0)).collect();
+
+        unsafe {
+            let _ = RegDeleteKeyW(HKEY_LOCAL_MACHINE, PCWSTR(cp_key_wide.as_ptr()));
+        }
+
+        let inproc_path = format!(r"CLSID\{}\InprocServer32", clsid_str);
+        let inproc_wide: Vec<u16> = inproc_path.encode_utf16().chain(std::iter::once(0)).collect();
+        let clsid_key_path = format!(r"CLSID\{}", clsid_str);
+        let clsid_wide: Vec<u16> = clsid_key_path.encode_utf16().chain(std::iter::once(0)).collect();
+
+        unsafe {
+            let _ = RegDeleteKeyW(HKEY_CLASSES_ROOT, PCWSTR(inproc_wide.as_ptr()));
+            let _ = RegDeleteKeyW(HKEY_CLASSES_ROOT, PCWSTR(clsid_wide.as_ptr()));
+        }
+    }
+
+    Ok(())
+}

client/rdp/credprov/src/named_pipe_client.rs

@@ -0,0 +1,135 @@
+use serde::{Deserialize, Serialize};
+use std::io::{Read, Write};
+use std::time::Duration;
+
+/// Named pipe path for communicating with the NetBird agent.
+const PIPE_NAME: &str = r"\\.\pipe\netbird-rdp-auth";
+
+/// Maximum response size from the agent.
+const MAX_RESPONSE_SIZE: usize = 4096;
+
+/// Timeout for named pipe operations.
+const PIPE_TIMEOUT: Duration = Duration::from_secs(5);
+
+/// Request sent to the NetBird agent via named pipe.
+#[derive(Serialize)]
+pub struct PipeRequest {
+    pub action: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub remote_ip: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_id: Option<String>,
+}
+
+/// Response received from the NetBird agent via named pipe.
+#[derive(Deserialize, Debug, Clone)]
+pub struct PipeResponse {
+    pub found: bool,
+    #[serde(default)]
+    pub session_id: String,
+    #[serde(default)]
+    pub os_user: String,
+    #[serde(default)]
+    pub domain: String,
+}
+
+/// Client for communicating with the NetBird agent's named pipe server.
+pub struct NamedPipeClient;
+
+impl NamedPipeClient {
+    /// Query the NetBird agent for a pending RDP session matching the given remote IP.
+    pub fn query_pending(remote_ip: &str) -> Result<PipeResponse, PipeError> {
+        let request = PipeRequest {
+            action: "query_pending".to_string(),
+            remote_ip: Some(remote_ip.to_string()),
+            session_id: None,
+        };
+        Self::send_request(&request)
+    }
+
+    /// Tell the NetBird agent to consume (mark as used) a pending session.
+    pub fn consume_session(session_id: &str) -> Result<PipeResponse, PipeError> {
+        let request = PipeRequest {
+            action: "consume".to_string(),
+            remote_ip: None,
+            session_id: Some(session_id.to_string()),
+        };
+        Self::send_request(&request)
+    }
+
+    fn send_request(request: &PipeRequest) -> Result<PipeResponse, PipeError> {
+        let request_data =
+            serde_json::to_vec(request).map_err(|e| PipeError::Serialization(e.to_string()))?;
+
+        // Open named pipe (CreateFile in Windows)
+        let mut pipe = Self::open_pipe()?;
+
+        // Write request
+        pipe.write_all(&request_data)
+            .map_err(|e| PipeError::Write(e.to_string()))?;
+
+        // Shutdown write side to signal end of request
+        // For named pipes on Windows, we rely on the message boundary
+        pipe.flush()
+            .map_err(|e| PipeError::Write(e.to_string()))?;
+
+        // Read response
+        let mut response_data = vec![0u8; MAX_RESPONSE_SIZE];
+        let n = pipe
+            .read(&mut response_data)
+            .map_err(|e| PipeError::Read(e.to_string()))?;
+
+        let response: PipeResponse = serde_json::from_slice(&response_data[..n])
+            .map_err(|e| PipeError::Deserialization(e.to_string()))?;
+
+        Ok(response)
+    }
+
+    fn open_pipe() -> Result<std::fs::File, PipeError> {
+        // On Windows, named pipes are opened like files
+        use std::fs::OpenOptions;
+
+        // Try to open the pipe with a brief retry for PIPE_BUSY
+        for attempt in 0..3 {
+            match OpenOptions::new().read(true).write(true).open(PIPE_NAME) {
+                Ok(file) => return Ok(file),
+                Err(e) => {
+                    if attempt < 2 {
+                        std::thread::sleep(Duration::from_millis(100));
+                        continue;
+                    }
+                    return Err(PipeError::Connect(format!(
+                        "failed to open pipe {}: {}",
+                        PIPE_NAME, e
+                    )));
+                }
+            }
+        }
+
+        Err(PipeError::Connect("exhausted pipe connection attempts".to_string()))
+    }
+}
+
+/// Errors that can occur during named pipe communication.
+#[derive(Debug)]
+pub enum PipeError {
+    Connect(String),
+    Write(String),
+    Read(String),
+    Serialization(String),
+    Deserialization(String),
+}
+
+impl std::fmt::Display for PipeError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            PipeError::Connect(e) => write!(f, "pipe connect: {}", e),
+            PipeError::Write(e) => write!(f, "pipe write: {}", e),
+            PipeError::Read(e) => write!(f, "pipe read: {}", e),
+            PipeError::Serialization(e) => write!(f, "pipe serialization: {}", e),
+            PipeError::Deserialization(e) => write!(f, "pipe deserialization: {}", e),
+        }
+    }
+}
+
+impl std::error::Error for PipeError {}

client/rdp/credprov/src/provider.rs

@@ -0,0 +1,270 @@
+//! ICredentialProvider implementation.
+//!
+//! This is the main COM object that Windows' LogonUI.exe instantiates.
+//! It determines whether to show a "NetBird Login" credential tile based on
+//! whether the NetBird agent has a pending RDP session for the connecting peer.
+
+use crate::credential::NetBirdCredential;
+use crate::guid::CLSID_NETBIRD_CREDENTIAL_PROVIDER;
+use crate::named_pipe_client::NamedPipeClient;
+use std::sync::Mutex;
+use windows::core::*;
+use windows::Win32::Foundation::*;
+use windows::Win32::Security::Credentials::*;
+use windows::Win32::System::RemoteDesktop::*;
+
+/// The NetBird Credential Provider, loaded by LogonUI.exe via COM.
+#[implement(ICredentialProvider)]
+pub struct NetBirdCredentialProvider {
+    /// The credential tile (if a pending session was found).
+    credential: Mutex<Option<ICredentialProviderCredential>>,
+    /// Whether this provider is active for the current usage scenario.
+    active: Mutex<bool>,
+}
+
+impl NetBirdCredentialProvider {
+    pub fn new() -> Self {
+        Self {
+            credential: Mutex::new(None),
+            active: Mutex::new(false),
+        }
+    }
+}
+
+impl ICredentialProvider_Impl for NetBirdCredentialProvider_Impl {
+    fn SetUsageScenario(
+        &self,
+        cpus: CREDENTIAL_PROVIDER_USAGE_SCENARIO,
+        _dwflags: u32,
+    ) -> Result<()> {
+        let mut active = self.active.lock().unwrap();
+
+        match cpus {
+            CPUS_LOGON | CPUS_UNLOCK_WORKSTATION => {
+                // We activate for RDP logon and unlock scenarios
+                *active = true;
+                log::info!("NetBird CP activated for usage scenario {:?}", cpus.0);
+                Ok(())
+            }
+            _ => {
+                // Don't activate for credui or other scenarios
+                *active = false;
+                Err(E_NOTIMPL.into())
+            }
+        }
+    }
+
+    fn SetSerialization(
+        &self,
+        _pcpcs: *const CREDENTIAL_PROVIDER_CREDENTIAL_SERIALIZATION,
+    ) -> Result<()> {
+        Err(E_NOTIMPL.into())
+    }
+
+    fn Advise(
+        &self,
+        _pcpe: Option<&ICredentialProviderEvents>,
+        _upadvisecontext: usize,
+    ) -> Result<()> {
+        Ok(())
+    }
+
+    fn UnAdvise(&self) -> Result<()> {
+        Ok(())
+    }
+
+    fn GetFieldDescriptorCount(&self) -> Result<u32> {
+        // We have one field: a large text label showing "NetBird: Logging in as <user>"
+        Ok(1)
+    }
+
+    fn GetFieldDescriptorAt(
+        &self,
+        _dwindex: u32,
+        _ppcpfd: *mut *mut CREDENTIAL_PROVIDER_FIELD_DESCRIPTOR,
+    ) -> Result<()> {
+        if _dwindex != 0 {
+            return Err(E_INVALIDARG.into());
+        }
+
+        let label = "NetBird Login";
+        let wide: Vec<u16> = label.encode_utf16().chain(std::iter::once(0)).collect();
+
+        unsafe {
+            let desc = windows::Win32::System::Com::CoTaskMemAlloc(
+                std::mem::size_of::<CREDENTIAL_PROVIDER_FIELD_DESCRIPTOR>(),
+            ) as *mut CREDENTIAL_PROVIDER_FIELD_DESCRIPTOR;
+
+            if desc.is_null() {
+                return Err(E_OUTOFMEMORY.into());
+            }
+
+            let label_mem =
+                windows::Win32::System::Com::CoTaskMemAlloc(wide.len() * 2) as *mut u16;
+            if label_mem.is_null() {
+                windows::Win32::System::Com::CoTaskMemFree(Some(desc as *const _));
+                return Err(E_OUTOFMEMORY.into());
+            }
+            std::ptr::copy_nonoverlapping(wide.as_ptr(), label_mem, wide.len());
+
+            (*desc).dwFieldID = 0;
+            (*desc).cpft = CPFT_LARGE_TEXT;
+            (*desc).pszLabel = PWSTR(label_mem);
+            (*desc).guidFieldType = GUID::zeroed();
+
+            *_ppcpfd = desc;
+        }
+
+        Ok(())
+    }
+
+    fn GetCredentialCount(
+        &self,
+        _pdwcount: *mut u32,
+        _pdwdefault: *mut u32,
+        _pbautologinwithdefault: *mut BOOL,
+    ) -> Result<()> {
+        let active = self.active.lock().unwrap();
+        if !*active {
+            unsafe {
+                *_pdwcount = 0;
+                *_pdwdefault = u32::MAX;
+                *_pbautologinwithdefault = FALSE;
+            }
+            return Ok(());
+        }
+
+        // Try to get the client IP of the current RDP session
+        let remote_ip = match get_rdp_client_ip() {
+            Some(ip) => ip,
+            None => {
+                log::debug!("NetBird CP: could not determine RDP client IP");
+                unsafe {
+                    *_pdwcount = 0;
+                    *_pdwdefault = u32::MAX;
+                    *_pbautologinwithdefault = FALSE;
+                }
+                return Ok(());
+            }
+        };
+
+        // Query the NetBird agent for a pending session
+        match NamedPipeClient::query_pending(&remote_ip) {
+            Ok(response) if response.found => {
+                log::info!(
+                    "NetBird CP: found pending session for {} -> {}",
+                    remote_ip,
+                    response.os_user
+                );
+
+                let cred = NetBirdCredential::new(remote_ip, response);
+                let icred: ICredentialProviderCredential = cred.into();
+
+                let mut credential = self.credential.lock().unwrap();
+                *credential = Some(icred);
+
+                unsafe {
+                    *_pdwcount = 1;
+                    *_pdwdefault = 0;
+                    *_pbautologinwithdefault = TRUE; // auto-logon
+                }
+            }
+            Ok(_) => {
+                log::debug!("NetBird CP: no pending session for {}", remote_ip);
+                unsafe {
+                    *_pdwcount = 0;
+                    *_pdwdefault = u32::MAX;
+                    *_pbautologinwithdefault = FALSE;
+                }
+            }
+            Err(e) => {
+                log::debug!("NetBird CP: pipe query failed: {}", e);
+                unsafe {
+                    *_pdwcount = 0;
+                    *_pdwdefault = u32::MAX;
+                    *_pbautologinwithdefault = FALSE;
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    fn GetCredentialAt(
+        &self,
+        _dwindex: u32,
+        _ppcpc: *mut Option<ICredentialProviderCredential>,
+    ) -> Result<()> {
+        if _dwindex != 0 {
+            return Err(E_INVALIDARG.into());
+        }
+
+        let credential = self.credential.lock().unwrap();
+        match &*credential {
+            Some(cred) => {
+                unsafe {
+                    *_ppcpc = Some(cred.clone());
+                }
+                Ok(())
+            }
+            None => Err(E_UNEXPECTED.into()),
+        }
+    }
+}
+
+/// Get the IP address of the remote RDP client for the current session.
+fn get_rdp_client_ip() -> Option<String> {
+    unsafe {
+        // Get the current session ID
+        let process_id = windows::Win32::System::Threading::GetCurrentProcessId();
+        let mut session_id = 0u32;
+
+        if !windows::Win32::System::RemoteDesktop::ProcessIdToSessionId(process_id, &mut session_id)
+            .as_bool()
+        {
+            log::debug!("ProcessIdToSessionId failed");
+            return None;
+        }
+
+        // Query the client address
+        let mut buffer: *mut WTS_CLIENT_ADDRESS = std::ptr::null_mut();
+        let mut bytes_returned = 0u32;
+
+        let result = WTSQuerySessionInformationW(
+            WTS_CURRENT_SERVER_HANDLE,
+            session_id,
+            WTS_INFO_CLASS(14), // WTSClientAddress
+            &mut buffer as *mut _ as *mut *mut u16,
+            &mut bytes_returned,
+        );
+
+        if !result.as_bool() || buffer.is_null() {
+            log::debug!("WTSQuerySessionInformation(WTSClientAddress) failed");
+            return None;
+        }
+
+        let client_addr = &*buffer;
+        let ip = match client_addr.AddressFamily as u32 {
+            // AF_INET
+            2 => {
+                let addr = &client_addr.Address;
+                Some(format!("{}.{}.{}.{}", addr[2], addr[3], addr[4], addr[5]))
+            }
+            // AF_INET6
+            23 => {
+                // IPv6 - extract from Address bytes
+                let addr = &client_addr.Address;
+                Some(format!(
+                    "{:02x}{:02x}:{:02x}{:02x}:{:02x}{:02x}:{:02x}{:02x}:{:02x}{:02x}:{:02x}{:02x}:{:02x}{:02x}:{:02x}{:02x}",
+                    addr[2], addr[3], addr[4], addr[5], addr[6], addr[7], addr[8], addr[9],
+                    addr[10], addr[11], addr[12], addr[13], addr[14], addr[15], addr[16], addr[17]
+                ))
+            }
+            _ => None,
+        };
+
+        WTSFreeMemory(buffer as *mut std::ffi::c_void);
+
+        ip
+    }
+}

client/rdp/credprov/src/s4u.rs

@@ -0,0 +1,398 @@
+//! S4U (Service for User) authentication for Windows.
+//!
+//! This module ports the S4U logon logic from the Go implementation at:
+//! `client/ssh/server/executor_windows.go:generateS4UUserToken()`
+//!
+//! It creates Windows logon tokens without requiring a password, using the LSA
+//! (Local Security Authority) S4U mechanism. This is the same approach used by
+//! OpenSSH for Windows for public key authentication.
+
+use std::ptr;
+use windows::core::{PCSTR, PWSTR};
+use windows::Win32::Foundation::{HANDLE, LUID, NTSTATUS, PSID};
+use windows::Win32::Security::Authentication::Identity::{
+    LsaDeregisterLogonProcess, LsaFreeReturnBuffer, LsaLogonUser, LsaLookupAuthenticationPackage,
+    LsaRegisterLogonProcess, KERB_S4U_LOGON, MSV1_0_S4U_LOGON, MSV1_0_S4U_LOGON_FLAG_CHECK_LOGONHOURS,
+    SECURITY_LOGON_TYPE,
+};
+use windows::Win32::Security::{
+    QUOTA_LIMITS, TOKEN_SOURCE,
+};
+
+/// Status code for successful LSA operations.
+const STATUS_SUCCESS: i32 = 0;
+
+/// Network logon type (used for S4U).
+const LOGON32_LOGON_NETWORK: SECURITY_LOGON_TYPE = SECURITY_LOGON_TYPE(3);
+
+/// Kerberos S4U logon message type.
+const KERB_S4U_LOGON_TYPE: u32 = 12;
+
+/// MSV1_0 S4U logon message type.
+const MSV1_0_S4U_LOGON_TYPE: u32 = 12;
+
+/// Authentication package name for Kerberos.
+const KERBEROS_PACKAGE: &str = "Kerberos";
+
+/// Authentication package name for MSV1_0 (local users).
+const MSV1_0_PACKAGE: &str = "MICROSOFT_AUTHENTICATION_PACKAGE_V1_0";
+
+/// Result of a successful S4U logon.
+pub struct S4UToken {
+    pub handle: HANDLE,
+}
+
+impl Drop for S4UToken {
+    fn drop(&mut self) {
+        if !self.handle.is_invalid() {
+            unsafe {
+                let _ = windows::Win32::Foundation::CloseHandle(self.handle);
+            }
+        }
+    }
+}
+
+/// Errors from S4U logon operations.
+#[derive(Debug)]
+pub enum S4UError {
+    LsaRegister(NTSTATUS),
+    LookupPackage(NTSTATUS),
+    LogonUser(NTSTATUS, i32),
+    AllocateLuid,
+    InvalidUsername(String),
+    Utf16Conversion(String),
+}
+
+impl std::fmt::Display for S4UError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            S4UError::LsaRegister(s) => write!(f, "LsaRegisterLogonProcess: 0x{:x}", s.0),
+            S4UError::LookupPackage(s) => write!(f, "LsaLookupAuthenticationPackage: 0x{:x}", s.0),
+            S4UError::LogonUser(s, sub) => {
+                write!(f, "LsaLogonUser S4U: NTSTATUS=0x{:x}, SubStatus=0x{:x}", s.0, sub)
+            }
+            S4UError::AllocateLuid => write!(f, "AllocateLocallyUniqueId failed"),
+            S4UError::InvalidUsername(u) => write!(f, "invalid username: {}", u),
+            S4UError::Utf16Conversion(s) => write!(f, "UTF-16 conversion: {}", s),
+        }
+    }
+}
+
+impl std::error::Error for S4UError {}
+
+/// Generate a Windows logon token using S4U authentication.
+///
+/// This creates a token for the specified user without requiring a password.
+/// The calling process must have SeTcbPrivilege (typically SYSTEM).
+///
+/// # Arguments
+/// * `username` - The Windows username (without domain prefix)
+/// * `domain` - The domain name ("." for local users)
+///
+/// # Returns
+/// An `S4UToken` containing the Windows logon token handle.
+pub fn generate_s4u_token(username: &str, domain: &str) -> Result<S4UToken, S4UError> {
+    if username.is_empty() {
+        return Err(S4UError::InvalidUsername("empty username".to_string()));
+    }
+
+    let is_local = is_local_user(domain);
+
+    // Initialize LSA connection
+    let lsa_handle = initialize_lsa_connection()?;
+
+    // Lookup authentication package
+    let auth_package_id = lookup_auth_package(lsa_handle, is_local)?;
+
+    // Perform S4U logon
+    let result = perform_s4u_logon(lsa_handle, auth_package_id, username, domain, is_local);
+
+    // Cleanup LSA connection
+    unsafe {
+        let _ = LsaDeregisterLogonProcess(lsa_handle);
+    }
+
+    result
+}
+
+fn is_local_user(domain: &str) -> bool {
+    domain.is_empty() || domain == "."
+}
+
+fn initialize_lsa_connection() -> Result<HANDLE, S4UError> {
+    let process_name = "NetBird\0";
+    let mut lsa_string = windows::Win32::Security::Authentication::Identity::LSA_STRING {
+        Length: (process_name.len() - 1) as u16,
+        MaximumLength: process_name.len() as u16,
+        Buffer: windows::core::PSTR(process_name.as_ptr() as *mut u8),
+    };
+
+    let mut lsa_handle = HANDLE::default();
+    let mut mode = 0u32;
+
+    let status = unsafe {
+        LsaRegisterLogonProcess(&mut lsa_string, &mut lsa_handle, &mut mode)
+    };
+
+    if status.0 != STATUS_SUCCESS {
+        return Err(S4UError::LsaRegister(status));
+    }
+
+    Ok(lsa_handle)
+}
+
+fn lookup_auth_package(lsa_handle: HANDLE, is_local: bool) -> Result<u32, S4UError> {
+    let package_name = if is_local { MSV1_0_PACKAGE } else { KERBEROS_PACKAGE };
+    let package_with_null = format!("{}\0", package_name);
+
+    let mut lsa_string = windows::Win32::Security::Authentication::Identity::LSA_STRING {
+        Length: (package_with_null.len() - 1) as u16,
+        MaximumLength: package_with_null.len() as u16,
+        Buffer: windows::core::PSTR(package_with_null.as_ptr() as *mut u8),
+    };
+
+    let mut auth_package_id = 0u32;
+    let status = unsafe {
+        LsaLookupAuthenticationPackage(lsa_handle, &mut lsa_string, &mut auth_package_id)
+    };
+
+    if status.0 != STATUS_SUCCESS {
+        return Err(S4UError::LookupPackage(status));
+    }
+
+    Ok(auth_package_id)
+}
+
+fn perform_s4u_logon(
+    lsa_handle: HANDLE,
+    auth_package_id: u32,
+    username: &str,
+    domain: &str,
+    is_local: bool,
+) -> Result<S4UToken, S4UError> {
+    // Prepare token source
+    let mut source_name = [0u8; 8];
+    let name_bytes = b"netbird";
+    source_name[..name_bytes.len()].copy_from_slice(name_bytes);
+
+    let mut source_id = LUID::default();
+    let alloc_ok = unsafe {
+        windows::Win32::System::SystemInformation::GetSystemTimeAsFileTime(
+            &mut std::mem::zeroed(),
+        );
+        // Use a simpler approach - just use the current time as a unique ID
+        source_id.LowPart = std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap_or_default()
+            .subsec_nanos();
+        source_id.HighPart = std::process::id() as i32;
+        true
+    };
+
+    if !alloc_ok {
+        return Err(S4UError::AllocateLuid);
+    }
+
+    let token_source = TOKEN_SOURCE {
+        SourceName: source_name,
+        SourceIdentifier: source_id,
+    };
+
+    let origin_name_str = "netbird\0";
+    let mut origin_name = windows::Win32::Security::Authentication::Identity::LSA_STRING {
+        Length: (origin_name_str.len() - 1) as u16,
+        MaximumLength: origin_name_str.len() as u16,
+        Buffer: windows::core::PSTR(origin_name_str.as_ptr() as *mut u8),
+    };
+
+    // Build the logon info structure
+    let (logon_info_ptr, logon_info_size) = if is_local {
+        build_msv1_0_s4u_logon(username)?
+    } else {
+        build_kerb_s4u_logon(username, domain)?
+    };
+
+    let mut profile: *mut std::ffi::c_void = ptr::null_mut();
+    let mut profile_size = 0u32;
+    let mut logon_id = LUID::default();
+    let mut token = HANDLE::default();
+    let mut quotas = QUOTA_LIMITS::default();
+    let mut sub_status: i32 = 0;
+
+    let status = unsafe {
+        LsaLogonUser(
+            lsa_handle,
+            &mut origin_name,
+            LOGON32_LOGON_NETWORK,
+            auth_package_id,
+            logon_info_ptr as *const std::ffi::c_void,
+            logon_info_size as u32,
+            None,  // local groups
+            &token_source,
+            &mut profile,
+            &mut profile_size,
+            &mut logon_id,
+            &mut token,
+            &mut quotas,
+            &mut sub_status,
+        )
+    };
+
+    // Free profile buffer if allocated
+    if !profile.is_null() {
+        unsafe {
+            let _ = LsaFreeReturnBuffer(profile);
+        }
+    }
+
+    // Free the logon info buffer
+    unsafe {
+        let layout = std::alloc::Layout::from_size_align_unchecked(logon_info_size, 8);
+        std::alloc::dealloc(logon_info_ptr as *mut u8, layout);
+    }
+
+    if status.0 != STATUS_SUCCESS {
+        return Err(S4UError::LogonUser(status, sub_status));
+    }
+
+    Ok(S4UToken { handle: token })
+}
+
+/// Build MSV1_0_S4U_LOGON structure for local users.
+fn build_msv1_0_s4u_logon(username: &str) -> Result<(*mut u8, usize), S4UError> {
+    let username_utf16: Vec<u16> = username.encode_utf16().chain(std::iter::once(0)).collect();
+    let domain_utf16: Vec<u16> = ".".encode_utf16().chain(std::iter::once(0)).collect();
+
+    let username_byte_size = username_utf16.len() * 2;
+    let domain_byte_size = domain_utf16.len() * 2;
+
+    // MSV1_0_S4U_LOGON structure:
+    // MessageType: u32 (4 bytes)
+    // Flags: u32 (4 bytes)
+    // UserPrincipalName: UNICODE_STRING (8 bytes on 32-bit, 16 bytes on 64-bit)
+    // DomainName: UNICODE_STRING
+    let struct_size = std::mem::size_of::<MSV1_0_S4U_LOGON_HEADER>();
+    let total_size = struct_size + username_byte_size + domain_byte_size;
+
+    let layout = std::alloc::Layout::from_size_align(total_size, 8).unwrap();
+    let buffer = unsafe { std::alloc::alloc_zeroed(layout) };
+
+    if buffer.is_null() {
+        return Err(S4UError::Utf16Conversion("allocation failed".to_string()));
+    }
+
+    // For the POC, we'll set up the raw bytes manually since the windows-rs
+    // MSV1_0_S4U_LOGON structure layout may differ.
+    // This is a simplified version - in production, use proper FFI bindings.
+
+    unsafe {
+        // MessageType = MSV1_0_S4U_LOGON_TYPE (12)
+        *(buffer as *mut u32) = MSV1_0_S4U_LOGON_TYPE;
+        // Flags = 0
+        *((buffer as *mut u32).add(1)) = 0;
+
+        // Copy username UTF-16 after the structure
+        let username_offset = struct_size;
+        let username_dest = buffer.add(username_offset);
+        ptr::copy_nonoverlapping(
+            username_utf16.as_ptr() as *const u8,
+            username_dest,
+            username_byte_size,
+        );
+
+        // Copy domain UTF-16 after username
+        let domain_offset = username_offset + username_byte_size;
+        let domain_dest = buffer.add(domain_offset);
+        ptr::copy_nonoverlapping(
+            domain_utf16.as_ptr() as *const u8,
+            domain_dest,
+            domain_byte_size,
+        );
+
+        // Set UNICODE_STRING for UserPrincipalName (offset 8 on 64-bit)
+        // Length, MaximumLength, Buffer pointer
+        let upn_ptr = buffer.add(8) as *mut u16;
+        *upn_ptr = ((username_utf16.len() - 1) * 2) as u16; // Length (without null)
+        *(upn_ptr.add(1)) = (username_utf16.len() * 2) as u16; // MaximumLength
+        *((buffer.add(8 + 4)) as *mut *const u8) = username_dest; // Buffer
+
+        // Set UNICODE_STRING for DomainName
+        let dn_offset = 8 + std::mem::size_of::<UnicodeStringRaw>();
+        let dn_ptr = buffer.add(dn_offset) as *mut u16;
+        *dn_ptr = ((domain_utf16.len() - 1) * 2) as u16;
+        *(dn_ptr.add(1)) = (domain_utf16.len() * 2) as u16;
+        *((buffer.add(dn_offset + 4)) as *mut *const u8) = domain_dest;
+    }
+
+    Ok((buffer, total_size))
+}
+
+/// Build KERB_S4U_LOGON structure for domain users.
+fn build_kerb_s4u_logon(username: &str, domain: &str) -> Result<(*mut u8, usize), S4UError> {
+    // Build UPN: username@domain
+    let upn = format!("{}@{}", username, domain);
+    let upn_utf16: Vec<u16> = upn.encode_utf16().chain(std::iter::once(0)).collect();
+    let upn_byte_size = upn_utf16.len() * 2;
+
+    let struct_size = std::mem::size_of::<KerbS4ULogonHeader>();
+    let total_size = struct_size + upn_byte_size;
+
+    let layout = std::alloc::Layout::from_size_align(total_size, 8).unwrap();
+    let buffer = unsafe { std::alloc::alloc_zeroed(layout) };
+
+    if buffer.is_null() {
+        return Err(S4UError::Utf16Conversion("allocation failed".to_string()));
+    }
+
+    unsafe {
+        // MessageType = KERB_S4U_LOGON_TYPE (12)
+        *(buffer as *mut u32) = KERB_S4U_LOGON_TYPE;
+        // Flags = 0
+        *((buffer as *mut u32).add(1)) = 0;
+
+        // Copy UPN UTF-16 after the structure
+        let upn_offset = struct_size;
+        let upn_dest = buffer.add(upn_offset);
+        ptr::copy_nonoverlapping(
+            upn_utf16.as_ptr() as *const u8,
+            upn_dest,
+            upn_byte_size,
+        );
+
+        // Set UNICODE_STRING for ClientUpn (offset 8)
+        let upn_str_ptr = buffer.add(8) as *mut u16;
+        *upn_str_ptr = ((upn_utf16.len() - 1) * 2) as u16;
+        *(upn_str_ptr.add(1)) = (upn_utf16.len() * 2) as u16;
+        *((buffer.add(8 + 4)) as *mut *const u8) = upn_dest;
+
+        // ClientRealm is empty (zeroed)
+    }
+
+    Ok((buffer, total_size))
+}
+
+/// Raw UNICODE_STRING layout for size calculation.
+#[repr(C)]
+struct UnicodeStringRaw {
+    _length: u16,
+    _maximum_length: u16,
+    _buffer: *const u16,
+}
+
+/// Header size for MSV1_0_S4U_LOGON (MessageType + Flags + 2x UNICODE_STRING).
+#[repr(C)]
+struct MSV1_0_S4U_LOGON_HEADER {
+    _message_type: u32,
+    _flags: u32,
+    _user_principal_name: UnicodeStringRaw,
+    _domain_name: UnicodeStringRaw,
+}
+
+/// Header size for KERB_S4U_LOGON (MessageType + Flags + 2x UNICODE_STRING).
+#[repr(C)]
+struct KerbS4ULogonHeader {
+    _message_type: u32,
+    _flags: u32,
+    _client_upn: UnicodeStringRaw,
+    _client_realm: UnicodeStringRaw,
+}

client/rdp/server/addr.go

@@ -0,0 +1,21 @@
+package server
+
+import (
+	"fmt"
+	"net/netip"
+)
+
+// parseAddr parses a string into a netip.Addr, stripping any port or zone.
+func parseAddr(s string) (netip.Addr, error) {
+	// Try as plain IP first
+	if addr, err := netip.ParseAddr(s); err == nil {
+		return addr, nil
+	}
+
+	// Try as IP:port
+	if addrPort, err := netip.ParseAddrPort(s); err == nil {
+		return addrPort.Addr(), nil
+	}
+
+	return netip.Addr{}, fmt.Errorf("invalid IP address: %s", s)
+}

client/rdp/server/credprov_stub.go

@@ -0,0 +1,13 @@
+//go:build !windows
+
+package server
+
+// RegisterCredentialProvider is a no-op on non-Windows platforms.
+func RegisterCredentialProvider() error {
+	return nil
+}
+
+// UnregisterCredentialProvider is a no-op on non-Windows platforms.
+func UnregisterCredentialProvider() error {
+	return nil
+}

client/rdp/server/credprov_windows.go

@@ -0,0 +1,66 @@
+//go:build windows
+
+package server
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// credProvDLLName is the filename of the credential provider DLL.
+	credProvDLLName = "netbird_credprov.dll"
+)
+
+// RegisterCredentialProvider registers the NetBird Credential Provider COM DLL
+// using regsvr32. The DLL must be shipped alongside the NetBird executable.
+func RegisterCredentialProvider() error {
+	dllPath, err := findCredProvDLL()
+	if err != nil {
+		return fmt.Errorf("find credential provider DLL: %w", err)
+	}
+
+	cmd := exec.Command("regsvr32", "/s", dllPath)
+	if output, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("regsvr32 %s: %w (output: %s)", dllPath, err, string(output))
+	}
+
+	log.Infof("registered RDP credential provider: %s", dllPath)
+	return nil
+}
+
+// UnregisterCredentialProvider unregisters the NetBird Credential Provider COM DLL.
+func UnregisterCredentialProvider() error {
+	dllPath, err := findCredProvDLL()
+	if err != nil {
+		log.Debugf("credential provider DLL not found for unregistration: %v", err)
+		return nil
+	}
+
+	cmd := exec.Command("regsvr32", "/s", "/u", dllPath)
+	if output, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("regsvr32 /u %s: %w (output: %s)", dllPath, err, string(output))
+	}
+
+	log.Infof("unregistered RDP credential provider: %s", dllPath)
+	return nil
+}
+
+// findCredProvDLL locates the credential provider DLL next to the running executable.
+func findCredProvDLL() (string, error) {
+	exePath, err := os.Executable()
+	if err != nil {
+		return "", fmt.Errorf("get executable path: %w", err)
+	}
+
+	dllPath := filepath.Join(filepath.Dir(exePath), credProvDLLName)
+	if _, err := os.Stat(dllPath); err != nil {
+		return "", fmt.Errorf("DLL not found at %s: %w", dllPath, err)
+	}
+
+	return dllPath, nil
+}

client/rdp/server/pending.go

@@ -0,0 +1,184 @@
+package server
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"fmt"
+	"net/netip"
+	"sync"
+	"time"
+
+	"github.com/google/uuid"
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// DefaultSessionTTL is the default time-to-live for pending RDP sessions.
+	DefaultSessionTTL = 60 * time.Second
+
+	// cleanupInterval is how often the store checks for expired sessions.
+	cleanupInterval = 10 * time.Second
+
+	// nonceLength is the length of the nonce in bytes.
+	nonceLength = 32
+)
+
+// PendingRDPSession represents an authorized but not yet consumed RDP session.
+type PendingRDPSession struct {
+	SessionID  string
+	PeerIP     netip.Addr
+	OSUsername string
+	Domain     string
+	JWTUserID  string // for audit trail
+	Nonce      string // replay protection
+	CreatedAt  time.Time
+	ExpiresAt  time.Time
+	consumed   bool
+}
+
+// PendingStore manages pending RDP session entries with automatic expiration.
+type PendingStore struct {
+	mu       sync.RWMutex
+	sessions map[string]*PendingRDPSession // keyed by SessionID
+	nonces   map[string]struct{}           // seen nonces for replay protection
+	ttl      time.Duration
+}
+
+// NewPendingStore creates a new pending session store with the given TTL.
+func NewPendingStore(ttl time.Duration) *PendingStore {
+	if ttl <= 0 {
+		ttl = DefaultSessionTTL
+	}
+	return &PendingStore{
+		sessions: make(map[string]*PendingRDPSession),
+		nonces:   make(map[string]struct{}),
+		ttl:      ttl,
+	}
+}
+
+// Add creates a new pending RDP session and returns it.
+func (ps *PendingStore) Add(peerIP netip.Addr, osUsername, domain, jwtUserID, nonce string) (*PendingRDPSession, error) {
+	ps.mu.Lock()
+	defer ps.mu.Unlock()
+
+	// Check nonce for replay protection
+	if _, seen := ps.nonces[nonce]; seen {
+		return nil, fmt.Errorf("duplicate nonce: replay detected")
+	}
+	ps.nonces[nonce] = struct{}{}
+
+	now := time.Now()
+	session := &PendingRDPSession{
+		SessionID:  uuid.New().String(),
+		PeerIP:     peerIP,
+		OSUsername: osUsername,
+		Domain:     domain,
+		JWTUserID:  jwtUserID,
+		Nonce:      nonce,
+		CreatedAt:  now,
+		ExpiresAt:  now.Add(ps.ttl),
+	}
+
+	ps.sessions[session.SessionID] = session
+
+	log.Debugf("RDP pending session created: id=%s peer=%s user=%s domain=%s expires=%s",
+		session.SessionID, peerIP, osUsername, domain, session.ExpiresAt.Format(time.RFC3339))
+
+	return session, nil
+}
+
+// QueryByPeerIP finds the first non-consumed, non-expired pending session for the given peer IP.
+func (ps *PendingStore) QueryByPeerIP(peerIP netip.Addr) (*PendingRDPSession, bool) {
+	ps.mu.RLock()
+	defer ps.mu.RUnlock()
+
+	now := time.Now()
+	for _, session := range ps.sessions {
+		if session.PeerIP == peerIP && !session.consumed && now.Before(session.ExpiresAt) {
+			return session, true
+		}
+	}
+	return nil, false
+}
+
+// Consume marks a session as consumed (single-use). Returns true if the session
+// was found and successfully consumed, false if it was already consumed, expired, or not found.
+func (ps *PendingStore) Consume(sessionID string) bool {
+	ps.mu.Lock()
+	defer ps.mu.Unlock()
+
+	session, exists := ps.sessions[sessionID]
+	if !exists {
+		return false
+	}
+
+	if session.consumed {
+		log.Debugf("RDP pending session already consumed: id=%s", sessionID)
+		return false
+	}
+
+	if time.Now().After(session.ExpiresAt) {
+		log.Debugf("RDP pending session expired: id=%s", sessionID)
+		return false
+	}
+
+	session.consumed = true
+	log.Debugf("RDP pending session consumed: id=%s peer=%s user=%s",
+		sessionID, session.PeerIP, session.OSUsername)
+	return true
+}
+
+// StartCleanup runs a background goroutine that periodically removes expired sessions.
+func (ps *PendingStore) StartCleanup(ctx context.Context) {
+	go func() {
+		ticker := time.NewTicker(cleanupInterval)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-ticker.C:
+				ps.cleanup()
+			}
+		}
+	}()
+}
+
+// cleanup removes expired and consumed sessions.
+func (ps *PendingStore) cleanup() {
+	ps.mu.Lock()
+	defer ps.mu.Unlock()
+
+	now := time.Now()
+	for id, session := range ps.sessions {
+		if now.After(session.ExpiresAt) || session.consumed {
+			delete(ps.sessions, id)
+			delete(ps.nonces, session.Nonce)
+		}
+	}
+}
+
+// Count returns the number of active (non-expired, non-consumed) sessions.
+func (ps *PendingStore) Count() int {
+	ps.mu.RLock()
+	defer ps.mu.RUnlock()
+
+	count := 0
+	now := time.Now()
+	for _, session := range ps.sessions {
+		if !session.consumed && now.Before(session.ExpiresAt) {
+			count++
+		}
+	}
+	return count
+}
+
+// GenerateNonce creates a cryptographically random nonce for replay protection.
+func GenerateNonce() (string, error) {
+	b := make([]byte, nonceLength)
+	if _, err := rand.Read(b); err != nil {
+		return "", fmt.Errorf("generate nonce: %w", err)
+	}
+	return hex.EncodeToString(b), nil
+}

client/rdp/server/pending_test.go

@@ -0,0 +1,268 @@
+package server
+
+import (
+	"context"
+	"net/netip"
+	"sync"
+	"testing"
+	"time"
+)
+
+func TestPendingStore_AddAndQuery(t *testing.T) {
+	store := NewPendingStore(DefaultSessionTTL)
+
+	peerIP := netip.MustParseAddr("100.64.0.1")
+	session, err := store.Add(peerIP, "admin", ".", "user@example.com", "nonce-1")
+	if err != nil {
+		t.Fatalf("Add failed: %v", err)
+	}
+
+	if session.SessionID == "" {
+		t.Fatal("expected non-empty session ID")
+	}
+	if session.PeerIP != peerIP {
+		t.Errorf("expected peer IP %s, got %s", peerIP, session.PeerIP)
+	}
+	if session.OSUsername != "admin" {
+		t.Errorf("expected username admin, got %s", session.OSUsername)
+	}
+
+	// Query should find the session
+	found, ok := store.QueryByPeerIP(peerIP)
+	if !ok {
+		t.Fatal("expected to find pending session")
+	}
+	if found.SessionID != session.SessionID {
+		t.Errorf("expected session %s, got %s", session.SessionID, found.SessionID)
+	}
+
+	// Query for different IP should not find anything
+	_, ok = store.QueryByPeerIP(netip.MustParseAddr("100.64.0.2"))
+	if ok {
+		t.Fatal("expected no session for different IP")
+	}
+}
+
+func TestPendingStore_Consume(t *testing.T) {
+	store := NewPendingStore(DefaultSessionTTL)
+
+	peerIP := netip.MustParseAddr("100.64.0.1")
+	session, err := store.Add(peerIP, "admin", ".", "user@example.com", "nonce-2")
+	if err != nil {
+		t.Fatalf("Add failed: %v", err)
+	}
+
+	// First consume should succeed
+	if !store.Consume(session.SessionID) {
+		t.Fatal("expected first consume to succeed")
+	}
+
+	// Second consume should fail (already consumed)
+	if store.Consume(session.SessionID) {
+		t.Fatal("expected second consume to fail")
+	}
+
+	// Query should no longer find consumed session
+	_, ok := store.QueryByPeerIP(peerIP)
+	if ok {
+		t.Fatal("expected consumed session to not be found by query")
+	}
+}
+
+func TestPendingStore_Expiry(t *testing.T) {
+	store := NewPendingStore(50 * time.Millisecond)
+
+	peerIP := netip.MustParseAddr("100.64.0.1")
+	session, err := store.Add(peerIP, "admin", ".", "user@example.com", "nonce-3")
+	if err != nil {
+		t.Fatalf("Add failed: %v", err)
+	}
+
+	// Should be found immediately
+	_, ok := store.QueryByPeerIP(peerIP)
+	if !ok {
+		t.Fatal("expected to find session before expiry")
+	}
+
+	// Wait for expiry
+	time.Sleep(100 * time.Millisecond)
+
+	// Should not be found after expiry
+	_, ok = store.QueryByPeerIP(peerIP)
+	if ok {
+		t.Fatal("expected session to be expired")
+	}
+
+	// Consume should also fail
+	if store.Consume(session.SessionID) {
+		t.Fatal("expected consume of expired session to fail")
+	}
+}
+
+func TestPendingStore_ReplayProtection(t *testing.T) {
+	store := NewPendingStore(DefaultSessionTTL)
+
+	peerIP := netip.MustParseAddr("100.64.0.1")
+	_, err := store.Add(peerIP, "admin", ".", "user@example.com", "nonce-same")
+	if err != nil {
+		t.Fatalf("first Add failed: %v", err)
+	}
+
+	// Same nonce should be rejected
+	_, err = store.Add(peerIP, "admin", ".", "user@example.com", "nonce-same")
+	if err == nil {
+		t.Fatal("expected duplicate nonce to be rejected")
+	}
+}
+
+func TestPendingStore_Cleanup(t *testing.T) {
+	store := NewPendingStore(50 * time.Millisecond)
+
+	peerIP := netip.MustParseAddr("100.64.0.1")
+	_, err := store.Add(peerIP, "admin", ".", "user@example.com", "nonce-cleanup")
+	if err != nil {
+		t.Fatalf("Add failed: %v", err)
+	}
+
+	if store.Count() != 1 {
+		t.Fatalf("expected count 1, got %d", store.Count())
+	}
+
+	// Wait for expiry then trigger cleanup
+	time.Sleep(100 * time.Millisecond)
+	store.cleanup()
+
+	if store.Count() != 0 {
+		t.Fatalf("expected count 0 after cleanup, got %d", store.Count())
+	}
+}
+
+func TestPendingStore_CleanupBackground(t *testing.T) {
+	store := NewPendingStore(50 * time.Millisecond)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	store.StartCleanup(ctx)
+
+	peerIP := netip.MustParseAddr("100.64.0.1")
+	_, err := store.Add(peerIP, "admin", ".", "user@example.com", "nonce-bg-cleanup")
+	if err != nil {
+		t.Fatalf("Add failed: %v", err)
+	}
+
+	// Wait for expiry + cleanup interval
+	time.Sleep(200 * time.Millisecond)
+
+	_, ok := store.QueryByPeerIP(peerIP)
+	if ok {
+		t.Fatal("expected session to be cleaned up")
+	}
+}
+
+func TestPendingStore_ConcurrentAccess(t *testing.T) {
+	store := NewPendingStore(DefaultSessionTTL)
+
+	var wg sync.WaitGroup
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func(i int) {
+			defer wg.Done()
+
+			ip := netip.AddrFrom4([4]byte{100, 64, byte(i / 256), byte(i % 256)})
+			nonce := "nonce-" + string(rune(i+'A'))
+			if i >= 26 {
+				nonce = "nonce-" + string(rune(i-26+'a'))
+			}
+
+			session, err := store.Add(ip, "admin", ".", "user", nonce)
+			if err != nil {
+				return // nonce collision in test is expected
+			}
+
+			store.QueryByPeerIP(ip)
+			store.Consume(session.SessionID)
+		}(i)
+	}
+
+	wg.Wait()
+}
+
+func TestPendingStore_MultipleSessions(t *testing.T) {
+	store := NewPendingStore(DefaultSessionTTL)
+
+	ip1 := netip.MustParseAddr("100.64.0.1")
+	ip2 := netip.MustParseAddr("100.64.0.2")
+
+	s1, err := store.Add(ip1, "admin", ".", "user1", "nonce-a")
+	if err != nil {
+		t.Fatalf("Add s1 failed: %v", err)
+	}
+
+	s2, err := store.Add(ip2, "jdoe", "DOMAIN", "user2", "nonce-b")
+	if err != nil {
+		t.Fatalf("Add s2 failed: %v", err)
+	}
+
+	// Query each
+	found1, ok := store.QueryByPeerIP(ip1)
+	if !ok || found1.SessionID != s1.SessionID {
+		t.Fatal("expected to find s1")
+	}
+
+	found2, ok := store.QueryByPeerIP(ip2)
+	if !ok || found2.SessionID != s2.SessionID {
+		t.Fatal("expected to find s2")
+	}
+
+	if found2.Domain != "DOMAIN" {
+		t.Errorf("expected domain DOMAIN, got %s", found2.Domain)
+	}
+
+	if store.Count() != 2 {
+		t.Errorf("expected count 2, got %d", store.Count())
+	}
+}
+
+func TestGenerateNonce(t *testing.T) {
+	nonce1, err := GenerateNonce()
+	if err != nil {
+		t.Fatalf("GenerateNonce failed: %v", err)
+	}
+
+	nonce2, err := GenerateNonce()
+	if err != nil {
+		t.Fatalf("GenerateNonce failed: %v", err)
+	}
+
+	if len(nonce1) != nonceLength*2 { // hex encoding doubles the length
+		t.Errorf("expected nonce length %d, got %d", nonceLength*2, len(nonce1))
+	}
+
+	if nonce1 == nonce2 {
+		t.Error("expected unique nonces")
+	}
+}
+
+func TestParseWindowsUsername(t *testing.T) {
+	tests := []struct {
+		input          string
+		expectedUser   string
+		expectedDomain string
+	}{
+		{"admin", "admin", "."},
+		{"DOMAIN\\admin", "admin", "DOMAIN"},
+		{"admin@domain.com", "admin", "domain.com"},
+		{".\\localuser", "localuser", "."},
+	}
+
+	for _, tt := range tests {
+		user, domain := parseWindowsUsername(tt.input)
+		if user != tt.expectedUser {
+			t.Errorf("parseWindowsUsername(%q) user = %q, want %q", tt.input, user, tt.expectedUser)
+		}
+		if domain != tt.expectedDomain {
+			t.Errorf("parseWindowsUsername(%q) domain = %q, want %q", tt.input, domain, tt.expectedDomain)
+		}
+	}
+}

client/rdp/server/pipe_stub.go

@@ -0,0 +1,19 @@
+//go:build !windows
+
+package server
+
+import "context"
+
+type stubPipeServer struct{}
+
+func newPipeServer(_ *PendingStore) PipeServer {
+	return &stubPipeServer{}
+}
+
+func (s *stubPipeServer) Start(_ context.Context) error {
+	return nil
+}
+
+func (s *stubPipeServer) Stop() error {
+	return nil
+}

client/rdp/server/pipe_windows.go

@@ -0,0 +1,164 @@
+//go:build windows
+
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/Microsoft/go-winio"
+)
+
+const (
+	// PipeName is the named pipe path used for IPC between the NetBird agent and
+	// the Credential Provider DLL.
+	PipeName = `\\.\pipe\netbird-rdp-auth`
+
+	// pipeSDDL restricts access to LOCAL_SYSTEM (SY) and Administrators (BA).
+	pipeSDDL = "D:P(A;;GA;;;SY)(A;;GA;;;BA)"
+
+	// maxPipeRequestSize is the maximum size of a pipe request in bytes.
+	maxPipeRequestSize = 4096
+)
+
+// windowsPipeServer implements the PipeServer interface for Windows.
+type windowsPipeServer struct {
+	pending  *PendingStore
+	listener net.Listener
+	mu       sync.Mutex
+	ctx      context.Context
+	cancel   context.CancelFunc
+}
+
+func newPipeServer(pending *PendingStore) PipeServer {
+	return &windowsPipeServer{
+		pending: pending,
+	}
+}
+
+func (s *windowsPipeServer) Start(ctx context.Context) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	s.ctx, s.cancel = context.WithCancel(ctx)
+
+	cfg := &winio.PipeConfig{
+		SecurityDescriptor: pipeSDDL,
+	}
+
+	listener, err := winio.ListenPipe(PipeName, cfg)
+	if err != nil {
+		return err
+	}
+	s.listener = listener
+
+	go s.acceptLoop()
+
+	log.Infof("RDP named pipe server started on %s", PipeName)
+	return nil
+}
+
+func (s *windowsPipeServer) Stop() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.cancel != nil {
+		s.cancel()
+	}
+
+	if s.listener != nil {
+		err := s.listener.Close()
+		s.listener = nil
+		return err
+	}
+	return nil
+}
+
+func (s *windowsPipeServer) acceptLoop() {
+	for {
+		conn, err := s.listener.Accept()
+		if err != nil {
+			if s.ctx.Err() != nil {
+				return
+			}
+			log.Debugf("RDP pipe accept error: %v", err)
+			continue
+		}
+
+		go s.handlePipeConnection(conn)
+	}
+}
+
+func (s *windowsPipeServer) handlePipeConnection(conn net.Conn) {
+	defer func() {
+		if err := conn.Close(); err != nil {
+			log.Debugf("RDP pipe close: %v", err)
+		}
+	}()
+
+	data, err := io.ReadAll(io.LimitReader(conn, maxPipeRequestSize))
+	if err != nil {
+		log.Debugf("RDP pipe read: %v", err)
+		return
+	}
+
+	var req PipeRequest
+	if err := json.Unmarshal(data, &req); err != nil {
+		log.Debugf("RDP pipe unmarshal: %v", err)
+		return
+	}
+
+	var resp PipeResponse
+
+	switch req.Action {
+	case PipeActionQuery:
+		resp = s.handleQuery(req.RemoteIP)
+	case PipeActionConsume:
+		resp = s.handleConsume(req.SessionID)
+	default:
+		log.Debugf("RDP pipe unknown action: %s", req.Action)
+		return
+	}
+
+	respData, err := json.Marshal(resp)
+	if err != nil {
+		log.Debugf("RDP pipe marshal response: %v", err)
+		return
+	}
+
+	if _, err := conn.Write(respData); err != nil {
+		log.Debugf("RDP pipe write response: %v", err)
+	}
+}
+
+func (s *windowsPipeServer) handleQuery(remoteIP string) PipeResponse {
+	peerIP, err := parseAddr(remoteIP)
+	if err != nil {
+		log.Debugf("RDP pipe invalid remote IP: %s", remoteIP)
+		return PipeResponse{Found: false}
+	}
+
+	session, found := s.pending.QueryByPeerIP(peerIP)
+	if !found {
+		return PipeResponse{Found: false}
+	}
+
+	return PipeResponse{
+		Found:     true,
+		SessionID: session.SessionID,
+		OSUser:    session.OSUsername,
+		Domain:    session.Domain,
+	}
+}
+
+func (s *windowsPipeServer) handleConsume(sessionID string) PipeResponse {
+	if s.pending.Consume(sessionID) {
+		return PipeResponse{Found: true, SessionID: sessionID}
+	}
+	return PipeResponse{Found: false}
+}

client/rdp/server/protocol.go

@@ -0,0 +1,48 @@
+package server
+
+// AuthRequest is the sideband authorization request sent by the connecting peer
+// to the target peer's RDP auth server over the WireGuard tunnel.
+type AuthRequest struct {
+	JWTToken      string `json:"jwt_token"`
+	RequestedUser string `json:"requested_user"`
+	ClientPeerIP  string `json:"client_peer_ip"`
+	Nonce         string `json:"nonce"`
+}
+
+// AuthResponse is the sideband authorization response sent by the target peer
+// back to the connecting peer.
+type AuthResponse struct {
+	Status    string `json:"status"`              // "authorized" or "denied"
+	SessionID string `json:"session_id,omitempty"`
+	ExpiresAt int64  `json:"expires_at,omitempty"` // unix timestamp
+	OSUser    string `json:"os_user,omitempty"`
+	Reason    string `json:"reason,omitempty"`
+}
+
+// PipeRequest is the IPC request from the Credential Provider DLL to the NetBird agent
+// via the named pipe.
+type PipeRequest struct {
+	Action    string `json:"action"`               // "query_pending" or "consume"
+	RemoteIP  string `json:"remote_ip"`             // connecting peer's WG IP
+	SessionID string `json:"session_id,omitempty"` // for consume action
+}
+
+// PipeResponse is the IPC response from the NetBird agent to the Credential Provider DLL.
+type PipeResponse struct {
+	Found     bool   `json:"found"`
+	SessionID string `json:"session_id,omitempty"`
+	OSUser    string `json:"os_user,omitempty"`
+	Domain    string `json:"domain,omitempty"`
+}
+
+const (
+	// StatusAuthorized indicates the RDP session was authorized.
+	StatusAuthorized = "authorized"
+	// StatusDenied indicates the RDP session was denied.
+	StatusDenied = "denied"
+
+	// PipeActionQuery queries for a pending session by remote IP.
+	PipeActionQuery = "query_pending"
+	// PipeActionConsume marks a pending session as consumed.
+	PipeActionConsume = "consume"
+)

client/rdp/server/server.go

@@ -0,0 +1,301 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/netip"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
+)
+
+const (
+	// InternalRDPAuthPort is the port the sideband auth server listens on.
+	InternalRDPAuthPort = 22338
+
+	// DefaultRDPAuthPort is the external port on the WireGuard interface (DNAT target).
+	DefaultRDPAuthPort = 22338
+
+	// maxRequestSize is the maximum size of an auth request in bytes.
+	maxRequestSize = 64 * 1024
+
+	// connectionTimeout is the timeout for a single auth connection.
+	connectionTimeout = 30 * time.Second
+)
+
+// JWTValidator validates JWT tokens and extracts user identity.
+type JWTValidator interface {
+	ValidateAndExtract(token string) (userID string, err error)
+}
+
+// Authorizer checks if a user is authorized for RDP access.
+type Authorizer interface {
+	Authorize(jwtUserID, osUsername string) (string, error)
+}
+
+// Server is the sideband RDP authorization server that listens on the WireGuard interface.
+type Server struct {
+	listener     net.Listener
+	pending      *PendingStore
+	pipeServer   PipeServer
+	jwtValidator JWTValidator
+	authorizer   Authorizer
+	sshAuthorizer *sshauth.Authorizer // reuses SSH ACL for RDP access control
+	networkAddr  netip.Prefix // WireGuard network for source IP validation
+
+	mu     sync.Mutex
+	ctx    context.Context
+	cancel context.CancelFunc
+}
+
+// PipeServer is the interface for the named pipe IPC server (platform-specific).
+type PipeServer interface {
+	Start(ctx context.Context) error
+	Stop() error
+}
+
+// Config holds the configuration for the RDP auth server.
+type Config struct {
+	JWTValidator JWTValidator
+	Authorizer   Authorizer
+	NetworkAddr  netip.Prefix
+	SessionTTL   time.Duration
+}
+
+// New creates a new RDP sideband auth server.
+func New(cfg *Config) *Server {
+	ttl := cfg.SessionTTL
+	if ttl <= 0 {
+		ttl = DefaultSessionTTL
+	}
+
+	pending := NewPendingStore(ttl)
+
+	return &Server{
+		pending:       pending,
+		pipeServer:    newPipeServer(pending),
+		jwtValidator:  cfg.JWTValidator,
+		authorizer:    cfg.Authorizer,
+		sshAuthorizer: sshauth.NewAuthorizer(),
+		networkAddr:   cfg.NetworkAddr,
+	}
+}
+
+// UpdateRDPAuth updates the RDP authorization config (reuses SSH ACL).
+func (s *Server) UpdateRDPAuth(config *sshauth.Config) {
+	s.sshAuthorizer.Update(config)
+	log.Debugf("RDP auth: updated authorization config")
+}
+
+// Start begins listening for sideband auth requests on the given address.
+func (s *Server) Start(ctx context.Context, addr netip.AddrPort) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.listener != nil {
+		return errors.New("RDP auth server already running")
+	}
+
+	s.ctx, s.cancel = context.WithCancel(ctx)
+
+	listenAddr := net.TCPAddrFromAddrPort(addr)
+	listener, err := net.ListenTCP("tcp", listenAddr)
+	if err != nil {
+		return fmt.Errorf("listen on %s: %w", addr, err)
+	}
+	s.listener = listener
+
+	s.pending.StartCleanup(s.ctx)
+
+	if s.pipeServer != nil {
+		if err := s.pipeServer.Start(s.ctx); err != nil {
+			log.Warnf("failed to start RDP named pipe server: %v", err)
+		}
+	}
+
+	go s.acceptLoop()
+
+	log.Infof("RDP sideband auth server started on %s", addr)
+	return nil
+}
+
+// Stop shuts down the server and cleans up resources.
+func (s *Server) Stop() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.cancel != nil {
+		s.cancel()
+	}
+
+	if s.pipeServer != nil {
+		if err := s.pipeServer.Stop(); err != nil {
+			log.Warnf("failed to stop RDP named pipe server: %v", err)
+		}
+	}
+
+	if s.listener != nil {
+		err := s.listener.Close()
+		s.listener = nil
+		if err != nil {
+			return fmt.Errorf("close listener: %w", err)
+		}
+	}
+
+	log.Info("RDP sideband auth server stopped")
+	return nil
+}
+
+// GetPendingStore returns the pending session store (for testing/named pipe access).
+func (s *Server) GetPendingStore() *PendingStore {
+	return s.pending
+}
+
+func (s *Server) acceptLoop() {
+	for {
+		conn, err := s.listener.Accept()
+		if err != nil {
+			if s.ctx.Err() != nil {
+				return
+			}
+			log.Debugf("RDP auth accept error: %v", err)
+			continue
+		}
+
+		go s.handleConnection(conn)
+	}
+}
+
+func (s *Server) handleConnection(conn net.Conn) {
+	defer func() {
+		if err := conn.Close(); err != nil {
+			log.Debugf("RDP auth close connection: %v", err)
+		}
+	}()
+
+	if err := conn.SetDeadline(time.Now().Add(connectionTimeout)); err != nil {
+		log.Debugf("RDP auth set deadline: %v", err)
+		return
+	}
+
+	// Validate source IP is from WireGuard network
+	remoteAddr, err := netip.ParseAddrPort(conn.RemoteAddr().String())
+	if err != nil {
+		log.Debugf("RDP auth parse remote addr: %v", err)
+		return
+	}
+
+	if !s.networkAddr.Contains(remoteAddr.Addr()) {
+		log.Warnf("RDP auth rejected connection from non-WG address: %s", remoteAddr.Addr())
+		return
+	}
+
+	// Read request
+	data, err := io.ReadAll(io.LimitReader(conn, maxRequestSize))
+	if err != nil {
+		log.Debugf("RDP auth read request: %v", err)
+		return
+	}
+
+	var req AuthRequest
+	if err := json.Unmarshal(data, &req); err != nil {
+		log.Debugf("RDP auth unmarshal request: %v", err)
+		s.sendResponse(conn, &AuthResponse{Status: StatusDenied, Reason: "invalid request format"})
+		return
+	}
+
+	response := s.processAuthRequest(remoteAddr.Addr(), &req)
+	s.sendResponse(conn, response)
+}
+
+func (s *Server) processAuthRequest(peerIP netip.Addr, req *AuthRequest) *AuthResponse {
+	// Validate JWT
+	if s.jwtValidator == nil {
+		// No JWT validation configured - for POC, accept all requests from WG peers
+		log.Warnf("RDP auth: no JWT validator configured, accepting request from %s", peerIP)
+		return s.createSession(peerIP, req, "no-jwt-validation")
+	}
+
+	userID, err := s.jwtValidator.ValidateAndExtract(req.JWTToken)
+	if err != nil {
+		log.Warnf("RDP auth JWT validation failed for %s: %v", peerIP, err)
+		return &AuthResponse{Status: StatusDenied, Reason: "JWT validation failed"}
+	}
+
+	// Check authorization - try explicit authorizer first, then SSH ACL
+	if s.authorizer != nil {
+		if _, err := s.authorizer.Authorize(userID, req.RequestedUser); err != nil {
+			log.Warnf("RDP auth denied for user %s -> %s: %v", userID, req.RequestedUser, err)
+			return &AuthResponse{Status: StatusDenied, Reason: "not authorized for this user"}
+		}
+	} else if s.sshAuthorizer != nil {
+		if _, err := s.sshAuthorizer.Authorize(userID, req.RequestedUser); err != nil {
+			log.Warnf("RDP auth denied (SSH ACL) for user %s -> %s: %v", userID, req.RequestedUser, err)
+			return &AuthResponse{Status: StatusDenied, Reason: "not authorized for this user"}
+		}
+	}
+
+	return s.createSession(peerIP, req, userID)
+}
+
+func (s *Server) createSession(peerIP netip.Addr, req *AuthRequest, jwtUserID string) *AuthResponse {
+	// Parse domain from requested user (DOMAIN\user or user@domain)
+	osUser, domain := parseWindowsUsername(req.RequestedUser)
+
+	session, err := s.pending.Add(peerIP, osUser, domain, jwtUserID, req.Nonce)
+	if err != nil {
+		log.Warnf("RDP auth create session failed: %v", err)
+		return &AuthResponse{Status: StatusDenied, Reason: err.Error()}
+	}
+
+	return &AuthResponse{
+		Status:    StatusAuthorized,
+		SessionID: session.SessionID,
+		ExpiresAt: session.ExpiresAt.Unix(),
+		OSUser:    session.OSUsername,
+	}
+}
+
+func (s *Server) sendResponse(conn net.Conn, resp *AuthResponse) {
+	data, err := json.Marshal(resp)
+	if err != nil {
+		log.Debugf("RDP auth marshal response: %v", err)
+		return
+	}
+
+	if _, err := conn.Write(data); err != nil {
+		log.Debugf("RDP auth write response: %v", err)
+	}
+}
+
+// parseWindowsUsername extracts username and domain from Windows username formats.
+// Supports DOMAIN\username, username@domain, and plain username.
+func parseWindowsUsername(fullUsername string) (username, domain string) {
+	for i := len(fullUsername) - 1; i >= 0; i-- {
+		if fullUsername[i] == '\\' {
+			return fullUsername[i+1:], fullUsername[:i]
+		}
+	}
+
+	if idx := indexOf(fullUsername, '@'); idx != -1 {
+		return fullUsername[:idx], fullUsername[idx+1:]
+	}
+
+	return fullUsername, "."
+}
+
+func indexOf(s string, c byte) int {
+	for i := 0; i < len(s); i++ {
+		if s[i] == c {
+			return i
+		}
+	}
+	return -1
+}

client/server/network.go

@@ -9,8 +9,6 @@ import (
 	"strings"
 
 	"golang.org/x/exp/maps"
-	"google.golang.org/grpc/codes"
-	gstatus "google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/route"
@@ -29,10 +27,6 @@ func (s *Server) ListNetworks(context.Context, *proto.ListNetworksRequest) (*pro
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	if s.networksDisabled {
-		return nil, gstatus.Errorf(codes.Unavailable, errNetworksDisabled)
-	}
-
 	if s.connectClient == nil {
 		return nil, fmt.Errorf("not connected")
 	}
@@ -124,10 +118,6 @@ func (s *Server) SelectNetworks(_ context.Context, req *proto.SelectNetworksRequ
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	if s.networksDisabled {
-		return nil, gstatus.Errorf(codes.Unavailable, errNetworksDisabled)
-	}
-
 	if s.connectClient == nil {
 		return nil, fmt.Errorf("not connected")
 	}
@@ -174,10 +164,6 @@ func (s *Server) DeselectNetworks(_ context.Context, req *proto.SelectNetworksRe
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	if s.networksDisabled {
-		return nil, gstatus.Errorf(codes.Unavailable, errNetworksDisabled)
-	}
-
 	if s.connectClient == nil {
 		return nil, fmt.Errorf("not connected")
 	}

client/server/server.go

@@ -53,7 +53,6 @@ const (
 	errRestoreResidualState   = "failed to restore residual state: %v"
 	errProfilesDisabled       = "profiles are disabled, you cannot use this feature without profiles enabled"
 	errUpdateSettingsDisabled = "update settings are disabled, you cannot use this feature without update settings enabled"
-	errNetworksDisabled       = "network selection is disabled by the administrator"
 )
 
 var ErrServiceNotUp = errors.New("service is not up")
@@ -89,7 +88,6 @@ type Server struct {
 	profileManager         *profilemanager.ServiceManager
 	profilesDisabled       bool
 	updateSettingsDisabled bool
-	networksDisabled       bool
 
 	sleepHandler *sleephandler.SleepHandler
 
@@ -106,7 +104,7 @@ type oauthAuthFlow struct {
 }
 
 // New server instance constructor.
-func New(ctx context.Context, logFile string, configFile string, profilesDisabled bool, updateSettingsDisabled bool, networksDisabled bool) *Server {
+func New(ctx context.Context, logFile string, configFile string, profilesDisabled bool, updateSettingsDisabled bool) *Server {
 	s := &Server{
 		rootCtx:                ctx,
 		logFile:                logFile,
@@ -115,7 +113,6 @@ func New(ctx context.Context, logFile string, configFile string, profilesDisable
 		profileManager:         profilemanager.NewServiceManager(configFile),
 		profilesDisabled:       profilesDisabled,
 		updateSettingsDisabled: updateSettingsDisabled,
-		networksDisabled:       networksDisabled,
 		jwtCache:               newJWTCache(),
 	}
 	agent := &serverAgent{s}
@@ -369,6 +366,7 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 	config.RosenpassPermissive = msg.RosenpassPermissive
 	config.DisableAutoConnect = msg.DisableAutoConnect
 	config.ServerSSHAllowed = msg.ServerSSHAllowed
+	config.ServerRDPAllowed = msg.ServerRDPAllowed
 	config.NetworkMonitor = msg.NetworkMonitor
 	config.DisableClientRoutes = msg.DisableClientRoutes
 	config.DisableServerRoutes = msg.DisableServerRoutes
@@ -1517,6 +1515,7 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		Mtu:                           int64(cfg.MTU),
 		DisableAutoConnect:            cfg.DisableAutoConnect,
 		ServerSSHAllowed:              *cfg.ServerSSHAllowed,
+		ServerRDPAllowed:              cfg.ServerRDPAllowed != nil && *cfg.ServerRDPAllowed,
 		RosenpassEnabled:              cfg.RosenpassEnabled,
 		RosenpassPermissive:           cfg.RosenpassPermissive,
 		LazyConnectionEnabled:         cfg.LazyConnectionEnabled,
@@ -1631,7 +1630,6 @@ func (s *Server) GetFeatures(ctx context.Context, msg *proto.GetFeaturesRequest)
 	features := &proto.GetFeaturesResponse{
 		DisableProfiles:       s.checkProfilesDisabled(),
 		DisableUpdateSettings: s.checkUpdateSettingsDisabled(),
-		DisableNetworks:       s.networksDisabled,
 	}
 
 	return features, nil

client/server/server_test.go

@@ -36,7 +36,6 @@ import (
 	daemonProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/activity"
-	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
@@ -104,7 +103,7 @@ func TestConnectWithRetryRuns(t *testing.T) {
 		t.Fatalf("failed to set active profile state: %v", err)
 	}
 
-	s := New(ctx, "debug", "", false, false, false)
+	s := New(ctx, "debug", "", false, false)
 
 	s.config = config
 
@@ -165,7 +164,7 @@ func TestServer_Up(t *testing.T) {
 		t.Fatalf("failed to set active profile state: %v", err)
 	}
 
-	s := New(ctx, "console", "", false, false, false)
+	s := New(ctx, "console", "", false, false)
 	err = s.Start()
 	require.NoError(t, err)
 
@@ -235,7 +234,7 @@ func TestServer_SubcribeEvents(t *testing.T) {
 		t.Fatalf("failed to set active profile state: %v", err)
 	}
 
-	s := New(ctx, "console", "", false, false, false)
+	s := New(ctx, "console", "", false, false)
 
 	err = s.Start()
 	require.NoError(t, err)
@@ -310,12 +309,7 @@ func startManagement(t *testing.T, signalAddr string, counter *int) (*grpc.Serve
 
 	jobManager := job.NewJobManager(nil, store, peersManager)
 
-	cacheStore, err := nbcache.NewStore(context.Background(), 100*time.Millisecond, 300*time.Millisecond, 100)
-	if err != nil {
-		return nil, "", err
-	}
-
-	ia, _ := integrations.NewIntegratedValidator(context.Background(), peersManager, settingsManagerMock, eventStore, cacheStore)
+	ia, _ := integrations.NewIntegratedValidator(context.Background(), peersManager, settingsManagerMock, eventStore)
 
 	metrics, err := telemetry.NewDefaultAppMetrics(context.Background())
 	require.NoError(t, err)
@@ -326,7 +320,7 @@ func startManagement(t *testing.T, signalAddr string, counter *int) (*grpc.Serve
 	requestBuffer := server.NewAccountRequestBuffer(context.Background(), store)
 	peersUpdateManager := update_channel.NewPeersUpdateManager(metrics)
 	networkMapController := controller.NewController(context.Background(), store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsMockManager, "netbird.selfhosted", port_forwarding.NewControllerMock(), manager.NewEphemeralManager(store, peersManager), config)
-	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false, cacheStore)
+	accountManager, err := server.BuildManager(context.Background(), config, store, networkMapController, jobManager, nil, "", eventStore, nil, false, ia, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManagerMock, false)
 	if err != nil {
 		return nil, "", err
 	}

client/server/setconfig_test.go

@@ -53,11 +53,12 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	require.NoError(t, err)
 
 	ctx := context.Background()
-	s := New(ctx, "console", "", false, false, false)
+	s := New(ctx, "console", "", false, false)
 
 	rosenpassEnabled := true
 	rosenpassPermissive := true
 	serverSSHAllowed := true
+	serverRDPAllowed := true
 	interfaceName := "utun100"
 	wireguardPort := int64(51820)
 	preSharedKey := "test-psk"
@@ -82,6 +83,7 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 		RosenpassEnabled:      &rosenpassEnabled,
 		RosenpassPermissive:   &rosenpassPermissive,
 		ServerSSHAllowed:      &serverSSHAllowed,
+		ServerRDPAllowed:      &serverRDPAllowed,
 		InterfaceName:         &interfaceName,
 		WireguardPort:         &wireguardPort,
 		OptionalPreSharedKey:  &preSharedKey,
@@ -125,6 +127,8 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	require.Equal(t, rosenpassPermissive, cfg.RosenpassPermissive)
 	require.NotNil(t, cfg.ServerSSHAllowed)
 	require.Equal(t, serverSSHAllowed, *cfg.ServerSSHAllowed)
+	require.NotNil(t, cfg.ServerRDPAllowed)
+	require.Equal(t, serverRDPAllowed, *cfg.ServerRDPAllowed)
 	require.Equal(t, interfaceName, cfg.WgIface)
 	require.Equal(t, int(wireguardPort), cfg.WgPort)
 	require.Equal(t, preSharedKey, cfg.PreSharedKey)
@@ -176,6 +180,7 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 		"RosenpassEnabled":              true,
 		"RosenpassPermissive":           true,
 		"ServerSSHAllowed":              true,
+		"ServerRDPAllowed":              true,
 		"InterfaceName":                 true,
 		"WireguardPort":                 true,
 		"OptionalPreSharedKey":          true,
@@ -236,6 +241,7 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 		"enable-rosenpass":                  "RosenpassEnabled",
 		"rosenpass-permissive":              "RosenpassPermissive",
 		"allow-server-ssh":                  "ServerSSHAllowed",
+		"allow-server-rdp":                  "ServerRDPAllowed",
 		"interface-name":                    "InterfaceName",
 		"wireguard-port":                    "WireguardPort",
 		"preshared-key":                     "OptionalPreSharedKey",

client/system/info_ios.go

@@ -4,12 +4,10 @@ import (
 	"context"
 	"runtime"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/version"
 )
 
-// UpdateStaticInfoAsync is a no-op on iOS as there is no static info to update
+// UpdateStaticInfoAsync is a no-op on Android as there is no static info to update
 func UpdateStaticInfoAsync() {
 	// do nothing
 }
@@ -17,24 +15,11 @@ func UpdateStaticInfoAsync() {
 // GetInfo retrieves and parses the system information
 func GetInfo(ctx context.Context) *Info {
 
+	// Convert fixed-size byte arrays to Go strings
 	sysName := extractOsName(ctx, "sysName")
 	swVersion := extractOsVersion(ctx, "swVersion")
 
-	addrs, err := networkAddresses()
-	if err != nil {
-		log.Warnf("failed to discover network addresses: %s", err)
-	}
-
-	gio := &Info{
-		Kernel:           sysName,
-		OSVersion:        swVersion,
-		Platform:         "unknown",
-		OS:               sysName,
-		GoOS:             runtime.GOOS,
-		CPUs:             runtime.NumCPU(),
-		KernelVersion:    swVersion,
-		NetworkAddresses: addrs,
-	}
+	gio := &Info{Kernel: sysName, OSVersion: swVersion, Platform: "unknown", OS: sysName, GoOS: runtime.GOOS, CPUs: runtime.NumCPU(), KernelVersion: swVersion}
 	gio.Hostname = extractDeviceName(ctx, "hostname")
 	gio.NetbirdVersion = version.NetbirdVersion()
 	gio.UIVersion = extractUserAgent(ctx)

client/ui/client_ui.go

@@ -314,7 +314,6 @@ type serviceClient struct {
 	lastNotifiedVersion  string
 	settingsEnabled      bool
 	profilesEnabled      bool
-	networksEnabled      bool
 	showNetworks         bool
 	wNetworks            fyne.Window
 	wProfiles            fyne.Window
@@ -369,7 +368,6 @@ func newServiceClient(args *newServiceClientArgs) *serviceClient {
 
 		showAdvancedSettings: args.showSettings,
 		showNetworks:         args.showNetworks,
-		networksEnabled:      true,
 	}
 
 	s.eventHandler = newEventHandler(s)
@@ -922,10 +920,8 @@ func (s *serviceClient) updateStatus() error {
 			s.mStatus.SetIcon(s.icConnectedDot)
 			s.mUp.Disable()
 			s.mDown.Enable()
-			if s.networksEnabled {
-				s.mNetworks.Enable()
-				s.mExitNode.Enable()
-			}
+			s.mNetworks.Enable()
+			s.mExitNode.Enable()
 			s.startExitNodeRefresh()
 			systrayIconState = true
 		case status.Status == string(internal.StatusConnecting):
@@ -1097,14 +1093,14 @@ func (s *serviceClient) onTrayReady() {
 		s.getSrvConfig()
 		time.Sleep(100 * time.Millisecond) // To prevent race condition caused by systray not being fully initialized and ignoring setIcon
 		for {
-			// Check features before status so menus respect disable flags before being enabled
-			s.checkAndUpdateFeatures()
-
 			err := s.updateStatus()
 			if err != nil {
 				log.Errorf("error while updating status: %v", err)
 			}
 
+			// Check features periodically to handle daemon restarts
+			s.checkAndUpdateFeatures()
+
 			time.Sleep(2 * time.Second)
 		}
 	}()
@@ -1303,16 +1299,6 @@ func (s *serviceClient) checkAndUpdateFeatures() {
 			s.mProfile.setEnabled(profilesEnabled)
 		}
 	}
-
-	// Update networks and exit node menus based on current features
-	s.networksEnabled = features == nil || !features.DisableNetworks
-	if s.networksEnabled && s.connected {
-		s.mNetworks.Enable()
-		s.mExitNode.Enable()
-	} else {
-		s.mNetworks.Disable()
-		s.mExitNode.Disable()
-	}
 }
 
 // getFeatures from the daemon to determine which features are enabled/disabled.

flow/client/client.go

@@ -14,6 +14,7 @@ import (
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/connectivity"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/keepalive"
@@ -25,22 +26,11 @@ import (
 	"github.com/netbirdio/netbird/util/wsproxy"
 )
 
-var ErrClientClosed = errors.New("client is closed")
-
-// minHealthyDuration is the minimum time a stream must survive before a failure
-// resets the backoff timer. Streams that fail faster are considered unhealthy and
-// should not reset backoff, so that MaxElapsedTime can eventually stop retries.
-const minHealthyDuration = 5 * time.Second
-
 type GRPCClient struct {
 	realClient proto.FlowServiceClient
 	clientConn *grpc.ClientConn
 	stream     proto.FlowService_EventsClient
-	target     string
-	opts       []grpc.DialOption
-	closed     bool       // prevent creating conn in the middle of the Close
-	receiving  bool       // prevent concurrent Receive calls
-	mu         sync.Mutex // protects clientConn, realClient, stream, closed, and receiving
+	streamMu   sync.Mutex
 }
 
 func NewClient(addr, payload, signature string, interval time.Duration) (*GRPCClient, error) {
@@ -75,8 +65,7 @@ func NewClient(addr, payload, signature string, interval time.Duration) (*GRPCCl
 		grpc.WithDefaultServiceConfig(`{"healthCheckConfig": {"serviceName": ""}}`),
 	)
 
-	target := parsedURL.Host
-	conn, err := grpc.NewClient(target, opts...)
+	conn, err := grpc.NewClient(fmt.Sprintf("%s:%s", parsedURL.Hostname(), parsedURL.Port()), opts...)
 	if err != nil {
 		return nil, fmt.Errorf("creating new grpc client: %w", err)
 	}
@@ -84,73 +73,30 @@ func NewClient(addr, payload, signature string, interval time.Duration) (*GRPCCl
 	return &GRPCClient{
 		realClient: proto.NewFlowServiceClient(conn),
 		clientConn: conn,
-		target:     target,
-		opts:       opts,
 	}, nil
 }
 
 func (c *GRPCClient) Close() error {
-	c.mu.Lock()
-	c.closed = true
+	c.streamMu.Lock()
+	defer c.streamMu.Unlock()
+
 	c.stream = nil
-	conn := c.clientConn
-	c.clientConn = nil
-	c.mu.Unlock()
-
-	if conn == nil {
-		return nil
-	}
-
-	if err := conn.Close(); err != nil && !errors.Is(err, context.Canceled) {
+	if err := c.clientConn.Close(); err != nil && !errors.Is(err, context.Canceled) {
 		return fmt.Errorf("close client connection: %w", err)
 	}
 
 	return nil
 }
 
-func (c *GRPCClient) Send(event *proto.FlowEvent) error {
-	c.mu.Lock()
-	stream := c.stream
-	c.mu.Unlock()
-
-	if stream == nil {
-		return errors.New("stream not initialized")
-	}
-
-	if err := stream.Send(event); err != nil {
-		return fmt.Errorf("send flow event: %w", err)
-	}
-
-	return nil
-}
-
 func (c *GRPCClient) Receive(ctx context.Context, interval time.Duration, msgHandler func(msg *proto.FlowEventAck) error) error {
-	c.mu.Lock()
-	if c.receiving {
-		c.mu.Unlock()
-		return errors.New("concurrent Receive calls are not supported")
-	}
-	c.receiving = true
-	c.mu.Unlock()
-	defer func() {
-		c.mu.Lock()
-		c.receiving = false
-		c.mu.Unlock()
-	}()
-
 	backOff := defaultBackoff(ctx, interval)
 	operation := func() error {
-		stream, err := c.establishStream(ctx)
-		if err != nil {
-			log.Errorf("failed to establish flow stream, retrying: %v", err)
-			return c.handleRetryableError(err, time.Time{}, backOff)
-		}
-
-		streamStart := time.Now()
-
-		if err := c.receive(stream, msgHandler); err != nil {
+		if err := c.establishStreamAndReceive(ctx, msgHandler); err != nil {
+			if s, ok := status.FromError(err); ok && s.Code() == codes.Canceled {
+				return fmt.Errorf("receive: %w: %w", err, context.Canceled)
+			}
 			log.Errorf("receive failed: %v", err)
-			return c.handleRetryableError(err, streamStart, backOff)
+			return fmt.Errorf("receive: %w", err)
 		}
 		return nil
 	}
@@ -162,106 +108,37 @@ func (c *GRPCClient) Receive(ctx context.Context, interval time.Duration, msgHan
 	return nil
 }
 
-// handleRetryableError resets the backoff timer if the stream was healthy long
-// enough and recreates the underlying ClientConn so that gRPC's internal
-// subchannel backoff does not accumulate and compete with our own retry timer.
-// A zero streamStart means the stream was never established.
-func (c *GRPCClient) handleRetryableError(err error, streamStart time.Time, backOff backoff.BackOff) error {
-	if isContextDone(err) {
-		return backoff.Permanent(err)
+func (c *GRPCClient) establishStreamAndReceive(ctx context.Context, msgHandler func(msg *proto.FlowEventAck) error) error {
+	if c.clientConn.GetState() == connectivity.Shutdown {
+		return errors.New("connection to flow receiver has been shut down")
 	}
 
-	var permErr *backoff.PermanentError
-	if errors.As(err, &permErr) {
-		return err
-	}
-
-	// Reset the backoff so the next retry starts with a short delay instead of
-	// continuing the already-elapsed timer. Only do this if the stream was healthy
-	// long enough; short-lived connect/drop cycles must not defeat MaxElapsedTime.
-	if !streamStart.IsZero() && time.Since(streamStart) >= minHealthyDuration {
-		backOff.Reset()
-	}
-
-	if recreateErr := c.recreateConnection(); recreateErr != nil {
-		log.Errorf("recreate connection: %v", recreateErr)
-		return recreateErr
-	}
-
-	log.Infof("connection recreated, retrying stream")
-	return fmt.Errorf("retrying after error: %w", err)
-}
-
-func (c *GRPCClient) recreateConnection() error {
-	c.mu.Lock()
-	if c.closed {
-		c.mu.Unlock()
-		return backoff.Permanent(ErrClientClosed)
-	}
-
-	conn, err := grpc.NewClient(c.target, c.opts...)
+	stream, err := c.realClient.Events(ctx, grpc.WaitForReady(true))
 	if err != nil {
-		c.mu.Unlock()
-		return fmt.Errorf("create new connection: %w", err)
+		return fmt.Errorf("create event stream: %w", err)
 	}
 
-	old := c.clientConn
-	c.clientConn = conn
-	c.realClient = proto.NewFlowServiceClient(conn)
-	c.stream = nil
-	c.mu.Unlock()
-
-	_ = old.Close()
-
-	return nil
-}
-
-func (c *GRPCClient) establishStream(ctx context.Context) (proto.FlowService_EventsClient, error) {
-	c.mu.Lock()
-	if c.closed {
-		c.mu.Unlock()
-		return nil, backoff.Permanent(ErrClientClosed)
-	}
-	cl := c.realClient
-	c.mu.Unlock()
-
-	// open stream outside the lock — blocking operation
-	stream, err := cl.Events(ctx)
+	err = stream.Send(&proto.FlowEvent{IsInitiator: true})
 	if err != nil {
-		return nil, fmt.Errorf("create event stream: %w", err)
-	}
-	streamReady := false
-	defer func() {
-		if !streamReady {
-			_ = stream.CloseSend()
-		}
-	}()
-
-	if err = stream.Send(&proto.FlowEvent{IsInitiator: true}); err != nil {
-		return nil, fmt.Errorf("send initiator: %w", err)
+		log.Infof("failed to send initiator message to flow receiver but will attempt to continue. Error: %s", err)
 	}
 
 	if err = checkHeader(stream); err != nil {
-		return nil, fmt.Errorf("check header: %w", err)
+		return fmt.Errorf("check header: %w", err)
 	}
 
-	c.mu.Lock()
-	if c.closed {
-		c.mu.Unlock()
-		return nil, backoff.Permanent(ErrClientClosed)
-	}
+	c.streamMu.Lock()
 	c.stream = stream
-	c.mu.Unlock()
-	streamReady = true
+	c.streamMu.Unlock()
 
-	return stream, nil
+	return c.receive(stream, msgHandler)
 }
 
 func (c *GRPCClient) receive(stream proto.FlowService_EventsClient, msgHandler func(msg *proto.FlowEventAck) error) error {
 	for {
 		msg, err := stream.Recv()
 		if err != nil {
-			return err
+			return fmt.Errorf("receive from stream: %w", err)
 		}
 
 		if msg.IsInitiator {
@@ -292,7 +169,7 @@ func checkHeader(stream proto.FlowService_EventsClient) error {
 func defaultBackoff(ctx context.Context, interval time.Duration) backoff.BackOff {
 	return backoff.WithContext(&backoff.ExponentialBackOff{
 		InitialInterval:     800 * time.Millisecond,
-		RandomizationFactor: 0.5,
+		RandomizationFactor: 1,
 		Multiplier:          1.7,
 		MaxInterval:         interval / 2,
 		MaxElapsedTime:      3 * 30 * 24 * time.Hour, // 3 months
@@ -301,12 +178,18 @@ func defaultBackoff(ctx context.Context, interval time.Duration) backoff.BackOff
 	}, ctx)
 }
 
-func isContextDone(err error) bool {
-	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
-		return true
+func (c *GRPCClient) Send(event *proto.FlowEvent) error {
+	c.streamMu.Lock()
+	stream := c.stream
+	c.streamMu.Unlock()
+
+	if stream == nil {
+		return errors.New("stream not initialized")
 	}
-	if s, ok := status.FromError(err); ok {
-		return s.Code() == codes.Canceled || s.Code() == codes.DeadlineExceeded
+
+	if err := stream.Send(event); err != nil {
+		return fmt.Errorf("send flow event: %w", err)
 	}
-	return false
+
+	return nil
 }

flow/client/client_test.go

@@ -2,11 +2,8 @@ package client_test
 
 import (
 	"context"
-	"encoding/binary"
 	"errors"
 	"net"
-	"sync"
-	"sync/atomic"
 	"testing"
 	"time"
 
@@ -14,8 +11,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
 
 	flow "github.com/netbirdio/netbird/flow/client"
 	"github.com/netbirdio/netbird/flow/proto"
@@ -23,89 +18,21 @@ import (
 
 type testServer struct {
 	proto.UnimplementedFlowServiceServer
-	events         chan *proto.FlowEvent
-	acks           chan *proto.FlowEventAck
-	grpcSrv        *grpc.Server
-	addr           string
-	listener       *connTrackListener
-	closeStream    chan struct{} // signal server to close the stream
-	handlerDone    chan struct{} // signaled each time Events() exits
-	handlerStarted chan struct{} // signaled each time Events() begins
-}
-
-// connTrackListener wraps a net.Listener to track accepted connections
-// so tests can forcefully close them to simulate PROTOCOL_ERROR/RST_STREAM.
-type connTrackListener struct {
-	net.Listener
-	mu    sync.Mutex
-	conns []net.Conn
-}
-
-func (l *connTrackListener) Accept() (net.Conn, error) {
-	c, err := l.Listener.Accept()
-	if err != nil {
-		return nil, err
-	}
-	l.mu.Lock()
-	l.conns = append(l.conns, c)
-	l.mu.Unlock()
-	return c, nil
-}
-
-// sendRSTStream writes a raw HTTP/2 RST_STREAM frame with PROTOCOL_ERROR
-// (error code 0x1) on every tracked connection. This produces the exact error:
-//
-//	rpc error: code = Internal desc = stream terminated by RST_STREAM with error code: PROTOCOL_ERROR
-//
-// HTTP/2 RST_STREAM frame format (9-byte header + 4-byte payload):
-//
-//	Length (3 bytes): 0x000004
-//	Type   (1 byte):  0x03 (RST_STREAM)
-//	Flags  (1 byte):  0x00
-//	Stream ID (4 bytes): target stream (must have bit 31 clear)
-//	Error Code (4 bytes): 0x00000001 (PROTOCOL_ERROR)
-func (l *connTrackListener) connCount() int {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-	return len(l.conns)
-}
-
-func (l *connTrackListener) sendRSTStream(streamID uint32) {
-	l.mu.Lock()
-	defer l.mu.Unlock()
-
-	frame := make([]byte, 13) // 9-byte header + 4-byte payload
-	// Length = 4 (3 bytes, big-endian)
-	frame[0], frame[1], frame[2] = 0, 0, 4
-	// Type = RST_STREAM (0x03)
-	frame[3] = 0x03
-	// Flags = 0
-	frame[4] = 0x00
-	// Stream ID (4 bytes, big-endian, bit 31 reserved = 0)
-	binary.BigEndian.PutUint32(frame[5:9], streamID)
-	// Error Code = PROTOCOL_ERROR (0x1)
-	binary.BigEndian.PutUint32(frame[9:13], 0x1)
-
-	for _, c := range l.conns {
-		_, _ = c.Write(frame)
-	}
+	events  chan *proto.FlowEvent
+	acks    chan *proto.FlowEventAck
+	grpcSrv *grpc.Server
+	addr    string
 }
 
 func newTestServer(t *testing.T) *testServer {
-	rawListener, err := net.Listen("tcp", "127.0.0.1:0")
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
 	require.NoError(t, err)
 
-	listener := &connTrackListener{Listener: rawListener}
-
 	s := &testServer{
-		events:         make(chan *proto.FlowEvent, 100),
-		acks:           make(chan *proto.FlowEventAck, 100),
-		grpcSrv:        grpc.NewServer(),
-		addr:           rawListener.Addr().String(),
-		listener:       listener,
-		closeStream:    make(chan struct{}, 1),
-		handlerDone:    make(chan struct{}, 10),
-		handlerStarted: make(chan struct{}, 10),
+		events:  make(chan *proto.FlowEvent, 100),
+		acks:    make(chan *proto.FlowEventAck, 100),
+		grpcSrv: grpc.NewServer(),
+		addr:    listener.Addr().String(),
 	}
 
 	proto.RegisterFlowServiceServer(s.grpcSrv, s)
@@ -124,23 +51,11 @@ func newTestServer(t *testing.T) *testServer {
 }
 
 func (s *testServer) Events(stream proto.FlowService_EventsServer) error {
-	defer func() {
-		select {
-		case s.handlerDone <- struct{}{}:
-		default:
-		}
-	}()
-
 	err := stream.Send(&proto.FlowEventAck{IsInitiator: true})
 	if err != nil {
 		return err
 	}
 
-	select {
-	case s.handlerStarted <- struct{}{}:
-	default:
-	}
-
 	ctx, cancel := context.WithCancel(stream.Context())
 	defer cancel()
 
@@ -176,8 +91,6 @@ func (s *testServer) Events(stream proto.FlowService_EventsServer) error {
 			if err := stream.Send(ack); err != nil {
 				return err
 			}
-		case <-s.closeStream:
-			return status.Errorf(codes.Internal, "server closing stream")
 		case <-ctx.Done():
 			return ctx.Err()
 		}
@@ -197,13 +110,16 @@ func TestReceive(t *testing.T) {
 		assert.NoError(t, err, "failed to close flow")
 	})
 
-	var ackCount atomic.Int32
+	receivedAcks := make(map[string]bool)
 	receiveDone := make(chan struct{})
 
 	go func() {
 		err := client.Receive(ctx, 1*time.Second, func(msg *proto.FlowEventAck) error {
 			if !msg.IsInitiator && len(msg.EventId) > 0 {
-				if ackCount.Add(1) >= 3 {
+				id := string(msg.EventId)
+				receivedAcks[id] = true
+
+				if len(receivedAcks) >= 3 {
 					close(receiveDone)
 				}
 			}
@@ -214,11 +130,7 @@ func TestReceive(t *testing.T) {
 		}
 	}()
 
-	select {
-	case <-server.handlerStarted:
-	case <-time.After(3 * time.Second):
-		t.Fatal("timeout waiting for stream to be established")
-	}
+	time.Sleep(500 * time.Millisecond)
 
 	for i := 0; i < 3; i++ {
 		eventID := uuid.New().String()
@@ -241,7 +153,7 @@ func TestReceive(t *testing.T) {
 		t.Fatal("timeout waiting for acks to be processed")
 	}
 
-	assert.Equal(t, int32(3), ackCount.Load())
+	assert.Equal(t, 3, len(receivedAcks))
 }
 
 func TestReceive_ContextCancellation(t *testing.T) {
@@ -342,195 +254,3 @@ func TestSend(t *testing.T) {
 		t.Fatal("timeout waiting for ack to be received by flow")
 	}
 }
-
-func TestNewClient_PermanentClose(t *testing.T) {
-	server := newTestServer(t)
-
-	client, err := flow.NewClient("http://"+server.addr, "test-payload", "test-signature", 1*time.Second)
-	require.NoError(t, err)
-
-	err = client.Close()
-	require.NoError(t, err)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	t.Cleanup(cancel)
-
-	done := make(chan error, 1)
-	go func() {
-		done <- client.Receive(ctx, 1*time.Second, func(msg *proto.FlowEventAck) error {
-			return nil
-		})
-	}()
-
-	select {
-	case err := <-done:
-		require.ErrorIs(t, err, flow.ErrClientClosed)
-	case <-time.After(2 * time.Second):
-		t.Fatal("Receive did not return after Close — stuck in retry loop")
-	}
-}
-
-func TestNewClient_CloseVerify(t *testing.T) {
-	server := newTestServer(t)
-
-	client, err := flow.NewClient("http://"+server.addr, "test-payload", "test-signature", 1*time.Second)
-	require.NoError(t, err)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	t.Cleanup(cancel)
-
-	done := make(chan error, 1)
-	go func() {
-		done <- client.Receive(ctx, 1*time.Second, func(msg *proto.FlowEventAck) error {
-			return nil
-		})
-	}()
-
-	closeDone := make(chan struct{}, 1)
-	go func() {
-		_ = client.Close()
-		closeDone <- struct{}{}
-	}()
-
-	select {
-	case err := <-done:
-		require.Error(t, err)
-	case <-time.After(2 * time.Second):
-		t.Fatal("Receive did not return after Close — stuck in retry loop")
-	}
-
-	select {
-	case <-closeDone:
-		return
-	case <-time.After(2 * time.Second):
-		t.Fatal("Close did not return — blocked in retry loop")
-	}
-
-}
-
-func TestClose_WhileReceiving(t *testing.T) {
-	server := newTestServer(t)
-	client, err := flow.NewClient("http://"+server.addr, "test-payload", "test-signature", 1*time.Second)
-	require.NoError(t, err)
-
-	ctx := context.Background() // no timeout — intentional
-	receiveDone := make(chan struct{})
-	go func() {
-		_ = client.Receive(ctx, 1*time.Second, func(msg *proto.FlowEventAck) error {
-			return nil
-		})
-		close(receiveDone)
-	}()
-
-	// Wait for the server-side handler to confirm the stream is established.
-	select {
-	case <-server.handlerStarted:
-	case <-time.After(3 * time.Second):
-		t.Fatal("timeout waiting for stream to be established")
-	}
-
-	closeDone := make(chan struct{})
-	go func() {
-		_ = client.Close()
-		close(closeDone)
-	}()
-
-	select {
-	case <-closeDone:
-		// Close returned — good
-	case <-time.After(2 * time.Second):
-		t.Fatal("Close blocked forever — Receive stuck in retry loop")
-	}
-
-	select {
-	case <-receiveDone:
-	case <-time.After(2 * time.Second):
-		t.Fatal("Receive did not exit after Close")
-	}
-}
-
-func TestReceive_ProtocolErrorStreamReconnect(t *testing.T) {
-	server := newTestServer(t)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	t.Cleanup(cancel)
-
-	client, err := flow.NewClient("http://"+server.addr, "test-payload", "test-signature", 1*time.Second)
-	require.NoError(t, err)
-	t.Cleanup(func() {
-		err := client.Close()
-		assert.NoError(t, err, "failed to close flow")
-	})
-
-	// Track acks received before and after server-side stream close
-	var ackCount atomic.Int32
-	receivedFirst := make(chan struct{})
-	receivedAfterReconnect := make(chan struct{})
-
-	go func() {
-		err := client.Receive(ctx, 1*time.Second, func(msg *proto.FlowEventAck) error {
-			if msg.IsInitiator || len(msg.EventId) == 0 {
-				return nil
-			}
-			n := ackCount.Add(1)
-			if n == 1 {
-				close(receivedFirst)
-			}
-			if n == 2 {
-				close(receivedAfterReconnect)
-			}
-			return nil
-		})
-		if err != nil && !errors.Is(err, context.Canceled) {
-			t.Logf("receive error: %v", err)
-		}
-	}()
-
-	// Wait for stream to be established, then send first ack
-	select {
-	case <-server.handlerStarted:
-	case <-time.After(3 * time.Second):
-		t.Fatal("timeout waiting for stream to be established")
-	}
-	server.acks <- &proto.FlowEventAck{EventId: []byte("before-close")}
-
-	select {
-	case <-receivedFirst:
-	case <-time.After(3 * time.Second):
-		t.Fatal("timeout waiting for first ack")
-	}
-
-	// Snapshot connection count before injecting the fault.
-	connsBefore := server.listener.connCount()
-
-	// Send a raw HTTP/2 RST_STREAM frame with PROTOCOL_ERROR on the TCP connection.
-	// gRPC multiplexes streams on stream IDs 1, 3, 5, ... (odd, client-initiated).
-	// Stream ID 1 is the client's first stream (our Events bidi stream).
-	// This produces the exact error the client sees in production:
-	//   "stream terminated by RST_STREAM with error code: PROTOCOL_ERROR"
-	server.listener.sendRSTStream(1)
-
-	// Wait for the old Events() handler to fully exit so it can no longer
-	// drain s.acks and drop our injected ack on a broken stream.
-	select {
-	case <-server.handlerDone:
-	case <-time.After(5 * time.Second):
-		t.Fatal("old Events() handler did not exit after RST_STREAM")
-	}
-
-	require.Eventually(t, func() bool {
-		return server.listener.connCount() > connsBefore
-	}, 5*time.Second, 50*time.Millisecond, "client did not open a new TCP connection after RST_STREAM")
-
-	server.acks <- &proto.FlowEventAck{EventId: []byte("after-close")}
-
-	select {
-	case <-receivedAfterReconnect:
-		// Client successfully reconnected and received ack after server-side stream close
-	case <-time.After(5 * time.Second):
-		t.Fatal("timeout waiting for ack after server-side stream close — client did not reconnect")
-	}
-
-	assert.GreaterOrEqual(t, int(ackCount.Load()), 2, "should have received acks before and after stream close")
-	assert.GreaterOrEqual(t, server.listener.connCount(), 2, "client should have created at least 2 TCP connections (original + reconnect)")
-}

go.mod

@@ -13,28 +13,28 @@ require (
 	github.com/onsi/ginkgo v1.16.5
 	github.com/onsi/gomega v1.27.6
 	github.com/rs/cors v1.8.0
-	github.com/sirupsen/logrus v1.9.4
+	github.com/sirupsen/logrus v1.9.3
 	github.com/spf13/cobra v1.10.1
 	github.com/spf13/pflag v1.0.9
 	github.com/vishvananda/netlink v1.3.1
-	golang.org/x/crypto v0.49.0
-	golang.org/x/sys v0.42.0
+	golang.org/x/crypto v0.48.0
+	golang.org/x/sys v0.41.0
 	golang.zx2c4.com/wireguard v0.0.0-20230704135630-469159ecf7d1
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6
 	golang.zx2c4.com/wireguard/windows v0.5.3
-	google.golang.org/grpc v1.80.0
+	google.golang.org/grpc v1.79.3
 	google.golang.org/protobuf v1.36.11
-	gopkg.in/natefinch/lumberjack.v2 v2.2.1
+	gopkg.in/natefinch/lumberjack.v2 v2.0.0
 )
 
 require (
 	fyne.io/fyne/v2 v2.7.0
 	fyne.io/systray v1.12.1-0.20260116214250-81f8e1a496f9
 	github.com/awnumar/memguard v0.23.0
-	github.com/aws/aws-sdk-go-v2 v1.38.3
-	github.com/aws/aws-sdk-go-v2/config v1.31.6
-	github.com/aws/aws-sdk-go-v2/credentials v1.18.10
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.87.3
+	github.com/aws/aws-sdk-go-v2 v1.36.3
+	github.com/aws/aws-sdk-go-v2/config v1.29.14
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.67
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.79.2
 	github.com/c-robinson/iplib v1.0.3
 	github.com/caddyserver/certmagic v0.21.3
 	github.com/cilium/ebpf v0.15.0
@@ -42,8 +42,6 @@ require (
 	github.com/coreos/go-iptables v0.7.0
 	github.com/coreos/go-oidc/v3 v3.14.1
 	github.com/creack/pty v1.1.24
-	github.com/crowdsecurity/crowdsec v1.7.7
-	github.com/crowdsecurity/go-cs-bouncer v0.0.21
 	github.com/dexidp/dex v0.0.0-00010101000000-000000000000
 	github.com/dexidp/dex/api/v2 v2.4.0
 	github.com/eko/gocache/lib/v4 v4.2.0
@@ -62,7 +60,7 @@ require (
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.0.2-0.20240212192251-757544f21357
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2
-	github.com/hashicorp/go-version v1.7.0
+	github.com/hashicorp/go-version v1.6.0
 	github.com/jackc/pgx/v5 v5.5.5
 	github.com/libdns/route53 v1.5.0
 	github.com/libp2p/go-nat v0.2.0
@@ -71,7 +69,7 @@ require (
 	github.com/mdlayher/socket v0.5.1
 	github.com/miekg/dns v1.1.59
 	github.com/mitchellh/hashstructure/v2 v2.0.2
-	github.com/netbirdio/management-integrations/integrations v0.0.0-20260416123949-2355d972be42
+	github.com/netbirdio/management-integrations/integrations v0.0.0-20260210160626-df4b180c7b25
 	github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45
 	github.com/oapi-codegen/runtime v1.1.2
 	github.com/okta/okta-sdk-golang/v2 v2.18.0
@@ -106,22 +104,22 @@ require (
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
-	go.opentelemetry.io/otel v1.43.0
+	go.opentelemetry.io/otel v1.42.0
 	go.opentelemetry.io/otel/exporters/prometheus v0.64.0
-	go.opentelemetry.io/otel/metric v1.43.0
-	go.opentelemetry.io/otel/sdk/metric v1.43.0
+	go.opentelemetry.io/otel/metric v1.42.0
+	go.opentelemetry.io/otel/sdk/metric v1.42.0
 	go.uber.org/mock v0.5.2
 	go.uber.org/zap v1.27.0
 	goauthentik.io/api/v3 v3.2023051.3
-	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
+	golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842
 	golang.org/x/mobile v0.0.0-20251113184115-a159579294ab
-	golang.org/x/mod v0.33.0
-	golang.org/x/net v0.52.0
-	golang.org/x/oauth2 v0.36.0
-	golang.org/x/sync v0.20.0
-	golang.org/x/term v0.41.0
-	golang.org/x/time v0.15.0
-	google.golang.org/api v0.276.0
+	golang.org/x/mod v0.32.0
+	golang.org/x/net v0.51.0
+	golang.org/x/oauth2 v0.34.0
+	golang.org/x/sync v0.19.0
+	golang.org/x/term v0.40.0
+	golang.org/x/time v0.14.0
+	google.golang.org/api v0.257.0
 	gopkg.in/yaml.v3 v3.0.1
 	gorm.io/driver/mysql v1.5.7
 	gorm.io/driver/postgres v1.5.7
@@ -131,11 +129,11 @@ require (
 )
 
 require (
-	cloud.google.com/go/auth v0.20.0 // indirect
+	cloud.google.com/go/auth v0.17.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.9.0 // indirect
 	dario.cat/mergo v1.0.1 // indirect
-	filippo.io/edwards25519 v1.1.1 // indirect
+	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/AppsFlyer/go-sundheit v0.6.0 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
@@ -146,39 +144,36 @@ require (
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
-	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/awnumar/memcall v0.4.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.6 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.6 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 // indirect
 	github.com/aws/aws-sdk-go-v2/service/route53 v1.42.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.29.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.38.2 // indirect
-	github.com/aws/smithy-go v1.23.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.33.19 // indirect
+	github.com/aws/smithy-go v1.22.2 // indirect
 	github.com/beevik/etree v1.6.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/caddyserver/zerossl v0.1.3 // indirect
-	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
 	github.com/cpuguy83/dockercfg v0.3.2 // indirect
-	github.com/crowdsecurity/go-cs-lib v0.0.25 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/distribution/reference v0.6.0 // indirect
 	github.com/docker/docker v28.0.1+incompatible // indirect
-	github.com/docker/go-connections v0.6.0 // indirect
+	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/ebitengine/purego v0.8.4 // indirect
+	github.com/ebitengine/purego v0.8.2 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fredbi/uri v1.1.1 // indirect
 	github.com/fyne-io/gl-js v0.2.0 // indirect
@@ -192,26 +187,14 @@ require (
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.3.0 // indirect
-	github.com/go-openapi/analysis v0.23.0 // indirect
-	github.com/go-openapi/errors v0.22.2 // indirect
-	github.com/go-openapi/jsonpointer v0.21.1 // indirect
-	github.com/go-openapi/jsonreference v0.21.0 // indirect
-	github.com/go-openapi/loads v0.22.0 // indirect
-	github.com/go-openapi/spec v0.21.0 // indirect
-	github.com/go-openapi/strfmt v0.23.0 // indirect
-	github.com/go-openapi/swag v0.23.1 // indirect
-	github.com/go-openapi/validate v0.24.0 // indirect
 	github.com/go-sql-driver/mysql v1.9.3 // indirect
 	github.com/go-text/render v0.2.0 // indirect
 	github.com/go-text/typesetting v0.2.1 // indirect
-	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/google/btree v1.1.2 // indirect
-	github.com/google/go-querystring v1.1.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
-	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
-	github.com/googleapis/gax-go/v2 v2.21.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
+	github.com/googleapis/gax-go/v2 v2.15.0 // indirect
 	github.com/gorilla/handlers v1.5.2 // indirect
 	github.com/hack-pad/go-indexeddb v0.3.2 // indirect
 	github.com/hack-pad/safejs v0.1.0 // indirect
@@ -229,18 +212,16 @@ require (
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/jonboulle/clockwork v0.5.0 // indirect
-	github.com/josharian/intern v1.0.0 // indirect
 	github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25 // indirect
 	github.com/kelseyhightower/envconfig v1.4.0 // indirect
 	github.com/klauspost/compress v1.18.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
 	github.com/koron/go-ssdp v0.0.4 // indirect
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/lib/pq v1.10.9 // indirect
 	github.com/libdns/libdns v0.2.2 // indirect
 	github.com/lufia/plan9stats v0.0.0-20240513124658-fba389f38bae // indirect
 	github.com/magiconair/properties v1.8.10 // indirect
-	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect
 	github.com/mattn/go-sqlite3 v1.14.32 // indirect
 	github.com/mdelapenya/tlscert v0.2.0 // indirect
@@ -248,7 +229,6 @@ require (
 	github.com/mdlayher/netlink v1.7.3-0.20250113171957-fbb4dce95f42 // indirect
 	github.com/mholt/acmez/v2 v2.0.1 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
-	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/patternmatcher v0.6.0 // indirect
@@ -260,8 +240,7 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 // indirect
 	github.com/nicksnyder/go-i18n/v2 v2.5.1 // indirect
-	github.com/nxadm/tail v1.4.11 // indirect
-	github.com/oklog/ulid v1.3.1 // indirect
+	github.com/nxadm/tail v1.4.8 // indirect
 	github.com/onsi/ginkgo/v2 v2.9.5 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
@@ -271,43 +250,41 @@ require (
 	github.com/pion/transport/v2 v2.2.4 // indirect
 	github.com/pion/turn/v4 v4.1.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/otlptranslator v1.0.0 // indirect
 	github.com/prometheus/procfs v0.19.2 // indirect
-	github.com/russellhaering/goxmldsig v1.6.0 // indirect
+	github.com/russellhaering/goxmldsig v1.5.0 // indirect
 	github.com/rymdport/portal v0.4.2 // indirect
-	github.com/shirou/gopsutil/v4 v4.25.8 // indirect
+	github.com/shirou/gopsutil/v4 v4.25.1 // indirect
 	github.com/shoenig/go-m1cpu v0.2.1 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
 	github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c // indirect
 	github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
-	github.com/tklauser/go-sysconf v0.3.15 // indirect
-	github.com/tklauser/numcpus v0.10.0 // indirect
+	github.com/tklauser/go-sysconf v0.3.14 // indirect
+	github.com/tklauser/numcpus v0.8.0 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/wlynxg/anet v0.0.5 // indirect
 	github.com/yuin/goldmark v1.7.8 // indirect
 	github.com/zeebo/blake3 v0.2.3 // indirect
-	go.mongodb.org/mongo-driver v1.17.9 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.43.0 // indirect
-	go.opentelemetry.io/otel/trace v1.43.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.42.0 // indirect
+	go.opentelemetry.io/otel/trace v1.42.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	golang.org/x/image v0.33.0 // indirect
-	golang.org/x/text v0.35.0 // indirect
-	golang.org/x/tools v0.42.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/tools v0.41.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
 
 replace github.com/kardianos/service => github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502

go.sum

@@ -1,5 +1,5 @@
-cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=
-cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=
+cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4=
+cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
@@ -9,8 +9,8 @@ cunicu.li/go-rosenpass v0.4.0 h1:LtPtBgFWY/9emfgC4glKLEqS0MJTylzV6+ChRhiZERw=
 cunicu.li/go-rosenpass v0.4.0/go.mod h1:MPbjH9nxV4l3vEagKVdFNwHOketqgS5/To1VYJplf/M=
 dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
 dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
-filippo.io/edwards25519 v1.1.1 h1:YpjwWWlNmGIDyXOn8zLzqiD+9TyIlPhGFG96P39uBpw=
-filippo.io/edwards25519 v1.1.1/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
 fyne.io/fyne/v2 v2.7.0 h1:GvZSpE3X0liU/fqstInVvRsaboIVpIWQ4/sfjDGIGGQ=
 fyne.io/fyne/v2 v2.7.0/go.mod h1:xClVlrhxl7D+LT+BWYmcrW4Nf+dJTvkhnPgji7spAwE=
 fyne.io/systray v1.12.1-0.20260116214250-81f8e1a496f9 h1:829+77I4TaMrcg9B3wf+gHhdSgoCVEgH2czlPXPbfj4=
@@ -40,50 +40,48 @@ github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFI
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
 github.com/apapsch/go-jsonmerge/v2 v2.0.0 h1:axGnT1gRIfimI7gJifB699GoE/oq+F2MU7Dml6nw9rQ=
 github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP2+08jFMw88y4klk=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
-github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
 github.com/awnumar/memcall v0.4.0 h1:B7hgZYdfH6Ot1Goaz8jGne/7i8xD4taZie/PNSFZ29g=
 github.com/awnumar/memcall v0.4.0/go.mod h1:8xOx1YbfyuCg3Fy6TO8DK0kZUua3V42/goA5Ru47E8w=
 github.com/awnumar/memguard v0.23.0 h1:sJ3a1/SWlcuKIQ7MV+R9p0Pvo9CWsMbGZvcZQtmc68A=
 github.com/awnumar/memguard v0.23.0/go.mod h1:olVofBrsPdITtJ2HgxQKrEYEMyIBAIciVG4wNnZhW9M=
-github.com/aws/aws-sdk-go-v2 v1.38.3 h1:B6cV4oxnMs45fql4yRH+/Po/YU+597zgWqvDpYMturk=
-github.com/aws/aws-sdk-go-v2 v1.38.3/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1 h1:i8p8P4diljCr60PpJp6qZXNlgX4m2yQFpYk+9ZT+J4E=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.1/go.mod h1:ddqbooRZYNoJ2dsTwOty16rM+/Aqmk/GOXrK8cg7V00=
-github.com/aws/aws-sdk-go-v2/config v1.31.6 h1:a1t8fXY4GT4xjyJExz4knbuoxSCacB5hT/WgtfPyLjo=
-github.com/aws/aws-sdk-go-v2/config v1.31.6/go.mod h1:5ByscNi7R+ztvOGzeUaIu49vkMk2soq5NaH5PYe33MQ=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.10 h1:xdJnXCouCx8Y0NncgoptztUocIYLKeQxrCgN6x9sdhg=
-github.com/aws/aws-sdk-go-v2/credentials v1.18.10/go.mod h1:7tQk08ntj914F/5i9jC4+2HQTAuJirq7m1vZVIhEkWs=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.6 h1:wbjnrrMnKew78/juW7I2BtKQwa1qlf6EjQgS69uYY14=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.6/go.mod h1:AtiqqNrDioJXuUgz3+3T0mBWN7Hro2n9wll2zRUc0ww=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.6 h1:uF68eJA6+S9iVr9WgX1NaRGyQ/6MdIyc4JNUo6TN1FA=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.6/go.mod h1:qlPeVZCGPiobx8wb1ft0GHT5l+dc6ldnwInDFaMvC7Y=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.6 h1:pa1DEC6JoI0zduhZePp3zmhWvk/xxm4NB8Hy/Tlsgos=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.6/go.mod h1:gxEjPebnhWGJoaDdtDkA0JX46VRg1wcTHYe63OfX5pE=
+github.com/aws/aws-sdk-go-v2 v1.36.3 h1:mJoei2CxPutQVxaATCzDUjcZEjVRdpsiiXi2o38yqWM=
+github.com/aws/aws-sdk-go-v2 v1.36.3/go.mod h1:LLXuLpgzEbD766Z5ECcRmi8AzSwfZItDtmABVkRLGzg=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 h1:zAybnyUQXIZ5mok5Jqwlf58/TFE7uvd3IAsa1aF9cXs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10/go.mod h1:qqvMj6gHLR/EXWZw4ZbqlPbQUyenf4h82UQUlKc+l14=
+github.com/aws/aws-sdk-go-v2/config v1.29.14 h1:f+eEi/2cKCg9pqKBoAIwRGzVb70MRKqWX4dg1BDcSJM=
+github.com/aws/aws-sdk-go-v2/config v1.29.14/go.mod h1:wVPHWcIFv3WO89w0rE10gzf17ZYy+UVS1Geq8Iei34g=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.67 h1:9KxtdcIA/5xPNQyZRgUSpYOE6j9Bc4+D7nZua0KGYOM=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.67/go.mod h1:p3C44m+cfnbv763s52gCqrjaqyPikj9Sg47kUVaNZQQ=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 h1:x793wxmUWVDhshP8WW2mlnXuFrO4cOd3HLBroh1paFw=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30/go.mod h1:Jpne2tDnYiFascUEs2AWHJL9Yp7A5ZVy3TNyxaAjD6M=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 h1:ZK5jHhnrioRkUNOc+hOgQKlUL5JeC3S6JgLxtQ+Rm0Q=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34/go.mod h1:p4VfIceZokChbA9FzMbRGz5OV+lekcVtHlPKEO0gSZY=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 h1:SZwFm17ZUNNg5Np0ioo/gq8Mn6u9w19Mri8DnJ15Jf0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34/go.mod h1:dFZsC0BLo346mvKQLWmoJxT+Sjp+qcVR1tRVHQGOH9Q=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.6 h1:R0tNFJqfjHL3900cqhXuwQ+1K4G0xc9Yf8EDbFXCKEw=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.6/go.mod h1:y/7sDdu+aJvPtGXr4xYosdpq9a6T9Z0jkXfugmti0rI=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.6 h1:hncKj/4gR+TPauZgTAsxOxNcvBayhUlYZ6LO/BYiQ30=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.6/go.mod h1:OiIh45tp6HdJDDJGnja0mw8ihQGz3VGrUflLqSL0SmM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.6 h1:LHS1YAIJXJ4K9zS+1d/xa9JAA9sL2QyXIQCQFQW/X08=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.6/go.mod h1:c9PCiTEuh0wQID5/KqA32J+HAgZxN9tOGXKCiYJjTZI=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.6 h1:nEXUSAwyUfLTgnc9cxlDWy637qsq4UWwp3sNAfl0Z3Y=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.6/go.mod h1:HGzIULx4Ge3Do2V0FaiYKcyKzOqwrhUZgCI77NisswQ=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 h1:ZNTqv4nIdE/DiBfUUfXcLZ/Spcuz+RjeziUtNJackkM=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34/go.mod h1:zf7Vcd1ViW7cPqYWEHLHJkS50X0JS2IKz9Cgaj6ugrs=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 h1:eAh2A4b5IzM/lum78bZ590jy36+d/aFLgKF/4Vd1xPE=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3/go.mod h1:0yKJC/kb8sAnmlYa6Zs3QVYqaC8ug2AbnNChv5Ox3uA=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.0 h1:lguz0bmOoGzozP9XfRJR1QIayEYo+2vP/No3OfLF0pU=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.0/go.mod h1:iu6FSzgt+M2/x3Dk8zhycdIcHjEFb36IS8HVUVFoMg0=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 h1:dM9/92u2F1JbDaGooxTq18wmmFzbJRfXfVfy96/1CXM=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15/go.mod h1:SwFBy2vjtA0vZbjjaFtfN045boopadnoVPhu4Fv66vY=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 h1:moLQUoVq91LiqT1nbvzDukyqAlCv89ZmwaHw/ZFlFZg=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15/go.mod h1:ZH34PJUc8ApjBIfgQCFvkWcUDBtl/WTD+uiYHjd8igA=
 github.com/aws/aws-sdk-go-v2/service/route53 v1.42.3 h1:MmLCRqP4U4Cw9gJ4bNrCG0mWqEtBlmAVleyelcHARMU=
 github.com/aws/aws-sdk-go-v2/service/route53 v1.42.3/go.mod h1:AMPjK2YnRh0YgOID3PqhJA1BRNfXDfGOnSsKHtAe8yA=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.87.3 h1:ETkfWcXP2KNPLecaDa++5bsQhCRa5M5sLUJa5DWYIIg=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.87.3/go.mod h1:+/3ZTqoYb3Ur7DObD00tarKMLMuKg8iqz5CHEanqTnw=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.1 h1:8OLZnVJPvjnrxEwHFg9hVUof/P4sibH+Ea4KKuqAGSg=
-github.com/aws/aws-sdk-go-v2/service/sso v1.29.1/go.mod h1:27M3BpVi0C02UiQh1w9nsBEit6pLhlaH3NHna6WUbDE=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.2 h1:gKWSTnqudpo8dAxqBqZnDoDWCiEh/40FziUjr/mo6uA=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.2/go.mod h1:x7+rkNmRoEN1U13A6JE2fXne9EWyJy54o3n6d4mGaXQ=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.2 h1:YZPjhyaGzhDQEvsffDEcpycq49nl7fiGcfJTIo8BszI=
-github.com/aws/aws-sdk-go-v2/service/sts v1.38.2/go.mod h1:2dIN8qhQfv37BdUYGgEC8Q3tteM3zFxTI1MLO2O3J3c=
-github.com/aws/smithy-go v1.23.0 h1:8n6I3gXzWJB2DxBDnfxgBaSX6oe0d/t10qGz7OKqMCE=
-github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.79.2 h1:tWUG+4wZqdMl/znThEk9tcCy8tTMxq8dW0JTgamohrY=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.79.2/go.mod h1:U5SNqwhXB3Xe6F47kXvWihPl/ilGaEDe8HD/50Z9wxc=
+github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 h1:1Gw+9ajCV1jogloEv1RRnvfRFia2cL6c9cuKV2Ps+G8=
+github.com/aws/aws-sdk-go-v2/service/sso v1.25.3/go.mod h1:qs4a9T5EMLl/Cajiw2TcbNt2UNo/Hqlyp+GiuG4CFDI=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 h1:hXmVKytPfTy5axZ+fYbR5d0cFmC3JvwLm5kM83luako=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1/go.mod h1:MlYRNmYu/fGPoxBQVvBYr9nyr948aY/WLUvwBMBJubs=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.19 h1:1XuUZ8mYJw9B6lzAkXhqHlJd/XvaX32evhproijJEZY=
+github.com/aws/aws-sdk-go-v2/service/sts v1.33.19/go.mod h1:cQnB8CUnxbMU82JvlqjKR2HBOm3fe9pWorWBza6MBJ4=
+github.com/aws/smithy-go v1.22.2 h1:6D9hW43xKFrRx/tXXfAlIZc4JI+yQe6snnWcQyxSyLQ=
+github.com/aws/smithy-go v1.22.2/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
 github.com/beevik/etree v1.6.0 h1:u8Kwy8pp9D9XeITj2Z0XtA5qqZEmtJtuXZRQi+j03eE=
 github.com/beevik/etree v1.6.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -101,8 +99,6 @@ github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+Y
 github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
-github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cilium/ebpf v0.15.0 h1:7NxJhNiBT3NG8pZJ3c+yfrVdHY8ScgKD27sScgjLMMk=
@@ -122,18 +118,11 @@ github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHf
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
-github.com/crowdsecurity/crowdsec v1.7.7 h1:sduZN763iXsrZodocWDrsR//7nLeffGu+RVkkIsbQkE=
-github.com/crowdsecurity/crowdsec v1.7.7/go.mod h1:L1HLGPDnBYCcY+yfSFnuBbQ1G9DHEJN9c+Kevv9F+4Q=
-github.com/crowdsecurity/go-cs-bouncer v0.0.21 h1:arPz0VtdVSaz+auOSfHythzkZVLyy18CzYvYab8UJDU=
-github.com/crowdsecurity/go-cs-bouncer v0.0.21/go.mod h1:4JiH0XXA4KKnnWThItUpe5+heJHWzsLOSA2IWJqUDBA=
-github.com/crowdsecurity/go-cs-lib v0.0.25 h1:Ov6VPW9yV+OPsbAIQk1iTkEWhwkpaG0v3lrBzeqjzj4=
-github.com/crowdsecurity/go-cs-lib v0.0.25/go.mod h1:X0GMJY2CxdA1S09SpuqIKaWQsvRGxXmecUp9cP599dE=
 github.com/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6 h1:/DS5cDX3FJdl+XaN2D7XAwFpuanTxnp52DBLZAaJKx0=
 github.com/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6/go.mod h1:+CauBF6R70Jqcyl8N2hC8pAXYbWkGIezuSbuGLtRhnw=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dexidp/dex/api/v2 v2.4.0 h1:gNba7n6BKVp8X4Jp24cxYn5rIIGhM6kDOXcZoL6tr9A=
 github.com/dexidp/dex/api/v2 v2.4.0/go.mod h1:/p550ADvFFh7K95VmhUD+jgm15VdaNnab9td8DHOpyI=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
@@ -142,12 +131,12 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/docker/docker v28.0.1+incompatible h1:FCHjSRdXhNRFjlHMTv4jUNlIBbTeRjrWfeFuJp7jpo0=
 github.com/docker/docker v28.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
-github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
+github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
+github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/ebitengine/purego v0.8.4 h1:CF7LEKg5FFOsASUj0+QwaXf8Ht6TlFxg09+S9wz0omw=
-github.com/ebitengine/purego v0.8.4/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/ebitengine/purego v0.8.2 h1:jPPGWs2sZ1UgOSgD2bClL0MJIqu58nOmIcBuXr62z1I=
+github.com/ebitengine/purego v0.8.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/eko/gocache/lib/v4 v4.2.0 h1:MNykyi5Xw+5Wu3+PUrvtOCaKSZM1nUSVftbzmeC7Yuw=
 github.com/eko/gocache/lib/v4 v4.2.0/go.mod h1:7ViVmbU+CzDHzRpmB4SXKyyzyuJ8A3UW3/cszpcqB4M=
 github.com/eko/gocache/store/go_cache/v4 v4.2.2 h1:tAI9nl6TLoJyKG1ujF0CS0n/IgTEMl+NivxtR5R3/hw=
@@ -166,7 +155,6 @@ github.com/fredbi/uri v1.1.1 h1:xZHJC08GZNIUhbP5ImTHnt5Ya0T8FI2VAwI/37kh2Ko=
 github.com/fredbi/uri v1.1.1/go.mod h1:4+DZQ5zBjEwQCDmXW5JdIjz0PUA+yJbvtBv+u+adr5o=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fyne-io/gl-js v0.2.0 h1:+EXMLVEa18EfkXBVKhifYB6OGs3HwKO3lUElA0LlAjs=
@@ -199,24 +187,6 @@ github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre
 github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
 github.com/go-ole/go-ole v1.3.0 h1:Dt6ye7+vXGIKZ7Xtk4s6/xVdGDQynvom7xCFEdWr6uE=
 github.com/go-ole/go-ole v1.3.0/go.mod h1:5LS6F96DhAwUc7C+1HLexzMXY1xGRSryjyPPKW6zv78=
-github.com/go-openapi/analysis v0.23.0 h1:aGday7OWupfMs+LbmLZG4k0MYXIANxcuBTYUC03zFCU=
-github.com/go-openapi/analysis v0.23.0/go.mod h1:9mz9ZWaSlV8TvjQHLl2mUW2PbZtemkE8yA5v22ohupo=
-github.com/go-openapi/errors v0.22.2 h1:rdxhzcBUazEcGccKqbY1Y7NS8FDcMyIRr0934jrYnZg=
-github.com/go-openapi/errors v0.22.2/go.mod h1:+n/5UdIqdVnLIJ6Q9Se8HNGUXYaY6CN8ImWzfi/Gzp0=
-github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic=
-github.com/go-openapi/jsonpointer v0.21.1/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk=
-github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ=
-github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4=
-github.com/go-openapi/loads v0.22.0 h1:ECPGd4jX1U6NApCGG1We+uEozOAvXvJSF4nnwHZ8Aco=
-github.com/go-openapi/loads v0.22.0/go.mod h1:yLsaTCS92mnSAZX5WWoxszLj0u+Ojl+Zs5Stn1oF+rs=
-github.com/go-openapi/spec v0.21.0 h1:LTVzPc3p/RzRnkQqLRndbAzjY0d0BCL72A6j3CdL9ZY=
-github.com/go-openapi/spec v0.21.0/go.mod h1:78u6VdPw81XU44qEWGhtr982gJ5BWg2c0I5XwVMotYk=
-github.com/go-openapi/strfmt v0.23.0 h1:nlUS6BCqcnAk0pyhi9Y+kdDVZdZMHfEKQiS4HaMgO/c=
-github.com/go-openapi/strfmt v0.23.0/go.mod h1:NrtIpfKtWIygRkKVsxh7XQMDQW5HKQl6S5ik2elW+K4=
-github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU=
-github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0=
-github.com/go-openapi/validate v0.24.0 h1:LdfDKwNbpB6Vn40xhTdNZAnfLECL81w+VX3BumrGD58=
-github.com/go-openapi/validate v0.24.0/go.mod h1:iyeX1sEufmv3nPbBdX3ieNviWnOZaJ1+zquzJEf2BAQ=
 github.com/go-playground/locales v0.12.1/go.mod h1:IUMDtCfWo/w/mtMfIE/IG2K+Ey3ygWanZIBtBW0W2TM=
 github.com/go-playground/universal-translator v0.16.0/go.mod h1:1AnU7NaIRDWWzGEKwgtJRd2xk99HeFyHw3yid4rvQIY=
 github.com/go-quicktest/qt v1.101.0 h1:O1K29Txy5P2OK0dGo59b7b0LR6wKfIhttaAhHUyn7eI=
@@ -233,14 +203,10 @@ github.com/go-text/typesetting v0.2.1 h1:x0jMOGyO3d1qFAPI0j4GSsh7M0Q3Ypjzr4+CEVg
 github.com/go-text/typesetting v0.2.1/go.mod h1:mTOxEwasOFpAMBjEQDhdWRckoLLeI/+qrQeBCTGEt6M=
 github.com/go-text/typesetting-utils v0.0.0-20241103174707-87a29e9e6066 h1:qCuYC+94v2xrb1PoS4NIDe7DGYtLnU2wWiQe9a1B1c0=
 github.com/go-text/typesetting-utils v0.0.0-20241103174707-87a29e9e6066/go.mod h1:DDxDdQEnB70R8owOx3LVpEFvpMK9eeH1o2r0yZhFI9o=
-github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
-github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
-github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
 github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
@@ -264,7 +230,6 @@ github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl76
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
@@ -272,8 +237,6 @@ github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
-github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gopacket v1.1.19 h1:ves8RnFZPGiFnTS0uPQStjwru6uO6h+nlr9j6fL7kF8=
 github.com/google/gopacket v1.1.19/go.mod h1:iJ8V8n6KS+z2U1A8pUwu8bW5SyEMkXJB8Yo/Vo+TKTo=
@@ -285,10 +248,10 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
 github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8=
-github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg=
-github.com/googleapis/gax-go/v2 v2.21.0 h1:h45NjjzEO3faG9Lg/cFrBh2PgegVVgzqKzuZl/wMbiI=
-github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4=
+github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAVrGgAa0f2/R35S4DJwfFaUPFQ=
+github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
+github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo=
+github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc=
 github.com/gopacket/gopacket v1.1.1 h1:zbx9F9d6A7sWNkFKrvMBZTfGgxFoY4NgUudFVVHMfcw=
 github.com/gopacket/gopacket v1.1.1/go.mod h1:HavMeONEl7W9036of9LbSWoonqhH7HA1+ZRO+rMIvFs=
 github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE=
@@ -313,8 +276,8 @@ github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PU
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKeRZfjY=
-github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
+github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
 github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI=
 github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
@@ -356,8 +319,6 @@ github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGw
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jonboulle/clockwork v0.5.0 h1:Hyh9A8u51kptdkR+cqRpT1EebBwTn1oK9YfGYbdFz6I=
 github.com/jonboulle/clockwork v0.5.0/go.mod h1:3mZlmanh0g2NDKO5TWZVJAfofYk64M7XN3SzBPjZF60=
-github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
-github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25 h1:YLvr1eE6cdCqjOe972w/cYF+FjW34v27+9Vo5106B4M=
 github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25/go.mod h1:kLgvv7o6UM+0QSf0QjAse3wReFDsb9qbZJdfexWlrQw=
@@ -369,8 +330,8 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/klauspost/cpuid/v2 v2.0.12/go.mod h1:g2LTdtYhdyuGPqyWyv7qRAmj1WBqxuObKfj5c0PQa7c=
-github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
-github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
+github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/koron/go-ssdp v0.0.4 h1:1IDwrghSKYM7yLf7XCzbByg2sJ/JcNOZRXS2jczTwz0=
 github.com/koron/go-ssdp v0.0.4/go.mod h1:oDXq+E5IL5q0U8uSBcoAXzTzInwy5lEgC91HoKtbmZk=
 github.com/kr/fs v0.1.0 h1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=
@@ -400,8 +361,6 @@ github.com/lufia/plan9stats v0.0.0-20240513124658-fba389f38bae h1:dIZY4ULFcto4tA
 github.com/lufia/plan9stats v0.0.0-20240513124658-fba389f38bae/go.mod h1:ilwx/Dta8jXAgpFYFvSWEMwxmbWXyiUHkd5FwyKhb5k=
 github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
 github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
-github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4=
-github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0 h1:RXbVD2UAl7A7nOTR4u7E3ILa4IbtvKBHw64LDsmu9hU=
 github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxqpJpWWUiPNr5H3O8eDgGV9gT5To=
 github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
@@ -425,8 +384,6 @@ github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa1
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
-github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
-github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
@@ -453,8 +410,8 @@ github.com/netbirdio/go-netroute v0.0.0-20240611143515-f59b0e1d3944 h1:TDtJKmM6S
 github.com/netbirdio/go-netroute v0.0.0-20240611143515-f59b0e1d3944/go.mod h1:sHA6TRxjQ6RLbnI+3R4DZo2Eseg/iKiPRfNmcuNySVQ=
 github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51 h1:Ov4qdafATOgGMB1wbSuh+0aAHcwz9hdvB6VZjh1mVMI=
 github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51/go.mod h1:ZSIbPdBn5hePO8CpF1PekH2SfpTxg1PDhEwtbqZS7R8=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20260416123949-2355d972be42 h1:F3zS5fT9xzD1OFLfcdAE+3FfyiwjGukF1hvj0jErgs8=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20260416123949-2355d972be42/go.mod h1:n47r67ZSPgwSmT/Z1o48JjZQW9YJ6m/6Bd/uAXkL3Pg=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20260210160626-df4b180c7b25 h1:iwAq/Ncaq0etl4uAlVsbNBzC1yY52o0AmY7uCm2AMTs=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20260210160626-df4b180c7b25/go.mod h1:y7CxagMYzg9dgu+masRqYM7BQlOGA5Y8US85MCNFPlY=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9axERMVN63dqyFqnvuD+EMJHzM7mNGON8=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
@@ -466,13 +423,10 @@ github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646/go.mod h1:jpp1/29i3P1S
 github.com/nicksnyder/go-i18n/v2 v2.5.1 h1:IxtPxYsR9Gp60cGXjfuR/llTqV8aYMsC472zD0D1vHk=
 github.com/nicksnyder/go-i18n/v2 v2.5.1/go.mod h1:DrhgsSDZxoAfvVrBVLXoxZn/pN5TXqaDbq7ju94viiQ=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
-github.com/nxadm/tail v1.4.11/go.mod h1:OTaG3NK980DZzxbRq6lEuzgU+mug70nY11sMd4JXXHc=
 github.com/oapi-codegen/runtime v1.1.2 h1:P2+CubHq8fO4Q6fV1tqDBZHCwpVpvPg7oKiYzQgXIyI=
 github.com/oapi-codegen/runtime v1.1.2/go.mod h1:SK9X900oXmPWilYR5/WKPzt3Kqxn/uS/+lbpREv+eCg=
-github.com/oklog/ulid v1.3.1 h1:EGfNDEx6MqHz8B3uNV6QAib1UR2Lm97sHi3ocA6ESJ4=
-github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
 github.com/okta/okta-sdk-golang/v2 v2.18.0 h1:cfDasMb7CShbZvOrF6n+DnLevWwiHgedWMGJ8M8xKDc=
 github.com/okta/okta-sdk-golang/v2 v2.18.0/go.mod h1:dz30v3ctAiMb7jpsCngGfQUAEGm1/NsWT92uTbNDQIs=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
@@ -493,8 +447,8 @@ github.com/oschwald/maxminddb-golang v1.12.0 h1:9FnTOD0YOhP7DGxGsq4glzpGy5+w7pq5
 github.com/oschwald/maxminddb-golang v1.12.0/go.mod h1:q0Nob5lTCqyQ8WT6FYgS1L7PXKVVbgiymefNwIjPzgY=
 github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc=
 github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ=
-github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
-github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.0.9 h1:uH2qQXheeefCCkuBBSLi7jCiSmj3VRh2+Goq2N7Xxu0=
+github.com/pelletier/go-toml/v2 v2.0.9/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
 github.com/petermattis/goid v0.0.0-20250303134427-723919f7f203 h1:E7Kmf11E4K7B5hDti2K2NqPb1nlYlGYsu02S1JNd/Bs=
 github.com/petermattis/goid v0.0.0-20250303134427-723919f7f203/go.mod h1:pxMtw7cyUw6B2bRH0ZBANSPg+AoSud1I1iyJHI69jH4=
 github.com/pion/dtls/v2 v2.2.7/go.mod h1:8WiMkebSHFD0T+dIU+UeBaoV7kDhOW5oDCzZ7WZ/F9s=
@@ -532,9 +486,8 @@ github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
 github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
 github.com/pkg/sftp v1.13.9 h1:4NGkvGudBL7GteO3m6qnaQ4pC0Kvf0onSVc9gR3EWBw=
 github.com/pkg/sftp v1.13.9/go.mod h1:OBN7bVXdstkFFN/gdnHPUb5TE8eb8G1Rp9wCItqjkkA=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
@@ -558,15 +511,15 @@ github.com/rs/cors v1.8.0 h1:P2KMzcFwrPoSjkF1WLRPsp3UMLyql8L4v9hQpVeK5so=
 github.com/rs/cors v1.8.0/go.mod h1:EBwu+T5AvHOcXwvZIkQFjUN6s8Czyqw12GL/Y0tUyRM=
 github.com/rs/xid v1.3.0 h1:6NjYksEUlhurdVehpc7S7dk6DAmcKv8V9gG0FsVN2U4=
 github.com/rs/xid v1.3.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
-github.com/russellhaering/goxmldsig v1.6.0 h1:8fdWXEPh2k/NZNQBPFNoVfS3JmzS4ZprY/sAOpKQLks=
-github.com/russellhaering/goxmldsig v1.6.0/go.mod h1:TrnaquDcYxWXfJrOjeMBTX4mLBeYAqaHEyUeWPxZlBM=
+github.com/russellhaering/goxmldsig v1.5.0 h1:AU2UkkYIUOTyZRbe08XMThaOCelArgvNfYapcmSjBNw=
+github.com/russellhaering/goxmldsig v1.5.0/go.mod h1:x98CjQNFJcWfMxeOrMnMKg70lvDP6tE0nTaeUnjXDmk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/rymdport/portal v0.4.2 h1:7jKRSemwlTyVHHrTGgQg7gmNPJs88xkbKcIL3NlcmSU=
 github.com/rymdport/portal v0.4.2/go.mod h1:kFF4jslnJ8pD5uCi17brj/ODlfIidOxlgUDTO5ncnC4=
 github.com/shirou/gopsutil/v3 v3.24.4 h1:dEHgzZXt4LMNm+oYELpzl9YCqV65Yr/6SfrvgRBtXeU=
 github.com/shirou/gopsutil/v3 v3.24.4/go.mod h1:lTd2mdiOspcqLgAnr9/nGi71NkeMpWKdmhuxm9GusH8=
-github.com/shirou/gopsutil/v4 v4.25.8 h1:NnAsw9lN7587WHxjJA9ryDnqhJpFH6A+wagYWTOH970=
-github.com/shirou/gopsutil/v4 v4.25.8/go.mod h1:q9QdMmfAOVIw7a+eF86P7ISEU6ka+NLgkUxlopV4RwI=
+github.com/shirou/gopsutil/v4 v4.25.1 h1:QSWkTc+fu9LTAWfkZwZ6j8MSUk4A2LV7rbH0ZqmLjXs=
+github.com/shirou/gopsutil/v4 v4.25.1/go.mod h1:RoUCUpndaJFtT+2zsZzzmhvbfGoDCJ7nFXKJf8GqJbI=
 github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
 github.com/shoenig/go-m1cpu v0.2.1 h1:yqRB4fvOge2+FyRXFkXqsyMoqPazv14Yyy+iyccT2E4=
 github.com/shoenig/go-m1cpu v0.2.1/go.mod h1:KkDOw6m3ZJQAPHbrzkZki4hnx+pDRR1Lo+ldA56wD5w=
@@ -575,8 +528,8 @@ github.com/shoenig/test v1.7.0 h1:eWcHtTXa6QLnBvm0jgEabMRN/uJ4DMV3M8xUGgRkZmk=
 github.com/shoenig/test v1.7.0/go.mod h1:UxJ6u/x2v/TNs/LoLxBNJRV9DiwBBKYxXSyczsBHFoI=
 github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k=
 github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME=
-github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
-github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 h1:JIAuq3EEf9cgbU6AtGPK4CTG3Zf6CKMNqf0MHTggAUA=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
 github.com/songgao/water v0.0.0-20200317203138-2b4b6d7c09d8 h1:TG/diQgUe0pntT/2D9tmUCz4VNwm9MfrtPr0SU2qSX8=
@@ -625,11 +578,11 @@ github.com/ti-mo/conntrack v0.5.1/go.mod h1:T6NCbkMdVU4qEIgwL0njA6lw/iCAbzchlnwm
 github.com/ti-mo/netfilter v0.5.2 h1:CTjOwFuNNeZ9QPdRXt1MZFLFUf84cKtiQutNauHWd40=
 github.com/ti-mo/netfilter v0.5.2/go.mod h1:Btx3AtFiOVdHReTDmP9AE+hlkOcvIy403u7BXXbWZKo=
 github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
-github.com/tklauser/go-sysconf v0.3.15 h1:VE89k0criAymJ/Os65CSn1IXaol+1wrsFHEB8Ol49K4=
-github.com/tklauser/go-sysconf v0.3.15/go.mod h1:Dmjwr6tYFIseJw7a3dRLJfsHAMXZ3nEnL/aZY+0IuI4=
+github.com/tklauser/go-sysconf v0.3.14 h1:g5vzr9iPFFz24v2KZXs/pvpvh8/V9Fw6vQK5ZZb78yU=
+github.com/tklauser/go-sysconf v0.3.14/go.mod h1:1ym4lWMLUOhuBOPGtRcJm7tEGX4SCYNEEEtghGG/8uY=
 github.com/tklauser/numcpus v0.6.1/go.mod h1:1XfjsgE2zo8GVw7POkMbHENHzVg3GzmoZ9fESEdAacY=
-github.com/tklauser/numcpus v0.10.0 h1:18njr6LDBk1zuna922MgdjQuJFjrdppsZG60sHGfjso=
-github.com/tklauser/numcpus v0.10.0/go.mod h1:BiTKazU708GQTYF4mB+cmlpT2Is1gLk7XVuEeem8LsQ=
+github.com/tklauser/numcpus v0.8.0 h1:Mx4Wwe/FjZLeQsK/6kt2EOepwwSl7SmJrK5bV/dXYgY=
+github.com/tklauser/numcpus v0.8.0/go.mod h1:ZJZlAY+dmR4eut8epnzf0u/VwodKmryxR8txiloSqBE=
 github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
 github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
 github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
@@ -658,30 +611,28 @@ github.com/zeebo/blake3 v0.2.3 h1:TFoLXsjeXqRNFxSbk35Dk4YtszE/MQQGK10BH4ptoTg=
 github.com/zeebo/blake3 v0.2.3/go.mod h1:mjJjZpnsyIVtVgTOSpJ9vmRE4wgDeyt2HU3qXvvKCaQ=
 github.com/zeebo/pcg v1.0.1 h1:lyqfGeWiv4ahac6ttHs+I5hwtH/+1mrhlCtVNQM2kHo=
 github.com/zeebo/pcg v1.0.1/go.mod h1:09F0S9iiKrwn9rlI5yjLkmrug154/YRW6KnnXVDM/l4=
-go.mongodb.org/mongo-driver v1.17.9 h1:IexDdCuuNJ3BHrELgBlyaH9p60JXAvdzWR128q+U5tU=
-go.mongodb.org/mongo-driver v1.17.9/go.mod h1:LlOhpH5NUEfhxcAwG0UEkMqwYcc4JU18gtCdGudk/tQ=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=
 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg=
-go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I=
-go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho=
+go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 h1:Mne5On7VWdx7omSrSSZvM4Kw7cS7NQkOOmLcgscI51U=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0/go.mod h1:IPtUMKL4O3tH5y+iXVyAXqpAwMuzC1IrxVS81rummfE=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 h1:IeMeyr1aBvBiPVYihXIaeIZba6b8E1bYp7lbdxK8CQg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
 go.opentelemetry.io/otel/exporters/prometheus v0.64.0 h1:g0LRDXMX/G1SEZtK8zl8Chm4K6GBwRkjPKE36LxiTYs=
 go.opentelemetry.io/otel/exporters/prometheus v0.64.0/go.mod h1:UrgcjnarfdlBDP3GjDIJWe6HTprwSazNjwsI+Ru6hro=
-go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM=
-go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
-go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A=
-go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
+go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4=
+go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI=
+go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo=
+go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts=
+go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA=
+go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc=
+go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY=
+go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc=
 go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
 go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -707,10 +658,10 @@ golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1m
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
-golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
-golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o=
-golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842 h1:vr/HnozRka3pE4EsMEg1lgkXJkTFJCVUX+S/ZT6wYzM=
+golang.org/x/exp v0.0.0-20240506185415-9bf2ced13842/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
 golang.org/x/image v0.33.0 h1:LXRZRnv1+zGd5XBUVRFmYEphyyKJjQjCRiOuAP3sZfQ=
 golang.org/x/image v0.33.0/go.mod h1:DD3OsTYT9chzuzTQt+zMcOlBHgfoKQb1gry8p76Y1sc=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
@@ -725,8 +676,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
-golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
+golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
+golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
@@ -745,11 +696,11 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0=
-golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw=
+golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo=
+golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
+golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -761,8 +712,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -782,8 +733,8 @@ golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -797,8 +748,8 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -811,8 +762,8 @@ golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -824,10 +775,10 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
-golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
@@ -839,8 +790,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k=
-golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0=
+golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -851,19 +802,19 @@ golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 h1:CawjfCvY
 golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6/go.mod h1:3rxYc4HtVcSG9gVaTs2GEBdehh+sYPOwKtyUWEOTb80=
 golang.zx2c4.com/wireguard/windows v0.5.3 h1:On6j2Rpn3OEMXqBq00QEDC7bWSZrPIHKIus8eIuExIE=
 golang.zx2c4.com/wireguard/windows v0.5.3/go.mod h1:9TEe8TJmtwyQebdFwAkEWOPr3prrtqm+REGFifP60hI=
-gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
-gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
-google.golang.org/api v0.276.0 h1:nVArUtfLEihtW+b0DdcqRGK1xoEm2+ltAihyztq7MKY=
-google.golang.org/api v0.276.0/go.mod h1:Fnag/EWUPIcJXuIkP1pjoTgS5vdxlk3eeemL7Do6bvw=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/api v0.257.0 h1:8Y0lzvHlZps53PEaw+G29SsQIkuKrumGWs9puiexNAA=
+google.golang.org/api v0.257.0/go.mod h1:4eJrr+vbVaZSqs7vovFd1Jb/A6ml6iw2e6FBYf3GAO4=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=
-google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I=
-google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 h1:41r6JMbpzBMen0R/4TZeeAmGXSJC7DftGINUodzTkPI=
-google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
-google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
-google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4=
+google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s=
+google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 h1:fCvbg86sFXwdrl5LgVcTEvNC+2txB5mgROGmRL5mrls=
+google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:+rXWjjaukWZun3mLfjmVnQi18E1AsFbDN9QdJ5YXLto=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE=
+google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -885,8 +836,8 @@ gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8
 gopkg.in/go-playground/validator.v9 v9.29.1/go.mod h1:+c9/zcJMFNgbLvly1L1V+PpxWdVbfP1avr/N00E2vyQ=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
-gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
+gopkg.in/natefinch/lumberjack.v2 v2.0.0 h1:1Lc07Kr7qY4U2YPouBjpCLxpiyxIVoxqXgkXLknAOE8=
+gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
 gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
 gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=

infrastructure_files/getting-started.sh

@@ -182,23 +182,6 @@ read_enable_proxy() {
   return 0
 }
 
-read_enable_crowdsec() {
-  echo "" > /dev/stderr
-  echo "Do you want to enable CrowdSec IP reputation blocking?" > /dev/stderr
-  echo "CrowdSec checks client IPs against a community threat intelligence database" > /dev/stderr
-  echo "and blocks known malicious sources before they reach your services." > /dev/stderr
-  echo "A local CrowdSec LAPI container will be added to your deployment." > /dev/stderr
-  echo -n "Enable CrowdSec? [y/N]: " > /dev/stderr
-  read -r CHOICE < /dev/tty
-
-  if [[ "$CHOICE" =~ ^[Yy]$ ]]; then
-    echo "true"
-  else
-    echo "false"
-  fi
-  return 0
-}
-
 read_traefik_acme_email() {
   echo "" > /dev/stderr
   echo "Enter your email for Let's Encrypt certificate notifications." > /dev/stderr
@@ -314,10 +297,6 @@ initialize_default_values() {
   # NetBird Proxy configuration
   ENABLE_PROXY="false"
   PROXY_TOKEN=""
-
-  # CrowdSec configuration
-  ENABLE_CROWDSEC="false"
-  CROWDSEC_BOUNCER_KEY=""
   return 0
 }
 
@@ -346,9 +325,6 @@ configure_reverse_proxy() {
   if [[ "$REVERSE_PROXY_TYPE" == "0" ]]; then
     TRAEFIK_ACME_EMAIL=$(read_traefik_acme_email)
     ENABLE_PROXY=$(read_enable_proxy)
-    if [[ "$ENABLE_PROXY" == "true" ]]; then
-      ENABLE_CROWDSEC=$(read_enable_crowdsec)
-    fi
   fi
 
   # Handle external Traefik-specific prompts (option 1)
@@ -378,7 +354,7 @@ check_existing_installation() {
     echo "Generated files already exist, if you want to reinitialize the environment, please remove them first."
     echo "You can use the following commands:"
     echo "  $DOCKER_COMPOSE_COMMAND down --volumes # to remove all containers and volumes"
-    echo "  rm -f docker-compose.yml dashboard.env config.yaml proxy.env traefik-dynamic.yaml nginx-netbird.conf caddyfile-netbird.txt npm-advanced-config.txt && rm -rf crowdsec/"
+    echo "  rm -f docker-compose.yml dashboard.env config.yaml proxy.env traefik-dynamic.yaml nginx-netbird.conf caddyfile-netbird.txt npm-advanced-config.txt"
     echo "Be aware that this will remove all data from the database, and you will have to reconfigure the dashboard."
     exit 1
   fi
@@ -399,9 +375,6 @@ generate_configuration_files() {
         echo "NB_PROXY_TOKEN=placeholder" >> proxy.env
         # TCP ServersTransport for PROXY protocol v2 to the proxy backend
         render_traefik_dynamic > traefik-dynamic.yaml
-        if [[ "$ENABLE_CROWDSEC" == "true" ]]; then
-          mkdir -p crowdsec
-        fi
       fi
       ;;
     1)
@@ -444,12 +417,8 @@ start_services_and_show_instructions() {
 
     if [[ "$ENABLE_PROXY" == "true" ]]; then
       # Phase 1: Start core services (without proxy)
-      local core_services="traefik dashboard netbird-server"
-      if [[ "$ENABLE_CROWDSEC" == "true" ]]; then
-        core_services="$core_services crowdsec"
-      fi
       echo "Starting core services..."
-      $DOCKER_COMPOSE_COMMAND up -d $core_services
+      $DOCKER_COMPOSE_COMMAND up -d traefik dashboard netbird-server
 
       sleep 3
       wait_management_proxy traefik
@@ -469,33 +438,7 @@ start_services_and_show_instructions() {
 
       echo "Proxy token created successfully."
 
-      if [[ "$ENABLE_CROWDSEC" == "true" ]]; then
-        echo "Registering CrowdSec bouncer..."
-        local cs_retries=0
-        while ! $DOCKER_COMPOSE_COMMAND exec -T crowdsec cscli capi status >/dev/null 2>&1; do
-          cs_retries=$((cs_retries + 1))
-          if [[ $cs_retries -ge 30 ]]; then
-            echo "WARNING: CrowdSec did not become ready. Skipping CrowdSec setup." > /dev/stderr
-            echo "You can register a bouncer manually later with:" > /dev/stderr
-            echo "  docker exec netbird-crowdsec cscli bouncers add netbird-proxy -o raw" > /dev/stderr
-            ENABLE_CROWDSEC="false"
-            break
-          fi
-          sleep 2
-        done
-
-        if [[ "$ENABLE_CROWDSEC" == "true" ]]; then
-          CROWDSEC_BOUNCER_KEY=$($DOCKER_COMPOSE_COMMAND exec -T crowdsec \
-            cscli bouncers add netbird-proxy -o raw 2>/dev/null)
-          if [[ -z "$CROWDSEC_BOUNCER_KEY" ]]; then
-            echo "WARNING: Failed to create CrowdSec bouncer key. Skipping CrowdSec setup." > /dev/stderr
-            ENABLE_CROWDSEC="false"
-          else
-            echo "CrowdSec bouncer registered."
-          fi
-        fi
-      fi
-
+      # Generate proxy.env with the token
       render_proxy_env > proxy.env
 
       # Start proxy service
@@ -582,25 +525,11 @@ render_docker_compose_traefik_builtin() {
   # Generate proxy service section and Traefik dynamic config if enabled
   local proxy_service=""
   local proxy_volumes=""
-  local crowdsec_service=""
-  local crowdsec_volumes=""
   local traefik_file_provider=""
   local traefik_dynamic_volume=""
   if [[ "$ENABLE_PROXY" == "true" ]]; then
     traefik_file_provider='      - "--providers.file.filename=/etc/traefik/dynamic.yaml"'
     traefik_dynamic_volume="      - ./traefik-dynamic.yaml:/etc/traefik/dynamic.yaml:ro"
-
-    local proxy_depends="
-      netbird-server:
-        condition: service_started"
-    if [[ "$ENABLE_CROWDSEC" == "true" ]]; then
-      proxy_depends="
-      netbird-server:
-        condition: service_started
-      crowdsec:
-        condition: service_healthy"
-    fi
-
     proxy_service="
   # NetBird Proxy - exposes internal resources to the internet
   proxy:
@@ -610,7 +539,8 @@ render_docker_compose_traefik_builtin() {
     - 51820:51820/udp
     restart: unless-stopped
     networks: [netbird]
-    depends_on:${proxy_depends}
+    depends_on:
+      - netbird-server
     env_file:
       - ./proxy.env
     volumes:
@@ -633,35 +563,6 @@ render_docker_compose_traefik_builtin() {
 "
     proxy_volumes="
   netbird_proxy_certs:"
-
-    if [[ "$ENABLE_CROWDSEC" == "true" ]]; then
-      crowdsec_service="
-  crowdsec:
-    image: crowdsecurity/crowdsec:v1.7.7
-    container_name: netbird-crowdsec
-    restart: unless-stopped
-    networks: [netbird]
-    environment:
-      COLLECTIONS: crowdsecurity/linux
-    volumes:
-      - ./crowdsec:/etc/crowdsec
-      - crowdsec_db:/var/lib/crowdsec/data
-    healthcheck:
-      test: ["CMD", "cscli", "lapi", "status"]
-      interval: 10s
-      timeout: 5s
-      retries: 15
-    labels:
-      - traefik.enable=false
-    logging:
-      driver: \"json-file\"
-      options:
-        max-size: \"500m\"
-        max-file: \"2\"
-"
-      crowdsec_volumes="
-  crowdsec_db:"
-    fi
   fi
 
   cat <<EOF
@@ -774,10 +675,10 @@ $traefik_dynamic_volume
       options:
         max-size: "500m"
         max-file: "2"
-${proxy_service}${crowdsec_service}
+${proxy_service}
 volumes:
   netbird_data:
-  netbird_traefik_letsencrypt:${proxy_volumes}${crowdsec_volumes}
+  netbird_traefik_letsencrypt:${proxy_volumes}
 
 networks:
   netbird:
@@ -882,14 +783,6 @@ NB_PROXY_PROXY_PROTOCOL=true
 # Trust Traefik's IP for PROXY protocol headers
 NB_PROXY_TRUSTED_PROXIES=$TRAEFIK_IP
 EOF
-
-  if [[ "$ENABLE_CROWDSEC" == "true" && -n "$CROWDSEC_BOUNCER_KEY" ]]; then
-    cat <<EOF
-NB_PROXY_CROWDSEC_API_URL=http://crowdsec:8080
-NB_PROXY_CROWDSEC_API_KEY=$CROWDSEC_BOUNCER_KEY
-EOF
-  fi
-
   return 0
 }
 
@@ -1279,17 +1172,6 @@ print_builtin_traefik_instructions() {
     echo ""
     echo "  *.$NETBIRD_DOMAIN    CNAME    $NETBIRD_DOMAIN"
     echo ""
-    if [[ "$ENABLE_CROWDSEC" == "true" ]]; then
-      echo "CrowdSec IP Reputation:"
-      echo "  CrowdSec LAPI is running and connected to the community blocklist."
-      echo "  The proxy will automatically check client IPs against known threats."
-      echo "  Enable CrowdSec per-service in the dashboard under Access Control."
-      echo ""
-      echo "  To enroll in CrowdSec Console (optional, for dashboard and premium blocklists):"
-      echo "    docker exec netbird-crowdsec cscli console enroll <your-enrollment-key>"
-      echo "  Get your enrollment key at: https://app.crowdsec.net"
-      echo ""
-    fi
   fi
   return 0
 }

management/internals/modules/reverseproxy/accesslogs/accesslogentry.go

@@ -1,7 +1,6 @@
 package accesslogs
 
 import (
-	"maps"
 	"net"
 	"net/netip"
 	"time"
@@ -38,7 +37,6 @@ type AccessLogEntry struct {
 	BytesUpload     int64             `gorm:"index"`
 	BytesDownload   int64             `gorm:"index"`
 	Protocol        AccessLogProtocol `gorm:"index"`
-	Metadata        map[string]string `gorm:"serializer:json"`
 }
 
 // FromProto creates an AccessLogEntry from a proto.AccessLog
@@ -57,7 +55,6 @@ func (a *AccessLogEntry) FromProto(serviceLog *proto.AccessLog) {
 	a.BytesUpload = serviceLog.GetBytesUpload()
 	a.BytesDownload = serviceLog.GetBytesDownload()
 	a.Protocol = AccessLogProtocol(serviceLog.GetProtocol())
-	a.Metadata = maps.Clone(serviceLog.GetMetadata())
 
 	if sourceIP := serviceLog.GetSourceIp(); sourceIP != "" {
 		if addr, err := netip.ParseAddr(sourceIP); err == nil {
@@ -120,11 +117,6 @@ func (a *AccessLogEntry) ToAPIResponse() *api.ProxyAccessLog {
 		protocol = &p
 	}
 
-	var metadata *map[string]string
-	if len(a.Metadata) > 0 {
-		metadata = &a.Metadata
-	}
-
 	return &api.ProxyAccessLog{
 		Id:              a.ID,
 		ServiceId:       a.ServiceID,
@@ -144,6 +136,5 @@ func (a *AccessLogEntry) ToAPIResponse() *api.ProxyAccessLog {
 		BytesUpload:     a.BytesUpload,
 		BytesDownload:   a.BytesDownload,
 		Protocol:        protocol,
-		Metadata:        metadata,
 	}
 }

management/internals/modules/reverseproxy/domain/domain.go

@@ -20,9 +20,6 @@ type Domain struct {
 	// RequireSubdomain is populated at query time. When true, the domain
 	// cannot be used bare and a subdomain label must be prepended. Not persisted.
 	RequireSubdomain *bool `gorm:"-"`
-	// SupportsCrowdSec is populated at query time from proxy cluster capabilities.
-	// Not persisted.
-	SupportsCrowdSec *bool `gorm:"-"`
 }
 
 // EventMeta returns activity event metadata for a domain

management/internals/modules/reverseproxy/domain/manager/api.go

@@ -48,7 +48,6 @@ func domainToApi(d *domain.Domain) api.ReverseProxyDomain {
 		Validated:           d.Validated,
 		SupportsCustomPorts: d.SupportsCustomPorts,
 		RequireSubdomain:    d.RequireSubdomain,
-		SupportsCrowdsec:    d.SupportsCrowdSec,
 	}
 	if d.TargetCluster != "" {
 		resp.TargetCluster = &d.TargetCluster

management/internals/modules/reverseproxy/domain/manager/manager.go

@@ -33,7 +33,6 @@ type proxyManager interface {
 	GetActiveClusterAddresses(ctx context.Context) ([]string, error)
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
-	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
 }
 
 type Manager struct {
@@ -91,7 +90,6 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 		}
 		d.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, cluster)
 		d.RequireSubdomain = m.proxyManager.ClusterRequireSubdomain(ctx, cluster)
-		d.SupportsCrowdSec = m.proxyManager.ClusterSupportsCrowdSec(ctx, cluster)
 		ret = append(ret, d)
 	}
 
@@ -107,7 +105,6 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 		}
 		if d.TargetCluster != "" {
 			cd.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, d.TargetCluster)
-			cd.SupportsCrowdSec = m.proxyManager.ClusterSupportsCrowdSec(ctx, d.TargetCluster)
 		}
 		// Custom domains never require a subdomain by default since
 		// the account owns them and should be able to use the bare domain.

management/internals/modules/reverseproxy/proxy/manager.go

@@ -18,7 +18,6 @@ type Manager interface {
 	GetActiveClusters(ctx context.Context) ([]Cluster, error)
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
-	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
 	CleanupStale(ctx context.Context, inactivityDuration time.Duration) error
 }
 

management/internals/modules/reverseproxy/proxy/manager/manager.go

@@ -18,7 +18,6 @@ type store interface {
 	GetActiveProxyClusters(ctx context.Context) ([]proxy.Cluster, error)
 	GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
-	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 }
 
@@ -139,12 +138,6 @@ func (m Manager) ClusterRequireSubdomain(ctx context.Context, clusterAddr string
 	return m.store.GetClusterRequireSubdomain(ctx, clusterAddr)
 }
 
-// ClusterSupportsCrowdSec returns whether all active proxies in the cluster
-// have CrowdSec configured (unanimous). Returns nil when no proxy has reported capabilities.
-func (m Manager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
-	return m.store.GetClusterSupportsCrowdSec(ctx, clusterAddr)
-}
-
 // CleanupStale removes proxies that haven't sent heartbeat in the specified duration
 func (m Manager) CleanupStale(ctx context.Context, inactivityDuration time.Duration) error {
 	if err := m.store.CleanupStaleProxies(ctx, inactivityDuration); err != nil {

management/internals/modules/reverseproxy/proxy/manager_mock.go

@@ -78,20 +78,6 @@ func (mr *MockManagerMockRecorder) ClusterRequireSubdomain(ctx, clusterAddr inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterRequireSubdomain", reflect.TypeOf((*MockManager)(nil).ClusterRequireSubdomain), ctx, clusterAddr)
 }
 
-// ClusterSupportsCrowdSec mocks base method.
-func (m *MockManager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ClusterSupportsCrowdSec", ctx, clusterAddr)
-	ret0, _ := ret[0].(*bool)
-	return ret0
-}
-
-// ClusterSupportsCrowdSec indicates an expected call of ClusterSupportsCrowdSec.
-func (mr *MockManagerMockRecorder) ClusterSupportsCrowdSec(ctx, clusterAddr interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCrowdSec", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCrowdSec), ctx, clusterAddr)
-}
-
 // Connect mocks base method.
 func (m *MockManager) Connect(ctx context.Context, proxyID, clusterAddress, ipAddress string, capabilities *Capabilities) error {
 	m.ctrl.T.Helper()

management/internals/modules/reverseproxy/proxy/proxy.go

@@ -11,8 +11,6 @@ type Capabilities struct {
 	// RequireSubdomain indicates whether a subdomain label is required in
 	// front of the cluster domain.
 	RequireSubdomain *bool
-	// SupportsCrowdsec indicates whether this proxy has CrowdSec configured.
-	SupportsCrowdsec *bool
 }
 
 // Proxy represents a reverse proxy instance

management/internals/modules/reverseproxy/service/manager/l4_port_test.go

@@ -81,7 +81,6 @@ func setupL4Test(t *testing.T, customPortsSupported *bool) (*Manager, store.Stor
 	mockCaps := proxy.NewMockManager(ctrl)
 	mockCaps.EXPECT().ClusterSupportsCustomPorts(gomock.Any(), testCluster).Return(customPortsSupported).AnyTimes()
 	mockCaps.EXPECT().ClusterRequireSubdomain(gomock.Any(), testCluster).Return((*bool)(nil)).AnyTimes()
-	mockCaps.EXPECT().ClusterSupportsCrowdSec(gomock.Any(), testCluster).Return((*bool)(nil)).AnyTimes()
 
 	accountMgr := &mock_server.MockAccountManager{
 		StoreEventFunc:         func(_ context.Context, _, _, _ string, _ activity.ActivityDescriber, _ map[string]any) {},

management/internals/modules/reverseproxy/service/manager/manager_test.go

@@ -7,7 +7,6 @@ import (
 	"testing"
 	"time"
 
-	cachestore "github.com/eko/gocache/lib/v4/store"
 	"github.com/golang/mock/gomock"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -19,7 +18,6 @@ import (
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
-	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/mock_server"
 	resourcetypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
@@ -31,13 +29,6 @@ import (
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
-func testCacheStore(t *testing.T) cachestore.StoreInterface {
-	t.Helper()
-	s, err := nbcache.NewStore(context.Background(), 30*time.Minute, 10*time.Minute, 100)
-	require.NoError(t, err)
-	return s
-}
-
 func TestInitializeServiceForCreate(t *testing.T) {
 	ctx := context.Background()
 	accountID := "test-account"
@@ -431,8 +422,10 @@ func TestDeletePeerService_SourcePeerValidation(t *testing.T) {
 
 	newProxyServer := func(t *testing.T) *nbgrpc.ProxyServiceServer {
 		t.Helper()
-		tokenStore := nbgrpc.NewOneTimeTokenStore(context.Background(), testCacheStore(t))
-		pkceStore := nbgrpc.NewPKCEVerifierStore(context.Background(), testCacheStore(t))
+		tokenStore, err := nbgrpc.NewOneTimeTokenStore(context.Background(), 1*time.Hour, 10*time.Minute, 100)
+		require.NoError(t, err)
+		pkceStore, err := nbgrpc.NewPKCEVerifierStore(context.Background(), 10*time.Minute, 10*time.Minute, 100)
+		require.NoError(t, err)
 		srv := nbgrpc.NewProxyServiceServer(nil, tokenStore, pkceStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil)
 		return srv
 	}
@@ -710,8 +703,10 @@ func setupIntegrationTest(t *testing.T) (*Manager, store.Store) {
 		},
 	}
 
-	tokenStore := nbgrpc.NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := nbgrpc.NewPKCEVerifierStore(ctx, testCacheStore(t))
+	tokenStore, err := nbgrpc.NewOneTimeTokenStore(ctx, 1*time.Hour, 10*time.Minute, 100)
+	require.NoError(t, err)
+	pkceStore, err := nbgrpc.NewPKCEVerifierStore(ctx, 10*time.Minute, 10*time.Minute, 100)
+	require.NoError(t, err)
 	proxySrv := nbgrpc.NewProxyServiceServer(nil, tokenStore, pkceStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil)
 
 	proxyController, err := proxymanager.NewGRPCController(proxySrv, noop.NewMeterProvider().Meter(""))
@@ -1133,8 +1128,10 @@ func TestDeleteService_DeletesTargets(t *testing.T) {
 	mockPerms := permissions.NewMockManager(ctrl)
 	mockAcct := account.NewMockManager(ctrl)
 
-	tokenStore := nbgrpc.NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := nbgrpc.NewPKCEVerifierStore(ctx, testCacheStore(t))
+	tokenStore, err := nbgrpc.NewOneTimeTokenStore(ctx, 1*time.Hour, 10*time.Minute, 100)
+	require.NoError(t, err)
+	pkceStore, err := nbgrpc.NewPKCEVerifierStore(ctx, 10*time.Minute, 10*time.Minute, 100)
+	require.NoError(t, err)
 	proxySrv := nbgrpc.NewProxyServiceServer(nil, tokenStore, pkceStore, nbgrpc.ProxyOIDCConfig{}, nil, nil, nil)
 
 	proxyController, err := proxymanager.NewGRPCController(proxySrv, noop.NewMeterProvider().Meter(""))

management/internals/modules/reverseproxy/service/service.go

@@ -113,7 +113,6 @@ type AccessRestrictions struct {
 	BlockedCIDRs     []string `json:"blocked_cidrs,omitempty" gorm:"serializer:json"`
 	AllowedCountries []string `json:"allowed_countries,omitempty" gorm:"serializer:json"`
 	BlockedCountries []string `json:"blocked_countries,omitempty" gorm:"serializer:json"`
-	CrowdSecMode     string   `json:"crowdsec_mode,omitempty" gorm:"serializer:json"`
 }
 
 // Copy returns a deep copy of the AccessRestrictions.
@@ -123,7 +122,6 @@ func (r AccessRestrictions) Copy() AccessRestrictions {
 		BlockedCIDRs:     slices.Clone(r.BlockedCIDRs),
 		AllowedCountries: slices.Clone(r.AllowedCountries),
 		BlockedCountries: slices.Clone(r.BlockedCountries),
-		CrowdSecMode:     r.CrowdSecMode,
 	}
 }
 
@@ -557,11 +555,7 @@ func (s *Service) FromAPIRequest(req *api.ServiceRequest, accountID string) erro
 	}
 
 	if req.AccessRestrictions != nil {
-		restrictions, err := restrictionsFromAPI(req.AccessRestrictions)
-		if err != nil {
-			return err
-		}
-		s.Restrictions = restrictions
+		s.Restrictions = restrictionsFromAPI(req.AccessRestrictions)
 	}
 
 	return nil
@@ -637,9 +631,9 @@ func authFromAPI(reqAuth *api.ServiceAuthConfig) AuthConfig {
 	return auth
 }
 
-func restrictionsFromAPI(r *api.AccessRestrictions) (AccessRestrictions, error) {
+func restrictionsFromAPI(r *api.AccessRestrictions) AccessRestrictions {
 	if r == nil {
-		return AccessRestrictions{}, nil
+		return AccessRestrictions{}
 	}
 	var res AccessRestrictions
 	if r.AllowedCidrs != nil {
@@ -654,19 +648,11 @@ func restrictionsFromAPI(r *api.AccessRestrictions) (AccessRestrictions, error)
 	if r.BlockedCountries != nil {
 		res.BlockedCountries = *r.BlockedCountries
 	}
-	if r.CrowdsecMode != nil {
-		if !r.CrowdsecMode.Valid() {
-			return AccessRestrictions{}, fmt.Errorf("invalid crowdsec_mode %q", *r.CrowdsecMode)
-		}
-		res.CrowdSecMode = string(*r.CrowdsecMode)
-	}
-	return res, nil
+	return res
 }
 
 func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
-	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
-		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" {
+	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 && len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 {
 		return nil
 	}
 	res := &api.AccessRestrictions{}
@@ -682,17 +668,11 @@ func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
 	if len(r.BlockedCountries) > 0 {
 		res.BlockedCountries = &r.BlockedCountries
 	}
-	if r.CrowdSecMode != "" {
-		mode := api.AccessRestrictionsCrowdsecMode(r.CrowdSecMode)
-		res.CrowdsecMode = &mode
-	}
 	return res
 }
 
 func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
-	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
-		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" {
+	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 && len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 {
 		return nil
 	}
 	return &proto.AccessRestrictions{
@@ -700,7 +680,6 @@ func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
 		BlockedCidrs:     r.BlockedCIDRs,
 		AllowedCountries: r.AllowedCountries,
 		BlockedCountries: r.BlockedCountries,
-		CrowdsecMode:     r.CrowdSecMode,
 	}
 }
 
@@ -1009,20 +988,7 @@ const (
 
 // validateAccessRestrictions validates and normalizes access restriction
 // entries. Country codes are uppercased in place.
-func validateCrowdSecMode(mode string) error {
-	switch mode {
-	case "", "off", "enforce", "observe":
-		return nil
-	default:
-		return fmt.Errorf("crowdsec_mode %q is invalid", mode)
-	}
-}
-
 func validateAccessRestrictions(r *AccessRestrictions) error {
-	if err := validateCrowdSecMode(r.CrowdSecMode); err != nil {
-		return err
-	}
-
 	if len(r.AllowedCIDRs) > maxCIDREntries {
 		return fmt.Errorf("allowed_cidrs: exceeds maximum of %d entries", maxCIDREntries)
 	}
@@ -1036,37 +1002,35 @@ func validateAccessRestrictions(r *AccessRestrictions) error {
 		return fmt.Errorf("blocked_countries: exceeds maximum of %d entries", maxCountryEntries)
 	}
 
-	if err := validateCIDRList("allowed_cidrs", r.AllowedCIDRs); err != nil {
-		return err
-	}
-	if err := validateCIDRList("blocked_cidrs", r.BlockedCIDRs); err != nil {
-		return err
-	}
-	if err := normalizeCountryList("allowed_countries", r.AllowedCountries); err != nil {
-		return err
-	}
-	return normalizeCountryList("blocked_countries", r.BlockedCountries)
-}
-
-func validateCIDRList(field string, cidrs []string) error {
-	for i, raw := range cidrs {
+	for i, raw := range r.AllowedCIDRs {
 		prefix, err := netip.ParsePrefix(raw)
 		if err != nil {
-			return fmt.Errorf("%s[%d]: %w", field, i, err)
+			return fmt.Errorf("allowed_cidrs[%d]: %w", i, err)
 		}
 		if prefix != prefix.Masked() {
-			return fmt.Errorf("%s[%d]: %q has host bits set, use %s instead", field, i, raw, prefix.Masked())
+			return fmt.Errorf("allowed_cidrs[%d]: %q has host bits set, use %s instead", i, raw, prefix.Masked())
 		}
 	}
-	return nil
-}
-
-func normalizeCountryList(field string, codes []string) error {
-	for i, code := range codes {
-		if len(code) != 2 {
-			return fmt.Errorf("%s[%d]: %q must be a 2-letter ISO 3166-1 alpha-2 code", field, i, code)
+	for i, raw := range r.BlockedCIDRs {
+		prefix, err := netip.ParsePrefix(raw)
+		if err != nil {
+			return fmt.Errorf("blocked_cidrs[%d]: %w", i, err)
 		}
-		codes[i] = strings.ToUpper(code)
+		if prefix != prefix.Masked() {
+			return fmt.Errorf("blocked_cidrs[%d]: %q has host bits set, use %s instead", i, raw, prefix.Masked())
+		}
+	}
+	for i, code := range r.AllowedCountries {
+		if len(code) != 2 {
+			return fmt.Errorf("allowed_countries[%d]: %q must be a 2-letter ISO 3166-1 alpha-2 code", i, code)
+		}
+		r.AllowedCountries[i] = strings.ToUpper(code)
+	}
+	for i, code := range r.BlockedCountries {
+		if len(code) != 2 {
+			return fmt.Errorf("blocked_countries[%d]: %q must be a 2-letter ISO 3166-1 alpha-2 code", i, code)
+		}
+		r.BlockedCountries[i] = strings.ToUpper(code)
 	}
 	return nil
 }

management/internals/server/boot.go

@@ -18,7 +18,6 @@ import (
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/keepalive"
 
-	cachestore "github.com/eko/gocache/lib/v4/store"
 	"github.com/netbirdio/management-integrations/integrations"
 
 	"github.com/netbirdio/netbird/encryption"
@@ -27,7 +26,6 @@ import (
 	accesslogsmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs/manager"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
-	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbContext "github.com/netbirdio/netbird/management/server/context"
 	nbhttp "github.com/netbirdio/netbird/management/server/http"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -60,18 +58,6 @@ func (s *BaseServer) Metrics() telemetry.AppMetrics {
 	})
 }
 
-// CacheStore returns a shared cache store backed by Redis or in-memory depending on the environment.
-// All consumers should reuse this store to avoid creating multiple Redis connections.
-func (s *BaseServer) CacheStore() cachestore.StoreInterface {
-	return Create(s, func() cachestore.StoreInterface {
-		cs, err := nbcache.NewStore(context.Background(), nbcache.DefaultStoreMaxTimeout, nbcache.DefaultStoreCleanupInterval, nbcache.DefaultStoreMaxConn)
-		if err != nil {
-			log.Fatalf("failed to create shared cache store: %v", err)
-		}
-		return cs
-	})
-}
-
 func (s *BaseServer) Store() store.Store {
 	return Create(s, func() store.Store {
 		store, err := store.NewStore(context.Background(), s.Config.StoreConfig.Engine, s.Config.Datadir, s.Metrics(), false)
@@ -209,7 +195,10 @@ func (s *BaseServer) proxyOIDCConfig() nbgrpc.ProxyOIDCConfig {
 
 func (s *BaseServer) ProxyTokenStore() *nbgrpc.OneTimeTokenStore {
 	return Create(s, func() *nbgrpc.OneTimeTokenStore {
-		tokenStore := nbgrpc.NewOneTimeTokenStore(context.Background(), s.CacheStore())
+		tokenStore, err := nbgrpc.NewOneTimeTokenStore(context.Background(), 5*time.Minute, 10*time.Minute, 100)
+		if err != nil {
+			log.Fatalf("failed to create proxy token store: %v", err)
+		}
 		log.Info("One-time token store initialized for proxy authentication")
 		return tokenStore
 	})
@@ -217,7 +206,11 @@ func (s *BaseServer) ProxyTokenStore() *nbgrpc.OneTimeTokenStore {
 
 func (s *BaseServer) PKCEVerifierStore() *nbgrpc.PKCEVerifierStore {
 	return Create(s, func() *nbgrpc.PKCEVerifierStore {
-		return nbgrpc.NewPKCEVerifierStore(context.Background(), s.CacheStore())
+		pkceStore, err := nbgrpc.NewPKCEVerifierStore(context.Background(), 10*time.Minute, 10*time.Minute, 100)
+		if err != nil {
+			log.Fatalf("failed to create PKCE verifier store: %v", err)
+		}
+		return pkceStore
 	})
 }
 

management/internals/server/controllers.go

@@ -41,8 +41,7 @@ func (s *BaseServer) IntegratedValidator() integrated_validator.IntegratedValida
 			context.Background(),
 			s.PeersManager(),
 			s.SettingsManager(),
-			s.EventStore(),
-			s.CacheStore())
+			s.EventStore())
 		if err != nil {
 			log.Errorf("failed to create integrated peer validator: %v", err)
 		}

management/internals/server/modules.go

@@ -100,7 +100,7 @@ func (s *BaseServer) PeersManager() peers.Manager {
 
 func (s *BaseServer) AccountManager() account.Manager {
 	return Create(s, func() account.Manager {
-		accountManager, err := server.BuildManager(context.Background(), s.Config, s.Store(), s.NetworkMapController(), s.JobManager(), s.IdpManager(), s.mgmtSingleAccModeDomain, s.EventStore(), s.GeoLocationManager(), s.userDeleteFromIDPEnabled, s.IntegratedValidator(), s.Metrics(), s.ProxyController(), s.SettingsManager(), s.PermissionsManager(), s.Config.DisableDefaultPolicy, s.CacheStore())
+		accountManager, err := server.BuildManager(context.Background(), s.Config, s.Store(), s.NetworkMapController(), s.JobManager(), s.IdpManager(), s.mgmtSingleAccModeDomain, s.EventStore(), s.GeoLocationManager(), s.userDeleteFromIDPEnabled, s.IntegratedValidator(), s.Metrics(), s.ProxyController(), s.SettingsManager(), s.PermissionsManager(), s.Config.DisableDefaultPolicy)
 		if err != nil {
 			log.Fatalf("failed to create account service: %v", err)
 		}

management/internals/shared/grpc/onetime_token.go

@@ -14,6 +14,8 @@ import (
 	"github.com/eko/gocache/lib/v4/cache"
 	"github.com/eko/gocache/lib/v4/store"
 	log "github.com/sirupsen/logrus"
+
+	nbcache "github.com/netbirdio/netbird/management/server/cache"
 )
 
 type tokenMetadata struct {
@@ -30,12 +32,17 @@ type OneTimeTokenStore struct {
 	ctx   context.Context
 }
 
-// NewOneTimeTokenStore creates a token store using the provided shared cache store.
-func NewOneTimeTokenStore(ctx context.Context, cacheStore store.StoreInterface) *OneTimeTokenStore {
+// NewOneTimeTokenStore creates a token store with automatic backend selection
+func NewOneTimeTokenStore(ctx context.Context, maxTimeout, cleanupInterval time.Duration, maxConn int) (*OneTimeTokenStore, error) {
+	cacheStore, err := nbcache.NewStore(ctx, maxTimeout, cleanupInterval, maxConn)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create cache store: %w", err)
+	}
+
 	return &OneTimeTokenStore{
 		cache: cache.New[string](cacheStore),
 		ctx:   ctx,
-	}
+	}, nil
 }
 
 // GenerateToken creates a new cryptographically secure one-time token

management/internals/shared/grpc/pkce_verifier.go

@@ -8,6 +8,8 @@ import (
 	"github.com/eko/gocache/lib/v4/cache"
 	"github.com/eko/gocache/lib/v4/store"
 	log "github.com/sirupsen/logrus"
+
+	nbcache "github.com/netbirdio/netbird/management/server/cache"
 )
 
 // PKCEVerifierStore manages PKCE verifiers for OAuth flows.
@@ -17,12 +19,17 @@ type PKCEVerifierStore struct {
 	ctx   context.Context
 }
 
-// NewPKCEVerifierStore creates a PKCE verifier store using the provided shared cache store.
-func NewPKCEVerifierStore(ctx context.Context, cacheStore store.StoreInterface) *PKCEVerifierStore {
+// NewPKCEVerifierStore creates a PKCE verifier store with automatic backend selection
+func NewPKCEVerifierStore(ctx context.Context, maxTimeout, cleanupInterval time.Duration, maxConn int) (*PKCEVerifierStore, error) {
+	cacheStore, err := nbcache.NewStore(ctx, maxTimeout, cleanupInterval, maxConn)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create cache store: %w", err)
+	}
+
 	return &PKCEVerifierStore{
 		cache: cache.New[string](cacheStore),
 		ctx:   ctx,
-	}
+	}, nil
 }
 
 // Store saves a PKCE verifier associated with an OAuth state parameter.

management/internals/shared/grpc/proxy.go

@@ -188,7 +188,6 @@ func (s *ProxyServiceServer) GetMappingUpdate(req *proto.GetMappingUpdateRequest
 		caps = &proxy.Capabilities{
 			SupportsCustomPorts: c.SupportsCustomPorts,
 			RequireSubdomain:    c.RequireSubdomain,
-			SupportsCrowdsec: c.SupportsCrowdsec,
 		}
 	}
 	if err := s.proxyManager.Connect(ctx, proxyID, proxyAddress, peerInfo, caps); err != nil {

management/internals/shared/grpc/proxy_test.go

@@ -9,22 +9,13 @@ import (
 	"testing"
 	"time"
 
-	cachestore "github.com/eko/gocache/lib/v4/store"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
-	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
-func testCacheStore(t *testing.T) cachestore.StoreInterface {
-	t.Helper()
-	s, err := nbcache.NewStore(context.Background(), 30*time.Minute, 10*time.Minute, 100)
-	require.NoError(t, err)
-	return s
-}
-
 type testProxyController struct {
 	mu             sync.Mutex
 	clusterProxies map[string]map[string]struct{}
@@ -123,8 +114,11 @@ func drainEmpty(ch chan *proto.GetMappingUpdateResponse) bool {
 
 func TestSendServiceUpdateToCluster_UniqueTokensPerProxy(t *testing.T) {
 	ctx := context.Background()
-	tokenStore := NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	tokenStore, err := NewOneTimeTokenStore(ctx, time.Hour, 10*time.Minute, 100)
+	require.NoError(t, err)
+
+	pkceStore, err := NewPKCEVerifierStore(ctx, 10*time.Minute, 10*time.Minute, 100)
+	require.NoError(t, err)
 
 	s := &ProxyServiceServer{
 		tokenStore:        tokenStore,
@@ -180,8 +174,11 @@ func TestSendServiceUpdateToCluster_UniqueTokensPerProxy(t *testing.T) {
 
 func TestSendServiceUpdateToCluster_DeleteNoToken(t *testing.T) {
 	ctx := context.Background()
-	tokenStore := NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	tokenStore, err := NewOneTimeTokenStore(ctx, time.Hour, 10*time.Minute, 100)
+	require.NoError(t, err)
+
+	pkceStore, err := NewPKCEVerifierStore(ctx, 10*time.Minute, 10*time.Minute, 100)
+	require.NoError(t, err)
 
 	s := &ProxyServiceServer{
 		tokenStore:        tokenStore,
@@ -214,8 +211,11 @@ func TestSendServiceUpdateToCluster_DeleteNoToken(t *testing.T) {
 
 func TestSendServiceUpdate_UniqueTokensPerProxy(t *testing.T) {
 	ctx := context.Background()
-	tokenStore := NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	tokenStore, err := NewOneTimeTokenStore(ctx, time.Hour, 10*time.Minute, 100)
+	require.NoError(t, err)
+
+	pkceStore, err := NewPKCEVerifierStore(ctx, 10*time.Minute, 10*time.Minute, 100)
+	require.NoError(t, err)
 
 	s := &ProxyServiceServer{
 		tokenStore:        tokenStore,
@@ -267,7 +267,8 @@ func generateState(s *ProxyServiceServer, redirectURL string) string {
 
 func TestOAuthState_NeverTheSame(t *testing.T) {
 	ctx := context.Background()
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	pkceStore, err := NewPKCEVerifierStore(ctx, 10*time.Minute, 10*time.Minute, 100)
+	require.NoError(t, err)
 
 	s := &ProxyServiceServer{
 		oidcConfig: ProxyOIDCConfig{
@@ -295,7 +296,8 @@ func TestOAuthState_NeverTheSame(t *testing.T) {
 
 func TestValidateState_RejectsOldTwoPartFormat(t *testing.T) {
 	ctx := context.Background()
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	pkceStore, err := NewPKCEVerifierStore(ctx, 10*time.Minute, 10*time.Minute, 100)
+	require.NoError(t, err)
 
 	s := &ProxyServiceServer{
 		oidcConfig: ProxyOIDCConfig{
@@ -305,7 +307,7 @@ func TestValidateState_RejectsOldTwoPartFormat(t *testing.T) {
 	}
 
 	// Old format had only 2 parts: base64(url)|hmac
-	err := s.pkceVerifierStore.Store("base64url|hmac", "test", 10*time.Minute)
+	err = s.pkceVerifierStore.Store("base64url|hmac", "test", 10*time.Minute)
 	require.NoError(t, err)
 
 	_, _, err = s.ValidateState("base64url|hmac")
@@ -315,7 +317,8 @@ func TestValidateState_RejectsOldTwoPartFormat(t *testing.T) {
 
 func TestValidateState_RejectsInvalidHMAC(t *testing.T) {
 	ctx := context.Background()
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	pkceStore, err := NewPKCEVerifierStore(ctx, 10*time.Minute, 10*time.Minute, 100)
+	require.NoError(t, err)
 
 	s := &ProxyServiceServer{
 		oidcConfig: ProxyOIDCConfig{
@@ -325,7 +328,7 @@ func TestValidateState_RejectsInvalidHMAC(t *testing.T) {
 	}
 
 	// Store with tampered HMAC
-	err := s.pkceVerifierStore.Store("dGVzdA==|nonce|wrong-hmac", "test", 10*time.Minute)
+	err = s.pkceVerifierStore.Store("dGVzdA==|nonce|wrong-hmac", "test", 10*time.Minute)
 	require.NoError(t, err)
 
 	_, _, err = s.ValidateState("dGVzdA==|nonce|wrong-hmac")
@@ -334,7 +337,8 @@ func TestValidateState_RejectsInvalidHMAC(t *testing.T) {
 }
 
 func TestSendServiceUpdateToCluster_FiltersOnCapability(t *testing.T) {
-	tokenStore := NewOneTimeTokenStore(context.Background(), testCacheStore(t))
+	tokenStore, err := NewOneTimeTokenStore(context.Background(), time.Hour, 10*time.Minute, 100)
+	require.NoError(t, err)
 
 	s := &ProxyServiceServer{
 		tokenStore: tokenStore,
@@ -406,7 +410,8 @@ func TestSendServiceUpdateToCluster_FiltersOnCapability(t *testing.T) {
 }
 
 func TestSendServiceUpdateToCluster_TLSNotFiltered(t *testing.T) {
-	tokenStore := NewOneTimeTokenStore(context.Background(), testCacheStore(t))
+	tokenStore, err := NewOneTimeTokenStore(context.Background(), time.Hour, 10*time.Minute, 100)
+	require.NoError(t, err)
 
 	s := &ProxyServiceServer{
 		tokenStore: tokenStore,
@@ -437,7 +442,8 @@ func TestSendServiceUpdateToCluster_TLSNotFiltered(t *testing.T) {
 // scenario for an existing service, verifying the correct update types
 // reach the correct clusters.
 func TestServiceModifyNotifications(t *testing.T) {
-	tokenStore := NewOneTimeTokenStore(context.Background(), testCacheStore(t))
+	tokenStore, err := NewOneTimeTokenStore(context.Background(), time.Hour, 10*time.Minute, 100)
+	require.NoError(t, err)
 
 	newServer := func() (*ProxyServiceServer, map[string]chan *proto.GetMappingUpdateResponse) {
 		s := &ProxyServiceServer{

management/internals/shared/grpc/validate_session_test.go

@@ -39,8 +39,11 @@ func setupValidateSessionTest(t *testing.T) *validateSessionTestSetup {
 	usersManager := &testValidateSessionUsersManager{store: testStore}
 	proxyManager := &testValidateSessionProxyManager{}
 
-	tokenStore := NewOneTimeTokenStore(ctx, testCacheStore(t))
-	pkceStore := NewPKCEVerifierStore(ctx, testCacheStore(t))
+	tokenStore, err := NewOneTimeTokenStore(ctx, time.Minute, 10*time.Minute, 100)
+	require.NoError(t, err)
+
+	pkceStore, err := NewPKCEVerifierStore(ctx, 10*time.Minute, 10*time.Minute, 100)
+	require.NoError(t, err)
 
 	proxyService := NewProxyServiceServer(nil, tokenStore, pkceStore, ProxyOIDCConfig{}, nil, usersManager, proxyManager)
 	proxyService.SetServiceManager(serviceManager)
@@ -324,7 +327,7 @@ func (m *testValidateSessionServiceManager) GetActiveClusters(_ context.Context,
 
 type testValidateSessionProxyManager struct{}
 
-func (m *testValidateSessionProxyManager) Connect(_ context.Context, _, _, _ string, _ *proxy.Capabilities) error {
+func (m *testValidateSessionProxyManager) Connect(_ context.Context, _, _, _ string) error {
 	return nil
 }
 
@@ -332,7 +335,7 @@ func (m *testValidateSessionProxyManager) Disconnect(_ context.Context, _ string
 	return nil
 }
 
-func (m *testValidateSessionProxyManager) Heartbeat(_ context.Context, _, _, _ string) error {
+func (m *testValidateSessionProxyManager) Heartbeat(_ context.Context, _ string) error {
 	return nil
 }
 
@@ -348,18 +351,6 @@ func (m *testValidateSessionProxyManager) CleanupStale(_ context.Context, _ time
 	return nil
 }
 
-func (m *testValidateSessionProxyManager) ClusterSupportsCustomPorts(_ context.Context, _ string) *bool {
-	return nil
-}
-
-func (m *testValidateSessionProxyManager) ClusterRequireSubdomain(_ context.Context, _ string) *bool {
-	return nil
-}
-
-func (m *testValidateSessionProxyManager) ClusterSupportsCrowdSec(_ context.Context, _ string) *bool {
-	return nil
-}
-
 type testValidateSessionUsersManager struct {
 	store store.Store
 }

management/server/account.go

@@ -181,7 +181,7 @@ func (am *DefaultAccountManager) getJWTGroupsChanges(user *types.User, groups []
 	return modified, newUserAutoGroups, newGroupsToCreate, nil
 }
 
-// BuildManager creates a new DefaultAccountManager with all dependencies.
+// BuildManager creates a new DefaultAccountManager with a provided Store
 func BuildManager(
 	ctx context.Context,
 	config *nbconfig.Config,
@@ -199,7 +199,6 @@ func BuildManager(
 	settingsManager settings.Manager,
 	permissionsManager permissions.Manager,
 	disableDefaultPolicy bool,
-	sharedCacheStore cacheStore.StoreInterface,
 ) (*DefaultAccountManager, error) {
 	start := time.Now()
 	defer func() {
@@ -248,12 +247,16 @@ func BuildManager(
 		log.WithContext(ctx).Infof("single account mode disabled, accounts number %d", accountsCounter)
 	}
 
-	am.externalCacheManager = nbcache.NewUserDataCache(sharedCacheStore)
-	am.cacheManager = nbcache.NewAccountUserDataCache(am.loadAccount, sharedCacheStore)
+	cacheStore, err := nbcache.NewStore(ctx, nbcache.DefaultIDPCacheExpirationMax, nbcache.DefaultIDPCacheCleanupInterval, nbcache.DefaultIDPCacheOpenConn)
+	if err != nil {
+		return nil, fmt.Errorf("getting cache store: %s", err)
+	}
+	am.externalCacheManager = nbcache.NewUserDataCache(cacheStore)
+	am.cacheManager = nbcache.NewAccountUserDataCache(am.loadAccount, cacheStore)
 
 	if !isNil(am.idpManager) && !IsEmbeddedIdp(am.idpManager) {
 		go func() {
-			err := am.warmupIDPCache(ctx, sharedCacheStore)
+			err := am.warmupIDPCache(ctx, cacheStore)
 			if err != nil {
 				log.WithContext(ctx).Warnf("failed warming up cache due to error: %v", err)
 				// todo retry?

management/server/account_request_buffer.go

@@ -63,11 +63,20 @@ func (ac *AccountRequestBuffer) GetAccountWithBackpressure(ctx context.Context,
 
 	log.WithContext(ctx).Tracef("requesting account %s with backpressure", accountID)
 	startTime := time.Now()
-	ac.getAccountRequestCh <- req
 
-	result := <-req.ResultChan
-	log.WithContext(ctx).Tracef("got account with backpressure after %s", time.Since(startTime))
-	return result.Account, result.Err
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case ac.getAccountRequestCh <- req:
+	}
+
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case result := <-req.ResultChan:
+		log.WithContext(ctx).Tracef("got account with backpressure after %s", time.Since(startTime))
+		return result.Account, result.Err
+	}
 }
 
 func (ac *AccountRequestBuffer) processGetAccountBatch(ctx context.Context, accountID string) {

management/server/account_test.go

@@ -3134,15 +3134,10 @@ func createManager(t testing.TB) (*DefaultAccountManager, *update_channel.PeersU
 
 	ctx := context.Background()
 
-	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
-	if err != nil {
-		return nil, nil, err
-	}
-
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
 	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.cloud", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{})
-	manager, err := BuildManager(ctx, &config.Config{}, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	manager, err := BuildManager(ctx, &config.Config{}, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false)
 	if err != nil {
 		return nil, nil, err
 	}

management/server/cache/store.go

@@ -17,24 +17,12 @@ import (
 
 // RedisStoreEnvVar is the environment variable that determines if a redis store should be used.
 // The value should follow redis URL format. https://github.com/redis/redis-specifications/blob/master/uri/redis.txt
-const RedisStoreEnvVar = "NB_CACHE_REDIS_ADDRESS"
-
-// legacyIdPCacheRedisEnvVar is the previous environment variable used for IDP cache.
-const legacyIdPCacheRedisEnvVar = "NB_IDP_CACHE_REDIS_ADDRESS"
-
-const (
-	// DefaultStoreMaxTimeout is the default max timeout for the shared cache store.
-	DefaultStoreMaxTimeout = 7 * 24 * time.Hour
-	// DefaultStoreCleanupInterval is the default cleanup interval for the shared cache store.
-	DefaultStoreCleanupInterval = 30 * time.Minute
-	// DefaultStoreMaxConn is the default max connections for the shared cache store.
-	DefaultStoreMaxConn = 1000
-)
+const RedisStoreEnvVar = "NB_IDP_CACHE_REDIS_ADDRESS"
 
 // NewStore creates a new cache store with the given max timeout and cleanup interval. It checks for the environment Variable RedisStoreEnvVar
 // to determine if a redis store should be used. If the environment variable is set, it will attempt to connect to the redis store.
 func NewStore(ctx context.Context, maxTimeout, cleanupInterval time.Duration, maxConn int) (store.StoreInterface, error) {
-	redisAddr := GetAddrFromEnv()
+	redisAddr := os.Getenv(RedisStoreEnvVar)
 	if redisAddr != "" {
 		return getRedisStore(ctx, redisAddr, maxConn)
 	}
@@ -42,15 +30,6 @@ func NewStore(ctx context.Context, maxTimeout, cleanupInterval time.Duration, ma
 	return gocache_store.NewGoCache(goc), nil
 }
 
-// GetAddrFromEnv returns the redis address from the environment variable RedisStoreEnvVar or its legacy counterpart.
-func GetAddrFromEnv() string {
-	addr := os.Getenv(RedisStoreEnvVar)
-	if addr == "" {
-		addr = os.Getenv(legacyIdPCacheRedisEnvVar)
-	}
-	return addr
-}
-
 func getRedisStore(ctx context.Context, redisEnvAddr string, maxConn int) (store.StoreInterface, error) {
 	options, err := redis.ParseURL(redisEnvAddr)
 	if err != nil {

management/server/dns_test.go

@@ -15,7 +15,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	ephemeral_manager "github.com/netbirdio/netbird/management/internals/modules/peers/ephemeral/manager"
 	"github.com/netbirdio/netbird/management/internals/server/config"
-	"github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/integrations/port_forwarding"
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
@@ -226,17 +225,11 @@ func createDNSManager(t *testing.T) (*DefaultAccountManager, error) {
 	peersManager := peers.NewManager(store, permissionsManager)
 
 	ctx := context.Background()
-
-	cacheStore, err := cache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
-	if err != nil {
-		return nil, err
-	}
-
 	updateManager := update_channel.NewPeersUpdateManager(metrics)
 	requestBuffer := NewAccountRequestBuffer(ctx, store)
 	networkMapController := controller.NewController(ctx, store, metrics, updateManager, requestBuffer, MockIntegratedValidator{}, settingsMockManager, "netbird.test", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peers.NewManager(store, permissionsManager)), &config.Config{})
 
-	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false, cacheStore)
+	return BuildManager(context.Background(), nil, store, networkMapController, job.NewJobManager(nil, store, peersManager), nil, "", eventStore, nil, false, MockIntegratedValidator{}, metrics, port_forwarding.NewControllerMock(), settingsMockManager, permissionsManager, false)
 }
 
 func createDNSStore(t *testing.T) (store.Store, error) {

management/server/http/handlers/networks/routers_handler.go

@@ -105,12 +105,6 @@ func (h *routersHandler) createRouter(w http.ResponseWriter, r *http.Request) {
 	router.NetworkID = networkID
 	router.AccountID = accountID
 	router.Enabled = true
-
-	if err := router.Validate(); err != nil {
-		util.WriteErrorResponse(err.Error(), http.StatusBadRequest, w)
-		return
-	}
-
 	router, err = h.routersManager.CreateRouter(r.Context(), userID, router)
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
@@ -163,11 +157,6 @@ func (h *routersHandler) updateRouter(w http.ResponseWriter, r *http.Request) {
 	router.ID = mux.Vars(r)["routerId"]
 	router.AccountID = accountID
 
-	if err := router.Validate(); err != nil {
-		util.WriteErrorResponse(err.Error(), http.StatusBadRequest, w)
-		return
-	}
-
 	router, err = h.routersManager.UpdateRouter(r.Context(), userID, router)
 	if err != nil {
 		util.WriteError(r.Context(), err, w)

management/server/http/handlers/proxy/auth_callback_integration_test.go

@@ -22,7 +22,6 @@ import (
 	nbproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
-	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/management/server/users"
@@ -192,11 +191,11 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 
 	oidcServer := newFakeOIDCServer()
 
-	cacheStore, err := nbcache.NewStore(ctx, 30*time.Minute, 10*time.Minute, 100)
+	tokenStore, err := nbgrpc.NewOneTimeTokenStore(ctx, time.Minute, 10*time.Minute, 100)
 	require.NoError(t, err)
 
-	tokenStore := nbgrpc.NewOneTimeTokenStore(ctx, cacheStore)
-	pkceStore := nbgrpc.NewPKCEVerifierStore(ctx, cacheStore)
+	pkceStore, err := nbgrpc.NewPKCEVerifierStore(ctx, 10*time.Minute, 10*time.Minute, 100)
+	require.NoError(t, err)
 
 	usersManager := users.NewManager(testStore)
 

management/server/http/testing/integration/networks_handler_integration_test.go

@@ -1170,17 +1170,13 @@ func Test_NetworkRouters_Create(t *testing.T) {
 				Metric:     100,
 				Enabled:    true,
 			},
-			expectedStatus: http.StatusBadRequest,
-		},
-		{
-			name:      "Create router without peer and peer_groups",
-			networkId: "testNetworkId",
-			requestBody: &api.NetworkRouterRequest{
-				Masquerade: true,
-				Metric:     100,
-				Enabled:    true,
+			expectedStatus: http.StatusOK,
+			verifyResponse: func(t *testing.T, router *api.NetworkRouter) {
+				t.Helper()
+				assert.NotEmpty(t, router.Id)
+				assert.Equal(t, peerID, *router.Peer)
+				assert.Equal(t, 1, len(*router.PeerGroups))
 			},
-			expectedStatus: http.StatusBadRequest,
 		},
 		{
 			name:      "Create router in non-existing network",
@@ -1345,18 +1341,13 @@ func Test_NetworkRouters_Update(t *testing.T) {
 				Metric:     100,
 				Enabled:    true,
 			},
-			expectedStatus: http.StatusBadRequest,
-		},
-		{
-			name:      "Update router without peer and peer_groups",
-			networkId: "testNetworkId",
-			routerId:  "testRouterId",
-			requestBody: &api.NetworkRouterRequest{
-				Masquerade: true,
-				Metric:     100,
-				Enabled:    true,
+			expectedStatus: http.StatusOK,
+			verifyResponse: func(t *testing.T, router *api.NetworkRouter) {
+				t.Helper()
+				assert.Equal(t, "testRouterId", router.Id)
+				assert.Equal(t, peerID, *router.Peer)
+				assert.Equal(t, 1, len(*router.PeerGroups))
 			},
-			expectedStatus: http.StatusBadRequest,
 		},
 	}
 

management/server/http/testing/testing_tools/channel/channel.go

@@ -35,7 +35,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
 	serverauth "github.com/netbirdio/netbird/management/server/auth"
-	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	"github.com/netbirdio/netbird/management/server/geolocation"
 	"github.com/netbirdio/netbird/management/server/groups"
 	http2 "github.com/netbirdio/netbird/management/server/http"
@@ -88,22 +87,22 @@ func BuildApiBlackBoxWithDBState(t testing_tools.TB, sqlFile string, expectedPee
 	jobManager := job.NewJobManager(nil, store, peersManager)
 
 	ctx := context.Background()
-
-	cacheStore, err := nbcache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
-	if err != nil {
-		t.Fatalf("Failed to create cache store: %v", err)
-	}
-
 	requestBuffer := server.NewAccountRequestBuffer(ctx, store)
 	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{})
-	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, proxyController, settingsManager, permissionsManager, false, cacheStore)
+	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, proxyController, settingsManager, permissionsManager, false)
 	if err != nil {
 		t.Fatalf("Failed to create manager: %v", err)
 	}
 
 	accessLogsManager := accesslogsmanager.NewManager(store, permissionsManager, nil)
-	proxyTokenStore := nbgrpc.NewOneTimeTokenStore(ctx, cacheStore)
-	pkceverifierStore := nbgrpc.NewPKCEVerifierStore(ctx, cacheStore)
+	proxyTokenStore, err := nbgrpc.NewOneTimeTokenStore(ctx, 5*time.Minute, 10*time.Minute, 100)
+	if err != nil {
+		t.Fatalf("Failed to create proxy token store: %v", err)
+	}
+	pkceverifierStore, err := nbgrpc.NewPKCEVerifierStore(ctx, 10*time.Minute, 10*time.Minute, 100)
+	if err != nil {
+		t.Fatalf("Failed to create PKCE verifier store: %v", err)
+	}
 	noopMeter := noop.NewMeterProvider().Meter("")
 	proxyMgr, err := proxymanager.NewManager(store, noopMeter)
 	if err != nil {
@@ -217,22 +216,22 @@ func BuildApiBlackBoxWithDBStateAndPeerChannel(t testing_tools.TB, sqlFile strin
 	jobManager := job.NewJobManager(nil, store, peersManager)
 
 	ctx := context.Background()
-
-	cacheStore, err := nbcache.NewStore(ctx, 100*time.Millisecond, 300*time.Millisecond, 100)
-	if err != nil {
-		t.Fatalf("Failed to create cache store: %v", err)
-	}
-
 	requestBuffer := server.NewAccountRequestBuffer(ctx, store)
 	networkMapController := controller.NewController(ctx, store, metrics, peersUpdateManager, requestBuffer, server.MockIntegratedValidator{}, settingsManager, "", port_forwarding.NewControllerMock(), ephemeral_manager.NewEphemeralManager(store, peersManager), &config.Config{})
-	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, proxyController, settingsManager, permissionsManager, false, cacheStore)
+	am, err := server.BuildManager(ctx, nil, store, networkMapController, jobManager, nil, "", &activity.InMemoryEventStore{}, geoMock, false, validatorMock, metrics, proxyController, settingsManager, permissionsManager, false)
 	if err != nil {
 		t.Fatalf("Failed to create manager: %v", err)
 	}
 
 	accessLogsManager := accesslogsmanager.NewManager(store, permissionsManager, nil)
-	proxyTokenStore := nbgrpc.NewOneTimeTokenStore(ctx, cacheStore)
-	pkceverifierStore := nbgrpc.NewPKCEVerifierStore(ctx, cacheStore)
+	proxyTokenStore, err := nbgrpc.NewOneTimeTokenStore(ctx, 5*time.Minute, 10*time.Minute, 100)
+	if err != nil {
+		t.Fatalf("Failed to create proxy token store: %v", err)
+	}
+	pkceverifierStore, err := nbgrpc.NewPKCEVerifierStore(ctx, 10*time.Minute, 10*time.Minute, 100)
+	if err != nil {
+		t.Fatalf("Failed to create PKCE verifier store: %v", err)
+	}
 	noopMeter := noop.NewMeterProvider().Meter("")
 	proxyMgr, err := proxymanager.NewManager(store, noopMeter)
 	if err != nil {