UDPv4 is sufficient! we always have 100.x overlay. IPv6 is additive

ipAllowed[0] is the v4

.goreleaser_ui.yaml

@@ -96,7 +96,6 @@ nfpms:
       - netbird (>= 0.75.0)
       - libgtk-4-1 (>= 4.14)
       - libwebkitgtk-6.0-4
-      - xdg-utils
 
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
@@ -120,7 +119,6 @@ nfpms:
       - netbird >= 0.75.0
       - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
       - (webkitgtk6.0 or libwebkitgtk-6_0-4)
-      - xdg-utils
 
     rpm:
       signature:

.goreleaser_ui_gtk3.yaml

@@ -71,7 +71,6 @@ nfpms:
       - netbird (>= 0.75.0)
       - libgtk-3-0
       - libwebkit2gtk-4.1-0
-      - xdg-utils
 
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
@@ -96,7 +95,6 @@ nfpms:
       - netbird >= 0.75.0
       - (gtk3 or libgtk-3-0)
       - (webkit2gtk4.1 or libwebkit2gtk-4_1-0)
-      - xdg-utils
 
     rpm:
       signature:
@@ -114,13 +112,6 @@ uploads:
   # The gtk3 packages reuse the netbird-ui package name, so they live in
   # dedicated repo paths (deb distribution `gtk3`, yum path `yum-gtk3`) that
   # legacy distros point their repo config at.
-  #
-  # GoReleaser derives the credential env var from the upload name, so these
-  # would look for UPLOAD_DEBIAN-GTK3_SECRET / UPLOAD_YUM-GTK3_SECRET. The
-  # release workflow only exports UPLOAD_DEBIAN_SECRET / UPLOAD_YUM_SECRET, and
-  # a missing secret is a silent skip rather than a failure -- the packages
-  # reached the GitHub release but never the package repositories. Point
-  # `password` at the exported vars so both uploads authenticate.
   - name: debian-gtk3
     skip: "{{ .Env.SKIP_PUBLISH }}"
     ids:
@@ -128,7 +119,6 @@ uploads:
     mode: archive
     target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=gtk3;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
     username: dev@wiretrustee.com
-    password: "{{ .Env.UPLOAD_DEBIAN_SECRET }}"
     method: PUT
 
   - name: yum-gtk3
@@ -138,5 +128,4 @@ uploads:
     mode: archive
     target: https://pkgs.wiretrustee.com/yum-gtk3/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
     username: dev@wiretrustee.com
-    password: "{{ .Env.UPLOAD_YUM_SECRET }}"
     method: PUT

client/android/client.go

@@ -15,7 +15,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	nbAnonymize "github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/debug"
@@ -33,13 +32,6 @@ import (
 	types "github.com/netbirdio/netbird/upload-server/types"
 )
 
-// AnonymizeLevelDefault and AnonymizeLevelStrict are the accepted
-// anonymizeLevel values for DebugBundle.
-const (
-	AnonymizeLevelDefault = nbAnonymize.LevelDefaultString
-	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
-)
-
 // ConnectionListener export internal Listener for mobile
 type ConnectionListener interface {
 	peer.Listener
@@ -286,10 +278,8 @@ func (c *Client) GetTunSettings() (*TunSettings, error) {
 }
 
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.
-// It works both with and without a running engine. anonymizeLevel is "default"
-// or "strict"; strict also anonymizes internal IP ranges, peer names, and
-// WireGuard public keys, and implies anonymize.
-func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool, anonymizeLevel string) (string, error) {
+// It works both with and without a running engine.
+func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (string, error) {
 	cfg, cacheDir, cc := c.stateSnapshot()
 
 	// If the engine hasn't been started, load config from disk
@@ -308,7 +298,6 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool, anonym
 		InternalConfig: cfg,
 		StatusRecorder: c.recorder,
 		TempDir:        cacheDir,
-		StatePath:      platformFiles.StateFilePath(),
 	}
 
 	if cc != nil {
@@ -332,7 +321,6 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool, anonym
 		deps,
 		debug.BundleConfig{
 			Anonymize:         anonymize,
-			AnonymizeLevel:    nbAnonymize.ParseLevel(anonymizeLevel),
 			IncludeSystemInfo: true,
 		},
 	)

client/anonymize/anonymize.go

@@ -2,7 +2,6 @@ package anonymize
 
 import (
 	"crypto/rand"
-	"encoding/base64"
 	"fmt"
 	"math/big"
 	"net"
@@ -16,88 +15,13 @@ import (
 
 const anonTLD = ".domain"
 
-// Level selects how much the anonymizer redacts. Levels are ordered: a higher
-// level redacts strictly more. On the wire (protos, flags) levels travel as
-// their string form.
-type Level int
-
-const (
-	// LevelDefault anonymizes public IP addresses, IPv6 ULA, domains, and MAC
-	// addresses. Internal IPv4 ranges (RFC 1918, CGNAT, link-local) are
-	// preserved so support can reason about the real topology.
-	LevelDefault Level = iota
-	// LevelStrict additionally anonymizes internal IP ranges, peer names, and
-	// WireGuard public keys.
-	LevelStrict
-)
-
-// LevelDefaultString and LevelStrictString are the wire forms of the levels,
-// for boundaries that pass levels as strings (flags, protos, mobile bindings).
-const (
-	LevelDefaultString = "default"
-	LevelStrictString  = "strict"
-)
-
-// ParseLevel maps s to a Level. Empty means LevelDefault; anything
-// unrecognized maps to LevelStrict so an unknown request never yields less
-// anonymization than intended.
-func ParseLevel(s string) Level {
-	switch strings.ToLower(s) {
-	case "", LevelDefaultString:
-		return LevelDefault
-	default:
-		return LevelStrict
-	}
-}
-
-// String returns the wire form of the level: "default" or "strict".
-func (l Level) String() string {
-	if l >= LevelStrict {
-		return LevelStrictString
-	}
-	return LevelDefaultString
-}
-
-// protectedDomains are NetBird-operated suffixes that stay recognizable in an
-// anonymized bundle. At LevelStrict the labels in front of them (the peer
-// name) are still replaced, except under netbird.io, which only hosts
-// NetBird infrastructure (api, signal, flow), never peer names.
-var protectedDomains = []string{"netbird.io", "netbird.selfhosted", "netbird.cloud", "netbird.stage"}
-
-const infraDomain = "netbird.io"
-
-var (
-	macColonRegex = regexp.MustCompile(`\b[0-9a-fA-F]{2}(?::[0-9a-fA-F]{2}){5}\b`)
-	macDashRegex  = regexp.MustCompile(`\b[0-9a-fA-F]{2}(?:-[0-9a-fA-F]{2}){5}\b`)
-	wgKeyRegex    = regexp.MustCompile(`\b[A-Za-z0-9+/]{43}=`)
-)
-
 type Anonymizer struct {
 	ipAnonymizer     map[netip.Addr]netip.Addr
 	domainAnonymizer map[string]string
-	// domainOrder caches the keys of domainAnonymizer sorted longest-first
-	// for AnonymizeString; it is rebuilt when the map gains entries.
-	domainOrder     []string
-	labelAnonymizer map[string]string
-	labelAnonymized map[string]struct{}
-	labelCounter    uint32
-	macAnonymizer   map[string]string
-	macCounter      uint32
-	wgKeyAnonymizer map[string]string
-	wgKeyAnonymized map[string]struct{}
-	currentAnonIPv4 netip.Addr
-	currentAnonIPv6 netip.Addr
-	startAnonIPv4   netip.Addr
-	startAnonIPv6   netip.Addr
-
-	// LevelStrict also anonymizes internal ranges (RFC 1918, CGNAT,
-	// link-local), replacing them from the dedicated internal pools below so
-	// a reader can still tell an internal address from a public one.
-	level                   Level
-	currentAnonInternalIPv4 netip.Addr
-	currentAnonInternalIPv6 netip.Addr
-	startAnonInternalIPv4   netip.Addr
-	startAnonInternalIPv6   netip.Addr
+	currentAnonIPv4  netip.Addr
+	currentAnonIPv6  netip.Addr
+	startAnonIPv4    netip.Addr
+	startAnonIPv6    netip.Addr
 
 	domainKeyRegex *regexp.Regexp
 }
@@ -108,50 +32,25 @@ func DefaultAddresses() (netip.Addr, netip.Addr) {
 	return netip.AddrFrom4([4]byte{198, 51, 100, 0}), netip.MustParseAddr("2001:db8:ffff::")
 }
 
-// InternalAddresses returns the pool starts used in strict mode for internal
-// ranges. Both are reserved ranges that cannot collide with real addressing:
-// 198.18.0.0 (RFC 2544 benchmarking), 2001:db8:1:: (RFC 3849 documentation).
-func InternalAddresses() (netip.Addr, netip.Addr) {
-	return netip.AddrFrom4([4]byte{198, 18, 0, 0}), netip.MustParseAddr("2001:db8:1::")
-}
-
 func NewAnonymizer(startIPv4, startIPv6 netip.Addr) *Anonymizer {
-	internalIPv4, internalIPv6 := InternalAddresses()
 	return &Anonymizer{
 		ipAnonymizer:     map[netip.Addr]netip.Addr{},
 		domainAnonymizer: map[string]string{},
-		labelAnonymizer:  map[string]string{},
-		labelAnonymized:  map[string]struct{}{},
-		macAnonymizer:    map[string]string{},
-		wgKeyAnonymizer:  map[string]string{},
-		wgKeyAnonymized:  map[string]struct{}{},
 		currentAnonIPv4:  startIPv4,
 		currentAnonIPv6:  startIPv6,
 		startAnonIPv4:    startIPv4,
 		startAnonIPv6:    startIPv6,
 
-		level:                   LevelDefault,
-		currentAnonInternalIPv4: internalIPv4,
-		currentAnonInternalIPv6: internalIPv6,
-		startAnonInternalIPv4:   internalIPv4,
-		startAnonInternalIPv6:   internalIPv6,
-
 		domainKeyRegex: regexp.MustCompile(`\bdomain=([^\s,:"]+)`),
 	}
 }
 
-// SetLevel selects the anonymization level. The zero value of a new
-// Anonymizer is LevelDefault.
-func (a *Anonymizer) SetLevel(level Level) {
-	a.level = level
-}
-
 func (a *Anonymizer) AnonymizeIP(ip netip.Addr) netip.Addr {
-	// Normalize 4-in-6 addresses so ::ffff:192.168.1.1 classifies and maps
-	// like 192.168.1.1.
-	ip = ip.Unmap()
-
 	if ip.IsLoopback() ||
+		ip.IsLinkLocalUnicast() ||
+		ip.IsLinkLocalMulticast() ||
+		ip.IsInterfaceLocalMulticast() ||
+		(ip.Is4() && ip.IsPrivate()) ||
 		ip.IsUnspecified() ||
 		ip.IsMulticast() ||
 		isWellKnown(ip) ||
@@ -160,100 +59,18 @@ func (a *Anonymizer) AnonymizeIP(ip netip.Addr) netip.Addr {
 		return ip
 	}
 
-	if isInternal(ip) && a.level < LevelStrict {
-		return ip
-	}
-
 	if _, ok := a.ipAnonymizer[ip]; !ok {
-		a.ipAnonymizer[ip] = a.nextAnonIP(ip)
+		if ip.Is4() {
+			a.ipAnonymizer[ip] = a.currentAnonIPv4
+			a.currentAnonIPv4 = a.currentAnonIPv4.Next()
+		} else {
+			a.ipAnonymizer[ip] = a.currentAnonIPv6
+			a.currentAnonIPv6 = a.currentAnonIPv6.Next()
+		}
 	}
 	return a.ipAnonymizer[ip]
 }
 
-func (a *Anonymizer) nextAnonIP(ip netip.Addr) netip.Addr {
-	// At the strict level, internal addresses (including IPv6 ULA, matched
-	// by IsPrivate) come from the internal pools so they remain recognizable
-	// as internal without disclosing the real values.
-	if a.level >= LevelStrict && (isInternal(ip) || ip.IsPrivate()) {
-		if ip.Is4() {
-			anon := a.currentAnonInternalIPv4
-			a.currentAnonInternalIPv4 = a.currentAnonInternalIPv4.Next()
-			return anon
-		}
-		anon := a.currentAnonInternalIPv6
-		a.currentAnonInternalIPv6 = a.currentAnonInternalIPv6.Next()
-		return anon
-	}
-
-	if ip.Is4() {
-		anon := a.currentAnonIPv4
-		a.currentAnonIPv4 = a.currentAnonIPv4.Next()
-		return anon
-	}
-	anon := a.currentAnonIPv6
-	a.currentAnonIPv6 = a.currentAnonIPv6.Next()
-	return anon
-}
-
-// AnonymizeMAC replaces a MAC address with a consistent placeholder from the
-// locally administered range starting at 02:00:00:00:00:01, at every
-// anonymization level. Broadcast, multicast, all-zero, and already assigned
-// placeholder addresses are preserved. The colon and dash spellings of the
-// same address share one placeholder; the output keeps the input's separator.
-func (a *Anonymizer) AnonymizeMAC(mac string) string {
-	hw, err := net.ParseMAC(mac)
-	if err != nil || len(hw) != 6 {
-		return mac
-	}
-
-	if isWellKnownMAC(hw) || a.isAnonymizedMAC(hw) {
-		return mac
-	}
-
-	key := hw.String()
-	anon, ok := a.macAnonymizer[key]
-	if !ok {
-		a.macCounter++
-		anon = fmt.Sprintf("02:00:00:%02x:%02x:%02x", byte(a.macCounter>>16), byte(a.macCounter>>8), byte(a.macCounter))
-		a.macAnonymizer[key] = anon
-	}
-
-	if strings.Contains(mac, "-") {
-		anon = strings.ReplaceAll(anon, ":", "-")
-	}
-	return anon
-}
-
-// isAnonymizedMAC reports whether hw is a placeholder this anonymizer already
-// handed out, so a second pass over anonymized output leaves it unchanged.
-func (a *Anonymizer) isAnonymizedMAC(hw net.HardwareAddr) bool {
-	if hw[0] != 0x02 || hw[1] != 0 || hw[2] != 0 {
-		return false
-	}
-	value := uint32(hw[3])<<16 | uint32(hw[4])<<8 | uint32(hw[5])
-	return value <= a.macCounter
-}
-
-// AnonymizeWGKey replaces a WireGuard public key with a consistent random
-// placeholder of the same shape. Keys are only anonymized at LevelStrict;
-// placeholders already handed out pass through unchanged.
-func (a *Anonymizer) AnonymizeWGKey(key string) string {
-	if a.level < LevelStrict || !looksLikeWGKey(key) {
-		return key
-	}
-	if _, ok := a.wgKeyAnonymized[key]; ok {
-		return key
-	}
-
-	anon, ok := a.wgKeyAnonymizer[key]
-	if !ok {
-		anon = generateAnonymousKey()
-		a.wgKeyAnonymizer[key] = anon
-		a.wgKeyAnonymized[anon] = struct{}{}
-	}
-	return anon
-}
-
 func (a *Anonymizer) AnonymizeUDPAddr(addr net.UDPAddr) net.UDPAddr {
 	// Convert IP to netip.Addr
 	ip, ok := netip.AddrFromSlice(addr.IP)
@@ -272,12 +89,12 @@ func (a *Anonymizer) AnonymizeUDPAddr(addr net.UDPAddr) net.UDPAddr {
 
 // isInAnonymizedRange checks if an IP is within the range of already assigned anonymized IPs
 func (a *Anonymizer) isInAnonymizedRange(ip netip.Addr) bool {
-	if ip.Is4() {
-		return inPoolRange(ip, a.startAnonIPv4, a.currentAnonIPv4) ||
-			inPoolRange(ip, a.startAnonInternalIPv4, a.currentAnonInternalIPv4)
+	if ip.Is4() && ip.Compare(a.startAnonIPv4) >= 0 && ip.Compare(a.currentAnonIPv4) <= 0 {
+		return true
+	} else if !ip.Is4() && ip.Compare(a.startAnonIPv6) >= 0 && ip.Compare(a.currentAnonIPv6) <= 0 {
+		return true
 	}
-	return inPoolRange(ip, a.startAnonIPv6, a.currentAnonIPv6) ||
-		inPoolRange(ip, a.startAnonInternalIPv6, a.currentAnonInternalIPv6)
+	return false
 }
 
 func (a *Anonymizer) AnonymizeIPString(ip string) string {
@@ -301,17 +118,14 @@ func (a *Anonymizer) AnonymizeDomain(domain string) string {
 		baseDomain = domain[:len(domain)-1]
 	}
 
-	if strings.HasSuffix(baseDomain, anonTLD) {
+	if strings.HasSuffix(baseDomain, "netbird.io") ||
+		strings.HasSuffix(baseDomain, "netbird.selfhosted") ||
+		strings.HasSuffix(baseDomain, "netbird.cloud") ||
+		strings.HasSuffix(baseDomain, "netbird.stage") ||
+		strings.HasSuffix(baseDomain, anonTLD) {
 		return domain
 	}
 
-	if suffix := protectedSuffix(baseDomain); suffix != "" {
-		if a.level < LevelStrict || baseDomain == suffix || suffix == infraDomain {
-			return domain
-		}
-		return withTrailingDot(a.anonymizePeerName(baseDomain, suffix), hasDot)
-	}
-
 	parts := strings.Split(baseDomain, ".")
 	if len(parts) < 2 {
 		return domain
@@ -327,53 +141,12 @@ func (a *Anonymizer) AnonymizeDomain(domain string) string {
 	}
 
 	result := strings.Replace(baseDomain, baseForLookup, anonymized, 1)
-	if a.level >= LevelStrict && len(parts) > 2 {
-		prefix := strings.TrimSuffix(baseDomain, "."+baseForLookup)
-		result = a.anonymizeLabels(prefix, "host") + "." + anonymized
-		// The full mapping feeds AnonymizeString so seeded FQDNs are caught
-		// in log lines as a whole, labels included.
-		a.domainAnonymizer[baseDomain] = result
-	}
-	return withTrailingDot(result, hasDot)
-}
-
-// anonymizePeerName replaces the labels in front of a protected suffix with
-// numbered peer placeholders, keeping the suffix, and records the full
-// mapping for string replacement in logs. The numbering keeps a peer
-// recognizable across the whole bundle without disclosing its name.
-func (a *Anonymizer) anonymizePeerName(baseDomain, suffix string) string {
-	prefix := strings.TrimSuffix(baseDomain, "."+suffix)
-	result := a.anonymizeLabels(prefix, "peer") + "." + suffix
-	if result != baseDomain {
-		a.domainAnonymizer[baseDomain] = result
+	if hasDot {
+		result += "."
 	}
 	return result
 }
 
-// anonymizeLabels replaces each dot-separated label with a consistent
-// numbered placeholder ("<placeholder>-<n>"). Wildcard labels and
-// placeholders already handed out pass through unchanged.
-func (a *Anonymizer) anonymizeLabels(prefix, placeholder string) string {
-	labels := strings.Split(prefix, ".")
-	for i, label := range labels {
-		if label == "*" {
-			continue
-		}
-		if _, ok := a.labelAnonymized[label]; ok {
-			continue
-		}
-		anon, ok := a.labelAnonymizer[label]
-		if !ok {
-			a.labelCounter++
-			anon = fmt.Sprintf("%s-%d", placeholder, a.labelCounter)
-			a.labelAnonymizer[label] = anon
-			a.labelAnonymized[anon] = struct{}{}
-		}
-		labels[i] = anon
-	}
-	return strings.Join(labels, ".")
-}
-
 func (a *Anonymizer) AnonymizeURI(uri string) string {
 	u, err := url.Parse(uri)
 	if err != nil {
@@ -408,70 +181,16 @@ func (a *Anonymizer) AnonymizeString(str string) string {
 	str = ipv4Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 	str = ipv6Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 
-	for _, domain := range a.sortedDomains() {
-		str = strings.ReplaceAll(str, domain, a.domainAnonymizer[domain])
+	for domain, anonDomain := range a.domainAnonymizer {
+		str = strings.ReplaceAll(str, domain, anonDomain)
 	}
 
 	str = a.AnonymizeSchemeURI(str)
 	str = a.AnonymizeDNSLogLine(str)
 
-	// MAC handling runs after the IP passes so preserved IPv6 addresses are
-	// already out of the way; the separator guard skips matches embedded in a
-	// longer colon- or dash-separated sequence (such as an IPv6 tail).
-	str = a.anonymizeMACsInString(str, macColonRegex, ':')
-	str = a.anonymizeMACsInString(str, macDashRegex, '-')
-
-	if a.level >= LevelStrict {
-		str = wgKeyRegex.ReplaceAllStringFunc(str, a.AnonymizeWGKey)
-	}
-
 	return str
 }
 
-// sortedDomains returns the domain mappings longest-first, so a full-FQDN
-// mapping (strict level) is applied before the base-domain mapping it
-// contains. The order is rebuilt only when domainAnonymizer has grown.
-func (a *Anonymizer) sortedDomains() []string {
-	if len(a.domainOrder) == len(a.domainAnonymizer) {
-		return a.domainOrder
-	}
-
-	a.domainOrder = a.domainOrder[:0]
-	for domain := range a.domainAnonymizer {
-		a.domainOrder = append(a.domainOrder, domain)
-	}
-	slices.SortFunc(a.domainOrder, func(x, y string) int {
-		if d := len(y) - len(x); d != 0 {
-			return d
-		}
-		return strings.Compare(x, y)
-	})
-	return a.domainOrder
-}
-
-// anonymizeMACsInString replaces MAC addresses matched by re, skipping
-// matches that directly adjoin another sep so a six-group run inside a longer
-// separated sequence is left alone.
-func (a *Anonymizer) anonymizeMACsInString(str string, re *regexp.Regexp, sep byte) string {
-	matches := re.FindAllStringIndex(str, -1)
-	if len(matches) == 0 {
-		return str
-	}
-
-	var b strings.Builder
-	last := 0
-	for _, m := range matches {
-		if (m[0] > 0 && str[m[0]-1] == sep) || (m[1] < len(str) && str[m[1]] == sep) {
-			continue
-		}
-		b.WriteString(str[last:m[0]])
-		b.WriteString(a.AnonymizeMAC(str[m[0]:m[1]]))
-		last = m[1]
-	}
-	b.WriteString(str[last:])
-	return b.String()
-}
-
 // AnonymizeSchemeURI finds and anonymizes URIs with ws, wss, rel, rels, stun, stuns, turn, and turns schemes.
 func (a *Anonymizer) AnonymizeSchemeURI(text string) string {
 	re := regexp.MustCompile(`(?i)\b(wss?://|rels?://|stuns?:|turns?:|https?://)\S+\b`)
@@ -520,79 +239,10 @@ func isWellKnown(addr netip.Addr) bool {
 		"128.0.0.0", "8000::", // 2nd split subnet for default routes
 	}
 
-	return slices.Contains(wellKnown, addr.String())
-}
-
-// isInternal reports whether ip identifies a host only within the local
-// network: IPv4 private (RFC 1918), CGNAT (RFC 6598), and link-local (v4 and
-// v6). These are preserved at the default level so support can reason about
-// the real topology, and replaced from the internal pools at the strict
-// level. IPv6 ULA is deliberately not internal: its random global ID uniquely
-// fingerprints the network, so it is anonymized at every level.
-func isInternal(ip netip.Addr) bool {
-	return (ip.Is4() && ip.IsPrivate()) ||
-		ip.IsLinkLocalUnicast() ||
-		isCGNAT(ip)
-}
-
-func inPoolRange(ip, start, current netip.Addr) bool {
-	return ip.Compare(start) >= 0 && ip.Compare(current) <= 0
-}
-
-// isWellKnownMAC reports whether hw carries no stable host identity: all-zero
-// or a group address (broadcast and multicast).
-func isWellKnownMAC(hw net.HardwareAddr) bool {
-	if hw[0]&1 == 1 {
+	if slices.Contains(wellKnown, addr.String()) {
 		return true
 	}
-	for _, b := range hw {
-		if b != 0 {
-			return false
-		}
-	}
-	return true
-}
 
-// looksLikeWGKey reports whether s has the shape of a WireGuard key:
-// 44 base64 characters decoding to 32 bytes.
-func looksLikeWGKey(s string) bool {
-	if len(s) != 44 || s[43] != '=' {
-		return false
-	}
-	decoded, err := base64.StdEncoding.DecodeString(s)
-	return err == nil && len(decoded) == 32
-}
-
-func generateAnonymousKey() string {
-	buf := make([]byte, 32)
-	if _, err := rand.Read(buf); err != nil {
-		return strings.Repeat("A", 43) + "="
-	}
-	return base64.StdEncoding.EncodeToString(buf)
-}
-
-// protectedSuffix returns the protected NetBird suffix baseDomain ends with,
-// or empty. The match is label-anchored so an unrelated domain that merely
-// ends in the same characters is not preserved.
-func protectedSuffix(baseDomain string) string {
-	for _, d := range protectedDomains {
-		if baseDomain == d || strings.HasSuffix(baseDomain, "."+d) {
-			return d
-		}
-	}
-	return ""
-}
-
-func withTrailingDot(domain string, hasDot bool) string {
-	if hasDot {
-		return domain + "."
-	}
-	return domain
-}
-
-// isCGNAT reports whether addr is in 100.64.0.0/10 (RFC 6598), the range
-// NetBird assigns overlay peer addresses from.
-func isCGNAT(addr netip.Addr) bool {
 	cgnatRangeStart := netip.AddrFrom4([4]byte{100, 64, 0, 0})
 	cgnatRange := netip.PrefixFrom(cgnatRangeStart, 10)
 

client/anonymize/anonymize_test.go

@@ -1,11 +1,8 @@
 package anonymize_test
 
 import (
-	"bytes"
-	"encoding/base64"
 	"net/netip"
 	"regexp"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -47,301 +44,6 @@ func TestAnonymizeIP(t *testing.T) {
 	}
 }
 
-func TestParseLevel(t *testing.T) {
-	tests := []struct {
-		input  string
-		expect anonymize.Level
-	}{
-		{"", anonymize.LevelDefault},
-		{"default", anonymize.LevelDefault},
-		{"DEFAULT", anonymize.LevelDefault},
-		{"strict", anonymize.LevelStrict},
-		{"STRICT", anonymize.LevelStrict},
-		// Unknown values must never yield less anonymization than requested.
-		{"garbage", anonymize.LevelStrict},
-	}
-
-	for _, tc := range tests {
-		t.Run("input="+tc.input, func(t *testing.T) {
-			assert.Equal(t, tc.expect, anonymize.ParseLevel(tc.input), "parsed level should match")
-		})
-	}
-}
-
-func TestAnonymizeIP_DefaultLevelInternalRanges(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	tests := []struct {
-		name   string
-		ip     string
-		expect string
-	}{
-		{"RFC1918 10/8", "10.1.2.3", "10.1.2.3"},
-		{"RFC1918 172.16/12", "172.16.5.5", "172.16.5.5"},
-		{"RFC1918 192.168/16", "192.168.1.1", "192.168.1.1"},
-		{"CGNAT", "100.64.0.5", "100.64.0.5"},
-		{"IPv4 link-local", "169.254.1.1", "169.254.1.1"},
-		{"IPv6 link-local", "fe80::1", "fe80::1"},
-		// ULA is anonymized even at the default level: its random global ID
-		// uniquely fingerprints the network, unlike shared RFC 1918 space.
-		{"IPv6 ULA", "fd12:3456:789a::1", "2001:db8:ffff::"},
-		// 4-in-6 addresses classify like their unmapped IPv4 form.
-		{"4-in-6 RFC1918", "::ffff:192.168.1.1", "192.168.1.1"},
-		{"4-in-6 CGNAT", "::ffff:100.64.0.5", "100.64.0.5"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			result := anonymizer.AnonymizeIP(netip.MustParseAddr(tc.ip))
-			assert.Equal(t, tc.expect, result.String(), "default level should preserve internal ranges except ULA")
-		})
-	}
-}
-
-func TestAnonymizeIP_StrictLevel(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(anonymize.LevelStrict)
-
-	// Order matters: internal pool addresses are assigned sequentially.
-	tests := []struct {
-		name   string
-		ip     string
-		expect string
-	}{
-		{"RFC1918 192.168/16", "192.168.1.1", "198.18.0.0"},
-		{"Second RFC1918", "192.168.1.2", "198.18.0.1"},
-		{"Repeated RFC1918", "192.168.1.1", "198.18.0.0"},
-		{"RFC1918 10/8", "10.1.2.3", "198.18.0.2"},
-		{"RFC1918 172.16/12", "172.16.5.5", "198.18.0.3"},
-		{"CGNAT", "100.64.0.5", "198.18.0.4"},
-		{"IPv4 link-local", "169.254.1.1", "198.18.0.5"},
-		{"Public IPv4 uses public pool", "1.2.3.4", "198.51.100.0"},
-		{"IPv6 link-local", "fe80::1", "2001:db8:1::"},
-		{"IPv6 ULA", "fd12:3456:789a::1", "2001:db8:1::1"},
-		{"Public IPv6 uses public pool", "2607:f8b0:4005:805::200e", "2001:db8:ffff::"},
-		{"Loopback IPv4", "127.0.0.1", "127.0.0.1"},
-		{"Loopback IPv6", "::1", "::1"},
-		{"Unspecified", "0.0.0.0", "0.0.0.0"},
-		{"Multicast", "224.0.0.251", "224.0.0.251"},
-		{"Well known resolver", "8.8.8.8", "8.8.8.8"},
-		{"Well known split marker", "128.0.0.0", "128.0.0.0"},
-		{"In internal pool range", "198.18.0.3", "198.18.0.3"},
-		{"In public pool range", "198.51.100.0", "198.51.100.0"},
-		{"4-in-6 repeated RFC1918", "::ffff:192.168.1.1", "198.18.0.0"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			result := anonymizer.AnonymizeIP(netip.MustParseAddr(tc.ip))
-			assert.Equal(t, tc.expect, result.String(), "strict level should replace internal ranges from the internal pools")
-		})
-	}
-}
-
-func TestAnonymizeString_StrictInternalIPs(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(anonymize.LevelStrict)
-
-	input := "route 10.20.30.0/24 via 192.168.1.1 dev eth0 src 100.64.0.7"
-	firstPass := anonymizer.AnonymizeString(input)
-	secondPass := anonymizer.AnonymizeString(firstPass)
-
-	assert.NotContains(t, firstPass, "10.20.30.0", "private network address should be anonymized")
-	assert.NotContains(t, firstPass, "192.168.1.1", "private gateway should be anonymized")
-	assert.NotContains(t, firstPass, "100.64.0.7", "CGNAT address should be anonymized")
-	assert.Contains(t, firstPass, "/24", "prefix length should be preserved")
-	assert.Equal(t, firstPass, secondPass, "second pass should not further anonymize the string")
-}
-
-func TestAnonymizeMAC(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	first := anonymizer.AnonymizeMAC("aa:bb:cc:dd:ee:0f")
-	assert.Equal(t, "02:00:00:00:00:01", first, "first MAC should get the first placeholder")
-	assert.Equal(t, first, anonymizer.AnonymizeMAC("aa:bb:cc:dd:ee:0f"), "repeated MAC should map to the same placeholder")
-	assert.Equal(t, first, anonymizer.AnonymizeMAC("AA:BB:CC:DD:EE:0F"), "case should not affect the mapping")
-	assert.Equal(t, "02-00-00-00-00-01", anonymizer.AnonymizeMAC("AA-BB-CC-DD-EE-0F"), "dash form should keep its separator but share the mapping")
-
-	second := anonymizer.AnonymizeMAC("10:22:33:44:55:66")
-	assert.Equal(t, "02:00:00:00:00:02", second, "second distinct MAC should get the next placeholder")
-
-	tests := []struct {
-		name string
-		mac  string
-	}{
-		{"Broadcast", "ff:ff:ff:ff:ff:ff"},
-		{"IPv4 multicast", "01:00:5e:00:00:fb"},
-		{"IPv6 multicast", "33:33:00:00:00:01"},
-		{"All zero", "00:00:00:00:00:00"},
-		{"Assigned placeholder", "02:00:00:00:00:01"},
-		{"Invalid", "not-a-mac"},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.mac, anonymizer.AnonymizeMAC(tc.mac), "should be preserved")
-		})
-	}
-}
-
-func TestAnonymizeString_MACAddresses(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	tests := []struct {
-		name   string
-		input  string
-		expect string
-	}{
-		{
-			name:   "nftables ether rule",
-			input:  "ether saddr aa:bb:cc:dd:ee:ff drop",
-			expect: "ether saddr 02:00:00:00:00:01 drop",
-		},
-		{
-			name:   "Windows dash form",
-			input:  "Physical Address : AA-BB-CC-DD-EE-FF",
-			expect: "Physical Address : 02-00-00-00-00-01",
-		},
-		{
-			name:   "IPv6 address tail is not treated as MAC",
-			input:  "addr fe80:0:11:22:33:44:55:66 scope link",
-			expect: "addr fe80:0:11:22:33:44:55:66 scope link",
-		},
-		{
-			name:   "broadcast MAC preserved",
-			input:  "dst ff:ff:ff:ff:ff:ff type ARP",
-			expect: "dst ff:ff:ff:ff:ff:ff type ARP",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			result := anonymizer.AnonymizeString(tc.input)
-			assert.Equal(t, tc.expect, result, "MAC addresses should be anonymized at every level")
-			assert.Equal(t, result, anonymizer.AnonymizeString(result), "second pass should not change the result")
-		})
-	}
-}
-
-func TestAnonymizeWGKey(t *testing.T) {
-	key := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{0x42}, 32))
-
-	t.Run("default level preserves keys", func(t *testing.T) {
-		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		assert.Equal(t, key, anonymizer.AnonymizeWGKey(key), "default level should not touch WireGuard keys")
-	})
-
-	t.Run("strict level replaces keys", func(t *testing.T) {
-		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		anonymizer.SetLevel(anonymize.LevelStrict)
-
-		anon := anonymizer.AnonymizeWGKey(key)
-		assert.NotEqual(t, key, anon, "strict level should replace the key")
-		assert.Regexp(t, `^[A-Za-z0-9+/]{43}=$`, anon, "placeholder should keep the WireGuard key shape")
-		assert.Equal(t, anon, anonymizer.AnonymizeWGKey(key), "repeated key should map to the same placeholder")
-		assert.Equal(t, anon, anonymizer.AnonymizeWGKey(anon), "an assigned placeholder should pass through unchanged")
-
-		assert.Equal(t, "not-a-key", anonymizer.AnonymizeWGKey("not-a-key"), "non-key values should be preserved")
-	})
-}
-
-func TestAnonymizeString_WGKeys(t *testing.T) {
-	key := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{0x42}, 32))
-	input := "peer " + key + " handshake completed"
-
-	t.Run("default level preserves keys", func(t *testing.T) {
-		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		assert.Equal(t, input, anonymizer.AnonymizeString(input), "default level should not touch WireGuard keys in strings")
-	})
-
-	t.Run("strict level replaces keys", func(t *testing.T) {
-		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		anonymizer.SetLevel(anonymize.LevelStrict)
-
-		firstPass := anonymizer.AnonymizeString(input)
-		assert.NotContains(t, firstPass, key, "the key should not survive strict anonymization")
-		assert.Equal(t, anonymizer.AnonymizeWGKey(key), extractKey(t, firstPass), "string replacement should be consistent with AnonymizeWGKey")
-		assert.Equal(t, firstPass, anonymizer.AnonymizeString(firstPass), "second pass should not change the result")
-	})
-}
-
-func extractKey(t *testing.T, logLine string) string {
-	t.Helper()
-	fields := strings.Fields(logLine)
-	require.Len(t, fields, 4, "log line should keep its structure")
-	return fields[1]
-}
-
-func TestAnonymizeDomain_StrictLevel(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(anonymize.LevelStrict)
-
-	t.Run("netbird peer name", func(t *testing.T) {
-		result := anonymizer.AnonymizeDomain("my-laptop.netbird.cloud")
-		assert.Regexp(t, `^peer-\d+\.netbird\.cloud$`, result, "peer name should be anonymized, suffix kept")
-		assert.NotContains(t, result, "my-laptop", "the peer name should not survive")
-		assert.Equal(t, result, anonymizer.AnonymizeDomain("my-laptop.netbird.cloud"), "repeated domain should map consistently")
-		assert.Equal(t, result, anonymizer.AnonymizeDomain(result), "an anonymized domain should pass through unchanged")
-	})
-
-	t.Run("bare netbird domain", func(t *testing.T) {
-		assert.Equal(t, "netbird.cloud", anonymizer.AnonymizeDomain("netbird.cloud"), "the bare protected suffix should be preserved")
-	})
-
-	t.Run("netbird infrastructure preserved", func(t *testing.T) {
-		assert.Equal(t, "api.netbird.io", anonymizer.AnonymizeDomain("api.netbird.io"),
-			"netbird.io hosts infrastructure, not peer names, and should stay readable")
-	})
-
-	t.Run("leading labels of other domains", func(t *testing.T) {
-		result := anonymizer.AnonymizeDomain("host1.corp.example.com")
-		assert.Regexp(t, `^host-\d+\.host-\d+\.anon-[a-zA-Z0-9]+\.domain$`, result, "every label should be anonymized")
-		for _, label := range []string{"host1", "corp", "example"} {
-			assert.NotContains(t, result, label, "no original label should survive")
-		}
-		assert.Equal(t, result, anonymizer.AnonymizeDomain("host1.corp.example.com"), "repeated domain should map consistently")
-	})
-
-	t.Run("same label maps consistently across domains", func(t *testing.T) {
-		first := anonymizer.AnonymizeDomain("shared.one.com")
-		second := anonymizer.AnonymizeDomain("shared.two.com")
-		assert.Equal(t, strings.Split(first, ".")[0], strings.Split(second, ".")[0], "the shared host label should get one placeholder")
-	})
-
-	t.Run("wildcard label preserved", func(t *testing.T) {
-		result := anonymizer.AnonymizeDomain("*.example.com")
-		assert.Regexp(t, `^\*\.anon-[a-zA-Z0-9]+\.domain$`, result, "the wildcard label should stay a wildcard")
-	})
-}
-
-func TestAnonymizeDomain_DefaultLevelKeepsPeerNames(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	assert.Equal(t, "my-laptop.netbird.cloud", anonymizer.AnonymizeDomain("my-laptop.netbird.cloud"),
-		"default level should preserve netbird FQDNs including the peer name")
-	assert.Regexp(t, `^sub\.anon-[a-zA-Z0-9]+\.domain$`, anonymizer.AnonymizeDomain("sub.example.com"),
-		"default level should keep subdomain labels")
-}
-
-func TestAnonymizeString_StrictPeerNames(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(anonymize.LevelStrict)
-
-	// Seed like the bundle generator does from the status: base first, then
-	// the full FQDN, so replacement must prefer the longer mapping.
-	anonBase := anonymizer.AnonymizeDomain("example.com")
-	anonPeer := anonymizer.AnonymizeDomain("peer1.netbird.cloud")
-	anonHost := anonymizer.AnonymizeDomain("host1.example.com")
-
-	logLine := "connected to peer1.netbird.cloud via host1.example.com endpoint"
-	firstPass := anonymizer.AnonymizeString(logLine)
-	assert.NotContains(t, firstPass, "peer1", "the peer name should not survive in logs")
-	assert.NotContains(t, firstPass, "host1", "the host label should not survive in logs")
-	assert.Contains(t, firstPass, anonPeer, "the seeded peer mapping should be applied")
-	assert.Contains(t, firstPass, anonHost, "the seeded host mapping should be applied, not just the base mapping")
-	assert.NotContains(t, firstPass, "host1."+anonBase, "the base mapping must not preempt the longer FQDN mapping")
-	assert.Equal(t, firstPass, anonymizer.AnonymizeString(firstPass), "second pass should not change the result")
-}
-
 func TestAnonymizeDNSLogLine(t *testing.T) {
 	anonymizer := anonymize.NewAnonymizer(netip.Addr{}, netip.Addr{})
 	tests := []struct {

client/cmd/debug.go

@@ -27,8 +27,8 @@ import (
 const errCloseConnection = "Failed to close connection: %v"
 
 var (
-	logFileCount             uint32
-	systemInfoFlag           bool
+	logFileCount        uint32
+	systemInfoFlag      bool
 	uploadBundleFlag         bool
 	uploadBundleURLFlag      string
 	uploadBundleInsecureFlag bool
@@ -156,11 +156,6 @@ func debugConfigDump(cmd *cobra.Command, _ []string) error {
 // request. Returns an error if the RPC fails or if the daemon reports
 // an upload failure reason.
 func debugBundle(cmd *cobra.Command, _ []string) error {
-	anonymizeEnabled, anonymizeLevel, err := effectiveAnonymize()
-	if err != nil {
-		return err
-	}
-
 	conn, err := getClient(cmd)
 	if err != nil {
 		return err
@@ -173,11 +168,10 @@ func debugBundle(cmd *cobra.Command, _ []string) error {
 
 	client := proto.NewDaemonServiceClient(conn)
 	request := &proto.DebugBundleRequest{
-		Anonymize:      anonymizeEnabled,
-		AnonymizeLevel: anonymizeLevel.String(),
-		SystemInfo:     systemInfoFlag,
-		LogFileCount:   logFileCount,
-		CliVersion:     version.NetbirdVersion(),
+		Anonymize:    anonymizeFlag,
+		SystemInfo:   systemInfoFlag,
+		LogFileCount: logFileCount,
+		CliVersion:   version.NetbirdVersion(),
 	}
 	if uploadBundleFlag {
 		request.UploadURL = uploadBundleURLFlag
@@ -235,11 +229,6 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("invalid duration format: %v", err)
 	}
 
-	anonymizeEnabled, anonymizeLevel, err := effectiveAnonymize()
-	if err != nil {
-		return err
-	}
-
 	conn, err := getClient(cmd)
 	if err != nil {
 		return err
@@ -379,11 +368,10 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 	cmd.Println("Creating debug bundle...")
 
 	request := &proto.DebugBundleRequest{
-		Anonymize:      anonymizeEnabled,
-		AnonymizeLevel: anonymizeLevel.String(),
-		SystemInfo:     systemInfoFlag,
-		LogFileCount:   logFileCount,
-		CliVersion:     version.NetbirdVersion(),
+		Anonymize:    anonymizeFlag,
+		SystemInfo:   systemInfoFlag,
+		LogFileCount: logFileCount,
+		CliVersion:   version.NetbirdVersion(),
 	}
 	if uploadBundleFlag {
 		request.UploadURL = uploadBundleURLFlag

client/cmd/root.go

@@ -21,7 +21,6 @@ import (
 	"github.com/spf13/pflag"
 	"google.golang.org/grpc"
 
-	"github.com/netbirdio/netbird/client/anonymize"
 	daddr "github.com/netbirdio/netbird/client/internal/daemonaddr"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 )
@@ -70,7 +69,6 @@ var (
 	autoConnectDisabled     bool
 	extraIFaceBlackList     []string
 	anonymizeFlag           bool
-	anonymizeLevelFlag      string
 	dnsRouteInterval        time.Duration
 	// lazyConnEnabled is the parse target for the deprecated --enable-lazy-connection
 	// flag. The flag is inert; the value is no longer read (use NB_LAZY_CONN instead).
@@ -158,8 +156,7 @@ func init() {
 	rootCmd.MarkFlagsMutuallyExclusive("setup-key", "setup-key-file")
 	rootCmd.PersistentFlags().StringVar(&preSharedKey, preSharedKeyFlag, "", "Sets WireGuard PreSharedKey property. If set, then only peers that have the same key can communicate.")
 	rootCmd.PersistentFlags().StringVarP(&hostName, "hostname", "n", "", "Sets a custom hostname for the device")
-	rootCmd.PersistentFlags().BoolVarP(&anonymizeFlag, "anonymize", "A", false, "anonymize public IP addresses, MAC addresses, and non-netbird.io domains in logs and status output; private, CGNAT, and link-local IP ranges are kept (see --anonymize-level strict)")
-	rootCmd.PersistentFlags().StringVar(&anonymizeLevelFlag, "anonymize-level", "", "anonymization level: \"default\" or \"strict\"; strict also anonymizes private, CGNAT, and link-local IP ranges, peer names, and WireGuard public keys. Setting this flag implies --anonymize")
+	rootCmd.PersistentFlags().BoolVarP(&anonymizeFlag, "anonymize", "A", false, "anonymize IP addresses and non-netbird.io domains in logs and status output")
 	rootCmd.PersistentFlags().StringVarP(&configPath, "config", "c", profilemanager.DefaultConfigPath, "Overrides the default profile file location")
 
 	rootCmd.AddCommand(upCmd)
@@ -296,19 +293,6 @@ var CLIBackOffSettings = &backoff.ExponentialBackOff{
 	Clock:               backoff.SystemClock,
 }
 
-// effectiveAnonymize resolves the --anonymize and --anonymize-level flags:
-// setting a level implies anonymization, and an invalid level is rejected.
-func effectiveAnonymize() (bool, anonymize.Level, error) {
-	if anonymizeLevelFlag == "" {
-		return anonymizeFlag, anonymize.LevelDefault, nil
-	}
-	level := anonymize.ParseLevel(anonymizeLevelFlag)
-	if !strings.EqualFold(anonymizeLevelFlag, level.String()) {
-		return false, anonymize.LevelDefault, fmt.Errorf("invalid anonymize level %q: use %q or %q", anonymizeLevelFlag, anonymize.LevelDefault.String(), anonymize.LevelStrict.String())
-	}
-	return true, level, nil
-}
-
 func getSetupKey() (string, error) {
 	if setupKeyPath != "" && setupKey == "" {
 		return getSetupKeyFromFile(setupKeyPath)

client/cmd/status.go

@@ -121,14 +121,8 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 		sessionExpiresAt = ts.AsTime().UTC()
 	}
 
-	anonymizeEnabled, anonymizeLevel, err := effectiveAnonymize()
-	if err != nil {
-		return err
-	}
-
 	var outputInformationHolder = nbstatus.ConvertToStatusOutputOverview(resp.GetFullStatus(), nbstatus.ConvertOptions{
-		Anonymize:            anonymizeEnabled,
-		AnonymizeLevel:       anonymizeLevel,
+		Anonymize:            anonymizeFlag,
 		DaemonVersion:        resp.GetDaemonVersion(),
 		DaemonStatus:         nbstatus.ParseDaemonStatus(status),
 		StatusFilter:         statusFilter,

client/iface/bind/ice_bind.go

@@ -22,16 +22,6 @@ import (
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
-const (
-	// wgMsgTypeHandshakeInitiation is the lowest WireGuard message type.
-	wgMsgTypeHandshakeInitiation uint32 = 1
-	// wgMsgTypeTransport is the highest WireGuard message type.
-	wgMsgTypeTransport uint32 = 4
-	// wgMinMsgSize is the smallest WireGuard message: transport data with an empty
-	// payload, which is what a keepalive is.
-	wgMinMsgSize = 32
-)
-
 type receiverCreator struct {
 	iceBind *ICEBind
 }
@@ -226,15 +216,8 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 		for i := 0; i < numMsgs; i++ {
 			msg := &(*msgs)[i]
 
-			if ok, err := s.filterOutStunMessages(msg.Buffers, msg.N, msg.Addr); ok {
-				if err != nil {
-					log.Debugf("failed to handle STUN packet from %s: %v", msg.Addr, err)
-				}
-				// WireGuard reuses sizes and eps across reads and only skips a slot
-				// whose size is below the minimum message size. Leaving a consumed
-				// slot untouched makes it process this buffer again under the
-				// previous packet's length and endpoint.
-				sizes[i] = 0
+			// todo: handle err
+			if ok, _ := s.filterOutStunMessages(msg.Buffers, msg.N, msg.Addr); ok {
 				continue
 			}
 			sizes[i] = msg.N
@@ -288,16 +271,11 @@ func (s *ICEBind) createOrUpdateMux() {
 
 func (s *ICEBind) filterOutStunMessages(buffers [][]byte, n int, addr net.Addr) (bool, error) {
 	for i := range buffers {
-		if n > len(buffers[i]) {
-			continue
-		}
-		pkt := buffers[i][:n]
-
-		if isWireGuardMsg(pkt) || !stun.IsMessage(pkt) {
+		if !stun.IsMessage(buffers[i]) {
 			continue
 		}
 
-		msg, err := s.parseSTUNMessage(pkt)
+		msg, err := s.parseSTUNMessage(buffers[i][:n])
 		if err != nil {
 			buffers[i] = []byte{}
 			return true, err
@@ -369,34 +347,18 @@ func putMessages(msgs *[]ipv6.Message, msgsPool *sync.Pool) {
 	msgsPool.Put(msgs)
 }
 
-// isWireGuardMsg reports whether the packet carries a WireGuard message header: a
-// little-endian uint32 message type in the range 1..4, which leaves the three bytes
-// after the type byte zero, in a packet long enough to hold any WireGuard message.
-//
-// A well formed STUN message cannot take that shape. Its length field sits in the two
-// bytes the type must leave zero, and for a message of at least wgMinMsgSize bytes that
-// field holds at least 12, so the two framings do not overlap. The test has to be this
-// tight because stun.IsMessage only looks at the magic cookie, which in a WireGuard
-// message overlaps the receiver index: a session whose index happens to equal the cookie
-// would otherwise have all of its inbound data misrouted to the STUN handler until the
-// next rekey.
-func isWireGuardMsg(pkt []byte) bool {
-	if len(pkt) < wgMinMsgSize {
-		return false
-	}
-
-	msgType := binary.LittleEndian.Uint32(pkt[:4])
-	return msgType >= wgMsgTypeHandshakeInitiation && msgType <= wgMsgTypeTransport
-}
-
-// isTransportPkg reports whether the packet is WireGuard transport data carrying a
-// payload, which is what counts as peer activity. A keepalive holds no payload and is
-// exactly wgMinMsgSize bytes.
 func isTransportPkg(buffers [][]byte, n int) bool {
-	if n < 4 || n > len(buffers[0]) {
-		return false
+	// The first buffer should contain at least 4 bytes for type
+	if len(buffers[0]) < 4 {
+		return true
 	}
 
-	msgType := binary.LittleEndian.Uint32(buffers[0][:4])
-	return msgType == wgMsgTypeTransport && n > wgMinMsgSize
+	// WireGuard packet type is a little-endian uint32 at start
+	packetType := binary.LittleEndian.Uint32(buffers[0][:4])
+
+	// Check if packetType matches known WireGuard message types
+	if packetType == 4 && n > 32 {
+		return true
+	}
+	return false
 }

client/iface/bind/stun_filter_test.go

@@ -1,215 +0,0 @@
-//go:build !js
-
-package bind
-
-import (
-	"encoding/binary"
-	"net"
-	"testing"
-	"time"
-
-	"github.com/pion/stun/v3"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/net/ipv4"
-	wgConn "golang.zx2c4.com/wireguard/conn"
-)
-
-// magicCookieBytes is the STUN magic cookie as it appears on the wire. In a
-// WireGuard message the same offset holds the receiver (or sender) index, which is
-// a random uint32, so a session can draw exactly this value.
-var magicCookieBytes = []byte{0x21, 0x12, 0xA4, 0x42}
-
-const testBufSize = 1500
-
-// wgMsg builds a WireGuard message of the given type and size, with the index field
-// at bytes 4:8 set to index.
-func wgMsg(msgType uint32, size int, index []byte) []byte {
-	pkt := make([]byte, size)
-	binary.LittleEndian.PutUint32(pkt[:4], msgType)
-	copy(pkt[4:8], index)
-	return pkt
-}
-
-// intoBuffer copies pkt into a full-size receive buffer, the way the kernel read
-// does, so tests see the same buffer/length split as the hot path.
-func intoBuffer(pkt []byte) [][]byte {
-	buf := make([]byte, testBufSize)
-	copy(buf, pkt)
-	return [][]byte{buf}
-}
-
-func TestFilterOutStunMessages_PassesWireGuardWithCookieShapedIndex(t *testing.T) {
-	tests := []struct {
-		name    string
-		msgType uint32
-		size    int
-	}{
-		{"transport data", wgMsgTypeTransport, 128},
-		{"keepalive", wgMsgTypeTransport, wgMinMsgSize},
-		{"handshake initiation", wgMsgTypeHandshakeInitiation, 148},
-		{"handshake response", 2, 92},
-		{"cookie reply", 3, 64},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			pkt := wgMsg(tc.msgType, tc.size, magicCookieBytes)
-			require.True(t, stun.IsMessage(pkt), "precondition: pion sees this as STUN")
-
-			buffers := intoBuffer(pkt)
-			bind := &ICEBind{}
-
-			filtered, err := bind.filterOutStunMessages(buffers, tc.size, &net.UDPAddr{})
-			assert.NoError(t, err)
-			assert.False(t, filtered, "WireGuard message must be handed to WireGuard, not the STUN handler")
-			assert.Len(t, buffers[0], testBufSize, "buffer must be left intact for WireGuard")
-		})
-	}
-}
-
-func TestFilterOutStunMessages_FiltersRealSTUNMessage(t *testing.T) {
-	msg, err := stun.Build(stun.BindingRequest, stun.TransactionID, stun.Fingerprint)
-	require.NoError(t, err)
-
-	buffers := intoBuffer(msg.Raw)
-	bind := &ICEBind{}
-
-	filtered, err := bind.filterOutStunMessages(buffers, len(msg.Raw), &net.UDPAddr{})
-	assert.NoError(t, err)
-	assert.True(t, filtered, "STUN message must be consumed by the STUN handler")
-	assert.Empty(t, buffers[0], "consumed buffer must be emptied so WireGuard does not see it")
-}
-
-// TestIsWireGuardMsg_DisjointFromSTUN locks the invariant the filter relies on: a
-// well formed STUN message long enough to be a WireGuard message always has a
-// non-zero length field, so it cannot be mistaken for a WireGuard header.
-func TestIsWireGuardMsg_DisjointFromSTUN(t *testing.T) {
-	types := []stun.MessageType{
-		stun.BindingRequest,
-		stun.BindingSuccess,
-		stun.BindingError,
-		{Method: stun.MethodBinding, Class: stun.ClassIndication},
-	}
-
-	for _, msgType := range types {
-		// Long enough that the length guard is not what makes this pass.
-		msg, err := stun.Build(msgType, stun.TransactionID,
-			stun.NewUsername("remoteUfrag:localUfrag"), stun.Fingerprint)
-		require.NoError(t, err)
-		require.GreaterOrEqual(t, len(msg.Raw), wgMinMsgSize, "precondition: %s", msgType)
-		assert.False(t, isWireGuardMsg(msg.Raw),
-			"%s must not look like a WireGuard message", msgType)
-	}
-}
-
-func TestIsWireGuardMsg(t *testing.T) {
-	tests := []struct {
-		name string
-		pkt  []byte
-		want bool
-	}{
-		{"transport data", wgMsg(wgMsgTypeTransport, 128, nil), true},
-		{"handshake initiation", wgMsg(wgMsgTypeHandshakeInitiation, 148, nil), true},
-		{"unknown type 5", wgMsg(5, 128, nil), false},
-		{"type 0", wgMsg(0, 128, nil), false},
-		{"non-zero reserved byte", []byte{0x04, 0x00, 0x01, 0x00}, false},
-		{"too short", []byte{0x04, 0x00, 0x00}, false},
-		{"empty", nil, false},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.want, isWireGuardMsg(tc.pkt), "wrong classification for %s", tc.name)
-		})
-	}
-}
-
-// TestFilterOutStunMessages_IgnoresBytesBeyondPacket guards against classifying on
-// buffer contents left over from an earlier, longer packet.
-func TestFilterOutStunMessages_IgnoresBytesBeyondPacket(t *testing.T) {
-	buf := make([]byte, testBufSize)
-	copy(buf[4:8], magicCookieBytes)
-	buffers := [][]byte{buf}
-	bind := &ICEBind{}
-
-	filtered, err := bind.filterOutStunMessages(buffers, 2, &net.UDPAddr{})
-	assert.NoError(t, err)
-	assert.False(t, filtered, "a 2 byte packet must not be classified from stale buffer bytes")
-}
-
-// TestReceiveFn_ClearsSizeOfConsumedPacket covers the accounting WireGuard relies
-// on: sizes is reused across reads, so a slot whose packet was consumed as STUN must
-// be reported as empty. Otherwise WireGuard reprocesses the same buffer under the
-// previous packet's length, which for a WireGuard-shaped packet means it is handled
-// twice.
-func TestReceiveFn_ClearsSizeOfConsumedPacket(t *testing.T) {
-	conn := listenUDP(t, "udp4", "127.0.0.1:0")
-	defer conn.Close()
-
-	recvFn := receiverCreator{setupICEBind(t)}.CreateReceiverFn(
-		ipv4.NewPacketConn(conn), conn, false, createMsgPool(),
-	)
-
-	msg, err := stun.Build(stun.BindingRequest, stun.TransactionID, stun.Fingerprint)
-	require.NoError(t, err)
-
-	sender := listenUDP(t, "udp4", "127.0.0.1:0")
-	defer sender.Close()
-	_, err = sender.WriteTo(msg.Raw, conn.LocalAddr())
-	require.NoError(t, err)
-
-	require.NoError(t, conn.SetReadDeadline(time.Now().Add(3*time.Second)))
-
-	bufs := [][]byte{make([]byte, 1500)}
-	// A leftover size from an earlier read, which is what makes the missing reset
-	// observable.
-	sizes := []int{148}
-	eps := make([]wgConn.Endpoint, 1)
-
-	n, err := recvFn(bufs, sizes, eps)
-	require.NoError(t, err)
-	require.Equal(t, 1, n)
-	assert.Zero(t, sizes[0], "consumed STUN packet must not leave a size behind for WireGuard")
-}
-
-func TestIsTransportPkg(t *testing.T) {
-	tests := []struct {
-		name string
-		pkt  []byte
-		n    int
-		want bool
-	}{
-		{"transport data with payload", wgMsg(wgMsgTypeTransport, 128, nil), 128, true},
-		{"keepalive", wgMsg(wgMsgTypeTransport, wgMinMsgSize, nil), wgMinMsgSize, false},
-		{"handshake initiation", wgMsg(wgMsgTypeHandshakeInitiation, 148, nil), 148, false},
-		{"stale type bytes beyond packet", wgMsg(wgMsgTypeTransport, 128, nil), 2, false},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.want, isTransportPkg(intoBuffer(tc.pkt), tc.n),
-				"wrong activity classification for %s", tc.name)
-		})
-	}
-}
-
-// TestFilterOutStunMessages_ConsumesSTUNWithWireGuardShapedType covers the one STUN
-// encoding whose leading bytes collide with a WireGuard message type: method 0x080 as a
-// request encodes to 0x0200, so the type byte reads as a handshake response and the byte
-// after it is zero. Only the length check keeps such a message out of WireGuard's hands.
-// pion implements no method in that range, so this is a synthetic worst case rather than
-// traffic ICE produces.
-func TestFilterOutStunMessages_ConsumesSTUNWithWireGuardShapedType(t *testing.T) {
-	msg, err := stun.Build(stun.NewType(stun.Method(0x080), stun.ClassRequest), stun.TransactionID)
-	require.NoError(t, err)
-	require.Equal(t, []byte{0x02, 0x00, 0x00, 0x00}, msg.Raw[:4],
-		"precondition: the leading bytes read as a WireGuard message type")
-
-	buffers := intoBuffer(msg.Raw)
-	bind := &ICEBind{}
-
-	filtered, err := bind.filterOutStunMessages(buffers, len(msg.Raw), &net.UDPAddr{})
-	assert.NoError(t, err)
-	assert.True(t, filtered, "STUN message must be consumed despite its WireGuard-shaped type")
-}

client/internal/debug/debug.go

@@ -34,8 +34,9 @@ import (
 	"github.com/netbirdio/netbird/shared/netiputil"
 )
 
-const readmeContent = `This debug bundle contains the following files.
-If anonymization is enabled (--anonymize / --anonymize-level), the files are anonymized to protect sensitive information.
+const readmeContent = `Netbird debug bundle
+This debug bundle contains the following files.
+If the --anonymize flag is set, the files are anonymized to protect sensitive information.
 
 status.txt: Anonymized status information of the NetBird client.
 client.log: Most recent, anonymized client log file of the NetBird client.
@@ -69,34 +70,21 @@ capture.pcap: Packet capture in pcap format. Only present when capture was runni
 
 
 Anonymization Process
-The files in this bundle have been anonymized to protect sensitive information. The level applied to this bundle is recorded at the top of this file. Here's how the anonymization was applied:
+The files in this bundle have been anonymized to protect sensitive information. Here's how the anonymization was applied:
 
 IP Addresses
 
-Default level:
-- Public IPv4 addresses are replaced with addresses starting from 198.51.100.0
-- Public IPv6 addresses are replaced with addresses starting from 2001:db8:ffff::
-- IPv6 unique local addresses (fc00::/7) are anonymized as well: their random global ID uniquely identifies the network.
-- IP addresses from internal IPv4 ranges and well-known addresses are not anonymized (e.g. 8.8.8.8, 100.64.0.0/10, addresses starting with 192.168., 172.16., 10., 169.254., fe80::).
-
-Strict level (--anonymize-level strict), in addition to the default level:
-- Private (RFC 1918), CGNAT (100.64.0.0/10), and link-local (169.254.0.0/16, fe80::/10) addresses are anonymized too.
-- Internal IPv4 addresses are replaced with addresses starting from 198.18.0.0 and internal IPv6 addresses with addresses starting from 2001:db8:1::, so internal addresses remain distinguishable from public ones.
-- Addresses are mapped in order of first appearance: subnet structure, allocation scheme, and gateway conventions are not preserved. Prefix lengths of networks are preserved.
-- Peer names in front of NetBird domains are replaced with numbered placeholders (e.g. peer-1.netbird.cloud), and subdomain labels of other domains with host-N placeholders.
-- WireGuard public keys are replaced with consistent placeholder keys.
+IPv4 addresses are replaced with addresses starting from 198.51.100.0
+IPv6 addresses are replaced with addresses starting from 100::
 
+IP addresses from non public ranges and well known addresses are not anonymized (e.g. 8.8.8.8, 100.64.0.0/10, addresses starting with 192.168., 172.16., 10., etc.).
 Reoccuring IP addresses are replaced with the same anonymized address.
 
 Note: The anonymized IP addresses in the status file do not match those in the log and routes files. However, the anonymized IP addresses are consistent within the status file and across the routes and log files.
 
-MAC Addresses
-MAC addresses are replaced at every anonymization level with consistent placeholders counting up from 02:00:00:00:00:01. Broadcast, multicast, and all-zero addresses are kept. At the default level a preserved IPv6 link-local address may still embed a MAC address (EUI-64); the strict level anonymizes those addresses.
-
 Domains
 All domain names (except for the netbird domains) are replaced with randomly generated strings ending in ".domain". Anonymized domains are consistent across all files in the bundle.
 Reoccuring domain names are replaced with the same anonymized domain.
-At the strict level, the peer name labels in front of netbird domains are anonymized as well.
 
 Sync Response
 The network_map.json file contains the following anonymized information:
@@ -293,7 +281,6 @@ type BundleGenerator struct {
 	cliVersion     string
 
 	anonymize         bool
-	anonymizeLevel    anonymize.Level
 	includeSystemInfo bool
 	logFileCount      uint32
 
@@ -301,10 +288,7 @@ type BundleGenerator struct {
 }
 
 type BundleConfig struct {
-	Anonymize bool
-	// AnonymizeLevel selects how much the anonymizer redacts.
-	// anonymize.LevelStrict implies Anonymize.
-	AnonymizeLevel    anonymize.Level
+	Anonymize         bool
 	IncludeSystemInfo bool
 	LogFileCount      uint32
 }
@@ -343,11 +327,8 @@ func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGen
 		uiLogOpener = openLogFile
 	}
 
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(cfg.AnonymizeLevel)
-
 	return &BundleGenerator{
-		anonymizer: anonymizer,
+		anonymizer: anonymize.NewAnonymizer(anonymize.DefaultAddresses()),
 
 		internalConfig: deps.InternalConfig,
 		statusRecorder: deps.StatusRecorder,
@@ -364,8 +345,7 @@ func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGen
 		daemonVersion:  deps.DaemonVersion,
 		cliVersion:     deps.CliVersion,
 
-		anonymize:         cfg.Anonymize || cfg.AnonymizeLevel >= anonymize.LevelStrict,
-		anonymizeLevel:    cfg.AnonymizeLevel,
+		anonymize:         cfg.Anonymize,
 		includeSystemInfo: cfg.IncludeSystemInfo,
 		logFileCount:      logFileCount,
 	}
@@ -505,13 +485,7 @@ func (g *BundleGenerator) addSystemInfo() {
 }
 
 func (g *BundleGenerator) addReadme() error {
-	level := "none (anonymization disabled)"
-	if g.anonymize {
-		level = g.anonymizeLevel.String()
-	}
-	header := fmt.Sprintf("Netbird debug bundle\nAnonymization level applied to this bundle: %s\n", level)
-
-	readmeReader := strings.NewReader(header + readmeContent)
+	readmeReader := strings.NewReader(readmeContent)
 	if err := g.addFileToZip(readmeReader, "README.txt"); err != nil {
 		return fmt.Errorf("add README file to zip: %w", err)
 	}
@@ -533,10 +507,9 @@ func (g *BundleGenerator) addStatus() error {
 		fullStatus := g.statusRecorder.GetFullStatus()
 		protoFullStatus := nbstatus.ToProtoFullStatus(fullStatus)
 		overview := nbstatus.ConvertToStatusOutputOverview(protoFullStatus, nbstatus.ConvertOptions{
-			Anonymize:      g.anonymize,
-			AnonymizeLevel: g.anonymizeLevel,
-			ProfileName:    profName,
-			DaemonVersion:  g.daemonVersion,
+			Anonymize:     g.anonymize,
+			ProfileName:   profName,
+			DaemonVersion: g.daemonVersion,
 		})
 		overview.CliVersion = g.cliVersion
 		statusOutput := overview.FullDetailSummary()
@@ -689,7 +662,7 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 	configContent.WriteString("NetBird Client Configuration:\n\n")
 
 	if key, err := wgtypes.ParseKey(g.internalConfig.PrivateKey); err == nil {
-		configContent.WriteString(fmt.Sprintf("PublicKey: %s\n", g.anonymizer.AnonymizeWGKey(key.PublicKey().String())))
+		configContent.WriteString(fmt.Sprintf("PublicKey: %s\n", key.PublicKey().String()))
 	}
 	configContent.WriteString(fmt.Sprintf("WgIface: %s\n", g.internalConfig.WgIface))
 	configContent.WriteString(fmt.Sprintf("WgPort: %d\n", g.internalConfig.WgPort))
@@ -979,11 +952,6 @@ func (g *BundleGenerator) addUpdateLogs() error {
 		}
 
 		baseName := filepath.Base(logFile)
-		data, err = g.anonymizeBytes(data)
-		if err != nil {
-			log.Warnf("skipping update log file %s: %v", baseName, err)
-			continue
-		}
 		if err := g.addFileToZip(bytes.NewReader(data), filepath.Join("update-logs", baseName)); err != nil {
 			return fmt.Errorf("add update log file %s to zip: %w", baseName, err)
 		}
@@ -1011,13 +979,6 @@ func (g *BundleGenerator) addCorruptedStateFiles() error {
 		}
 
 		fileName := filepath.Base(match)
-		// Corrupted state files usually fail structured JSON anonymization,
-		// so run them through the string anonymizer instead.
-		data, err = g.anonymizeBytes(data)
-		if err != nil {
-			log.Warnf("skipping corrupted state file %s: %v", fileName, err)
-			continue
-		}
 		if err := g.addFileToZip(bytes.NewReader(data), "corrupted_states/"+fileName); err != nil {
 			log.Warnf("Failed to add corrupted state file %s to zip: %v", fileName, err)
 			continue
@@ -1029,27 +990,6 @@ func (g *BundleGenerator) addCorruptedStateFiles() error {
 	return nil
 }
 
-// anonymizeBytes runs raw file content through the string anonymizer line by
-// line when anonymization is enabled. It errors instead of returning partial
-// content, so a caller never adds an unanonymized fallback to the bundle.
-func (g *BundleGenerator) anonymizeBytes(data []byte) ([]byte, error) {
-	if !g.anonymize {
-		return data, nil
-	}
-
-	var buf bytes.Buffer
-	scanner := bufio.NewScanner(bytes.NewReader(data))
-	scanner.Buffer(make([]byte, 1024*1024), 1024*1024)
-	for scanner.Scan() {
-		buf.WriteString(g.anonymizer.AnonymizeString(scanner.Text()))
-		buf.WriteByte('\n')
-	}
-	if err := scanner.Err(); err != nil {
-		return nil, fmt.Errorf("anonymize content: %w", err)
-	}
-	return buf.Bytes(), nil
-}
-
 func (g *BundleGenerator) addMetrics() error {
 	if g.clientMetrics == nil {
 		log.Debugf("skipping metrics in debug bundle: no metrics collector")
@@ -1522,7 +1462,6 @@ func anonymizeRemotePeer(peer *mgmProto.RemotePeerConfig, anonymizer *anonymize.
 	}
 
 	peer.Fqdn = anonymizer.AnonymizeDomain(peer.Fqdn)
-	peer.WgPubKey = anonymizer.AnonymizeWGKey(peer.WgPubKey)
 
 	anonymizeSSHConfig(peer.SshConfig)
 }

client/internal/debug/wgshow.go

@@ -35,14 +35,14 @@ func (g *BundleGenerator) toWGShowFormat(s *configurer.Stats) string {
 	var sb strings.Builder
 
 	sb.WriteString(fmt.Sprintf("interface: %s\n", s.DeviceName))
-	sb.WriteString(fmt.Sprintf("  public key: %s\n", g.anonymizer.AnonymizeWGKey(s.PublicKey)))
+	sb.WriteString(fmt.Sprintf("  public key: %s\n", s.PublicKey))
 	sb.WriteString(fmt.Sprintf("  listen port: %d\n", s.ListenPort))
 	if s.FWMark != 0 {
 		sb.WriteString(fmt.Sprintf("  fwmark: %#x\n", s.FWMark))
 	}
 
 	for _, peer := range s.Peers {
-		sb.WriteString(fmt.Sprintf("\npeer: %s\n", g.anonymizer.AnonymizeWGKey(peer.PublicKey)))
+		sb.WriteString(fmt.Sprintf("\npeer: %s\n", peer.PublicKey))
 		if peer.Endpoint.IP != nil {
 			if g.anonymize {
 				anonEndpoint := g.anonymizer.AnonymizeUDPAddr(peer.Endpoint)
@@ -54,11 +54,7 @@ func (g *BundleGenerator) toWGShowFormat(s *configurer.Stats) string {
 		if len(peer.AllowedIPs) > 0 {
 			var ipStrings []string
 			for _, ipnet := range peer.AllowedIPs {
-				ipStr := ipnet.String()
-				if g.anonymize {
-					ipStr = g.anonymizer.AnonymizeIPString(ipStr)
-				}
-				ipStrings = append(ipStrings, ipStr)
+				ipStrings = append(ipStrings, ipnet.String())
 			}
 			sb.WriteString(fmt.Sprintf("  allowed ips: %s\n", strings.Join(ipStrings, ", ")))
 		}

client/internal/engine.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"math"
 	"math/rand"
 	"net"
 	"net/netip"
@@ -23,7 +24,6 @@ import (
 	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
-	"github.com/netbirdio/netbird/client/anonymize"
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/firewall"
 	"github.com/netbirdio/netbird/client/firewall/firewalld"
@@ -51,6 +51,7 @@ import (
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/client/internal/portforward"
+	"github.com/netbirdio/netbird/client/internal/pqkem"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/relay"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
@@ -198,6 +199,10 @@ type Engine struct {
 	// rpManager is a Rosenpass manager
 	rpManager *rosenpass.Manager
 
+	// pqkemManager runs the ML-KEM post-quantum PSK exchange (gated by NB_ENABLE_PQ_MLKEM).
+	// It owns the data-path transport and peer endpoint routing.
+	pqkemManager *pqkem.Manager
+
 	// syncMsgMux is used to guarantee sequential Management Service message processing
 	syncMsgMux *sync.Mutex
 
@@ -556,7 +561,11 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	publicKey := e.config.WgPrivateKey.PublicKey()
 	e.flowManager = netflow.NewManager(e.wgInterface, publicKey[:], e.statusRecorder)
 
-	if e.config.RosenpassEnabled {
+	// Rosenpass and ML-KEM are mutually exclusive. ML-KEM (NB_ENABLE_PQ_MLKEM) takes precedence
+	if e.config.RosenpassEnabled && pqkem.Enabled() {
+		log.Warnf("rosenpass and ML-KEM post-quantum are mutually exclusive; ML-KEM is enabled, so rosenpass is disabled")
+	}
+	if e.config.RosenpassEnabled && !pqkem.Enabled() {
 		log.Infof("rosenpass is enabled")
 		if e.config.RosenpassPermissive {
 			log.Infof("running rosenpass in permissive mode")
@@ -645,6 +654,35 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		e.rpManager.SetInterface(e.wgInterface)
 	}
 
+	// Start the ML-KEM PQ manager after the interface is up so its dedicated UDP
+	// transport can bind on the WG overlay IP.
+	if pqkem.Enabled() {
+		tr, pqErr := newPQTransport(e.config.WgAddr.IP)
+		if pqErr != nil {
+			// In strict mode the peer must fail closed; silently continuing without the PQ
+			// exchange would hand out classic tunnels, so treat the bind failure as fatal.
+			if pqkem.Strict() {
+				return fmt.Errorf("pqkem: strict mode enabled but transport bind failed: %w", pqErr)
+			}
+			log.Errorf("pqkem: transport bind failed, exchange disabled: %v", pqErr)
+		} else {
+			cbHandler := pqCallbackHandler{
+				wg: e.wgInterface,
+				// On a persistent rekey failure, re-bootstrap the KEM over Signal: a
+				// fresh signalling offer starts a new exchange that overwrites the
+				// stalled PSK on both sides, recovering from a data-path desync.
+				reoffer: func(remoteKey string) {
+					if conn, ok := e.peerStore.PeerConn(remoteKey); ok {
+						conn.RequestReoffer()
+					}
+				},
+			}
+			e.pqkemManager = pqkem.NewManager(pqkem.LocalID(publicKey.String()), cbHandler, pqkem.NewLogger())
+			e.pqkemManager.Start(tr)
+			log.Infof("pqkem: enabled (udp port %d on overlay %s)", e.pqkemManager.LocalPort(), e.config.WgAddr.IP)
+		}
+	}
+
 	// if inbound conns are blocked there is no need to create the ACL manager
 	if e.firewall != nil && !e.config.BlockInbound {
 		e.acl = acl.NewDefaultManager(e.firewall)
@@ -908,6 +946,10 @@ func (e *Engine) removePeer(peerKey string) error {
 
 	e.connMgr.RemovePeerConn(peerKey)
 
+	if e.pqkemManager != nil {
+		e.pqkemManager.RemovePeer(pqkem.RemoteID(peerKey))
+	}
+
 	err := e.statusRecorder.RemovePeer(peerKey)
 	if err != nil {
 		log.Warnf("received error when removing peer %s from status recorder: %v", peerKey, err)
@@ -1365,17 +1407,7 @@ func (e *Engine) receiveJobEvents() {
 }
 
 func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobResponse_Bundle, error) {
-	// The upload URL can carry a host, credentials, or query tokens, so it is
-	// kept out of the info-level line; the full parameters stay available at
-	// debug level for troubleshooting.
-	log.Infof("handle remote debug bundle request: anonymize=%v anonymize_level=%q log_file_count=%d bundle_for=%v bundle_for_time=%d",
-		params.GetAnonymize(), params.GetAnonymizeLevel(), params.GetLogFileCount(), params.GetBundleFor(), params.GetBundleForTime())
-	log.Debugf("remote debug bundle request parameters: %s", params.String())
-
-	if err := validateBundleUploadURL(params.GetUploadUrl()); err != nil {
-		return nil, err
-	}
-
+	log.Infof("handle remote debug bundle request: %s", params.String())
 	syncResponse, err := e.GetLatestSyncResponse()
 	if err != nil {
 		log.Warnf("get latest sync response: %v", err)
@@ -1396,14 +1428,13 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR
 
 	bundleJobParams := debug.BundleConfig{
 		Anonymize:         params.Anonymize,
-		AnonymizeLevel:    anonymize.ParseLevel(params.AnonymizeLevel),
 		IncludeSystemInfo: true,
 		LogFileCount:      uint32(params.LogFileCount),
 	}
 
 	waitFor := time.Duration(params.BundleForTime) * time.Minute
 
-	uploadKey, err := e.jobExecutor.BundleJob(e.ctx, bundleDeps, bundleJobParams, waitFor, e.config.ProfileConfig.ManagementURL.String(), params.GetUploadUrl())
+	uploadKey, err := e.jobExecutor.BundleJob(e.ctx, bundleDeps, bundleJobParams, waitFor, e.config.ProfileConfig.ManagementURL.String())
 	if err != nil {
 		return nil, err
 	}
@@ -1416,26 +1447,6 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR
 	return response, nil
 }
 
-// validateBundleUploadURL sanity-checks a management-supplied upload URL for a
-// remote debug bundle job. An empty value is accepted — the executor falls back
-// to the default upload service. A non-empty value must be a well-formed https
-// URL with a host; a malformed value or a plaintext scheme is rejected. This
-// deliberately does not constrain which host may receive the bundle; that
-// policy is left open pending a decision on management-directed uploads.
-func validateBundleUploadURL(raw string) error {
-	if raw == "" {
-		return nil
-	}
-	parsed, err := url.Parse(raw)
-	if err != nil {
-		return fmt.Errorf("parse upload URL: %w", err)
-	}
-	if parsed.Scheme != "https" || parsed.Host == "" {
-		return fmt.Errorf("upload URL must be an https URL with a host")
-	}
-	return nil
-}
-
 // receiveManagementEvents connects to the Management Service event stream to receive updates from the management service
 // E.g. when a new peer has been registered and we are allowed to connect to it.
 func (e *Engine) receiveManagementEvents() {
@@ -1925,6 +1936,10 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 		},
 		ICEConfig: e.createICEConfig(),
 	}
+	if e.pqkemManager != nil {
+		config.PQ = pqHandshaker{mgr: e.pqkemManager}
+		config.PQStrict = pqkem.Strict()
+	}
 
 	serviceDependencies := peer.ServiceDependencies{
 		StatusRecorder:     e.statusRecorder,
@@ -2108,6 +2123,10 @@ func (e *Engine) close() {
 		_ = e.rpManager.Close()
 	}
 
+	if e.pqkemManager != nil {
+		e.pqkemManager.Stop()
+	}
+
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	if err := e.portForwardManager.GracefullyStop(ctx); err != nil {
@@ -2875,6 +2894,13 @@ func convertToOfferAnswer(msg *sProto.Message) (*peer.OfferAnswer, error) {
 
 	relayIP := decodeRelayIP(msg.GetBody().GetRelayServerIP())
 
+	// Ports are uint16 internally; the proto widens them to uint32, so validate the
+	// range before narrowing (a value that does not fit is a malformed message).
+	mlkemPort := msg.GetBody().GetMlkemPort()
+	if mlkemPort > math.MaxUint16 {
+		return nil, fmt.Errorf("invalid ML-KEM port %d in signalling message", mlkemPort)
+	}
+
 	offerAnswer := peer.OfferAnswer{
 		IceCredentials: peer.IceCredentials{
 			UFrag: remoteCred.UFrag,
@@ -2884,6 +2910,8 @@ func convertToOfferAnswer(msg *sProto.Message) (*peer.OfferAnswer, error) {
 		Version:         msg.GetBody().GetNetBirdVersion(),
 		RosenpassPubKey: rosenpassPubKey,
 		RosenpassAddr:   rosenpassAddr,
+		MlkemPayload:    msg.GetBody().GetMlkemPayload(),
+		MlkemPort:       uint16(mlkemPort),
 		RelaySrvAddress: msg.GetBody().GetRelayServerAddress(),
 		RelaySrvIP:      relayIP,
 		SessionID:       sessionID,

client/internal/engine_bundle_test.go

@@ -1,35 +0,0 @@
-package internal
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestValidateBundleUploadURL covers the sanity check applied to a
-// management-supplied upload URL before a remote debug bundle is generated.
-func TestValidateBundleUploadURL(t *testing.T) {
-	for _, tc := range []struct {
-		name    string
-		raw     string
-		wantErr bool
-	}{
-		{name: "empty falls back to default", raw: ""},
-		{name: "https with host", raw: "https://upload.debug.netbird.io/upload"},
-		{name: "https self-hosted host", raw: "https://upload.example.com"},
-		{name: "plaintext rejected", raw: "http://upload.example.com", wantErr: true},
-		{name: "missing host rejected", raw: "https:///upload", wantErr: true},
-		{name: "non-url scheme rejected", raw: "ftp://upload.example.com", wantErr: true},
-		{name: "garbage rejected", raw: "://not a url", wantErr: true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			err := validateBundleUploadURL(tc.raw)
-			if tc.wantErr {
-				require.Error(t, err, "an invalid upload URL must be rejected")
-				return
-			}
-			assert.NoError(t, err, "a valid or empty upload URL must be accepted")
-		})
-	}
-}

client/internal/metrics/connection_type.go

@@ -4,17 +4,11 @@ package metrics
 type ConnectionType string
 
 const (
-	// ConnectionTypeICEP2P represents a direct peer-to-peer connection using ICE
-	ConnectionTypeICEP2P ConnectionType = "ice_p2p"
-
-	// ConnectionTypeICETurn represents an ICE connection through a TURN server
-	ConnectionTypeICETurn ConnectionType = "ice_turn"
+	// ConnectionTypeICE represents a direct peer-to-peer connection using ICE
+	ConnectionTypeICE ConnectionType = "ice"
 
 	// ConnectionTypeRelay represents a relayed connection
 	ConnectionTypeRelay ConnectionType = "relay"
-
-	// ConnectionTypeUnknown represents a connection with no active transport. It is not pushed.
-	ConnectionTypeUnknown ConnectionType = "unknown"
 )
 
 // String returns the string representation of the connection type

client/internal/metrics/influxdb_test.go

@@ -28,7 +28,7 @@ func TestInfluxDBMetrics_RecordAndExport(t *testing.T) {
 		WgHandshakeSuccess: time.Now().Add(-1 * time.Second),
 	}
 
-	m.RecordConnectionStages(context.Background(), agentInfo, "pair123", ConnectionTypeICEP2P, false, ts)
+	m.RecordConnectionStages(context.Background(), agentInfo, "pair123", ConnectionTypeICE, false, ts)
 
 	var buf bytes.Buffer
 	err := m.Export(&buf)
@@ -60,7 +60,7 @@ func TestInfluxDBMetrics_ExportDeterministicFieldOrder(t *testing.T) {
 
 	// Record multiple times and verify consistent field order
 	for i := 0; i < 10; i++ {
-		m.RecordConnectionStages(context.Background(), agentInfo, "pair123", ConnectionTypeICEP2P, false, ts)
+		m.RecordConnectionStages(context.Background(), agentInfo, "pair123", ConnectionTypeICE, false, ts)
 	}
 
 	var buf bytes.Buffer

client/internal/metrics/infra/README.md

@@ -56,33 +56,14 @@ Measurement: `netbird_peer_connection`
 
 Tags:
 - `deployment_type`: "cloud" | "selfhosted" | "unknown"
-- `connection_type`: "ice_p2p" | "ice_turn" | "relay" (see below)
+- `connection_type`: "ice" | "relay"
 - `attempt_type`: "initial" | "reconnection"
 - `version`: NetBird version string
 - `os`: Operating system (linux, darwin, windows, android, ios, etc.)
 - `arch`: CPU architecture (amd64, arm64, etc.)
-- `peer_id`: anonymised peer identifier (truncated SHA-256 of the WireGuard public key)
-- `connection_pair_id`: deterministic identifier for the peer pair, identical on both sides
 
 **Note:** `SignalingReceived` is set when the first offer or answer arrives from the remote peer (in both initial and reconnection paths). It excludes the potentially unbounded wait for the remote peer to come online.
 
-#### `connection_type` values
-
-Derived from the connection priority (`conntype.ConnPriority`) by `metricsConnType` in `client/internal/peer/conn.go`:
-
-| Value | Priority | Traffic is |
-|-------|----------|------------|
-| `ice_p2p` | `ICEP2P` | direct peer-to-peer |
-| `ice_turn` | `ICETurn` | relayed, through a TURN server |
-| `relay` | `Relay` | relayed, through a NetBird relay |
-| `unknown` | `None` or unrecognised | no active transport — **the sample is not pushed** |
-
-**Direct traffic is `ice_p2p` only.** `ice_turn` is relayed despite being negotiated by ICE, matching `Conn.isRelayed`.
-
-`None` means no transport is active: not established yet, or reset after a relay drop or a peer-state reset. Such a sample cannot be attributed to a transport, so `recordConnectionMetrics` drops it instead of pushing it — `unknown` therefore never appears in the bucket. Connection counts are counts of connections whose transport was known at sampling time.
-
-**Samples recorded before 0.77 used a single `ice` value** which covered `ICEP2P`, `ICETurn` *and* `None`, so historical `ice` samples overstate direct connections by an unknown amount and must not be compared with `ice_p2p`.
-
 ### Sync Duration
 
 Measurement: `netbird_sync`

client/internal/peer/conn.go

@@ -3,6 +3,7 @@ package peer
 import (
 	"context"
 	"fmt"
+	"math"
 	"net"
 	"net/netip"
 	"runtime"
@@ -26,6 +27,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
+	"github.com/netbirdio/netbird/monotime"
 	"github.com/netbirdio/netbird/route"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
@@ -74,6 +76,39 @@ type RosenpassConfig struct {
 	PermissiveMode bool
 }
 
+// PQHandshaker attaches post-quantum ML-KEM material to signalling offers/answers and
+// feeds received material back. It is implemented by the engine over the pqkem
+// manager and is nil when the PQ exchange is disabled. remoteKey is the peer's
+// WireGuard public key.
+type PQHandshaker interface {
+	// OfferPayload returns the KEM offer to embed in an outgoing offer (nil if this
+	// peer is not the KEM initiator) and the local PQ data-path port to announce.
+	OfferPayload(remoteKey string) (payload []byte, port uint16)
+	// ShouldSendBootstrapOffer reports whether, as the controller, we should reply to a
+	// received responder offer with our own KEM offer (true only when no exchange is
+	// already in flight — so we kick the KEM once and ignore further offers).
+	ShouldSendBootstrapOffer(remoteKey string) bool
+	// AnswerPayload processes a received KEM offer (nil if absent) and returns the KEM
+	// answer to embed in the outgoing answer (nil if none) and the local PQ port.
+	AnswerPayload(remoteKey string, recvOffer []byte) (payload []byte, port uint16)
+	// OnAnswer feeds a received KEM answer (nil if absent).
+	OnAnswer(remoteKey string, recvAnswer []byte)
+	// PSK returns the peer's latest derived post-quantum PSK to program at WG
+	// peer-config time (the pull path). ok is false until one has been derived.
+	PSK(remoteKey string) (wgtypes.Key, bool)
+	// SetRemoteAddr registers the peer's data-path endpoint learned from signalling:
+	// its WG overlay IP with the announced pq UDP port (port 0 means the peer omitted
+	// it and is on the default port).
+	SetRemoteAddr(remoteKey string, addr netip.AddrPort)
+	// OnDataPathRekeyed signals a fresh WireGuard handshake for the peer; it clocks the
+	// next chained PSK rotation pushed over the data path. sinceActivity is how long
+	// ago the peer last exchanged real user data, so the rotation can be skipped for
+	// idle tunnels.
+	OnDataPathRekeyed(remoteKey string, sinceActivity time.Duration)
+	// OnDataPathDown signals the peer's tunnel went down.
+	OnDataPathDown(remoteKey string)
+}
+
 // ConnConfig is a peer Connection configuration
 type ConnConfig struct {
 	// Key is a public key of a remote peer
@@ -91,6 +126,12 @@ type ConnConfig struct {
 
 	RosenpassConfig RosenpassConfig
 
+	// PQ carries post-quantum ML-KEM material on offers/answers; nil when disabled.
+	PQ PQHandshaker
+	// PQStrict fails closed: block peer traffic until the ML-KEM PSK is established,
+	// instead of letting the tunnel come up classically and upgrading to PQ later.
+	PQStrict bool
+
 	// ICEConfig ICE protocol configuration
 	ICEConfig icemaker.Config
 }
@@ -149,6 +190,11 @@ type Conn struct {
 	// pendingFirstPacket is the lazyconn-captured handshake init, replayed once the real
 	// transport is up.
 	pendingFirstPacket []byte
+
+	// pqStrictSentinelKey is a per-conn random sentinel PSK used in PQ strict mode to
+	// fail closed: it is programmed until the real ML-KEM PSK is derived, so no session
+	// can form on a non-PQ key. Per-conn random so two strict peers never match by chance.
+	pqStrictSentinelKey *wgtypes.Key
 }
 
 // injectPendingFirstPacket replays the captured handshake through the proxy if present, else
@@ -206,6 +252,16 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
 		metricsRecorder:    services.MetricsRecorder,
 	}
 
+	if config.PQ != nil && config.PQStrict {
+		// The sentinel is what makes strict mode fail closed; if we cannot generate it we
+		// must not fall back to a usable key, so fail creating the conn instead.
+		k, err := wgtypes.GenerateKey()
+		if err != nil {
+			return nil, fmt.Errorf("generate pqkem strict-mode sentinel key: %w", err)
+		}
+		conn.pqStrictSentinelKey = &k
+	}
+
 	return conn, nil
 }
 
@@ -407,6 +463,9 @@ func (conn *Conn) ConnID() id.ConnID {
 
 // configureConnection starts proxying traffic from/to local Wireguard and sets connection status to StatusConnected
 func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConnInfo ICEConnInfo) {
+	// Read the PQ PSK before conn.mu to keep the lock order conn.mu -> manager.
+	pqPSK, pqOK := conn.pqPSK()
+
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 
@@ -424,7 +483,7 @@ func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConn
 	if conn.currentConnPriority > priority {
 		conn.Log.Infof("current connection priority (%s) is higher than the new one (%s), do not upgrade connection", conn.currentConnPriority, priority)
 		conn.statusICE.SetConnected()
-		conn.updateIceState(iceConnInfo, time.Now())
+		conn.updateIceState(iceConnInfo, pqOK, time.Now())
 		return
 	}
 
@@ -467,7 +526,7 @@ func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConn
 	updateTime := time.Now()
 	conn.enableWgWatcherIfNeeded(updateTime)
 
-	presharedKey := conn.presharedKey(iceConnInfo.RosenpassPubKey)
+	presharedKey := conn.presharedKey(iceConnInfo.RosenpassPubKey, pqPSK)
 	if err = conn.endpointUpdater.ConfigureWGEndpoint(ep, presharedKey); err != nil {
 		conn.handleConfigurationFailure(err, wgProxy)
 		return
@@ -483,11 +542,14 @@ func (conn *Conn) onICEConnectionIsReady(priority conntype.ConnPriority, iceConn
 
 	conn.currentConnPriority = priority
 	conn.statusICE.SetConnected()
-	conn.updateIceState(iceConnInfo, updateTime)
+	conn.updateIceState(iceConnInfo, pqOK, updateTime)
 	conn.doOnConnected(iceConnInfo.RosenpassPubKey, iceConnInfo.RosenpassAddr, updateTime)
 }
 
 func (conn *Conn) onICEStateDisconnected(sessionChanged bool) {
+	// Read the PQ PSK before conn.mu to keep the lock order conn.mu -> manager.
+	pqPSK, _ := conn.pqPSK()
+
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 
@@ -514,7 +576,7 @@ func (conn *Conn) onICEStateDisconnected(sessionChanged bool) {
 		// todo consider to move after the ConfigureWGEndpoint
 		conn.wgProxyRelay.Work()
 
-		presharedKey := conn.presharedKey(conn.rosenpassRemoteKey)
+		presharedKey := conn.presharedKey(conn.rosenpassRemoteKey, pqPSK)
 		if err := conn.endpointUpdater.SwitchWGEndpoint(conn.wgProxyRelay.EndpointAddr(), presharedKey); err != nil {
 			conn.Log.Errorf("failed to switch to relay conn: %v", err)
 		}
@@ -552,6 +614,9 @@ func (conn *Conn) onICEStateDisconnected(sessionChanged bool) {
 }
 
 func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
+	// Read the PQ PSK before conn.mu to keep the lock order conn.mu -> manager.
+	pqPSK, pqOK := conn.pqPSK()
+
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 
@@ -580,7 +645,7 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 		conn.Log.Debugf("do not switch to relay because current priority is: %s", conn.currentConnPriority.String())
 		conn.setRelayedProxy(wgProxy)
 		conn.statusRelay.SetConnected()
-		conn.updateRelayStatus(rci.relayedConn.RemoteAddr().String(), rci.rosenpassPubKey, time.Now())
+		conn.updateRelayStatus(rci.relayedConn.RemoteAddr().String(), rci.rosenpassPubKey, pqOK, time.Now())
 		return
 	}
 
@@ -591,7 +656,7 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 	}
 	updateTime := time.Now()
 	conn.enableWgWatcherIfNeeded(updateTime)
-	if err := conn.endpointUpdater.ConfigureWGEndpoint(wgProxy.EndpointAddr(), conn.presharedKey(rci.rosenpassPubKey)); err != nil {
+	if err := conn.endpointUpdater.ConfigureWGEndpoint(wgProxy.EndpointAddr(), conn.presharedKey(rci.rosenpassPubKey, pqPSK)); err != nil {
 		if err := wgProxy.CloseConn(); err != nil {
 			conn.Log.Warnf("Failed to close relay connection: %v", err)
 		}
@@ -610,7 +675,7 @@ func (conn *Conn) onRelayConnectionIsReady(rci RelayConnInfo) {
 	conn.currentConnPriority = conntype.Relay
 	conn.statusRelay.SetConnected()
 	conn.setRelayedProxy(wgProxy)
-	conn.updateRelayStatus(rci.relayedConn.RemoteAddr().String(), rci.rosenpassPubKey, updateTime)
+	conn.updateRelayStatus(rci.relayedConn.RemoteAddr().String(), rci.rosenpassPubKey, pqOK, updateTime)
 	conn.Log.Infof("start to communicate with peer via relay")
 	conn.doOnConnected(rci.rosenpassPubKey, rci.rosenpassAddr, updateTime)
 }
@@ -672,12 +737,28 @@ func (conn *Conn) onGuardEvent() {
 	}
 }
 
+// RequestReoffer sends a fresh signalling offer for the peer, re-running the
+// post-quantum bootstrap over Signal. Used to recover from a persistent data-path
+// rekey failure: a new exchange overwrites the stalled PSK on both sides. No-op if the
+// connection is not open yet.
+func (conn *Conn) RequestReoffer() {
+	conn.mu.Lock()
+	h := conn.handshaker
+	conn.mu.Unlock()
+	if h == nil {
+		return
+	}
+	if err := h.SendOffer(); err != nil {
+		conn.Log.Debugf("pqkem: recovery re-offer failed: %v", err)
+	}
+}
+
 func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
 	conn.mu.Lock()
-	defer conn.mu.Unlock()
 
 	// watcherCtx guards against a stale watcher tearing down a connection that already superseded it.
 	if conn.ctx.Err() != nil || watcherCtx.Err() != nil {
+		conn.mu.Unlock()
 		return
 	}
 
@@ -695,6 +776,15 @@ func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
 	}
 
 	conn.escalateWGTimeoutLocked()
+	pq := conn.config.PQ
+	key := conn.config.Key
+	conn.mu.Unlock()
+
+	// Signal the PQ manager outside conn.mu: it may re-enter Conn (reoffer) under
+	// conn.mu, so calling it while holding the lock would invert the lock order.
+	if pq != nil {
+		pq.OnDataPathDown(key)
+	}
 }
 
 // escalateWGTimeoutLocked resets the peer's rosenpass state after repeated
@@ -718,14 +808,14 @@ func (conn *Conn) escalateWGTimeoutLocked() {
 	conn.onDisconnected(conn.config.WgConfig.RemoteKey)
 }
 
-func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []byte, updateTime time.Time) {
+func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []byte, pqEstablished bool, updateTime time.Time) {
 	peerState := State{
 		PubKey:             conn.config.Key,
 		ConnStatusUpdate:   updateTime,
 		ConnStatus:         conn.evalStatus(),
 		Relayed:            conn.isRelayed(),
 		RelayServerAddress: relayServerAddr,
-		RosenpassEnabled:   isRosenpassEnabled(rosenpassPubKey),
+		RosenpassEnabled:   conn.quantumResistant(rosenpassPubKey, pqEstablished),
 	}
 
 	err := conn.statusRecorder.UpdatePeerRelayedState(peerState)
@@ -734,7 +824,7 @@ func (conn *Conn) updateRelayStatus(relayServerAddr string, rosenpassPubKey []by
 	}
 }
 
-func (conn *Conn) updateIceState(iceConnInfo ICEConnInfo, updateTime time.Time) {
+func (conn *Conn) updateIceState(iceConnInfo ICEConnInfo, pqEstablished bool, updateTime time.Time) {
 	peerState := State{
 		PubKey:                     conn.config.Key,
 		ConnStatusUpdate:           updateTime,
@@ -744,7 +834,7 @@ func (conn *Conn) updateIceState(iceConnInfo ICEConnInfo, updateTime time.Time)
 		RemoteIceCandidateType:     iceConnInfo.RemoteIceCandidateType,
 		LocalIceCandidateEndpoint:  iceConnInfo.LocalIceCandidateEndpoint,
 		RemoteIceCandidateEndpoint: iceConnInfo.RemoteIceCandidateEndpoint,
-		RosenpassEnabled:           isRosenpassEnabled(iceConnInfo.RosenpassPubKey),
+		RosenpassEnabled:           conn.quantumResistant(iceConnInfo.RosenpassPubKey, pqEstablished),
 	}
 
 	err := conn.statusRecorder.UpdatePeerICEState(peerState)
@@ -948,6 +1038,35 @@ func (conn *Conn) onWGCheckSuccess() {
 	conn.mu.Lock()
 	conn.wgTimeouts = 0
 	conn.mu.Unlock()
+
+	// A fresh WireGuard handshake clocks the post-quantum PSK rotation. Pass how long
+	// ago the peer last exchanged real user data (keepalives excluded) so the pqkem
+	// manager can skip rotation on idle tunnels — rotating then would push data-path
+	// traffic that keeps the lazy connection artificially active.
+	if conn.config.PQ != nil {
+		conn.config.PQ.OnDataPathRekeyed(conn.config.Key, conn.dataActivityAge())
+	}
+}
+
+// dataActivityAge returns how long ago the peer last exchanged real user data
+// (WireGuard keepalives excluded), per the same LastActivities signal the
+// lazy-connection inactivity monitor uses. It reports a very large duration when no
+// activity has ever been recorded, so the peer is treated as idle.
+//
+// In kernel mode there is no per-peer data-activity signal (LastActivities is
+// userspace-only), so we cannot tell active from idle. We report zero — always
+// "active" — so PSK rotation is not disabled in kernel mode. Lazy back-to-idle is
+// already limited there; the eBPF WG-activity detection (future) will supply a real
+// signal that excludes handshake/pqkem traffic.
+func (conn *Conn) dataActivityAge() time.Duration {
+	if !conn.config.WgConfig.WgInterface.IsUserspaceBind() {
+		return 0
+	}
+	last, ok := conn.config.WgConfig.WgInterface.LastActivities()[conn.config.WgConfig.RemoteKey]
+	if !ok {
+		return time.Duration(math.MaxInt64)
+	}
+	return monotime.Since(last)
 }
 
 // recordConnectionMetrics records connection stage timestamps as metrics
@@ -961,9 +1080,12 @@ func (conn *Conn) recordConnectionMetrics() {
 	priority := conn.currentConnPriority
 	conn.mu.Unlock()
 
-	connType := metricsConnType(priority)
-	if connType == metrics.ConnectionTypeUnknown {
-		return
+	var connType metrics.ConnectionType
+	switch priority {
+	case conntype.Relay:
+		connType = metrics.ConnectionTypeRelay
+	default:
+		connType = metrics.ConnectionTypeICE
 	}
 
 	// Record metrics with timestamps - duration calculation happens in metrics package
@@ -985,7 +1107,42 @@ func (conn *Conn) AgentVersionString() string {
 	return conn.config.AgentVersion
 }
 
-func (conn *Conn) presharedKey(remoteRosenpassKey []byte) *wgtypes.Key {
+// pqPSK returns the post-quantum PSK derived for this peer, if the ML-KEM exchange has
+// produced one. It reads the manager WITHOUT conn.mu, so callers fetch it before taking
+// conn.mu: the lock order is always conn.mu -> manager, never the reverse (the manager's
+// reoffer callback re-enters Conn under conn.mu).
+func (conn *Conn) pqPSK() (*wgtypes.Key, bool) {
+	if conn.config.PQ == nil {
+		return nil, false
+	}
+	psk, ok := conn.config.PQ.PSK(conn.config.Key)
+	if !ok {
+		return nil, false
+	}
+	return &psk, true
+}
+
+// presharedKey resolves the WireGuard preshared key for the peer. pqPSK is the
+// post-quantum PSK looked up out of band via pqPSK (nil when none is derived yet), passed
+// in so the manager lock is never taken under conn.mu.
+func (conn *Conn) presharedKey(remoteRosenpassKey []byte, pqPSK *wgtypes.Key) *wgtypes.Key {
+	// Post-quantum: once the ML-KEM exchange has derived a PSK for this peer, program
+	// it here so the peer's next WireGuard handshake adopts it. Applied at peer-config
+	// time (bootstrap / reconnect); steady-state rotation is pushed separately.
+	if conn.config.PQ != nil {
+		if pqPSK != nil {
+			return pqPSK
+		}
+		if conn.config.PQStrict && conn.pqStrictSentinelKey != nil {
+			// Fail closed: program a non-matching sentinel so no session forms on a
+			// non-PQ key until the ML-KEM exchange derives the real PSK (pushed via
+			// SetPresharedKey once it converges). "pending" — turns into a "stuck"
+			// warning from the manager if the exchange keeps failing (see raiseFailure).
+			conn.Log.Debugf("pqkem: strict mode — no PQ PSK yet, blocking peer traffic until the ML-KEM exchange converges")
+			return conn.pqStrictSentinelKey
+		}
+	}
+
 	if conn.config.RosenpassConfig.PubKey == nil {
 		return conn.config.WgConfig.PreSharedKey
 	}
@@ -1025,6 +1182,13 @@ func isRosenpassEnabled(remoteRosenpassPubKey []byte) bool {
 	return remoteRosenpassPubKey != nil
 }
 
+// quantumResistant reports whether the peer's tunnel is post-quantum protected, for
+// the status "Quantum resistance" field: either Rosenpass (the remote advertised a
+// Rosenpass key) or the ML-KEM exchange (a PQ PSK has been derived for this peer).
+func (conn *Conn) quantumResistant(remoteRosenpassPubKey []byte, pqEstablished bool) bool {
+	return isRosenpassEnabled(remoteRosenpassPubKey) || pqEstablished
+}
+
 func evalConnStatus(in connStatusInputs) guard.ConnStatus {
 	// "Relay up and needed" — the peer uses relay and the transport is connected.
 	relayUsedAndUp := in.peerUsesRelay && in.relayConnected
@@ -1064,16 +1228,3 @@ func boolToConnStatus(connected bool) guard.ConnStatus {
 	}
 	return guard.ConnStatusDisconnected
 }
-
-func metricsConnType(priority conntype.ConnPriority) metrics.ConnectionType {
-	switch priority {
-	case conntype.Relay:
-		return metrics.ConnectionTypeRelay
-	case conntype.ICETurn:
-		return metrics.ConnectionTypeICETurn
-	case conntype.ICEP2P:
-		return metrics.ConnectionTypeICEP2P
-	default:
-		return metrics.ConnectionTypeUnknown
-	}
-}

client/internal/peer/conn_pq_test.go

@@ -0,0 +1,90 @@
+package peer
+
+import (
+	"net/netip"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/require"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+)
+
+// fakePQ is a minimal PQHandshaker: only PSK is exercised by presharedKey, the rest
+// are no-op stubs to satisfy the interface.
+type fakePQ struct {
+	psk wgtypes.Key
+	ok  bool
+}
+
+func (f fakePQ) OfferPayload(string) ([]byte, uint16)          { return nil, 0 }
+func (f fakePQ) ShouldSendBootstrapOffer(string) bool          { return false }
+func (f fakePQ) AnswerPayload(string, []byte) ([]byte, uint16) { return nil, 0 }
+func (f fakePQ) OnAnswer(string, []byte)                       {}
+func (f fakePQ) PSK(string) (wgtypes.Key, bool)                { return f.psk, f.ok }
+func (f fakePQ) SetRemoteAddr(string, netip.AddrPort)          {}
+func (f fakePQ) OnDataPathRekeyed(string, time.Duration)       {}
+func (f fakePQ) OnDataPathDown(string)                         {}
+
+// TestConn_presharedKey_PQ covers the post-quantum branch of presharedKey across the
+// three states that matter: a derived PSK is programmed, and — before one exists —
+// strict mode blocks with a sentinel while non-strict falls open to the ordinary key.
+func TestConn_presharedKey_PQ(t *testing.T) {
+	derivedPSK, err := wgtypes.GenerateKey()
+	require.NoError(t, err)
+	nbPSK, err := wgtypes.GenerateKey()
+	require.NoError(t, err)
+
+	newConn := func() *Conn {
+		return &Conn{
+			Log: log.WithField("peer", "pq-test"),
+			config: ConnConfig{
+				Key:             "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
+				LocalKey:        "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
+				WgConfig:        WgConfig{PreSharedKey: &nbPSK},
+				RosenpassConfig: RosenpassConfig{},
+			},
+		}
+	}
+
+	t.Run("derived PSK is programmed", func(t *testing.T) {
+		for _, strict := range []bool{false, true} {
+			c := newConn()
+			c.config.PQ = fakePQ{psk: derivedPSK, ok: true}
+			c.config.PQStrict = strict
+			if strict {
+				sentinel, err := wgtypes.GenerateKey()
+				require.NoError(t, err)
+				c.pqStrictSentinelKey = &sentinel
+			}
+			pqPSK, _ := c.pqPSK()
+			got := c.presharedKey(nil, pqPSK)
+			require.NotNil(t, got)
+			require.Equal(t, derivedPSK, *got, "the derived PQ PSK must win (strict=%v)", strict)
+		}
+	})
+
+	t.Run("non-strict falls open to the ordinary key before a PSK exists", func(t *testing.T) {
+		c := newConn()
+		c.config.PQ = fakePQ{ok: false}
+		c.config.PQStrict = false
+		pqPSK, _ := c.pqPSK()
+		got := c.presharedKey(nil, pqPSK)
+		require.NotNil(t, got, "non-strict must not block")
+		require.Equal(t, nbPSK, *got, "non-strict falls through to the NetBird PSK, not a sentinel")
+	})
+
+	t.Run("strict blocks with the per-conn sentinel before a PSK exists", func(t *testing.T) {
+		sentinel, err := wgtypes.GenerateKey()
+		require.NoError(t, err)
+		c := newConn()
+		c.config.PQ = fakePQ{ok: false}
+		c.config.PQStrict = true
+		c.pqStrictSentinelKey = &sentinel
+		pqPSK, _ := c.pqPSK()
+		got := c.presharedKey(nil, pqPSK)
+		require.NotNil(t, got)
+		require.Equal(t, sentinel, *got, "strict must return the blocking sentinel")
+		require.NotEqual(t, nbPSK, *got, "the sentinel must not be the ordinary key")
+	})
+}

client/internal/peer/conn_test.go

@@ -11,8 +11,6 @@ import (
 	"github.com/stretchr/testify/assert"
 
 	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/internal/metrics"
-	"github.com/netbirdio/netbird/client/internal/peer/conntype"
 	"github.com/netbirdio/netbird/client/internal/peer/dispatcher"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	"github.com/netbirdio/netbird/client/internal/peer/ice"
@@ -257,8 +255,8 @@ func TestConn_presharedKey(t *testing.T) {
 			}
 			conn2.config.RosenpassConfig.PermissiveMode = test.conn2Permissive
 
-			conn1PresharedKey := conn1.presharedKey(conn2.config.RosenpassConfig.PubKey)
-			conn2PresharedKey := conn2.presharedKey(conn1.config.RosenpassConfig.PubKey)
+			conn1PresharedKey := conn1.presharedKey(conn2.config.RosenpassConfig.PubKey, nil)
+			conn2PresharedKey := conn2.presharedKey(conn1.config.RosenpassConfig.PubKey, nil)
 
 			if test.conn1ExpectedInitialKey {
 				if conn1PresharedKey == nil {
@@ -296,14 +294,14 @@ func TestConn_presharedKey_RosenpassManaged(t *testing.T) {
 	// When Rosenpass has already initialized the PSK for this peer,
 	// presharedKey must return nil to avoid UpdatePeer overwriting it.
 	conn.rosenpassInitializedPresharedKeyValidator = func(peerKey string) bool { return true }
-	if k := conn.presharedKey([]byte("remote")); k != nil {
+	if k := conn.presharedKey([]byte("remote"), nil); k != nil {
 		t.Fatalf("expected nil presharedKey when Rosenpass manages PSK, got %v", k)
 	}
 
 	// When Rosenpass hasn't taken over yet, presharedKey should provide
 	// a non-nil initial key (deterministic or from NetBird PSK).
 	conn.rosenpassInitializedPresharedKeyValidator = func(peerKey string) bool { return false }
-	if k := conn.presharedKey([]byte("remote")); k == nil {
+	if k := conn.presharedKey([]byte("remote"), nil); k == nil {
 		t.Fatalf("expected non-nil presharedKey before Rosenpass manages PSK")
 	}
 }
@@ -388,33 +386,3 @@ func TestConn_onWGDisconnected_NoEscalationWithoutRosenpass(t *testing.T) {
 	}
 	assert.Empty(t, disconnected, "escalation must be limited to rosenpass connections")
 }
-
-func TestMetricsConnType(t *testing.T) {
-	tests := []struct {
-		name     string
-		priority conntype.ConnPriority
-		expected metrics.ConnectionType
-	}{
-		{"relay", conntype.Relay, metrics.ConnectionTypeRelay},
-		{"ice over turn is relayed, not p2p", conntype.ICETurn, metrics.ConnectionTypeICETurn},
-		{"direct p2p", conntype.ICEP2P, metrics.ConnectionTypeICEP2P},
-		{"unset priority is unknown, not p2p", conntype.None, metrics.ConnectionTypeUnknown},
-		{"unrecognised priority is unknown", conntype.ConnPriority(99), metrics.ConnectionTypeUnknown},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.expected, metricsConnType(tc.priority))
-		})
-	}
-}
-
-func TestMetricsConnType_RelayedMatchesIsRelayed(t *testing.T) {
-	for _, priority := range []conntype.ConnPriority{conntype.None, conntype.Relay, conntype.ICETurn, conntype.ICEP2P} {
-		conn := &Conn{currentConnPriority: priority}
-		tag := metricsConnType(priority)
-		relayedTag := tag == metrics.ConnectionTypeRelay || tag == metrics.ConnectionTypeICETurn
-		assert.Equal(t, conn.isRelayed(), relayedTag,
-			"priority %s: isRelayed and the %q metric tag must agree", priority, tag)
-	}
-}

client/internal/peer/endpoint.go

@@ -88,7 +88,7 @@ func (e *EndpointUpdater) configureAsResponder(addr *net.UDPAddr, presharedKey *
 	var ctx context.Context
 	ctx, e.cancelFunc = context.WithCancel(context.Background())
 	e.updateWg.Add(1)
-	go e.scheduleDelayedUpdate(ctx, addr, presharedKey)
+	go e.scheduleDelayedUpdate(ctx, addr)
 
 	if err := e.updateWireGuardPeer(nil, presharedKey); err != nil {
 		e.waitForCloseTheDelayedUpdate()
@@ -107,8 +107,14 @@ func (e *EndpointUpdater) waitForCloseTheDelayedUpdate() {
 	e.updateWg.Wait()
 }
 
-// scheduleDelayedUpdate waits for the fallback period before updating the endpoint
-func (e *EndpointUpdater) scheduleDelayedUpdate(ctx context.Context, addr *net.UDPAddr, presharedKey *wgtypes.Key) {
+// scheduleDelayedUpdate waits for the fallback period, then sets the responder's real
+// endpoint. It deliberately passes a nil preshared key so it only updates the endpoint
+// and leaves the current PSK untouched: the PSK captured when this was scheduled may be
+// stale by now (e.g. the post-quantum bootstrap derived a fresher PSK within the
+// fallback window, applied via SetPresharedKey), and re-applying the captured one would
+// revert WireGuard to a key the remote peer no longer uses — a mismatch that stalls the
+// handshake until the next retry.
+func (e *EndpointUpdater) scheduleDelayedUpdate(ctx context.Context, addr *net.UDPAddr) {
 	defer e.updateWg.Done()
 	t := time.NewTimer(fallbackDelay)
 	defer t.Stop()
@@ -117,7 +123,7 @@ func (e *EndpointUpdater) scheduleDelayedUpdate(ctx context.Context, addr *net.U
 	case <-ctx.Done():
 		return
 	case <-t.C:
-		if err := e.updateWireGuardPeer(addr, presharedKey); err != nil {
+		if err := e.updateWireGuardPeer(addr, nil); err != nil {
 			e.log.Errorf("failed to update WireGuard peer, address: %s, error: %v", addr, err)
 		}
 	}

client/internal/peer/handshaker.go

@@ -39,6 +39,16 @@ type OfferAnswer struct {
 	// This value is the local Rosenpass server address when sending the message
 	RosenpassAddr string
 
+	// MlkemPayload carries the post-quantum X25519MLKEM768 handshake message
+	// (pqkem-framed offer on an OFFER, answer on an ANSWER) that seeds the
+	// WireGuard PSK. Opaque here — the pqkem library frames and parses it. Nil
+	// when the peer does not run the ML-KEM PQ exchange.
+	MlkemPayload []byte
+
+	// MlkemPort is the peer's ML-KEM PQ service UDP port (bound on its WG overlay
+	// IP) where data-path rekey messages are sent. Zero when not running the exchange.
+	MlkemPort uint16
+
 	// relay server address
 	RelaySrvAddress string
 	// RelaySrvIP is the IP the remote peer is connected to on its
@@ -81,14 +91,20 @@ type Handshaker struct {
 
 func NewHandshaker(log *log.Entry, config ConnConfig, signaler *Signaler, ice *WorkerICE, relay *WorkerRelay, metricsStages *MetricsStages) *Handshaker {
 	h := &Handshaker{
-		log:            log,
-		config:         config,
-		signaler:       signaler,
-		ice:            ice,
-		relay:          relay,
-		metricsStages:  metricsStages,
-		remoteOffersCh: make(chan OfferAnswer),
-		remoteAnswerCh: make(chan OfferAnswer),
+		log:           log,
+		config:        config,
+		signaler:      signaler,
+		ice:           ice,
+		relay:         relay,
+		metricsStages: metricsStages,
+		// Buffered by 1: the single Listen goroutine can be busy handling an offer
+		// (sendAnswer does a blocking signal send) exactly when the matching answer
+		// arrives on the other channel. Unbuffered, that answer would hit the
+		// non-blocking send's default and be dropped — fatal for the post-quantum
+		// exchange, which needs the answer to converge. A 1-slot cushion lets it wait
+		// until Listen loops back, without ever blocking the signal receiver.
+		remoteOffersCh: make(chan OfferAnswer, 1),
+		remoteAnswerCh: make(chan OfferAnswer, 1),
 	}
 	// assume remote supports ICE until we learn otherwise from received offers
 	h.remoteICESupported.Store(ice != nil)
@@ -111,44 +127,9 @@ func (h *Handshaker) Listen(ctx context.Context) {
 	for {
 		select {
 		case remoteOfferAnswer := <-h.remoteOffersCh:
-			h.log.Infof("received offer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
-
-			// Record signaling received for reconnection attempts
-			if h.metricsStages != nil {
-				h.metricsStages.RecordSignalingReceived()
-			}
-
-			h.updateRemoteICEState(&remoteOfferAnswer)
-
-			if h.relayListener != nil {
-				h.relayListener.Notify(&remoteOfferAnswer)
-			}
-
-			if h.iceListener != nil && h.RemoteICESupported() {
-				h.iceListener(&remoteOfferAnswer)
-			}
-
-			if err := h.sendAnswer(); err != nil {
-				h.log.Errorf("failed to send remote offer confirmation: %s", err)
-				continue
-			}
+			h.handleRemoteOffer(remoteOfferAnswer)
 		case remoteOfferAnswer := <-h.remoteAnswerCh:
-			h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
-
-			// Record signaling received for reconnection attempts
-			if h.metricsStages != nil {
-				h.metricsStages.RecordSignalingReceived()
-			}
-
-			h.updateRemoteICEState(&remoteOfferAnswer)
-
-			if h.relayListener != nil {
-				h.relayListener.Notify(&remoteOfferAnswer)
-			}
-
-			if h.iceListener != nil && h.RemoteICESupported() {
-				h.iceListener(&remoteOfferAnswer)
-			}
+			h.handleRemoteAnswer(remoteOfferAnswer)
 		case <-ctx.Done():
 			h.log.Infof("stop listening for remote offers and answers")
 			return
@@ -156,6 +137,119 @@ func (h *Handshaker) Listen(ctx context.Context) {
 	}
 }
 
+// onSignalReceived runs the common preamble for a received offer/answer: record the
+// signalling metric, refresh the remote ICE state, and register the peer's post-quantum
+// data-path endpoint learned from the message.
+func (h *Handshaker) onSignalReceived(remoteOfferAnswer *OfferAnswer) {
+	if h.metricsStages != nil {
+		h.metricsStages.RecordSignalingReceived()
+	}
+	h.updateRemoteICEState(remoteOfferAnswer)
+	h.pqRegisterEndpoint(remoteOfferAnswer.MlkemPort)
+}
+
+// notifyListeners hands the offer/answer to the relay and ICE workers so they bring the
+// connection up.
+func (h *Handshaker) notifyListeners(remoteOfferAnswer *OfferAnswer) {
+	if h.relayListener != nil {
+		h.relayListener.Notify(remoteOfferAnswer)
+	}
+	if h.iceListener != nil && h.RemoteICESupported() {
+		h.iceListener(remoteOfferAnswer)
+	}
+}
+
+func (h *Handshaker) handleRemoteOffer(remoteOfferAnswer OfferAnswer) {
+	h.log.Infof("received offer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+	h.onSignalReceived(&remoteOfferAnswer)
+
+	// If we are the controller running the KEM, a responder's offer is handled by
+	// replying with our own KEM offer, not by answering it (see pqControllerReoffer).
+	if h.pqControllerReoffer() {
+		return
+	}
+
+	// Derive+store the KEM PSK (inside sendAnswer's AnswerPayload) BEFORE bringing up the
+	// connection: the relay/ICE workers configure the WG endpoint, which pulls the PSK
+	// for the first handshake. Notifying them first would race the KEM exchange and hand
+	// the first handshake a not-yet-derived key.
+	if err := h.sendAnswer(&remoteOfferAnswer); err != nil {
+		h.log.Errorf("failed to send remote offer confirmation: %s", err)
+		return
+	}
+	h.notifyListeners(&remoteOfferAnswer)
+}
+
+func (h *Handshaker) handleRemoteAnswer(remoteOfferAnswer OfferAnswer) {
+	h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+	h.onSignalReceived(&remoteOfferAnswer)
+
+	// Feed the KEM answer (derive+store PSK) BEFORE bringing up the connection so the WG
+	// endpoint config pulls the real PSK for the first handshake instead of racing ahead
+	// of the KEM exchange.
+	if h.config.PQ != nil {
+		h.config.PQ.OnAnswer(h.config.Key, remoteOfferAnswer.MlkemPayload)
+	}
+	h.notifyListeners(&remoteOfferAnswer)
+}
+
+// pqControllerReoffer handles a responder's offer when we are the controller running the
+// KEM. The KEM material rides only the controller's offer, so the two peers derive a
+// single shared PSK (a bidirectional KEM would yield two different PSKs and WireGuard
+// would pick misaligned ones). Rather than answer the responder's (KEM-less) offer —
+// which would bring WireGuard up on a pre-PQ key before the KEM completes — we reply with
+// our own KEM offer, so the only transaction that establishes the tunnel is the one that
+// also derives the PSK. It also guarantees a responder-initiated wake still triggers a
+// KEM offer (no stuck responder). Sent exactly once per exchange; further offers while
+// one is in flight are ignored (re-sending on every responder offer would be a runaway).
+// The re-offer reuses our stable ICE session id, so the peer dedups repeats.
+//
+// Returns true when it took ownership of the offer (the caller must not answer it).
+func (h *Handshaker) pqControllerReoffer() bool {
+	if h.config.PQ == nil || !isController(h.config) {
+		return false
+	}
+	if h.config.PQ.ShouldSendBootstrapOffer(h.config.Key) {
+		h.log.Debugf("pqkem: controller received a responder offer, replying with our KEM offer instead of an answer")
+		if err := h.sendOffer(); err != nil {
+			h.log.Errorf("failed to send KEM offer in response to peer offer: %s", err)
+		}
+	} else {
+		h.log.Debugf("pqkem: controller received a responder offer but a KEM exchange is already in flight, ignoring")
+	}
+	return true
+}
+
+// pqRegisterEndpoint feeds the post-quantum handshaker the peer's data-path endpoint
+// (its WG overlay IP plus the advertised pq UDP port) learned from a remote offer/answer.
+func (h *Handshaker) pqRegisterEndpoint(remotePort uint16) {
+	if h.config.PQ == nil {
+		return
+	}
+	overlay, ok := h.pqPeerOverlayAddr()
+	if !ok {
+		return
+	}
+	// remotePort may be 0 (the peer omitted it, meaning the default port); the adapter
+	// resolves 0 to DefaultPort.
+	h.config.PQ.SetRemoteAddr(h.config.Key, netip.AddrPortFrom(overlay, remotePort))
+}
+
+// pqPeerOverlayAddr returns the peer's IPv4 overlay address for the pq data path. A
+// RemotePeerConfig carries only the peer overlay (v4 /32, optionally v6 /128) — served
+// routes are programmed on WireGuard separately and never land in WgConfig.AllowedIps —
+// so AllowedIps[0] is the v4 overlay, matching conn.AllowedIP(). The transport is v4
+// (the overlay always has v4; v6 is additive). Returns false when no v4 overlay exists.
+func (h *Handshaker) pqPeerOverlayAddr() (netip.Addr, bool) {
+	if len(h.config.WgConfig.AllowedIps) == 0 {
+		return netip.Addr{}, false
+	}
+	if a := h.config.WgConfig.AllowedIps[0].Addr().Unmap(); a.Is4() {
+		return a, true
+	}
+	return netip.Addr{}, false
+}
+
 func (h *Handshaker) SendOffer() error {
 	h.mu.Lock()
 	defer h.mu.Unlock()
@@ -195,13 +289,23 @@ func (h *Handshaker) sendOffer() error {
 	}
 
 	offer := h.buildOfferAnswer()
+	if h.config.PQ != nil {
+		offer.MlkemPayload, offer.MlkemPort = h.config.PQ.OfferPayload(h.config.Key)
+	}
 	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
 
 	return h.signaler.SignalOffer(offer, h.config.Key)
 }
 
-func (h *Handshaker) sendAnswer() error {
+func (h *Handshaker) sendAnswer(remoteOffer *OfferAnswer) error {
 	answer := h.buildOfferAnswer()
+	if h.config.PQ != nil {
+		var recvOffer []byte
+		if remoteOffer != nil {
+			recvOffer = remoteOffer.MlkemPayload
+		}
+		answer.MlkemPayload, answer.MlkemPort = h.config.PQ.AnswerPayload(h.config.Key, recvOffer)
+	}
 	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
 
 	return h.signaler.SignalAnswer(answer, h.config.Key)

client/internal/peer/iface.go

@@ -10,6 +10,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
+	"github.com/netbirdio/netbird/monotime"
 )
 
 type WGIface interface {
@@ -19,4 +20,11 @@ type WGIface interface {
 	GetProxy() wgproxy.Proxy
 	Address() wgaddr.Address
 	RemoveEndpointAddress(key string) error
+	// LastActivities returns the last real-data activity time per peer (WireGuard
+	// keepalives excluded), used to gate post-quantum PSK rotation on active tunnels.
+	LastActivities() map[string]monotime.Time
+	// IsUserspaceBind reports whether WireGuard runs in userspace. Only there does
+	// LastActivities track per-peer data activity; in kernel mode it is unavailable,
+	// so PSK rotation cannot be gated on activity.
+	IsUserspaceBind() bool
 }

client/internal/peer/signaler.go

@@ -63,6 +63,8 @@ func (s *Signaler) signalOfferAnswer(offerAnswer OfferAnswer, remoteKey string,
 		},
 		RosenpassPubKey: offerAnswer.RosenpassPubKey,
 		RosenpassAddr:   offerAnswer.RosenpassAddr,
+		MlkemPayload:    offerAnswer.MlkemPayload,
+		MlkemPort:       int(offerAnswer.MlkemPort),
 		RelaySrvAddress: offerAnswer.RelaySrvAddress,
 		RelaySrvIP:      offerAnswer.RelaySrvIP,
 		SessionID:       sessionIDBytes,

client/internal/pqkem/bench_test.go

@@ -0,0 +1,71 @@
+package pqkem
+
+import (
+	"crypto/ecdh"
+	"crypto/mlkem"
+	"crypto/rand"
+	"testing"
+)
+
+func BenchmarkX25519Keygen(b *testing.B) {
+	c := ecdh.X25519()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if _, err := c.GenerateKey(rand.Reader); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkX25519ECDH(b *testing.B) {
+	c := ecdh.X25519()
+	a, err := c.GenerateKey(rand.Reader)
+	if err != nil {
+		b.Fatal(err)
+	}
+	p, err := c.GenerateKey(rand.Reader)
+	if err != nil {
+		b.Fatal(err)
+	}
+	pub := p.PublicKey()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if _, err := a.ECDH(pub); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkMLKEMKeygen(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		if _, err := mlkem.GenerateKey768(); err != nil {
+			b.Fatal(err)
+		}
+	}
+}
+
+func BenchmarkMLKEMEncaps(b *testing.B) {
+	dk, err := mlkem.GenerateKey768()
+	if err != nil {
+		b.Fatal(err)
+	}
+	ek := dk.EncapsulationKey()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_, _ = ek.Encapsulate()
+	}
+}
+
+func BenchmarkMLKEMDecaps(b *testing.B) {
+	dk, err := mlkem.GenerateKey768()
+	if err != nil {
+		b.Fatal(err)
+	}
+	_, ct := dk.EncapsulationKey().Encapsulate()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		if _, err := dk.Decapsulate(ct); err != nil {
+			b.Fatal(err)
+		}
+	}
+}

client/internal/pqkem/callbacks.go

@@ -0,0 +1,18 @@
+package pqkem
+
+// CallbackHandler is implemented by the host and invoked by the library. The
+// library only reports events; the host owns the reaction. Keeping this an
+// interface — rather than touching the transport or keying directly — is what lets
+// the KEM code be extracted as a standalone library.
+type CallbackHandler interface {
+	// OnNewPSKReady fires when a fresh post-quantum PSK has been derived for a peer
+	// and must be programmed into the consumer's secure channel. It is invoked at
+	// the commit point of each side: the initiator on receiving the answer, the
+	// responder on receiving the confirm.
+	OnNewPSKReady(remoteID RemoteID, psk PSK) error
+
+	// OnRekeyFailed fires when an exchange fails to converge within the allotted
+	// time. The host should tear the peer connection down so it re-establishes, and
+	// log a WARN. The library reports the event; it does not dictate the reaction.
+	OnRekeyFailed(remoteID RemoteID) error
+}

client/internal/pqkem/capability_test.go

@@ -0,0 +1,66 @@
+package pqkem
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestManager_NonCapablePeerNotOffered: a peer known not to run the KEM (it advertised
+// no PQ port over signalling) is never offered an exchange, and no failure is raised —
+// this is what stops the reoffer storm against non-PQ peers (e.g. Rosenpass peers).
+func TestManager_NonCapablePeerNotOffered(t *testing.T) {
+	wg := newFakeWG()
+	d := NewManager("bbbb", wg, nil) // initiator vs "aaaa"
+	d.Start(&loopback{ep: epB, sw: newSwitch()})
+	defer d.Stop()
+
+	d.MarkNonCapable("aaaa")
+
+	offer, err := d.SignalOffer("aaaa")
+	require.NoError(t, err)
+	assert.Nil(t, offer, "a non-capable peer must not be offered a KEM exchange")
+	assert.Empty(t, wg.failed, "a non-capable peer must not raise a rekey failure")
+}
+
+// TestManager_MarkNonCapableCancelsInFlight: if we start an exchange with a peer whose
+// capability is not yet known and then learn it does not run the KEM, the in-flight
+// exchange is cancelled and no further offer is produced (no timeout -> no failure).
+func TestManager_MarkNonCapableCancelsInFlight(t *testing.T) {
+	wg := newFakeWG()
+	d := NewManager("bbbb", wg, nil)
+	d.Start(&loopback{ep: epB, sw: newSwitch()})
+	defer d.Stop()
+
+	// Capability unknown -> the bootstrap offer goes out optimistically.
+	offer, err := d.SignalOffer("aaaa")
+	require.NoError(t, err)
+	require.NotNil(t, offer)
+
+	// Now we learn the peer is non-PQ: the exchange must be dropped.
+	d.MarkNonCapable("aaaa")
+
+	next, err := d.SignalOffer("aaaa")
+	require.NoError(t, err)
+	assert.Nil(t, next, "after learning non-capability the peer is no longer offered")
+	assert.Empty(t, wg.failed, "cancelling an in-flight exchange must not raise a failure")
+}
+
+// TestManager_EstablishedPeerNotDowngraded: a stray zero-port observation must not tear
+// down a peer we already have a working PQ session with.
+func TestManager_EstablishedPeerNotDowngraded(t *testing.T) {
+	dA, dB, _, wgB, _ := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	bootstrap(t, dA, dB)
+	require.NotEqual(t, PSK{}, wgB.psk("aaaa"), "established a PSK")
+
+	dB.MarkNonCapable("aaaa") // stray zero after establishment
+
+	// The peer keeps its derived PSK (MarkNonCapable is a no-op once established).
+	psk, ok := dB.PSK("aaaa")
+	assert.True(t, ok, "an established peer must keep its PSK despite a stray zero")
+	assert.NotEqual(t, PSK{}, psk)
+}

client/internal/pqkem/concurrency_test.go

@@ -0,0 +1,77 @@
+package pqkem
+
+import (
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestConcurrency_RecoversViaResignalAfterDataPathBreak exercises the A-light recovery:
+// a data-path rotation can no longer converge (OnRekeyFailed), and re-bootstrapping over
+// signalling resyncs both peers on a fresh PSK — even while the data path stays broken,
+// since the signal channel is independent of it.
+func TestConcurrency_RecoversViaResignalAfterDataPathBreak(t *testing.T) {
+	dA, dB, wgA, wgB, lbB := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	// Tighten B's timings and make a single rotation miss raise OnRekeyFailed. Set
+	// before any exchange loop spawns (the loop reads these fields).
+	dB.retryInterval = 5 * time.Millisecond
+	dB.maxRetries = 2
+	dB.maxRekeyFailures = 1
+
+	bootstrap(t, dA, dB)
+	dA.OnDataPathRekeyed("bbbb", 0)
+	dB.OnDataPathRekeyed("aaaa", 0)
+	psk1 := wgB.psk("aaaa")
+	require.NotEqual(t, PSK{}, psk1)
+	require.Equal(t, psk1, wgA.psk("bbbb"), "converged on the same PSK after bootstrap+rotation")
+
+	// Data path breaks: the rotation can no longer converge -> OnRekeyFailed.
+	lbB.drop.Store(true)
+	_, err := dB.startExchangeTest("aaaa", false, ExchangeID{})
+	require.NoError(t, err)
+	require.Eventually(t, func() bool { return failedCount(wgB) >= 1 }, time.Second, 5*time.Millisecond)
+
+	// Recovery: re-bootstrap over signalling with the data path STILL broken. It must
+	// still converge (signal is independent of the data path) on a fresh PSK.
+	bootstrap(t, dA, dB)
+	psk2 := wgB.psk("aaaa")
+	require.NotEqual(t, psk1, psk2, "recovery derived a fresh PSK")
+	require.Equal(t, psk2, wgA.psk("bbbb"), "both sides resync after recovery")
+}
+
+// TestConcurrency_ConcurrentRekeysNoRace hammers both managers with concurrent rotation
+// clocks from many goroutines. Its primary job (with -race) is to prove the single-lock
+// state machine has no data races or deadlocks under contention; a final deterministic
+// bootstrap then asserts there is no split-brain (both sides on the same PSK).
+func TestConcurrency_ConcurrentRekeysNoRace(t *testing.T) {
+	dA, dB, wgA, wgB, _ := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	bootstrap(t, dA, dB)
+
+	var wg sync.WaitGroup
+	for g := 0; g < 8; g++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for i := 0; i < 50; i++ {
+				dB.OnDataPathRekeyed("aaaa", 0) // initiator chains a rotation
+				dA.OnDataPathRekeyed("bbbb", 0) // responder side is a no-op, still stresses the lock
+			}
+		}()
+	}
+	wg.Wait()
+
+	// The storm may leave an exchange mid-flight (concurrent cancellation). Force a
+	// clean convergence over signalling, then assert no split-brain.
+	bootstrap(t, dA, dB)
+	a, b := wgA.psk("bbbb"), wgB.psk("aaaa")
+	require.NotEqual(t, PSK{}, b)
+	require.Equal(t, a, b, "both sides converge on the same PSK, no split-brain")
+}

client/internal/pqkem/convergence.go

@@ -0,0 +1,291 @@
+package pqkem
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"time"
+)
+
+// idHex renders an exchange ID for logs.
+func idHex(id ExchangeID) string { return hex.EncodeToString(id[:]) }
+
+// pskFingerprint is a short, non-secret digest of a derived PSK: identical on both
+// peers iff they derived the same key. Logged instead of the raw PSK so debug logs
+// never carry the actual WireGuard preshared key.
+func pskFingerprint(psk PSK) string {
+	sum := sha256.Sum256(psk[:])
+	return hex.EncodeToString(sum[:8])
+}
+
+// startExchange creates a fresh initiator exchange (acknowledging ackID, zero for a
+// bootstrap) and returns the framed offer for the caller to send — pushed over the
+// data path for a chained rekey, or handed to the host for signalling when viaSignal
+// is set. Any previous in-flight exchange for the peer is cancelled.
+// startExchangeLocked must be called with m.mu held: the caller's idempotency check and
+// the exchange install stay under one lock acquisition so two concurrent starts for the
+// same peer cannot both create an exchange. It also refuses to start (and to Add to the
+// wait group) once the manager is stopping, so it never races Manager.Stop's Wait.
+func (m *Manager) startExchangeLocked(remoteID RemoteID, viaSignal bool, ackID ExchangeID) ([]byte, error) {
+	if m.rootCtx.Err() != nil {
+		return nil, fmt.Errorf("manager stopping")
+	}
+	init, err := NewInitiator()
+	if err != nil {
+		return nil, err
+	}
+	id, err := newExchangeID()
+	if err != nil {
+		return nil, err
+	}
+	raw, err := (&OfferMsg{ExchangeID: id, AckID: ackID, KEMOffer: init.Offer()}).Encode()
+	if err != nil {
+		return nil, err
+	}
+
+	ctx, cancel := context.WithCancel(m.rootCtx)
+	if old := m.exchanges[remoteID]; old != nil && old.cancel != nil {
+		old.cancel()
+	}
+	m.exchanges[remoteID] = &exchangeCtl{
+		id:        id,
+		state:     stateAwaitingAnswer,
+		startedAt: time.Now(),
+		cancel:    cancel,
+		lastSent:  raw,
+		initiator: init,
+		viaSignal: viaSignal,
+	}
+
+	m.wait.Add(1)
+	go m.initiatorLoop(ctx, remoteID, id)
+
+	via := "data-path"
+	if viaSignal {
+		via = "signal"
+	}
+	m.trace("pqkem: offer sent", "peer", remoteID, "exchange", idHex(id), "acks", idHex(ackID), "via", via)
+	return raw, nil
+}
+
+// processOffer (responder) first acknowledges the previous exchange the offer names
+// (that offer riding the data path under the freshly adopted key proves it worked),
+// then derives the PSK for the new offer, commits it optimistically, and returns the
+// framed answer. A duplicate offer returns the cached answer without re-deriving.
+func (m *Manager) processOffer(remoteID RemoteID, o *OfferMsg) ([]byte, error) {
+	m.trace("pqkem: offer received", "peer", remoteID, "exchange", idHex(o.ExchangeID), "acks", idHex(o.AckID))
+
+	if o.AckID != (ExchangeID{}) {
+		m.ackConverged(remoteID, o.AckID)
+	}
+
+	m.mu.Lock()
+	if ex := m.exchanges[remoteID]; ex != nil && ex.id == o.ExchangeID {
+		state, last := ex.state, ex.lastSent
+		m.mu.Unlock()
+		if state == stateReserved {
+			return nil, nil
+		}
+		m.trace("pqkem: duplicate offer, resending cached answer", "peer", remoteID, "exchange", idHex(o.ExchangeID))
+		return last, nil
+	}
+	// Reserve the slot so a concurrent duplicate offer bails.
+	m.exchanges[remoteID] = &exchangeCtl{id: o.ExchangeID, state: stateReserved, startedAt: time.Now()}
+	m.mu.Unlock()
+
+	answerBytes, psk, err := Respond(o.KEMOffer, m.binding(remoteID))
+	if err != nil {
+		return nil, err
+	}
+	raw, err := (&AnswerMsg{ExchangeID: o.ExchangeID, KEMAnswer: answerBytes}).Encode()
+	if err != nil {
+		return nil, err
+	}
+
+	m.mu.Lock()
+	ex := m.exchanges[remoteID]
+	if ex == nil || ex.id != o.ExchangeID {
+		m.mu.Unlock()
+		m.trace("pqkem: exchange superseded during respond, dropping answer", "peer", remoteID, "exchange", idHex(o.ExchangeID))
+		return nil, nil
+	}
+	ex.state = stateAwaitingAck
+	ex.lastSent = raw
+	ex.pendingPSK = psk
+	m.psks[remoteID] = psk
+	m.capable[remoteID] = true // a real KEM offer proves the peer runs the exchange
+	m.mu.Unlock()
+
+	m.trace("pqkem: new PSK derived", "peer", remoteID, "exchange", idHex(o.ExchangeID), "role", "responder", "psk_fp", pskFingerprint(psk))
+
+	// Commit optimistically so our data path can rekey to the new PSK.
+	if err := m.cbHandler.OnNewPSKReady(remoteID, psk); err != nil {
+		return nil, err
+	}
+	m.trace("pqkem: answer sent", "peer", remoteID, "exchange", idHex(o.ExchangeID))
+	return raw, nil
+}
+
+// processAnswer (initiator) derives and commits the PSK and parks in
+// stateAwaitingRekey; the next offer (chained from OnDataPathRekeyed) will acknowledge
+// this exchange. Only valid in stateAwaitingAnswer; advancing the state under the
+// lock makes a concurrent/duplicate answer bail.
+func (m *Manager) processAnswer(remoteID RemoteID, a *AnswerMsg) error {
+	m.mu.Lock()
+	ex := m.exchanges[remoteID]
+	if ex == nil || ex.id != a.ExchangeID || ex.state != stateAwaitingAnswer {
+		haveID := "none"
+		if ex != nil {
+			haveID = idHex(ex.id)
+		}
+		m.mu.Unlock()
+		m.trace("pqkem: unexpected answer dropped (inconsistency)", "peer", remoteID, "answer_for", idHex(a.ExchangeID), "have_exchange", haveID)
+		return nil
+	}
+	ex.state = stateAwaitingRekey
+	init := ex.initiator
+	ex.initiator = nil
+	m.mu.Unlock()
+
+	m.trace("pqkem: answer received", "peer", remoteID, "exchange", idHex(a.ExchangeID))
+
+	psk, err := init.Finish(a.KEMAnswer, m.binding(remoteID))
+	if err != nil {
+		// The state already advanced to stateAwaitingRekey and the initiator was cleared,
+		// so initiatorLoop would exit its default branch without registering a failure —
+		// leaving the peer desynced (the responder committed its PSK in processOffer).
+		// Drop the exchange and raise the failure so recovery re-bootstraps.
+		m.mu.Lock()
+		if cur := m.exchanges[remoteID]; cur != nil && cur.id == a.ExchangeID {
+			delete(m.exchanges, remoteID)
+		}
+		initial := !m.established[remoteID]
+		fail := m.registerFailureLocked(remoteID)
+		m.mu.Unlock()
+		m.raiseFailure(remoteID, fail, initial)
+		return err
+	}
+
+	// The initiator has converged: the responder must have derived the key to answer.
+	m.mu.Lock()
+	m.established[remoteID] = true
+	m.failures[remoteID] = 0
+	m.psks[remoteID] = psk
+	m.capable[remoteID] = true // a real KEM answer proves the peer runs the exchange
+	m.mu.Unlock()
+
+	m.trace("pqkem: new PSK derived", "peer", remoteID, "exchange", idHex(a.ExchangeID), "role", "initiator", "psk_fp", pskFingerprint(psk))
+
+	return m.cbHandler.OnNewPSKReady(remoteID, psk)
+}
+
+// ackConverged (responder) records convergence of the exchange named by ackID: a
+// later offer acknowledging it proves both sides operate on that exchange's key. Only
+// acts on a matching stateAwaitingAck exchange; anything else is ignored.
+func (m *Manager) ackConverged(remoteID RemoteID, ackID ExchangeID) {
+	m.mu.Lock()
+	ex := m.exchanges[remoteID]
+	if ex == nil || ex.id != ackID || ex.state != stateAwaitingAck {
+		m.mu.Unlock()
+		m.trace("pqkem: ack for unknown/mismatched exchange, ignored (inconsistency)", "peer", remoteID, "acks", idHex(ackID))
+		return
+	}
+	delete(m.exchanges, remoteID)
+	m.established[remoteID] = true
+	m.failures[remoteID] = 0
+	_ = time.Since(ex.startedAt) // convergence latency (metrics hook, later step)
+	m.mu.Unlock()
+
+	m.trace("pqkem: previous exchange confirmed by ack", "peer", remoteID, "exchange", idHex(ackID))
+}
+
+// initiatorLoop enforces the offer->answer convergence deadline and retransmits the
+// initiator's outstanding data-path offer while awaiting the answer (a
+// signalling-bootstrapped offer is retransmitted by the host, so it is not resent
+// here). Exhausting the deadline before the answer arrives is a failure. Once the
+// answer is in (state past awaitingAnswer) the loop exits: the next rotation is driven
+// by OnDataPathRekeyed, and the idle wait for it has no deadline.
+func (m *Manager) initiatorLoop(ctx context.Context, remoteID RemoteID, id ExchangeID) {
+	defer m.wait.Done()
+	t := time.NewTicker(m.retryInterval)
+	defer t.Stop()
+
+	attempts := 0
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			m.mu.Lock()
+			ex := m.exchanges[remoteID]
+			if ex == nil || ex.id != id {
+				m.mu.Unlock()
+				return
+			}
+
+			switch ex.state {
+			case stateAwaitingAnswer:
+				if attempts >= m.maxRetries {
+					delete(m.exchanges, remoteID)
+					initial := !m.established[remoteID]
+					fail := m.registerFailureLocked(remoteID)
+					m.mu.Unlock()
+					m.raiseFailure(remoteID, fail, initial)
+					return
+				}
+				viaSignal := ex.viaSignal
+				msg := ex.lastSent
+				attempts++
+				m.mu.Unlock()
+				if !viaSignal {
+					if err := m.pushDataPath(remoteID, msg); err != nil {
+						m.logger.Warn("pqkem: offer retransmit failed", "peer", remoteID, "err", err)
+					}
+				}
+
+			default:
+				// Past awaiting the answer (converged) or superseded: the loop's job
+				// is done. The next rotation is driven externally by OnDataPathRekeyed,
+				// so there is no deadline while idle-waiting for it (that wait can be
+				// as long as the transport's natural rekey interval).
+				m.mu.Unlock()
+				return
+			}
+		}
+	}
+}
+
+// registerFailureLocked applies policy B and reports whether OnRekeyFailed is due:
+// an initial exchange (peer never established) fails immediately; a rekey tolerates
+// up to maxRekeyFailures consecutive misses (we stay on the still-valid previous
+// PSK) before failing. Assumes m.mu is held.
+func (m *Manager) registerFailureLocked(remoteID RemoteID) bool {
+	if !m.established[remoteID] {
+		return true
+	}
+	m.failures[remoteID]++
+	if m.failures[remoteID] >= m.maxRekeyFailures {
+		m.failures[remoteID] = 0
+		return true
+	}
+	return false
+}
+
+// raiseFailure reports a convergence failure. initial distinguishes a never-established
+// peer (bootstrap failed → no PQ PSK at all; in strict mode the peer stays blocked =
+// "stuck") from a rekey failure (a previous PSK is still in force and traffic continues).
+func (m *Manager) raiseFailure(remoteID RemoteID, fail, initial bool) {
+	if !fail {
+		m.logger.Warn("pqkem: rekey attempt timed out, will retry next cycle", "peer", remoteID)
+		return
+	}
+	if initial {
+		m.logger.Warn("pqkem: initial exchange failed — no PQ PSK established for peer (strict mode keeps the peer blocked until it converges)", "peer", remoteID)
+	} else {
+		m.logger.Warn("pqkem: rekey failed after retries — staying on the previous PSK", "peer", remoteID)
+	}
+	if err := m.cbHandler.OnRekeyFailed(remoteID); err != nil {
+		m.logger.Error("pqkem: OnRekeyFailed handler error", "peer", remoteID, "err", err)
+	}
+}

client/internal/pqkem/convergence_test.go

@@ -0,0 +1,75 @@
+package pqkem
+
+import (
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// dropTransport is a pqkem.Transport that silently discards everything.
+type dropTransport struct{}
+
+func (dropTransport) Send(netip.AddrPort, []byte) error { return nil }
+func (dropTransport) LocalPort() int                    { return 0 }
+func (dropTransport) Run(func(netip.AddrPort, []byte))  {}
+func (dropTransport) Close() error                      { return nil }
+
+func failedCount(f *fakeWG) int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return len(f.failed)
+}
+
+func TestManager_InitialTimeoutFailsImmediately(t *testing.T) {
+	wg := newFakeWG()
+	d := NewManager("bbbb", wg, nil) // bbbb > aaaa -> initiator
+	d.Start(dropTransport{})
+	d.retryInterval = 5 * time.Millisecond
+	d.maxRetries = 3
+	defer d.Stop()
+
+	// Bootstrap offer is produced for signalling; no answer ever comes back -> the
+	// initial exchange fails fast.
+	offer, err := d.SignalOffer("aaaa")
+	require.NoError(t, err)
+	require.NotNil(t, offer)
+
+	assert.Eventually(t, func() bool { return failedCount(wg) == 1 }, time.Second, 5*time.Millisecond)
+}
+
+func TestManager_RekeyToleratesKFailures(t *testing.T) {
+	dA, dB, _, wgB, lbB := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	// Tighten B's timings before any exchange loop spawns (the loop reads these
+	// fields, so writing them after a loop is running would race).
+	dB.retryInterval = 5 * time.Millisecond
+	dB.maxRetries = 2
+
+	// Establish: bootstrap + data-path-rekeyed so B becomes established and its data
+	// path is usable.
+	bootstrap(t, dA, dB)
+	dA.OnDataPathRekeyed("bbbb", 0)
+	dB.OnDataPathRekeyed("aaaa", 0)
+	require.NotEqual(t, PSK{}, wgB.psk("aaaa"))
+
+	// Drop B's outbound so rekeys can no longer converge.
+	lbB.drop.Store(true)
+
+	// K-1 data-path rekeys must NOT raise OnRekeyFailed.
+	for i := 0; i < DefaultMaxRekeyFailures-1; i++ {
+		_, err := dB.startExchangeTest("aaaa", false, ExchangeID{})
+		require.NoError(t, err)
+		time.Sleep(50 * time.Millisecond)
+	}
+	assert.Equal(t, 0, failedCount(wgB), "no failure before K attempts")
+
+	// The K-th failure raises it once.
+	_, err := dB.startExchangeTest("aaaa", false, ExchangeID{})
+	require.NoError(t, err)
+	assert.Eventually(t, func() bool { return failedCount(wgB) == 1 }, time.Second, 5*time.Millisecond)
+}

client/internal/pqkem/env.go

@@ -0,0 +1,138 @@
+package pqkem
+
+import (
+	"context"
+	"log/slog"
+	"os"
+	"strconv"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// EnvEnabled is the environment variable that turns the ML-KEM post-quantum
+// exchange on for this client. Accepts on/off aliases plus anything
+// strconv.ParseBool understands (true/false/1/0).
+const EnvEnabled = "NB_ENABLE_PQ_MLKEM"
+
+// Enabled reports whether the ML-KEM PQ exchange is enabled via the environment.
+// An empty or unrecognized value is treated as disabled.
+func Enabled() bool {
+	raw := strings.ToLower(strings.TrimSpace(os.Getenv(EnvEnabled)))
+	switch raw {
+	case "":
+		return false
+	case "on":
+		return true
+	case "off":
+		return false
+	}
+	enabled, err := strconv.ParseBool(raw)
+	if err != nil {
+		log.Warnf("failed to parse %s value %q: %v", EnvEnabled, raw, err)
+		return false
+	}
+	return enabled
+}
+
+// EnvStrict enables strict (fail-closed) mode: block peer traffic until the ML-KEM
+// PSK has been established, instead of the default opportunistic behaviour that lets
+// the tunnel come up classically and upgrades to PQ once the exchange converges.
+const EnvStrict = "NB_PQ_MLKEM_STRICT"
+
+// Strict reports whether strict (fail-closed) mode is enabled via the environment.
+// An empty or unrecognized value is treated as disabled (opportunistic).
+func Strict() bool {
+	switch strings.ToLower(strings.TrimSpace(os.Getenv(EnvStrict))) {
+	case "on":
+		return true
+	case "", "off":
+		return false
+	}
+	enabled, err := strconv.ParseBool(strings.TrimSpace(os.Getenv(EnvStrict)))
+	if err != nil {
+		log.Warnf("failed to parse %s value %q: %v", EnvStrict, os.Getenv(EnvStrict), err)
+		return false
+	}
+	return enabled
+}
+
+// EnvLogLevel overrides the ML-KEM manager's slog level (trace/debug/info/warn/error).
+// Defaults to info. The verbose per-exchange lifecycle logs are emitted at trace.
+const EnvLogLevel = "NB_PQ_MLKEM_LOG_LEVEL"
+
+// LevelTrace is a custom slog level below Debug for the verbose per-exchange lifecycle
+// logs, so they stay off unless NB_PQ_MLKEM_LOG_LEVEL=trace (and the daemon log level
+// is trace, since the records are forwarded to logrus).
+const LevelTrace = slog.LevelDebug - 4
+
+// NewLogger builds the slog logger for the ML-KEM manager. It forwards records to
+// logrus so PQ logs land in the same sink as the rest of the daemon (console +
+// client.log) rather than stdout. Verbosity is gated by EnvLogLevel.
+func NewLogger() *slog.Logger {
+	return slog.New(slogToLogrus{})
+}
+
+func logLevel() slog.Level {
+	switch strings.ToLower(strings.TrimSpace(os.Getenv(EnvLogLevel))) {
+	case "trace":
+		return LevelTrace
+	case "debug":
+		return slog.LevelDebug
+	case "warn":
+		return slog.LevelWarn
+	case "error":
+		return slog.LevelError
+	default:
+		return slog.LevelInfo
+	}
+}
+
+// slogToLogrus is a slog.Handler that forwards records to logrus, so the ML-KEM
+// manager's logs go wherever the daemon's logrus is configured (console + client.log)
+// instead of stdout. Verbosity is gated by EnvLogLevel via logLevel().
+type slogToLogrus struct {
+	fields log.Fields
+}
+
+func (h slogToLogrus) Enabled(_ context.Context, level slog.Level) bool {
+	return level >= logLevel()
+}
+
+func (h slogToLogrus) Handle(_ context.Context, r slog.Record) error {
+	fields := make(log.Fields, len(h.fields)+r.NumAttrs())
+	for k, v := range h.fields {
+		fields[k] = v
+	}
+	r.Attrs(func(a slog.Attr) bool {
+		fields[a.Key] = a.Value.Any()
+		return true
+	})
+	entry := log.WithFields(fields)
+	switch {
+	case r.Level >= slog.LevelError:
+		entry.Error(r.Message)
+	case r.Level >= slog.LevelWarn:
+		entry.Warn(r.Message)
+	case r.Level >= slog.LevelInfo:
+		entry.Info(r.Message)
+	case r.Level >= slog.LevelDebug:
+		entry.Debug(r.Message)
+	default:
+		entry.Trace(r.Message)
+	}
+	return nil
+}
+
+func (h slogToLogrus) WithAttrs(attrs []slog.Attr) slog.Handler {
+	fields := make(log.Fields, len(h.fields)+len(attrs))
+	for k, v := range h.fields {
+		fields[k] = v
+	}
+	for _, a := range attrs {
+		fields[a.Key] = a.Value.Any()
+	}
+	return slogToLogrus{fields: fields}
+}
+
+func (h slogToLogrus) WithGroup(_ string) slog.Handler { return h }

client/internal/pqkem/kem.go

@@ -0,0 +1,183 @@
+// Package pqkem is a spike (NET-1406) for a post-quantum pre-shared-key exchange
+// that could replace Rosenpass. It performs an X25519MLKEM768 hybrid key
+// encapsulation and derives a 32-byte pre-shared key (PSK).
+//
+// The exchange is a single round trip designed to ride the (already
+// authenticated) Signal offer/answer channel:
+//
+//	initiator --Offer(1216B)--> responder
+//	initiator <--Answer(1120B)-- responder
+//
+// Both sides then hold the same PSK, which is bound to the two peers' identities
+// (their peer identity keys) so the derived key cannot be transplanted
+// to a different peer pair even if the transport authentication were bypassed.
+//
+// Combiner note: this follows draft-ietf-tls-ecdhe-mlkem for X25519MLKEM768 — on
+// the wire ML-KEM ‖ X25519 (the draft deliberately reversed the share order for
+// this group), and ML-KEM_ss ‖ X25519_ss as the KDF input. The PSK is derived with
+// HKDF-SHA256 over that hybrid secret, salted with a domain-separation label and
+// bound (via the HKDF info) to the full transcript and the canonicalised peer
+// identities.
+package pqkem
+
+import (
+	"crypto/ecdh"
+	"crypto/hkdf"
+	"crypto/mlkem"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+)
+
+const (
+	// OfferSize is the initiator message: ML-KEM-768 encapsulation key ‖ X25519 public key
+	// (share order per draft-ietf-tls-ecdhe-mlkem for X25519MLKEM768).
+	OfferSize = mlkem.EncapsulationKeySize768 + 32 // 1216
+	// AnswerSize is the responder message: ML-KEM-768 ciphertext ‖ X25519 public key.
+	AnswerSize = mlkem.CiphertextSize768 + 32 // 1120
+
+	pskLabel = "netbird-pq-psk-v1"
+)
+
+// PSK is the 32-byte derived pre-shared key handed to the consumer to key its channel.
+type PSK [32]byte
+
+// Binding identifies the peer pair the PSK is derived for. Callers set both
+// peer identity keys; the order does not matter (it is canonicalised).
+type Binding struct {
+	LocalID  []byte
+	RemoteID []byte
+}
+
+// Initiator holds the ephemeral secrets between Offer and Finish.
+type Initiator struct {
+	x25519  *ecdh.PrivateKey
+	mlkemDK *mlkem.DecapsulationKey768
+	offer   []byte
+}
+
+// NewInitiator generates the ephemeral X25519 + ML-KEM-768 keypairs.
+func NewInitiator() (*Initiator, error) {
+	x, err := ecdh.X25519().GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, fmt.Errorf("x25519 keygen: %w", err)
+	}
+	dk, err := mlkem.GenerateKey768()
+	if err != nil {
+		return nil, fmt.Errorf("ml-kem keygen: %w", err)
+	}
+
+	offer := make([]byte, 0, OfferSize)
+	offer = append(offer, dk.EncapsulationKey().Bytes()...)
+	offer = append(offer, x.PublicKey().Bytes()...)
+
+	return &Initiator{x25519: x, mlkemDK: dk, offer: offer}, nil
+}
+
+// Offer returns the initiator message to send over Signal.
+func (i *Initiator) Offer() []byte {
+	return i.offer
+}
+
+// Finish consumes the responder's answer and derives the PSK.
+func (i *Initiator) Finish(answer []byte, b Binding) (PSK, error) {
+	if len(answer) != AnswerSize {
+		return PSK{}, fmt.Errorf("answer: got %d bytes, want %d", len(answer), AnswerSize)
+	}
+	ct := answer[:mlkem.CiphertextSize768]
+	peerX := answer[mlkem.CiphertextSize768:]
+
+	ssMLKEM, err := i.mlkemDK.Decapsulate(ct)
+	if err != nil {
+		return PSK{}, fmt.Errorf("ml-kem decapsulate: %w", err)
+	}
+	pub, err := ecdh.X25519().NewPublicKey(peerX)
+	if err != nil {
+		return PSK{}, fmt.Errorf("parse peer x25519: %w", err)
+	}
+	ssX, err := i.x25519.ECDH(pub)
+	if err != nil {
+		return PSK{}, fmt.Errorf("x25519 ecdh: %w", err)
+	}
+
+	return derivePSK(ssMLKEM, ssX, i.offer, answer, b)
+}
+
+// Respond consumes an initiator offer, produces the answer, and derives the PSK.
+func Respond(offer []byte, b Binding) (answer []byte, psk PSK, err error) {
+	if len(offer) != OfferSize {
+		return nil, PSK{}, fmt.Errorf("offer: got %d bytes, want %d", len(offer), OfferSize)
+	}
+	peerEK := offer[:mlkem.EncapsulationKeySize768]
+	peerX := offer[mlkem.EncapsulationKeySize768:]
+
+	ek, err := mlkem.NewEncapsulationKey768(peerEK)
+	if err != nil {
+		return nil, PSK{}, fmt.Errorf("parse peer ml-kem key: %w", err)
+	}
+	ssMLKEM, ct := ek.Encapsulate()
+
+	x, err := ecdh.X25519().GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, PSK{}, fmt.Errorf("x25519 keygen: %w", err)
+	}
+	pub, err := ecdh.X25519().NewPublicKey(peerX)
+	if err != nil {
+		return nil, PSK{}, fmt.Errorf("parse peer x25519: %w", err)
+	}
+	ssX, err := x.ECDH(pub)
+	if err != nil {
+		return nil, PSK{}, fmt.Errorf("x25519 ecdh: %w", err)
+	}
+
+	answer = make([]byte, 0, AnswerSize)
+	answer = append(answer, ct...)
+	answer = append(answer, x.PublicKey().Bytes()...)
+
+	// derivePSK uses the same argument order on both sides; the responder's local
+	// binding is the mirror of the initiator's, canonicalised inside derivePSK.
+	psk, err = derivePSK(ssMLKEM, ssX, offer, answer, b)
+	if err != nil {
+		return nil, PSK{}, err
+	}
+	return answer, psk, nil
+}
+
+// derivePSK runs HKDF-SHA256 over the hybrid shared secret (ML-KEM_ss ‖ X25519_ss,
+// per draft-ietf-tls-ecdhe-mlkem), salted with the domain-separation label, and binds
+// the result — via the HKDF info — to the full transcript (offer ‖ answer) and the
+// canonicalised peer identities, so the PSK cannot be transplanted to another peer
+// pair or a different exchange.
+func derivePSK(ssMLKEM, ssX, offer, answer []byte, b Binding) (PSK, error) {
+	// A PSK not bound to both peer identities could be transplanted to a different peer
+	// pair, so refuse to derive one from an empty binding.
+	if len(b.LocalID) == 0 || len(b.RemoteID) == 0 {
+		return PSK{}, fmt.Errorf("empty peer identity binding")
+	}
+	lo, hi := canonicalPair(b.LocalID, b.RemoteID)
+
+	ikm := make([]byte, 0, len(ssMLKEM)+len(ssX))
+	ikm = append(ikm, ssMLKEM...)
+	ikm = append(ikm, ssX...)
+
+	info := make([]byte, 0, len(offer)+len(answer)+len(lo)+len(hi))
+	info = append(info, offer...)
+	info = append(info, answer...)
+	info = append(info, lo...)
+	info = append(info, hi...)
+
+	var psk PSK
+	key, err := hkdf.Key(sha256.New, ikm, []byte(pskLabel), string(info), len(psk))
+	if err != nil {
+		return PSK{}, fmt.Errorf("hkdf derive psk: %w", err)
+	}
+	copy(psk[:], key)
+	return psk, nil
+}
+
+func canonicalPair(a, b []byte) (lo, hi []byte) {
+	if string(a) <= string(b) {
+		return a, b
+	}
+	return b, a
+}

client/internal/pqkem/kem_framing_test.go

@@ -0,0 +1,105 @@
+package pqkem
+
+import (
+	"crypto/mlkem"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestExchange_TamperedCiphertextFailsClosed verifies the core fail-closed
+// property: mutating the ML-KEM ciphertext in the answer does not error (ML-KEM
+// uses implicit rejection — Decapsulate always returns a value) but yields a
+// different shared secret, so the initiator derives a PSK that does NOT match the
+// responder's. A mismatched PSK means WireGuard passes no bytes: tamper => no data.
+func TestExchange_TamperedCiphertextFailsClosed(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	tampered := append([]byte(nil), answer...)
+	tampered[0] ^= 0xff // flip a bit in the ML-KEM ciphertext
+
+	pskA, err := init.Finish(tampered, Binding{LocalID: wgA, RemoteID: wgB})
+	require.NoError(t, err, "implicit rejection: decapsulate still succeeds")
+	require.NotEqual(t, pskB, pskA, "tampered ciphertext must not yield the responder's PSK")
+}
+
+// TestExchange_TamperedX25519ShareDiverges flips a byte in the answer's X25519
+// share: the classical half of the hybrid secret changes, so the derived PSK
+// diverges from the responder's (fail-closed on the ECDH half too).
+func TestExchange_TamperedX25519ShareDiverges(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	tampered := append([]byte(nil), answer...)
+	tampered[mlkem.CiphertextSize768] ^= 0x01 // first byte of the X25519 public key
+
+	pskA, err := init.Finish(tampered, Binding{LocalID: wgA, RemoteID: wgB})
+	// Either the point is rejected (error) or the ECDH differs (different PSK);
+	// in both cases the honest PSK is never reproduced.
+	if err == nil {
+		require.NotEqual(t, pskB, pskA, "tampered X25519 share must not yield the responder's PSK")
+	}
+}
+
+// TestExchange_AllZeroX25519Rejected feeds an all-zero X25519 share (a low-order
+// point) in the answer. The stdlib ECDH must reject it, so Finish errors rather
+// than deriving a PSK from a degenerate secret.
+func TestExchange_AllZeroX25519Rejected(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	bad := append([]byte(nil), answer...)
+	for i := mlkem.CiphertextSize768; i < len(bad); i++ {
+		bad[i] = 0
+	}
+
+	_, err = init.Finish(bad, Binding{LocalID: wgA, RemoteID: wgB})
+	require.Error(t, err, "all-zero X25519 share (low-order point) must be rejected")
+}
+
+// TestExchange_SizeBoundaries locks the exact-length framing checks: one byte
+// short or long on either message is rejected, not silently truncated/padded.
+func TestExchange_SizeBoundaries(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+	offer := init.Offer()
+
+	_, _, err = Respond(offer[:OfferSize-1], Binding{})
+	require.Error(t, err, "offer one byte short")
+	_, _, err = Respond(append(append([]byte(nil), offer...), 0), Binding{})
+	require.Error(t, err, "offer one byte long")
+
+	answer, _, err := Respond(offer, Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	_, err = init.Finish(answer[:AnswerSize-1], Binding{LocalID: wgA, RemoteID: wgB})
+	require.Error(t, err, "answer one byte short")
+	_, err = init.Finish(append(append([]byte(nil), answer...), 0), Binding{LocalID: wgA, RemoteID: wgB})
+	require.Error(t, err, "answer one byte long")
+}
+
+// TestExchange_BindingIsSymmetric confirms the canonicalisation: the two peers
+// pass their identities in opposite (Local, Remote) order yet derive the same PSK,
+// so identity binding does not depend on who is initiator vs responder.
+func TestExchange_BindingIsSymmetric(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	pskA, err := init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
+	require.NoError(t, err)
+
+	require.Equal(t, pskB, pskA, "swapped Local/Remote order must canonicalise to the same PSK")
+}

client/internal/pqkem/kem_test.go

@@ -0,0 +1,106 @@
+package pqkem
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	wgA = []byte("peer-A-wireguard-pubkey-32bytes!")
+	wgB = []byte("peer-B-wireguard-pubkey-32bytes!")
+)
+
+func TestExchange_DerivesMatchingPSK(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	require.Len(t, init.Offer(), OfferSize)
+
+	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+	require.Len(t, answer, AnswerSize)
+
+	pskA, err := init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
+	require.NoError(t, err)
+
+	require.Equal(t, pskB, pskA, "both sides must derive the same PSK")
+	require.NotEqual(t, PSK{}, pskA, "PSK must not be zero")
+}
+
+func TestExchange_PSKBoundToPeerIdentities(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	// Finish twice over the SAME KEM material (same offer/answer/secrets), changing only
+	// the peer identity binding: the differing PSK is attributable to the binding alone.
+	pskHonest, err := init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
+	require.NoError(t, err)
+
+	wgC := []byte("peer-C-wireguard-pubkey-32bytes!")
+	pskWrong, err := init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgC})
+	require.NoError(t, err)
+
+	require.NotEqual(t, pskHonest, pskWrong, "PSK must be bound to the peer pair")
+}
+
+func TestExchange_RejectsEmptyBinding(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+	answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	// A PSK not bound to both identities could be transplanted to another peer pair.
+	_, err = init.Finish(answer, Binding{})
+	require.Error(t, err, "empty binding must be rejected")
+	_, err = init.Finish(answer, Binding{LocalID: wgA})
+	require.Error(t, err, "missing RemoteID must be rejected")
+	_, _, err = Respond(init.Offer(), Binding{RemoteID: wgA})
+	require.Error(t, err, "missing LocalID must be rejected")
+}
+
+func TestExchange_RejectsMalformedMessages(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+
+	_, _, err = Respond(init.Offer()[:10], Binding{})
+	require.Error(t, err)
+
+	_, err = init.Finish([]byte("too short"), Binding{})
+	require.Error(t, err)
+}
+
+// TestExchange_ReportSizesAndTiming is a spike measurement, not a pass/fail gate.
+// Run with: go test -run TestExchange_ReportSizesAndTiming -v ./client/internal/pqkem/
+func TestExchange_ReportSizesAndTiming(t *testing.T) {
+	const iters = 200
+
+	var tInit, tResp, tFinish time.Duration
+	for i := 0; i < iters; i++ {
+		s0 := time.Now()
+		init, err := NewInitiator()
+		require.NoError(t, err)
+		tInit += time.Since(s0)
+
+		s1 := time.Now()
+		answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+		require.NoError(t, err)
+		tResp += time.Since(s1)
+
+		s2 := time.Now()
+		_, err = init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
+		require.NoError(t, err)
+		tFinish += time.Since(s2)
+	}
+
+	t.Logf("wire sizes:   offer=%d B   answer=%d B   (Rosenpass static pubkey ~524160 B)", OfferSize, AnswerSize)
+	t.Logf("total on-wire per handshake: %d B  (~%.0fx smaller than RP static key)", OfferSize+AnswerSize, 524160.0/float64(OfferSize+AnswerSize))
+	t.Logf("avg NewInitiator (keygen): %s", tInit/iters)
+	t.Logf("avg Respond (encaps+dh):   %s", tResp/iters)
+	t.Logf("avg Finish (decaps+dh):    %s", tFinish/iters)
+	t.Logf("avg full handshake CPU:    %s", (tInit+tResp+tFinish)/iters)
+}

client/internal/pqkem/manager.go

@@ -0,0 +1,467 @@
+package pqkem
+
+import (
+	"context"
+	"crypto/rand"
+	"fmt"
+	"log/slog"
+	"net/netip"
+	"sync"
+	"time"
+)
+
+const (
+	// DefaultRetryInterval is how often the initiator retransmits its outstanding
+	// data-path offer while awaiting the answer.
+	DefaultRetryInterval = 2 * time.Second
+	// DefaultMaxRetries bounds how many ticks an exchange may run before it is
+	// declared failed. The convergence deadline is thus MaxRetries * RetryInterval.
+	DefaultMaxRetries = 10
+	// DefaultMaxRekeyFailures is how many consecutive rekey (non-initial) failures
+	// are tolerated before OnRekeyFailed. The initial exchange fails immediately.
+	DefaultMaxRekeyFailures = 3
+
+	// rotationActivityWindow gates rotation on recent real-data activity: a rekey
+	// clocks a rotation only if the peer exchanged user data within this window. It
+	// must stay shorter than the data path's rekey interval (WireGuard
+	// REKEY_AFTER_TIME ~120s) so the rotation's own traffic — which itself renews the
+	// activity signal — ages out before the next rekey, letting an idle tunnel stop
+	// rotating instead of self-sustaining.
+	rotationActivityWindow = 90 * time.Second
+)
+
+// LocalID and RemoteID are peer identity keys (e.g. WireGuard public keys). They are
+// distinct types so the local and a remote identity cannot be mixed up.
+type (
+	LocalID  string
+	RemoteID string
+)
+
+// Transport is the data-path socket the Manager drives (the analogue of
+// go-rosenpass's Conn). It is a dumb mover of bytes to/from endpoints: the Manager
+// owns the remoteID<->endpoint routing and hands the transport a resolved endpoint
+// to Send, and reverse-resolves the source of each inbound datagram. Its lifecycle
+// belongs to the Manager (Run at Start, Close at Stop).
+type Transport interface {
+	// Send delivers msg to the given data-path endpoint.
+	Send(endpoint netip.AddrPort, msg []byte) error
+	// LocalPort is the bound local UDP port, announced to peers so they know where
+	// to send data-path messages.
+	LocalPort() int
+	// Run starts delivering inbound datagrams as (source endpoint, msg) to onInbound
+	// and returns immediately; it runs until Close.
+	Run(onInbound func(src netip.AddrPort, msg []byte))
+	// Close stops delivery and releases the socket.
+	Close() error
+}
+
+// exchangeState is the single source of truth for an exchange's role and phase.
+type exchangeState uint8
+
+const (
+	stateReserved       exchangeState = iota // responder: deriving the answer
+	stateAwaitingAnswer                      // initiator: offer sent, awaiting the answer
+	stateAwaitingRekey                       // initiator: PSK derived+set, awaiting OnDataPathRekeyed to chain the next offer
+	stateAwaitingAck                         // responder: answer sent, awaiting the next offer that acks this exchange
+)
+
+// exchangeCtl holds all state for one in-flight exchange with a peer, under the
+// Manager's single lock. state drives every decision. lastSent is the current
+// data-path retransmit payload (the offer, for the initiator). initiator is the
+// ephemeral handle used at Finish; pendingPSK is the responder's derived key.
+// viaSignal records that the offer went to the host for the signalling channel, so
+// the loop does not retransmit it on the data path. Only the initiator runs a
+// retransmit loop, so only it sets cancel.
+type exchangeCtl struct {
+	id         ExchangeID
+	state      exchangeState
+	startedAt  time.Time
+	cancel     context.CancelFunc
+	lastSent   []byte
+	initiator  *Initiator
+	pendingPSK PSK
+	viaSignal  bool
+}
+
+// Manager is the stateful orchestrator — the analogue of go-rosenpass's Server. It
+// drives the X25519MLKEM768 exchange, owns the peer endpoint routing and the data-path
+// transport, and surfaces the derived PSK and convergence to the host via
+// CallbackHandler. It is event-driven: the bootstrap is triggered by the host
+// (SignalOffer) and each rotation is clocked by OnDataPathRekeyed. The cryptography is
+// the pure kem.go primitives; all state lives here under one lock.
+type Manager struct {
+	localID   LocalID
+	cbHandler CallbackHandler
+	logger    *slog.Logger
+
+	retryInterval    time.Duration
+	maxRetries       int
+	maxRekeyFailures int
+
+	rootCtx    context.Context
+	rootCancel context.CancelFunc
+
+	mu          sync.Mutex
+	transport   Transport
+	exchanges   map[RemoteID]*exchangeCtl   // in-flight exchange per peer
+	established map[RemoteID]bool           // peer has completed at least one exchange
+	failures    map[RemoteID]int            // consecutive rekey failures per peer
+	psks        map[RemoteID]PSK            // latest derived PSK per peer (pulled at WG peer-config time)
+	capable     map[RemoteID]bool           // peer runs the KEM (advertised a PQ port); false = known non-capable
+	peerAddrs   map[RemoteID]netip.AddrPort // remoteID -> data-path endpoint (send routing)
+	peersByAddr map[netip.AddrPort]RemoteID // reverse: source endpoint -> remoteID (inbound)
+	wait        sync.WaitGroup
+}
+
+// NewManager builds a manager for the local peer identified by its peer identity key
+// (used for the deterministic initiator role and the identity binding). A nil logger
+// falls back to slog.Default(). Install the data-path transport with Start.
+func NewManager(localID LocalID, h CallbackHandler, logger *slog.Logger) *Manager {
+	if logger == nil {
+		logger = slog.Default()
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	return &Manager{
+		localID:          localID,
+		cbHandler:        h,
+		logger:           logger,
+		retryInterval:    DefaultRetryInterval,
+		maxRetries:       DefaultMaxRetries,
+		maxRekeyFailures: DefaultMaxRekeyFailures,
+		rootCtx:          ctx,
+		rootCancel:       cancel,
+		exchanges:        make(map[RemoteID]*exchangeCtl),
+		established:      make(map[RemoteID]bool),
+		failures:         make(map[RemoteID]int),
+		psks:             make(map[RemoteID]PSK),
+		capable:          make(map[RemoteID]bool),
+		peerAddrs:        make(map[RemoteID]netip.AddrPort),
+		peersByAddr:      make(map[netip.AddrPort]RemoteID),
+	}
+}
+
+// Start installs the data-path transport and begins its inbound delivery. The Manager
+// owns it from here; Stop closes it.
+func (m *Manager) Start(t Transport) {
+	m.mu.Lock()
+	m.transport = t
+	m.mu.Unlock()
+	if t != nil {
+		t.Run(m.onDataPathInbound)
+	}
+}
+
+// LocalPort is the data-path transport's bound UDP port (0 if no transport), to be
+// announced to peers.
+func (m *Manager) LocalPort() int {
+	m.mu.Lock()
+	t := m.transport
+	m.mu.Unlock()
+	if t == nil {
+		return 0
+	}
+	return t.LocalPort()
+}
+
+// IsInitiator reports whether the local peer drives the exchange for this remote
+// peer. Roles are deterministic (lexicographic identity-key compare) so exactly one
+// side initiates, mirroring how Rosenpass picks its handshake initiator.
+func (m *Manager) IsInitiator(remoteID RemoteID) bool {
+	return string(m.localID) > string(remoteID)
+}
+
+// PSK returns the latest PSK derived for the peer, for the host to program at WG
+// peer-config time (the pull path). ok is false until an exchange has derived one.
+func (m *Manager) PSK(remoteID RemoteID) (PSK, bool) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	psk, ok := m.psks[remoteID]
+	return psk, ok
+}
+
+// trace logs at LevelTrace, the verbose per-exchange lifecycle level gated by
+// NB_PQ_MLKEM_LOG_LEVEL=trace.
+func (m *Manager) trace(msg string, args ...any) {
+	m.logger.Log(context.Background(), LevelTrace, msg, args...)
+}
+
+// AddPeer registers where a peer's data-path messages are sent and received: its
+// overlay endpoint (IP:port). This is pure routing and says nothing about capability —
+// PQ capability is decided solely from the peer's KEM payload (see processOffer /
+// processAnswer / MarkNonCapable), never from an endpoint or port.
+func (m *Manager) AddPeer(remoteID RemoteID, endpoint netip.AddrPort) {
+	if !endpoint.IsValid() {
+		return
+	}
+	m.mu.Lock()
+	if old, ok := m.peerAddrs[remoteID]; ok {
+		delete(m.peersByAddr, old)
+	}
+	m.peerAddrs[remoteID] = endpoint
+	m.peersByAddr[endpoint] = remoteID
+	m.mu.Unlock()
+}
+
+// MarkNonCapable records that a peer does not run the KEM: it answered our offer with
+// no KEM material over signalling (the capability signal is the peer's payload, not its
+// optional data-path port). Any in-flight exchange is cancelled and further offers are
+// suppressed (see SignalOffer), so a non-PQ peer never drives the rekey-recovery storm.
+// An already-established peer is left untouched — a stray empty answer must not tear
+// down a working PQ session.
+func (m *Manager) MarkNonCapable(remoteID RemoteID) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.established[remoteID] {
+		return
+	}
+	if prev, ok := m.capable[remoteID]; ok && !prev {
+		return // already known non-capable, nothing to do
+	}
+	m.capable[remoteID] = false
+	if ex := m.exchanges[remoteID]; ex != nil {
+		if ex.cancel != nil {
+			ex.cancel()
+		}
+		delete(m.exchanges, remoteID)
+	}
+	m.trace("pqkem: peer advertises no PQ service — treating as non-capable, no KEM attempted", "peer", remoteID)
+}
+
+// RemovePeer stops any in-flight exchange for a peer and drops its state and routing.
+func (m *Manager) RemovePeer(remoteID RemoteID) {
+	m.mu.Lock()
+	if ex, ok := m.exchanges[remoteID]; ok {
+		if ex.cancel != nil {
+			ex.cancel()
+		}
+		delete(m.exchanges, remoteID)
+	}
+	delete(m.established, remoteID)
+	delete(m.failures, remoteID)
+	delete(m.psks, remoteID)
+	delete(m.capable, remoteID)
+	if ep, ok := m.peerAddrs[remoteID]; ok {
+		delete(m.peersByAddr, ep)
+		delete(m.peerAddrs, remoteID)
+	}
+	m.mu.Unlock()
+}
+
+// Stop cancels all in-flight exchanges, closes the transport, and waits for the
+// exchange goroutines to exit.
+func (m *Manager) Stop() {
+	// Cancel the root context under the lock, before Wait: startExchangeLocked checks
+	// rootCtx.Err() under the same lock before it Adds to the wait group, so once Stop
+	// has cancelled here no new Add can race Wait.
+	m.mu.Lock()
+	m.rootCancel()
+	m.mu.Unlock()
+	m.wait.Wait()
+	m.mu.Lock()
+	t := m.transport
+	m.transport = nil
+	m.exchanges = make(map[RemoteID]*exchangeCtl)
+	m.psks = make(map[RemoteID]PSK)
+	m.mu.Unlock()
+	if t != nil {
+		if err := t.Close(); err != nil {
+			m.logger.Warn("pqkem: closing data-path transport", "err", err)
+		}
+	}
+}
+
+// ---- Signalling channel (host-driven; rides the host's negotiation) ----
+
+// SignalOffer returns the KEM offer for the host to embed in its outgoing offer to
+// remoteID (bootstrap). It returns (nil, nil) when the local peer is not the
+// initiator. It is idempotent for an in-flight bootstrap: a repeat call returns the
+// same offer rather than starting a new exchange.
+//
+// A signal re-negotiation always re-bootstraps (fresh exchange): the remote may have
+// restarted and lost its PSK, so reusing a locally frozen one would desync. The derived
+// PSK still survives idle in the manager (dropped only on account-level peer removal),
+// so a pure lazy wake with no re-negotiation reuses it via the conn's WG-config pull.
+func (m *Manager) SignalOffer(remoteID RemoteID) ([]byte, error) {
+	if !m.IsInitiator(remoteID) {
+		return nil, nil
+	}
+	m.mu.Lock()
+	if capable, ok := m.capable[remoteID]; ok && !capable {
+		m.mu.Unlock()
+		return nil, nil // peer does not run the KEM; do not offer (avoids a failure/reoffer loop)
+	}
+	// Idempotent while a signalling bootstrap is in flight OR already derived a PSK but
+	// not yet chained a rotation (awaitingRekey): return the SAME offer instead of
+	// starting a new exchange. This matters when the controller both offers on its own
+	// guard AND re-offers in response to the responder's offer — without this, the
+	// second call would start a fresh exchange (a different PSK) and desync the peers.
+	if ex := m.exchanges[remoteID]; ex != nil && ex.viaSignal &&
+		(ex.state == stateAwaitingAnswer || ex.state == stateAwaitingRekey) {
+		last := ex.lastSent
+		m.mu.Unlock()
+		return last, nil
+	}
+	// Hold the lock across the check above and the install so a concurrent SignalOffer
+	// for the same peer can't also start an exchange. bootstrap offer acks nothing.
+	raw, err := m.startExchangeLocked(remoteID, true, ExchangeID{})
+	m.mu.Unlock()
+	return raw, err
+}
+
+// ShouldSendBootstrapOffer reports whether we should emit a fresh KEM offer to kick a
+// bootstrap for this peer. True only if we are the initiator, the peer is not known
+// non-capable, and no exchange is already in flight. The host uses this when it (as the
+// controller) receives the responder's offer: it replies with a KEM offer exactly once
+// to start the exchange, and ignores further responder offers while one is in flight,
+// avoiding an offer-per-offer runaway.
+func (m *Manager) ShouldSendBootstrapOffer(remoteID RemoteID) bool {
+	if !m.IsInitiator(remoteID) {
+		return false
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if capable, ok := m.capable[remoteID]; ok && !capable {
+		return false
+	}
+	return m.exchanges[remoteID] == nil
+}
+
+// SignalOnOffer processes a KEM offer the host extracted from an incoming offer and
+// returns the KEM answer for the host to embed in its outgoing answer.
+func (m *Manager) SignalOnOffer(remoteID RemoteID, offer []byte) ([]byte, error) {
+	typ, msg, err := Decode(offer)
+	if err != nil {
+		return nil, fmt.Errorf("decode signal offer from %s: %w", remoteID, err)
+	}
+	if typ != MsgOffer {
+		return nil, fmt.Errorf("expected offer from %s, got type %d", remoteID, typ)
+	}
+	return m.processOffer(remoteID, msg.(*OfferMsg))
+}
+
+// SignalOnAnswer processes a KEM answer the host extracted from an incoming answer.
+// There is no reply: the next offer (over the data path) acknowledges this exchange.
+func (m *Manager) SignalOnAnswer(remoteID RemoteID, answer []byte) error {
+	typ, msg, err := Decode(answer)
+	if err != nil {
+		return fmt.Errorf("decode signal answer from %s: %w", remoteID, err)
+	}
+	if typ != MsgAnswer {
+		return fmt.Errorf("expected answer from %s, got type %d", remoteID, typ)
+	}
+	return m.processAnswer(remoteID, msg.(*AnswerMsg))
+}
+
+// ---- Data path ----
+
+// onDataPathInbound is the transport's inbound handler: it reverse-resolves the
+// source endpoint to a peer and dispatches. Unknown sources are dropped.
+func (m *Manager) onDataPathInbound(src netip.AddrPort, msg []byte) {
+	m.mu.Lock()
+	remoteID, ok := m.peersByAddr[src]
+	m.mu.Unlock()
+	if !ok {
+		return
+	}
+	if err := m.OnDataPathMessage(remoteID, msg); err != nil {
+		m.trace("pqkem: inbound", "peer", remoteID, "err", err)
+	}
+}
+
+// OnDataPathMessage handles a KEM message received over the data path from remoteID
+// and pushes any reply back over the data path.
+func (m *Manager) OnDataPathMessage(remoteID RemoteID, raw []byte) error {
+	typ, msg, err := Decode(raw)
+	if err != nil {
+		return fmt.Errorf("decode data-path msg from %s: %w", remoteID, err)
+	}
+	switch typ {
+	case MsgOffer:
+		answer, err := m.processOffer(remoteID, msg.(*OfferMsg))
+		if err != nil {
+			return err
+		}
+		if answer == nil {
+			return nil
+		}
+		return m.pushDataPath(remoteID, answer)
+	case MsgAnswer:
+		return m.processAnswer(remoteID, msg.(*AnswerMsg))
+	default:
+		return fmt.Errorf("unhandled data-path message type %d from %s", typ, remoteID)
+	}
+}
+
+// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh data-path rekey
+// (fired on first establishment AND every rekey). If we are the initiator that just
+// derived a PSK, it chains the next exchange: a fresh offer over the data path that
+// acknowledges the just-completed one (its arrival under the new key proves to the
+// responder the key works). sinceActivity is how long ago the peer last exchanged real
+// user data; past rotationActivityWindow the tunnel is treated as idle and rotation is
+// skipped — an idle tunnel has nothing to protect, and rotating would emit data-path
+// traffic that keeps the peer artificially active (see conn.onWGCheckSuccess).
+func (m *Manager) OnDataPathRekeyed(remoteID RemoteID, sinceActivity time.Duration) {
+	if sinceActivity >= rotationActivityWindow {
+		m.trace("pqkem: peer idle, skipping data-path rotation", "peer", remoteID, "since_activity", sinceActivity)
+		return
+	}
+
+	m.mu.Lock()
+	ex := m.exchanges[remoteID]
+	chain := ex != nil && ex.state == stateAwaitingRekey
+	if !chain {
+		m.mu.Unlock()
+		m.trace("pqkem: data-path rekey signal", "peer", remoteID, "chaining", false)
+		return
+	}
+	// Hold the lock across the awaitingRekey check and the install so two rekey clocks
+	// can't each start a chained exchange for the same peer.
+	offer, err := m.startExchangeLocked(remoteID, false, ex.id)
+	m.mu.Unlock()
+
+	m.trace("pqkem: data-path rekey signal", "peer", remoteID, "chaining", true)
+	if err != nil {
+		m.logger.Error("pqkem: chain offer failed to start", "peer", remoteID, "err", err)
+		return
+	}
+	if err := m.pushDataPath(remoteID, offer); err != nil {
+		m.logger.Warn("pqkem: send chain offer failed", "peer", remoteID, "err", err)
+		return
+	}
+	m.trace("pqkem: chain offer sent over data path", "peer", remoteID)
+}
+
+// OnDataPathDown notifies that the peer's data path went down. Rotations resume once
+// the host re-bootstraps over signalling on reconnect; in-flight data-path sends will
+// simply fail until then. Reserved as an explicit hook.
+func (m *Manager) OnDataPathDown(remoteID RemoteID) {}
+
+// ---- internals ----
+
+// pushDataPath resolves the peer's endpoint and sends over the data-path transport,
+// erroring if the peer is unknown or no transport is set.
+func (m *Manager) pushDataPath(remoteID RemoteID, msg []byte) error {
+	m.mu.Lock()
+	ep, ok := m.peerAddrs[remoteID]
+	t := m.transport
+	m.mu.Unlock()
+	if !ok {
+		return fmt.Errorf("no data-path endpoint for peer %s", remoteID)
+	}
+	if t == nil {
+		return fmt.Errorf("no data-path transport")
+	}
+	return t.Send(ep, msg)
+}
+
+func (m *Manager) binding(remoteID RemoteID) Binding {
+	return Binding{LocalID: []byte(m.localID), RemoteID: []byte(remoteID)}
+}
+
+func newExchangeID() (ExchangeID, error) {
+	var id ExchangeID
+	if _, err := rand.Read(id[:]); err != nil {
+		return ExchangeID{}, fmt.Errorf("generate exchange id: %w", err)
+	}
+	return id, nil
+}

client/internal/pqkem/manager_test.go

@@ -0,0 +1,201 @@
+package pqkem
+
+import (
+	"fmt"
+	"net/netip"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+// netSwitch is an in-memory UDP fabric: transports register their endpoint and get
+// datagrams delivered to their inbound handler.
+type netSwitch struct {
+	mu sync.Mutex
+	h  map[netip.AddrPort]func(netip.AddrPort, []byte)
+}
+
+func newSwitch() *netSwitch {
+	return &netSwitch{h: map[netip.AddrPort]func(netip.AddrPort, []byte){}}
+}
+
+func (s *netSwitch) register(ep netip.AddrPort, fn func(netip.AddrPort, []byte)) {
+	s.mu.Lock()
+	s.h[ep] = fn
+	s.mu.Unlock()
+}
+
+func (s *netSwitch) deliver(dst, src netip.AddrPort, msg []byte) error {
+	s.mu.Lock()
+	fn := s.h[dst]
+	s.mu.Unlock()
+	if fn == nil {
+		return fmt.Errorf("no route to %s", dst)
+	}
+	fn(src, msg)
+	return nil
+}
+
+// loopback is an endpoint-based pqkem.Transport over a netSwitch, with a switchable
+// drop flag.
+type loopback struct {
+	ep   netip.AddrPort
+	sw   *netSwitch
+	drop atomic.Bool
+}
+
+func (l *loopback) Send(dst netip.AddrPort, msg []byte) error {
+	if l.drop.Load() {
+		return nil
+	}
+	return l.sw.deliver(dst, l.ep, append([]byte(nil), msg...))
+}
+
+func (l *loopback) LocalPort() int                             { return int(l.ep.Port()) }
+func (l *loopback) Run(onInbound func(netip.AddrPort, []byte)) { l.sw.register(l.ep, onInbound) }
+func (l *loopback) Close() error                               { return nil }
+
+type fakeWG struct {
+	mu     sync.Mutex
+	psks   map[RemoteID]PSK
+	failed []RemoteID
+}
+
+func newFakeWG() *fakeWG { return &fakeWG{psks: map[RemoteID]PSK{}} }
+
+// startExchangeTest drives startExchangeLocked with the lock held, for tests that kick an
+// exchange directly (production callers hold m.mu across their idempotency check).
+func (m *Manager) startExchangeTest(remoteID RemoteID, viaSignal bool, ackID ExchangeID) ([]byte, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.startExchangeLocked(remoteID, viaSignal, ackID)
+}
+
+func (f *fakeWG) OnNewPSKReady(remoteID RemoteID, psk PSK) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.psks[remoteID] = psk
+	return nil
+}
+
+func (f *fakeWG) OnRekeyFailed(remoteID RemoteID) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.failed = append(f.failed, remoteID)
+	return nil
+}
+
+func (f *fakeWG) psk(peer RemoteID) PSK {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.psks[peer]
+}
+
+var (
+	epA = netip.MustParseAddrPort("100.64.0.1:51833")
+	epB = netip.MustParseAddrPort("100.64.0.2:51833")
+)
+
+// pair builds two wired managers (B is the initiator, "bbbb" > "aaaa") sharing a
+// netSwitch, with each peer's data-path endpoint registered. lbB is B's loopback
+// (for toggling drop).
+func pair(t *testing.T) (dA, dB *Manager, wgA, wgB *fakeWG, lbB *loopback) {
+	t.Helper()
+	sw := newSwitch()
+	wgA = newFakeWG()
+	wgB = newFakeWG()
+	dA = NewManager("aaaa", wgA, nil)
+	dB = NewManager("bbbb", wgB, nil)
+	dA.Start(&loopback{ep: epA, sw: sw})
+	lbB = &loopback{ep: epB, sw: sw}
+	dB.Start(lbB)
+	dA.AddPeer("bbbb", epB)
+	dB.AddPeer("aaaa", epA)
+	return dA, dB, wgA, wgB, lbB
+}
+
+// bootstrap runs the signalling offer/answer (the test plays the host carrying bytes).
+func bootstrap(t *testing.T, dA, dB *Manager) {
+	t.Helper()
+	offer, err := dB.SignalOffer("aaaa")
+	require.NoError(t, err)
+	require.NotNil(t, offer)
+	answer, err := dA.SignalOnOffer("bbbb", offer)
+	require.NoError(t, err)
+	require.NotNil(t, answer)
+	require.NoError(t, dB.SignalOnAnswer("aaaa", answer))
+}
+
+func TestManager_BootstrapDerivesSamePSK(t *testing.T) {
+	dA, dB, wgA, wgB, _ := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	bootstrap(t, dA, dB)
+
+	pskA := wgA.psk("bbbb")
+	pskB := wgB.psk("aaaa")
+	require.NotEqual(t, PSK{}, pskA)
+	require.Equal(t, pskB, pskA, "both sides derive the same PSK from the bootstrap exchange")
+}
+
+func TestManager_ChainRotatesAndAcks(t *testing.T) {
+	dA, dB, wgA, wgB, _ := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	bootstrap(t, dA, dB)
+	psk1 := wgB.psk("aaaa")
+
+	// Data path up: B (initiator) chains the next offer over the data path, which
+	// rotates both to a fresh PSK and acknowledges A.
+	dA.OnDataPathRekeyed("bbbb", 0)
+	dB.OnDataPathRekeyed("aaaa", 0)
+
+	psk2A := wgA.psk("bbbb")
+	psk2B := wgB.psk("aaaa")
+	require.Equal(t, psk2B, psk2A, "both sides converge on the rotated PSK")
+	require.NotEqual(t, psk1, psk2B, "the chain rotated to a new PSK")
+}
+
+func TestManager_RotationSkippedWhenIdle(t *testing.T) {
+	dA, dB, wgA, wgB, _ := pair(t)
+	defer dA.Stop()
+	defer dB.Stop()
+
+	bootstrap(t, dA, dB)
+	psk1 := wgB.psk("aaaa")
+	require.NotEqual(t, PSK{}, psk1)
+
+	// Idle: the peer's last real-data activity is older than the window, so a rekey
+	// must NOT clock a rotation.
+	dA.OnDataPathRekeyed("bbbb", rotationActivityWindow)
+	dB.OnDataPathRekeyed("aaaa", rotationActivityWindow)
+	require.Equal(t, psk1, wgB.psk("aaaa"), "idle peer must not rotate the PSK")
+	require.Equal(t, psk1, wgA.psk("bbbb"), "idle peer must not rotate the PSK")
+
+	// Active: activity within the window clocks the rotation as usual.
+	dA.OnDataPathRekeyed("bbbb", rotationActivityWindow-1)
+	dB.OnDataPathRekeyed("aaaa", rotationActivityWindow-1)
+	psk2 := wgB.psk("aaaa")
+	require.NotEqual(t, psk1, psk2, "recent activity must clock a rotation")
+	require.Equal(t, psk2, wgA.psk("bbbb"), "both sides converge on the rotated PSK")
+}
+
+func TestManager_NonInitiatorReturnsNoOffer(t *testing.T) {
+	dA := NewManager("aaaa", newFakeWG(), nil)
+	defer dA.Stop()
+
+	offer, err := dA.SignalOffer("bbbb") // not the initiator vs "bbbb"
+	require.NoError(t, err)
+	require.Nil(t, offer)
+}
+
+func TestManager_StopIsIdempotent(t *testing.T) {
+	dA := NewManager("aaaa", newFakeWG(), nil)
+	dA.Start(&loopback{ep: epA, sw: newSwitch()})
+	dA.Stop()
+	dA.Stop() // must not panic or hang
+}

client/internal/pqkem/message.go

@@ -0,0 +1,121 @@
+package pqkem
+
+import (
+	"crypto/mlkem"
+	"fmt"
+)
+
+// Wire framing for the PQ-KEM exchange. Messages are self-contained, versioned,
+// transport-agnostic byte blobs: the same bytes ride the signalling channel
+// (initial bootstrap) or a data-tunnel packet (rekey). The library only ever sees
+// opaque []byte at the transport seam.
+//
+// Layout (all messages): [type:1][version:1][exchangeID:16][payload...]
+//
+// There is no confirm message: an exchange is acknowledged by the NEXT offer, which
+// carries the acked exchange's id (see OfferMsg.AckID) and — riding the data path
+// under the freshly adopted key — proves that key works.
+
+const (
+	// ProtocolVersion is bumped on any wire-incompatible change; a peer rejects
+	// messages it does not understand rather than misparsing them.
+	ProtocolVersion uint8 = 1
+
+	// ExchangeIDSize identifies one exchange so answers/acks correlate and stale
+	// messages are dropped.
+	ExchangeIDSize = 16
+
+	headerSize = 1 + 1 + ExchangeIDSize
+)
+
+// MsgType tags the two message kinds of the exchange.
+type MsgType uint8
+
+const (
+	MsgOffer MsgType = iota + 1
+	MsgAnswer
+)
+
+// ExchangeID is the per-exchange correlator. The zero value means "none" (an offer
+// that acknowledges nothing, i.e. the first exchange of a connection).
+type ExchangeID [ExchangeIDSize]byte
+
+// OfferMsg carries the initiator's public material (ML-KEM encap key ‖ X25519 pub)
+// and AckID, the id of the previous exchange this offer acknowledges (zero if none).
+type OfferMsg struct {
+	ExchangeID ExchangeID
+	AckID      ExchangeID
+	// KEMOffer is the raw Initiator.Offer() blob (OfferSize bytes).
+	KEMOffer []byte
+}
+
+// AnswerMsg carries the responder's reply (ML-KEM ciphertext ‖ X25519 pub) for the
+// round identified by ExchangeID.
+type AnswerMsg struct {
+	ExchangeID ExchangeID
+	// KEMAnswer is the raw Respond() answer blob (AnswerSize bytes).
+	KEMAnswer []byte
+}
+
+// Encode serialises the offer with its framed header (payload = AckID ‖ KEMOffer).
+func (m *OfferMsg) Encode() ([]byte, error) {
+	if len(m.KEMOffer) != OfferSize {
+		return nil, fmt.Errorf("offer payload: got %d, want %d", len(m.KEMOffer), OfferSize)
+	}
+	payload := make([]byte, 0, ExchangeIDSize+OfferSize)
+	payload = append(payload, m.AckID[:]...)
+	payload = append(payload, m.KEMOffer...)
+	return frame(MsgOffer, m.ExchangeID, payload), nil
+}
+
+// Encode serialises the answer with its framed header.
+func (m *AnswerMsg) Encode() ([]byte, error) {
+	if len(m.KEMAnswer) != AnswerSize {
+		return nil, fmt.Errorf("answer payload: got %d, want %d", len(m.KEMAnswer), AnswerSize)
+	}
+	return frame(MsgAnswer, m.ExchangeID, m.KEMAnswer), nil
+}
+
+// Decode parses a framed message into one of *OfferMsg / *AnswerMsg.
+func Decode(buf []byte) (MsgType, any, error) {
+	if len(buf) < headerSize {
+		return 0, nil, fmt.Errorf("message too short: %d bytes", len(buf))
+	}
+	typ := MsgType(buf[0])
+	if ver := buf[1]; ver != ProtocolVersion {
+		return typ, nil, fmt.Errorf("unsupported protocol version %d (want %d)", ver, ProtocolVersion)
+	}
+
+	var id ExchangeID
+	copy(id[:], buf[2:headerSize])
+	payload := buf[headerSize:]
+
+	switch typ {
+	case MsgOffer:
+		if len(payload) != ExchangeIDSize+OfferSize {
+			return typ, nil, fmt.Errorf("offer payload: got %d, want %d", len(payload), ExchangeIDSize+OfferSize)
+		}
+		var ack ExchangeID
+		copy(ack[:], payload[:ExchangeIDSize])
+		return typ, &OfferMsg{ExchangeID: id, AckID: ack, KEMOffer: payload[ExchangeIDSize:]}, nil
+	case MsgAnswer:
+		if len(payload) != AnswerSize {
+			return typ, nil, fmt.Errorf("answer payload: got %d, want %d", len(payload), AnswerSize)
+		}
+		return typ, &AnswerMsg{ExchangeID: id, KEMAnswer: payload}, nil
+	default:
+		return typ, nil, fmt.Errorf("unknown message type %d", typ)
+	}
+}
+
+func frame(typ MsgType, id ExchangeID, payload []byte) []byte {
+	buf := make([]byte, headerSize+len(payload))
+	buf[0] = byte(typ)
+	buf[1] = ProtocolVersion
+	copy(buf[2:], id[:])
+	copy(buf[headerSize:], payload)
+	return buf
+}
+
+// compile-time assurance the KEM blob sizes referenced here stay in sync with kem.go.
+var _ = [1]struct{}{}[OfferSize-(32+mlkem.EncapsulationKeySize768)]

client/internal/pqkem/message_test.go

@@ -0,0 +1,57 @@
+package pqkem
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMessageRoundTrip(t *testing.T) {
+	init, err := NewInitiator()
+	require.NoError(t, err)
+	answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
+	require.NoError(t, err)
+
+	id := ExchangeID{1, 2, 3, 4}
+	ack := ExchangeID{9, 9, 9}
+
+	offBytes, err := (&OfferMsg{ExchangeID: id, AckID: ack, KEMOffer: init.Offer()}).Encode()
+	require.NoError(t, err)
+	typ, decoded, err := Decode(offBytes)
+	require.NoError(t, err)
+	require.Equal(t, MsgOffer, typ)
+	require.Equal(t, id, decoded.(*OfferMsg).ExchangeID)
+	require.Equal(t, ack, decoded.(*OfferMsg).AckID)
+	require.Equal(t, init.Offer(), decoded.(*OfferMsg).KEMOffer)
+
+	ansBytes, err := (&AnswerMsg{ExchangeID: id, KEMAnswer: answer}).Encode()
+	require.NoError(t, err)
+	typ, decoded, err = Decode(ansBytes)
+	require.NoError(t, err)
+	require.Equal(t, MsgAnswer, typ)
+	require.Equal(t, answer, decoded.(*AnswerMsg).KEMAnswer)
+}
+
+func TestDecodeRejects(t *testing.T) {
+	// too short
+	_, _, err := Decode([]byte{1, 1})
+	require.Error(t, err)
+
+	// wrong version
+	bad := make([]byte, headerSize+ExchangeIDSize+OfferSize)
+	bad[0] = byte(MsgOffer)
+	bad[1] = ProtocolVersion + 1
+	_, _, err = Decode(bad)
+	require.Error(t, err)
+
+	// unknown type
+	bad2 := make([]byte, headerSize)
+	bad2[0] = 99
+	bad2[1] = ProtocolVersion
+	_, _, err = Decode(bad2)
+	require.Error(t, err)
+
+	// offer with wrong payload size
+	_, err = (&OfferMsg{KEMOffer: []byte{1, 2, 3}}).Encode()
+	require.Error(t, err)
+}

client/internal/pqkem_adapter.go

@@ -0,0 +1,160 @@
+package internal
+
+import (
+	"net/netip"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/internal/pqkem"
+)
+
+// pqPresharedKeySetter is the subset of the WireGuard interface the ML-KEM callback
+// needs: programming a peer's preshared key. *iface.WGIface satisfies it.
+type pqPresharedKeySetter interface {
+	SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error
+}
+
+// pqCallbackHandler programs the derived PQ PSK onto the WireGuard peer. It is the
+// engine-side implementation of pqkem.CallbackHandler.
+type pqCallbackHandler struct {
+	wg pqPresharedKeySetter
+	// reoffer re-bootstraps the KEM over Signal for a peer (a fresh signalling offer)
+	// to recover from a persistent data-path rekey failure. Nil disables recovery.
+	reoffer func(remoteKey string)
+}
+
+// OnNewPSKReady programs the freshly derived PSK for the peer (updateOnly: a no-op
+// if the peer is not present, mirroring Rosenpass).
+func (h pqCallbackHandler) OnNewPSKReady(remoteID pqkem.RemoteID, psk pqkem.PSK) error {
+	// updateOnly: applies to an already-configured peer (rotation). At bootstrap the
+	// peer is not configured yet, so this is a no-op there and the PSK is instead
+	// pulled at peer-config time (pqHandshaker.PSK / conn.presharedKey).
+	log.Tracef("pqkem: programming PSK for peer %s", remoteID)
+	return h.wg.SetPresharedKey(string(remoteID), wgtypes.Key(psk), true)
+}
+
+// OnRekeyFailed reports a failed PQ (re)key convergence and re-bootstraps the KEM over
+// Signal to recover: a fresh signalling offer starts a new exchange that overwrites the
+// stalled PSK on both sides, resyncing after a persistent data-path desync. The tunnel
+// stays up on the previous PSK meanwhile (the Signal channel is independent of the
+// broken data path).
+func (h pqCallbackHandler) OnRekeyFailed(remoteID pqkem.RemoteID) error {
+	log.Warnf("pqkem: post-quantum rekey failed for peer %s, re-bootstrapping over signal", remoteID)
+	if h.reoffer != nil {
+		h.reoffer(string(remoteID))
+	}
+	return nil
+}
+
+// pqHandshaker adapts the pqkem manager to peer.PQHandshaker (string peer keys),
+// wiring the host's signalling offers/answers to the KEM exchange.
+type pqHandshaker struct {
+	mgr *pqkem.Manager
+}
+
+// announcedPort is the PQ data-path port to advertise to peers. It is omitted (0) when
+// the manager is on DefaultPort, since peers assume the default when no port is sent;
+// only a non-default (collision-forced) port is announced explicitly.
+func (p pqHandshaker) announcedPort() uint16 {
+	if port := p.mgr.LocalPort(); port != DefaultPort {
+		return uint16(port)
+	}
+	return 0
+}
+
+// OfferPayload builds the KEM offer to attach to an outgoing signalling offer for the
+// peer, plus the data-path port to announce (0 when on DefaultPort). Payload is nil when
+// this side has no offer to send.
+func (p pqHandshaker) OfferPayload(remoteKey string) ([]byte, uint16) {
+	payload, err := p.mgr.SignalOffer(pqkem.RemoteID(remoteKey))
+	if err != nil {
+		log.Warnf("pqkem: build offer for %s: %v", remoteKey, err)
+	}
+	return payload, p.announcedPort()
+}
+
+// ShouldSendBootstrapOffer reports whether the controller should reply to the peer's
+// KEM-less offer with its own bootstrap offer instead of an answer.
+func (p pqHandshaker) ShouldSendBootstrapOffer(remoteKey string) bool {
+	return p.mgr.ShouldSendBootstrapOffer(pqkem.RemoteID(remoteKey))
+}
+
+// AnswerPayload processes a received KEM offer (nil when absent) and returns the KEM
+// answer to attach to the outgoing signalling answer, plus the data-path port to announce
+// (0 when on DefaultPort). An empty offer is treated as a capability signal.
+func (p pqHandshaker) AnswerPayload(remoteKey string, recvOffer []byte) ([]byte, uint16) {
+	if len(recvOffer) == 0 {
+		// Capability signal (responder side): the KEM offer flows initiator->responder,
+		// so if we are the responder for this peer (it is the KEM initiator by role) an
+		// empty offer means it does not run the KEM. If we are the initiator, an empty
+		// offer is normal — the peer is the responder and puts its material in the
+		// answer — so we must not flag it.
+		if !p.mgr.IsInitiator(pqkem.RemoteID(remoteKey)) {
+			p.mgr.MarkNonCapable(pqkem.RemoteID(remoteKey))
+		}
+		return nil, p.announcedPort()
+	}
+	payload, err := p.mgr.SignalOnOffer(pqkem.RemoteID(remoteKey), recvOffer)
+	if err != nil {
+		log.Warnf("pqkem: build answer for %s: %v", remoteKey, err)
+	}
+	return payload, p.announcedPort()
+}
+
+// OnAnswer feeds a received KEM answer (nil when absent) into the exchange. An empty
+// answer to our offer is treated as a capability signal on the initiator side.
+func (p pqHandshaker) OnAnswer(remoteKey string, recvAnswer []byte) {
+	if len(recvAnswer) == 0 {
+		// Capability signal (initiator side): the KEM answer flows responder->initiator,
+		// so an empty answer to our offer means the peer does not run the KEM — mark it
+		// non-capable to stop offering (no failure/reoffer storm). Only meaningful when
+		// we are the initiator: as the responder we also receive an (empty) answer to
+		// our own non-KEM offer from a perfectly capable peer, which must not be flagged.
+		if p.mgr.IsInitiator(pqkem.RemoteID(remoteKey)) {
+			p.mgr.MarkNonCapable(pqkem.RemoteID(remoteKey))
+		}
+		return
+	}
+	if err := p.mgr.SignalOnAnswer(pqkem.RemoteID(remoteKey), recvAnswer); err != nil {
+		log.Warnf("pqkem: process answer from %s: %v", remoteKey, err)
+	}
+}
+
+// PSK exposes the peer's derived PSK for the conn to program at WG peer-config time.
+func (p pqHandshaker) PSK(remoteKey string) (wgtypes.Key, bool) {
+	psk, ok := p.mgr.PSK(pqkem.RemoteID(remoteKey))
+	if !ok {
+		return wgtypes.Key{}, false
+	}
+	return wgtypes.Key(psk), true
+}
+
+// SetRemoteAddr registers the peer's data-path endpoint learned from signalling. A
+// zero port means the peer omitted it (it is on DefaultPort), so we resolve it here —
+// DefaultPort lives in this package, not in peer. Sends only ever fire once the tunnel
+// is up (clocked by OnDataPathRekeyed), so registering here is safe even before
+// connection-up.
+func (p pqHandshaker) SetRemoteAddr(remoteKey string, addr netip.AddrPort) {
+	if !addr.Addr().IsValid() {
+		return
+	}
+	port := addr.Port()
+	if port == 0 {
+		port = DefaultPort
+	}
+	p.mgr.AddPeer(pqkem.RemoteID(remoteKey), netip.AddrPortFrom(addr.Addr(), port))
+}
+
+// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh WG handshake.
+// sinceActivity is how long ago the peer last exchanged real user data; the manager
+// skips rotation for idle tunnels.
+func (p pqHandshaker) OnDataPathRekeyed(remoteKey string, sinceActivity time.Duration) {
+	p.mgr.OnDataPathRekeyed(pqkem.RemoteID(remoteKey), sinceActivity)
+}
+
+// OnDataPathDown signals the peer's tunnel went down.
+func (p pqHandshaker) OnDataPathDown(remoteKey string) {
+	p.mgr.OnDataPathDown(pqkem.RemoteID(remoteKey))
+}

client/internal/pqkem_adapter_test.go

@@ -0,0 +1,37 @@
+package internal
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal/pqkem"
+)
+
+type pqNoopHandler struct{}
+
+func (pqNoopHandler) OnNewPSKReady(pqkem.RemoteID, pqkem.PSK) error { return nil }
+func (pqNoopHandler) OnRekeyFailed(pqkem.RemoteID) error            { return nil }
+
+// TestPQAdapter_CapabilityRoleAware locks the role-aware capability signal: the KEM
+// payload only flows initiator-offer -> responder-answer, so an empty message in the
+// other direction comes from a perfectly capable peer and must NOT flag it. Only the
+// message that should carry material (the answer we receive as initiator) marks a peer
+// non-capable when empty.
+func TestPQAdapter_CapabilityRoleAware(t *testing.T) {
+	// localID "zzzz" > "aaaa" => this manager is the KEM initiator for peer "aaaa".
+	mgr := pqkem.NewManager("zzzz", pqNoopHandler{}, nil)
+	defer mgr.Stop()
+	h := pqHandshaker{mgr: mgr}
+
+	// An empty OFFER from our peer is normal here: as the initiator's responder it puts
+	// its material in the answer, not the offer. It must not disable our offering.
+	h.AnswerPayload("aaaa", nil)
+	payload, _ := h.OfferPayload("aaaa")
+	require.NotNil(t, payload, "an empty offer from a responder-role peer must not mark it non-capable")
+
+	// An empty ANSWER to our offer means the peer does not run the KEM -> stop offering.
+	h.OnAnswer("aaaa", nil)
+	payload2, _ := h.OfferPayload("aaaa")
+	require.Nil(t, payload2, "an empty answer to our offer marks the peer non-capable, so we stop offering")
+}

client/internal/pqkem_transport.go

@@ -0,0 +1,76 @@
+package internal
+
+import (
+	"fmt"
+	"net"
+	"net/netip"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// DefaultPort is the preferred UDP port for the ML-KEM data-path service, bound on
+// the WG overlay IP. Since each client owns a distinct overlay IP, this port is
+// almost always free, so it need not be announced (peers assume it). A peer only
+// announces Body.mlkemPort when a collision forced it onto a different port.
+const DefaultPort = 51833
+
+// pqTransport is the ML-KEM data-path transport: a dumb UDP socket bound on the WG
+// overlay IP. It implements pqkem.Transport — the manager owns the remoteID<->endpoint
+// routing and drives this socket's lifecycle (Run / Close).
+type pqTransport struct {
+	conn *net.UDPConn
+	port int
+}
+
+// newPQTransport binds a UDP socket on the WG overlay IP, preferring DefaultPort and
+// falling back to an OS-assigned ephemeral port if it is in use. Call it after the WG
+// interface is up so the overlay IP is assigned; when the bound port is not
+// DefaultPort it must be announced to peers via Body.mlkemPort.
+func newPQTransport(overlayIP netip.Addr) (*pqTransport, error) {
+	if !overlayIP.IsValid() {
+		return nil, fmt.Errorf("invalid overlay IP for pqkem transport")
+	}
+	// The WG overlay always carries an IPv4 address (v6 is additive, never standalone),
+	// so the transport binds over IPv4. Unmap first so AsSlice() yields 4 bytes for an
+	// IPv4-mapped IPv6 address (a hardcoded "udp4" would otherwise fail on its 16 bytes).
+	overlayIP = overlayIP.Unmap()
+	ip := net.IP(overlayIP.AsSlice())
+	conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: DefaultPort})
+	if err != nil {
+		log.Debugf("pqkem: default port %d unavailable on %s (%v), using an ephemeral port", DefaultPort, overlayIP, err)
+		conn, err = net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: 0})
+		if err != nil {
+			return nil, fmt.Errorf("bind pqkem udp on overlay %s: %w", overlayIP, err)
+		}
+	}
+	return &pqTransport{conn: conn, port: conn.LocalAddr().(*net.UDPAddr).Port}, nil
+}
+
+// Send implements pqkem.Transport.
+func (t *pqTransport) Send(endpoint netip.AddrPort, msg []byte) error {
+	_, err := t.conn.WriteToUDPAddrPort(msg, endpoint)
+	return err
+}
+
+// LocalPort implements pqkem.Transport.
+func (t *pqTransport) LocalPort() int { return t.port }
+
+// Run implements pqkem.Transport: the receive loop, delivering each datagram as
+// (source endpoint, msg). Exits when the socket is closed.
+func (t *pqTransport) Run(onInbound func(src netip.AddrPort, msg []byte)) {
+	go func() {
+		buf := make([]byte, 2048)
+		for {
+			n, src, err := t.conn.ReadFromUDPAddrPort(buf)
+			if err != nil {
+				return
+			}
+			msg := make([]byte, n)
+			copy(msg, buf[:n])
+			onInbound(src, msg)
+		}
+	}()
+}
+
+// Close implements pqkem.Transport.
+func (t *pqTransport) Close() error { return t.conn.Close() }

client/ios/NetBirdSDK/client.go

@@ -14,7 +14,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	nbAnonymize "github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/debug"
@@ -29,13 +28,6 @@ import (
 	types "github.com/netbirdio/netbird/upload-server/types"
 )
 
-// AnonymizeLevelDefault and AnonymizeLevelStrict are the accepted
-// anonymizeLevel values for DebugBundle.
-const (
-	AnonymizeLevelDefault = nbAnonymize.LevelDefaultString
-	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
-)
-
 // ConnectionListener export internal Listener for mobile
 type ConnectionListener interface {
 	peer.Listener
@@ -208,10 +200,8 @@ func (c *Client) Stop() {
 // DebugBundle generates a debug bundle, uploads it and returns the upload key.
 // It works with or without a running engine: when the engine is up it reuses
 // the live config, sync response and client metrics; otherwise it loads the
-// config from disk (or the preloaded tvOS config). anonymizeLevel is "default"
-// or "strict"; strict also anonymizes internal IP ranges, peer names, and
-// WireGuard public keys, and implies anonymize.
-func (c *Client) DebugBundle(anonymize bool, anonymizeLevel string) (string, error) {
+// config from disk (or the preloaded tvOS config).
+func (c *Client) DebugBundle(anonymize bool) (string, error) {
 	cfg, cc := c.stateSnapshot()
 
 	// If the engine hasn't been started, load config so we can reach management.
@@ -261,7 +251,6 @@ func (c *Client) DebugBundle(anonymize bool, anonymizeLevel string) (string, err
 		deps,
 		debug.BundleConfig{
 			Anonymize:         anonymize,
-			AnonymizeLevel:    nbAnonymize.ParseLevel(anonymizeLevel),
 			IncludeSystemInfo: true,
 		},
 	)

client/jobexec/executor.go

@@ -28,11 +28,7 @@ func NewExecutor() *Executor {
 	return &Executor{}
 }
 
-func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.GeneratorDependencies, params debug.BundleConfig, waitForDuration time.Duration, mgmURL, uploadURL string) (string, error) {
-	if uploadURL == "" {
-		uploadURL = types.DefaultBundleURL
-	}
-
+func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.GeneratorDependencies, params debug.BundleConfig, waitForDuration time.Duration, mgmURL string) (string, error) {
 	if waitForDuration > MaxBundleWaitTime {
 		log.Warnf("bundle wait time %v exceeds maximum %v, capping to maximum", waitForDuration, MaxBundleWaitTime)
 		waitForDuration = MaxBundleWaitTime
@@ -58,7 +54,7 @@ func (e *Executor) BundleJob(ctx context.Context, debugBundleDependencies debug.
 		}
 	}()
 
-	key, err := debug.UploadDebugBundle(ctx, uploadURL, mgmURL, path, false)
+	key, err := debug.UploadDebugBundle(ctx, types.DefaultBundleURL, mgmURL, path, false)
 	if err != nil {
 		log.Errorf("failed to upload debug bundle: %v", err)
 		return "", fmt.Errorf("upload debug bundle: %w", err)

client/proto/daemon.pb.go

@@ -2781,11 +2781,6 @@ type DebugBundleRequest struct {
 	// untrusted TLS certificate. Restricted to privileged callers; for
 	// self-hosted upload servers.
 	UploadInsecure bool `protobuf:"varint,7,opt,name=uploadInsecure,proto3" json:"uploadInsecure,omitempty"`
-	// anonymizeLevel selects how much the anonymizer redacts: "default"
-	// (or empty) keeps internal IP ranges, "strict" also anonymizes them.
-	// Unknown values are treated as "strict". Only meaningful with anonymize;
-	// "strict" implies it.
-	AnonymizeLevel string `protobuf:"bytes,8,opt,name=anonymizeLevel,proto3" json:"anonymizeLevel,omitempty"`
 	unknownFields  protoimpl.UnknownFields
 	sizeCache      protoimpl.SizeCache
 }
@@ -2862,13 +2857,6 @@ func (x *DebugBundleRequest) GetUploadInsecure() bool {
 	return false
 }
 
-func (x *DebugBundleRequest) GetAnonymizeLevel() string {
-	if x != nil {
-		return x.AnonymizeLevel
-	}
-	return ""
-}
-
 type DebugBundleResponse struct {
 	state               protoimpl.MessageState `protogen:"open.v1"`
 	Path                string                 `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
@@ -7265,7 +7253,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x12translatedHostname\x18\x04 \x01(\tR\x12translatedHostname\x128\n" +
 	"\x0etranslatedPort\x18\x05 \x01(\v2\x10.daemon.PortInfoR\x0etranslatedPort\"G\n" +
 	"\x17ForwardingRulesResponse\x12,\n" +
-	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules\"\x84\x02\n" +
+	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules\"\xdc\x01\n" +
 	"\x12DebugBundleRequest\x12\x1c\n" +
 	"\tanonymize\x18\x01 \x01(\bR\tanonymize\x12\x1e\n" +
 	"\n" +
@@ -7276,8 +7264,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\n" +
 	"cliVersion\x18\x06 \x01(\tR\n" +
 	"cliVersion\x12&\n" +
-	"\x0euploadInsecure\x18\a \x01(\bR\x0euploadInsecure\x12&\n" +
-	"\x0eanonymizeLevel\x18\b \x01(\tR\x0eanonymizeLevel\"}\n" +
+	"\x0euploadInsecure\x18\a \x01(\bR\x0euploadInsecure\"}\n" +
 	"\x13DebugBundleResponse\x12\x12\n" +
 	"\x04path\x18\x01 \x01(\tR\x04path\x12 \n" +
 	"\vuploadedKey\x18\x02 \x01(\tR\vuploadedKey\x120\n" +

client/proto/daemon.proto

@@ -540,11 +540,6 @@ message DebugBundleRequest {
   // untrusted TLS certificate. Restricted to privileged callers; for
   // self-hosted upload servers.
   bool uploadInsecure = 7;
-  // anonymizeLevel selects how much the anonymizer redacts: "default"
-  // (or empty) keeps internal IP ranges, "strict" also anonymizes them.
-  // Unknown values are treated as "strict". Only meaningful with anonymize;
-  // "strict" implies it.
-  string anonymizeLevel = 8;
 }
 
 message DebugBundleResponse {

client/server/debug.go

@@ -16,7 +16,6 @@ import (
 	"google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"
 
-	"github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/internal/debug"
 	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
@@ -123,7 +122,6 @@ func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener deb
 		},
 		debug.BundleConfig{
 			Anonymize:         req.GetAnonymize(),
-			AnonymizeLevel:    anonymize.ParseLevel(req.GetAnonymizeLevel()),
 			IncludeSystemInfo: req.GetSystemInfo(),
 			LogFileCount:      req.GetLogFileCount(),
 		},

client/status/status.go

@@ -46,10 +46,7 @@ func ParseDaemonStatus(s string) DaemonStatus {
 
 // ConvertOptions holds parameters for ConvertToStatusOutputOverview.
 type ConvertOptions struct {
-	Anonymize bool
-	// AnonymizeLevel selects how much the anonymizer redacts. Only
-	// meaningful when Anonymize is set.
-	AnonymizeLevel       anonymize.Level
+	Anonymize            bool
 	DaemonVersion        string
 	DaemonStatus         DaemonStatus
 	StatusFilter         string
@@ -220,7 +217,6 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 
 	if opts.Anonymize {
 		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		anonymizer.SetLevel(opts.AnonymizeLevel)
 		anonymizeOverview(anonymizer, &overview)
 	}
 
@@ -980,7 +976,6 @@ func timeAgo(t time.Time) string {
 
 func anonymizePeerDetail(a *anonymize.Anonymizer, peer *PeerStateDetailOutput) {
 	peer.FQDN = a.AnonymizeDomain(peer.FQDN)
-	peer.PubKey = a.AnonymizeWGKey(peer.PubKey)
 	if localIP, port, err := net.SplitHostPort(peer.IceCandidateEndpoint.Local); err == nil {
 		peer.IceCandidateEndpoint.Local = fmt.Sprintf("%s:%s", a.AnonymizeIPString(localIP), port)
 	}
@@ -1012,7 +1007,6 @@ func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 	overview.SignalState.URL = a.AnonymizeURI(overview.SignalState.URL)
 	overview.SignalState.Error = a.AnonymizeString(overview.SignalState.Error)
 
-	overview.PubKey = a.AnonymizeWGKey(overview.PubKey)
 	overview.IP = a.AnonymizeIPString(overview.IP)
 	overview.IPv6 = a.AnonymizeIPString(overview.IPv6)
 	for i, detail := range overview.Relays.Details {

client/ui/frontend/src/contexts/DebugBundleContext.tsx

@@ -71,12 +71,10 @@ type BundleOptions = {
     hasWindow: boolean;
     totalSec: number;
     uploadUrl: string;
-    anonymizeLevel: AnonymizeLevel;
+    anonymize: boolean;
     systemInfo: boolean;
 };
 
-export type AnonymizeLevel = "none" | "default" | "strict";
-
 const startCaptureBestEffort = async (totalSec: number, pcap: CaptureState) => {
     try {
         // Mirror the CLI's safety margin: window + 30s, server caps at 10m.
@@ -189,10 +187,7 @@ const runBundleFlow = async (
 
     if (opts.uploadUrl) setStage({ kind: "uploading" });
     const result = await DebugSvc.Bundle({
-        anonymize: opts.anonymizeLevel !== "none",
-        // The daemon only knows "default" and "strict"; "none" is expressed
-        // through the anonymize flag being off.
-        anonymizeLevel: opts.anonymizeLevel === "strict" ? "strict" : "default",
+        anonymize: opts.anonymize,
         systemInfo: opts.systemInfo,
         uploadUrl: opts.uploadUrl,
         logFileCount,
@@ -203,7 +198,7 @@ const runBundleFlow = async (
 };
 
 const useDebugBundle = () => {
-    const [anonymizeLevel, setAnonymizeLevel] = useState<AnonymizeLevel>("none");
+    const [anonymize, setAnonymize] = useState(false);
     const [systemInfo, setSystemInfo] = useState(true);
     const [upload, setUpload] = useState(true);
     const [trace, setTrace] = useState(true);
@@ -245,7 +240,7 @@ const useDebugBundle = () => {
             hasWindow: capture && totalSec > 0,
             totalSec,
             uploadUrl: upload ? NETBIRD_UPLOAD_URL : "",
-            anonymizeLevel,
+            anonymize,
             systemInfo,
         };
 
@@ -277,8 +272,8 @@ const useDebugBundle = () => {
     };
 
     return {
-        anonymizeLevel,
-        setAnonymizeLevel,
+        anonymize,
+        setAnonymize,
         systemInfo,
         setSystemInfo,
         upload,

client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx

@@ -1,6 +1,6 @@
 import { useId, type ReactNode } from "react";
 import { Trans, useTranslation } from "react-i18next";
-import { ChevronDown, CircleCheckBig, FolderOpen, Info, Loader2 } from "lucide-react";
+import { CircleCheckBig, FolderOpen, Loader2 } from "lucide-react";
 import { Browser } from "@wailsio/runtime";
 import { Debug as DebugSvc } from "@bindings/services";
 import type { DebugBundleResult } from "@bindings/services/models.js";
@@ -8,22 +8,13 @@ import { Button } from "@/components/buttons/Button";
 import { DialogActions } from "@/components/dialog/DialogActions";
 import { DialogDescription } from "@/components/dialog/DialogDescription";
 import { DialogHeading } from "@/components/dialog/DialogHeading";
-import {
-    DropdownMenu,
-    DropdownMenuContent,
-    DropdownMenuRadioGroup,
-    DropdownMenuRadioItem,
-    DropdownMenuTrigger,
-} from "@/components/DropdownMenu";
 import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
 import HelpText from "@/components/typography/HelpText.tsx";
 import { Input } from "@/components/inputs/Input";
 import { Label } from "@/components/typography/Label";
 import { SquareIcon } from "@/components/SquareIcon";
-import { Tooltip } from "@/components/Tooltip";
-import { cn } from "@/lib/cn";
 import { formatRemaining } from "@/lib/formatters";
-import type { AnonymizeLevel, DebugStage } from "@/contexts/DebugBundleContext";
+import type { DebugStage } from "@/contexts/DebugBundleContext";
 import { useDebugBundleContext } from "@/contexts/DebugBundleContext";
 import { SectionGroup, SettingsBottomBar } from "@/modules/settings/SettingsSection.tsx";
 
@@ -33,8 +24,8 @@ export function SettingsTroubleshooting() {
     const { t } = useTranslation();
     const durationId = useId();
     const {
-        anonymizeLevel,
-        setAnonymizeLevel,
+        anonymize,
+        setAnonymize,
         systemInfo,
         setSystemInfo,
         upload,
@@ -64,71 +55,12 @@ export function SettingsTroubleshooting() {
 
     return (
         <SectionGroup title={t("settings.troubleshooting.section.title")}>
-            <div className={"flex items-center justify-between gap-6"}>
-                <div className={"max-w-md flex-1"}>
-                    <Label as={"div"}>
-                        <span className={"inline-flex items-center gap-1.5"}>
-                            {t("settings.troubleshooting.anonymize.label")}
-                            <Tooltip
-                                content={
-                                    <div className={"max-w-xs whitespace-normal leading-relaxed"}>
-                                        {t("settings.troubleshooting.anonymize.info")}
-                                    </div>
-                                }
-                            >
-                                <Info
-                                    size={14}
-                                    aria-label={t("settings.troubleshooting.anonymize.label")}
-                                    className={"shrink-0 cursor-default text-nb-gray-400"}
-                                />
-                            </Tooltip>
-                        </span>
-                    </Label>
-                    <HelpText margin={false}>
-                        {t("settings.troubleshooting.anonymize.help")}
-                    </HelpText>
-                </div>
-                <div className={"shrink-0"}>
-                    <DropdownMenu>
-                        <DropdownMenuTrigger asChild>
-                            <button
-                                type={"button"}
-                                aria-label={t("settings.troubleshooting.anonymize.label")}
-                                className={cn(
-                                    "inline-flex h-[40px] min-w-[160px] items-center justify-between gap-2 px-3",
-                                    "rounded-md border bg-white dark:bg-nb-gray-900",
-                                    "border-neutral-200 dark:border-nb-gray-700",
-                                    "cursor-default text-xs font-semibold text-nb-gray-100 outline-none",
-                                    "hover:border-nb-gray-600 data-[state=open]:border-nb-gray-600",
-                                )}
-                            >
-                                {t(`settings.troubleshooting.anonymize.${anonymizeLevel}`)}
-                                <ChevronDown
-                                    size={16}
-                                    aria-hidden={"true"}
-                                    className={"shrink-0 text-nb-gray-200"}
-                                />
-                            </button>
-                        </DropdownMenuTrigger>
-                        <DropdownMenuContent align={"end"} className={"min-w-[160px]"}>
-                            <DropdownMenuRadioGroup
-                                value={anonymizeLevel}
-                                onValueChange={(v) => setAnonymizeLevel(v as AnonymizeLevel)}
-                            >
-                                <DropdownMenuRadioItem value={"none"}>
-                                    {t("settings.troubleshooting.anonymize.none")}
-                                </DropdownMenuRadioItem>
-                                <DropdownMenuRadioItem value={"default"}>
-                                    {t("settings.troubleshooting.anonymize.default")}
-                                </DropdownMenuRadioItem>
-                                <DropdownMenuRadioItem value={"strict"}>
-                                    {t("settings.troubleshooting.anonymize.strict")}
-                                </DropdownMenuRadioItem>
-                            </DropdownMenuRadioGroup>
-                        </DropdownMenuContent>
-                    </DropdownMenu>
-                </div>
-            </div>
+            <FancyToggleSwitch
+                value={anonymize}
+                onChange={setAnonymize}
+                label={t("settings.troubleshooting.anonymize.label")}
+                helpText={t("settings.troubleshooting.anonymize.help")}
+            />
             <FancyToggleSwitch
                 value={systemInfo}
                 onChange={setSystemInfo}

client/ui/i18n/locales/en/common.json

@@ -1013,27 +1013,11 @@
     },
     "settings.troubleshooting.anonymize.label": {
         "message": "Anonymize Sensitive Information",
-        "description": "Label for the anonymization level dropdown (None, Default, Strict)."
+        "description": "Toggle label: anonymize sensitive information in the bundle."
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Hides IP addresses, domains, and other sensitive values.",
-        "description": "Helper text under the anonymization dropdown. The level details live in the info tooltip."
-    },
-    "settings.troubleshooting.anonymize.info": {
-        "message": "Default keeps internal IPv4 addresses and peer names readable for support. Strict additionally anonymizes private (RFC 1918), CGNAT, and link-local IP addresses, peer names, and WireGuard public keys. Recurring values map to the same placeholder, so peers stay distinguishable. Use Strict when sharing the bundle outside your organization.",
-        "description": "Info tooltip explaining the anonymization levels. 'RFC 1918', 'CGNAT', 'link-local', and 'WireGuard' are technical terms — keep them."
-    },
-    "settings.troubleshooting.anonymize.none": {
-        "message": "None",
-        "description": "Dropdown option: no anonymization."
-    },
-    "settings.troubleshooting.anonymize.default": {
-        "message": "Default",
-        "description": "Dropdown option: default anonymization level."
-    },
-    "settings.troubleshooting.anonymize.strict": {
-        "message": "Strict",
-        "description": "Dropdown option: strict anonymization level."
+        "message": "Hides public IP addresses and non-NetBird domains from logs.",
+        "description": "Helper text for anonymizing logs (hides public IPs and non-NetBird domains)."
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Include System Information",

client/ui/services/debug.go

@@ -15,13 +15,10 @@ import (
 )
 
 type DebugBundleParams struct {
-	Anonymize bool `json:"anonymize"`
-	// AnonymizeLevel is "default" or "strict"; strict also anonymizes
-	// private IP ranges, peer names, and WireGuard public keys.
-	AnonymizeLevel string `json:"anonymizeLevel"`
-	SystemInfo     bool   `json:"systemInfo"`
-	UploadURL      string `json:"uploadUrl"`
-	LogFileCount   uint32 `json:"logFileCount"`
+	Anonymize    bool   `json:"anonymize"`
+	SystemInfo   bool   `json:"systemInfo"`
+	UploadURL    string `json:"uploadUrl"`
+	LogFileCount uint32 `json:"logFileCount"`
 }
 
 // DebugBundleResult: Path is set for local-only bundles, UploadedKey on upload
@@ -51,12 +48,11 @@ func (s *Debug) Bundle(ctx context.Context, p DebugBundleParams) (DebugBundleRes
 		return DebugBundleResult{}, err
 	}
 	resp, err := cli.DebugBundle(ctx, &proto.DebugBundleRequest{
-		Anonymize:      p.Anonymize,
-		AnonymizeLevel: p.AnonymizeLevel,
-		SystemInfo:     p.SystemInfo,
-		UploadURL:      p.UploadURL,
-		LogFileCount:   p.LogFileCount,
-		CliVersion:     version.NetbirdVersion(),
+		Anonymize:    p.Anonymize,
+		SystemInfo:   p.SystemInfo,
+		UploadURL:    p.UploadURL,
+		LogFileCount: p.LogFileCount,
+		CliVersion:   version.NetbirdVersion(),
 	})
 	if err != nil {
 		return DebugBundleResult{}, err

e2e/agentnetwork/chat_test.go

@@ -438,10 +438,14 @@ func TestProvidersMatrix(t *testing.T) {
 	// Create every provider, all enabled, each with a unique model string so the
 	// proxy's connect-time snapshot carries them all and model→provider routing
 	// is unambiguous (provider toggles after connect don't reconcile to the
-	// proxy, so we enable everything up front).
+	// proxy, so we enable everything up front). The first create bootstraps the
+	// cluster.
 	ids := make([]string, 0, len(matrix))
-	for _, pc := range matrix {
+	for i, pc := range matrix {
 		req := providerRequest(pc)
+		if i == 0 {
+			req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+		}
 		prov, perr := srv.CreateProvider(ctx, req)
 		require.NoError(t, perr, "create provider %s", pc.name)
 		ids = append(ids, prov.Id)

e2e/agentnetwork/custom_pricing_test.go

@@ -82,12 +82,13 @@ func provisionPricedProvider(t *testing.T, ctx context.Context, name string, mod
 	// need NOT be in the catalog — the operator names it and prices it here.
 	dummyKey := "sk-price-e2e"
 	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        name,
-		ProviderId:  "openai_api",
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &dummyKey,
-		Enabled:     ptr(true),
-		Models:      &models,
+		Name:             name,
+		ProviderId:       "openai_api",
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &dummyKey,
+		Enabled:          ptr(true),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
+		Models:           &models,
 	})
 	require.NoError(t, err, "create provider")
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })

e2e/agentnetwork/guardrail_block_test.go

@@ -113,14 +113,15 @@ func runPathRoutedGuardrailCase(t *testing.T, tc pathRoutedGuardrailCase) {
 
 	// Catch-all provider (no models) so the router forwards any model; a static
 	// bearer key means the router injects a static auth header instead of minting
-	// a GCP token.
+	// a GCP token. Bootstraps the cluster if it isn't already.
 	staticKey := "static-e2e-token"
 	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        tc.name,
-		ProviderId:  tc.catalogID,
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &staticKey,
-		Enabled:     ptr(true),
+		Name:             tc.name,
+		ProviderId:       tc.catalogID,
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &staticKey,
+		Enabled:          ptr(true),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
 	})
 	require.NoError(t, err, "create %s provider", tc.name)
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })

e2e/agentnetwork/guardrail_groupswitch_test.go

@@ -73,6 +73,7 @@ func TestGuardrailGroupSwitchTakesEffectAfterTTL(t *testing.T) {
 			{Id: modelA, InputPer1k: 0.001, OutputPer1k: 0.001},
 			{Id: modelB, InputPer1k: 0.001, OutputPer1k: 0.001},
 		},
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
 	})
 	require.NoError(t, err, "create provider")
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })

e2e/agentnetwork/guardrail_multipolicy_test.go

@@ -61,14 +61,15 @@ func TestGuardrailMultiPolicyModelAllowlist(t *testing.T) {
 	}
 
 	// pRestricted declares the two guardrailed models so routing is deterministic
-	// (model -> provider).
+	// (model -> provider). Created first, so it carries the bootstrap cluster.
 	pRestricted, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        "restricted",
-		ProviderId:  "openai_api",
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &staticKey,
-		Enabled:     ptr(true),
-		Models:      models(modelSelected, modelOther),
+		Name:             "restricted",
+		ProviderId:       "openai_api",
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &staticKey,
+		Enabled:          ptr(true),
+		Models:           models(modelSelected, modelOther),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
 	})
 	require.NoError(t, err, "create restricted provider")
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), pRestricted.Id) })

e2e/agentnetwork/guardrail_pergroup_providers_test.go

@@ -115,7 +115,7 @@ func TestGuardrailPerGroupAllowlist_AllProviders(t *testing.T) {
 	staticKey := "static-e2e-token"
 	enabled := true
 
-	for _, c := range cases {
+	for i, c := range cases {
 		req := api.AgentNetworkProviderRequest{
 			Name:        "e2e-pergroup-" + c.name,
 			ProviderId:  c.catalogID,
@@ -124,6 +124,9 @@ func TestGuardrailPerGroupAllowlist_AllProviders(t *testing.T) {
 			Enabled:     ptr(true),
 			Models:      c.models,
 		}
+		if i == 0 {
+			req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+		}
 		prov, perr := srv.CreateProvider(ctx, req)
 		require.NoError(t, perr, "create provider %s", c.name)
 		c.providerID = prov.Id
@@ -280,12 +283,13 @@ func TestGuardrailMultiGroupUser(t *testing.T) {
 
 	// P1 — union scenario: two restricting policies, one per group.
 	p1, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        "e2e-mg-union",
-		ProviderId:  "openai_api",
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &staticKey,
-		Enabled:     ptr(true),
-		Models:      priced(unionA, unionB, unionC),
+		Name:             "e2e-mg-union",
+		ProviderId:       "openai_api",
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &staticKey,
+		Enabled:          ptr(true),
+		Models:           priced(unionA, unionB, unionC),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
 	})
 	require.NoError(t, err, "create union provider")
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), p1.Id) })

e2e/agentnetwork/guardrail_test.go

@@ -115,11 +115,14 @@ func TestModelAllowlistEnforced(t *testing.T) {
 	})
 	require.NoError(t, err, "mint setup key")
 
-	// Providers with their configured (allowed) models
+	// Providers with their configured (allowed) models; the first bootstraps the cluster.
 	ids := make([]string, 0, len(providers))
 	allowed := make([]string, 0, len(providers))
-	for _, pc := range providers {
+	for i, pc := range providers {
 		req := providerRequest(pc)
+		if i == 0 {
+			req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+		}
 		prov, perr := srv.CreateProvider(ctx, req)
 		require.NoError(t, perr, "create provider %s", pc.name)
 		id := prov.Id

e2e/agentnetwork/main_test.go

@@ -14,7 +14,6 @@ import (
 	"time"
 
 	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
 )
 
 // srv is the shared combined server for the package, ready (PAT-authenticated)
@@ -43,14 +42,5 @@ func run(m *testing.M) int {
 		return 1
 	}
 
-	// Bootstrap the account's agent-network endpoint once for the package:
-	// providers no longer have settings side effects, and every data-plane
-	// test expects the shared account pinned to the combined proxy cluster.
-	cluster := harness.AgentNetworkCluster
-	if _, err := srv.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{ProxyAddress: &cluster}); err != nil {
-		fmt.Fprintf(os.Stderr, "e2e: bootstrap agent-network endpoint: %v\n", err)
-		return 1
-	}
-
 	return m.Run()
 }

e2e/agentnetwork/management_test.go

@@ -21,10 +21,11 @@ func ptr[T any](v T) *T { return &v }
 func newProvider(t *testing.T, ctx context.Context, name string) api.AgentNetworkProvider {
 	t.Helper()
 	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        name,
-		ProviderId:  "openai_api",
-		UpstreamUrl: "https://api.openai.com",
-		ApiKey:      ptr("sk-dummy-e2e-key"),
+		Name:             name,
+		ProviderId:       "openai_api",
+		UpstreamUrl:      "https://api.openai.com",
+		ApiKey:           ptr("sk-dummy-e2e-key"),
+		BootstrapCluster: ptr("eu.proxy.netbird.test"),
 	})
 	require.NoError(t, err, "create provider %q", name)
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
@@ -56,11 +57,17 @@ func TestProviderLifecycle(t *testing.T) {
 		}}
 	}
 
-	for _, pc := range cases {
-		pc := pc
+	for i, pc := range cases {
+		i, pc := i, pc
 		t.Run(pc.name, func(t *testing.T) {
 			req := providerRequest(pc)
 			req.Name = "lc-" + pc.name
+			// Bootstrap the cluster on the first create in case the matrix has
+			// not run (e.g. no provider keys → settings not yet bootstrapped).
+			if i == 0 {
+				req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+			}
+
 			prov, err := srv.CreateProvider(ctx, req)
 			require.NoError(t, err, "create %s provider", pc.name)
 			t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
@@ -130,65 +137,45 @@ func TestProviderValidation(t *testing.T) {
 	requireClientError(t, err)
 }
 
-// TestSettingsRoundTrip flips the collection toggles and confirms the
-// endpoint and proxy address stay immutable, then restores the original
-// state. A second bootstrap attempt must be rejected as a conflict.
+// TestSettingsRoundTrip flips the collection toggles and confirms cluster /
+// subdomain stay immutable, then restores the original state.
 func TestSettingsRoundTrip(t *testing.T) {
 	ctx := context.Background()
 
-	// The package's TestMain bootstrapped the shared account's endpoint.
+	// Settings are bootstrapped on first provider create.
+	newProvider(t, ctx, "Settings Bootstrap")
+
 	before, err := srv.GetSettings(ctx)
 	require.NoError(t, err, "get settings")
-	require.NotEmpty(t, before.Endpoint, "settings must carry the bootstrapped endpoint")
-	require.NotEmpty(t, before.ProxyAddress, "settings must carry the bootstrapped proxy address")
-
-	require.NotNil(t, before.AccessLogRetentionDays, "bootstrapped settings must carry a retention")
-	beforeRetention := *before.AccessLogRetentionDays
+	require.NotEmpty(t, before.Cluster, "settings must carry an assigned cluster")
 
 	flipped, err := srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Endpoint:               before.Endpoint,
-		ProxyAddress:           before.ProxyAddress,
 		EnableLogCollection:    !before.EnableLogCollection,
 		EnablePromptCollection: !before.EnablePromptCollection,
 		RedactPii:              !before.RedactPii,
-		AccessLogRetentionDays: beforeRetention,
 	})
 	require.NoError(t, err, "update settings")
 	assert.Equal(t, !before.EnableLogCollection, flipped.EnableLogCollection, "log collection toggle must flip")
 	assert.Equal(t, !before.EnablePromptCollection, flipped.EnablePromptCollection, "prompt collection toggle must flip")
-	require.NotNil(t, flipped.AccessLogRetentionDays)
-	assert.Equal(t, beforeRetention, *flipped.AccessLogRetentionDays,
-		"retention sent unchanged must round-trip, not reset to the zero value")
-	assert.Equal(t, before.Endpoint, flipped.Endpoint, "endpoint must be immutable across updates")
-	assert.Equal(t, before.ProxyAddress, flipped.ProxyAddress, "proxy address must be immutable across updates")
+	assert.Equal(t, before.Cluster, flipped.Cluster, "cluster must be immutable across updates")
+	assert.Equal(t, before.Subdomain, flipped.Subdomain, "subdomain must be immutable across updates")
 
-	// The account is already bootstrapped: a second bootstrap is a conflict,
-	// whatever shape it asks for.
-	_, err = srv.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
-		Endpoint: ptr("attacker.cluster.invalid"),
-	})
-	requireClientError(t, err)
-
-	// The identity fields ride along on the PUT as a required echo: a request
-	// carrying a different endpoint is rejected without applying anything.
+	// A cluster different from the pinned one must be rejected; echoing the
+	// pinned one back is valid.
 	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Endpoint:               "other.cluster.invalid",
-		ProxyAddress:           before.ProxyAddress,
+		Cluster:                ptr("attacker.cluster.invalid"),
 		EnableLogCollection:    before.EnableLogCollection,
 		EnablePromptCollection: before.EnablePromptCollection,
 		RedactPii:              before.RedactPii,
-		AccessLogRetentionDays: beforeRetention,
 	})
 	requireClientError(t, err)
 
 	// Restore the original toggles.
 	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Endpoint:               before.Endpoint,
-		ProxyAddress:           before.ProxyAddress,
+		Cluster:                ptr(before.Cluster),
 		EnableLogCollection:    before.EnableLogCollection,
 		EnablePromptCollection: before.EnablePromptCollection,
 		RedactPii:              before.RedactPii,
-		AccessLogRetentionDays: beforeRetention,
 	})
 	require.NoError(t, err, "restore settings")
 }

e2e/agentnetwork/settings_bootstrap_test.go

@@ -4,7 +4,6 @@ package agentnetwork
 
 import (
 	"context"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -15,8 +14,7 @@ import (
 )
 
 // harnessStartFresh boots a dedicated combined server with its own fresh
-// account and registers its teardown on t. Unlike the shared srv, the fresh
-// account has NOT had its agent-network endpoint bootstrapped.
+// account and registers its teardown on t.
 func harnessStartFresh(ctx context.Context, t *testing.T) (*harness.Combined, error) {
 	t.Helper()
 	fresh, err := harness.StartCombined(ctx)
@@ -30,16 +28,16 @@ func harnessStartFresh(ctx context.Context, t *testing.T) (*harness.Combined, er
 	return fresh, nil
 }
 
-// TestSettingsBootstrapViaPost covers the explicit bootstrap contract on an
+// TestSettingsBootstrapViaPut covers the settings-first bootstrap path on an
 // account that has never been bootstrapped: the GET reads as the defaults
-// with an empty endpoint/proxy_address, a PUT has no row to update and fails,
-// and a POST creates the row and assigns the immutable endpoint — labeled
-// beneath a proxy address here, with the toggle overrides from the same
-// request applied. The shared srv cannot provide that starting state
-// (TestMain bootstraps it), so this boots a dedicated combined server — the
-// image is already built and cached by TestMain's StartCombined, so the extra
-// cost is one container start.
-func TestSettingsBootstrapViaPost(t *testing.T) {
+// with an empty cluster/subdomain/endpoint, a PUT without a cluster has
+// nothing to pin and fails, and a PUT carrying a cluster creates the row and
+// pins it immutably. The shared srv cannot provide that starting state (any
+// provider-creating test bootstraps it, and test order is deliberately not
+// relied on), so this boots a dedicated combined server — the image is
+// already built and cached by TestMain's StartCombined, so the extra cost is
+// one container start.
+func TestSettingsBootstrapViaPut(t *testing.T) {
 	ctx := context.Background()
 
 	fresh, err := harnessStartFresh(ctx, t)
@@ -49,35 +47,32 @@ func TestSettingsBootstrapViaPost(t *testing.T) {
 	// as an error and not as a null body.
 	before, err := fresh.GetSettings(ctx)
 	require.NoError(t, err, "get settings on a fresh account must succeed")
-	assert.Empty(t, before.Endpoint, "endpoint must be empty before bootstrap")
-	assert.Empty(t, before.ProxyAddress, "proxy address must be empty before bootstrap")
-	assert.False(t, before.Dedicated, "an unbootstrapped account has no serving shape")
+	assert.Empty(t, before.Cluster, "cluster must be empty before bootstrap")
+	assert.Empty(t, before.Subdomain, "subdomain must be empty before bootstrap")
+	assert.Empty(t, before.Endpoint, "endpoint must be empty before bootstrap, not a bare dot")
 	assert.True(t, before.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
 	assert.False(t, before.EnablePromptCollection, "defaults must show prompt collection off")
 
-	// A PUT has no row to update yet — bootstrap is the explicit POST.
+	// A PUT without a cluster has nothing to pin the account to.
 	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		EnableLogCollection:    true,
-		AccessLogRetentionDays: 30,
+		EnableLogCollection: true,
 	})
 	requireClientError(t, err)
 
-	// A POST with a proxy address bootstraps a labeled endpoint and applies
-	// the toggles from the same request. Every toggle is set away from its
-	// bootstrap default so each assertion can actually fail.
+	// A PUT carrying a cluster bootstraps the account and applies the
+	// mutable fields from the same request. Every toggle is set away from
+	// its bootstrap default so each assertion can actually fail.
 	const cluster = "e2e.bootstrap.netbird.selfhosted"
-	bootstrapped, err := fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
-		ProxyAddress:           ptr(cluster),
-		EnableLogCollection:    ptr(false),
-		EnablePromptCollection: ptr(true),
-		RedactPii:              ptr(true),
+	bootstrapped, err := fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		Cluster:                ptr(cluster),
+		EnableLogCollection:    false,
+		EnablePromptCollection: true,
+		RedactPii:              true,
 	})
-	require.NoError(t, err, "bootstrap settings via POST must succeed")
-	assert.Equal(t, cluster, bootstrapped.ProxyAddress, "proxy address must be pinned from the request")
-	require.NotEmpty(t, bootstrapped.Endpoint, "endpoint must be assigned at bootstrap")
-	assert.True(t, strings.HasSuffix(bootstrapped.Endpoint, "."+cluster),
-		"labeled endpoint must hang one label beneath the proxy address: %s", bootstrapped.Endpoint)
-	assert.False(t, bootstrapped.Dedicated, "a labeled pin is not dedicated")
+	require.NoError(t, err, "bootstrap settings via PUT must succeed")
+	assert.Equal(t, cluster, bootstrapped.Cluster, "cluster must be pinned from the request")
+	require.NotEmpty(t, bootstrapped.Subdomain, "subdomain must be assigned at bootstrap")
+	assert.Equal(t, bootstrapped.Subdomain+"."+cluster, bootstrapped.Endpoint, "endpoint must combine subdomain and cluster")
 	assert.False(t, bootstrapped.EnableLogCollection, "log collection from the bootstrap request must override the default")
 	assert.True(t, bootstrapped.EnablePromptCollection, "prompt collection from the bootstrap request must apply")
 	assert.True(t, bootstrapped.RedactPii, "redact toggle from the bootstrap request must apply")
@@ -90,90 +85,30 @@ func TestSettingsBootstrapViaPost(t *testing.T) {
 	assert.Equal(t, bootstrapped.EnablePromptCollection, after.EnablePromptCollection, "prompt collection must persist")
 	assert.Equal(t, bootstrapped.RedactPii, after.RedactPii, "redact toggle must persist")
 
-	// Once bootstrapped, PUT updates the toggles. The identity fields ride
-	// along as a required echo of the assigned values; a matching echo is
-	// accepted and never written.
+	// Once bootstrapped, later updates may omit the cluster entirely.
 	persisted, err := fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Endpoint:               bootstrapped.Endpoint,
-		ProxyAddress:           bootstrapped.ProxyAddress,
 		EnableLogCollection:    true,
 		EnablePromptCollection: false,
 		RedactPii:              true,
-		AccessLogRetentionDays: 21,
 	})
-	require.NoError(t, err, "post-bootstrap update must succeed")
-	require.NotNil(t, persisted.AccessLogRetentionDays)
-	assert.Equal(t, 21, *persisted.AccessLogRetentionDays, "retention from the update must apply")
-	assert.Equal(t, bootstrapped.Endpoint, persisted.Endpoint, "endpoint must survive updates untouched")
-	assert.Equal(t, cluster, persisted.ProxyAddress, "proxy address must survive updates untouched")
+	require.NoError(t, err, "post-bootstrap update without cluster must succeed")
+	assert.Equal(t, cluster, persisted.Cluster, "omitted cluster must keep the pinned value")
 	assert.True(t, persisted.EnableLogCollection, "post-bootstrap toggle must apply")
 	assert.False(t, persisted.EnablePromptCollection, "post-bootstrap toggle must apply")
 
-	// The endpoint is immutable: a PUT carrying a different endpoint is
-	// rejected, and a second bootstrap is rejected as a conflict. Neither
-	// rejected write may disturb anything.
+	// The cluster is immutable: a different value is rejected rather than
+	// silently ignored, and the rejected update must not disturb anything.
 	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Endpoint:               "other.cluster.invalid",
-		ProxyAddress:           persisted.ProxyAddress,
-		EnableLogCollection:    persisted.EnableLogCollection,
-		EnablePromptCollection: persisted.EnablePromptCollection,
-		RedactPii:              persisted.RedactPii,
-		AccessLogRetentionDays: 21,
-	})
-	requireClientError(t, err)
-
-	_, err = fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
-		Endpoint: ptr("other.cluster.invalid"),
+		Cluster:             ptr("other.cluster.invalid"),
+		EnableLogCollection: false,
 	})
 	requireClientError(t, err)
 
 	final, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings after the rejected bootstrap must succeed")
-	assert.Equal(t, persisted.Endpoint, final.Endpoint, "rejected bootstrap must not change the endpoint")
-	assert.Equal(t, persisted.ProxyAddress, final.ProxyAddress, "rejected bootstrap must not change the proxy address")
-	assert.Equal(t, persisted.EnableLogCollection, final.EnableLogCollection, "rejected bootstrap must not apply its toggles")
-	assert.Equal(t, persisted.EnablePromptCollection, final.EnablePromptCollection, "rejected bootstrap must not apply its toggles")
-	assert.Equal(t, persisted.RedactPii, final.RedactPii, "rejected bootstrap must not apply its toggles")
-}
-
-// TestSettingsBootstrapSelfAddressed covers the dedicated shape end to end:
-// a POST carrying an endpoint claims the hostname verbatim, the proxy address
-// equals it, and the pin reads as dedicated — the address-first flow a
-// self-hosted operator uses before deploying the proxy that will declare it.
-// The tail covers the recovery path the guarded DELETE exists for: with no
-// providers and no proxy at the address, the claim can be released and a
-// fresh bootstrap succeeds — the fix for a typo'd immutable endpoint.
-func TestSettingsBootstrapSelfAddressed(t *testing.T) {
-	ctx := context.Background()
-
-	fresh, err := harnessStartFresh(ctx, t)
-	require.NoError(t, err, "start dedicated combined server")
-
-	created, err := fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
-		Endpoint: ptr("gw.e2e.netbird.selfhosted"),
-	})
-	require.NoError(t, err, "self-addressed bootstrap must succeed")
-	assert.Equal(t, "gw.e2e.netbird.selfhosted", created.Endpoint, "endpoint must be claimed verbatim")
-	assert.Equal(t, created.Endpoint, created.ProxyAddress, "self-addressed: proxy address is the endpoint")
-	assert.True(t, created.Dedicated, "a self-addressed pin is dedicated")
-
-	// No providers exist and no proxy declares the address, so both delete
-	// guards are clear: the delete releases the claim and the account reads
-	// as unbootstrapped defaults again.
-	require.NoError(t, fresh.DeleteSettings(ctx), "guarded delete with both guards clear must succeed")
-
-	after, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings after delete must succeed")
-	assert.Empty(t, after.Endpoint, "a deleted account must read as unbootstrapped")
-
-	// A second delete has nothing to remove.
-	requireClientError(t, fresh.DeleteSettings(ctx))
-
-	// Re-creating is a fresh bootstrap — the released hostname is free to be
-	// claimed again, or a different one chosen.
-	recreated, err := fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
-		Endpoint: ptr("gw2.e2e.netbird.selfhosted"),
-	})
-	require.NoError(t, err, "bootstrap after delete must succeed")
-	assert.Equal(t, "gw2.e2e.netbird.selfhosted", recreated.Endpoint, "the fresh bootstrap claims the new hostname")
+	require.NoError(t, err, "get settings after the rejected cluster change must succeed")
+	assert.Equal(t, persisted.Cluster, final.Cluster, "rejected update must not change the cluster")
+	assert.Equal(t, persisted.Endpoint, final.Endpoint, "rejected update must not change the endpoint")
+	assert.Equal(t, persisted.EnableLogCollection, final.EnableLogCollection, "rejected update must not apply its toggles")
+	assert.Equal(t, persisted.EnablePromptCollection, final.EnablePromptCollection, "rejected update must not apply its toggles")
+	assert.Equal(t, persisted.RedactPii, final.RedactPii, "rejected update must not apply its toggles")
 }

e2e/agentnetwork/skiptls_test.go

@@ -66,7 +66,9 @@ func TestProviderSkipTLSVerification(t *testing.T) {
 		}
 	}
 
+	// First create bootstraps the account cluster.
 	insecureReq := newReq("skip-tls", insecureModel, true)
+	insecureReq.BootstrapCluster = ptr(harness.AgentNetworkCluster)
 	insecureProv, err := srv.CreateProvider(ctx, insecureReq)
 	require.NoError(t, err, "create skip-tls provider")
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), insecureProv.Id) })

e2e/agentnetwork/vllm_test.go

@@ -57,11 +57,12 @@ func TestVLLMProvider(t *testing.T) {
 	// is enumerated so the router dispatches this model string to this provider.
 	dummyKey := "sk-vllm-e2e"
 	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        "vllm",
-		ProviderId:  "vllm",
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &dummyKey,
-		Enabled:     ptr(true),
+		Name:             "vllm",
+		ProviderId:       "vllm",
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &dummyKey,
+		Enabled:          ptr(true),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
 		Models: &[]api.AgentNetworkProviderModel{
 			{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002},
 		},

e2e/harness/agentnetwork.go

@@ -126,33 +126,17 @@ func (c *Combined) DeleteGuardrail(ctx context.Context, id string) error {
 	return anDelete(ctx, c, "/api/agent-network/guardrails/"+id)
 }
 
-// CreateSettings bootstraps the account's agent-network settings row,
-// assigning the immutable endpoint. Exactly one of req.ProxyAddress (labeled
-// endpoint beneath that cluster) and req.Endpoint (self-addressed dedicated
-// endpoint) must be set; a second bootstrap returns a conflict.
-func (c *Combined) CreateSettings(ctx context.Context, req api.AgentNetworkSettingsCreateRequest) (api.AgentNetworkSettings, error) {
-	return anRequest[api.AgentNetworkSettings](ctx, c, http.MethodPost, "/api/agent-network/settings", req)
-}
-
-// GetSettings returns the account's agent-network settings row. Before the
-// CreateSettings bootstrap it reads as the defaults with an empty endpoint.
+// GetSettings returns the account's agent-network settings row. It exists only
+// after the first provider create bootstraps it.
 func (c *Combined) GetSettings(ctx context.Context) (api.AgentNetworkSettings, error) {
 	return anRequest[api.AgentNetworkSettings](ctx, c, http.MethodGet, "/api/agent-network/settings", nil)
 }
 
-// UpdateSettings applies the mutable collection toggles. The request must
-// echo the assigned endpoint and proxy address unchanged — the server rejects
-// a PUT that tries to change them.
+// UpdateSettings applies the mutable collection toggles.
 func (c *Combined) UpdateSettings(ctx context.Context, req api.AgentNetworkSettingsRequest) (api.AgentNetworkSettings, error) {
 	return anRequest[api.AgentNetworkSettings](ctx, c, http.MethodPut, "/api/agent-network/settings", req)
 }
 
-// DeleteSettings removes the account's settings row, releasing the endpoint.
-// Refused while providers exist or a proxy is actively serving the endpoint.
-func (c *Combined) DeleteSettings(ctx context.Context) error {
-	return anDelete(ctx, c, "/api/agent-network/settings")
-}
-
 // ListConsumption returns the account's consumption rows (possibly empty).
 func (c *Combined) ListConsumption(ctx context.Context) ([]api.AgentNetworkConsumption, error) {
 	return anRequest[[]api.AgentNetworkConsumption](ctx, c, http.MethodGet, "/api/agent-network/consumption", nil)

go.mod

@@ -99,7 +99,7 @@ require (
 	github.com/pires/go-proxyproto v0.11.0
 	github.com/pkg/sftp v1.13.9
 	github.com/prometheus/client_golang v1.23.2
-	github.com/quic-go/quic-go v0.59.1
+	github.com/quic-go/quic-go v0.55.0
 	github.com/redis/go-redis/v9 v9.7.3
 	github.com/rs/xid v1.3.0
 	github.com/shirou/gopsutil/v4 v4.25.8
@@ -239,6 +239,7 @@ require (
 	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
 	github.com/jackc/puddle/v2 v2.2.1 // indirect
 	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
+	github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
@@ -339,4 +340,4 @@ replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-2
 
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
 
-replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260810103952-24e716aea4db
+replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4

go.sum

@@ -349,6 +349,8 @@ github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk
 github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
 github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
+github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1 h1:njuLRcjAuMKr7kI3D85AXWkw6/+v9PwtV6M6o11sWHQ=
+github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1/go.mod h1:alcuEEnZsY1WQsagKhZDsoPCRoOijYqhZvPwLG0kzVs=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
 github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
 github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
@@ -488,8 +490,8 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260810103952-24e716aea4db h1:gBOE2r4AW1soSmpYJC5/n9/1L8UQ8+HLjed8CY/TzZY=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260810103952-24e716aea4db/go.mod h1:bsdahLwBQxXjlmdPPeQyrTcDJfcqAr/ymFj0RXhwtWI=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4 h1:UKztc3QjWvzU5DZk+uYaOWN0x62NSe/pkxuPvzqZIy4=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
@@ -580,8 +582,8 @@ github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEo
 github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
 github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
 github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
-github.com/quic-go/quic-go v0.59.1 h1:0Gmua0HW1Tv7ANR7hUYwRyD0MG5OJfgvYSZasGZzBic=
-github.com/quic-go/quic-go v0.59.1/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/quic-go/quic-go v0.55.0 h1:zccPQIqYCXDt5NmcEabyYvOnomjs8Tlwl7tISjJh9Mk=
+github.com/quic-go/quic-go v0.55.0/go.mod h1:DR51ilwU1uE164KuWXhinFcKWGlEjzys2l8zUl5Ss1U=
 github.com/redis/go-redis/v9 v9.7.3 h1:YpPyAayJV+XErNsatSElgRZZVCwXX9QzkKYNvO7x0wM=
 github.com/redis/go-redis/v9 v9.7.3/go.mod h1:bGUrSggJ9X9GUmZpZNEOQKaANxSGgOEBRltRTZHSvrA=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
@@ -791,6 +793,7 @@ golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200810151505-1b9f1253b3ed/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201015000850-e3ed0017c211/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

infrastructure_files/migrate-to-enterprise.sh

@@ -173,11 +173,11 @@ EOF
 # ---------------------------------------------------------------------------
 
 detect_combined_service() {
-  yq eval '.services | to_entries | map(select(.value.image | test("^(ghcr\\.io/)?netbirdio/netbird-server([:@]|$)"))) | .[0].key // ""' "$COMPOSE_FILE"
+  yq eval '.services | to_entries | map(select(.value.image | test("^netbirdio/netbird-server"))) | .[0].key // ""' "$COMPOSE_FILE"
 }
 
 detect_dashboard_service() {
-  yq eval '.services | to_entries | map(select(.value.image | test("^(ghcr\\.io/)?netbirdio/dashboard([:@]|$)"))) | .[0].key // ""' "$COMPOSE_FILE"
+  yq eval '.services | to_entries | map(select(.value.image | test("^netbirdio/dashboard"))) | .[0].key // ""' "$COMPOSE_FILE"
 }
 
 detect_config_yaml_host_path() {
@@ -661,12 +661,12 @@ init_migration() {
   COMPOSE_NETWORK=$(detect_compose_network)
 
   if [[ -z "$COMBINED_SERVICE" ]]; then
-    echo "Could not find a service running netbirdio/netbird-server or ghcr.io/netbirdio/netbird-server in $COMPOSE_FILE." > /dev/stderr
+    echo "Could not find a service running netbirdio/netbird-server* in $COMPOSE_FILE." > /dev/stderr
     echo "This script targets the community combined-server deployment." > /dev/stderr
     exit 1
   fi
   if [[ -z "$DASHBOARD_SERVICE" ]]; then
-    echo "Could not find a service running netbirdio/dashboard or ghcr.io/netbirdio/dashboard in $COMPOSE_FILE." > /dev/stderr
+    echo "Could not find a service running netbirdio/dashboard* in $COMPOSE_FILE." > /dev/stderr
     exit 1
   fi
   if [[ -z "$CONFIG_YAML_HOST" ]]; then

management/internals/controllers/network_map/controller/controller.go

@@ -176,7 +176,6 @@ func (c *Controller) sendUpdateAccountPeers(ctx context.Context, accountID strin
 	semaphore := make(chan struct{}, 10)
 
 	c.injectAllProxyPolicies(ctx, account)
-	account.PrecomputePostureValidation(ctx)
 	dnsCache := &cache.DNSConfigCache{}
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)
@@ -358,7 +357,6 @@ func (c *Controller) sendUpdateForAffectedPeers(ctx context.Context, accountID s
 	// network map that omitted the synth DNS zone, and the agent kept
 	// resolving against the stale or absent record.
 	c.injectAllProxyPolicies(ctx, account)
-	account.PrecomputePostureValidation(ctx)
 	dnsCache := &cache.DNSConfigCache{}
 	dnsDomain := c.GetDNSDomain(account.Settings)
 	peersCustomZone := account.GetPeersCustomZone(ctx, dnsDomain)

management/internals/modules/agentnetwork/handlers/budget_handler_test.go

@@ -102,8 +102,8 @@ func TestSettingsHandler_GetExposesCollectionToggles(t *testing.T) {
 
 	require.NoError(t, f.store.SaveAgentNetworkSettings(context.Background(), &agentNetworkTypes.Settings{
 		AccountID:              testAccountID,
-		Domain:                 "violet.eu.proxy.netbird.io",
-		ProxyAddress:           "eu.proxy.netbird.io",
+		Cluster:                "eu.proxy.netbird.io",
+		Subdomain:              "violet",
 		EnableLogCollection:    true,
 		EnablePromptCollection: true,
 		RedactPii:              false,

management/internals/modules/agentnetwork/handlers/providers_handler.go

@@ -155,7 +155,12 @@ func (h *handler) createProvider(w http.ResponseWriter, r *http.Request) {
 	provider := types.NewProvider(userAuth.AccountId)
 	provider.FromAPIRequest(&req)
 
-	created, err := h.manager.CreateProvider(r.Context(), userAuth.UserId, provider)
+	bootstrapCluster := ""
+	if req.BootstrapCluster != nil {
+		bootstrapCluster = *req.BootstrapCluster
+	}
+
+	created, err := h.manager.CreateProvider(r.Context(), userAuth.UserId, provider, bootstrapCluster)
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return

management/internals/modules/agentnetwork/handlers/settings_handler.go

@@ -12,55 +12,13 @@ import (
 	"github.com/netbirdio/netbird/shared/management/http/util"
 )
 
-// addSettingsEndpoints registers the Agent Network settings routes. POST
-// bootstraps the settings row, assigning the account's immutable endpoint;
-// GET reads it (defaults with an empty endpoint before bootstrap); PUT
-// carries every field, replacing the mutable collection toggles and rejecting
-// any change to the identity fields; DELETE removes the row — guarded so it
-// stays a bootstrap-repair operation — releasing the endpoint for a fresh
-// bootstrap.
+// addSettingsEndpoints registers the Agent Network settings routes. The
+// settings row is bootstrapped server-side on first provider create or on the
+// first PUT carrying a cluster; GET reads it and PUT applies a partial update
+// of the mutable collection toggles (cluster/subdomain stay immutable).
 func (h *handler) addSettingsEndpoints(router *mux.Router) {
 	router.HandleFunc("/agent-network/settings", h.getSettings).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/settings", h.createSettings).Methods("POST", "OPTIONS")
 	router.HandleFunc("/agent-network/settings", h.updateSettings).Methods("PUT", "OPTIONS")
-	router.HandleFunc("/agent-network/settings", h.deleteSettings).Methods("DELETE", "OPTIONS")
-}
-
-// createSettings bootstraps the account's settings row. Exactly one of
-// proxy_address (labeled endpoint; the server allocates the label) and
-// endpoint (self-addressed, claimed verbatim) must be provided; optional
-// collection toggles ride along with defaults for omitted fields.
-func (h *handler) createSettings(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	var req api.AgentNetworkSettingsCreateRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
-		return
-	}
-
-	settings := types.DefaultSettings(userAuth.AccountId)
-	settings.FromAPICreateRequest(&req)
-
-	proxyAddress := ""
-	if req.ProxyAddress != nil {
-		proxyAddress = *req.ProxyAddress
-	}
-	endpoint := ""
-	if req.Endpoint != nil {
-		endpoint = *req.Endpoint
-	}
-
-	created, err := h.manager.CreateSettings(r.Context(), userAuth.UserId, settings, proxyAddress, endpoint)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	util.WriteJSONObject(r.Context(), w, created.ToAPIResponse())
 }
 
 // updateSettings replaces the mutable settings fields on the account's row.
@@ -90,24 +48,6 @@ func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
 }
 
-// deleteSettings removes the account's settings row, releasing the endpoint.
-// The manager refuses (412) while providers exist or a proxy is actively
-// serving the endpoint; a later POST bootstraps fresh, allocating a new
-// endpoint.
-func (h *handler) deleteSettings(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	if err := h.manager.DeleteSettings(r.Context(), userAuth.AccountId, userAuth.UserId); err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	util.WriteJSONObject(r.Context(), w, util.EmptyObject{})
-}
-
 // getSettings returns the account's agent-network settings. Accounts that
 // haven't been bootstrapped yet read as the defaults with an empty cluster,
 // subdomain and endpoint; the manager synthesises that view.

management/internals/modules/agentnetwork/handlers/settings_handler_test.go

@@ -1,25 +1,20 @@
 package handlers
 
 import (
-	"context"
 	"encoding/json"
-	"fmt"
 	"net/http"
-	"strings"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	rpproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 )
 
 // TestSettingsHandler_GetUnbootstrappedReturnsDefaults pins the settings-read
 // convention shared with the account and DNS settings endpoints: settings
 // always read as a JSON object. Before bootstrap that object carries the
-// defaults with an empty endpoint/proxy_address (the "not bootstrapped"
+// defaults with an empty cluster/subdomain/endpoint (the "not bootstrapped"
 // signal) and no timestamps — never a 404 and never the legacy null body.
 func TestSettingsHandler_GetUnbootstrappedReturnsDefaults(t *testing.T) {
 	f := newAgentNetworkHandlerFixture(t)
@@ -32,9 +27,9 @@ func TestSettingsHandler_GetUnbootstrappedReturnsDefaults(t *testing.T) {
 
 	var got api.AgentNetworkSettings
 	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Empty(t, got.Endpoint, "endpoint must be empty until bootstrapped")
-	assert.Empty(t, got.ProxyAddress, "proxy address must be empty until bootstrapped")
-	assert.False(t, got.Dedicated, "an unbootstrapped account has no serving shape")
+	assert.Empty(t, got.Cluster, "cluster must be empty until bootstrapped")
+	assert.Empty(t, got.Subdomain, "subdomain must be empty until bootstrapped")
+	assert.Empty(t, got.Endpoint, "endpoint must be empty until bootstrapped, not a bare dot")
 	assert.True(t, got.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
 	assert.False(t, got.EnablePromptCollection, "defaults must show prompt collection off")
 	assert.False(t, got.RedactPii, "defaults must show redaction off")
@@ -44,149 +39,62 @@ func TestSettingsHandler_GetUnbootstrappedReturnsDefaults(t *testing.T) {
 	assert.Nil(t, got.UpdatedAt, "no timestamps before a row exists")
 }
 
-// TestSettingsHandler_PostBootstrapsLabeled covers the labeled bootstrap
-// shape: a POST carrying a proxy_address allocates a label beneath it, so the
-// endpoint hangs one label under the shared cluster's address and the pin is
-// not dedicated. Toggles riding along apply; omitted ones keep defaults.
-func TestSettingsHandler_PostBootstrapsLabeled(t *testing.T) {
+// TestSettingsHandler_PutBootstrapsWithCluster covers the settings-first
+// bootstrap path: a PUT carrying a cluster on an unbootstrapped account
+// creates the row (cluster pinned, subdomain assigned) and applies the
+// mutable fields from the same request.
+func TestSettingsHandler_PutBootstrapsWithCluster(t *testing.T) {
 	f := newAgentNetworkHandlerFixture(t)
 
-	rec := f.do(t, http.MethodPost, "/agent-network/settings",
-		`{"proxy_address": "eu.proxy.netbird.io", "enable_prompt_collection": true, "access_log_retention_days": 14}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
+	rec := f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": true, "redact_pii": false, "access_log_retention_days": 30}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap PUT must succeed: %s", rec.Body.String())
 
 	var got api.AgentNetworkSettings
 	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, "eu.proxy.netbird.io", got.ProxyAddress, "proxy address must be pinned from the request")
-	require.NotEmpty(t, got.Endpoint, "endpoint must be allocated at bootstrap")
-	assert.True(t, strings.HasSuffix(got.Endpoint, ".eu.proxy.netbird.io"),
-		"labeled endpoint must hang off the proxy address: %s", got.Endpoint)
-	label := strings.TrimSuffix(got.Endpoint, ".eu.proxy.netbird.io")
-	assert.NotContains(t, label, ".", "the allocated label must be a single DNS label: %s", label)
-	assert.False(t, got.Dedicated, "a labeled pin is not dedicated")
-	assert.True(t, got.EnableLogCollection, "omitted toggle must keep its default")
+	assert.Equal(t, "eu.proxy.netbird.io", got.Cluster, "cluster must be pinned from the request")
+	assert.NotEmpty(t, got.Subdomain, "subdomain must be assigned at bootstrap")
+	assert.Equal(t, got.Subdomain+".eu.proxy.netbird.io", got.Endpoint, "endpoint must combine subdomain and cluster")
+	assert.True(t, got.EnableLogCollection, "toggle from the bootstrap request must apply")
 	assert.True(t, got.EnablePromptCollection, "toggle from the bootstrap request must apply")
 	require.NotNil(t, got.AccessLogRetentionDays)
-	assert.Equal(t, 14, *got.AccessLogRetentionDays, "retention from the bootstrap request must apply")
-	assert.NotNil(t, got.CreatedAt, "a persisted row carries timestamps")
+	assert.Equal(t, 30, *got.AccessLogRetentionDays, "retention from the bootstrap request must apply")
 
 	// The row is now readable via GET.
 	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
 	require.Equal(t, http.StatusOK, rec.Code, "GET after bootstrap must succeed")
-	var read api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &read))
-	assert.Equal(t, got.Endpoint, read.Endpoint, "GET must return the bootstrapped endpoint")
 }
 
-// TestSettingsHandler_PostBootstrapsSelfAddressed covers the dedicated shape:
-// a POST carrying an endpoint claims the hostname verbatim, the proxy address
-// equals it, and the pin reads as dedicated. The claim is legitimate before
-// any proxy declares the address (address-first).
-func TestSettingsHandler_PostBootstrapsSelfAddressed(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPost, "/agent-network/settings",
-		`{"endpoint": "Brave-Otter.Gateway.Example.com"}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, "brave-otter.gateway.example.com", got.Endpoint,
-		"endpoint must be claimed verbatim, lowercased")
-	assert.Equal(t, got.Endpoint, got.ProxyAddress, "self-addressed: the proxy address is the endpoint")
-	assert.True(t, got.Dedicated, "a self-addressed pin is dedicated")
-	assert.True(t, got.EnableLogCollection, "omitted toggles must keep their defaults")
-}
-
-// TestSettingsHandler_PostRequiresExactlyOneIdentityField pins the request
-// contract: proxy_address and endpoint are mutually exclusive and one is
-// required — both or neither is a validation error, not a guess.
-func TestSettingsHandler_PostRequiresExactlyOneIdentityField(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPost, "/agent-network/settings", `{}`)
-	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
-		"empty POST must be rejected: got %d body=%s", rec.Code, rec.Body.String())
-
-	rec = f.do(t, http.MethodPost, "/agent-network/settings",
-		`{"proxy_address": "eu.proxy.netbird.io", "endpoint": "brave-otter.gateway.example.com"}`)
-	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
-		"POST with both identity fields must be rejected: got %d body=%s", rec.Code, rec.Body.String())
-}
-
-// TestSettingsHandler_PostRejectsMalformedHostnames pins per-write input
-// validation: shapes canonicalization cannot repair — trailing dots, embedded
-// whitespace, empty labels — are rejected with a validation error instead of
-// landing in an immutable column.
-func TestSettingsHandler_PostRejectsMalformedHostnames(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	for name, body := range map[string]string{
-		"trailing dot":     `{"endpoint": "gateway.example.com."}`,
-		"leading dot":      `{"endpoint": ".gateway.example.com"}`,
-		"inner whitespace": `{"endpoint": "gate way.example.com"}`,
-		"empty label":      `{"proxy_address": "eu..proxy.netbird.io"}`,
-	} {
-		rec := f.do(t, http.MethodPost, "/agent-network/settings", body)
-		assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
-			"%s must be rejected: got %d body=%s", name, rec.Code, rec.Body.String())
-	}
-}
-
-// TestSettingsHandler_PostConflictsOnSecondBootstrap pins that bootstrap is a
-// one-time create: a second POST returns 409 and leaves the row untouched.
-func TestSettingsHandler_PostConflictsOnSecondBootstrap(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPost, "/agent-network/settings", `{"proxy_address": "eu.proxy.netbird.io"}`)
-	require.Equal(t, http.StatusOK, rec.Code, "first bootstrap must succeed: %s", rec.Body.String())
-	var first api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &first))
-
-	rec = f.do(t, http.MethodPost, "/agent-network/settings", `{"proxy_address": "us.proxy.netbird.io"}`)
-	assert.Equal(t, http.StatusConflict, rec.Code,
-		"second bootstrap must 409: got %d body=%s", rec.Code, rec.Body.String())
-
-	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code)
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, first.Endpoint, got.Endpoint, "the original endpoint must survive the rejected bootstrap")
-	assert.Equal(t, first.ProxyAddress, got.ProxyAddress, "the original proxy address must survive")
-}
-
-// TestSettingsHandler_PutBeforeBootstrapIs404 pins that a PUT cannot conjure a
-// settings row out of nothing — bootstrap is the explicit POST — and the
-// error points the caller there.
-func TestSettingsHandler_PutBeforeBootstrapIs404(t *testing.T) {
+// TestSettingsHandler_PutWithoutClusterOnUnbootstrapped pins that a PUT
+// without a cluster cannot conjure a settings row out of nothing — there is
+// no cluster to pin — and surfaces as 404 like the GET.
+func TestSettingsHandler_PutWithoutClusterOnUnbootstrapped(t *testing.T) {
 	f := newAgentNetworkHandlerFixture(t)
 
 	rec := f.do(t, http.MethodPut, "/agent-network/settings",
 		`{"enable_log_collection": false, "enable_prompt_collection": false, "redact_pii": false}`)
 	assert.Equal(t, http.StatusNotFound, rec.Code,
-		"PUT on an unbootstrapped account must 404: got %d body=%s", rec.Code, rec.Body.String())
-	assert.Contains(t, rec.Body.String(), "/api/agent-network/settings",
-		"the error must point the caller at the bootstrap POST: %s", rec.Body.String())
+		"cluster-less PUT on an unbootstrapped account must 404: got %d body=%s", rec.Code, rec.Body.String())
+	assert.Contains(t, rec.Body.String(), "cluster",
+		"the error must point the caller at the bootstrap paths: %s", rec.Body.String())
 }
 
 // TestSettingsHandler_PutReplacesMutableFields pins the update contract shared
-// with the other PUT endpoints: the request carries every field, replacing the
-// mutable ones. The identity fields ride along as a required echo of the
-// assigned values — compared, never written — so the endpoint and proxy
-// address survive every accepted update.
+// with the other PUT endpoints: the request replaces every mutable field, so a
+// toggle absent from the JSON lands as its zero value rather than being
+// preserved. Cluster and subdomain survive untouched.
 func TestSettingsHandler_PutReplacesMutableFields(t *testing.T) {
 	f := newAgentNetworkHandlerFixture(t)
 
-	rec := f.do(t, http.MethodPost, "/agent-network/settings",
-		`{"proxy_address": "eu.proxy.netbird.io", "enable_prompt_collection": true, "redact_pii": true, "access_log_retention_days": 14}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
+	rec := f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": true, "redact_pii": true, "access_log_retention_days": 14}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap PUT must succeed: %s", rec.Body.String())
 
 	var before api.AgentNetworkSettings
 	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &before))
 
-	rec = f.do(t, http.MethodPut, "/agent-network/settings", fmt.Sprintf(
-		`{"endpoint": %q, "proxy_address": %q, "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false, "access_log_retention_days": 7}`,
-		before.Endpoint, before.ProxyAddress))
+	rec = f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
 	require.Equal(t, http.StatusOK, rec.Code, "update PUT must succeed: %s", rec.Body.String())
 
 	var got api.AgentNetworkSettings
@@ -195,201 +103,35 @@ func TestSettingsHandler_PutReplacesMutableFields(t *testing.T) {
 	assert.False(t, got.EnablePromptCollection, "sent toggle must apply")
 	assert.False(t, got.RedactPii, "sent toggle must apply")
 	require.NotNil(t, got.AccessLogRetentionDays)
-	assert.Equal(t, 7, *got.AccessLogRetentionDays, "sent retention must apply")
-	assert.Equal(t, before.Endpoint, got.Endpoint, "endpoint must survive updates untouched")
-	assert.Equal(t, before.ProxyAddress, got.ProxyAddress, "proxy address must survive updates untouched")
-}
-
-// TestSettingsHandler_PutRejectsChangedIdentity pins the immutability contract:
-// the PUT carries the identity fields like every other field, but they are an
-// echo — a request carrying a different endpoint or proxy address is rejected
-// as a validation error and the row is left untouched. The comparison is
-// lenient about casing (the stored values are normalized lowercase), so a
-// client replaying a GET response with different casing is not rejected.
-func TestSettingsHandler_PutRejectsChangedIdentity(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPost, "/agent-network/settings",
-		`{"proxy_address": "eu.proxy.netbird.io", "enable_prompt_collection": true}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
-	var before api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &before))
-
-	for name, body := range map[string]string{
-		"changed endpoint": fmt.Sprintf(
-			`{"endpoint": "other.gateway.example.com", "proxy_address": %q, "enable_log_collection": false, "enable_prompt_collection": false, "redact_pii": false, "access_log_retention_days": 30}`,
-			before.ProxyAddress),
-		"changed proxy_address": fmt.Sprintf(
-			`{"endpoint": %q, "proxy_address": "us.proxy.netbird.io", "enable_log_collection": false, "enable_prompt_collection": false, "redact_pii": false, "access_log_retention_days": 30}`,
-			before.Endpoint),
-		"omitted identity": `{"enable_log_collection": false, "enable_prompt_collection": false, "redact_pii": false, "access_log_retention_days": 30}`,
-	} {
-		rec = f.do(t, http.MethodPut, "/agent-network/settings", body)
-		assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
-			"%s must be rejected: got %d body=%s", name, rec.Code, rec.Body.String())
-	}
-
-	// The rejected updates must not have applied anything — toggles included.
-	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code)
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, before.Endpoint, got.Endpoint, "rejected PUT must not change the endpoint")
-	assert.Equal(t, before.ProxyAddress, got.ProxyAddress, "rejected PUT must not change the proxy address")
-	assert.True(t, got.EnablePromptCollection, "rejected PUT must not apply its toggles")
-
-	// An uppercased echo of the assigned values still names the same host and
-	// must be accepted.
-	rec = f.do(t, http.MethodPut, "/agent-network/settings", fmt.Sprintf(
-		`{"endpoint": %q, "proxy_address": %q, "enable_log_collection": true, "enable_prompt_collection": true, "redact_pii": false, "access_log_retention_days": 30}`,
-		strings.ToUpper(before.Endpoint), strings.ToUpper(before.ProxyAddress)))
-	assert.Equal(t, http.StatusOK, rec.Code,
-		"an uppercased identity echo must be accepted: got %d body=%s", rec.Code, rec.Body.String())
-}
-
-// TestSettingsHandler_PutOmittedRetentionLandsAsZero documents a residual the
-// required-ness of access_log_retention_days does not remove. Marking the field
-// required changes the generated client type from *int to int, so a generated
-// client cannot omit it — but nothing validates OpenAPI required-ness at
-// runtime, so a hand-rolled body without the field still decodes as 0, which
-// the API documents as "keep indefinitely".
-//
-// That is the same latitude the three booleans already have, so it is left
-// consistent rather than special-cased. This test exists to make the gap
-// explicit: if request validation is ever added, this expectation is what
-// changes.
-func TestSettingsHandler_PutOmittedRetentionLandsAsZero(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPost, "/agent-network/settings",
-		`{"proxy_address": "eu.proxy.netbird.io", "access_log_retention_days": 14}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
-	var before api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &before))
-
-	rec = f.do(t, http.MethodPut, "/agent-network/settings", fmt.Sprintf(
-		`{"endpoint": %q, "proxy_address": %q, "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`,
-		before.Endpoint, before.ProxyAddress))
-	require.Equal(t, http.StatusOK, rec.Code, "update PUT must succeed: %s", rec.Body.String())
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	require.NotNil(t, got.AccessLogRetentionDays)
 	assert.Equal(t, 0, *got.AccessLogRetentionDays,
-		"a non-conforming body that omits retention still replaces it with the zero value")
+		"retention absent from the request must land as the zero value — PUT replaces all mutable fields")
+	assert.Equal(t, before.Cluster, got.Cluster, "cluster must survive updates untouched")
+	assert.Equal(t, before.Subdomain, got.Subdomain, "subdomain must survive updates untouched")
 }
 
-// TestSettingsHandler_DeleteBeforeBootstrapIs404 pins that DELETE on an
-// account with no settings row is a 404, mirroring the PUT.
-func TestSettingsHandler_DeleteBeforeBootstrapIs404(t *testing.T) {
+// TestSettingsHandler_PutRejectsClusterChange pins cluster immutability: once
+// assigned, a differing cluster is rejected as a validation error instead of
+// being silently ignored, so callers never observe a value other than the one
+// they sent. Echoing the assigned cluster back stays valid, which lets
+// declarative clients send their full desired state idempotently.
+func TestSettingsHandler_PutRejectsClusterChange(t *testing.T) {
 	f := newAgentNetworkHandlerFixture(t)
 
-	rec := f.do(t, http.MethodDelete, "/agent-network/settings", "")
-	assert.Equal(t, http.StatusNotFound, rec.Code,
-		"DELETE on an unbootstrapped account must 404: got %d body=%s", rec.Code, rec.Body.String())
-}
+	rec := f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap PUT must succeed: %s", rec.Body.String())
 
-// TestSettingsHandler_DeleteBlockedByProviders pins the first delete guard:
-// while any provider exists for the account, the delete is refused with 412
-// and the row survives. Providers route through the endpoint — the guard
-// keeps DELETE a bootstrap-repair operation rather than a way to abandon a
-// configured gateway.
-func TestSettingsHandler_DeleteBlockedByProviders(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
+	rec = f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"cluster": "us.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
+	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
+		"cluster change must be rejected as a validation error: got %d body=%s", rec.Code, rec.Body.String())
 
-	rec := f.do(t, http.MethodPost, "/agent-network/settings", `{"proxy_address": "eu.proxy.netbird.io"}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
-	var before api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &before))
+	rec = f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": true}`)
+	require.Equal(t, http.StatusOK, rec.Code, "echoing the assigned cluster must stay valid: %s", rec.Body.String())
 
-	f.seedProvider(t, "prov-guard")
-
-	rec = f.do(t, http.MethodDelete, "/agent-network/settings", "")
-	assert.Equal(t, http.StatusPreconditionFailed, rec.Code,
-		"delete with a provider present must be refused: got %d body=%s", rec.Code, rec.Body.String())
-
-	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code)
 	var got api.AgentNetworkSettings
 	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, before.Endpoint, got.Endpoint, "the refused delete must leave the row intact")
-}
-
-// TestSettingsHandler_DeleteBlockedByActiveProxy pins the second delete
-// guard: while a proxy is actively serving the endpoint — an active proxy
-// row declaring the endpoint hostname as its cluster address, the dedicated
-// shape — the delete is refused with 412. A proxy that has disconnected no
-// longer blocks: the guard is about a live serving path, not history.
-//
-// The proxy declares its address with mixed casing on purpose: Connect
-// stores the declared address verbatim while the settings row is normalized
-// lowercase, and hostnames are case-insensitive, so the guard must match
-// across the casing difference rather than be sidestepped by it.
-func TestSettingsHandler_DeleteBlockedByActiveProxy(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	const endpoint = "gw.dedicated.example.com"
-	rec := f.do(t, http.MethodPost, "/agent-network/settings", fmt.Sprintf(`{"endpoint": %q}`, endpoint))
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
-
-	now := time.Now()
-	accountID := testAccountID
-	proxyRow := &rpproxy.Proxy{
-		ID:             "proxy-guard",
-		SessionID:      "sess-1",
-		ClusterAddress: "GW.Dedicated.Example.Com",
-		AccountID:      &accountID,
-		LastSeen:       now,
-		ConnectedAt:    &now,
-		Status:         rpproxy.StatusConnected,
-	}
-	require.NoError(t, f.store.SaveProxy(context.Background(), proxyRow))
-
-	rec = f.do(t, http.MethodDelete, "/agent-network/settings", "")
-	assert.Equal(t, http.StatusPreconditionFailed, rec.Code,
-		"delete with an active proxy at the endpoint must be refused: got %d body=%s", rec.Code, rec.Body.String())
-
-	// Once the proxy disconnects it no longer serves the endpoint, so the
-	// delete goes through.
-	require.NoError(t, f.store.DisconnectProxy(context.Background(), proxyRow.ID, proxyRow.SessionID))
-	rec = f.do(t, http.MethodDelete, "/agent-network/settings", "")
-	assert.Equal(t, http.StatusOK, rec.Code,
-		"delete after the proxy disconnected must succeed: got %d body=%s", rec.Code, rec.Body.String())
-}
-
-// TestSettingsHandler_DeleteReleasesEndpointForFreshBootstrap pins the
-// full-reset semantic that gives replace-on-change clients (e.g. Terraform's
-// RequiresReplace) a real path: with both guards clear the delete succeeds,
-// the account reads as the defaults again, and a fresh bootstrap draws a
-// fresh label. The released hostname is not reserved — a fresh draw may even
-// legitimately re-pick it — so the assertions check the new row's shape, not
-// that the label differs.
-func TestSettingsHandler_DeleteReleasesEndpointForFreshBootstrap(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPost, "/agent-network/settings",
-		`{"proxy_address": "eu.proxy.netbird.io", "enable_prompt_collection": true}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
-
-	rec = f.do(t, http.MethodDelete, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code,
-		"delete with both guards clear must succeed: got %d body=%s", rec.Code, rec.Body.String())
-
-	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code)
-	var after api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &after))
-	assert.Empty(t, after.Endpoint, "a deleted account must read as unbootstrapped defaults")
-	assert.False(t, after.EnablePromptCollection, "the deleted row's toggles must not linger")
-
-	rec = f.do(t, http.MethodPost, "/agent-network/settings", `{"proxy_address": "eu.proxy.netbird.io"}`)
-	require.Equal(t, http.StatusOK, rec.Code, "re-bootstrap after delete must succeed: %s", rec.Body.String())
-	var second api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &second))
-	require.NotEmpty(t, second.Endpoint, "the fresh bootstrap must allocate an endpoint")
-	assert.True(t, strings.HasSuffix(second.Endpoint, ".eu.proxy.netbird.io"),
-		"the fresh endpoint must hang beneath the requested proxy address: %s", second.Endpoint)
-	assert.False(t, second.EnablePromptCollection,
-		"the fresh row must carry bootstrap defaults, not the deleted row's toggles")
-	assert.NotNil(t, second.CreatedAt, "the fresh row is persisted and carries timestamps")
+	assert.Equal(t, "eu.proxy.netbird.io", got.Cluster, "cluster must be unchanged")
+	assert.True(t, got.RedactPii, "toggle sent alongside the echoed cluster must apply")
 }

management/internals/modules/agentnetwork/labelgen/adjectives.go

@@ -1,37 +0,0 @@
-package labelgen
-
-// adjectives is the descriptor half of a generated label. It pairs with the
-// noun pool in words.go to form `<adjective>-<noun>` labels, and is kept
-// separate because words.go is almost entirely nouns — drawing both halves
-// from it produced unreadable pairs like "millet-hammock". Entries are
-// lowercase ASCII, 4-12 chars, free of hyphens and digits, screened for
-// offensive/brand/region-specific terms, and disjoint from the noun pool
-// (enforced by TestAdjectives_AreDisjointFromNouns).
-var adjectives = []string{
-	"able", "active", "adept", "agile", "airy", "alert", "amiable", "ample",
-	"ancient", "ardent", "artful", "astute", "balmy", "blithe", "bold", "bonny",
-	"brave", "breezy", "brisk", "bubbly", "buoyant", "bushy", "candid", "canny",
-	"cheery", "chilly", "chipper", "chunky", "civil", "classic", "clever", "comely",
-	"compact", "cordial", "cosmic", "courtly", "crafty", "creamy", "crisp", "cuddly",
-	"curious", "dainty", "dapper", "daring", "dashing", "deft", "dewy", "diligent",
-	"downy", "dreamy", "dulcet", "durable", "dusky", "eager", "earnest", "earthy",
-	"easy", "elated", "elegant", "epic", "fabled", "faithful", "fancy", "fearless",
-	"feisty", "fervent", "fleet", "fluffy", "fond", "frisky", "frosty", "gallant",
-	"genial", "genteel", "gentle", "giddy", "gilded", "glad", "glassy", "gleaming",
-	"glossy", "graceful", "grand", "grainy", "hale", "hardy", "hearty", "hefty",
-	"honest", "hopeful", "humble", "hushed", "immense", "jaunty", "jolly", "jovial",
-	"joyful", "jubilant", "keen", "kindly", "kindred", "lanky", "leafy", "limber",
-	"lively", "lofty", "loyal", "lucent", "lucid", "luminous", "lush", "maroon",
-	"mellow", "merry", "mighty", "mindful", "mirthful", "misty", "modest", "muted",
-	"nifty", "nimble", "noble", "patient", "peaceful", "pearly", "peppy", "perky",
-	"petite", "placid", "playful", "pleasant", "plucky", "plush", "polite", "posh",
-	"prancing", "pristine", "prompt", "proud", "prudent", "quaint", "quick", "quirky",
-	"radiant", "ready", "regal", "restful", "robust", "rosy", "ruddy", "rugged",
-	"sandy", "satin", "saucy", "savvy", "sedate", "serene", "shady", "shiny",
-	"silken", "silky", "sincere", "sleek", "slender", "smart", "smooth", "snappy",
-	"snug", "soaring", "sparkly", "spiffy", "spirited", "sprightly", "spry", "stalwart",
-	"stately", "steady", "sterling", "stoic", "stormy", "stout", "sturdy", "sunlit",
-	"supple", "svelte", "tawny", "tender", "tidy", "timeless", "trusty", "upbeat",
-	"urbane", "valiant", "vast", "vernal", "vibrant", "vintage", "whimsy", "willing",
-	"windy", "winsome", "wintry", "witty", "worthy", "zesty", "zippy",
-}

management/internals/modules/agentnetwork/labelgen/labelgen.go

@@ -64,20 +64,3 @@ func PickUnique(rng *rand.Rand, taken map[string]struct{}, fallbackSuffix string
 	w := pool[rng.Intn(len(pool))]
 	return fmt.Sprintf("%s-%s", w, fallbackSuffix)
 }
-
-// PickTuple returns an adjective-noun label such as "brave-otter". It is still
-// a single DNS label.
-//
-// Unlike PickUnique it takes no `taken` set and has no fallback suffix. The
-// noun pool holds 857 entries, which is ample per cluster but a hard ceiling
-// once labels must be unique across one shared zone; pairing an adjective with
-// a noun spans len(adjectives) * 857 instead. Uniqueness is enforced by a
-// database constraint and retried by the caller, rather than guessed from a
-// pre-read set that a concurrent allocation can invalidate.
-func PickTuple(rng *rand.Rand) string {
-	nouns := uniqueWords()
-	if len(nouns) == 0 || len(adjectives) == 0 {
-		return ""
-	}
-	return adjectives[rng.Intn(len(adjectives))] + "-" + nouns[rng.Intn(len(nouns))]
-}

management/internals/modules/agentnetwork/labelgen/labelgen_test.go

@@ -99,82 +99,3 @@ func TestUniqueWords_DropsDuplicates(t *testing.T) {
 	}
 	assert.GreaterOrEqual(t, len(pool), 500, "Pool must contain at least 500 unique words")
 }
-
-// TestPickTuple_ShapeAndPoolMembership locks the wire-visible shape: an
-// adjective and a noun, each from its own pool, joined by a single hyphen so
-// the result stays one DNS label.
-func TestPickTuple_ShapeAndPoolMembership(t *testing.T) {
-	nouns := uniqueWords()
-	inNouns := make(map[string]struct{}, len(nouns))
-	for _, w := range nouns {
-		inNouns[w] = struct{}{}
-	}
-	inAdjectives := make(map[string]struct{}, len(adjectives))
-	for _, a := range adjectives {
-		inAdjectives[a] = struct{}{}
-	}
-
-	rng := rand.New(rand.NewSource(7))
-	for i := 0; i < 200; i++ {
-		got := PickTuple(rng)
-
-		parts := strings.Split(got, "-")
-		require.Len(t, parts, 2, "PickTuple must produce exactly two hyphen-joined words; got %q", got)
-
-		_, adjOK := inAdjectives[parts[0]]
-		assert.True(t, adjOK, "First half must be an adjective; %q not in adjectives (from %q)", parts[0], got)
-		_, nounOK := inNouns[parts[1]]
-		assert.True(t, nounOK, "Second half must be a noun; %q not in words (from %q)", parts[1], got)
-
-		assert.LessOrEqual(t, len(got), 63, "Label must fit a DNS label; got %q (%d chars)", got, len(got))
-	}
-}
-
-// TestAdjectives_AreDisjointFromNouns keeps the namespace a clean product and
-// prevents nonsense like "azure-azure": a handful of the noun pool's entries
-// are adjectival, and any overlap would let the same word land on both sides.
-func TestAdjectives_AreDisjointFromNouns(t *testing.T) {
-	nouns := make(map[string]struct{}, len(uniqueWords()))
-	for _, w := range uniqueWords() {
-		nouns[w] = struct{}{}
-	}
-	for _, a := range adjectives {
-		_, clash := nouns[a]
-		assert.False(t, clash, "Adjective %q also appears in the noun pool; remove it from one list", a)
-	}
-}
-
-// TestAdjectives_AreDNSSafeAndDeduplicated mirrors the curation contract stated
-// in words.go: lowercase ASCII, 4-12 chars, no digits or hyphens, no repeats.
-func TestAdjectives_AreDNSSafeAndDeduplicated(t *testing.T) {
-	seen := make(map[string]struct{}, len(adjectives))
-	for _, a := range adjectives {
-		_, dup := seen[a]
-		assert.False(t, dup, "Duplicate adjective %q", a)
-		seen[a] = struct{}{}
-
-		assert.Regexp(t, `^[a-z]{4,12}$`, a, "Adjective %q must be 4-12 lowercase ASCII letters", a)
-	}
-	assert.Greater(t, len(adjectives), 150, "Adjective pool too small to give a useful namespace")
-}
-
-// TestPickTuple_DeterministicWithSeededRng documents that generation is a pure
-// function of the rng, which is what makes allocation retries reproducible in tests.
-func TestPickTuple_DeterministicWithSeededRng(t *testing.T) {
-	a := PickTuple(rand.New(rand.NewSource(42)))
-	b := PickTuple(rand.New(rand.NewSource(42)))
-	assert.Equal(t, a, b, "Same seed must yield the same tuple")
-}
-
-// TestPickTuple_SpansALargeNamespace guards the reason we moved to tuples: a
-// single-word pool caps the GLOBAL namespace at 857. Drawing many tuples must
-// yield overwhelmingly distinct values.
-func TestPickTuple_SpansALargeNamespace(t *testing.T) {
-	rng := rand.New(rand.NewSource(11))
-	seen := make(map[string]struct{}, 2000)
-	for i := 0; i < 2000; i++ {
-		seen[PickTuple(rng)] = struct{}{}
-	}
-	assert.Greater(t, len(seen), 1900,
-		"2000 draws should be nearly all distinct across a ~200k namespace; got %d unique", len(seen))
-}

management/internals/modules/agentnetwork/manager.go

@@ -22,6 +22,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -47,7 +48,7 @@ func ensureSessionKeys(p *types.Provider) error {
 type Manager interface {
 	GetAllProviders(ctx context.Context, accountID, userID string) ([]*types.Provider, error)
 	GetProvider(ctx context.Context, accountID, userID, providerID string) (*types.Provider, error)
-	CreateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error)
+	CreateProvider(ctx context.Context, userID string, provider *types.Provider, bootstrapCluster string) (*types.Provider, error)
 	UpdateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error)
 	DeleteProvider(ctx context.Context, accountID, userID, providerID string) error
 
@@ -70,9 +71,7 @@ type Manager interface {
 	DeleteBudgetRule(ctx context.Context, accountID, userID, ruleID string) error
 
 	GetSettings(ctx context.Context, accountID, userID string) (*types.Settings, error)
-	CreateSettings(ctx context.Context, userID string, settings *types.Settings, proxyAddress, endpoint string) (*types.Settings, error)
 	UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error)
-	DeleteSettings(ctx context.Context, accountID, userID string) error
 
 	ListConsumption(ctx context.Context, accountID, userID string) ([]*types.Consumption, error)
 	ListAccessLogs(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLog, int64, error)
@@ -124,10 +123,11 @@ type managerImpl struct {
 	proxyController    proxy.Controller
 
 	// reconcileCache holds the last set of synthesised proxy mappings
-	// per account, each paired with the proxy that served it, so a change
-	// of serving proxy can be diffed without re-deriving it.
+	// per account so reconcile can emit precise Create/Update/Delete
+	// updates instead of a full re-push on every mutation. Keyed by
+	// accountID, then by synthesised service ID.
 	reconcileMu    sync.Mutex
-	reconcileCache map[string]map[string]syntheticMapping
+	reconcileCache map[string]map[string]*proto.ProxyMapping
 
 	// labelRngMu guards labelRng. PickUnique consumes math/rand.Source
 	// state; concurrent provider creates would otherwise race.
@@ -151,7 +151,7 @@ func NewManager(
 		accountManager:     accountManager,
 		permissionsManager: permissionsManager,
 		proxyController:    proxyController,
-		reconcileCache:     make(map[string]map[string]syntheticMapping),
+		reconcileCache:     make(map[string]map[string]*proto.ProxyMapping),
 		labelRng:           rand.New(rand.NewSource(time.Now().UnixNano())),
 	}
 }
@@ -170,14 +170,19 @@ func (m *managerImpl) GetProvider(ctx context.Context, accountID, userID, provid
 	return m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, providerID)
 }
 
-// CreateProvider persists a new provider for the account. Providers have no
-// settings side effects: the account's endpoint is bootstrapped separately and
-// explicitly via CreateSettings, and every provider in the account routes
-// through it.
-func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error) {
+// CreateProvider persists a new provider for the account. bootstrapCluster
+// is used only when the per-account agent-network Settings row hasn't
+// been created yet; otherwise it is ignored (the cluster is pinned on
+// Settings and every provider in the account routes through it).
+func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provider *types.Provider, bootstrapCluster string) (*types.Provider, error) {
 	if err := m.requirePermission(ctx, provider.AccountID, userID, modules.AgentNetworkProviders, operations.Create); err != nil {
 		return nil, err
 	}
+	if strings.TrimSpace(bootstrapCluster) != "" {
+		if err := m.requireSettingsBootstrapPermission(ctx, provider.AccountID, userID); err != nil {
+			return nil, err
+		}
+	}
 
 	// An empty api_key would silently produce a synthesised service
 	// that 401s on every upstream request. Surface the misconfiguration
@@ -201,6 +206,16 @@ func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provide
 		return nil, fmt.Errorf("save agent network provider: %w", err)
 	}
 
+	if strings.TrimSpace(bootstrapCluster) != "" {
+		if _, err := m.bootstrapSettingsIfNeeded(ctx, m.store, provider.AccountID, bootstrapCluster); err != nil {
+			// The provider create has already succeeded; logging the
+			// bootstrap miss matches the plan's PoC behaviour. The synth
+			// path treats a missing settings row as a no-op, and the next
+			// provider create retries the bootstrap.
+			log.WithContext(ctx).Debugf("agent-network bootstrap settings for account %s on cluster %s: %v", provider.AccountID, bootstrapCluster, err)
+		}
+	}
+
 	m.accountManager.StoreEvent(ctx, userID, provider.ID, provider.AccountID, activity.AgentNetworkProviderCreated, provider.EventMeta())
 	m.reconcile(ctx, provider.AccountID)
 
@@ -545,44 +560,52 @@ func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, r
 }
 
 // UpdateSettings replaces the mutable account-level settings — the collection
-// toggles and retention — on the account's row. The identity fields (Domain,
-// ProxyAddress) are assigned at bootstrap (CreateSettings) and immutable: the
-// request carries them, matching the PUT convention of every other endpoint,
-// but they are only compared against the stored row — a request carrying
-// different values is rejected, and the stored values are never overwritten.
-// When the account has no settings row yet the update fails with NotFound.
-// Because the collection toggles change the synthesised service config
-// (prompt-capture gating, access-log emission), a reconcile is triggered so
-// the proxy and peer network maps converge on the new state.
+// toggles and retention — on the account's row. When the account has no
+// settings row yet, a non-empty settings.Cluster bootstraps one (same path as
+// first provider create); without it the update fails with NotFound. On an
+// existing row the cluster and subdomain are immutable: a differing
+// settings.Cluster is rejected rather than silently ignored so callers never
+// observe a value other than what they sent. Because the collection toggles
+// change the synthesised service config (prompt-capture gating, access-log
+// emission), a reconcile is triggered so the proxy and peer network maps
+// converge on the new state.
 func (m *managerImpl) UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error) {
 	if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Update); err != nil {
 		return nil, err
 	}
 
+	requestedCluster := strings.TrimSpace(settings.Cluster)
+
 	// The row lock from LockingStrengthUpdate only holds for the duration of
-	// the surrounding transaction, so the read and the save must share one —
-	// otherwise concurrent PUTs could interleave between them.
+	// the surrounding transaction, so the read, the cluster-immutability
+	// check, and the save must share one — otherwise concurrent PUTs could
+	// interleave between them.
 	var updated *types.Settings
 	err := m.store.ExecuteInTransaction(ctx, func(tx store.Store) error {
 		existing, err := tx.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, settings.AccountID)
 		switch {
 		case err == nil:
+			if requestedCluster != "" && requestedCluster != existing.Cluster {
+				return status.Errorf(status.InvalidArgument, "cluster is immutable once assigned (current: %s)", existing.Cluster)
+			}
 		case isNotFound(err):
-			return status.Errorf(status.NotFound, "agent network settings have not been bootstrapped yet; POST /api/agent-network/settings to bootstrap them")
+			if requestedCluster == "" {
+				return status.Errorf(status.NotFound, "agent network settings have not been bootstrapped yet; pass cluster to bootstrap them, or create a provider with bootstrap_cluster set")
+			}
+			// Bootstrapping pins the cluster and subdomain — a settings
+			// create on top of the update the caller already passed, matching
+			// the gate on the provider-create bootstrap path.
+			if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Create); err != nil {
+				return err
+			}
+			existing, err = m.bootstrapSettingsIfNeeded(ctx, tx, settings.AccountID, requestedCluster)
+			if err != nil {
+				return err
+			}
 		default:
 			return fmt.Errorf("get agent network settings: %w", err)
 		}
 
-		// The identity echo is compared leniently (trimmed, case-insensitive):
-		// the stored values are normalized lowercase, and a client replaying a
-		// GET response must never be rejected over casing it didn't choose.
-		if !hostnamesEquivalent(settings.Domain, existing.Domain) {
-			return status.Errorf(status.InvalidArgument, "endpoint is immutable: it must match the assigned endpoint %q; delete the settings to release it and bootstrap again", existing.Domain)
-		}
-		if !hostnamesEquivalent(settings.ProxyAddress, existing.ProxyAddress) {
-			return status.Errorf(status.InvalidArgument, "proxy_address is immutable: it must match the assigned proxy address %q; delete the settings to release it and bootstrap again", existing.ProxyAddress)
-		}
-
 		existing.EnableLogCollection = settings.EnableLogCollection
 		existing.EnablePromptCollection = settings.EnablePromptCollection
 		existing.RedactPii = settings.RedactPii
@@ -609,83 +632,6 @@ func (m *managerImpl) UpdateSettings(ctx context.Context, userID string, setting
 	return updated, nil
 }
 
-// hostnamesEquivalent reports whether a caller-supplied hostname names the
-// same host as a stored (normalized, lowercase) one: equal after trimming and
-// case folding. No structural validation — an arbitrary mismatch and a
-// malformed value are both simply "not the assigned value".
-func hostnamesEquivalent(supplied, stored string) bool {
-	return strings.EqualFold(strings.TrimSpace(supplied), stored)
-}
-
-// DeleteSettings removes the account's settings row, releasing the endpoint.
-// Two guards make this a bootstrap-repair operation rather than a way to tear
-// down a serving gateway, both re-checked under the row lock:
-//
-//   - No Agent Network providers may exist for the account. Providers route
-//     through the endpoint; delete them first.
-//   - No proxy may be actively serving the endpoint — that is, no active proxy
-//     declares the endpoint hostname as its cluster address. This is the
-//     dedicated (self-addressed) shape's guard: the proxy at the address IS
-//     this account's gateway. A labeled endpoint hangs beneath a shared
-//     cluster's address, and with the account's providers already gone the
-//     shared proxy serves nothing of the account's, so the parent cluster
-//     being up does not block the delete.
-//
-// Bootstrapping again after a delete allocates fresh — the released hostname
-// is not reserved. That full-reset semantic is what gives clients that model
-// immutability as replace-on-change (e.g. Terraform's RequiresReplace) a real
-// path: tear down providers, delete, re-create.
-func (m *managerImpl) DeleteSettings(ctx context.Context, accountID, userID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Delete); err != nil {
-		return err
-	}
-
-	var deleted *types.Settings
-	err := m.store.ExecuteInTransaction(ctx, func(tx store.Store) error {
-		existing, err := tx.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, accountID)
-		switch {
-		case err == nil:
-		case isNotFound(err):
-			return status.Errorf(status.NotFound, "agent network settings have not been bootstrapped yet; there is nothing to delete")
-		default:
-			return fmt.Errorf("get agent network settings: %w", err)
-		}
-
-		providers, err := tx.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
-		if err != nil {
-			return fmt.Errorf("get agent network providers: %w", err)
-		}
-		if len(providers) > 0 {
-			return status.Errorf(status.PreconditionFailed, "agent network settings cannot be deleted while %d provider(s) exist; delete the providers first", len(providers))
-		}
-
-		serving, err := tx.HasActiveProxyAtClusterAddress(ctx, existing.Domain)
-		if err != nil {
-			return fmt.Errorf("check for a proxy serving the endpoint: %w", err)
-		}
-		if serving {
-			return status.Errorf(status.PreconditionFailed, "agent network settings cannot be deleted while a proxy is actively serving the endpoint %q", existing.Domain)
-		}
-
-		if err := tx.DeleteAgentNetworkSettings(ctx, accountID); err != nil {
-			return fmt.Errorf("delete agent network settings: %w", err)
-		}
-		deleted = existing
-		return nil
-	})
-	if err != nil {
-		return err
-	}
-
-	m.accountManager.StoreEvent(ctx, userID, accountID, accountID, activity.AgentNetworkSettingsDeleted, map[string]any{
-		"endpoint":      deleted.Domain,
-		"proxy_address": deleted.ProxyAddress,
-	})
-	m.reconcile(ctx, accountID)
-
-	return nil
-}
-
 // isNotFound reports whether err is a status.NotFound error.
 func isNotFound(err error) bool {
 	var sErr *status.Error
@@ -732,162 +678,74 @@ func (m *managerImpl) GetSettings(ctx context.Context, accountID, userID string)
 	}
 }
 
-// maxDomainAllocationAttempts bounds the label search when bootstrapping a
-// labeled endpoint. Package-level (rather than function-local) so tests can
-// assert on the exhaustion path without duplicating the literal.
-const maxDomainAllocationAttempts = 10
-
-// CreateSettings bootstraps the per-account settings row, assigning the
-// account's immutable endpoint. Exactly one of proxyAddress and endpoint must
-// be non-empty: proxyAddress allocates a labeled endpoint one label beneath
-// the given cluster address; endpoint claims the given hostname verbatim as a
-// self-addressed (dedicated) endpoint — a legitimate claim before any proxy
-// declares the address (address-first). settings carries the account ID and
-// the initial collection toggles; its identity fields are assigned here.
-func (m *managerImpl) CreateSettings(ctx context.Context, userID string, settings *types.Settings, proxyAddress, endpoint string) (*types.Settings, error) {
-	if settings == nil || settings.AccountID == "" {
-		return nil, status.Errorf(status.InvalidArgument, "account id is required")
+// requireSettingsBootstrapPermission gates the one-time settings bootstrap a
+// first provider create performs. Pinning the account's cluster and subdomain
+// is a settings write, so it needs the settings permission on top of the
+// provider one. No-op once the settings row exists.
+func (m *managerImpl) requireSettingsBootstrapPermission(ctx context.Context, accountID, userID string) error {
+	_, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	if err == nil {
+		return nil
 	}
-	if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Create); err != nil {
-		return nil, err
+	if !isNotFound(err) {
+		return fmt.Errorf("get agent network settings: %w", err)
+	}
+	return m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Create)
+}
+
+// bootstrapSettingsIfNeeded creates the per-account agent-network
+// settings row when missing. The cluster comes from the create-time
+// hint the dashboard sends (auto-picked from the active cluster list);
+// the subdomain is picked from the curated wordlist avoiding
+// collisions on the same cluster. Idempotent: if a row already exists
+// it is returned untouched and the hint is ignored. st is the store to
+// operate on — pass the transaction store when calling from within one.
+func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, st store.Store, accountID, providerCluster string) (*types.Settings, error) {
+	if accountID == "" {
+		return nil, fmt.Errorf("bootstrap settings: account id is required")
+	}
+	if strings.TrimSpace(providerCluster) == "" {
+		return nil, fmt.Errorf("bootstrap settings: provider cluster is required")
 	}
 
-	hasProxyAddress := strings.TrimSpace(proxyAddress) != ""
-	hasEndpoint := strings.TrimSpace(endpoint) != ""
-	if hasProxyAddress == hasEndpoint {
-		return nil, status.Errorf(status.InvalidArgument, "exactly one of proxy_address and endpoint is required")
+	existing, err := st.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	if err == nil {
+		return existing, nil
 	}
-
-	// Fail fast on an existing row for a clean 409; the insert below stays
-	// the authority against concurrent bootstraps (the primary key wins).
-	if _, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, settings.AccountID); err == nil {
-		return nil, status.Errorf(status.AlreadyExists, "agent network settings already bootstrapped for account %s", settings.AccountID)
-	} else if !isNotFound(err) {
+	if !isNotFound(err) {
 		return nil, fmt.Errorf("get agent network settings: %w", err)
 	}
 
+	siblings, err := st.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, providerCluster)
+	if err != nil {
+		return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
+	}
+	taken := make(map[string]struct{}, len(siblings))
+	for _, s := range siblings {
+		taken[s.Subdomain] = struct{}{}
+	}
+
+	suffix := accountID
+	if len(suffix) > 4 {
+		suffix = suffix[:4]
+	}
+
+	m.labelRngMu.Lock()
+	subdomain := labelgen.PickUnique(m.labelRng, taken, suffix)
+	m.labelRngMu.Unlock()
+
 	now := time.Now().UTC()
+	settings := types.DefaultSettings(accountID)
+	settings.Cluster = providerCluster
+	settings.Subdomain = subdomain
 	settings.CreatedAt = now
 	settings.UpdatedAt = now
-
-	var err error
-	if hasEndpoint {
-		err = m.bootstrapSelfAddressed(ctx, settings, endpoint)
-	} else {
-		err = m.bootstrapLabeled(ctx, settings, proxyAddress)
+	if err := st.SaveAgentNetworkSettings(ctx, settings); err != nil {
+		return nil, fmt.Errorf("save agent network settings: %w", err)
 	}
-	if err != nil {
-		return nil, err
-	}
-
-	m.accountManager.StoreEvent(ctx, userID, settings.AccountID, settings.AccountID, activity.AgentNetworkSettingsUpdated, map[string]any{
-		"bootstrapped": true,
-		"endpoint":     settings.Domain,
-		"dedicated":    settings.Dedicated(),
-	})
-	m.reconcile(ctx, settings.AccountID)
-
 	return settings, nil
 }
 
-// bootstrapSelfAddressed claims the given hostname as the account's endpoint,
-// served only by a proxy declaring exactly that address (Domain ==
-// ProxyAddress). The domain unique index is the arbiter of availability.
-func (m *managerImpl) bootstrapSelfAddressed(ctx context.Context, settings *types.Settings, endpoint string) error {
-	hostname, err := types.NormalizeHostname(endpoint)
-	if err != nil {
-		return status.Errorf(status.InvalidArgument, "invalid endpoint: %s", err)
-	}
-
-	settings.Domain = hostname
-	settings.ProxyAddress = hostname
-	if err := m.store.CreateAgentNetworkSettings(ctx, settings); err != nil {
-		if isUniqueConstraintError(err) {
-			// The violation is either the account primary key (a concurrent
-			// bootstrap for the same account won) or the domain index
-			// (another account holds the hostname). Distinguish by re-read.
-			if _, getErr := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, settings.AccountID); getErr == nil {
-				return status.Errorf(status.AlreadyExists, "agent network settings already bootstrapped for account %s", settings.AccountID)
-			}
-			return status.Errorf(status.AlreadyExists, "endpoint %s is already taken", hostname)
-		}
-		return fmt.Errorf("create agent network settings: %w", err)
-	}
-	return nil
-}
-
-// bootstrapLabeled allocates a labeled endpoint one label beneath the given
-// cluster address: Domain = <label>.<proxyAddress>, served by whichever proxy
-// declares the parent. Labels are adjective-noun tuples; a candidate is
-// checked by read and the domain unique index stays the authority, so a
-// concurrent allocation of the same tuple surfaces as a unique violation and
-// another tuple is drawn.
-func (m *managerImpl) bootstrapLabeled(ctx context.Context, settings *types.Settings, proxyAddress string) error {
-	parent, err := types.NormalizeHostname(proxyAddress)
-	if err != nil {
-		return status.Errorf(status.InvalidArgument, "invalid proxy_address: %s", err)
-	}
-
-	for attempt := 1; attempt <= maxDomainAllocationAttempts; attempt++ {
-		m.labelRngMu.Lock()
-		label := labelgen.PickTuple(m.labelRng)
-		m.labelRngMu.Unlock()
-		if label == "" {
-			// Only reachable if either word pool were emptied. An empty label
-			// would produce a broken endpoint like ".example.com", so fail
-			// loudly rather than looping or inserting.
-			return fmt.Errorf("allocate agent network endpoint for account %s: label generator returned an empty label", settings.AccountID)
-		}
-
-		candidate, err := types.NormalizeHostname(label + "." + parent)
-		if err != nil {
-			return status.Errorf(status.InvalidArgument, "proxy_address leaves no room for a label: %s", err)
-		}
-
-		_, err = m.store.GetAgentNetworkSettingsByDomain(ctx, store.LockingStrengthNone, candidate)
-		if err == nil {
-			log.WithContext(ctx).Tracef("agent-network endpoint %q taken, retrying (attempt %d/%d)", candidate, attempt, maxDomainAllocationAttempts)
-			continue
-		}
-		if !isNotFound(err) {
-			return fmt.Errorf("check agent network endpoint availability: %w", err)
-		}
-
-		settings.Domain = candidate
-		settings.ProxyAddress = parent
-		if err := m.store.CreateAgentNetworkSettings(ctx, settings); err != nil {
-			if isUniqueConstraintError(err) {
-				// A concurrent bootstrap for the same account may have won on
-				// the primary key — return the conflict. A lost race on the
-				// domain index just means the tuple was taken between the
-				// read and the insert: draw another.
-				if _, getErr := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, settings.AccountID); getErr == nil {
-					return status.Errorf(status.AlreadyExists, "agent network settings already bootstrapped for account %s", settings.AccountID)
-				}
-				log.WithContext(ctx).Tracef("agent-network endpoint %q lost an allocation race, retrying (attempt %d/%d)", candidate, attempt, maxDomainAllocationAttempts)
-				continue
-			}
-			return fmt.Errorf("create agent network settings: %w", err)
-		}
-		return nil
-	}
-
-	return fmt.Errorf("allocate agent network endpoint for account %s: %d attempts exhausted", settings.AccountID, maxDomainAllocationAttempts)
-}
-
-// isUniqueConstraintError reports whether err is a database unique-constraint
-// violation, matched on the driver message because CreateAgentNetworkSettings
-// deliberately returns the driver error unwrapped.
-func isUniqueConstraintError(err error) bool {
-	if err == nil {
-		return false
-	}
-	msg := err.Error()
-	return strings.Contains(msg, "(SQLSTATE 23505)") || // postgres
-		strings.Contains(msg, "Error 1062 (23000)") || // mysql
-		strings.Contains(msg, "UNIQUE constraint failed") // sqlite
-}
-
 // ListConsumption returns every consumption row recorded for the
 // account, ordered window-newest-first. Backs the dashboard's basic
 // counter view; permission gate is the same Read role that gates
@@ -1021,7 +879,7 @@ func (*mockManager) GetProvider(_ context.Context, _, _, _ string) (*types.Provi
 	return &types.Provider{}, nil
 }
 
-func (*mockManager) CreateProvider(_ context.Context, _ string, p *types.Provider) (*types.Provider, error) {
+func (*mockManager) CreateProvider(_ context.Context, _ string, p *types.Provider, _ string) (*types.Provider, error) {
 	return p, nil
 }
 
@@ -1089,23 +947,10 @@ func (*mockManager) GetSettings(_ context.Context, accountID, _ string) (*types.
 	return types.DefaultSettings(accountID), nil
 }
 
-func (*mockManager) CreateSettings(_ context.Context, _ string, s *types.Settings, proxyAddress, endpoint string) (*types.Settings, error) {
-	if endpoint != "" {
-		s.Domain = endpoint
-		s.ProxyAddress = endpoint
-	} else {
-		s.Domain = "mock." + proxyAddress
-		s.ProxyAddress = proxyAddress
-	}
-	return s, nil
-}
-
 func (*mockManager) UpdateSettings(_ context.Context, _ string, s *types.Settings) (*types.Settings, error) {
 	return s, nil
 }
 
-func (*mockManager) DeleteSettings(_ context.Context, _, _ string) error { return nil }
-
 func (*mockManager) ListConsumption(_ context.Context, _, _ string) ([]*types.Consumption, error) {
 	return nil, nil
 }

management/internals/modules/agentnetwork/provider_bootstrap_test.go

@@ -0,0 +1,134 @@
+package agentnetwork
+
+import (
+	"context"
+	"runtime"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/store"
+	nbtypes "github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// bootstrapFixture wires a real sqlite store to a gomock permissions manager
+// so tests can grant the provider permission while denying (or never
+// expecting) the settings one.
+type bootstrapFixture struct {
+	manager Manager
+	store   store.Store
+	perms   *permissions.MockManager
+}
+
+func newBootstrapFixture(t *testing.T) *bootstrapFixture {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		t.Skip("sqlite store not properly supported on Windows yet")
+	}
+	t.Setenv("NETBIRD_STORE_ENGINE", string(nbtypes.SqliteStoreEngine))
+
+	st, cleanUp, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err, "test store setup must succeed")
+	t.Cleanup(cleanUp)
+
+	ctrl := gomock.NewController(t)
+	perms := permissions.NewMockManager(ctrl)
+
+	accounts := account.NewMockManager(ctrl)
+	accounts.EXPECT().StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	accounts.EXPECT().UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	accounts.EXPECT().BufferUpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+
+	return &bootstrapFixture{
+		manager: NewManager(st, perms, accounts, nil),
+		store:   st,
+		perms:   perms,
+	}
+}
+
+func (f *bootstrapFixture) expectPermission(accountID, userID string, module modules.Module, op operations.Operation, allowed bool) {
+	f.perms.EXPECT().
+		ValidateUserPermissions(gomock.Any(), accountID, userID, module, op).
+		Return(allowed, context.Background(), nil)
+}
+
+func newBootstrapProvider(accountID string) *types.Provider {
+	p := types.NewProvider(accountID)
+	p.Name = "openai"
+	p.UpstreamURL = "https://api.openai.com"
+	p.APIKey = "sk-test"
+	p.Enabled = true
+	return p
+}
+
+// TestCreateProviderBootstrapRequiresSettingsPermission pins the gate on the
+// one-time settings bootstrap: creating the first provider with a
+// bootstrap_cluster pins the account's cluster and subdomain, which is a
+// settings write and must not ride on the providers permission alone.
+func TestCreateProviderBootstrapRequiresSettingsPermission(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("denied without settings permission", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, false)
+
+		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
+		require.Error(t, err, "bootstrap without settings permission must fail")
+		var sErr *status.Error
+		require.ErrorAs(t, err, &sErr)
+		assert.Equal(t, status.PermissionDenied, sErr.Type(), "denial should surface as permission denied")
+
+		providers, err := f.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "account1")
+		require.NoError(t, err)
+		assert.Empty(t, providers, "provider must not be persisted when bootstrap is denied")
+		_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+		assert.Error(t, err, "settings row must not be created when bootstrap is denied")
+	})
+
+	t.Run("allowed with settings permission", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+		created, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
+		require.NoError(t, err, "bootstrap with both permissions must succeed")
+		require.NotNil(t, created)
+
+		settings, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+		require.NoError(t, err, "bootstrap must create the settings row")
+		assert.Equal(t, "cluster1.example.com", settings.Cluster, "settings should pin the bootstrap cluster")
+	})
+
+	t.Run("existing settings need no settings permission", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		require.NoError(t, f.store.SaveAgentNetworkSettings(ctx, &types.Settings{
+			AccountID: "account1",
+			Cluster:   "cluster1.example.com",
+			Subdomain: "existing",
+		}), "pre-existing settings row setup must succeed")
+
+		// Only the providers permission may be consulted: gomock fails the
+		// test on any unexpected settings-permission call.
+		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
+		require.NoError(t, err, "create with existing settings must not require the settings permission")
+	})
+
+	t.Run("no bootstrap cluster needs no settings permission", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "")
+		require.NoError(t, err, "create without bootstrap must not require the settings permission")
+	})
+}

management/internals/modules/agentnetwork/reconcile.go

@@ -10,17 +10,6 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
-// syntheticMapping pairs a synthesised proxy mapping with the address of the
-// proxy that serves it. The cluster is recorded rather than derived from the
-// mapping's domain: ProxyMapping does not carry it, and the previous derivation
-// -- everything after the first DNS label -- is wrong whenever the service's
-// domain is not one label under its proxy's address, which silently addressed
-// updates to a cluster no proxy declares.
-type syntheticMapping struct {
-	mapping *proto.ProxyMapping
-	cluster string
-}
-
 // reconcile recomputes the synthesised reverse-proxy services for an
 // account, diffs them against the previously-synthesised set in the
 // in-memory cache, and emits Create / Update / Delete proxy mappings
@@ -56,21 +45,18 @@ func (m *managerImpl) reconcile(ctx context.Context, accountID string) {
 	}
 
 	oidcCfg := m.proxyController.GetOIDCValidationConfig()
-	current := make(map[string]syntheticMapping, len(services))
+	current := make(map[string]*proto.ProxyMapping, len(services))
 	for _, svc := range services {
 		if svc == nil || svc.ID == "" {
 			continue
 		}
-		current[svc.ID] = syntheticMapping{
-			mapping: svc.ToProtoMapping(rpservice.Update, "", oidcCfg),
-			cluster: svc.ProxyCluster,
-		}
+		current[svc.ID] = svc.ToProtoMapping(rpservice.Update, "", oidcCfg)
 	}
 
 	m.reconcileMu.Lock()
 	previous := m.reconcileCache[accountID]
 	if previous == nil {
-		previous = make(map[string]syntheticMapping)
+		previous = make(map[string]*proto.ProxyMapping)
 	}
 
 	creates, updates, deletes := diffMappings(previous, current)
@@ -81,36 +67,34 @@ func (m *managerImpl) reconcile(ctx context.Context, accountID string) {
 	}
 	m.reconcileMu.Unlock()
 
-	for _, entry := range creates {
-		entry.mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED
-		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, entry.mapping, entry.cluster)
+	for _, mapping := range creates {
+		mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED
+		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, mapping, clusterFromMapping(mapping))
 	}
-	for _, entry := range updates {
-		entry.mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_MODIFIED
-		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, entry.mapping, entry.cluster)
+	for _, mapping := range updates {
+		mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_MODIFIED
+		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, mapping, clusterFromMapping(mapping))
 	}
-	for _, entry := range deletes {
-		entry.mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED
-		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, entry.mapping, entry.cluster)
+	for _, mapping := range deletes {
+		mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED
+		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, mapping, clusterFromMapping(mapping))
 	}
 }
 
-// diffMappings classifies the previous→current transition for a single
-// account into Create / Update / Delete sets.
+// diffMappings classifies the previous→current transition for a
+// single account into Create / Update / Delete sets.
 //
-// A change of serving proxy for the same service ID is surfaced as a Delete
-// addressed to the old proxy plus a Create addressed to the new one, so the
-// mapping actually moves. Comparing the recorded cluster is what makes that
-// detectable: with a placement-free endpoint the mapping's domain is identical
-// before and after the move, so nothing about the mapping itself reveals it.
-func diffMappings(previous, current map[string]syntheticMapping) (creates, updates, deletes []syntheticMapping) {
+// Cluster moves (current.cluster != previous.cluster) are surfaced as
+// a Delete on the old cluster + Create on the new — handled by
+// emitting both a delete (on previous mapping) and a create (on the
+// current mapping) for that service ID.
+func diffMappings(previous, current map[string]*proto.ProxyMapping) (creates, updates, deletes []*proto.ProxyMapping) {
 	for id, cur := range current {
 		prev, existed := previous[id]
 		switch {
 		case !existed:
 			creates = append(creates, cur)
-		case prev.mapping.GetDomain() == "" ||
-			cur.mapping.GetAccountId() == prev.mapping.GetAccountId() && prev.cluster != cur.cluster:
+		case prev.GetDomain() == "" || cur.GetAccountId() == prev.GetAccountId() && currentClusterChanged(prev, cur):
 			deletes = append(deletes, prev)
 			creates = append(creates, cur)
 		default:
@@ -124,3 +108,24 @@ func diffMappings(previous, current map[string]syntheticMapping) (creates, updat
 	}
 	return creates, updates, deletes
 }
+
+func currentClusterChanged(prev, cur *proto.ProxyMapping) bool {
+	return clusterFromMapping(prev) != clusterFromMapping(cur)
+}
+
+// clusterFromMapping returns the cluster the mapping should be sent
+// to. ProxyMapping doesn't carry the cluster directly, so we rely on
+// the synthesised service's domain (`<slug>.<cluster>`) and split on
+// the first '.'.
+func clusterFromMapping(m *proto.ProxyMapping) string {
+	if m == nil {
+		return ""
+	}
+	domain := m.GetDomain()
+	for i := 0; i < len(domain); i++ {
+		if domain[i] == '.' {
+			return domain[i+1:]
+		}
+	}
+	return ""
+}

management/internals/modules/agentnetwork/reconcile_test.go

@@ -21,7 +21,7 @@ func newReconcileMgr(t *testing.T, ctrl *gomock.Controller) (*managerImpl, *stor
 	return &managerImpl{
 		store:           mockStore,
 		proxyController: mockProxy,
-		reconcileCache:  make(map[string]map[string]syntheticMapping),
+		reconcileCache:  make(map[string]map[string]*proto.ProxyMapping),
 	}, mockStore, mockProxy
 }
 
@@ -52,9 +52,9 @@ func newReconcileTestPolicy(providerID, sourceGroupID string) *types.Policy {
 
 func newReconcileTestSettings() *types.Settings {
 	return &types.Settings{
-		AccountID:    "acct-1",
-		Domain:       "violet.eu.proxy.netbird.io",
-		ProxyAddress: "eu.proxy.netbird.io",
+		AccountID: "acct-1",
+		Cluster:   "eu.proxy.netbird.io",
+		Subdomain: "violet",
 	}
 }
 
@@ -196,7 +196,7 @@ func TestReconcile_PolicyRemoved_EmitsDelete(t *testing.T) {
 func TestReconcile_NilProxyController_NoOp(t *testing.T) {
 	ctx := context.Background()
 	mgr := &managerImpl{
-		reconcileCache: make(map[string]map[string]syntheticMapping),
+		reconcileCache: make(map[string]map[string]*proto.ProxyMapping),
 	}
 	// Must not panic; must not query the store.
 	mgr.reconcile(ctx, "acct-1")
@@ -212,78 +212,21 @@ func TestReconcile_EmptyAccountID_NoOp(t *testing.T) {
 	mgr.reconcile(ctx, "")
 }
 
-// TestDiffMappings_ServingProxyChange — when the proxy serving an account
-// changes, the same service ID must be deleted on the old proxy and created on
-// the new one. The cluster cannot be recovered from the mapping's domain: with a
-// placement-free endpoint the domain does not change at all when the serving
-// proxy does, so a domain-derived cluster sees no change and emits a plain
-// update, addressed to a proxy that does not exist.
-func TestDiffMappings_ServingProxyChange(t *testing.T) {
-	previous := map[string]syntheticMapping{
-		"svc-1": {
-			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "brave-otter.gateway.example.com"},
-			cluster: "proxy.example.com",
-		},
+func TestClusterFromMapping(t *testing.T) {
+	tests := []struct {
+		name   string
+		domain string
+		want   string
+	}{
+		{"simple", "openai.eu.proxy.netbird.io", "eu.proxy.netbird.io"},
+		{"deeply nested", "a.b.c.d", "b.c.d"},
+		{"no dot", "openai", ""},
+		{"empty", "", ""},
 	}
-	current := map[string]syntheticMapping{
-		"svc-1": {
-			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "brave-otter.gateway.example.com"},
-			cluster: "brave-otter.gateway.example.com",
-		},
-	}
-
-	creates, updates, deletes := diffMappings(previous, current)
-
-	if assert.Len(t, deletes, 1, "the old proxy must be told to drop the mapping") {
-		assert.Equal(t, "proxy.example.com", deletes[0].cluster)
-	}
-	if assert.Len(t, creates, 1, "the new proxy must be told to add it") {
-		assert.Equal(t, "brave-otter.gateway.example.com", creates[0].cluster)
-	}
-	assert.Empty(t, updates, "a serving-proxy move is a delete plus a create, not an update")
-}
-
-// TestDiffMappings_UnchangedClusterIsAnUpdate keeps the ordinary path: same
-// service, same proxy, changed contents.
-func TestDiffMappings_UnchangedClusterIsAnUpdate(t *testing.T) {
-	previous := map[string]syntheticMapping{
-		"svc-1": {
-			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "otter.proxy.example.com"},
-			cluster: "proxy.example.com",
-		},
-	}
-	current := map[string]syntheticMapping{
-		"svc-1": {
-			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "otter.proxy.example.com"},
-			cluster: "proxy.example.com",
-		},
-	}
-
-	creates, updates, deletes := diffMappings(previous, current)
-
-	assert.Empty(t, creates)
-	assert.Empty(t, deletes)
-	if assert.Len(t, updates, 1) {
-		assert.Equal(t, "proxy.example.com", updates[0].cluster)
-	}
-}
-
-// TestDiffMappings_RemovedServiceIsDeletedOnItsOwnCluster — a service that has
-// gone away is deleted on the cluster it was last served by, which is recorded
-// rather than re-derived.
-func TestDiffMappings_RemovedServiceIsDeletedOnItsOwnCluster(t *testing.T) {
-	previous := map[string]syntheticMapping{
-		"svc-1": {
-			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "brave-otter.gateway.example.com"},
-			cluster: "brave-otter.gateway.example.com",
-		},
-	}
-
-	creates, updates, deletes := diffMappings(previous, map[string]syntheticMapping{})
-
-	assert.Empty(t, creates)
-	assert.Empty(t, updates)
-	if assert.Len(t, deletes, 1) {
-		assert.Equal(t, "brave-otter.gateway.example.com", deletes[0].cluster)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := clusterFromMapping(&proto.ProxyMapping{Domain: tt.domain})
+			assert.Equal(t, tt.want, got)
+		})
 	}
 }

management/internals/modules/agentnetwork/settings_bootstrap_test.go

@@ -1,225 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/golang/mock/gomock"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/account"
-	"github.com/netbirdio/netbird/management/server/permissions"
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/store"
-	nbtypes "github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/management/status"
-)
-
-// bootstrapFixture wires a real sqlite store to a gomock permissions manager
-// so tests can grant or deny the settings permission per case.
-type bootstrapFixture struct {
-	manager Manager
-	store   store.Store
-	perms   *permissions.MockManager
-}
-
-func newBootstrapFixture(t *testing.T) *bootstrapFixture {
-	t.Helper()
-	if runtime.GOOS == "windows" {
-		t.Skip("sqlite store not properly supported on Windows yet")
-	}
-	t.Setenv("NETBIRD_STORE_ENGINE", string(nbtypes.SqliteStoreEngine))
-
-	st, cleanUp, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	require.NoError(t, err, "test store setup must succeed")
-	t.Cleanup(cleanUp)
-
-	ctrl := gomock.NewController(t)
-	perms := permissions.NewMockManager(ctrl)
-
-	accounts := account.NewMockManager(ctrl)
-	accounts.EXPECT().StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
-	accounts.EXPECT().UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
-	accounts.EXPECT().BufferUpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
-
-	return &bootstrapFixture{
-		manager: NewManager(st, perms, accounts, nil),
-		store:   st,
-		perms:   perms,
-	}
-}
-
-func (f *bootstrapFixture) expectPermission(accountID, userID string, module modules.Module, op operations.Operation, allowed bool) {
-	f.perms.EXPECT().
-		ValidateUserPermissions(gomock.Any(), accountID, userID, module, op).
-		Return(allowed, context.Background(), nil)
-}
-
-func (f *bootstrapFixture) createSettings(ctx context.Context, accountID, userID, proxyAddress, endpoint string) (*types.Settings, error) {
-	return f.manager.CreateSettings(ctx, userID, types.DefaultSettings(accountID), proxyAddress, endpoint)
-}
-
-// TestCreateSettingsRequiresPermission pins the gate: bootstrap assigns the
-// account's immutable endpoint, a settings write requiring the settings
-// Create permission — and a denial leaves no row behind.
-func TestCreateSettingsRequiresPermission(t *testing.T) {
-	ctx := context.Background()
-	f := newBootstrapFixture(t)
-	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, false)
-
-	_, err := f.createSettings(ctx, "account1", "user1", "cluster1.example.com", "")
-	require.Error(t, err, "bootstrap without the settings permission must fail")
-	var sErr *status.Error
-	require.ErrorAs(t, err, &sErr)
-	assert.Equal(t, status.PermissionDenied, sErr.Type(), "denial should surface as permission denied")
-
-	_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-	assert.Error(t, err, "settings row must not be created when bootstrap is denied")
-}
-
-// TestCreateSettingsLabeled pins the labeled shape: the server allocates an
-// adjective-noun label beneath the proxy address, the pin is not dedicated,
-// and the domain records the full endpoint hostname.
-func TestCreateSettingsLabeled(t *testing.T) {
-	ctx := context.Background()
-	f := newBootstrapFixture(t)
-	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-
-	created, err := f.createSettings(ctx, "account1", "user1", "Cluster1.Example.com", "")
-	require.NoError(t, err, "labeled bootstrap must succeed")
-	assert.Equal(t, "cluster1.example.com", created.ProxyAddress, "proxy address must be pinned lowercased")
-	require.True(t, strings.HasSuffix(created.Domain, ".cluster1.example.com"),
-		"domain must hang one label beneath the proxy address: %s", created.Domain)
-	label := strings.TrimSuffix(created.Domain, ".cluster1.example.com")
-	assert.NotContains(t, label, ".", "the allocated label must be a single DNS label: %s", label)
-	assert.False(t, created.Dedicated(), "a labeled pin is not dedicated")
-	assert.Equal(t, created.Domain, created.Endpoint(), "the endpoint is the domain column")
-
-	stored, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-	require.NoError(t, err, "bootstrap must persist the row")
-	assert.Equal(t, created.Domain, stored.Domain)
-	assert.Equal(t, created.ProxyAddress, stored.ProxyAddress)
-}
-
-// TestCreateSettingsSelfAddressed pins the dedicated shape: the endpoint is
-// claimed verbatim (normalized), Domain == ProxyAddress, and the claim
-// succeeds with no proxy declaring the address yet (address-first).
-func TestCreateSettingsSelfAddressed(t *testing.T) {
-	ctx := context.Background()
-	f := newBootstrapFixture(t)
-	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-
-	created, err := f.createSettings(ctx, "account1", "user1", "", "Brave-Otter.GW.Example.com")
-	require.NoError(t, err, "self-addressed bootstrap must succeed")
-	assert.Equal(t, "brave-otter.gw.example.com", created.Domain, "endpoint must be claimed lowercased")
-	assert.Equal(t, created.Domain, created.ProxyAddress, "self-addressed: proxy address is the endpoint")
-	assert.True(t, created.Dedicated(), "a self-addressed pin is dedicated")
-}
-
-// TestCreateSettingsIdentityFieldValidation pins the request contract: exactly
-// one of proxyAddress and endpoint, and both must be well-formed hostnames.
-func TestCreateSettingsIdentityFieldValidation(t *testing.T) {
-	ctx := context.Background()
-
-	cases := map[string]struct {
-		proxyAddress string
-		endpoint     string
-	}{
-		"neither":               {"", ""},
-		"both":                  {"cluster1.example.com", "gw.example.com"},
-		"trailing dot endpoint": {"", "gw.example.com."},
-		"leading dot endpoint":  {"", ".gw.example.com"},
-		"whitespace inside":     {"", "g w.example.com"},
-		"empty label in parent": {"eu..example.com", ""},
-		"hyphen-edged label":    {"", "-gw.example.com"},
-	}
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			f := newBootstrapFixture(t)
-			f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-
-			_, err := f.createSettings(ctx, "account1", "user1", tc.proxyAddress, tc.endpoint)
-			require.Error(t, err, "invalid identity input must be rejected")
-			var sErr *status.Error
-			require.ErrorAs(t, err, &sErr)
-			assert.Equal(t, status.InvalidArgument, sErr.Type(), "rejection must be a validation error")
-
-			_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-			assert.Error(t, err, "no row may be left behind by a rejected bootstrap")
-		})
-	}
-}
-
-// TestCreateSettingsConflictsOnSecondBootstrap pins that bootstrap is a
-// one-time create per account: a second call is a conflict, whatever shape it
-// asks for, and the original row survives untouched.
-func TestCreateSettingsConflictsOnSecondBootstrap(t *testing.T) {
-	ctx := context.Background()
-	f := newBootstrapFixture(t)
-	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-
-	first, err := f.createSettings(ctx, "account1", "user1", "cluster1.example.com", "")
-	require.NoError(t, err)
-
-	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-	_, err = f.createSettings(ctx, "account1", "user1", "", "other.example.com")
-	require.Error(t, err, "second bootstrap must fail")
-	var sErr *status.Error
-	require.ErrorAs(t, err, &sErr)
-	assert.Equal(t, status.AlreadyExists, sErr.Type(), "second bootstrap must surface as a conflict")
-
-	stored, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-	require.NoError(t, err)
-	assert.Equal(t, first.Domain, stored.Domain, "the original endpoint must survive the rejected bootstrap")
-}
-
-// TestCreateSettingsEndpointTaken pins global hostname uniqueness: a hostname
-// held by one account cannot be claimed by another, in either direction —
-// self-addressed onto self-addressed, or self-addressed onto an allocated
-// labeled endpoint.
-func TestCreateSettingsEndpointTaken(t *testing.T) {
-	ctx := context.Background()
-	f := newBootstrapFixture(t)
-
-	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-	first, err := f.createSettings(ctx, "account1", "user1", "", "gw.example.com")
-	require.NoError(t, err)
-
-	f.expectPermission("account2", "user2", modules.AgentNetworkSettings, operations.Create, true)
-	_, err = f.createSettings(ctx, "account2", "user2", "", "gw.example.com")
-	require.Error(t, err, "a taken hostname must be refused")
-	var sErr *status.Error
-	require.ErrorAs(t, err, &sErr)
-	assert.Equal(t, status.AlreadyExists, sErr.Type(), "the refusal must surface as a conflict")
-
-	f.expectPermission("account3", "user3", modules.AgentNetworkSettings, operations.Create, true)
-	_, err = f.createSettings(ctx, "account3", "user3", "", first.Domain)
-	require.Error(t, err, "claiming another account's endpoint must be refused")
-}
-
-// TestCreateProviderHasNoSettingsSideEffects pins the decoupling: provider
-// create needs only the providers permission (gomock fails the test on any
-// settings-permission call) and never creates a settings row.
-func TestCreateProviderHasNoSettingsSideEffects(t *testing.T) {
-	ctx := context.Background()
-	f := newBootstrapFixture(t)
-	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
-
-	provider := types.NewProvider("account1")
-	provider.Name = "openai"
-	provider.UpstreamURL = "https://api.openai.com"
-	provider.APIKey = "sk-test"
-	provider.Enabled = true
-
-	created, err := f.manager.CreateProvider(ctx, "user1", provider)
-	require.NoError(t, err, "provider create must succeed on the providers permission alone")
-	require.NotNil(t, created)
-
-	_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-	assert.Error(t, err, "provider create must not conjure a settings row")
-}

management/internals/modules/agentnetwork/synthesizer.go

@@ -89,7 +89,7 @@ func SynthesizeServicesForCluster(ctx context.Context, s store.Store, clusterAdd
 		return nil, nil
 	}
 
-	settingsRows, err := s.GetAgentNetworkSettingsByProxyAddress(ctx, store.LockingStrengthNone, clusterAddr)
+	settingsRows, err := s.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, clusterAddr)
 	if err != nil {
 		return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
 	}
@@ -116,41 +116,53 @@ func SynthesizeServicesForCluster(ctx context.Context, s store.Store, clusterAdd
 }
 
 // SynthesizeServiceForDomain resolves a single agent-network service by its
-// public endpoint domain — a point query on the settings domain unique index,
-// then synthesis of just that account. Returns nil (no error) when no account
-// owns the domain.
+// public endpoint domain. It lists the (few) settings rows on the domain's
+// cluster, matches the one whose endpoint equals the domain, and synthesises
+// only that account — avoiding full per-account synthesis for every tenant on
+// the cluster, which is what auth/session paths previously paid. Returns nil
+// (no error) when no account owns the domain.
 func SynthesizeServiceForDomain(ctx context.Context, s store.Store, domain string) (*rpservice.Service, error) {
-	domain = strings.ToLower(strings.TrimSpace(domain))
-	if domain == "" {
-		return nil, nil //nolint:nilnil // optional lookup: no account owns the domain
-	}
-
-	settings, err := s.GetAgentNetworkSettingsByDomain(ctx, store.LockingStrengthNone, domain)
-	if err != nil {
-		if isNotFound(err) {
-			return nil, nil //nolint:nilnil // optional lookup: no account owns the domain
+	domain = strings.TrimSpace(domain)
+	cluster := clusterFromDomain(domain)
+	if domain != "" && cluster != "" {
+		settingsRows, err := s.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, cluster)
+		if err != nil {
+			return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
 		}
-		return nil, fmt.Errorf("get agent network settings by domain: %w", err)
-	}
-
-	services, err := SynthesizeServices(ctx, s, settings.AccountID)
-	if err != nil {
-		return nil, err
-	}
-	for _, svc := range services {
-		if svc != nil && svc.Domain == domain {
-			return svc, nil
+		for _, settings := range settingsRows {
+			if settings == nil || settings.Endpoint() != domain {
+				continue
+			}
+			services, serr := SynthesizeServices(ctx, s, settings.AccountID)
+			if serr != nil {
+				return nil, serr
+			}
+			for _, svc := range services {
+				if svc != nil && svc.Domain == domain {
+					return svc, nil
+				}
+			}
+			break
 		}
 	}
 	return nil, nil //nolint:nilnil // optional lookup: no account owns the domain
 }
 
+// clusterFromDomain returns the cluster portion of an endpoint domain (every
+// label after the first).
+func clusterFromDomain(domain string) string {
+	if i := strings.IndexByte(domain, '.'); i >= 0 {
+		return domain[i+1:]
+	}
+	return ""
+}
+
 // SynthesizeServices builds the in-memory reverse-proxy service that
 // fronts the account's agent-network gateway. Returns nil when the
 // account has no settings row, no enabled providers, or no enabled
 // policies — in any of those cases there's nothing useful to expose.
 //
-// One service per (account, settings.ProxyAddress) is emitted. The router
+// One service per (account, settings.Cluster) is emitted. The router
 // middleware encodes a denormalised model→provider routing table
 // (auth headers + decrypted API keys baked in); the policy_check
 // middleware encodes per-provider authorised group IDs derived from
@@ -163,7 +175,7 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([
 	if err != nil {
 		return nil, err
 	}
-	if !ok || strings.TrimSpace(settings.ProxyAddress) == "" {
+	if !ok || strings.TrimSpace(settings.Cluster) == "" {
 		return nil, nil
 	}
 
@@ -922,7 +934,7 @@ func buildAccountService(
 	middlewares []rpservice.MiddlewareConfig,
 	sessionPriv, sessionPub string,
 ) *rpservice.Service {
-	cluster := settings.ProxyAddress
+	cluster := settings.Cluster
 	domain := settings.Endpoint()
 	serviceID := SynthesizedServiceIDPrefix + accountID
 

management/internals/modules/agentnetwork/synthesizer_realstore_test.go

@@ -147,7 +147,7 @@ func TestReconcile_RealStore_PushesPrivateAfterStatusToggle(t *testing.T) {
 		store:           s,
 		accountManager:  noopAccountManager{},
 		proxyController: ctrl,
-		reconcileCache:  make(map[string]map[string]syntheticMapping),
+		reconcileCache:  make(map[string]map[string]*proto.ProxyMapping),
 	}
 
 	m.reconcile(ctx, testAccountID) // initial, provider enabled

management/internals/modules/agentnetwork/synthesizer_test.go

@@ -19,14 +19,15 @@ import (
 const (
 	testAccountID = "acct-1"
 	testCluster   = "eu.proxy.netbird.io"
+	testSubdomain = "violet"
 	testEndpoint  = "violet.eu.proxy.netbird.io"
 )
 
 func newSynthTestSettings() *types.Settings {
 	return &types.Settings{
-		AccountID:    testAccountID,
-		Domain:       testEndpoint,
-		ProxyAddress: testCluster,
+		AccountID: testAccountID,
+		Cluster:   testCluster,
+		Subdomain: testSubdomain,
 	}
 }
 

management/internals/modules/agentnetwork/types/settings.go

@@ -1,7 +1,6 @@
 package types
 
 import (
-	"fmt"
 	"strings"
 	"time"
 
@@ -13,23 +12,13 @@ import (
 // the long-term aggregate and are retained independently.
 const DefaultAccessLogRetentionDays = 30
 
-// Settings is the per-account agent-network configuration row. One row per
-// account. Domain and ProxyAddress are assigned at bootstrap and immutable
-// thereafter; a persisted row is always fully allocated — there is no "row
-// exists, endpoint pending" state.
+// Settings is the per-account agent-network configuration row. One
+// row per account. Cluster + Subdomain are immutable once written and
+// produce the public endpoint agents call (`<subdomain>.<cluster>`).
 type Settings struct {
 	AccountID string `gorm:"primaryKey"`
-
-	// Domain is the gateway endpoint hostname agents call. Globally unique
-	// across accounts. Sized explicitly because MySQL cannot index an
-	// unbounded TEXT column; 255 covers the RFC 1035 253-octet bound.
-	Domain string `gorm:"type:varchar(255);uniqueIndex:idx_agent_network_settings_domain"`
-
-	// ProxyAddress is the declared cluster address of the proxy serving this
-	// account's gateway. Either equal to Domain — a proxy dedicated to this
-	// account, declaring the tenant's own hostname — or Domain's immediate
-	// parent, with the endpoint one label beneath it on a shared cluster.
-	ProxyAddress string `gorm:"type:varchar(255);index:idx_agent_network_settings_proxy_address"`
+	Cluster   string
+	Subdomain string `gorm:"index:idx_agent_network_settings_cluster_subdomain"`
 
 	// Account-level collection controls sourced by the synthesizer.
 	// EnableLogCollection gates the per-request access-log trail and defaults
@@ -56,9 +45,9 @@ func (Settings) TableName() string { return "agent_network_settings" }
 
 // DefaultSettings returns the settings an account observes before its row is
 // bootstrapped: log collection on with the default retention, everything else
-// off, and no domain or proxy address assigned yet. Bootstrap persists exactly
-// these values plus the assigned domain and proxy address, so the
-// pre-bootstrap read and the freshly bootstrapped row agree.
+// off, and no cluster/subdomain assigned yet. Bootstrap persists exactly these
+// values plus the assigned cluster and subdomain, so the pre-bootstrap read
+// and the freshly bootstrapped row agree.
 func DefaultSettings(accountID string) *Settings {
 	return &Settings{
 		AccountID:              accountID,
@@ -67,15 +56,14 @@ func DefaultSettings(accountID string) *Settings {
 	}
 }
 
-// Endpoint returns the bare hostname agents reach this account at — the
-// Domain column. Empty until the row is bootstrapped.
-func (s *Settings) Endpoint() string { return s.Domain }
-
-// Dedicated reports whether the account's gateway is served by a proxy
-// dedicated to it — the self-addressed shape, where the serving proxy declares
-// the endpoint hostname itself. The alternative (labeled) shape has the
-// endpoint one label beneath a shared cluster's address.
-func (s *Settings) Dedicated() bool { return s.Domain != "" && s.Domain == s.ProxyAddress }
+// Endpoint returns the bare hostname agents reach this account at:
+// `<subdomain>.<cluster>`. Empty until both halves are assigned at bootstrap.
+func (s *Settings) Endpoint() string {
+	if s.Cluster == "" || s.Subdomain == "" {
+		return ""
+	}
+	return s.Subdomain + "." + s.Cluster
+}
 
 // ToAPIResponse renders the settings as the API representation. The
 // timestamps are omitted while zero — a default (not yet bootstrapped) view
@@ -83,9 +71,9 @@ func (s *Settings) Dedicated() bool { return s.Domain != "" && s.Domain == s.Pro
 func (s *Settings) ToAPIResponse() *api.AgentNetworkSettings {
 	retention := s.AccessLogRetentionDays
 	resp := &api.AgentNetworkSettings{
+		Cluster:                s.Cluster,
+		Subdomain:              s.Subdomain,
 		Endpoint:               s.Endpoint(),
-		ProxyAddress:           s.ProxyAddress,
-		Dedicated:              s.Dedicated(),
 		EnableLogCollection:    s.EnableLogCollection,
 		EnablePromptCollection: s.EnablePromptCollection,
 		RedactPii:              s.RedactPii,
@@ -102,91 +90,19 @@ func (s *Settings) ToAPIResponse() *api.AgentNetworkSettings {
 	return resp
 }
 
-// FromAPIRequest applies the update request onto the receiver: every mutable
-// field is replaced with the request value, and the identity fields (Domain,
-// ProxyAddress) carry the request's echo of the assigned values. The identity
-// fields are never written to the stored row — UpdateSettings compares them
-// against it and rejects the request when they differ, so PUT keeps the
-// house convention of requiring every field while the endpoint and proxy
-// address stay immutable.
-//
-// Every field is required by the schema, so none is presence-sensitive.
-// AccessLogRetentionDays in particular must stay required: the caller receives
-// a zero-valued Settings, and UpdateSettings copies each field onto the stored
-// row unconditionally, so an omitted value would be written as 0 — which the
-// API documents as "keep indefinitely". Making retention optional would
-// therefore let a client silently maximise log retention by leaving it out.
+// FromAPIRequest applies the request onto the receiver. The mutable
+// collection fields are always replaced with the request values. Cluster
+// participates only in bootstrap and the immutability check (see
+// Manager.UpdateSettings); Subdomain is server-assigned and never taken
+// from a request.
 func (s *Settings) FromAPIRequest(req *api.AgentNetworkSettingsRequest) {
-	s.Domain = req.Endpoint
-	s.ProxyAddress = req.ProxyAddress
+	if req.Cluster != nil {
+		s.Cluster = strings.TrimSpace(*req.Cluster)
+	}
 	s.EnableLogCollection = req.EnableLogCollection
 	s.EnablePromptCollection = req.EnablePromptCollection
 	s.RedactPii = req.RedactPii
-	s.AccessLogRetentionDays = req.AccessLogRetentionDays
-}
-
-// FromAPICreateRequest applies the optional collection toggles of a bootstrap
-// request onto the receiver (typically DefaultSettings), leaving defaults in
-// place for omitted fields. The identity fields are resolved by the manager
-// from the request's proxy_address / endpoint, not copied here.
-func (s *Settings) FromAPICreateRequest(req *api.AgentNetworkSettingsCreateRequest) {
-	if req.EnableLogCollection != nil {
-		s.EnableLogCollection = *req.EnableLogCollection
-	}
-	if req.EnablePromptCollection != nil {
-		s.EnablePromptCollection = *req.EnablePromptCollection
-	}
-	if req.RedactPii != nil {
-		s.RedactPii = *req.RedactPii
-	}
 	if req.AccessLogRetentionDays != nil {
 		s.AccessLogRetentionDays = *req.AccessLogRetentionDays
 	}
 }
-
-// maxHostnameLength is the RFC 1035 bound on a full domain name.
-const maxHostnameLength = 253
-
-// NormalizeHostname lowercases and trims a caller-supplied hostname and
-// validates its shape: non-empty DNS labels of letters, digits and inner
-// hyphens, joined by single dots, within length bounds. Shapes that
-// canonicalization cannot repair — leading/trailing dots, empty labels,
-// whitespace inside the name — are rejected rather than guessed at, because
-// the value lands in an immutable column.
-func NormalizeHostname(raw string) (string, error) {
-	hostname := strings.ToLower(strings.TrimSpace(raw))
-	if hostname == "" {
-		return "", fmt.Errorf("hostname is empty")
-	}
-	if len(hostname) > maxHostnameLength {
-		return "", fmt.Errorf("hostname exceeds %d characters", maxHostnameLength)
-	}
-	for _, label := range strings.Split(hostname, ".") {
-		if err := validateHostnameLabel(label); err != nil {
-			return "", fmt.Errorf("invalid hostname %q: %w", hostname, err)
-		}
-	}
-	return hostname, nil
-}
-
-func validateHostnameLabel(label string) error {
-	if label == "" {
-		return fmt.Errorf("empty label (leading, trailing or doubled dot)")
-	}
-	if len(label) > 63 {
-		return fmt.Errorf("label %q exceeds 63 characters", label)
-	}
-	if label[0] == '-' || label[len(label)-1] == '-' {
-		return fmt.Errorf("label %q must not start or end with a hyphen", label)
-	}
-	for _, r := range label {
-		switch {
-		case r >= 'a' && r <= 'z':
-		case r >= '0' && r <= '9':
-		case r == '-':
-		default:
-			return fmt.Errorf("label %q contains invalid character %q", label, r)
-		}
-	}
-	return nil
-}

management/internals/modules/reverseproxy/domain/manager/manager.go

@@ -2,28 +2,24 @@ package manager
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"net"
 	"strings"
 
 	log "github.com/sirupsen/logrus"
 
-	agentnetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	nbstore "github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 type store interface {
 	GetAccount(ctx context.Context, accountID string) (*types.Account, error)
-	GetAgentNetworkSettings(ctx context.Context, lockStrength nbstore.LockingStrength, accountID string) (*agentnetworkTypes.Settings, error)
 
 	GetCustomDomain(ctx context.Context, accountID string, domainID string) (*domain.Domain, error)
 	ListFreeDomains(ctx context.Context, accountID string) ([]string, error)
@@ -315,21 +311,17 @@ func (m Manager) getClusterAllowList(ctx context.Context, accountID string) ([]s
 	if err != nil {
 		return nil, fmt.Errorf("get public cluster addresses: %w", err)
 	}
-	reserved, err := m.reservedGatewayAddress(ctx, accountID)
-	if err != nil {
-		return nil, err
-	}
 	seen := make(map[string]struct{}, len(byopAddresses)+len(publicAddresses))
 	merged := make([]string, 0, len(byopAddresses)+len(publicAddresses))
 	for _, addr := range byopAddresses {
-		if _, ok := seen[addr]; ok || addr == reserved {
+		if _, ok := seen[addr]; ok {
 			continue
 		}
 		seen[addr] = struct{}{}
 		merged = append(merged, addr)
 	}
 	for _, addr := range publicAddresses {
-		if _, ok := seen[addr]; ok || addr == reserved {
+		if _, ok := seen[addr]; ok {
 			continue
 		}
 		seen[addr] = struct{}{}
@@ -338,31 +330,6 @@ func (m Manager) getClusterAllowList(ctx context.Context, accountID string) ([]s
 	return merged, nil
 }
 
-// reservedGatewayAddress returns the account's agent-network gateway address
-// when its settings pin is self-addressed — a proxy dedicated to serving
-// exactly the gateway. Dropping that address from the cluster allow list keeps
-// it from being offered as a cluster for ordinary services, and because the
-// free-domain suffix match is depth-independent, dropping the address rejects
-// every name beneath it as well as the bare one. Only the account's own
-// gateway address can ever appear in its allow list (another tenant's gateway
-// proxy is account-scoped to them), so this single-address exclusion is
-// sufficient. Returns "" when the account has no settings row or a labeled
-// (shared-cluster) pin.
-func (m Manager) reservedGatewayAddress(ctx context.Context, accountID string) (string, error) {
-	settings, err := m.store.GetAgentNetworkSettings(ctx, nbstore.LockingStrengthNone, accountID)
-	if err != nil {
-		var sErr *status.Error
-		if errors.As(err, &sErr) && sErr.Type() == status.NotFound {
-			return "", nil
-		}
-		return "", fmt.Errorf("get agent network settings: %w", err)
-	}
-	if settings == nil || !settings.Dedicated() {
-		return "", nil
-	}
-	return settings.ProxyAddress, nil
-}
-
 func extractClusterFromCustomDomains(serviceDomain string, customDomains []*domain.Domain) (string, bool) {
 	bestCluster := ""
 	bestLen := -1

management/internals/modules/reverseproxy/domain/manager/manager_test.go

@@ -7,12 +7,6 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-
-	agentnetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
-	nbstore "github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 type mockProxyManager struct {
@@ -61,7 +55,7 @@ func TestGetClusterAllowList_BYOPMergedWithPublic(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"byop.example.com", "eu.proxy.netbird.io"}, result)
@@ -77,7 +71,7 @@ func TestGetClusterAllowList_DeduplicatesBYOPAndPublic(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"shared.example.com", "byop.example.com", "eu.proxy.netbird.io"}, result)
@@ -93,7 +87,7 @@ func TestGetClusterAllowList_NoBYOP_FallbackToShared(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"eu.proxy.netbird.io", "us.proxy.netbird.io"}, result)
@@ -106,7 +100,7 @@ func TestGetClusterAllowList_BYOPError_ReturnsError(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.Error(t, err)
 	assert.Nil(t, result)
@@ -123,7 +117,7 @@ func TestGetClusterAllowList_PublicError_ReturnsError(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.Error(t, err)
 	assert.Nil(t, result)
@@ -140,7 +134,7 @@ func TestGetClusterAllowList_BYOPEmptySlice_FallbackToShared(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"eu.proxy.netbird.io"}, result)
@@ -156,138 +150,8 @@ func TestGetClusterAllowList_PublicEmpty_BYOPOnly(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"byop.example.com"}, result)
 }
-
-// stubStore satisfies the manager's narrow store interface for allow-list
-// tests. Only the agent-network settings lookup participates; the default (a
-// nil func) reads as "no settings row", the state most accounts are in.
-type stubStore struct {
-	getAgentNetworkSettingsFunc func(ctx context.Context, accountID string) (*agentnetworkTypes.Settings, error)
-}
-
-func (s *stubStore) GetAccount(context.Context, string) (*types.Account, error) {
-	panic("not used in allow-list tests")
-}
-
-func (s *stubStore) GetAgentNetworkSettings(ctx context.Context, _ nbstore.LockingStrength, accountID string) (*agentnetworkTypes.Settings, error) {
-	if s.getAgentNetworkSettingsFunc != nil {
-		return s.getAgentNetworkSettingsFunc(ctx, accountID)
-	}
-	return nil, status.Errorf(status.NotFound, "agent network settings for account %s not found", accountID)
-}
-
-func (s *stubStore) GetCustomDomain(context.Context, string, string) (*domain.Domain, error) {
-	panic("not used in allow-list tests")
-}
-
-func (s *stubStore) ListFreeDomains(context.Context, string) ([]string, error) {
-	panic("not used in allow-list tests")
-}
-
-func (s *stubStore) ListCustomDomains(context.Context, string) ([]*domain.Domain, error) {
-	panic("not used in allow-list tests")
-}
-
-func (s *stubStore) CreateCustomDomain(context.Context, string, string, string, bool) (*domain.Domain, error) {
-	panic("not used in allow-list tests")
-}
-
-func (s *stubStore) UpdateCustomDomain(context.Context, string, *domain.Domain) (*domain.Domain, error) {
-	panic("not used in allow-list tests")
-}
-
-func (s *stubStore) DeleteCustomDomain(context.Context, string, string) error {
-	panic("not used in allow-list tests")
-}
-
-// TestGetClusterAllowList_DedicatedGatewayAddressExcluded pins invariant (B)'s
-// chokepoint: a self-addressed settings pin reserves the account's gateway
-// address, so it is dropped from the allow list — which, because the
-// free-domain suffix match is depth-independent, rejects every name beneath
-// it as well as the bare one. Other addresses are unaffected.
-func TestGetClusterAllowList_DedicatedGatewayAddressExcluded(t *testing.T) {
-	pm := &mockProxyManager{
-		getActiveClusterAddressesForAccountFunc: func(_ context.Context, _ string) ([]string, error) {
-			return []string{"brave-otter.gateway.example.com", "byop.example.com"}, nil
-		},
-		getActiveClusterAddressesFunc: func(_ context.Context) ([]string, error) {
-			return []string{"eu.proxy.netbird.io"}, nil
-		},
-	}
-	st := &stubStore{
-		getAgentNetworkSettingsFunc: func(_ context.Context, accountID string) (*agentnetworkTypes.Settings, error) {
-			assert.Equal(t, "acc-123", accountID,
-				"the exclusion must look up the requesting account's own settings")
-			return &agentnetworkTypes.Settings{
-				AccountID:    accountID,
-				Domain:       "brave-otter.gateway.example.com",
-				ProxyAddress: "brave-otter.gateway.example.com",
-			}, nil
-		},
-	}
-
-	mgr := Manager{store: st, proxyManager: pm}
-	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
-	require.NoError(t, err)
-	assert.Equal(t, []string{"byop.example.com", "eu.proxy.netbird.io"}, result,
-		"the dedicated gateway address must be reserved from cluster selection")
-}
-
-// TestGetClusterAllowList_LabeledPinDoesNotExclude pins the counterpart: a
-// labeled pin means the gateway rides on a shared cluster serving ordinary
-// services too, so nothing is reserved.
-func TestGetClusterAllowList_LabeledPinDoesNotExclude(t *testing.T) {
-	pm := &mockProxyManager{
-		getActiveClusterAddressesForAccountFunc: func(_ context.Context, _ string) ([]string, error) {
-			return []string{"byop.example.com"}, nil
-		},
-		getActiveClusterAddressesFunc: func(_ context.Context) ([]string, error) {
-			return []string{"eu.proxy.netbird.io"}, nil
-		},
-	}
-	st := &stubStore{
-		getAgentNetworkSettingsFunc: func(_ context.Context, accountID string) (*agentnetworkTypes.Settings, error) {
-			return &agentnetworkTypes.Settings{
-				AccountID:    accountID,
-				Domain:       "violet.eu.proxy.netbird.io",
-				ProxyAddress: "eu.proxy.netbird.io",
-			}, nil
-		},
-	}
-
-	mgr := Manager{store: st, proxyManager: pm}
-	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
-	require.NoError(t, err)
-	assert.Equal(t, []string{"byop.example.com", "eu.proxy.netbird.io"}, result,
-		"a labeled pin reserves nothing")
-}
-
-// TestGetClusterAllowList_SettingsLookupError_ReturnsError pins that a store
-// outage is surfaced rather than silently treated as "nothing reserved" —
-// failing open here would offer a reserved gateway address for ordinary
-// services.
-func TestGetClusterAllowList_SettingsLookupError_ReturnsError(t *testing.T) {
-	pm := &mockProxyManager{
-		getActiveClusterAddressesForAccountFunc: func(_ context.Context, _ string) ([]string, error) {
-			return []string{"byop.example.com"}, nil
-		},
-		getActiveClusterAddressesFunc: func(_ context.Context) ([]string, error) {
-			return []string{"eu.proxy.netbird.io"}, nil
-		},
-	}
-	st := &stubStore{
-		getAgentNetworkSettingsFunc: func(_ context.Context, _ string) (*agentnetworkTypes.Settings, error) {
-			return nil, status.Errorf(status.Internal, "store outage")
-		},
-	}
-
-	mgr := Manager{store: st, proxyManager: pm}
-	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
-	require.Error(t, err)
-	assert.Nil(t, result)
-	assert.Contains(t, err.Error(), "agent network settings")
-}

management/internals/shared/grpc/proxy.go

@@ -29,7 +29,6 @@ import (
 
 	"github.com/netbirdio/netbird/shared/management/domain"
 
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
@@ -37,6 +36,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/management/server/users"
 	proxyauth "github.com/netbirdio/netbird/proxy/auth"
@@ -61,17 +61,6 @@ type ProxyTokenChecker interface {
 	IsProxyAccessTokenValid(ctx context.Context, tokenID string) (bool, error)
 }
 
-// ProxyConnectAuthorizer authorizes a proxy's claim to the cluster address it
-// declares at connect time. Implementations are supplied by integrations; none
-// is installed by default, so every well-formed claim is authorized — the
-// declared address is otherwise only checked for availability. token is nil
-// when the connection carries no proxy access token. A returned status error
-// is sent to the proxy unchanged; any other error is wrapped as
-// PermissionDenied.
-type ProxyConnectAuthorizer interface {
-	AuthorizeProxyConnect(ctx context.Context, token *types.ProxyAccessToken, proxyID, address string) error
-}
-
 // ProxyServiceServer implements the ProxyService gRPC server
 // AgentNetworkSynthesizer produces in-memory reverse-proxy services from
 // Agent Network provider/policy state for the proxy snapshot path; synthesised
@@ -110,9 +99,6 @@ type ProxyServiceServer struct {
 	// and the post-flight consumption write (RecordLLMUsage). Optional — when
 	// nil both RPCs return Unimplemented.
 	agentNetworkLimits AgentNetworkLimitsService
-	// connectAuthorizer authorizes address claims at proxy connect time.
-	// Optional — when nil every well-formed claim is authorized.
-	connectAuthorizer ProxyConnectAuthorizer
 	// ProxyController for service updates and cluster management
 	proxyController proxy.Controller
 
@@ -276,23 +262,6 @@ func (s *ProxyServiceServer) agentNetworkSynthesizer() AgentNetworkSynthesizer {
 	return s.agentNetworkSynth
 }
 
-// SetProxyConnectAuthorizer wires the connect-time address-claim authorizer.
-// Optional — when nil (the default) every well-formed claim is authorized,
-// which is the behavior without the hook. The modules layer injects this
-// after the proxy server is constructed, like the other setters.
-func (s *ProxyServiceServer) SetProxyConnectAuthorizer(authorizer ProxyConnectAuthorizer) {
-	s.mu.Lock()
-	s.connectAuthorizer = authorizer
-	s.mu.Unlock()
-}
-
-// proxyConnectAuthorizer returns the connect authorizer under read lock.
-func (s *ProxyServiceServer) proxyConnectAuthorizer() ProxyConnectAuthorizer {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-	return s.connectAuthorizer
-}
-
 // CheckLLMPolicyLimits is the pre-flight policy gate the proxy calls before
 // forwarding an LLM request upstream. Delegates to the agent-network selector,
 // which scores applicable policies by remaining headroom and returns the
@@ -477,9 +446,8 @@ func recvSyncInit(stream proto.ProxyService_SyncMappingsServer) (*proto.SyncMapp
 	return init, nil
 }
 
-// validateProxyConnect validates the proxy ID and address, checks cluster
-// address availability for account-scoped tokens, and finally consults the
-// connect authorizer (when installed) on the address claim.
+// validateProxyConnect validates the proxy ID and address, and checks cluster
+// address availability for account-scoped tokens.
 func (s *ProxyServiceServer) validateProxyConnect(proxyID, address string, ctx context.Context) (proxyConnectParams, error) {
 	if proxyID == "" {
 		return proxyConnectParams{}, status.Errorf(codes.InvalidArgument, "proxy_id is required")
@@ -499,19 +467,6 @@ func (s *ProxyServiceServer) validateProxyConnect(proxyID, address string, ctx c
 		}
 	}
 
-	// The authorizer runs last, outside the account-scoped branch, so it also
-	// sees management-wide and token-less connects. PermissionDenied keeps an
-	// authorization rejection distinguishable from the AlreadyExists address
-	// conflict above in proxy logs.
-	if authorizer := s.proxyConnectAuthorizer(); authorizer != nil {
-		if err := authorizer.AuthorizeProxyConnect(ctx, token, proxyID, address); err != nil {
-			if _, ok := status.FromError(err); ok {
-				return proxyConnectParams{}, err
-			}
-			return proxyConnectParams{}, status.Errorf(codes.PermissionDenied, "proxy connect not authorized: %v", err)
-		}
-	}
-
 	return proxyConnectParams{proxyID: proxyID, address: address}, nil
 }
 
@@ -1624,62 +1579,9 @@ func (s *ProxyServiceServer) ValidateState(state string) (verifier, redirectURL
 	return verifier, redirectURL, nil
 }
 
-// Denied reasons reported to the proxy when access is refused because of the
-// account status of the user behind the request.
-const (
-	deniedReasonPendingApproval = "pending_approval"
-	deniedReasonUserBlocked     = "user_blocked"
-	deniedReasonUserNotFound    = "user_not_found"
-)
-
-var (
-	// ErrUserPendingApproval reports a user whose account still awaits approval
-	// by an administrator and may therefore not hold a proxy session.
-	ErrUserPendingApproval = errors.New("user pending approval")
-
-	// ErrUserBlocked reports a blocked user, who may not hold a proxy session.
-	ErrUserBlocked = errors.New("user blocked")
-
-	errUserUnresolved = errors.New("user could not be resolved")
-)
-
-// checkUserStatus reports whether the user's account status permits reverse
-// proxy access, returning the denied reason for the proxy access log together
-// with the sentinel error callers match on. A user awaiting approval is stored
-// as both pending and blocked, so the pending state is reported first: it is
-// the one an administrator can act on.
-func checkUserStatus(user *types.User) (string, error) {
-	switch {
-	case user == nil:
-		return deniedReasonUserNotFound, errUserUnresolved
-	case user.PendingApproval:
-		return deniedReasonPendingApproval, ErrUserPendingApproval
-	case user.IsBlocked():
-		return deniedReasonUserBlocked, ErrUserBlocked
-	default:
-		return "", nil
-	}
-}
-
-// userStatusDeniedReason returns the denied reason for callers that report a
-// decision rather than an error, and an empty string when the user may proceed.
-func userStatusDeniedReason(user *types.User) string {
-	reason, _ := checkUserStatus(user)
-	return reason
-}
-
-// sameAccount reports whether a user belongs to a service's account. An empty
-// identifier on either side never matches: two unset accounts must not compare
-// equal into a grant.
-func sameAccount(userAccountID, serviceAccountID string) bool {
-	return userAccountID != "" && serviceAccountID != "" && userAccountID == serviceAccountID
-}
-
 // GenerateSessionToken creates a signed session JWT for the given domain and
 // user. The user's group memberships are embedded in the token so policy-aware
 // middlewares on the proxy can authorise without an extra management round-trip.
-// A user the store cannot resolve, or whose account is pending approval or
-// blocked, gets no token at all, so the browser never receives a session cookie.
 func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, userID string, method proxyauth.Method) (string, error) {
 	service, err := s.getServiceByDomain(ctx, domain)
 	if err != nil {
@@ -1690,37 +1592,25 @@ func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, u
 		return "", fmt.Errorf("no session key configured for domain: %s", domain)
 	}
 
-	if s.usersManager == nil {
-		return "", errors.New("users manager not configured")
+	var (
+		email      string
+		groupIDs   []string
+		groupNames []string
+	)
+	if s.usersManager != nil {
+		user, userGroups, uerr := s.usersManager.GetUserWithGroups(ctx, userID)
+		if uerr != nil {
+			log.WithContext(ctx).Debugf("session token mint: lookup user %s: %v", userID, uerr)
+		} else if user != nil {
+			email = user.Email
+			groupIDs, groupNames = pairGroupIDsAndNames(userGroups)
+		}
 	}
 
-	user, userGroups, err := s.usersManager.GetUserWithGroups(ctx, userID)
-	if err != nil {
-		return "", fmt.Errorf("get user %s: %w", userID, err)
-	}
-
-	if user == nil {
-		return "", fmt.Errorf("get user %s: %w", userID, errUserUnresolved)
-	}
-
-	// Bind the OIDC identity to the service's account before signing anything
-	// with that service's session key. The proxy validates an installed cookie
-	// locally against the service public key, so a token minted for a user of
-	// another account would be honoured without a management round-trip.
-	if !sameAccount(user.AccountID, service.AccountID) {
-		return "", fmt.Errorf("user %s does not belong to the service account", userID)
-	}
-
-	if _, err := checkUserStatus(user); err != nil {
-		return "", fmt.Errorf("session token for user %s: %w", userID, err)
-	}
-
-	groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
-
 	return sessionkey.SignToken(
 		service.SessionPrivateKey,
 		userID,
-		user.Email,
+		email,
 		domain,
 		method,
 		groupIDs,
@@ -1738,10 +1628,6 @@ func (s *ProxyServiceServer) ValidateUserGroupAccess(ctx context.Context, domain
 		return fmt.Errorf("user not found: %s", userID)
 	}
 
-	if _, err := checkUserStatus(user); err != nil {
-		return fmt.Errorf("user %s denied access to domain %s: %w", userID, domain, err)
-	}
-
 	service, err := s.getAccountServiceByDomain(ctx, user.AccountID, domain)
 	if err != nil {
 		return err
@@ -1796,7 +1682,10 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 	sessionToken := req.GetSessionToken()
 
 	if domain == "" || sessionToken == "" {
-		return deniedSessionResponse("missing domain or session_token"), nil
+		return &proto.ValidateSessionResponse{
+			Valid:        false,
+			DeniedReason: "missing domain or session_token",
+		}, nil
 	}
 
 	service, err := s.getServiceByDomain(ctx, domain)
@@ -1806,49 +1695,83 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 			"error":  err.Error(),
 		}).Debug("ValidateSession: service not found")
 		//nolint:nilerr
-		return deniedSessionResponse("service_not_found"), nil
+		return &proto.ValidateSessionResponse{
+			Valid:        false,
+			DeniedReason: "service_not_found",
+		}, nil
 	}
 
 	if err := enforceAccountScope(ctx, service.AccountID); err != nil {
 		return nil, err
 	}
 
-	userID, reason := sessionTokenSubject(domain, service, sessionToken)
-	if reason != "" {
-		return deniedSessionResponse(reason), nil
+	pubKeyBytes, err := base64.StdEncoding.DecodeString(service.SessionPublicKey)
+	if err != nil {
+		log.WithFields(log.Fields{
+			"domain": domain,
+			"error":  err.Error(),
+		}).Error("ValidateSession: decode public key")
+		//nolint:nilerr
+		return &proto.ValidateSessionResponse{
+			Valid:        false,
+			DeniedReason: "invalid_service_config",
+		}, nil
+	}
+
+	userID, _, _, _, _, err := proxyauth.ValidateSessionJWT(sessionToken, domain, pubKeyBytes)
+	if err != nil {
+		log.WithFields(log.Fields{
+			"domain": domain,
+			"error":  err.Error(),
+		}).Debug("ValidateSession: invalid session token")
+		//nolint:nilerr
+		return &proto.ValidateSessionResponse{
+			Valid:        false,
+			DeniedReason: "invalid_token",
+		}, nil
 	}
 
 	user, userGroups, err := s.usersManager.GetUserWithGroups(ctx, userID)
-	if err != nil || user == nil {
+	if err != nil {
 		log.WithFields(log.Fields{
 			"domain":  domain,
 			"user_id": userID,
-			"error":   err,
+			"error":   err.Error(),
 		}).Debug("ValidateSession: user not found")
 		//nolint:nilerr
-		return deniedSessionResponse(deniedReasonUserNotFound), nil
+		return &proto.ValidateSessionResponse{
+			Valid:        false,
+			DeniedReason: "user_not_found",
+		}, nil
 	}
 
-	// A user from another account gets a bare response: none of their identity
-	// belongs in an answer to a proxy serving a different account.
-	if !sameAccount(user.AccountID, service.AccountID) {
+	if user.AccountID != service.AccountID {
 		log.WithFields(log.Fields{
 			"domain":          domain,
 			"user_id":         userID,
 			"user_account":    user.AccountID,
 			"service_account": service.AccountID,
 		}).Debug("ValidateSession: user account mismatch")
-		return deniedSessionResponse("account_mismatch"), nil
+		//nolint:nilerr
+		return &proto.ValidateSessionResponse{
+			Valid:        false,
+			DeniedReason: "account_mismatch",
+		}, nil
 	}
 
-	groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
-
-	if reason := s.accountUserDeniedReason(domain, service, user); reason != "" {
+	if err := s.checkGroupAccess(service, user); err != nil {
+		log.WithFields(log.Fields{
+			"domain":  domain,
+			"user_id": userID,
+			"error":   err.Error(),
+		}).Debug("ValidateSession: access denied")
+		groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
+		//nolint:nilerr
 		return &proto.ValidateSessionResponse{
 			Valid:          false,
 			UserId:         user.Id,
 			UserEmail:      user.Email,
-			DeniedReason:   reason,
+			DeniedReason:   "not_in_group",
 			PeerGroupIds:   groupIDs,
 			PeerGroupNames: groupNames,
 		}, nil
@@ -1860,6 +1783,7 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 		"email":   user.Email,
 	}).Debug("ValidateSession: access granted")
 
+	groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
 	return &proto.ValidateSessionResponse{
 		Valid:          true,
 		UserId:         user.Id,
@@ -1869,66 +1793,6 @@ func (s *ProxyServiceServer) ValidateSession(ctx context.Context, req *proto.Val
 	}, nil
 }
 
-// deniedSessionResponse builds a denial that carries no identity, for the
-// checks that run before a user of this service's account is resolved.
-func deniedSessionResponse(reason string) *proto.ValidateSessionResponse {
-	return &proto.ValidateSessionResponse{
-		Valid:        false,
-		DeniedReason: reason,
-	}
-}
-
-// sessionTokenSubject verifies the session token against the service's session
-// key and returns the user it was minted for, or the reason it cannot be
-// trusted.
-func sessionTokenSubject(domain string, service *rpservice.Service, sessionToken string) (userID, deniedReason string) {
-	pubKeyBytes, err := base64.StdEncoding.DecodeString(service.SessionPublicKey)
-	if err != nil {
-		log.WithFields(log.Fields{
-			"domain": domain,
-			"error":  err.Error(),
-		}).Error("ValidateSession: decode public key")
-		return "", "invalid_service_config"
-	}
-
-	userID, _, _, _, _, err = proxyauth.ValidateSessionJWT(sessionToken, domain, pubKeyBytes)
-	if err != nil {
-		log.WithFields(log.Fields{
-			"domain": domain,
-			"error":  err.Error(),
-		}).Debug("ValidateSession: invalid session token")
-		return "", "invalid_token"
-	}
-
-	return userID, ""
-}
-
-// accountUserDeniedReason gates a user of the service's own account, returning
-// an empty string when access is granted. Account status comes before group
-// membership: a user awaiting approval or blocked has no access regardless of
-// the groups they were auto-assigned.
-func (s *ProxyServiceServer) accountUserDeniedReason(domain string, service *rpservice.Service, user *types.User) string {
-	if reason := userStatusDeniedReason(user); reason != "" {
-		log.WithFields(log.Fields{
-			"domain":  domain,
-			"user_id": user.Id,
-			"reason":  reason,
-		}).Debug("ValidateSession: user status denies access")
-		return reason
-	}
-
-	if err := s.checkGroupAccess(service, user); err != nil {
-		log.WithFields(log.Fields{
-			"domain":  domain,
-			"user_id": user.Id,
-			"error":   err.Error(),
-		}).Debug("ValidateSession: access denied")
-		return "not_in_group"
-	}
-
-	return ""
-}
-
 func (s *ProxyServiceServer) getServiceByDomain(ctx context.Context, domain string) (*rpservice.Service, error) {
 	service, err := s.serviceManager.GetServiceByDomain(ctx, domain)
 	if err == nil {
@@ -2043,20 +1907,7 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 	}
 
 	groupIDs, groupNames := pairGroupIDsAndNames(peerGroups)
-	owner := s.resolvePeerOwner(ctx, peer, service.AccountID)
-	principalID, displayIdentity := s.getTunnelPeerInfo(ctx, domain, service, peer, owner)
-
-	if reason := peerOwnerDeniedReason(peer, owner); reason != "" {
-		log.WithFields(log.Fields{"domain": domain, "peer_id": peer.ID, "user_id": peer.UserID, "reason": reason}).Debug("ValidateTunnelPeer: owner status denies access")
-		return &proto.ValidateTunnelPeerResponse{
-			Valid:          false,
-			UserId:         principalID,
-			UserEmail:      displayIdentity,
-			DeniedReason:   reason,
-			PeerGroupIds:   groupIDs,
-			PeerGroupNames: groupNames,
-		}, nil
-	}
+	principalID, displayIdentity := s.getTunnelPeerInfo(ctx, domain, service, peer)
 
 	if err := checkPeerGroupAccess(service, groupIDs); err != nil {
 		log.WithFields(log.Fields{"domain": domain, "peer_id": peer.ID, "error": err.Error()}).Debug("ValidateTunnelPeer: access denied")
@@ -2093,55 +1944,9 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 	}, nil
 }
 
-// resolvePeerOwner returns the user a peer is linked to, once per request so
-// the status gate and the identity resolution below share a single lookup.
-// Unlinked peers (machine agents) have no owner. A lookup that fails returns
-// nil rather than an error: both callers treat an unresolved owner the same
-// way, and neither may trust one it could not read.
-func (s *ProxyServiceServer) resolvePeerOwner(ctx context.Context, peer *peer.Peer, accountID string) *types.User {
-	if peer.UserID == "" {
-		return nil
-	}
-
-	user, err := s.usersManager.GetUser(ctx, peer.UserID)
-	if err != nil {
-		log.WithContext(ctx).Debugf("ValidateTunnelPeer: look up owner %s of peer %s: %v", peer.UserID, peer.ID, err)
-		return nil
-	}
-
-	// The lookup is by user ID alone, so a peer row pointing outside the
-	// service's account would otherwise resolve a foreign user. Leave the owner
-	// unresolved instead: the gate denies it, and neither the response nor the
-	// minted token carries an identity from another account.
-	if !sameAccount(user.AccountID, accountID) {
-		log.WithContext(ctx).Debugf("ValidateTunnelPeer: owner %s of peer %s belongs to another account", peer.UserID, peer.ID)
-		return nil
-	}
-
-	return user
-}
-
-// peerOwnerDeniedReason gates the mesh fast-path on the account status of the
-// peer's owning user, so a user blocked after registering a peer loses
-// mesh-origin access too. Unlinked peers (machine agents) have no owner to gate
-// on and stay first-class callers. An owner the store cannot resolve denies:
-// an unavailable lookup must not grant access.
-func peerOwnerDeniedReason(peer *peer.Peer, owner *types.User) string {
-	if peer.UserID == "" {
-		return ""
-	}
-
-	if owner == nil {
-		return deniedReasonUserNotFound
-	}
-
-	return userStatusDeniedReason(owner)
-}
-
 // getTunnelPeerInfo returns the principal ID and display name for a peer, e.g. a
-// user or peer ID, and peer name or user email. owner is the already-resolved
-// user the peer is linked to, or nil.
-func (s *ProxyServiceServer) getTunnelPeerInfo(ctx context.Context, domain string, service *rpservice.Service, peer *peer.Peer, owner *types.User) (string, string) {
+// user or peer ID, and peer name or user email.
+func (s *ProxyServiceServer) getTunnelPeerInfo(ctx context.Context, domain string, service *rpservice.Service, peer *peer.Peer) (string, string) {
 	// Resolve the principal: when the peer is linked to a user, the human is the
 	// principal so multiple peers owned by the same user share a single
 	// identity. Unlinked peers (machine agents) are their own principal keyed on
@@ -2158,10 +1963,10 @@ func (s *ProxyServiceServer) getTunnelPeerInfo(ctx context.Context, domain strin
 	principalID := peer.UserID
 	displayIdentity := peer.Name
 	// Stored column first (cheap, but often empty for OIDC-provisioned users).
-	if owner != nil {
-		principalID = owner.Id
-		if owner.Email != "" {
-			displayIdentity = owner.Email
+	if user, uerr := s.usersManager.GetUser(ctx, peer.UserID); uerr == nil && user != nil {
+		principalID = user.Id
+		if user.Email != "" {
+			displayIdentity = user.Email
 		}
 	}
 	// IdP enrichment wins when available — the stored email column is a

management/internals/shared/grpc/proxy_connect_authorizer_test.go

@@ -1,168 +0,0 @@
-package grpc
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	"github.com/golang/mock/gomock"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"google.golang.org/grpc/codes"
-	grpcstatus "google.golang.org/grpc/status"
-
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// capturingAuthorizer records the arguments of the last AuthorizeProxyConnect
-// call and returns a fixed error.
-type capturingAuthorizer struct {
-	called  int
-	token   *types.ProxyAccessToken
-	proxyID string
-	address string
-	err     error
-}
-
-func (a *capturingAuthorizer) AuthorizeProxyConnect(_ context.Context, token *types.ProxyAccessToken, proxyID, address string) error {
-	a.called++
-	a.token = token
-	a.proxyID = proxyID
-	a.address = address
-	return a.err
-}
-
-// authorizerServer builds a ProxyServiceServer whose proxy manager reports
-// every cluster address as available, so the authorizer is the only thing
-// standing between a claim and success.
-func authorizerServer(t *testing.T) *ProxyServiceServer {
-	t.Helper()
-	ctrl := gomock.NewController(t)
-	mgr := proxy.NewMockManager(ctrl)
-	mgr.EXPECT().IsClusterAddressAvailable(gomock.Any(), gomock.Any(), gomock.Any()).Return(true, nil).AnyTimes()
-	return &ProxyServiceServer{proxyManager: mgr}
-}
-
-// TestValidateProxyConnect_NilAuthorizerUnchanged guards the no-behavior-change
-// claim: with no authorizer installed — the OSS default — a well-formed claim
-// succeeds and malformed input is rejected exactly as before the hook existed.
-func TestValidateProxyConnect_NilAuthorizerUnchanged(t *testing.T) {
-	s := authorizerServer(t)
-
-	params, err := s.validateProxyConnect("proxy-1", "cluster.example.com", scopedCtx("acc-1"))
-	require.NoError(t, err)
-	assert.Equal(t, "proxy-1", params.proxyID)
-	assert.Equal(t, "cluster.example.com", params.address)
-
-	_, err = s.validateProxyConnect("", "cluster.example.com", scopedCtx("acc-1"))
-	require.Error(t, err)
-	st, ok := grpcstatus.FromError(err)
-	require.True(t, ok)
-	assert.Equal(t, codes.InvalidArgument, st.Code(), "missing proxy_id must stay InvalidArgument")
-
-	_, err = s.validateProxyConnect("proxy-1", "not a hostname", scopedCtx("acc-1"))
-	require.Error(t, err)
-	st, ok = grpcstatus.FromError(err)
-	require.True(t, ok)
-	assert.Equal(t, codes.InvalidArgument, st.Code(), "invalid address must stay InvalidArgument")
-}
-
-// TestValidateProxyConnect_AuthorizerReceivesClaim pins the hook contract: the
-// authorizer sees the presented token and the claimed proxy ID and address,
-// and an authorized claim proceeds.
-func TestValidateProxyConnect_AuthorizerReceivesClaim(t *testing.T) {
-	s := authorizerServer(t)
-	auth := &capturingAuthorizer{}
-	s.SetProxyConnectAuthorizer(auth)
-
-	params, err := s.validateProxyConnect("proxy-1", "cluster.example.com", scopedCtx("acc-1"))
-	require.NoError(t, err)
-	assert.Equal(t, "cluster.example.com", params.address)
-
-	require.Equal(t, 1, auth.called, "authorizer must be consulted exactly once per connect")
-	assert.Equal(t, "proxy-1", auth.proxyID)
-	assert.Equal(t, "cluster.example.com", auth.address)
-	require.NotNil(t, auth.token, "the presented token must be handed to the authorizer")
-	require.NotNil(t, auth.token.AccountID)
-	assert.Equal(t, "acc-1", *auth.token.AccountID)
-}
-
-// TestValidateProxyConnect_PlainErrorBecomesPermissionDenied pins the error
-// mapping: a non-status error from the authorizer surfaces as
-// PermissionDenied — distinguishable from the AlreadyExists used for address
-// conflicts — and the claim does not proceed even though the address itself
-// was available.
-func TestValidateProxyConnect_PlainErrorBecomesPermissionDenied(t *testing.T) {
-	s := authorizerServer(t)
-	s.SetProxyConnectAuthorizer(&capturingAuthorizer{err: errors.New("not the assigned credential")})
-
-	_, err := s.validateProxyConnect("proxy-1", "cluster.example.com", scopedCtx("acc-1"))
-	require.Error(t, err)
-	st, ok := grpcstatus.FromError(err)
-	require.True(t, ok)
-	assert.Equal(t, codes.PermissionDenied, st.Code())
-	assert.Contains(t, st.Message(), "not the assigned credential", "the authorizer's reason must survive into the status message")
-}
-
-// TestValidateProxyConnect_StatusErrorPassesThrough pins that an authorizer
-// which chooses its own status code is not second-guessed.
-func TestValidateProxyConnect_StatusErrorPassesThrough(t *testing.T) {
-	s := authorizerServer(t)
-	s.SetProxyConnectAuthorizer(&capturingAuthorizer{
-		err: grpcstatus.Errorf(codes.ResourceExhausted, "try later"),
-	})
-
-	_, err := s.validateProxyConnect("proxy-1", "cluster.example.com", scopedCtx("acc-1"))
-	require.Error(t, err)
-	st, ok := grpcstatus.FromError(err)
-	require.True(t, ok)
-	assert.Equal(t, codes.ResourceExhausted, st.Code(), "a status error must pass through unchanged")
-	assert.Equal(t, "try later", st.Message())
-}
-
-// TestValidateProxyConnect_AuthorizerSeesGlobalAndTokenlessConnects pins the
-// call-site placement: the authorizer sits outside the account-scoped branch,
-// so management-wide tokens (AccountID == nil) and connections without any
-// token are also presented to it rather than bypassing policy.
-func TestValidateProxyConnect_AuthorizerSeesGlobalAndTokenlessConnects(t *testing.T) {
-	s := &ProxyServiceServer{} // no proxy manager: neither path may reach the availability check
-
-	auth := &capturingAuthorizer{}
-	s.SetProxyConnectAuthorizer(auth)
-
-	_, err := s.validateProxyConnect("proxy-1", "cluster.example.com", globalCtx())
-	require.NoError(t, err)
-	require.Equal(t, 1, auth.called, "a management-wide token must still be presented to the authorizer")
-	require.NotNil(t, auth.token)
-	assert.Nil(t, auth.token.AccountID)
-
-	_, err = s.validateProxyConnect("proxy-1", "cluster.example.com", context.Background())
-	require.NoError(t, err)
-	require.Equal(t, 2, auth.called, "a token-less connect must still be presented to the authorizer")
-	assert.Nil(t, auth.token, "no token in context must surface as a nil token, not a zero value")
-}
-
-// TestValidateProxyConnect_AuthorizerRunsLast pins the ordering: input
-// validation and the availability check precede policy, so the authorizer is
-// never consulted about a claim that is malformed or already rejected.
-func TestValidateProxyConnect_AuthorizerRunsLast(t *testing.T) {
-	ctrl := gomock.NewController(t)
-	mgr := proxy.NewMockManager(ctrl)
-	mgr.EXPECT().IsClusterAddressAvailable(gomock.Any(), gomock.Any(), gomock.Any()).Return(false, nil)
-	s := &ProxyServiceServer{proxyManager: mgr}
-
-	auth := &capturingAuthorizer{}
-	s.SetProxyConnectAuthorizer(auth)
-
-	_, err := s.validateProxyConnect("proxy-1", "not a hostname", scopedCtx("acc-1"))
-	require.Error(t, err)
-	assert.Zero(t, auth.called, "a malformed address must be rejected before policy runs")
-
-	_, err = s.validateProxyConnect("proxy-1", "cluster.example.com", scopedCtx("acc-1"))
-	require.Error(t, err)
-	st, ok := grpcstatus.FromError(err)
-	require.True(t, ok)
-	assert.Equal(t, codes.AlreadyExists, st.Code(), "an address conflict must keep its own status")
-	assert.Zero(t, auth.called, "a conflicting address must be rejected before policy runs")
-}

management/internals/shared/grpc/proxy_group_access_test.go

@@ -119,13 +119,11 @@ func (m *mockReverseProxyManager) GetClusters(_ context.Context, _, _ string) ([
 }
 
 type mockUsersManager struct {
-	users        map[string]*types.User
-	err          error
-	getUserCalls int
+	users map[string]*types.User
+	err   error
 }
 
 func (m *mockUsersManager) GetUser(ctx context.Context, userID string) (*types.User, error) {
-	m.getUserCalls++
 	if m.err != nil {
 		return nil, m.err
 	}
@@ -352,64 +350,6 @@ func TestValidateUserGroupAccess(t *testing.T) {
 			},
 			expectErr: false,
 		},
-		{
-			name:   "user pending approval denied despite group membership",
-			domain: "app.example.com",
-			userID: "user1",
-			proxiesByAccount: map[string][]*service.Service{
-				"account1": {{
-					Domain:    "app.example.com",
-					AccountID: "account1",
-					Auth: service.AuthConfig{
-						BearerAuth: &service.BearerAuthConfig{
-							Enabled:            true,
-							DistributionGroups: []string{"group1"},
-						},
-					},
-				}},
-			},
-			users: map[string]*types.User{
-				// The approval flow stores a pending user as blocked as well.
-				"user1": {Id: "user1", AccountID: "account1", AutoGroups: []string{"group1"}, Blocked: true, PendingApproval: true},
-			},
-			expectErr:    true,
-			expectErrMsg: "user pending approval",
-		},
-		{
-			name:   "blocked user denied despite group membership",
-			domain: "app.example.com",
-			userID: "user1",
-			proxiesByAccount: map[string][]*service.Service{
-				"account1": {{
-					Domain:    "app.example.com",
-					AccountID: "account1",
-					Auth: service.AuthConfig{
-						BearerAuth: &service.BearerAuthConfig{
-							Enabled:            true,
-							DistributionGroups: []string{"group1"},
-						},
-					},
-				}},
-			},
-			users: map[string]*types.User{
-				"user1": {Id: "user1", AccountID: "account1", AutoGroups: []string{"group1"}, Blocked: true},
-			},
-			expectErr:    true,
-			expectErrMsg: "user blocked",
-		},
-		{
-			name:   "blocked user denied on a service with no auth configured",
-			domain: "app.example.com",
-			userID: "user1",
-			proxiesByAccount: map[string][]*service.Service{
-				"account1": {{Domain: "app.example.com", AccountID: "account1", Auth: service.AuthConfig{}}},
-			},
-			users: map[string]*types.User{
-				"user1": {Id: "user1", AccountID: "account1", Blocked: true},
-			},
-			expectErr:    true,
-			expectErrMsg: "user blocked",
-		},
 		{
 			name:             "proxy manager error",
 			domain:           "app.example.com",
@@ -481,18 +421,17 @@ func TestValidateTunnelPeerUserEmailEnrichment(t *testing.T) {
 	storedUserNoEmail := map[string]*types.User{userID: {Id: userID, AccountID: accountID, Email: ""}}
 
 	tests := []struct {
-		name               string
-		peerUserID         string
-		storedUsers        map[string]*types.User
-		storedErr          error
-		noIdP              bool
-		idpEmail           string
-		idpHasData         bool
-		idpErr             error
-		expectEmail        string
-		expectUserID       string
-		expectIdPHit       bool
-		expectDeniedReason string
+		name         string
+		peerUserID   string
+		storedUsers  map[string]*types.User
+		storedErr    error
+		noIdP        bool
+		idpEmail     string
+		idpHasData   bool
+		idpErr       error
+		expectEmail  string
+		expectUserID string
+		expectIdPHit bool
 	}{
 		{
 			name:         "idp email wins over stored email",
@@ -551,17 +490,14 @@ func TestValidateTunnelPeerUserEmailEnrichment(t *testing.T) {
 			expectIdPHit: true,
 		},
 		{
-			// The identity still resolves from the IdP, but an owner the store
-			// cannot resolve denies the fast-path rather than granting it.
-			name:               "idp email when stored user missing keeps peer.UserID as principal",
-			peerUserID:         userID,
-			storedUsers:        map[string]*types.User{},
-			idpEmail:           "idp@example.com",
-			idpHasData:         true,
-			expectEmail:        "idp@example.com",
-			expectUserID:       userID,
-			expectIdPHit:       true,
-			expectDeniedReason: deniedReasonUserNotFound,
+			name:         "idp email when stored user missing keeps peer.UserID as principal",
+			peerUserID:   userID,
+			storedUsers:  map[string]*types.User{},
+			idpEmail:     "idp@example.com",
+			idpHasData:   true,
+			expectEmail:  "idp@example.com",
+			expectUserID: userID,
+			expectIdPHit: true,
 		},
 		{
 			name:         "unlinked peer uses peer name and never consults idp",
@@ -609,13 +545,9 @@ func TestValidateTunnelPeerUserEmailEnrichment(t *testing.T) {
 
 			require.NoError(t, err)
 			require.NotNil(t, resp)
-			assert.Equal(t, tt.expectDeniedReason == "", resp.GetValid(), "unexpected access decision")
-			assert.Equal(t, tt.expectDeniedReason, resp.GetDeniedReason(), "unexpected denied reason")
+			assert.True(t, resp.GetValid(), "expected access granted")
 			assert.Equal(t, tt.expectEmail, resp.GetUserEmail())
 			assert.Equal(t, tt.expectUserID, resp.GetUserId())
-			if tt.expectDeniedReason != "" {
-				assert.Empty(t, resp.GetSessionToken(), "a denied peer must not receive a session token")
-			}
 
 			if idpMock != nil {
 				if tt.expectIdPHit {
@@ -630,121 +562,6 @@ func TestValidateTunnelPeerUserEmailEnrichment(t *testing.T) {
 	}
 }
 
-// TestDeniedReasonValues pins the wire values of the account status denied
-// reasons. The proxy logs them and operators filter access logs on them, so a
-// rename is a breaking change rather than an internal detail.
-// TestSameAccount pins the fail-closed behaviour of the account binding: an
-// unset account on either side must never compare equal into a grant.
-func TestSameAccount(t *testing.T) {
-	assert.True(t, sameAccount("account1", "account1"), "matching accounts should bind")
-	assert.False(t, sameAccount("account1", "account2"), "different accounts must not bind")
-	assert.False(t, sameAccount("", ""), "two unset accounts must not bind")
-	assert.False(t, sameAccount("account1", ""), "an unset service account must not bind")
-	assert.False(t, sameAccount("", "account1"), "an unset user account must not bind")
-}
-
-func TestDeniedReasonValues(t *testing.T) {
-	assert.Equal(t, "pending_approval", deniedReasonPendingApproval, "pending approval denied reason wire value")
-	assert.Equal(t, "user_blocked", deniedReasonUserBlocked, "blocked user denied reason wire value")
-	assert.Equal(t, "user_not_found", deniedReasonUserNotFound, "unresolved user denied reason wire value")
-}
-
-// TestValidateTunnelPeerOwnerStatus verifies that the mesh fast-path gates on
-// the account status of the peer's owning user. A peer whose owner was blocked
-// after the peer registered must lose access, while an unlinked machine peer
-// keeps it.
-func TestValidateTunnelPeerOwnerStatus(t *testing.T) {
-	const (
-		domain    = "app.example.com"
-		accountID = "account1"
-		peerID    = "peer1"
-		peerName  = "peer-display-name"
-		userID    = "user1"
-	)
-
-	tests := []struct {
-		name               string
-		peerUserID         string
-		owner              *types.User
-		expectDeniedReason string
-		expectEmail        string
-	}{
-		{
-			name:       "active owner allowed",
-			peerUserID: userID,
-			owner:      &types.User{Id: userID, AccountID: accountID, Email: "user@example.com"},
-		},
-		{
-			name:               "owner pending approval denied",
-			peerUserID:         userID,
-			owner:              &types.User{Id: userID, AccountID: accountID, Email: "user@example.com", Blocked: true, PendingApproval: true},
-			expectDeniedReason: deniedReasonPendingApproval,
-		},
-		{
-			name:               "owner blocked after registering the peer denied",
-			peerUserID:         userID,
-			owner:              &types.User{Id: userID, AccountID: accountID, Email: "user@example.com", Blocked: true},
-			expectDeniedReason: deniedReasonUserBlocked,
-		},
-		{
-			name:       "unlinked machine peer stays allowed",
-			peerUserID: "",
-			owner:      &types.User{Id: userID, AccountID: accountID, Blocked: true},
-		},
-		{
-			// The user lookup is not account-scoped, so a peer row pointing at
-			// another account's user must not resolve into an owner: the peer is
-			// denied and the foreign email never reaches the response.
-			name:               "owner in another account denied and not disclosed",
-			peerUserID:         userID,
-			owner:              &types.User{Id: userID, AccountID: "otherAccount", Email: "foreign@example.com"},
-			expectDeniedReason: deniedReasonUserNotFound,
-			expectEmail:        peerName,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			svc := &service.Service{Domain: domain, AccountID: accountID}
-			usersManager := &mockUsersManager{users: map[string]*types.User{userID: tt.owner}}
-			server := &ProxyServiceServer{
-				serviceManager: &mockReverseProxyManager{
-					proxiesByAccount: map[string][]*service.Service{accountID: {svc}},
-				},
-				peersManager: &mockTunnelPeersManager{
-					peer: &peer.Peer{ID: peerID, Name: peerName, UserID: tt.peerUserID},
-				},
-				usersManager: usersManager,
-			}
-
-			resp, err := server.ValidateTunnelPeer(context.Background(), &proto.ValidateTunnelPeerRequest{
-				Domain:   domain,
-				TunnelIp: "100.64.0.1",
-			})
-
-			require.NoError(t, err)
-			require.NotNil(t, resp)
-			assert.Equal(t, tt.expectDeniedReason, resp.GetDeniedReason(), "unexpected denied reason")
-			assert.Equal(t, tt.expectDeniedReason == "", resp.GetValid(), "unexpected access decision")
-			if tt.expectDeniedReason != "" {
-				assert.Empty(t, resp.GetSessionToken(), "a denied peer must not receive a session token")
-			}
-
-			if tt.expectEmail != "" {
-				assert.Equal(t, tt.expectEmail, resp.GetUserEmail(), "unexpected identity on the response")
-			}
-
-			// The status gate and the identity resolution share one lookup;
-			// an unlinked peer has no owner to look up at all.
-			wantLookups := 1
-			if tt.peerUserID == "" {
-				wantLookups = 0
-			}
-			assert.Equal(t, wantLookups, usersManager.getUserCalls, "owner must be resolved exactly once per request")
-		})
-	}
-}
-
 func TestGetAccountProxyByDomain(t *testing.T) {
 	tests := []struct {
 		name             string

management/internals/shared/grpc/validate_session_test.go

@@ -46,7 +46,6 @@ func setupValidateSessionTest(t *testing.T) *validateSessionTestSetup {
 	proxyService.SetServiceManager(serviceManager)
 
 	createTestProxies(t, ctx, testStore)
-	createStatusTestUsers(t, ctx, testStore)
 
 	return &validateSessionTestSetup{
 		proxyService: proxyService,
@@ -92,82 +91,6 @@ func createTestProxies(t *testing.T, ctx context.Context, testStore store.Store)
 		},
 	}
 	require.NoError(t, testStore.CreateService(ctx, restrictedProxy))
-
-	// Distributed to the account's "All" group, the configuration that hands a
-	// service to every user in the account.
-	allUsersProxy := &service.Service{
-		ID:                "allUsersProxyId",
-		AccountID:         "testAccountId",
-		Name:              "All Users Proxy",
-		Domain:            "all-users-proxy.example.com",
-		Enabled:           true,
-		SessionPrivateKey: privKey,
-		SessionPublicKey:  pubKey,
-		Auth: service.AuthConfig{
-			BearerAuth: &service.BearerAuthConfig{
-				Enabled:            true,
-				DistributionGroups: []string{allUsersGroupID},
-			},
-		},
-	}
-	require.NoError(t, testStore.CreateService(ctx, allUsersProxy))
-}
-
-const (
-	allUsersGroupID   = "allUsersGroupId"
-	pendingUserID     = "pendingUserId"
-	blockedUserID     = "blockedUserId"
-	pendingAllUsersID = "pendingAllUsersUserId"
-)
-
-// createStatusTestUsers adds the users whose account status must keep them out
-// of a proxy session. A user awaiting approval is persisted as both blocked and
-// pending approval, the way the approval flow stores one.
-func createStatusTestUsers(t *testing.T, ctx context.Context, testStore store.Store) {
-	t.Helper()
-
-	require.NoError(t, testStore.CreateGroup(ctx, &types.Group{
-		ID:        allUsersGroupID,
-		AccountID: "testAccountId",
-		Name:      "All",
-		Issued:    types.GroupIssuedAPI,
-	}))
-
-	users := []*types.User{
-		{
-			Id:              pendingUserID,
-			AccountID:       "testAccountId",
-			Role:            types.UserRoleUser,
-			AutoGroups:      []string{"allowedGroupId"},
-			Blocked:         true,
-			PendingApproval: true,
-			Issued:          "api",
-			CreatedAt:       time.Now(),
-		},
-		{
-			Id:              pendingAllUsersID,
-			AccountID:       "testAccountId",
-			Role:            types.UserRoleUser,
-			AutoGroups:      []string{allUsersGroupID},
-			Blocked:         true,
-			PendingApproval: true,
-			Issued:          "api",
-			CreatedAt:       time.Now(),
-		},
-		{
-			Id:              blockedUserID,
-			AccountID:       "testAccountId",
-			Role:            types.UserRoleUser,
-			AutoGroups:      []string{"allowedGroupId"},
-			Blocked:         true,
-			PendingApproval: false,
-			Issued:          "api",
-			CreatedAt:       time.Now(),
-		},
-	}
-	for _, user := range users {
-		require.NoError(t, testStore.SaveUser(ctx, user))
-	}
 }
 
 func generateSessionKeyPair(t *testing.T) (string, string) {
@@ -226,114 +149,6 @@ func TestValidateSession_UserNotInAllowedGroup(t *testing.T) {
 	assert.Empty(t, resp.GetPeerGroupIds(), "PeerGroupIds must mirror the resolved user's actual (empty) memberships on denial")
 }
 
-// TestValidateSession_PendingApprovalUserDenied covers a user who is a member of
-// the service's distribution group but is still waiting for an administrator to
-// approve the account. Group membership alone must not open the service.
-func TestValidateSession_PendingApprovalUserDenied(t *testing.T) {
-	setup := setupValidateSessionTest(t)
-	defer setup.cleanup()
-
-	proxy, err := setup.store.GetServiceByID(context.Background(), store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
-	require.NoError(t, err)
-
-	token := createSessionToken(t, proxy.SessionPrivateKey, pendingUserID, "restricted-proxy.example.com")
-
-	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
-		Domain:       "restricted-proxy.example.com",
-		SessionToken: token,
-	})
-
-	require.NoError(t, err)
-	assert.False(t, resp.Valid, "User pending approval should be denied")
-	assert.Equal(t, deniedReasonPendingApproval, resp.DeniedReason, "Denied reason should name the pending approval state")
-	assert.Equal(t, pendingUserID, resp.UserId, "Denial should identify the user it applies to")
-	assert.Equal(t, []string{"allowedGroupId"}, resp.GetPeerGroupIds(), "PeerGroupIds must mirror the resolved user's group memberships on denial")
-	assert.Equal(t, []string{"Allowed Group"}, resp.GetPeerGroupNames(), "PeerGroupNames must pair with PeerGroupIds on denial")
-}
-
-// TestValidateSession_PendingApprovalUserInAllUsersGroupDenied covers the same
-// user against a service distributed to the account's "All" group, where every
-// user of the account is a member by default.
-func TestValidateSession_PendingApprovalUserInAllUsersGroupDenied(t *testing.T) {
-	setup := setupValidateSessionTest(t)
-	defer setup.cleanup()
-
-	proxy, err := setup.store.GetServiceByID(context.Background(), store.LockingStrengthNone, "testAccountId", "allUsersProxyId")
-	require.NoError(t, err)
-
-	token := createSessionToken(t, proxy.SessionPrivateKey, pendingAllUsersID, "all-users-proxy.example.com")
-
-	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
-		Domain:       "all-users-proxy.example.com",
-		SessionToken: token,
-	})
-
-	require.NoError(t, err)
-	assert.False(t, resp.Valid, "User pending approval should be denied even in the All Users group")
-	assert.Equal(t, deniedReasonPendingApproval, resp.DeniedReason, "Denied reason should name the pending approval state")
-	assert.Equal(t, pendingAllUsersID, resp.UserId, "Denial should identify the user it applies to")
-	assert.Equal(t, []string{allUsersGroupID}, resp.GetPeerGroupIds(), "PeerGroupIds must mirror the resolved user's group memberships on denial")
-}
-
-// TestValidateSession_BlockedUserDenied covers a user blocked after having been
-// approved, so PendingApproval is false and only the blocked flag is set.
-func TestValidateSession_BlockedUserDenied(t *testing.T) {
-	setup := setupValidateSessionTest(t)
-	defer setup.cleanup()
-
-	proxy, err := setup.store.GetServiceByID(context.Background(), store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
-	require.NoError(t, err)
-
-	token := createSessionToken(t, proxy.SessionPrivateKey, blockedUserID, "restricted-proxy.example.com")
-
-	resp, err := setup.proxyService.ValidateSession(context.Background(), &proto.ValidateSessionRequest{
-		Domain:       "restricted-proxy.example.com",
-		SessionToken: token,
-	})
-
-	require.NoError(t, err)
-	assert.False(t, resp.Valid, "Blocked user should be denied")
-	assert.Equal(t, deniedReasonUserBlocked, resp.DeniedReason, "Denied reason should name the blocked state")
-	assert.Equal(t, blockedUserID, resp.UserId, "Denial should identify the user it applies to")
-}
-
-// TestValidateSession_UserAllowedAfterApproval walks the same session token
-// through the approval transition: denied while pending, allowed once an
-// administrator clears both flags.
-func TestValidateSession_UserAllowedAfterApproval(t *testing.T) {
-	setup := setupValidateSessionTest(t)
-	defer setup.cleanup()
-
-	ctx := context.Background()
-
-	proxy, err := setup.store.GetServiceByID(ctx, store.LockingStrengthNone, "testAccountId", "restrictedProxyId")
-	require.NoError(t, err)
-
-	token := createSessionToken(t, proxy.SessionPrivateKey, pendingUserID, "restricted-proxy.example.com")
-	req := &proto.ValidateSessionRequest{
-		Domain:       "restricted-proxy.example.com",
-		SessionToken: token,
-	}
-
-	resp, err := setup.proxyService.ValidateSession(ctx, req)
-	require.NoError(t, err)
-	require.False(t, resp.Valid, "User pending approval should be denied before approval")
-	assert.Equal(t, deniedReasonPendingApproval, resp.DeniedReason, "Denied reason should name the pending approval state")
-
-	user, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, pendingUserID)
-	require.NoError(t, err)
-	user.PendingApproval = false
-	user.Blocked = false
-	require.NoError(t, setup.store.SaveUser(ctx, user))
-
-	resp, err = setup.proxyService.ValidateSession(ctx, req)
-	require.NoError(t, err)
-	assert.True(t, resp.Valid, "Approved user should be allowed access")
-	assert.Empty(t, resp.DeniedReason)
-	assert.Equal(t, pendingUserID, resp.UserId, "Approved user should be identified in the response")
-	assert.Equal(t, []string{"allowedGroupId"}, resp.GetPeerGroupIds(), "PeerGroupIds must mirror the approved user's group memberships")
-}
-
 func TestValidateSession_UserInDifferentAccount(t *testing.T) {
 	setup := setupValidateSessionTest(t)
 	defer setup.cleanup()

management/server/account.go

@@ -33,7 +33,6 @@ import (
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
-	"github.com/netbirdio/netbird/management/server/affectedpeers"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/management/server/geolocation"
@@ -1627,8 +1626,6 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 	var removeOldGroups []string
 	var hasChanges bool
 	var user *types.User
-	var change affectedpeers.Change
-	var snap *affectedpeers.Snapshot
 	err = am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
 		user, err = transaction.GetUserByUserID(ctx, store.LockingStrengthNone, userAuth.UserId)
 		if err != nil {
@@ -1667,25 +1664,14 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 			return fmt.Errorf("error saving user: %w", err)
 		}
 
-		allGroupChanges := slices.Concat(addNewGroups, removeOldGroups)
-		// The user's auto-groups changed, so the SSH rules authorizing them ship a new
-		// group -> user mapping even when no peer moves between groups.
-		change.UserGroupIDs = allGroupChanges
-
-		// The user's peers are the changed entity in every scenario the sync can
-		// produce — group membership, IPv6 assignment, SSH mappings — so they refresh
-		// together with every peer they can connect to, like on a regular peer update.
-		userPeers, err := transaction.GetUserPeers(ctx, store.LockingStrengthNone, userAuth.AccountId, userAuth.UserId)
-		if err != nil {
-			return fmt.Errorf("error getting user peers: %w", err)
-		}
-		for _, peer := range userPeers {
-			change.ChangedPeerIDs = append(change.ChangedPeerIDs, peer.ID)
-		}
-
 		// Propagate changes to peers if group propagation is enabled
 		if settings.GroupsPropagationEnabled {
-			for _, peer := range userPeers {
+			peers, err := transaction.GetUserPeers(ctx, store.LockingStrengthNone, userAuth.AccountId, userAuth.UserId)
+			if err != nil {
+				return fmt.Errorf("error getting user peers: %w", err)
+			}
+
+			for _, peer := range peers {
 				for _, g := range addNewGroups {
 					if err := transaction.AddPeerToGroup(ctx, userAuth.AccountId, peer.ID, g); err != nil {
 						return fmt.Errorf("error adding peer %s to group %s: %w", peer.ID, g, err)
@@ -1698,8 +1684,7 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 				}
 			}
 
-			change.LinkGroups = allGroupChanges
-
+			allGroupChanges := slices.Concat(addNewGroups, removeOldGroups)
 			if err = am.reconcileIPv6ForGroupChanges(ctx, transaction, userAuth.AccountId, allGroupChanges); err != nil {
 				return fmt.Errorf("reconcile IPv6 for group changes: %w", err)
 			}
@@ -1709,10 +1694,6 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 			}
 		}
 
-		if snap, err = affectedpeers.Load(ctx, transaction, userAuth.AccountId, change); err != nil {
-			return err
-		}
-
 		return nil
 	})
 	if err != nil {
@@ -1749,17 +1730,20 @@ func (am *DefaultAccountManager) SyncUserJWTGroups(ctx context.Context, userAuth
 		}
 	}
 
-	log.WithContext(ctx).Tracef("user %s: JWT group membership changed, updating affected peers", userAuth.UserId)
-	bgCtx := context.WithoutCancel(ctx)
-	go func() {
-		affectedPeerIDs := snap.Expand(bgCtx, userAuth.AccountId, change)
-		if len(affectedPeerIDs) == 0 {
-			return
-		}
-		if err := am.networkMapController.BufferUpdateAffectedPeers(bgCtx, userAuth.AccountId, affectedPeerIDs, types.UpdateReason{Resource: types.UpdateResourceUser, Operation: types.UpdateOperationUpdate}); err != nil {
-			log.WithContext(bgCtx).Errorf("failed to update affected peers after JWT group sync for account %s: %v", userAuth.AccountId, err)
-		}
-	}()
+	removedGroupAffectsPeers, err := areGroupChangesAffectPeers(ctx, am.Store, userAuth.AccountId, removeOldGroups)
+	if err != nil {
+		return err
+	}
+
+	newGroupsAffectsPeers, err := areGroupChangesAffectPeers(ctx, am.Store, userAuth.AccountId, addNewGroups)
+	if err != nil {
+		return err
+	}
+
+	if removedGroupAffectsPeers || newGroupsAffectsPeers {
+		log.WithContext(ctx).Tracef("user %s: JWT group membership changed, updating account peers", userAuth.UserId)
+		am.BufferUpdateAccountPeers(ctx, userAuth.AccountId, types.UpdateReason{Resource: types.UpdateResourceUser, Operation: types.UpdateOperationUpdate})
+	}
 
 	return nil
 }
@@ -2442,24 +2426,30 @@ func (am *DefaultAccountManager) reconcileIPv6ForGroupChanges(ctx context.Contex
 		return fmt.Errorf("get account settings: %w", err)
 	}
 
-	if !ipv6ReconcileNeeded(settings, groupIDs) {
+	if len(settings.IPv6EnabledGroups) == 0 {
+		return nil
+	}
+
+	enabledSet := make(map[string]struct{}, len(settings.IPv6EnabledGroups))
+	for _, gid := range settings.IPv6EnabledGroups {
+		enabledSet[gid] = struct{}{}
+	}
+
+	affected := false
+	for _, gid := range groupIDs {
+		if _, ok := enabledSet[gid]; ok {
+			affected = true
+			break
+		}
+	}
+
+	if !affected {
 		return nil
 	}
 
 	return am.updatePeerIPv6Addresses(ctx, transaction, accountID, settings)
 }
 
-// ipv6ReconcileNeeded reports whether changes to the given groups trigger an IPv6
-// reconciliation.
-func ipv6ReconcileNeeded(settings *types.Settings, groupIDs []string) bool {
-	for _, groupID := range groupIDs {
-		if slices.Contains(settings.IPv6EnabledGroups, groupID) {
-			return true
-		}
-	}
-	return false
-}
-
 func (am *DefaultAccountManager) ensureIPv6Subnet(ctx context.Context, transaction store.Store, accountID string, settings *types.Settings, network *types.Network) error {
 	if settings.NetworkRangeV6.IsValid() {
 		network.NetV6 = net.IPNet{

management/server/account_test.go

@@ -1757,7 +1757,6 @@ func TestAccount_Copy(t *testing.T) {
 				AccountID: "account1",
 			},
 		},
-		PostureValidation: map[string]map[string]bool{"1": {"1": true}},
 	}
 	err := hasNilField(account)
 	if err != nil {

management/server/activity/codes.go

@@ -281,9 +281,6 @@ const (
 	// AccountMetricsPushDisabled indicates that a user disabled metrics push for the account
 	AccountMetricsPushDisabled Activity = 141
 
-	// AgentNetworkSettingsDeleted indicates that a user deleted the Agent Network account settings, releasing the endpoint
-	AgentNetworkSettingsDeleted Activity = 142
-
 	AccountDeleted Activity = 99999
 )
 
@@ -456,7 +453,6 @@ var activityMap = map[Activity]Code{
 	AgentNetworkBudgetRuleDeleted: {"Agent Network budget rule deleted", "agent_network.budget_rule.delete"},
 
 	AgentNetworkSettingsUpdated: {"Agent Network settings updated", "agent_network.settings.update"},
-	AgentNetworkSettingsDeleted: {"Agent Network settings deleted", "agent_network.settings.delete"},
 
 	AccountMetricsPushEnabled:  {"Account metrics push enabled", "account.setting.metrics.push.enable"},
 	AccountMetricsPushDisabled: {"Account metrics push disabled", "account.setting.metrics.push.disable"},

management/server/affected_peers_jwt_test.go

@@ -1,179 +0,0 @@
-package server
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/netbirdio/netbird/management/server/affectedpeers"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/auth"
-)
-
-// A user's auto-group change refreshes the destinations of the SSH rules authorizing
-// that group — they carry the group -> user mapping — even though no peer moved
-// between groups.
-func TestAffectedPeers_UserGroupChange_RefreshesSSHAuthorizedDestinations(t *testing.T) {
-	manager, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
-	ctx := context.Background()
-
-	_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:          true,
-				Sources:          []string{groupIDs[0]},
-				Destinations:     []string{groupIDs[1]},
-				Protocol:         types.PolicyRuleProtocolNetbirdSSH,
-				Action:           types.PolicyTrafficActionAccept,
-				AuthorizedGroups: map[string][]string{groupIDs[3]: {"root"}},
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	result := resolveAffected(t, s, accountID, affectedpeers.Change{UserGroupIDs: []string{groupIDs[3]}})
-	assert.ElementsMatch(t, []string{peerIDs[1]}, result,
-		"only the SSH rule's destination peers carry the changed group -> user mapping")
-
-	result = resolveAffected(t, s, accountID, affectedpeers.Change{UserGroupIDs: []string{groupIDs[4]}})
-	assert.Empty(t, result, "a group no SSH rule authorizes affects nobody")
-}
-
-// Creating, blocking or unblocking a user changes the account's allowed-user set, which
-// reaches only the destinations of the SSH rules that ship it.
-func TestAffectedPeers_AllowedUsersChange_RefreshesSSHDestinations(t *testing.T) {
-	manager, s, accountID, peerIDs, groupIDs := setupAffectedPeersTest(t)
-	ctx := context.Background()
-
-	// Ships the allowed-user set: an SSH rule naming no groups and no user.
-	_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{{
-			Enabled:      true,
-			Sources:      []string{groupIDs[0]},
-			Destinations: []string{groupIDs[1]},
-			Protocol:     types.PolicyRuleProtocolNetbirdSSH,
-			Action:       types.PolicyTrafficActionAccept,
-		}},
-	}, true)
-	require.NoError(t, err)
-
-	// Does not ship it: an SSH rule that authorizes a specific group.
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{{
-			Enabled:          true,
-			Sources:          []string{groupIDs[2]},
-			Destinations:     []string{groupIDs[3]},
-			Protocol:         types.PolicyRuleProtocolNetbirdSSH,
-			Action:           types.PolicyTrafficActionAccept,
-			AuthorizedGroups: map[string][]string{groupIDs[0]: {"root"}},
-		}},
-	}, true)
-	require.NoError(t, err)
-
-	result := resolveAffected(t, s, accountID, affectedpeers.Change{AllowedUsersChanged: true})
-	assert.ElementsMatch(t, []string{peerIDs[1]}, result,
-		"only the destinations of the rule shipping the allowed-user set refresh")
-}
-
-// TestAffectedPeers_SyncUserJWTGroups_OnlyAffectedPeersUpdated verifies that a JWT
-// auto-group change updates only the user's peers and the peers linked to the changed
-// group through policies, instead of fanning out to the whole account.
-func TestAffectedPeers_SyncUserJWTGroups_OnlyAffectedPeersUpdated(t *testing.T) {
-	manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
-
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	userPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", userID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "user-peer"},
-	}, false)
-	require.NoError(t, err)
-
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
-	}
-
-	account, err = manager.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Settings.JWTGroupsEnabled = true
-	account.Settings.JWTGroupsClaimName = "groups"
-	account.Settings.GroupsPropagationEnabled = true
-	require.NoError(t, manager.Store.SaveAccount(ctx, account))
-
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-grp", Name: "jwt-linked", Issued: types.GroupIssuedJWT, Peers: []string{}}))
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "jwt-dest", Name: "jwt-dest", Peers: []string{peer2.ID}}))
-
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"jwt-grp"},
-				Destinations:  []string{"jwt-dest"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updUser := updateManager.CreateChannel(ctx, userPeer.ID)
-	upd2 := updateManager.CreateChannel(ctx, peer2.ID)
-	upd3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, userPeer.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	userAuth := auth.UserAuth{
-		AccountId: accountID,
-		UserId:    userID,
-		Groups:    []string{"jwt-linked"},
-	}
-
-	t.Run("adding JWT group updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updUser)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
-
-		peerShouldReceiveUpdate(t, updUser)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
-		require.NoError(t, err)
-		assert.Contains(t, user.AutoGroups, "jwt-grp")
-	})
-
-	t.Run("removing JWT group updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updUser)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		userAuth.Groups = nil
-		require.NoError(t, manager.SyncUserJWTGroups(ctx, userAuth))
-
-		peerShouldReceiveUpdate(t, updUser)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, userID)
-		require.NoError(t, err)
-		assert.NotContains(t, user.AutoGroups, "jwt-grp")
-	})
-}

management/server/affected_peers_user_test.go

@@ -1,170 +0,0 @@
-package server
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/netbirdio/netbird/management/server/activity"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// A user update refreshes only the peers its auto-group change reaches, and a user
-// update that changes no group membership refreshes nobody.
-func TestAffectedPeers_SaveUser_OnlyAffectedPeersUpdated(t *testing.T) {
-	manager, updateManager, account, _, peer2, peer3 := setupNetworkMapTest(t)
-	ctx := context.Background()
-	accountID := account.Id
-
-	const targetUserID = "target-user"
-	require.NoError(t, manager.Store.SaveUser(ctx, &types.User{
-		Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-	}))
-
-	key, err := wgtypes.GeneratePrivateKey()
-	require.NoError(t, err)
-	targetPeer, _, _, _, err := manager.AddPeer(ctx, accountID, "", targetUserID, &nbpeer.Peer{
-		Key:  key.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "target-peer"},
-	}, false)
-	require.NoError(t, err)
-
-	policies, err := manager.Store.GetAccountPolicies(ctx, store.LockingStrengthNone, accountID)
-	require.NoError(t, err)
-	for _, p := range policies {
-		require.NoError(t, manager.Store.DeletePolicy(ctx, accountID, p.ID))
-	}
-
-	account, err = manager.Store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	account.Settings.GroupsPropagationEnabled = true
-	require.NoError(t, manager.Store.SaveAccount(ctx, account))
-
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-linked", Name: "ug-linked"}))
-	require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-dest", Name: "ug-dest", Peers: []string{peer2.ID}}))
-
-	_, err = manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-		Enabled: true,
-		Rules: []*types.PolicyRule{
-			{
-				Enabled:       true,
-				Sources:       []string{"ug-linked"},
-				Destinations:  []string{"ug-dest"},
-				Bidirectional: true,
-				Action:        types.PolicyTrafficActionAccept,
-			},
-		},
-	}, true)
-	require.NoError(t, err)
-
-	updTarget := updateManager.CreateChannel(ctx, targetPeer.ID)
-	upd2 := updateManager.CreateChannel(ctx, peer2.ID)
-	upd3 := updateManager.CreateChannel(ctx, peer3.ID)
-	t.Cleanup(func() {
-		updateManager.CloseChannel(ctx, targetPeer.ID)
-		updateManager.CloseChannel(ctx, peer2.ID)
-		updateManager.CloseChannel(ctx, peer3.ID)
-	})
-
-	t.Run("auto group change updates only linked peers", func(t *testing.T) {
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked"},
-		})
-		require.NoError(t, err)
-
-		peerShouldReceiveUpdate(t, updTarget)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
-
-	t.Run("update without group changes refreshes nobody", func(t *testing.T) {
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		_, err := manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked"}, Name: "renamed",
-		})
-		require.NoError(t, err)
-
-		peerShouldNotReceiveUpdate(t, updTarget)
-		peerShouldNotReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-
-		user, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
-		require.NoError(t, err)
-		assert.Equal(t, "renamed", user.Name)
-	})
-
-	t.Run("auto group change reassigning IPv6 refreshes the changed peers and their observers", func(t *testing.T) {
-		account, err := manager.Store.GetAccount(ctx, accountID)
-		require.NoError(t, err)
-		account.Settings.IPv6EnabledGroups = []string{"ug-v6"}
-		require.NoError(t, manager.Store.SaveAccount(ctx, account))
-		require.NoError(t, manager.CreateGroup(ctx, accountID, userID, &types.Group{ID: "ug-v6", Name: "ug-v6"}))
-
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
-		})
-		require.NoError(t, err)
-
-		// The reassigned peer refreshes with everyone it can reach: peer2 via the
-		// policy, but not peer3, which shares no group or policy with it.
-		peerShouldReceiveUpdate(t, updTarget)
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
-
-	t.Run("unblocking a user refreshes only the SSH rule destinations", func(t *testing.T) {
-		// An SSH rule that authorizes no group of its own ships the account's
-		// allowed-user set to its destinations, so those are the peers an unblock
-		// reaches — not the whole account.
-		_, err := manager.SavePolicy(ctx, accountID, userID, &types.Policy{
-			Enabled: true,
-			Rules: []*types.PolicyRule{{
-				Enabled:      true,
-				Sources:      []string{"ug-linked"},
-				Destinations: []string{"ug-dest"},
-				Protocol:     types.PolicyRuleProtocolNetbirdSSH,
-				Action:       types.PolicyTrafficActionAccept,
-			}},
-		}, true)
-		require.NoError(t, err)
-
-		blocked, err := manager.Store.GetUserByUserID(ctx, store.LockingStrengthNone, targetUserID)
-		require.NoError(t, err)
-		blocked.Blocked = true
-		require.NoError(t, manager.Store.SaveUser(ctx, blocked))
-
-		drainPeerUpdates(updTarget)
-		drainPeerUpdates(upd2)
-		drainPeerUpdates(upd3)
-
-		// Same auto-groups as the previous subtest left them, so no group change and
-		// no IPv6 reconciliation interferes: the unblock alone drives the refresh.
-		_, err = manager.SaveUser(ctx, accountID, activity.SystemInitiator, &types.User{
-			Id: targetUserID, AccountID: accountID, Role: types.UserRoleUser,
-			AutoGroups: []string{"ug-linked", "ug-v6"}, Name: "renamed",
-		})
-		require.NoError(t, err)
-
-		peerShouldReceiveUpdate(t, upd2)
-		peerShouldNotReceiveUpdate(t, upd3)
-	})
-}

management/server/affectedpeers/resolver.go

@@ -18,7 +18,6 @@ import (
 	"context"
 
 	log "github.com/sirupsen/logrus"
-	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
@@ -84,7 +83,7 @@ func (snap *Snapshot) loadCollections(ctx context.Context, s store.Store, accoun
 	hasGroupOrPeerChange := len(c.ChangedGroupIDs) > 0 || len(c.ChangedPeerIDs) > 0 || len(c.LinkGroups) > 0 || len(c.Resources) > 0
 	hasNetworkObject := len(c.Routers) > 0 || len(c.Resources) > 0 || len(c.Networks) > 0
 	// the resource<->router bridge can fire for any of these
-	needsRoutersResources := hasGroupOrPeerChange || len(c.PostureCheckIDs) > 0 || len(c.Policies) > 0 || hasNetworkObject || len(c.UserGroupIDs) > 0 || c.AllowedUsersChanged
+	needsRoutersResources := hasGroupOrPeerChange || len(c.PostureCheckIDs) > 0 || len(c.Policies) > 0 || hasNetworkObject
 
 	if needsRoutersResources {
 		if err := snap.loadPolicyRoutersResources(ctx, s, accountID); err != nil {
@@ -220,18 +219,6 @@ type Change struct {
 	// (correct when the peer's own attributes changed, e.g. IP/status).
 	OutputPeerIDs []string
 
-	// UserGroupIDs are groups whose USER membership changed (a user's auto-groups),
-	// as opposed to their peer membership. Peers ship the group -> user mapping only
-	// for the groups an SSH rule authorizes, so these refresh the destinations of the
-	// SSH rules authorizing them — independently of any peer moving between groups.
-	UserGroupIDs []string
-
-	// AllowedUsersChanged marks a change to the set of users allowed to open SSH
-	// sessions — a user was created, blocked or unblocked. That set is account-wide,
-	// and peers receive it through the SSH rules that name no group or user of their
-	// own, so those rules' destinations refresh.
-	AllowedUsersChanged bool
-
 	// LinkGroups are groups used ONLY to match policies/routes/routers and walk to the
 	// OPPOSITE side — they are never expanded to their own members. Use this when a
 	// peer's group membership changed: pass the peer in ChangedPeerIDs and its
@@ -253,8 +240,6 @@ func (c Change) isEmpty() bool {
 		len(c.Resources) == 0 &&
 		len(c.Networks) == 0 &&
 		len(c.PostureCheckIDs) == 0 &&
-		len(c.UserGroupIDs) == 0 &&
-		!c.AllowedUsersChanged &&
 		len(c.DistributionGroupIDs) == 0 &&
 		len(c.RemovedPeersByGroup) == 0 &&
 		len(c.LinkGroups) == 0 &&
@@ -374,9 +359,6 @@ func (r *resolver) walk() {
 		r.collectFromProxyServices()
 	}
 
-	r.collectFromSSHAuthorizedGroups()
-	r.collectFromAllowedUsers()
-
 	r.collectFromChangedRoutes(r.change.Routes)
 	r.collectFromChangedRouters(r.change.Routers)
 	r.collectFromChangedResources(r.change.Resources)
@@ -829,59 +811,6 @@ func (r *resolver) collectFromNameServers() {
 	}
 }
 
-// collectFromSSHAuthorizedGroups folds the destinations of the enabled SSH rules that
-// authorize a group whose user membership changed. Those destination peers carry the
-// group -> user mapping for the groups they authorize, so they refresh even when no
-// peer moved between groups.
-func (r *resolver) collectFromSSHAuthorizedGroups() {
-	if len(r.change.UserGroupIDs) == 0 {
-		return
-	}
-
-	changed := toSet(r.change.UserGroupIDs)
-	for _, policy := range r.policies() {
-		for _, rule := range policy.Rules {
-			if !rule.Enabled || rule.Protocol != types.PolicyRuleProtocolNetbirdSSH {
-				continue
-			}
-			if !anyInSet(maps.Keys(rule.AuthorizedGroups), changed) {
-				continue
-			}
-			log.WithContext(r.ctx).Tracef("collectFromSSHAuthorizedGroups: rule %s authorizes a changed user group -> folding its destinations", rule.ID)
-			r.foldPolicySideForRule(policy, rule, sideDestination)
-		}
-	}
-}
-
-// collectFromAllowedUsers folds the destinations of the rules that make a peer carry
-// the account's allowed-user set, for a change to who is in that set.
-func (r *resolver) collectFromAllowedUsers() {
-	if !r.change.AllowedUsersChanged {
-		return
-	}
-
-	for _, policy := range r.policies() {
-		for _, rule := range policy.Rules {
-			if !rule.Enabled || !ruleShipsAllowedUsers(rule) {
-				continue
-			}
-			log.WithContext(r.ctx).Tracef("collectFromAllowedUsers: rule %s ships the allowed-user set -> folding its destinations", rule.ID)
-			r.foldPolicySideForRule(policy, rule, sideDestination)
-		}
-	}
-}
-
-// ruleShipsAllowedUsers reports whether a rule makes its destination peers carry the
-// account's allowed-user set. It mirrors the network map's SSH requirements except for
-// the destination peer's own SSH flag, which the snapshot does not hold — so it folds a
-// superset and never misses a peer.
-func ruleShipsAllowedUsers(rule *types.PolicyRule) bool {
-	if rule.Protocol == types.PolicyRuleProtocolNetbirdSSH {
-		return len(rule.AuthorizedGroups) == 0 && rule.AuthorizedUser == ""
-	}
-	return types.PolicyRuleImpliesLegacySSH(rule)
-}
-
 func (r *resolver) collectFromDNSSettings() {
 	if len(r.linkGroups) == 0 || r.snap.dnsSettings == nil {
 		return

management/server/affectedpeers/resolver_test.go

@@ -85,8 +85,6 @@ func TestChangeIsEmpty(t *testing.T) {
 	assert.False(t, Change{Resources: []*resourceTypes.NetworkResource{{ID: "r"}}}.isEmpty())
 	assert.False(t, Change{Networks: []*networkTypes.Network{{ID: "n"}}}.isEmpty())
 	assert.False(t, Change{PostureCheckIDs: []string{"pc"}}.isEmpty())
-	assert.False(t, Change{UserGroupIDs: []string{"g"}}.isEmpty())
-	assert.False(t, Change{AllowedUsersChanged: true}.isEmpty())
 }
 
 func TestPolicyReferencesPostureChecks(t *testing.T) {

management/server/agentnetwork_budgetrule_realstack_test.go

@@ -68,10 +68,7 @@ func TestAgentNetwork_BudgetRuleCRUD_RealManager(t *testing.T) {
 
 // TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection is the
 // GC-1 guard for UpdateSettings: it must apply the collection toggles while
-// preserving the immutable Domain/ProxyAddress assigned at bootstrap. The
-// request echoes the identity fields back — the PUT convention every other
-// endpoint follows — and a request echoing anything else is rejected outright
-// rather than quietly ignored.
+// preserving the immutable Cluster/Subdomain pinned at bootstrap.
 func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *testing.T) {
 	am, _, err := createManager(t)
 	require.NoError(t, err, "createManager must succeed")
@@ -87,14 +84,7 @@ func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *t
 
 	mgr := agentnetwork.NewManager(am.Store, permissions.NewManager(am.Store), am, nil)
 
-	// Bootstrap is an explicit settings create; providers have no settings
-	// side effects anymore.
-	before, err := mgr.CreateSettings(ctx, adminUserID, agenttypes.DefaultSettings(accountID), clusterAddr, "")
-	require.NoError(t, err, "CreateSettings must bootstrap the row")
-	require.Equal(t, clusterAddr, before.ProxyAddress, "proxy address pinned at bootstrap")
-	require.NotEmpty(t, before.Domain, "endpoint allocated at bootstrap")
-	assert.False(t, before.EnablePromptCollection, "prompt collection defaults off")
-
+	// Creating a provider bootstraps the settings row (cluster + subdomain).
 	_, err = mgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
 		AccountID:   accountID,
 		ProviderID:  "openai_api",
@@ -103,64 +93,43 @@ func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *t
 		APIKey:      "sk-test",
 		Enabled:     true,
 		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
-	})
-	require.NoError(t, err, "CreateProvider must succeed")
+	}, clusterAddr)
+	require.NoError(t, err, "CreateProvider must bootstrap settings")
 
-	// Flipping the toggles works when the request echoes the assigned
-	// identity. Retention is echoed too: UpdateSettings takes it verbatim, so
-	// omitting it would zero the account's retention.
+	before, err := mgr.GetSettings(ctx, accountID, adminUserID)
+	require.NoError(t, err, "GetSettings must succeed after bootstrap")
+	require.Equal(t, clusterAddr, before.Cluster, "cluster pinned at bootstrap")
+	require.NotEmpty(t, before.Subdomain, "subdomain pinned at bootstrap")
+	assert.False(t, before.EnablePromptCollection, "prompt collection defaults off")
+
+	// A cluster different from the one pinned at bootstrap must be rejected
+	// outright — never silently swapped or ignored.
+	_, err = mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
+		AccountID:           accountID,
+		Cluster:             "attacker.cluster",
+		EnableLogCollection: true,
+	})
+	require.Error(t, err, "UpdateSettings with a mismatched cluster must fail")
+
+	// Flipping the toggles works with the pinned cluster echoed back (and
+	// with it omitted); the subdomain is never taken from the request.
 	updated, err := mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
 		AccountID:              accountID,
-		Domain:                 before.Domain,
-		ProxyAddress:           before.ProxyAddress,
+		Cluster:                clusterAddr,
+		Subdomain:              "evil",
 		EnableLogCollection:    true,
 		EnablePromptCollection: true,
 		RedactPii:              true,
-		AccessLogRetentionDays: before.AccessLogRetentionDays,
 	})
 	require.NoError(t, err, "UpdateSettings must succeed")
-	assert.Equal(t, before.Domain, updated.Domain, "domain is immutable and must be preserved")
-	assert.Equal(t, before.ProxyAddress, updated.ProxyAddress, "proxy address is immutable and must be preserved")
+	assert.Equal(t, before.Cluster, updated.Cluster, "cluster is immutable and must be preserved")
+	assert.Equal(t, before.Subdomain, updated.Subdomain, "subdomain is immutable and must be preserved")
 	assert.True(t, updated.EnableLogCollection, "log collection toggle must apply")
 	assert.True(t, updated.EnablePromptCollection, "prompt collection toggle must apply")
 	assert.True(t, updated.RedactPii, "redact toggle must apply")
-	assert.Equal(t, before.AccessLogRetentionDays, updated.AccessLogRetentionDays, "echoed retention must survive")
-
-	// Neither identity field can be smuggled into the row: a hand-rolled
-	// Settings value carrying a different endpoint or proxy address is
-	// rejected, not silently ignored.
-	for _, tc := range []struct {
-		name         string
-		domain       string
-		proxyAddress string
-	}{
-		{name: "foreign endpoint", domain: "evil.example.com", proxyAddress: before.ProxyAddress},
-		{name: "foreign proxy address", domain: before.Domain, proxyAddress: "attacker.cluster"},
-		{name: "empty identity echo", domain: "", proxyAddress: ""},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			_, err := mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
-				AccountID:              accountID,
-				Domain:                 tc.domain,
-				ProxyAddress:           tc.proxyAddress,
-				EnableLogCollection:    false,
-				EnablePromptCollection: false,
-				RedactPii:              false,
-				AccessLogRetentionDays: before.AccessLogRetentionDays,
-			})
-			assert.Error(t, err, "a mismatched identity echo must be rejected")
-			assert.ErrorContains(t, err, "immutable", "the rejection must name the immutability rule")
-		})
-	}
-
-	// The rejected updates left the row exactly as the accepted one wrote it.
-	afterRejects, err := mgr.GetSettings(ctx, accountID, adminUserID)
-	require.NoError(t, err, "GetSettings must succeed")
-	assert.True(t, afterRejects.EnablePromptCollection, "a rejected update must not roll back the accepted toggles")
 
 	reloaded, err := am.Store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
 	require.NoError(t, err)
-	assert.Equal(t, before.Domain, reloaded.Domain, "persisted domain unchanged")
-	assert.Equal(t, before.ProxyAddress, reloaded.ProxyAddress, "persisted proxy address unchanged")
+	assert.Equal(t, before.Cluster, reloaded.Cluster, "persisted cluster unchanged")
 	assert.True(t, reloaded.EnablePromptCollection, "persisted prompt collection toggled on")
 }

management/server/agentnetwork_realstack_test.go

@@ -92,14 +92,6 @@ func TestAgentNetwork_ProviderCRUD_FansOutToProxyAndClientPeers(t *testing.T) {
 	// UpdateAccountPeers, which is the path under test.
 	agentMgr := agentnetwork.NewManager(am.Store, permissions.NewManager(am.Store), am, nil)
 
-	_, err = agentMgr.CreateSettings(ctx, adminUserID, agenttypes.DefaultSettings(accountID), clusterAddr, "")
-	require.NoError(t, err, "CreateSettings must bootstrap the endpoint")
-	// The bootstrap itself reconciles and queues updates on both channels;
-	// drain them so the fan-out assertions below can only be satisfied by the
-	// operation under test, not by this leftover.
-	drain(clientCh)
-	drain(proxyCh)
-
 	provider, err := agentMgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
 		AccountID:   accountID,
 		ProviderID:  "openai_api",
@@ -108,7 +100,7 @@ func TestAgentNetwork_ProviderCRUD_FansOutToProxyAndClientPeers(t *testing.T) {
 		APIKey:      "sk-test-key",
 		Enabled:     true,
 		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
-	})
+	}, clusterAddr)
 	require.NoError(t, err, "CreateProvider must succeed")
 
 	policy, err := agentMgr.CreatePolicy(ctx, adminUserID, &agenttypes.Policy{