Add CrowdSec AppSec request inspection to the reverse proxy

client/internal/engine.go

@@ -50,7 +50,6 @@ import (
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/client/internal/portforward"
-	"github.com/netbirdio/netbird/client/internal/pqkem"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/relay"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
@@ -198,10 +197,6 @@ type Engine struct {
 	// rpManager is a Rosenpass manager
 	rpManager *rosenpass.Manager
 
-	// pqkemManager runs the ML-KEM post-quantum PSK exchange (gated by NB_ENABLE_PQ_MLKEM).
-	// It owns the data-path transport and peer endpoint routing.
-	pqkemManager *pqkem.Manager
-
 	// syncMsgMux is used to guarantee sequential Management Service message processing
 	syncMsgMux *sync.Mutex
 
@@ -656,19 +651,6 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		e.rpManager.SetInterface(e.wgInterface)
 	}
 
-	// Start the ML-KEM PQ manager after the interface is up so its dedicated UDP
-	// transport can bind on the WG overlay IP.
-	if pqkem.Enabled() {
-		tr, pqErr := newPQTransport(e.config.WgAddr.IP)
-		if pqErr != nil {
-			log.Errorf("pqkem: transport bind failed, exchange disabled: %v", pqErr)
-		} else {
-			e.pqkemManager = pqkem.NewManager(pqkem.LocalID(publicKey.String()), pqCallbackHandler{wg: e.wgInterface}, pqkem.NewLogger())
-			e.pqkemManager.Start(tr)
-			log.Infof("pqkem: enabled (udp port %d on overlay %s)", e.pqkemManager.LocalPort(), e.config.WgAddr.IP)
-		}
-	}
-
 	// if inbound conns are blocked there is no need to create the ACL manager
 	if e.firewall != nil && !e.config.BlockInbound {
 		e.acl = acl.NewDefaultManager(e.firewall)
@@ -932,10 +914,6 @@ func (e *Engine) removePeer(peerKey string) error {
 
 	e.connMgr.RemovePeerConn(peerKey)
 
-	if e.pqkemManager != nil {
-		e.pqkemManager.RemovePeer(pqkem.RemoteID(peerKey))
-	}
-
 	err := e.statusRecorder.RemovePeer(peerKey)
 	if err != nil {
 		log.Warnf("received error when removing peer %s from status recorder: %v", peerKey, err)
@@ -1922,9 +1900,6 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 		},
 		ICEConfig: e.createICEConfig(),
 	}
-	if e.pqkemManager != nil {
-		config.PQ = pqHandshaker{mgr: e.pqkemManager}
-	}
 
 	serviceDependencies := peer.ServiceDependencies{
 		StatusRecorder:     e.statusRecorder,
@@ -2108,10 +2083,6 @@ func (e *Engine) close() {
 		_ = e.rpManager.Close()
 	}
 
-	if e.pqkemManager != nil {
-		e.pqkemManager.Stop()
-	}
-
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	if err := e.portForwardManager.GracefullyStop(ctx); err != nil {
@@ -2924,8 +2895,6 @@ func convertToOfferAnswer(msg *sProto.Message) (*peer.OfferAnswer, error) {
 		Version:         msg.GetBody().GetNetBirdVersion(),
 		RosenpassPubKey: rosenpassPubKey,
 		RosenpassAddr:   rosenpassAddr,
-		MlkemPayload:    msg.GetBody().GetMlkemPayload(),
-		MlkemPort:       int(msg.GetBody().GetMlkemPort()),
 		RelaySrvAddress: msg.GetBody().GetRelayServerAddress(),
 		RelaySrvIP:      relayIP,
 		SessionID:       sessionID,

client/internal/peer/conn.go

@@ -74,32 +74,6 @@ type RosenpassConfig struct {
 	PermissiveMode bool
 }
 
-// PQHandshaker attaches post-quantum ML-KEM material to signalling offers/answers and
-// feeds received material back. It is implemented by the engine over the pqkem
-// manager and is nil when the PQ exchange is disabled. remoteKey is the peer's
-// WireGuard public key.
-type PQHandshaker interface {
-	// OfferPayload returns the KEM offer to embed in an outgoing offer (nil if this
-	// peer is not the KEM initiator) and the local PQ data-path port to announce.
-	OfferPayload(remoteKey string) (payload []byte, port int)
-	// AnswerPayload processes a received KEM offer (nil if absent) and returns the KEM
-	// answer to embed in the outgoing answer (nil if none) and the local PQ port.
-	AnswerPayload(remoteKey string, recvOffer []byte) (payload []byte, port int)
-	// OnAnswer feeds a received KEM answer (nil if absent).
-	OnAnswer(remoteKey string, recvAnswer []byte)
-	// PSK returns the peer's latest derived post-quantum PSK to program at WG
-	// peer-config time (the pull path). ok is false until one has been derived.
-	PSK(remoteKey string) (wgtypes.Key, bool)
-	// SetRemoteAddr registers the peer's data-path endpoint learned from signalling:
-	// its WG overlay IP with the advertised pq UDP port.
-	SetRemoteAddr(remoteKey string, addr netip.AddrPort)
-	// OnDataPathRekeyed signals a fresh WireGuard handshake for the peer; it clocks the
-	// next chained PSK rotation pushed over the data path.
-	OnDataPathRekeyed(remoteKey string)
-	// OnDataPathDown signals the peer's tunnel went down.
-	OnDataPathDown(remoteKey string)
-}
-
 // ConnConfig is a peer Connection configuration
 type ConnConfig struct {
 	// Key is a public key of a remote peer
@@ -117,9 +91,6 @@ type ConnConfig struct {
 
 	RosenpassConfig RosenpassConfig
 
-	// PQ carries post-quantum ML-KEM material on offers/answers; nil when disabled.
-	PQ PQHandshaker
-
 	// ICEConfig ICE protocol configuration
 	ICEConfig icemaker.Config
 }
@@ -710,10 +681,6 @@ func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
 
 	conn.Log.Warnf("WireGuard handshake timeout detected, closing current connection")
 
-	if conn.config.PQ != nil {
-		conn.config.PQ.OnDataPathDown(conn.config.Key)
-	}
-
 	// Close the active connection based on current priority
 	switch conn.currentConnPriority {
 	case conntype.Relay:
@@ -979,11 +946,6 @@ func (conn *Conn) onWGCheckSuccess() {
 	conn.mu.Lock()
 	conn.wgTimeouts = 0
 	conn.mu.Unlock()
-
-	// A fresh WireGuard handshake is the clock for the post-quantum PSK rotation.
-	if conn.config.PQ != nil {
-		conn.config.PQ.OnDataPathRekeyed(conn.config.Key)
-	}
 }
 
 // recordConnectionMetrics records connection stage timestamps as metrics
@@ -1025,15 +987,6 @@ func (conn *Conn) AgentVersionString() string {
 }
 
 func (conn *Conn) presharedKey(remoteRosenpassKey []byte) *wgtypes.Key {
-	// Post-quantum: once the ML-KEM exchange has derived a PSK for this peer, program
-	// it here so the peer's next WireGuard handshake adopts it. Applied at peer-config
-	// time (bootstrap / reconnect); steady-state rotation is pushed separately.
-	if conn.config.PQ != nil {
-		if psk, ok := conn.config.PQ.PSK(conn.config.Key); ok {
-			return &psk
-		}
-	}
-
 	if conn.config.RosenpassConfig.PubKey == nil {
 		return conn.config.WgConfig.PreSharedKey
 	}

client/internal/peer/handshaker.go

@@ -39,16 +39,6 @@ type OfferAnswer struct {
 	// This value is the local Rosenpass server address when sending the message
 	RosenpassAddr string
 
-	// MlkemPayload carries the post-quantum X25519MLKEM768 handshake message
-	// (pqkem-framed offer on an OFFER, answer on an ANSWER) that seeds the
-	// WireGuard PSK. Opaque here — the pqkem library frames and parses it. Nil
-	// when the peer does not run the ML-KEM PQ exchange.
-	MlkemPayload []byte
-
-	// MlkemPort is the peer's ML-KEM PQ service UDP port (bound on its WG overlay
-	// IP) where data-path rekey messages are sent. Zero when not running the exchange.
-	MlkemPort int
-
 	// relay server address
 	RelaySrvAddress string
 	// RelaySrvIP is the IP the remote peer is connected to on its
@@ -130,8 +120,6 @@ func (h *Handshaker) Listen(ctx context.Context) {
 
 			h.updateRemoteICEState(&remoteOfferAnswer)
 
-			h.pqRegisterEndpoint(remoteOfferAnswer.MlkemPort)
-
 			if h.relayListener != nil {
 				h.relayListener.Notify(&remoteOfferAnswer)
 			}
@@ -140,7 +128,7 @@ func (h *Handshaker) Listen(ctx context.Context) {
 				h.iceListener(&remoteOfferAnswer)
 			}
 
-			if err := h.sendAnswer(&remoteOfferAnswer); err != nil {
+			if err := h.sendAnswer(); err != nil {
 				h.log.Errorf("failed to send remote offer confirmation: %s", err)
 				continue
 			}
@@ -154,8 +142,6 @@ func (h *Handshaker) Listen(ctx context.Context) {
 
 			h.updateRemoteICEState(&remoteOfferAnswer)
 
-			h.pqRegisterEndpoint(remoteOfferAnswer.MlkemPort)
-
 			if h.relayListener != nil {
 				h.relayListener.Notify(&remoteOfferAnswer)
 			}
@@ -163,10 +149,6 @@ func (h *Handshaker) Listen(ctx context.Context) {
 			if h.iceListener != nil && h.RemoteICESupported() {
 				h.iceListener(&remoteOfferAnswer)
 			}
-
-			if h.config.PQ != nil {
-				h.config.PQ.OnAnswer(h.config.Key, remoteOfferAnswer.MlkemPayload)
-			}
 		case <-ctx.Done():
 			h.log.Infof("stop listening for remote offers and answers")
 			return
@@ -174,16 +156,6 @@ func (h *Handshaker) Listen(ctx context.Context) {
 	}
 }
 
-// pqRegisterEndpoint feeds the post-quantum handshaker the peer's data-path endpoint
-// (its WG overlay IP plus the advertised pq UDP port) learned from a remote offer/answer.
-func (h *Handshaker) pqRegisterEndpoint(remotePort int) {
-	if h.config.PQ == nil || remotePort <= 0 || remotePort > 65535 || len(h.config.WgConfig.AllowedIps) == 0 {
-		return
-	}
-	addr := netip.AddrPortFrom(h.config.WgConfig.AllowedIps[0].Addr(), uint16(remotePort))
-	h.config.PQ.SetRemoteAddr(h.config.Key, addr)
-}
-
 func (h *Handshaker) SendOffer() error {
 	h.mu.Lock()
 	defer h.mu.Unlock()
@@ -223,23 +195,13 @@ func (h *Handshaker) sendOffer() error {
 	}
 
 	offer := h.buildOfferAnswer()
-	if h.config.PQ != nil {
-		offer.MlkemPayload, offer.MlkemPort = h.config.PQ.OfferPayload(h.config.Key)
-	}
 	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
 
 	return h.signaler.SignalOffer(offer, h.config.Key)
 }
 
-func (h *Handshaker) sendAnswer(remoteOffer *OfferAnswer) error {
+func (h *Handshaker) sendAnswer() error {
 	answer := h.buildOfferAnswer()
-	if h.config.PQ != nil {
-		var recvOffer []byte
-		if remoteOffer != nil {
-			recvOffer = remoteOffer.MlkemPayload
-		}
-		answer.MlkemPayload, answer.MlkemPort = h.config.PQ.AnswerPayload(h.config.Key, recvOffer)
-	}
 	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
 
 	return h.signaler.SignalAnswer(answer, h.config.Key)

client/internal/peer/signaler.go

@@ -63,8 +63,6 @@ func (s *Signaler) signalOfferAnswer(offerAnswer OfferAnswer, remoteKey string,
 		},
 		RosenpassPubKey: offerAnswer.RosenpassPubKey,
 		RosenpassAddr:   offerAnswer.RosenpassAddr,
-		MlkemPayload:    offerAnswer.MlkemPayload,
-		MlkemPort:       offerAnswer.MlkemPort,
 		RelaySrvAddress: offerAnswer.RelaySrvAddress,
 		RelaySrvIP:      offerAnswer.RelaySrvIP,
 		SessionID:       sessionIDBytes,

client/internal/pqkem/bench_test.go

@@ -1,59 +0,0 @@
-package pqkem
-
-import (
-	"crypto/ecdh"
-	"crypto/mlkem"
-	"crypto/rand"
-	"testing"
-)
-
-func BenchmarkX25519Keygen(b *testing.B) {
-	c := ecdh.X25519()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if _, err := c.GenerateKey(rand.Reader); err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-func BenchmarkX25519ECDH(b *testing.B) {
-	c := ecdh.X25519()
-	a, _ := c.GenerateKey(rand.Reader)
-	p, _ := c.GenerateKey(rand.Reader)
-	pub := p.PublicKey()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if _, err := a.ECDH(pub); err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-func BenchmarkMLKEMKeygen(b *testing.B) {
-	for i := 0; i < b.N; i++ {
-		if _, err := mlkem.GenerateKey768(); err != nil {
-			b.Fatal(err)
-		}
-	}
-}
-
-func BenchmarkMLKEMEncaps(b *testing.B) {
-	dk, _ := mlkem.GenerateKey768()
-	ek := dk.EncapsulationKey()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		_, _ = ek.Encapsulate()
-	}
-}
-
-func BenchmarkMLKEMDecaps(b *testing.B) {
-	dk, _ := mlkem.GenerateKey768()
-	_, ct := dk.EncapsulationKey().Encapsulate()
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		if _, err := dk.Decapsulate(ct); err != nil {
-			b.Fatal(err)
-		}
-	}
-}

client/internal/pqkem/callbacks.go

@@ -1,18 +0,0 @@
-package pqkem
-
-// CallbackHandler is implemented by the host and invoked by the library. The
-// library only reports events; the host owns the reaction. Keeping this an
-// interface — rather than touching the transport or keying directly — is what lets
-// the KEM code be extracted as a standalone library.
-type CallbackHandler interface {
-	// OnNewPSKReady fires when a fresh post-quantum PSK has been derived for a peer
-	// and must be programmed into the consumer's secure channel. It is invoked at
-	// the commit point of each side: the initiator on receiving the answer, the
-	// responder on receiving the confirm.
-	OnNewPSKReady(remoteID RemoteID, psk PSK) error
-
-	// OnRekeyFailed fires when an exchange fails to converge within the allotted
-	// time. The host should tear the peer connection down so it re-establishes, and
-	// log a WARN. The library reports the event; it does not dictate the reaction.
-	OnRekeyFailed(remoteID RemoteID) error
-}

client/internal/pqkem/convergence.go

@@ -1,224 +0,0 @@
-package pqkem
-
-import (
-	"context"
-	"time"
-)
-
-// startExchange creates a fresh initiator exchange (acknowledging ackID, zero for a
-// bootstrap) and returns the framed offer for the caller to send — pushed over the
-// data path for a chained rekey, or handed to the host for signalling when viaSignal
-// is set. Any previous in-flight exchange for the peer is cancelled.
-func (m *Manager) startExchange(remoteID RemoteID, viaSignal bool, ackID ExchangeID) ([]byte, error) {
-	init, err := NewInitiator()
-	if err != nil {
-		return nil, err
-	}
-	id, err := newExchangeID()
-	if err != nil {
-		return nil, err
-	}
-	raw, err := (&OfferMsg{ExchangeID: id, AckID: ackID, KEMOffer: init.Offer()}).Encode()
-	if err != nil {
-		return nil, err
-	}
-
-	ctx, cancel := context.WithCancel(m.rootCtx)
-	m.mu.Lock()
-	if old := m.exchanges[remoteID]; old != nil && old.cancel != nil {
-		old.cancel()
-	}
-	m.exchanges[remoteID] = &exchangeCtl{
-		id:        id,
-		state:     stateAwaitingAnswer,
-		startedAt: time.Now(),
-		cancel:    cancel,
-		lastSent:  raw,
-		initiator: init,
-		viaSignal: viaSignal,
-	}
-	m.mu.Unlock()
-
-	m.wait.Add(1)
-	go m.initiatorLoop(ctx, remoteID, id)
-	return raw, nil
-}
-
-// processOffer (responder) first acknowledges the previous exchange the offer names
-// (that offer riding the data path under the freshly adopted key proves it worked),
-// then derives the PSK for the new offer, commits it optimistically, and returns the
-// framed answer. A duplicate offer returns the cached answer without re-deriving.
-func (m *Manager) processOffer(remoteID RemoteID, o *OfferMsg) ([]byte, error) {
-	if o.AckID != (ExchangeID{}) {
-		m.ackConverged(remoteID, o.AckID)
-	}
-
-	m.mu.Lock()
-	if ex := m.exchanges[remoteID]; ex != nil && ex.id == o.ExchangeID {
-		state, last := ex.state, ex.lastSent
-		m.mu.Unlock()
-		if state == stateReserved {
-			return nil, nil
-		}
-		return last, nil
-	}
-	// Reserve the slot so a concurrent duplicate offer bails.
-	m.exchanges[remoteID] = &exchangeCtl{id: o.ExchangeID, state: stateReserved, startedAt: time.Now()}
-	m.mu.Unlock()
-
-	answerBytes, psk, err := Respond(o.KEMOffer, m.binding(remoteID))
-	if err != nil {
-		return nil, err
-	}
-	raw, err := (&AnswerMsg{ExchangeID: o.ExchangeID, KEMAnswer: answerBytes}).Encode()
-	if err != nil {
-		return nil, err
-	}
-
-	m.mu.Lock()
-	ex := m.exchanges[remoteID]
-	if ex == nil || ex.id != o.ExchangeID {
-		m.mu.Unlock()
-		return nil, nil
-	}
-	ex.state = stateAwaitingAck
-	ex.lastSent = raw
-	ex.pendingPSK = psk
-	m.psks[remoteID] = psk
-	m.mu.Unlock()
-
-	// Commit optimistically so our data path can rekey to the new PSK.
-	if err := m.cbHandler.OnNewPSKReady(remoteID, psk); err != nil {
-		return nil, err
-	}
-	return raw, nil
-}
-
-// processAnswer (initiator) derives and commits the PSK and parks in
-// stateAwaitingRekey; the next offer (chained from OnDataPathRekeyed) will acknowledge
-// this exchange. Only valid in stateAwaitingAnswer; advancing the state under the
-// lock makes a concurrent/duplicate answer bail.
-func (m *Manager) processAnswer(remoteID RemoteID, a *AnswerMsg) error {
-	m.mu.Lock()
-	ex := m.exchanges[remoteID]
-	if ex == nil || ex.id != a.ExchangeID || ex.state != stateAwaitingAnswer {
-		m.mu.Unlock()
-		return nil
-	}
-	ex.state = stateAwaitingRekey
-	init := ex.initiator
-	ex.initiator = nil
-	m.mu.Unlock()
-
-	psk, err := init.Finish(a.KEMAnswer, m.binding(remoteID))
-	if err != nil {
-		return err
-	}
-
-	// The initiator has converged: the responder must have derived the key to answer.
-	m.mu.Lock()
-	m.established[remoteID] = true
-	m.failures[remoteID] = 0
-	m.psks[remoteID] = psk
-	m.mu.Unlock()
-
-	return m.cbHandler.OnNewPSKReady(remoteID, psk)
-}
-
-// ackConverged (responder) records convergence of the exchange named by ackID: a
-// later offer acknowledging it proves both sides operate on that exchange's key. Only
-// acts on a matching stateAwaitingAck exchange; anything else is ignored.
-func (m *Manager) ackConverged(remoteID RemoteID, ackID ExchangeID) {
-	m.mu.Lock()
-	ex := m.exchanges[remoteID]
-	if ex == nil || ex.id != ackID || ex.state != stateAwaitingAck {
-		m.mu.Unlock()
-		return
-	}
-	delete(m.exchanges, remoteID)
-	m.established[remoteID] = true
-	m.failures[remoteID] = 0
-	_ = time.Since(ex.startedAt) // convergence latency (metrics hook, later step)
-	m.mu.Unlock()
-}
-
-// initiatorLoop enforces the offer->answer convergence deadline and retransmits the
-// initiator's outstanding data-path offer while awaiting the answer (a
-// signalling-bootstrapped offer is retransmitted by the host, so it is not resent
-// here). Exhausting the deadline before the answer arrives is a failure. Once the
-// answer is in (state past awaitingAnswer) the loop exits: the next rotation is driven
-// by OnDataPathRekeyed, and the idle wait for it has no deadline.
-func (m *Manager) initiatorLoop(ctx context.Context, remoteID RemoteID, id ExchangeID) {
-	defer m.wait.Done()
-	t := time.NewTicker(m.retryInterval)
-	defer t.Stop()
-
-	attempts := 0
-	for {
-		select {
-		case <-ctx.Done():
-			return
-		case <-t.C:
-			m.mu.Lock()
-			ex := m.exchanges[remoteID]
-			if ex == nil || ex.id != id {
-				m.mu.Unlock()
-				return
-			}
-
-			switch ex.state {
-			case stateAwaitingAnswer:
-				if attempts >= m.maxRetries {
-					delete(m.exchanges, remoteID)
-					fail := m.registerFailureLocked(remoteID)
-					m.mu.Unlock()
-					m.raiseFailure(remoteID, fail)
-					return
-				}
-				viaSignal := ex.viaSignal
-				msg := ex.lastSent
-				attempts++
-				m.mu.Unlock()
-				if !viaSignal {
-					if err := m.pushDataPath(remoteID, msg); err != nil {
-						m.logger.Warn("pqkem: offer retransmit failed", "peer", remoteID, "err", err)
-					}
-				}
-
-			default:
-				// Past awaiting the answer (converged) or superseded: the loop's job
-				// is done. The next rotation is driven externally by OnDataPathRekeyed,
-				// so there is no deadline while idle-waiting for it (that wait can be
-				// as long as the transport's natural rekey interval).
-				m.mu.Unlock()
-				return
-			}
-		}
-	}
-}
-
-// registerFailureLocked applies policy B and reports whether OnRekeyFailed is due:
-// an initial exchange (peer never established) fails immediately; a rekey tolerates
-// up to maxRekeyFailures consecutive misses (we stay on the still-valid previous
-// PSK) before failing. Assumes m.mu is held.
-func (m *Manager) registerFailureLocked(remoteID RemoteID) bool {
-	if !m.established[remoteID] {
-		return true
-	}
-	m.failures[remoteID]++
-	if m.failures[remoteID] >= m.maxRekeyFailures {
-		m.failures[remoteID] = 0
-		return true
-	}
-	return false
-}
-
-func (m *Manager) raiseFailure(remoteID RemoteID, fail bool) {
-	if !fail {
-		m.logger.Warn("pqkem: rekey attempt timed out, will retry next cycle", "peer", remoteID)
-		return
-	}
-	if err := m.cbHandler.OnRekeyFailed(remoteID); err != nil {
-		m.logger.Error("pqkem: OnRekeyFailed handler error", "peer", remoteID, "err", err)
-	}
-}

client/internal/pqkem/convergence_test.go

@@ -1,74 +0,0 @@
-package pqkem
-
-import (
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-// dropTransport is a pqkem.Transport that silently discards everything.
-type dropTransport struct{}
-
-func (dropTransport) Send(netip.AddrPort, []byte) error { return nil }
-func (dropTransport) LocalPort() int                    { return 0 }
-func (dropTransport) Run(func(netip.AddrPort, []byte))  {}
-func (dropTransport) Close() error                      { return nil }
-
-func failedCount(f *fakeWG) int {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return len(f.failed)
-}
-
-func TestManager_InitialTimeoutFailsImmediately(t *testing.T) {
-	wg := newFakeWG()
-	d := NewManager("bbbb", wg, nil) // bbbb > aaaa -> initiator
-	d.Start(dropTransport{})
-	d.retryInterval = 5 * time.Millisecond
-	d.maxRetries = 3
-	defer d.Stop()
-
-	// Bootstrap offer is produced for signalling; no answer ever comes back -> the
-	// initial exchange fails fast.
-	offer, err := d.SignalOffer("aaaa")
-	require.NoError(t, err)
-	require.NotNil(t, offer)
-
-	require.Eventually(t, func() bool { return failedCount(wg) == 1 }, time.Second, 5*time.Millisecond)
-}
-
-func TestManager_RekeyToleratesKFailures(t *testing.T) {
-	dA, dB, _, wgB, lbB := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	// Tighten B's timings before any exchange loop spawns (the loop reads these
-	// fields, so writing them after a loop is running would race).
-	dB.retryInterval = 5 * time.Millisecond
-	dB.maxRetries = 2
-
-	// Establish: bootstrap + data-path-rekeyed so B becomes established and its data
-	// path is usable.
-	bootstrap(t, dA, dB)
-	dA.OnDataPathRekeyed("bbbb")
-	dB.OnDataPathRekeyed("aaaa")
-	require.NotEqual(t, PSK{}, wgB.psk("aaaa"))
-
-	// Drop B's outbound so rekeys can no longer converge.
-	lbB.drop.Store(true)
-
-	// K-1 data-path rekeys must NOT raise OnRekeyFailed.
-	for i := 0; i < DefaultMaxRekeyFailures-1; i++ {
-		_, err := dB.startExchange("aaaa", false, ExchangeID{})
-		require.NoError(t, err)
-		time.Sleep(50 * time.Millisecond)
-	}
-	require.Equal(t, 0, failedCount(wgB), "no failure before K attempts")
-
-	// The K-th failure raises it once.
-	_, err := dB.startExchange("aaaa", false, ExchangeID{})
-	require.NoError(t, err)
-	require.Eventually(t, func() bool { return failedCount(wgB) == 1 }, time.Second, 5*time.Millisecond)
-}

client/internal/pqkem/env.go

@@ -1,59 +0,0 @@
-package pqkem
-
-import (
-	"log/slog"
-	"os"
-	"strconv"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// EnvEnabled is the environment variable that turns the ML-KEM post-quantum
-// exchange on for this client. Accepts on/off aliases plus anything
-// strconv.ParseBool understands (true/false/1/0).
-const EnvEnabled = "NB_ENABLE_PQ_MLKEM"
-
-// Enabled reports whether the ML-KEM PQ exchange is enabled via the environment.
-// An empty or unrecognized value is treated as disabled.
-func Enabled() bool {
-	raw := strings.ToLower(strings.TrimSpace(os.Getenv(EnvEnabled)))
-	switch raw {
-	case "":
-		return false
-	case "on":
-		return true
-	case "off":
-		return false
-	}
-	enabled, err := strconv.ParseBool(raw)
-	if err != nil {
-		log.Warnf("failed to parse %s value %q: %v", EnvEnabled, raw, err)
-		return false
-	}
-	return enabled
-}
-
-// EnvLogLevel overrides the ML-KEM manager's slog level (debug/info/warn/error).
-// Defaults to info.
-const EnvLogLevel = "NB_PQ_MLKEM_LOG_LEVEL"
-
-// NewLogger builds the slog logger for the ML-KEM manager: a text handler to stdout
-// at the level from EnvLogLevel. Mirrors the Rosenpass manager's logger setup so PQ
-// components log consistently.
-func NewLogger() *slog.Logger {
-	return slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: logLevel()}))
-}
-
-func logLevel() slog.Level {
-	switch strings.ToLower(strings.TrimSpace(os.Getenv(EnvLogLevel))) {
-	case "debug":
-		return slog.LevelDebug
-	case "warn":
-		return slog.LevelWarn
-	case "error":
-		return slog.LevelError
-	default:
-		return slog.LevelInfo
-	}
-}

client/internal/pqkem/kem.go

@@ -1,167 +0,0 @@
-// Package pqkem is a spike (NET-1406) for a post-quantum pre-shared-key exchange
-// that could replace Rosenpass. It performs an X25519MLKEM768 hybrid key
-// encapsulation and derives a 32-byte pre-shared key (PSK).
-//
-// The exchange is a single round trip designed to ride the (already
-// authenticated) Signal offer/answer channel:
-//
-//	initiator --Offer(1216B)--> responder
-//	initiator <--Answer(1120B)-- responder
-//
-// Both sides then hold the same PSK, which is bound to the two peers' identities
-// (their peer identity keys) so the derived key cannot be transplanted
-// to a different peer pair even if the transport authentication were bypassed.
-//
-// Combiner note: this follows draft-ietf-tls-ecdhe-mlkem for X25519MLKEM768 — on
-// the wire ML-KEM ‖ X25519 (the draft deliberately reversed the share order for
-// this group), and ML-KEM_ss ‖ X25519_ss fed into the KDF. The spike uses SHA-256
-// (also binding the transcript and peer identities); a production version should
-// use HKDF — see TODO below.
-package pqkem
-
-import (
-	"crypto/ecdh"
-	"crypto/mlkem"
-	"crypto/rand"
-	"crypto/sha256"
-	"fmt"
-)
-
-const (
-	// OfferSize is the initiator message: ML-KEM-768 encapsulation key ‖ X25519 public key
-	// (share order per draft-ietf-tls-ecdhe-mlkem for X25519MLKEM768).
-	OfferSize = mlkem.EncapsulationKeySize768 + 32 // 1216
-	// AnswerSize is the responder message: ML-KEM-768 ciphertext ‖ X25519 public key.
-	AnswerSize = mlkem.CiphertextSize768 + 32 // 1120
-
-	pskLabel = "netbird-pq-psk-v1"
-)
-
-// PSK is the 32-byte derived pre-shared key handed to the consumer to key its channel.
-type PSK [32]byte
-
-// Binding identifies the peer pair the PSK is derived for. Callers set both
-// peer identity keys; the order does not matter (it is canonicalised).
-type Binding struct {
-	LocalID  []byte
-	RemoteID []byte
-}
-
-// Initiator holds the ephemeral secrets between Offer and Finish.
-type Initiator struct {
-	x25519  *ecdh.PrivateKey
-	mlkemDK *mlkem.DecapsulationKey768
-	offer   []byte
-}
-
-// NewInitiator generates the ephemeral X25519 + ML-KEM-768 keypairs.
-func NewInitiator() (*Initiator, error) {
-	x, err := ecdh.X25519().GenerateKey(rand.Reader)
-	if err != nil {
-		return nil, fmt.Errorf("x25519 keygen: %w", err)
-	}
-	dk, err := mlkem.GenerateKey768()
-	if err != nil {
-		return nil, fmt.Errorf("ml-kem keygen: %w", err)
-	}
-
-	offer := make([]byte, 0, OfferSize)
-	offer = append(offer, dk.EncapsulationKey().Bytes()...)
-	offer = append(offer, x.PublicKey().Bytes()...)
-
-	return &Initiator{x25519: x, mlkemDK: dk, offer: offer}, nil
-}
-
-// Offer returns the initiator message to send over Signal.
-func (i *Initiator) Offer() []byte {
-	return i.offer
-}
-
-// Finish consumes the responder's answer and derives the PSK.
-func (i *Initiator) Finish(answer []byte, b Binding) (PSK, error) {
-	if len(answer) != AnswerSize {
-		return PSK{}, fmt.Errorf("answer: got %d bytes, want %d", len(answer), AnswerSize)
-	}
-	ct := answer[:mlkem.CiphertextSize768]
-	peerX := answer[mlkem.CiphertextSize768:]
-
-	ssMLKEM, err := i.mlkemDK.Decapsulate(ct)
-	if err != nil {
-		return PSK{}, fmt.Errorf("ml-kem decapsulate: %w", err)
-	}
-	pub, err := ecdh.X25519().NewPublicKey(peerX)
-	if err != nil {
-		return PSK{}, fmt.Errorf("parse peer x25519: %w", err)
-	}
-	ssX, err := i.x25519.ECDH(pub)
-	if err != nil {
-		return PSK{}, fmt.Errorf("x25519 ecdh: %w", err)
-	}
-
-	return derivePSK(ssMLKEM, ssX, i.offer, answer, b), nil
-}
-
-// Respond consumes an initiator offer, produces the answer, and derives the PSK.
-func Respond(offer []byte, b Binding) (answer []byte, psk PSK, err error) {
-	if len(offer) != OfferSize {
-		return nil, PSK{}, fmt.Errorf("offer: got %d bytes, want %d", len(offer), OfferSize)
-	}
-	peerEK := offer[:mlkem.EncapsulationKeySize768]
-	peerX := offer[mlkem.EncapsulationKeySize768:]
-
-	ek, err := mlkem.NewEncapsulationKey768(peerEK)
-	if err != nil {
-		return nil, PSK{}, fmt.Errorf("parse peer ml-kem key: %w", err)
-	}
-	ssMLKEM, ct := ek.Encapsulate()
-
-	x, err := ecdh.X25519().GenerateKey(rand.Reader)
-	if err != nil {
-		return nil, PSK{}, fmt.Errorf("x25519 keygen: %w", err)
-	}
-	pub, err := ecdh.X25519().NewPublicKey(peerX)
-	if err != nil {
-		return nil, PSK{}, fmt.Errorf("parse peer x25519: %w", err)
-	}
-	ssX, err := x.ECDH(pub)
-	if err != nil {
-		return nil, PSK{}, fmt.Errorf("x25519 ecdh: %w", err)
-	}
-
-	answer = make([]byte, 0, AnswerSize)
-	answer = append(answer, ct...)
-	answer = append(answer, x.PublicKey().Bytes()...)
-
-	// derivePSK uses the same argument order on both sides; the responder's local
-	// binding is the mirror of the initiator's, canonicalised inside derivePSK.
-	return answer, derivePSK(ssMLKEM, ssX, offer, answer, b), nil
-}
-
-// derivePSK combines the two shared secrets and binds the result to the full
-// transcript (offer ‖ answer) and the canonicalised peer identities.
-//
-// TODO(NET-1406): replace the SHA-256 concat with the RFC HKDF combiner
-// (crypto/hkdf, Go 1.24+) and proper labels before this leaves spike status.
-func derivePSK(ssMLKEM, ssX, offer, answer []byte, b Binding) PSK {
-	lo, hi := canonicalPair(b.LocalID, b.RemoteID)
-
-	h := sha256.New()
-	h.Write([]byte(pskLabel))
-	h.Write(ssMLKEM)
-	h.Write(ssX)
-	h.Write(offer)
-	h.Write(answer)
-	h.Write(lo)
-	h.Write(hi)
-
-	var psk PSK
-	copy(psk[:], h.Sum(nil))
-	return psk
-}
-
-func canonicalPair(a, b []byte) (lo, hi []byte) {
-	if string(a) <= string(b) {
-		return a, b
-	}
-	return b, a
-}

client/internal/pqkem/kem_test.go

@@ -1,89 +0,0 @@
-package pqkem
-
-import (
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-var (
-	wgA = []byte("peer-A-wireguard-pubkey-32bytes!")
-	wgB = []byte("peer-B-wireguard-pubkey-32bytes!")
-)
-
-func TestExchange_DerivesMatchingPSK(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	require.Len(t, init.Offer(), OfferSize)
-
-	answer, pskB, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-	require.Len(t, answer, AnswerSize)
-
-	pskA, err := init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
-	require.NoError(t, err)
-
-	require.Equal(t, pskB, pskA, "both sides must derive the same PSK")
-	require.NotEqual(t, PSK{}, pskA, "PSK must not be zero")
-}
-
-func TestExchange_PSKBoundToPeerIdentities(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	// responder computes with the honest pair...
-	_, pskHonest, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-
-	// ...a second responder run with a different peer identity yields a different PSK,
-	// even though the KEM material would otherwise combine identically.
-	wgC := []byte("peer-C-wireguard-pubkey-32bytes!")
-	_, pskWrong, err := Respond(init.Offer(), Binding{LocalID: wgC, RemoteID: wgA})
-	require.NoError(t, err)
-
-	require.NotEqual(t, pskHonest, pskWrong, "PSK must be bound to the peer pair")
-}
-
-func TestExchange_RejectsMalformedMessages(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-
-	_, _, err = Respond(init.Offer()[:10], Binding{})
-	require.Error(t, err)
-
-	_, err = init.Finish([]byte("too short"), Binding{})
-	require.Error(t, err)
-}
-
-// TestExchange_ReportSizesAndTiming is a spike measurement, not a pass/fail gate.
-// Run with: go test -run TestExchange_ReportSizesAndTiming -v ./client/internal/pqkem/
-func TestExchange_ReportSizesAndTiming(t *testing.T) {
-	const iters = 200
-
-	var tInit, tResp, tFinish time.Duration
-	for i := 0; i < iters; i++ {
-		s0 := time.Now()
-		init, err := NewInitiator()
-		require.NoError(t, err)
-		tInit += time.Since(s0)
-
-		s1 := time.Now()
-		answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-		require.NoError(t, err)
-		tResp += time.Since(s1)
-
-		s2 := time.Now()
-		_, err = init.Finish(answer, Binding{LocalID: wgA, RemoteID: wgB})
-		require.NoError(t, err)
-		tFinish += time.Since(s2)
-	}
-
-	t.Logf("wire sizes:   offer=%d B   answer=%d B   (Rosenpass static pubkey ~524160 B)", OfferSize, AnswerSize)
-	t.Logf("total on-wire per handshake: %d B  (~%.0fx smaller than RP static key)", OfferSize+AnswerSize, 524160.0/float64(OfferSize+AnswerSize))
-	t.Logf("avg NewInitiator (keygen): %s", tInit/iters)
-	t.Logf("avg Respond (encaps+dh):   %s", tResp/iters)
-	t.Logf("avg Finish (decaps+dh):    %s", tFinish/iters)
-	t.Logf("avg full handshake CPU:    %s", (tInit+tResp+tFinish)/iters)
-}

client/internal/pqkem/manager.go

@@ -1,372 +0,0 @@
-package pqkem
-
-import (
-	"context"
-	"crypto/rand"
-	"fmt"
-	"log/slog"
-	"net/netip"
-	"sync"
-	"time"
-)
-
-const (
-	// DefaultRetryInterval is how often the initiator retransmits its outstanding
-	// data-path offer while awaiting the answer.
-	DefaultRetryInterval = 2 * time.Second
-	// DefaultMaxRetries bounds how many ticks an exchange may run before it is
-	// declared failed. The convergence deadline is thus MaxRetries * RetryInterval.
-	DefaultMaxRetries = 10
-	// DefaultMaxRekeyFailures is how many consecutive rekey (non-initial) failures
-	// are tolerated before OnRekeyFailed. The initial exchange fails immediately.
-	DefaultMaxRekeyFailures = 3
-)
-
-// LocalID and RemoteID are peer identity keys (e.g. WireGuard public keys). They are
-// distinct types so the local and a remote identity cannot be mixed up.
-type (
-	LocalID  string
-	RemoteID string
-)
-
-// Transport is the data-path socket the Manager drives (the analogue of
-// go-rosenpass's Conn). It is a dumb mover of bytes to/from endpoints: the Manager
-// owns the remoteID<->endpoint routing and hands the transport a resolved endpoint
-// to Send, and reverse-resolves the source of each inbound datagram. Its lifecycle
-// belongs to the Manager (Run at Start, Close at Stop).
-type Transport interface {
-	// Send delivers msg to the given data-path endpoint.
-	Send(endpoint netip.AddrPort, msg []byte) error
-	// LocalPort is the bound local UDP port, announced to peers so they know where
-	// to send data-path messages.
-	LocalPort() int
-	// Run starts delivering inbound datagrams as (source endpoint, msg) to onInbound
-	// and returns immediately; it runs until Close.
-	Run(onInbound func(src netip.AddrPort, msg []byte))
-	// Close stops delivery and releases the socket.
-	Close() error
-}
-
-// exchangeState is the single source of truth for an exchange's role and phase.
-type exchangeState uint8
-
-const (
-	stateReserved       exchangeState = iota // responder: deriving the answer
-	stateAwaitingAnswer                      // initiator: offer sent, awaiting the answer
-	stateAwaitingRekey                       // initiator: PSK derived+set, awaiting OnDataPathRekeyed to chain the next offer
-	stateAwaitingAck                         // responder: answer sent, awaiting the next offer that acks this exchange
-)
-
-// exchangeCtl holds all state for one in-flight exchange with a peer, under the
-// Manager's single lock. state drives every decision. lastSent is the current
-// data-path retransmit payload (the offer, for the initiator). initiator is the
-// ephemeral handle used at Finish; pendingPSK is the responder's derived key.
-// viaSignal records that the offer went to the host for the signalling channel, so
-// the loop does not retransmit it on the data path. Only the initiator runs a
-// retransmit loop, so only it sets cancel.
-type exchangeCtl struct {
-	id         ExchangeID
-	state      exchangeState
-	startedAt  time.Time
-	cancel     context.CancelFunc
-	lastSent   []byte
-	initiator  *Initiator
-	pendingPSK PSK
-	viaSignal  bool
-}
-
-// Manager is the stateful orchestrator — the analogue of go-rosenpass's Server. It
-// drives the X25519MLKEM768 exchange, owns the peer endpoint routing and the data-path
-// transport, and surfaces the derived PSK and convergence to the host via
-// CallbackHandler. It is event-driven: the bootstrap is triggered by the host
-// (SignalOffer) and each rotation is clocked by OnDataPathRekeyed. The cryptography is
-// the pure kem.go primitives; all state lives here under one lock.
-type Manager struct {
-	localID   LocalID
-	cbHandler CallbackHandler
-	logger    *slog.Logger
-
-	retryInterval    time.Duration
-	maxRetries       int
-	maxRekeyFailures int
-
-	rootCtx    context.Context
-	rootCancel context.CancelFunc
-
-	mu          sync.Mutex
-	transport   Transport
-	exchanges   map[RemoteID]*exchangeCtl   // in-flight exchange per peer
-	established map[RemoteID]bool           // peer has completed at least one exchange
-	failures    map[RemoteID]int            // consecutive rekey failures per peer
-	psks        map[RemoteID]PSK            // latest derived PSK per peer (pulled at WG peer-config time)
-	peerAddrs   map[RemoteID]netip.AddrPort // remoteID -> data-path endpoint (send routing)
-	peersByAddr map[netip.AddrPort]RemoteID // reverse: source endpoint -> remoteID (inbound)
-	wait        sync.WaitGroup
-}
-
-// NewManager builds a manager for the local peer identified by its peer identity key
-// (used for the deterministic initiator role and the identity binding). A nil logger
-// falls back to slog.Default(). Install the data-path transport with Start.
-func NewManager(localID LocalID, h CallbackHandler, logger *slog.Logger) *Manager {
-	if logger == nil {
-		logger = slog.Default()
-	}
-	ctx, cancel := context.WithCancel(context.Background())
-	return &Manager{
-		localID:          localID,
-		cbHandler:        h,
-		logger:           logger,
-		retryInterval:    DefaultRetryInterval,
-		maxRetries:       DefaultMaxRetries,
-		maxRekeyFailures: DefaultMaxRekeyFailures,
-		rootCtx:          ctx,
-		rootCancel:       cancel,
-		exchanges:        make(map[RemoteID]*exchangeCtl),
-		established:      make(map[RemoteID]bool),
-		failures:         make(map[RemoteID]int),
-		psks:             make(map[RemoteID]PSK),
-		peerAddrs:        make(map[RemoteID]netip.AddrPort),
-		peersByAddr:      make(map[netip.AddrPort]RemoteID),
-	}
-}
-
-// Start installs the data-path transport and begins its inbound delivery. The Manager
-// owns it from here; Stop closes it. Start/Stop are the transport lifecycle pair.
-func (m *Manager) Start(t Transport) {
-	m.mu.Lock()
-	m.transport = t
-	m.mu.Unlock()
-	if t != nil {
-		t.Run(m.onDataPathInbound)
-	}
-}
-
-// LocalPort is the data-path transport's bound UDP port (0 if no transport), to be
-// announced to peers.
-func (m *Manager) LocalPort() int {
-	m.mu.Lock()
-	t := m.transport
-	m.mu.Unlock()
-	if t == nil {
-		return 0
-	}
-	return t.LocalPort()
-}
-
-// IsInitiator reports whether the local peer drives the exchange for this remote
-// peer. Roles are deterministic (lexicographic identity-key compare) so exactly one
-// side initiates, mirroring how Rosenpass picks its handshake initiator.
-func (m *Manager) IsInitiator(remoteID RemoteID) bool {
-	return string(m.localID) > string(remoteID)
-}
-
-// PSK returns the latest PSK derived for the peer, for the host to program at WG
-// peer-config time (the pull path). ok is false until an exchange has derived one.
-func (m *Manager) PSK(remoteID RemoteID) (PSK, bool) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	psk, ok := m.psks[remoteID]
-	return psk, ok
-}
-
-// AddPeer registers where a peer's data-path messages are sent and received: its
-// overlay endpoint (IP:port). Re-adding updates the endpoint.
-func (m *Manager) AddPeer(remoteID RemoteID, endpoint netip.AddrPort) {
-	if !endpoint.IsValid() {
-		return
-	}
-	m.mu.Lock()
-	if old, ok := m.peerAddrs[remoteID]; ok {
-		delete(m.peersByAddr, old)
-	}
-	m.peerAddrs[remoteID] = endpoint
-	m.peersByAddr[endpoint] = remoteID
-	m.mu.Unlock()
-}
-
-// RemovePeer stops any in-flight exchange for a peer and drops its state and routing.
-func (m *Manager) RemovePeer(remoteID RemoteID) {
-	m.mu.Lock()
-	if ex, ok := m.exchanges[remoteID]; ok {
-		if ex.cancel != nil {
-			ex.cancel()
-		}
-		delete(m.exchanges, remoteID)
-	}
-	delete(m.established, remoteID)
-	delete(m.failures, remoteID)
-	delete(m.psks, remoteID)
-	if ep, ok := m.peerAddrs[remoteID]; ok {
-		delete(m.peersByAddr, ep)
-		delete(m.peerAddrs, remoteID)
-	}
-	m.mu.Unlock()
-}
-
-// Stop cancels all in-flight exchanges, closes the transport, and waits for the
-// exchange goroutines to exit.
-func (m *Manager) Stop() {
-	m.rootCancel()
-	m.wait.Wait()
-	m.mu.Lock()
-	t := m.transport
-	m.transport = nil
-	m.exchanges = make(map[RemoteID]*exchangeCtl)
-	m.psks = make(map[RemoteID]PSK)
-	m.mu.Unlock()
-	if t != nil {
-		if err := t.Close(); err != nil {
-			m.logger.Warn("pqkem: closing data-path transport", "err", err)
-		}
-	}
-}
-
-// ---- Signalling channel (host-driven; rides the host's negotiation) ----
-
-// SignalOffer returns the KEM offer for the host to embed in its outgoing offer to
-// remoteID (bootstrap). It returns (nil, nil) when the local peer is not the
-// initiator. It is idempotent for an in-flight bootstrap: a repeat call returns the
-// same offer rather than starting a new exchange.
-func (m *Manager) SignalOffer(remoteID RemoteID) ([]byte, error) {
-	if !m.IsInitiator(remoteID) {
-		return nil, nil
-	}
-	m.mu.Lock()
-	if ex := m.exchanges[remoteID]; ex != nil && ex.viaSignal && ex.state == stateAwaitingAnswer {
-		last := ex.lastSent
-		m.mu.Unlock()
-		return last, nil
-	}
-	m.mu.Unlock()
-	// bootstrap offer acknowledges nothing (zero AckID).
-	return m.startExchange(remoteID, true, ExchangeID{})
-}
-
-// SignalOnOffer processes a KEM offer the host extracted from an incoming offer and
-// returns the KEM answer for the host to embed in its outgoing answer.
-func (m *Manager) SignalOnOffer(remoteID RemoteID, offer []byte) ([]byte, error) {
-	typ, msg, err := Decode(offer)
-	if err != nil {
-		return nil, fmt.Errorf("decode signal offer from %s: %w", remoteID, err)
-	}
-	if typ != MsgOffer {
-		return nil, fmt.Errorf("expected offer from %s, got type %d", remoteID, typ)
-	}
-	return m.processOffer(remoteID, msg.(*OfferMsg))
-}
-
-// SignalOnAnswer processes a KEM answer the host extracted from an incoming answer.
-// There is no reply: the next offer (over the data path) acknowledges this exchange.
-func (m *Manager) SignalOnAnswer(remoteID RemoteID, answer []byte) error {
-	typ, msg, err := Decode(answer)
-	if err != nil {
-		return fmt.Errorf("decode signal answer from %s: %w", remoteID, err)
-	}
-	if typ != MsgAnswer {
-		return fmt.Errorf("expected answer from %s, got type %d", remoteID, typ)
-	}
-	return m.processAnswer(remoteID, msg.(*AnswerMsg))
-}
-
-// ---- Data path ----
-
-// onDataPathInbound is the transport's inbound handler: it reverse-resolves the
-// source endpoint to a peer and dispatches. Unknown sources are dropped.
-func (m *Manager) onDataPathInbound(src netip.AddrPort, msg []byte) {
-	m.mu.Lock()
-	remoteID, ok := m.peersByAddr[src]
-	m.mu.Unlock()
-	if !ok {
-		return
-	}
-	if err := m.OnDataPathMessage(remoteID, msg); err != nil {
-		m.logger.Debug("pqkem: inbound", "peer", remoteID, "err", err)
-	}
-}
-
-// OnDataPathMessage handles a KEM message received over the data path from remoteID
-// and pushes any reply back over the data path.
-func (m *Manager) OnDataPathMessage(remoteID RemoteID, raw []byte) error {
-	typ, msg, err := Decode(raw)
-	if err != nil {
-		return fmt.Errorf("decode data-path msg from %s: %w", remoteID, err)
-	}
-	switch typ {
-	case MsgOffer:
-		answer, err := m.processOffer(remoteID, msg.(*OfferMsg))
-		if err != nil {
-			return err
-		}
-		if answer == nil {
-			return nil
-		}
-		return m.pushDataPath(remoteID, answer)
-	case MsgAnswer:
-		return m.processAnswer(remoteID, msg.(*AnswerMsg))
-	default:
-		return fmt.Errorf("unhandled data-path message type %d from %s", typ, remoteID)
-	}
-}
-
-// OnDataPathRekeyed notifies that the peer's data path is up and freshly keyed with
-// the latest PSK (fired on first establishment AND every rekey). If we are the
-// initiator that just derived a PSK, it chains the next exchange: a fresh offer over
-// the data path that acknowledges the just-completed one (its arrival under the new
-// key proves to the responder that the key works).
-func (m *Manager) OnDataPathRekeyed(remoteID RemoteID) {
-	m.mu.Lock()
-	ex := m.exchanges[remoteID]
-	chain := ex != nil && ex.state == stateAwaitingRekey
-	var ackID ExchangeID
-	if chain {
-		ackID = ex.id
-	}
-	m.mu.Unlock()
-
-	if !chain {
-		return
-	}
-	offer, err := m.startExchange(remoteID, false, ackID)
-	if err != nil {
-		m.logger.Error("pqkem: chain offer failed to start", "peer", remoteID, "err", err)
-		return
-	}
-	if err := m.pushDataPath(remoteID, offer); err != nil {
-		m.logger.Warn("pqkem: send chain offer failed", "peer", remoteID, "err", err)
-	}
-}
-
-// OnDataPathDown notifies that the peer's data path went down. Rotations resume once
-// the host re-bootstraps over signalling on reconnect; in-flight data-path sends will
-// simply fail until then. Reserved as an explicit hook.
-func (m *Manager) OnDataPathDown(remoteID RemoteID) {}
-
-// ---- internals ----
-
-// pushDataPath resolves the peer's endpoint and sends over the data-path transport,
-// erroring if the peer is unknown or no transport is set.
-func (m *Manager) pushDataPath(remoteID RemoteID, msg []byte) error {
-	m.mu.Lock()
-	ep, ok := m.peerAddrs[remoteID]
-	t := m.transport
-	m.mu.Unlock()
-	if !ok {
-		return fmt.Errorf("no data-path endpoint for peer %s", remoteID)
-	}
-	if t == nil {
-		return fmt.Errorf("no data-path transport")
-	}
-	return t.Send(ep, msg)
-}
-
-func (m *Manager) binding(remoteID RemoteID) Binding {
-	return Binding{LocalID: []byte(m.localID), RemoteID: []byte(remoteID)}
-}
-
-func newExchangeID() (ExchangeID, error) {
-	var id ExchangeID
-	if _, err := rand.Read(id[:]); err != nil {
-		return ExchangeID{}, fmt.Errorf("generate exchange id: %w", err)
-	}
-	return id, nil
-}

client/internal/pqkem/manager_test.go

@@ -1,169 +0,0 @@
-package pqkem
-
-import (
-	"fmt"
-	"net/netip"
-	"sync"
-	"sync/atomic"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// netSwitch is an in-memory UDP fabric: transports register their endpoint and get
-// datagrams delivered to their inbound handler.
-type netSwitch struct {
-	mu sync.Mutex
-	h  map[netip.AddrPort]func(netip.AddrPort, []byte)
-}
-
-func newSwitch() *netSwitch {
-	return &netSwitch{h: map[netip.AddrPort]func(netip.AddrPort, []byte){}}
-}
-
-func (s *netSwitch) register(ep netip.AddrPort, fn func(netip.AddrPort, []byte)) {
-	s.mu.Lock()
-	s.h[ep] = fn
-	s.mu.Unlock()
-}
-
-func (s *netSwitch) deliver(dst, src netip.AddrPort, msg []byte) error {
-	s.mu.Lock()
-	fn := s.h[dst]
-	s.mu.Unlock()
-	if fn == nil {
-		return fmt.Errorf("no route to %s", dst)
-	}
-	fn(src, msg)
-	return nil
-}
-
-// loopback is an endpoint-based pqkem.Transport over a netSwitch, with a switchable
-// drop flag.
-type loopback struct {
-	ep   netip.AddrPort
-	sw   *netSwitch
-	drop atomic.Bool
-}
-
-func (l *loopback) Send(dst netip.AddrPort, msg []byte) error {
-	if l.drop.Load() {
-		return nil
-	}
-	return l.sw.deliver(dst, l.ep, append([]byte(nil), msg...))
-}
-
-func (l *loopback) LocalPort() int                             { return int(l.ep.Port()) }
-func (l *loopback) Run(onInbound func(netip.AddrPort, []byte)) { l.sw.register(l.ep, onInbound) }
-func (l *loopback) Close() error                               { return nil }
-
-type fakeWG struct {
-	mu     sync.Mutex
-	psks   map[RemoteID]PSK
-	failed []RemoteID
-}
-
-func newFakeWG() *fakeWG { return &fakeWG{psks: map[RemoteID]PSK{}} }
-
-func (f *fakeWG) OnNewPSKReady(remoteID RemoteID, psk PSK) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	f.psks[remoteID] = psk
-	return nil
-}
-
-func (f *fakeWG) OnRekeyFailed(remoteID RemoteID) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	f.failed = append(f.failed, remoteID)
-	return nil
-}
-
-func (f *fakeWG) psk(peer RemoteID) PSK {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return f.psks[peer]
-}
-
-var (
-	epA = netip.MustParseAddrPort("100.64.0.1:51833")
-	epB = netip.MustParseAddrPort("100.64.0.2:51833")
-)
-
-// pair builds two wired managers (B is the initiator, "bbbb" > "aaaa") sharing a
-// netSwitch, with each peer's data-path endpoint registered. lbB is B's loopback
-// (for toggling drop).
-func pair(t *testing.T) (dA, dB *Manager, wgA, wgB *fakeWG, lbB *loopback) {
-	t.Helper()
-	sw := newSwitch()
-	wgA = newFakeWG()
-	wgB = newFakeWG()
-	dA = NewManager("aaaa", wgA, nil)
-	dB = NewManager("bbbb", wgB, nil)
-	dA.Start(&loopback{ep: epA, sw: sw})
-	lbB = &loopback{ep: epB, sw: sw}
-	dB.Start(lbB)
-	dA.AddPeer("bbbb", epB)
-	dB.AddPeer("aaaa", epA)
-	return dA, dB, wgA, wgB, lbB
-}
-
-// bootstrap runs the signalling offer/answer (the test plays the host carrying bytes).
-func bootstrap(t *testing.T, dA, dB *Manager) {
-	t.Helper()
-	offer, err := dB.SignalOffer("aaaa")
-	require.NoError(t, err)
-	require.NotNil(t, offer)
-	answer, err := dA.SignalOnOffer("bbbb", offer)
-	require.NoError(t, err)
-	require.NotNil(t, answer)
-	require.NoError(t, dB.SignalOnAnswer("aaaa", answer))
-}
-
-func TestManager_BootstrapDerivesSamePSK(t *testing.T) {
-	dA, dB, wgA, wgB, _ := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	bootstrap(t, dA, dB)
-
-	pskA := wgA.psk("bbbb")
-	pskB := wgB.psk("aaaa")
-	require.NotEqual(t, PSK{}, pskA)
-	require.Equal(t, pskB, pskA, "both sides derive the same PSK from the bootstrap exchange")
-}
-
-func TestManager_ChainRotatesAndAcks(t *testing.T) {
-	dA, dB, wgA, wgB, _ := pair(t)
-	defer dA.Stop()
-	defer dB.Stop()
-
-	bootstrap(t, dA, dB)
-	psk1 := wgB.psk("aaaa")
-
-	// Data path up: B (initiator) chains the next offer over the data path, which
-	// rotates both to a fresh PSK and acknowledges A.
-	dA.OnDataPathRekeyed("bbbb")
-	dB.OnDataPathRekeyed("aaaa")
-
-	psk2A := wgA.psk("bbbb")
-	psk2B := wgB.psk("aaaa")
-	require.Equal(t, psk2B, psk2A, "both sides converge on the rotated PSK")
-	require.NotEqual(t, psk1, psk2B, "the chain rotated to a new PSK")
-}
-
-func TestManager_NonInitiatorReturnsNoOffer(t *testing.T) {
-	dA := NewManager("aaaa", newFakeWG(), nil)
-	defer dA.Stop()
-
-	offer, err := dA.SignalOffer("bbbb") // not the initiator vs "bbbb"
-	require.NoError(t, err)
-	require.Nil(t, offer)
-}
-
-func TestManager_StopIsIdempotent(t *testing.T) {
-	dA := NewManager("aaaa", newFakeWG(), nil)
-	dA.Start(&loopback{ep: epA, sw: newSwitch()})
-	dA.Stop()
-	dA.Stop() // must not panic or hang
-}

client/internal/pqkem/message.go

@@ -1,121 +0,0 @@
-package pqkem
-
-import (
-	"crypto/mlkem"
-	"fmt"
-)
-
-// Wire framing for the PQ-KEM exchange. Messages are self-contained, versioned,
-// transport-agnostic byte blobs: the same bytes ride the signalling channel
-// (initial bootstrap) or a data-tunnel packet (rekey). The library only ever sees
-// opaque []byte at the transport seam.
-//
-// Layout (all messages): [type:1][version:1][exchangeID:16][payload...]
-//
-// There is no confirm message: an exchange is acknowledged by the NEXT offer, which
-// carries the acked exchange's id (see OfferMsg.AckID) and — riding the data path
-// under the freshly adopted key — proves that key works.
-
-const (
-	// ProtocolVersion is bumped on any wire-incompatible change; a peer rejects
-	// messages it does not understand rather than misparsing them.
-	ProtocolVersion uint8 = 1
-
-	// ExchangeIDSize identifies one exchange so answers/acks correlate and stale
-	// messages are dropped.
-	ExchangeIDSize = 16
-
-	headerSize = 1 + 1 + ExchangeIDSize
-)
-
-// MsgType tags the two message kinds of the exchange.
-type MsgType uint8
-
-const (
-	MsgOffer MsgType = iota + 1
-	MsgAnswer
-)
-
-// ExchangeID is the per-exchange correlator. The zero value means "none" (an offer
-// that acknowledges nothing, i.e. the first exchange of a connection).
-type ExchangeID [ExchangeIDSize]byte
-
-// OfferMsg carries the initiator's public material (X25519 pub ‖ ML-KEM encap key)
-// and AckID, the id of the previous exchange this offer acknowledges (zero if none).
-type OfferMsg struct {
-	ExchangeID ExchangeID
-	AckID      ExchangeID
-	// KEMOffer is the raw Initiator.Offer() blob (OfferSize bytes).
-	KEMOffer []byte
-}
-
-// AnswerMsg carries the responder's reply (ML-KEM ciphertext ‖ X25519 pub) for the
-// round identified by ExchangeID.
-type AnswerMsg struct {
-	ExchangeID ExchangeID
-	// KEMAnswer is the raw Respond() answer blob (AnswerSize bytes).
-	KEMAnswer []byte
-}
-
-// Encode serialises the offer with its framed header (payload = AckID ‖ KEMOffer).
-func (m *OfferMsg) Encode() ([]byte, error) {
-	if len(m.KEMOffer) != OfferSize {
-		return nil, fmt.Errorf("offer payload: got %d, want %d", len(m.KEMOffer), OfferSize)
-	}
-	payload := make([]byte, 0, ExchangeIDSize+OfferSize)
-	payload = append(payload, m.AckID[:]...)
-	payload = append(payload, m.KEMOffer...)
-	return frame(MsgOffer, m.ExchangeID, payload), nil
-}
-
-// Encode serialises the answer with its framed header.
-func (m *AnswerMsg) Encode() ([]byte, error) {
-	if len(m.KEMAnswer) != AnswerSize {
-		return nil, fmt.Errorf("answer payload: got %d, want %d", len(m.KEMAnswer), AnswerSize)
-	}
-	return frame(MsgAnswer, m.ExchangeID, m.KEMAnswer), nil
-}
-
-// Decode parses a framed message into one of *OfferMsg / *AnswerMsg.
-func Decode(buf []byte) (MsgType, any, error) {
-	if len(buf) < headerSize {
-		return 0, nil, fmt.Errorf("message too short: %d bytes", len(buf))
-	}
-	typ := MsgType(buf[0])
-	if ver := buf[1]; ver != ProtocolVersion {
-		return typ, nil, fmt.Errorf("unsupported protocol version %d (want %d)", ver, ProtocolVersion)
-	}
-
-	var id ExchangeID
-	copy(id[:], buf[2:headerSize])
-	payload := buf[headerSize:]
-
-	switch typ {
-	case MsgOffer:
-		if len(payload) != ExchangeIDSize+OfferSize {
-			return typ, nil, fmt.Errorf("offer payload: got %d, want %d", len(payload), ExchangeIDSize+OfferSize)
-		}
-		var ack ExchangeID
-		copy(ack[:], payload[:ExchangeIDSize])
-		return typ, &OfferMsg{ExchangeID: id, AckID: ack, KEMOffer: payload[ExchangeIDSize:]}, nil
-	case MsgAnswer:
-		if len(payload) != AnswerSize {
-			return typ, nil, fmt.Errorf("answer payload: got %d, want %d", len(payload), AnswerSize)
-		}
-		return typ, &AnswerMsg{ExchangeID: id, KEMAnswer: payload}, nil
-	default:
-		return typ, nil, fmt.Errorf("unknown message type %d", typ)
-	}
-}
-
-func frame(typ MsgType, id ExchangeID, payload []byte) []byte {
-	buf := make([]byte, headerSize+len(payload))
-	buf[0] = byte(typ)
-	buf[1] = ProtocolVersion
-	copy(buf[2:], id[:])
-	copy(buf[headerSize:], payload)
-	return buf
-}
-
-// compile-time assurance the KEM blob sizes referenced here stay in sync with kem.go.
-var _ = [1]struct{}{}[OfferSize-(32+mlkem.EncapsulationKeySize768)]

client/internal/pqkem/message_test.go

@@ -1,57 +0,0 @@
-package pqkem
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestMessageRoundTrip(t *testing.T) {
-	init, err := NewInitiator()
-	require.NoError(t, err)
-	answer, _, err := Respond(init.Offer(), Binding{LocalID: wgB, RemoteID: wgA})
-	require.NoError(t, err)
-
-	id := ExchangeID{1, 2, 3, 4}
-	ack := ExchangeID{9, 9, 9}
-
-	offBytes, err := (&OfferMsg{ExchangeID: id, AckID: ack, KEMOffer: init.Offer()}).Encode()
-	require.NoError(t, err)
-	typ, decoded, err := Decode(offBytes)
-	require.NoError(t, err)
-	require.Equal(t, MsgOffer, typ)
-	require.Equal(t, id, decoded.(*OfferMsg).ExchangeID)
-	require.Equal(t, ack, decoded.(*OfferMsg).AckID)
-	require.Equal(t, init.Offer(), decoded.(*OfferMsg).KEMOffer)
-
-	ansBytes, err := (&AnswerMsg{ExchangeID: id, KEMAnswer: answer}).Encode()
-	require.NoError(t, err)
-	typ, decoded, err = Decode(ansBytes)
-	require.NoError(t, err)
-	require.Equal(t, MsgAnswer, typ)
-	require.Equal(t, answer, decoded.(*AnswerMsg).KEMAnswer)
-}
-
-func TestDecodeRejects(t *testing.T) {
-	// too short
-	_, _, err := Decode([]byte{1, 1})
-	require.Error(t, err)
-
-	// wrong version
-	bad := make([]byte, headerSize+ExchangeIDSize+OfferSize)
-	bad[0] = byte(MsgOffer)
-	bad[1] = ProtocolVersion + 1
-	_, _, err = Decode(bad)
-	require.Error(t, err)
-
-	// unknown type
-	bad2 := make([]byte, headerSize)
-	bad2[0] = 99
-	bad2[1] = ProtocolVersion
-	_, _, err = Decode(bad2)
-	require.Error(t, err)
-
-	// offer with wrong payload size
-	_, err = (&OfferMsg{KEMOffer: []byte{1, 2, 3}}).Encode()
-	require.Error(t, err)
-}

client/internal/pqkem_adapter.go

@@ -1,102 +0,0 @@
-package internal
-
-import (
-	"net/netip"
-
-	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/netbirdio/netbird/client/internal/pqkem"
-)
-
-// pqPresharedKeySetter is the subset of the WireGuard interface the ML-KEM callback
-// needs: programming a peer's preshared key. *iface.WGIface satisfies it.
-type pqPresharedKeySetter interface {
-	SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error
-}
-
-// pqCallbackHandler programs the derived PQ PSK onto the WireGuard peer. It is the
-// engine-side implementation of pqkem.CallbackHandler.
-type pqCallbackHandler struct {
-	wg pqPresharedKeySetter
-}
-
-// OnNewPSKReady programs the freshly derived PSK for the peer (updateOnly: a no-op
-// if the peer is not present, mirroring Rosenpass). remoteID is the peer's WG pubkey.
-func (h pqCallbackHandler) OnNewPSKReady(remoteID pqkem.RemoteID, psk pqkem.PSK) error {
-	// updateOnly: applies to an already-configured peer (rotation). At bootstrap the
-	// peer is not configured yet, so this is a no-op there and the PSK is instead
-	// pulled at peer-config time (pqHandshaker.PSK / conn.presharedKey).
-	log.Debugf("pqkem: programming PSK for peer %s", remoteID)
-	return h.wg.SetPresharedKey(string(remoteID), wgtypes.Key(psk), true)
-}
-
-// OnRekeyFailed reports a failed PQ (re)key convergence.
-// TODO(NET-1406): tear the peer connection down / trigger ICE reconnect.
-func (h pqCallbackHandler) OnRekeyFailed(remoteID pqkem.RemoteID) error {
-	log.Warnf("pqkem: post-quantum rekey failed for peer %s", remoteID)
-	return nil
-}
-
-// pqHandshaker adapts the pqkem manager to peer.PQHandshaker (string peer keys),
-// wiring the host's signalling offers/answers to the KEM exchange.
-type pqHandshaker struct {
-	mgr *pqkem.Manager
-}
-
-func (p pqHandshaker) OfferPayload(remoteKey string) ([]byte, int) {
-	payload, err := p.mgr.SignalOffer(pqkem.RemoteID(remoteKey))
-	if err != nil {
-		log.Warnf("pqkem: build offer for %s: %v", remoteKey, err)
-	}
-	return payload, p.mgr.LocalPort()
-}
-
-func (p pqHandshaker) AnswerPayload(remoteKey string, recvOffer []byte) ([]byte, int) {
-	if len(recvOffer) == 0 {
-		return nil, p.mgr.LocalPort()
-	}
-	payload, err := p.mgr.SignalOnOffer(pqkem.RemoteID(remoteKey), recvOffer)
-	if err != nil {
-		log.Warnf("pqkem: build answer for %s: %v", remoteKey, err)
-	}
-	return payload, p.mgr.LocalPort()
-}
-
-func (p pqHandshaker) OnAnswer(remoteKey string, recvAnswer []byte) {
-	if len(recvAnswer) == 0 {
-		return
-	}
-	if err := p.mgr.SignalOnAnswer(pqkem.RemoteID(remoteKey), recvAnswer); err != nil {
-		log.Warnf("pqkem: process answer from %s: %v", remoteKey, err)
-	}
-}
-
-// PSK exposes the peer's derived PSK for the conn to program at WG peer-config time.
-func (p pqHandshaker) PSK(remoteKey string) (wgtypes.Key, bool) {
-	psk, ok := p.mgr.PSK(pqkem.RemoteID(remoteKey))
-	if !ok {
-		return wgtypes.Key{}, false
-	}
-	return wgtypes.Key(psk), true
-}
-
-// SetRemoteAddr registers the peer's data-path endpoint (overlay IP + pq UDP port)
-// learned from signalling. Sends only ever fire once the tunnel is up (clocked by
-// OnDataPathRekeyed), so registering here is safe even before connection-up.
-func (p pqHandshaker) SetRemoteAddr(remoteKey string, addr netip.AddrPort) {
-	if !addr.IsValid() || addr.Port() == 0 {
-		return
-	}
-	p.mgr.AddPeer(pqkem.RemoteID(remoteKey), addr)
-}
-
-// OnDataPathRekeyed clocks the next chained PSK rotation on a fresh WG handshake.
-func (p pqHandshaker) OnDataPathRekeyed(remoteKey string) {
-	p.mgr.OnDataPathRekeyed(pqkem.RemoteID(remoteKey))
-}
-
-// OnDataPathDown signals the peer's tunnel went down.
-func (p pqHandshaker) OnDataPathDown(remoteKey string) {
-	p.mgr.OnDataPathDown(pqkem.RemoteID(remoteKey))
-}

client/internal/pqkem_transport.go

@@ -1,72 +0,0 @@
-package internal
-
-import (
-	"fmt"
-	"net"
-	"net/netip"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// DefaultPort is the preferred UDP port for the ML-KEM data-path service, bound on
-// the WG overlay IP. Since each client owns a distinct overlay IP, this port is
-// almost always free, so it need not be announced (peers assume it). A peer only
-// announces Body.mlkemPort when a collision forced it onto a different port.
-const DefaultPort = 51833
-
-// pqTransport is the ML-KEM data-path transport: a dumb UDP socket bound on the WG
-// overlay IP. It implements pqkem.Transport — the manager owns the remoteID<->endpoint
-// routing and drives this socket's lifecycle (Run / Close).
-type pqTransport struct {
-	conn *net.UDPConn
-	port int
-}
-
-// newPQTransport binds a UDP socket on the WG overlay IP, preferring DefaultPort and
-// falling back to an OS-assigned ephemeral port if it is in use. Call it after the WG
-// interface is up so the overlay IP is assigned; when the bound port is not
-// DefaultPort it must be announced to peers via Body.mlkemPort.
-func newPQTransport(overlayIP netip.Addr) (*pqTransport, error) {
-	if !overlayIP.IsValid() {
-		return nil, fmt.Errorf("invalid overlay IP for pqkem transport")
-	}
-	ip := net.IP(overlayIP.AsSlice())
-	conn, err := net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: DefaultPort})
-	if err != nil {
-		log.Debugf("pqkem: default port %d unavailable on %s (%v), using an ephemeral port", DefaultPort, overlayIP, err)
-		conn, err = net.ListenUDP("udp4", &net.UDPAddr{IP: ip, Port: 0})
-		if err != nil {
-			return nil, fmt.Errorf("bind pqkem udp on overlay %s: %w", overlayIP, err)
-		}
-	}
-	return &pqTransport{conn: conn, port: conn.LocalAddr().(*net.UDPAddr).Port}, nil
-}
-
-// Send implements pqkem.Transport.
-func (t *pqTransport) Send(endpoint netip.AddrPort, msg []byte) error {
-	_, err := t.conn.WriteToUDPAddrPort(msg, endpoint)
-	return err
-}
-
-// LocalPort implements pqkem.Transport.
-func (t *pqTransport) LocalPort() int { return t.port }
-
-// Run implements pqkem.Transport: the receive loop, delivering each datagram as
-// (source endpoint, msg). Exits when the socket is closed.
-func (t *pqTransport) Run(onInbound func(src netip.AddrPort, msg []byte)) {
-	go func() {
-		buf := make([]byte, 2048)
-		for {
-			n, src, err := t.conn.ReadFromUDPAddrPort(buf)
-			if err != nil {
-				return
-			}
-			msg := make([]byte, n)
-			copy(msg, buf[:n])
-			onInbound(src, msg)
-		}
-	}()
-}
-
-// Close implements pqkem.Transport.
-func (t *pqTransport) Close() error { return t.conn.Close() }

client/ios/NetBirdSDK/version.go

@@ -1,12 +0,0 @@
-//go:build ios
-
-package NetBirdSDK
-
-import "github.com/netbirdio/netbird/version"
-
-// GoClientVersion returns the NetBird Go client version that was baked into
-// the framework at compile time via
-// -ldflags "-X github.com/netbirdio/netbird/version.version=<version>".
-func GoClientVersion() string {
-	return version.NetbirdVersion()
-}

infrastructure_files/getting-started.sh

@@ -228,6 +228,8 @@ read_enable_crowdsec() {
   echo "CrowdSec checks client IPs against a community threat intelligence database" > /dev/stderr
   echo "and blocks known malicious sources before they reach your services." > /dev/stderr
   echo "A local CrowdSec LAPI container will be added to your deployment." > /dev/stderr
+  echo "It also enables the AppSec (WAF) endpoint, so services can inspect HTTP" > /dev/stderr
+  echo "requests for exploits. Both stay off per service until you enable them." > /dev/stderr
   echo -n "Enable CrowdSec? [y/N]: " > /dev/stderr
   read -r CHOICE < /dev/tty
 
@@ -497,7 +499,8 @@ generate_configuration_files() {
         # TCP ServersTransport for PROXY protocol v2 to the proxy backend
         render_traefik_dynamic > traefik-dynamic.yaml
         if [[ "$ENABLE_CROWDSEC" == "true" ]]; then
-          mkdir -p crowdsec
+          mkdir -p crowdsec/acquis.d
+          render_crowdsec_appsec_acquis > crowdsec/acquis.d/appsec.yaml
         fi
       fi
       ;;
@@ -531,6 +534,23 @@ generate_configuration_files() {
   return 0
 }
 
+# The AppSec (WAF) listener only exists if an appsec acquisition datasource is
+# configured. One datasource is one listener carrying one merged rule set: the
+# protocol has no rule-set selector, so per-service rule variation would need
+# either a second datasource on another port or pre_eval hooks filtering on
+# req.Host.
+render_crowdsec_appsec_acquis() {
+  cat <<EOF
+source: appsec
+listen_addr: 0.0.0.0:7422
+appsec_configs:
+  - crowdsecurity/appsec-default
+labels:
+  type: appsec
+EOF
+  return 0
+}
+
 start_services_and_show_instructions() {
   # For built-in Traefik, start containers immediately
   # For NPM, start containers first (NPM needs services running to create proxy)
@@ -742,7 +762,11 @@ render_docker_compose_traefik_builtin() {
     restart: unless-stopped
     networks: [netbird]
     environment:
-      COLLECTIONS: crowdsecurity/linux
+      # appsec-generic-rules is required alongside appsec-virtual-patching:
+      # the appsec-default config references crowdsecurity/generic-* and
+      # crowdsecurity/experimental-*, which only that collection provides, and
+      # the engine exits at startup if they are missing.
+      COLLECTIONS: crowdsecurity/linux crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules
     volumes:
       - ./crowdsec:/etc/crowdsec
       - crowdsec_db:/var/lib/crowdsec/data
@@ -1007,6 +1031,11 @@ EOF
     cat <<EOF
 NB_PROXY_CROWDSEC_API_URL=http://crowdsec:8080
 NB_PROXY_CROWDSEC_API_KEY=$CROWDSEC_BOUNCER_KEY
+# AppSec (WAF) request inspection. Separate endpoint from the LAPI above and
+# validated with the same bouncer key. Setting it makes the proxy advertise the
+# AppSec capability, which is what lets a service select appsec_mode; nothing is
+# inspected until a service opts in.
+NB_PROXY_CROWDSEC_APPSEC_URL=http://crowdsec:7422/
 EOF
   fi
 

management/internals/modules/reverseproxy/domain/domain.go

@@ -23,6 +23,9 @@ type Domain struct {
 	// SupportsCrowdSec is populated at query time from proxy cluster capabilities.
 	// Not persisted.
 	SupportsCrowdSec *bool `gorm:"-"`
+	// SupportsAppSec is populated at query time from proxy cluster capabilities.
+	// Not persisted.
+	SupportsAppSec *bool `gorm:"-"`
 	// SupportsPrivate is populated at query time from proxy cluster capabilities. Not persisted.
 	SupportsPrivate *bool `gorm:"-"`
 }

management/internals/modules/reverseproxy/domain/manager/api.go

@@ -49,6 +49,7 @@ func domainToApi(d *domain.Domain) api.ReverseProxyDomain {
 		SupportsCustomPorts: d.SupportsCustomPorts,
 		RequireSubdomain:    d.RequireSubdomain,
 		SupportsCrowdsec:    d.SupportsCrowdSec,
+		SupportsAppsec:      d.SupportsAppSec,
 		SupportsPrivate:     d.SupportsPrivate,
 	}
 	if d.TargetCluster != "" {

management/internals/modules/reverseproxy/domain/manager/manager.go

@@ -35,6 +35,7 @@ type proxyManager interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 }
 
@@ -94,6 +95,7 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 		d.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, cluster)
 		d.RequireSubdomain = m.proxyManager.ClusterRequireSubdomain(ctx, cluster)
 		d.SupportsCrowdSec = m.proxyManager.ClusterSupportsCrowdSec(ctx, cluster)
+		d.SupportsAppSec = m.proxyManager.ClusterSupportsAppSec(ctx, cluster)
 		d.SupportsPrivate = m.proxyManager.ClusterSupportsPrivate(ctx, cluster)
 		ret = append(ret, d)
 	}
@@ -111,6 +113,7 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 		if d.TargetCluster != "" {
 			cd.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, d.TargetCluster)
 			cd.SupportsCrowdSec = m.proxyManager.ClusterSupportsCrowdSec(ctx, d.TargetCluster)
+			cd.SupportsAppSec = m.proxyManager.ClusterSupportsAppSec(ctx, d.TargetCluster)
 			cd.SupportsPrivate = m.proxyManager.ClusterSupportsPrivate(ctx, d.TargetCluster)
 		}
 		// Custom domains never require a subdomain by default since

management/internals/modules/reverseproxy/domain/manager/manager_test.go

@@ -40,6 +40,10 @@ func (m *mockProxyManager) ClusterSupportsCrowdSec(_ context.Context, _ string)
 	return nil
 }
 
+func (m *mockProxyManager) ClusterSupportsAppSec(_ context.Context, _ string) *bool {
+	return nil
+}
+
 func (m *mockProxyManager) ClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }

management/internals/modules/reverseproxy/proxy/manager.go

@@ -19,6 +19,7 @@ type Manager interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStale(ctx context.Context, inactivityDuration time.Duration) error
 	GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error)

management/internals/modules/reverseproxy/proxy/manager/manager.go

@@ -21,6 +21,7 @@ type store interface {
 	GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetProxyByAccountID(ctx context.Context, accountID string) (*proxy.Proxy, error)
@@ -138,6 +139,13 @@ func (m Manager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string
 	return m.store.GetClusterSupportsCrowdSec(ctx, clusterAddr)
 }
 
+// ClusterSupportsAppSec returns whether all active proxies in the cluster have
+// a CrowdSec AppSec endpoint configured (unanimous). Returns nil when no proxy
+// has reported capabilities.
+func (m Manager) ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	return m.store.GetClusterSupportsAppSec(ctx, clusterAddr)
+}
+
 // ClusterSupportsPrivate reports whether any active proxy claims the private capability (nil = unreported).
 func (m Manager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
 	return m.store.GetClusterSupportsPrivate(ctx, clusterAddr)

management/internals/modules/reverseproxy/proxy/manager/manager_test.go

@@ -99,6 +99,9 @@ func (m *mockStore) GetClusterRequireSubdomain(_ context.Context, _ string) *boo
 func (m *mockStore) GetClusterSupportsCrowdSec(_ context.Context, _ string) *bool {
 	return nil
 }
+func (m *mockStore) GetClusterSupportsAppSec(_ context.Context, _ string) *bool {
+	return nil
+}
 func (m *mockStore) GetClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }

management/internals/modules/reverseproxy/proxy/manager_mock.go

@@ -50,20 +50,6 @@ func (mr *MockManagerMockRecorder) CleanupStale(ctx, inactivityDuration interfac
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupStale", reflect.TypeOf((*MockManager)(nil).CleanupStale), ctx, inactivityDuration)
 }
 
-// ClusterSupportsCustomPorts mocks base method.
-func (m *MockManager) ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ClusterSupportsCustomPorts", ctx, clusterAddr)
-	ret0, _ := ret[0].(*bool)
-	return ret0
-}
-
-// ClusterSupportsCustomPorts indicates an expected call of ClusterSupportsCustomPorts.
-func (mr *MockManagerMockRecorder) ClusterSupportsCustomPorts(ctx, clusterAddr interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCustomPorts", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCustomPorts), ctx, clusterAddr)
-}
-
 // ClusterRequireSubdomain mocks base method.
 func (m *MockManager) ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -78,6 +64,20 @@ func (mr *MockManagerMockRecorder) ClusterRequireSubdomain(ctx, clusterAddr inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterRequireSubdomain", reflect.TypeOf((*MockManager)(nil).ClusterRequireSubdomain), ctx, clusterAddr)
 }
 
+// ClusterSupportsAppSec mocks base method.
+func (m *MockManager) ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ClusterSupportsAppSec", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// ClusterSupportsAppSec indicates an expected call of ClusterSupportsAppSec.
+func (mr *MockManagerMockRecorder) ClusterSupportsAppSec(ctx, clusterAddr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsAppSec", reflect.TypeOf((*MockManager)(nil).ClusterSupportsAppSec), ctx, clusterAddr)
+}
+
 // ClusterSupportsCrowdSec mocks base method.
 func (m *MockManager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -92,6 +92,20 @@ func (mr *MockManagerMockRecorder) ClusterSupportsCrowdSec(ctx, clusterAddr inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCrowdSec", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCrowdSec), ctx, clusterAddr)
 }
 
+// ClusterSupportsCustomPorts mocks base method.
+func (m *MockManager) ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ClusterSupportsCustomPorts", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// ClusterSupportsCustomPorts indicates an expected call of ClusterSupportsCustomPorts.
+func (mr *MockManagerMockRecorder) ClusterSupportsCustomPorts(ctx, clusterAddr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCustomPorts", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCustomPorts), ctx, clusterAddr)
+}
+
 // ClusterSupportsPrivate mocks base method.
 func (m *MockManager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -121,6 +135,35 @@ func (mr *MockManagerMockRecorder) Connect(ctx, proxyID, sessionID, clusterAddre
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Connect", reflect.TypeOf((*MockManager)(nil).Connect), ctx, proxyID, sessionID, clusterAddress, ipAddress, accountID, capabilities)
 }
 
+// CountAccountProxies mocks base method.
+func (m *MockManager) CountAccountProxies(ctx context.Context, accountID string) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CountAccountProxies", ctx, accountID)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CountAccountProxies indicates an expected call of CountAccountProxies.
+func (mr *MockManagerMockRecorder) CountAccountProxies(ctx, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountProxies", reflect.TypeOf((*MockManager)(nil).CountAccountProxies), ctx, accountID)
+}
+
+// DeleteAccountCluster mocks base method.
+func (m *MockManager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAccountCluster", ctx, clusterAddress, accountID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
+func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
+}
+
 // Disconnect mocks base method.
 func (m *MockManager) Disconnect(ctx context.Context, proxyID, sessionID string) error {
 	m.ctrl.T.Helper()
@@ -135,6 +178,21 @@ func (mr *MockManagerMockRecorder) Disconnect(ctx, proxyID, sessionID interface{
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Disconnect", reflect.TypeOf((*MockManager)(nil).Disconnect), ctx, proxyID, sessionID)
 }
 
+// GetAccountProxy mocks base method.
+func (m *MockManager) GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountProxy", ctx, accountID)
+	ret0, _ := ret[0].(*Proxy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountProxy indicates an expected call of GetAccountProxy.
+func (mr *MockManagerMockRecorder) GetAccountProxy(ctx, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountProxy", reflect.TypeOf((*MockManager)(nil).GetAccountProxy), ctx, accountID)
+}
+
 // GetActiveClusterAddresses mocks base method.
 func (m *MockManager) GetActiveClusterAddresses(ctx context.Context) ([]string, error) {
 	m.ctrl.T.Helper()
@@ -150,6 +208,7 @@ func (mr *MockManagerMockRecorder) GetActiveClusterAddresses(ctx interface{}) *g
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveClusterAddresses", reflect.TypeOf((*MockManager)(nil).GetActiveClusterAddresses), ctx)
 }
 
+// GetActiveClusterAddressesForAccount mocks base method.
 func (m *MockManager) GetActiveClusterAddressesForAccount(ctx context.Context, accountID string) ([]string, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetActiveClusterAddressesForAccount", ctx, accountID)
@@ -158,6 +217,7 @@ func (m *MockManager) GetActiveClusterAddressesForAccount(ctx context.Context, a
 	return ret0, ret1
 }
 
+// GetActiveClusterAddressesForAccount indicates an expected call of GetActiveClusterAddressesForAccount.
 func (mr *MockManagerMockRecorder) GetActiveClusterAddressesForAccount(ctx, accountID interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveClusterAddressesForAccount", reflect.TypeOf((*MockManager)(nil).GetActiveClusterAddressesForAccount), ctx, accountID)
@@ -177,36 +237,6 @@ func (mr *MockManagerMockRecorder) Heartbeat(ctx, p interface{}) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Heartbeat", reflect.TypeOf((*MockManager)(nil).Heartbeat), ctx, p)
 }
 
-// GetAccountProxy mocks base method.
-func (m *MockManager) GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountProxy", ctx, accountID)
-	ret0, _ := ret[0].(*Proxy)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountProxy indicates an expected call of GetAccountProxy.
-func (mr *MockManagerMockRecorder) GetAccountProxy(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountProxy", reflect.TypeOf((*MockManager)(nil).GetAccountProxy), ctx, accountID)
-}
-
-// CountAccountProxies mocks base method.
-func (m *MockManager) CountAccountProxies(ctx context.Context, accountID string) (int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CountAccountProxies", ctx, accountID)
-	ret0, _ := ret[0].(int64)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// CountAccountProxies indicates an expected call of CountAccountProxies.
-func (mr *MockManagerMockRecorder) CountAccountProxies(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountProxies", reflect.TypeOf((*MockManager)(nil).CountAccountProxies), ctx, accountID)
-}
-
 // IsClusterAddressAvailable mocks base method.
 func (m *MockManager) IsClusterAddressAvailable(ctx context.Context, clusterAddress, accountID string) (bool, error) {
 	m.ctrl.T.Helper()
@@ -222,20 +252,6 @@ func (mr *MockManagerMockRecorder) IsClusterAddressAvailable(ctx, clusterAddress
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsClusterAddressAvailable", reflect.TypeOf((*MockManager)(nil).IsClusterAddressAvailable), ctx, clusterAddress, accountID)
 }
 
-// DeleteAccountCluster mocks base method.
-func (m *MockManager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAccountCluster", ctx, clusterAddress, accountID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
-func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
-}
-
 // MockController is a mock of Controller interface.
 type MockController struct {
 	ctrl     *gomock.Controller

management/internals/modules/reverseproxy/proxy/proxy.go

@@ -20,6 +20,9 @@ type Capabilities struct {
 	RequireSubdomain *bool
 	// SupportsCrowdsec indicates whether this proxy has CrowdSec configured.
 	SupportsCrowdsec *bool
+	// SupportsAppsec indicates whether this proxy has a CrowdSec AppSec (WAF)
+	// endpoint configured.
+	SupportsAppsec *bool
 	// Private indicates whether this proxy supports inbound access via Wireguard
 	// tunnel and netbird-only authentication policies
 	Private *bool
@@ -74,5 +77,6 @@ type Cluster struct {
 	SupportsCustomPorts *bool
 	RequireSubdomain    *bool
 	SupportsCrowdSec    *bool
+	SupportsAppSec      *bool
 	Private             *bool
 }

management/internals/modules/reverseproxy/service/manager/api.go

@@ -204,6 +204,7 @@ func (h *handler) getClusters(w http.ResponseWriter, r *http.Request) {
 			SupportsCustomPorts: c.SupportsCustomPorts,
 			RequireSubdomain:    c.RequireSubdomain,
 			SupportsCrowdsec:    c.SupportsCrowdSec,
+			SupportsAppsec:      c.SupportsAppSec,
 			Private:             c.Private,
 		})
 	}

management/internals/modules/reverseproxy/service/manager/manager.go

@@ -82,6 +82,7 @@ type CapabilityProvider interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 }
 
@@ -137,6 +138,7 @@ func (m *Manager) GetClusters(ctx context.Context, accountID, userID string) ([]
 		clusters[i].SupportsCustomPorts = m.capabilities.ClusterSupportsCustomPorts(ctx, clusters[i].Address)
 		clusters[i].RequireSubdomain = m.capabilities.ClusterRequireSubdomain(ctx, clusters[i].Address)
 		clusters[i].SupportsCrowdSec = m.capabilities.ClusterSupportsCrowdSec(ctx, clusters[i].Address)
+		clusters[i].SupportsAppSec = m.capabilities.ClusterSupportsAppSec(ctx, clusters[i].Address)
 		clusters[i].Private = m.capabilities.ClusterSupportsPrivate(ctx, clusters[i].Address)
 	}
 

management/internals/modules/reverseproxy/service/service.go

@@ -165,6 +165,18 @@ type AccessRestrictions struct {
 	AllowedCountries []string `json:"allowed_countries,omitempty" gorm:"serializer:json"`
 	BlockedCountries []string `json:"blocked_countries,omitempty" gorm:"serializer:json"`
 	CrowdSecMode     string   `json:"crowdsec_mode,omitempty" gorm:"serializer:json"`
+	// AppSecMode is the CrowdSec AppSec (WAF) request inspection mode: "",
+	// "off", "enforce", or "observe". HTTP services only.
+	AppSecMode string `json:"appsec_mode,omitempty" gorm:"serializer:json"`
+}
+
+// isEmpty reports whether no restriction is configured. Both conversions drop
+// the object entirely in that case, so a field missing from this check is
+// silently discarded on the way to the API and the proxy.
+func (r AccessRestrictions) isEmpty() bool {
+	return len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
+		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
+		r.CrowdSecMode == "" && r.AppSecMode == ""
 }
 
 // Copy returns a deep copy of the AccessRestrictions.
@@ -175,6 +187,7 @@ func (r AccessRestrictions) Copy() AccessRestrictions {
 		AllowedCountries: slices.Clone(r.AllowedCountries),
 		BlockedCountries: slices.Clone(r.BlockedCountries),
 		CrowdSecMode:     r.CrowdSecMode,
+		AppSecMode:       r.AppSecMode,
 	}
 }
 
@@ -808,13 +821,17 @@ func restrictionsFromAPI(r *api.AccessRestrictions) (AccessRestrictions, error)
 		}
 		res.CrowdSecMode = string(*r.CrowdsecMode)
 	}
+	if r.AppsecMode != nil {
+		if !r.AppsecMode.Valid() {
+			return AccessRestrictions{}, fmt.Errorf("invalid appsec_mode %q", *r.AppsecMode)
+		}
+		res.AppSecMode = string(*r.AppsecMode)
+	}
 	return res, nil
 }
 
 func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
-	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
-		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" {
+	if r.isEmpty() {
 		return nil
 	}
 	res := &api.AccessRestrictions{}
@@ -834,13 +851,15 @@ func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
 		mode := api.AccessRestrictionsCrowdsecMode(r.CrowdSecMode)
 		res.CrowdsecMode = &mode
 	}
+	if r.AppSecMode != "" {
+		mode := api.AccessRestrictionsAppsecMode(r.AppSecMode)
+		res.AppsecMode = &mode
+	}
 	return res
 }
 
 func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
-	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
-		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" {
+	if r.isEmpty() {
 		return nil
 	}
 	return &proto.AccessRestrictions{
@@ -849,6 +868,7 @@ func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
 		AllowedCountries: r.AllowedCountries,
 		BlockedCountries: r.BlockedCountries,
 		CrowdsecMode:     r.CrowdSecMode,
+		AppsecMode:       r.AppSecMode,
 	}
 }
 
@@ -874,6 +894,11 @@ func (s *Service) Validate() error {
 	if err := validateAccessRestrictions(&s.Restrictions); err != nil {
 		return err
 	}
+	// AppSec inspects HTTP requests, so it cannot apply to the L4 modes, which
+	// forward opaque byte streams.
+	if appSecEnabled(s.Restrictions.AppSecMode) && s.Mode != ModeHTTP {
+		return fmt.Errorf("appsec_mode is only supported for HTTP services, got mode %q", s.Mode)
+	}
 	if err := s.validatePrivateRequirements(); err != nil {
 		return err
 	}
@@ -1242,10 +1267,27 @@ func validateCrowdSecMode(mode string) error {
 	}
 }
 
+func validateAppSecMode(mode string) error {
+	switch mode {
+	case "", "off", "enforce", "observe":
+		return nil
+	default:
+		return fmt.Errorf("appsec_mode %q is invalid", mode)
+	}
+}
+
+// appSecEnabled reports whether the mode asks for request inspection.
+func appSecEnabled(mode string) bool {
+	return mode == "enforce" || mode == "observe"
+}
+
 func validateAccessRestrictions(r *AccessRestrictions) error {
 	if err := validateCrowdSecMode(r.CrowdSecMode); err != nil {
 		return err
 	}
+	if err := validateAppSecMode(r.AppSecMode); err != nil {
+		return err
+	}
 
 	if len(r.AllowedCIDRs) > maxCIDREntries {
 		return fmt.Errorf("allowed_cidrs: exceeds maximum of %d entries", maxCIDREntries)

management/internals/modules/reverseproxy/service/service_test.go

@@ -26,6 +26,17 @@ func validProxy() *Service {
 	}
 }
 
+// validL4Proxy returns a service that passes validation in one of the L4 modes.
+func validL4Proxy(mode string) *Service {
+	rp := validProxy()
+	rp.Mode = mode
+	rp.ListenPort = 9000
+	rp.Targets = []*Target{
+		{TargetId: "peer-1", TargetType: TargetTypePeer, Host: "10.0.0.1", Port: 5432, Protocol: mode, Enabled: true},
+	}
+	return rp
+}
+
 func TestValidate_Valid(t *testing.T) {
 	require.NoError(t, validProxy().Validate())
 }
@@ -1315,3 +1326,68 @@ func TestValidate_Private_RejectsNonHTTPMode(t *testing.T) {
 	}}
 	assert.ErrorContains(t, rp.Validate(), "HTTP")
 }
+
+func TestRestrictions_AppSecMode_RoundTrip(t *testing.T) {
+	mode := api.AccessRestrictionsAppsecModeEnforce
+	apiIn := &api.AccessRestrictions{AppsecMode: &mode}
+
+	model, err := restrictionsFromAPI(apiIn)
+	require.NoError(t, err)
+	assert.Equal(t, "enforce", model.AppSecMode)
+
+	// appsec_mode alone must keep the restrictions object alive on both the API
+	// and proto legs: it is meaningful without any CIDR or country entry.
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut, "appsec_mode alone must not collapse the restrictions to nil")
+	require.NotNil(t, apiOut.AppsecMode)
+	assert.Equal(t, api.AccessRestrictionsAppsecModeEnforce, *apiOut.AppsecMode)
+
+	protoOut := restrictionsToProto(model)
+	require.NotNil(t, protoOut, "appsec_mode alone must reach the proxy")
+	assert.Equal(t, "enforce", protoOut.AppsecMode)
+}
+
+func TestRestrictions_AppSecMode_EmptyIsOmitted(t *testing.T) {
+	model, err := restrictionsFromAPI(&api.AccessRestrictions{
+		AllowedCidrs: &[]string{"203.0.113.0/24"},
+	})
+	require.NoError(t, err)
+	assert.Empty(t, model.AppSecMode)
+
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut)
+	assert.Nil(t, apiOut.AppsecMode, "empty appsec_mode is omitted from the API response")
+}
+
+func TestRestrictions_AppSecMode_CopyIsDeep(t *testing.T) {
+	original := AccessRestrictions{AppSecMode: "observe", CrowdSecMode: "enforce"}
+	assert.Equal(t, original, original.Copy(), "Copy must carry every mode field")
+}
+
+func TestValidate_RejectsInvalidAppSecMode(t *testing.T) {
+	rp := validProxy()
+	rp.Restrictions = AccessRestrictions{AppSecMode: "sometimes"}
+	assert.ErrorContains(t, rp.Validate(), "appsec_mode")
+}
+
+func TestValidate_RejectsAppSecOnL4Modes(t *testing.T) {
+	// AppSec inspects HTTP requests, so the L4 modes cannot honor it. Accepting
+	// the field there would report protection that never runs.
+	for _, mode := range []string{ModeTCP, ModeUDP, ModeTLS} {
+		t.Run(mode, func(t *testing.T) {
+			rp := validL4Proxy(mode)
+			rp.Restrictions = AccessRestrictions{AppSecMode: "enforce"}
+			assert.ErrorContains(t, rp.Validate(), "appsec_mode is only supported for HTTP services")
+		})
+	}
+}
+
+func TestValidate_AllowsAppSecOffOnL4Modes(t *testing.T) {
+	for _, mode := range []string{ModeTCP, ModeUDP, ModeTLS} {
+		t.Run(mode, func(t *testing.T) {
+			rp := validL4Proxy(mode)
+			rp.Restrictions = AccessRestrictions{AppSecMode: "off"}
+			require.NoError(t, rp.Validate(), "an explicit off must not be rejected on L4 services")
+		})
+	}
+}

management/internals/shared/grpc/proxy.go

@@ -29,6 +29,7 @@ import (
 
 	"github.com/netbirdio/netbird/shared/management/domain"
 
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
@@ -36,7 +37,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/management/server/users"
 	proxyauth "github.com/netbirdio/netbird/proxy/auth"
@@ -505,6 +505,7 @@ func (s *ProxyServiceServer) registerProxyConnection(ctx context.Context, params
 			SupportsCustomPorts: c.SupportsCustomPorts,
 			RequireSubdomain:    c.RequireSubdomain,
 			SupportsCrowdsec:    c.SupportsCrowdsec,
+			SupportsAppsec:      c.SupportsAppsec,
 			Private:             c.Private,
 		}
 	}

management/server/store/sql_store.go

@@ -2259,7 +2259,7 @@ func (s *SqlStore) getPostureChecks(ctx context.Context, accountID string) ([]*p
 }
 
 func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpservice.Service, error) {
-	const serviceQuery = `SELECT id, account_id, name, domain, enabled, auth,
+	const serviceQuery = `SELECT id, account_id, name, domain, enabled, auth, restrictions,
 		meta_created_at, meta_certificate_issued_at, meta_status, proxy_cluster,
 		pass_host_header, rewrite_redirects, session_private_key, session_public_key,
 		mode, listen_port, port_auto_assigned, source, source_peer, terminated,
@@ -2278,6 +2278,7 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 	services, err := pgx.CollectRows(serviceRows, func(row pgx.CollectableRow) (*rpservice.Service, error) {
 		var s rpservice.Service
 		var auth []byte
+		var restrictions []byte
 		var accessGroups []byte
 		var createdAt, certIssuedAt sql.NullTime
 		var status, proxyCluster, sessionPrivateKey, sessionPublicKey sql.NullString
@@ -2291,6 +2292,7 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 			&s.Domain,
 			&s.Enabled,
 			&auth,
+			&restrictions,
 			&createdAt,
 			&certIssuedAt,
 			&status,
@@ -2318,6 +2320,12 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 			}
 		}
 
+		if len(restrictions) > 0 {
+			if err := json.Unmarshal(restrictions, &s.Restrictions); err != nil {
+				return nil, fmt.Errorf("unmarshal restrictions: %w", err)
+			}
+		}
+
 		if len(accessGroups) > 0 {
 			if err := json.Unmarshal(accessGroups, &s.AccessGroups); err != nil {
 				return nil, fmt.Errorf("unmarshal access_groups: %w", err)
@@ -6357,6 +6365,7 @@ var validCapabilityColumns = map[string]struct{}{
 	"supports_custom_ports": {},
 	"require_subdomain":     {},
 	"supports_crowdsec":     {},
+	"supports_appsec":       {},
 	"private":               {},
 }
 
@@ -6387,6 +6396,14 @@ func (s *SqlStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr s
 	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_crowdsec")
 }
 
+// GetClusterSupportsAppSec returns whether all active proxies in the cluster
+// have a CrowdSec AppSec endpoint configured. Returns nil when no proxy
+// reported the capability. Unanimous for the same reason as CrowdSec: a single
+// proxy without AppSec would let requests through uninspected.
+func (s *SqlStore) GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_appsec")
+}
+
 // getClusterUnanimousCapability returns an aggregated boolean capability
 // requiring all active proxies in the cluster to report true.
 func (s *SqlStore) getClusterUnanimousCapability(ctx context.Context, clusterAddr, column string) *bool {

management/server/store/sql_store_proxy_capability_test.go

@@ -0,0 +1,119 @@
+package store
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+)
+
+// Capabilities travel proxy → gRPC → embedded gorm columns → aggregation → API.
+// A field dropped at any of those hops reads as "capability absent", which is
+// indistinguishable from a proxy that never reported it: the dashboard simply
+// hides the feature and nothing fails. These assertions cover the persistence
+// and aggregation hops.
+func TestSqlStore_ClusterCapabilityAggregation(t *testing.T) {
+	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	yes, no := true, false
+
+	tests := []struct {
+		name          string
+		reported      []*bool // one entry per connected proxy in the cluster
+		wantAppSec    *bool
+		wantAssertion string
+	}{
+		{
+			name:          "unreported stays unknown",
+			reported:      []*bool{nil},
+			wantAppSec:    nil,
+			wantAssertion: "an unreported capability must not read as false",
+		},
+		{
+			name:          "single proxy reporting true",
+			reported:      []*bool{&yes},
+			wantAppSec:    &yes,
+			wantAssertion: "a reported capability must survive persistence",
+		},
+		{
+			name:          "one proxy without it disables the cluster",
+			reported:      []*bool{&yes, &no},
+			wantAppSec:    &no,
+			wantAssertion: "capability must be unanimous, so a rolling upgrade cannot leave traffic uninspected",
+		},
+		{
+			name:          "one proxy yet to report disables the cluster",
+			reported:      []*bool{&yes, nil},
+			wantAppSec:    &no,
+			wantAssertion: "a proxy that has not reported must not count as capable",
+		},
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		for i, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				cluster := fmt.Sprintf("cluster-%d.proxy.example", i)
+				for j, reported := range tt.reported {
+					require.NoError(t, store.SaveProxy(ctx, &proxy.Proxy{
+						ID:             fmt.Sprintf("proxy-%d-%d", i, j),
+						ClusterAddress: cluster,
+						Status:         proxy.StatusConnected,
+						LastSeen:       time.Now(),
+						Capabilities:   proxy.Capabilities{SupportsAppsec: reported},
+					}))
+				}
+
+				got := store.GetClusterSupportsAppSec(ctx, cluster)
+				if tt.wantAppSec == nil {
+					assert.Nil(t, got, tt.wantAssertion)
+					return
+				}
+				require.NotNil(t, got, tt.wantAssertion)
+				assert.Equal(t, *tt.wantAppSec, *got, tt.wantAssertion)
+			})
+		}
+	})
+}
+
+// AppSec and IP reputation are separate endpoints, so a cluster can have either
+// without the other. Gating one on the other would silently disable a feature
+// the operator configured.
+func TestSqlStore_ClusterCapabilitiesAreIndependent(t *testing.T) {
+	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		const cluster = "independent.proxy.example"
+		yes, no := true, false
+
+		require.NoError(t, store.SaveProxy(ctx, &proxy.Proxy{
+			ID:             "proxy-independent",
+			ClusterAddress: cluster,
+			Status:         proxy.StatusConnected,
+			LastSeen:       time.Now(),
+			Capabilities: proxy.Capabilities{
+				SupportsAppsec:   &yes,
+				SupportsCrowdsec: &no,
+			},
+		}))
+
+		appsec := store.GetClusterSupportsAppSec(ctx, cluster)
+		crowdsec := store.GetClusterSupportsCrowdSec(ctx, cluster)
+		require.NotNil(t, appsec)
+		require.NotNil(t, crowdsec)
+		assert.True(t, *appsec, "AppSec must not be gated on CrowdSec")
+		assert.False(t, *crowdsec, "CrowdSec must not be implied by AppSec")
+	})
+}

management/server/store/sql_store_service_test.go

@@ -44,3 +44,42 @@ func TestSqlStore_GetAccount_PrivateServiceRoundtrip(t *testing.T) {
 		assert.Equal(t, []string{"grp-admins", "grp-ops"}, got.AccessGroups)
 	})
 }
+
+// Restrictions are stored as a JSON blob, and the Postgres read path lists
+// columns by hand: a mode that is not read there is silently off on Postgres
+// while working in SQLite dev.
+func TestSqlStore_GetAccount_ServiceRestrictionsRoundtrip(t *testing.T) {
+	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		account := newAccountWithId(ctx, "account_svc_restrictions", "testuser", "")
+		require.NoError(t, store.SaveAccount(ctx, account))
+
+		svc := &rpservice.Service{
+			ID:        "svc-restrictions",
+			AccountID: account.Id,
+			Name:      "restricted-svc",
+			Domain:    "restricted.example",
+			Enabled:   true,
+			Mode:      rpservice.ModeHTTP,
+			Restrictions: rpservice.AccessRestrictions{
+				AllowedCIDRs: []string{"203.0.113.0/24"},
+				CrowdSecMode: "observe",
+				AppSecMode:   "enforce",
+			},
+		}
+		require.NoError(t, store.CreateService(ctx, svc))
+
+		loaded, err := store.GetAccount(ctx, account.Id)
+		require.NoError(t, err)
+		require.Len(t, loaded.Services, 1)
+
+		got := loaded.Services[0].Restrictions
+		assert.Equal(t, []string{"203.0.113.0/24"}, got.AllowedCIDRs)
+		assert.Equal(t, "observe", got.CrowdSecMode)
+		assert.Equal(t, "enforce", got.AppSecMode)
+	})
+}

management/server/store/store.go

@@ -321,6 +321,7 @@ type Store interface {
 	GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetAllProxies(ctx context.Context) ([]*proxy.Proxy, error)

management/server/store/store_mock.go

@@ -1835,6 +1835,20 @@ func (mr *MockStoreMockRecorder) GetClusterRequireSubdomain(ctx, clusterAddr int
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterRequireSubdomain", reflect.TypeOf((*MockStore)(nil).GetClusterRequireSubdomain), ctx, clusterAddr)
 }
 
+// GetClusterSupportsAppSec mocks base method.
+func (m *MockStore) GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetClusterSupportsAppSec", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// GetClusterSupportsAppSec indicates an expected call of GetClusterSupportsAppSec.
+func (mr *MockStoreMockRecorder) GetClusterSupportsAppSec(ctx, clusterAddr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterSupportsAppSec", reflect.TypeOf((*MockStore)(nil).GetClusterSupportsAppSec), ctx, clusterAddr)
+}
+
 // GetClusterSupportsCrowdSec mocks base method.
 func (m *MockStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()

proxy/cmd/proxy/cmd/root.go

@@ -79,6 +79,11 @@ var (
 	geoDataDir            string
 	crowdsecAPIURL        string
 	crowdsecAPIKey        string
+	appsecURL             string
+	appsecTimeout         time.Duration
+	appsecMaxBodyBytes    int64
+	captureBudgetBytes    int64
+	appsecMaxConcurrent   int
 )
 
 var rootCmd = &cobra.Command{
@@ -125,6 +130,11 @@ func init() {
 	rootCmd.Flags().StringVar(&geoDataDir, "geo-data-dir", envStringOrDefault("NB_PROXY_GEO_DATA_DIR", "/var/lib/netbird/geolocation"), "Directory for the GeoLite2 MMDB file (auto-downloaded if missing)")
 	rootCmd.Flags().StringVar(&crowdsecAPIURL, "crowdsec-api-url", envStringOrDefault("NB_PROXY_CROWDSEC_API_URL", ""), "CrowdSec LAPI URL for IP reputation checks")
 	rootCmd.Flags().StringVar(&crowdsecAPIKey, "crowdsec-api-key", envStringOrDefault("NB_PROXY_CROWDSEC_API_KEY", ""), "CrowdSec bouncer API key")
+	rootCmd.Flags().StringVar(&appsecURL, "crowdsec-appsec-url", envStringOrDefault("NB_PROXY_CROWDSEC_APPSEC_URL", ""), "CrowdSec AppSec (WAF) endpoint for HTTP request inspection, e.g. http://127.0.0.1:7422/ (reuses the bouncer API key)")
+	rootCmd.Flags().DurationVar(&appsecTimeout, "crowdsec-appsec-timeout", envDurationOrDefault("NB_PROXY_CROWDSEC_APPSEC_TIMEOUT", 0), "Timeout for a single AppSec inspection call (0 = 200ms)")
+	rootCmd.Flags().IntVar(&appsecMaxConcurrent, "crowdsec-appsec-max-concurrent", int(envInt64OrDefault("NB_PROXY_CROWDSEC_APPSEC_MAX_CONCURRENT", 0)), "Cap on AppSec inspections in flight; further requests are denied in enforce mode rather than queued (0 = 256, negative = no cap)")
+	rootCmd.Flags().Int64Var(&captureBudgetBytes, "capture-budget-bytes", envInt64OrDefault("NB_PROXY_CAPTURE_BUDGET_BYTES", 0), "Total in-flight request-body buffering across the proxy, shared by AppSec inspection and agent-network capture (0 = 256MiB)")
+	rootCmd.Flags().Int64Var(&appsecMaxBodyBytes, "crowdsec-appsec-max-body-bytes", envInt64OrDefault("NB_PROXY_CROWDSEC_APPSEC_MAX_BODY_BYTES", 0), "Cap on the request body mirrored to AppSec (0 = 64KiB, negative = headers and URI only)")
 }
 
 // Execute runs the root command.
@@ -218,47 +228,59 @@ func runServer(cmd *cobra.Command, args []string) error {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
 	defer stop()
 
-	srv := proxy.New(ctx, proxy.Config{
-		ListenAddr:               addr,
-		Logger:                   logger,
-		Version:                  Version,
-		ManagementAddress:        mgmtAddr,
-		ProxyURL:                 proxyDomain,
-		ProxyToken:               proxyToken,
-		CertificateDirectory:     certDir,
-		CertificateFile:          certFile,
-		CertificateKeyFile:       certKeyFile,
-		GenerateACMECertificates: acmeCerts,
-		ACMEChallengeAddress:     acmeAddr,
-		ACMEDirectory:            acmeDir,
-		ACMEEABKID:               acmeEABKID,
-		ACMEEABHMACKey:           acmeEABHMACKey,
-		ACMEChallengeType:        acmeChallengeType,
-		DebugEndpointEnabled:     debugEndpoint,
-		DebugEndpointAddress:     debugEndpointAddr,
-		HealthAddr:               healthAddr,
-		ForwardedProto:           forwardedProto,
-		TrustedProxies:           parsedTrustedProxies,
-		CertLockMethod:           nbacme.CertLockMethod(certLockMethod),
-		WildcardCertDir:          wildcardCertDir,
-		WireguardPort:            wgPort,
-		Performance:              perf,
-		ProxyProtocol:            proxyProtocol,
-		PreSharedKey:             preSharedKey,
-		SupportsCustomPorts:      supportsCustomPorts,
-		RequireSubdomain:         requireSubdomain,
-		Private:                  private,
-		MaxDialTimeout:           maxDialTimeout,
-		MaxSessionIdleTimeout:    maxSessionIdleTimeout,
-		MappingBatchWatchdog:     envDurationOrDefault("NB_PROXY_MAPPING_BATCH_WATCHDOG", 0),
-		GeoDataDir:               geoDataDir,
-		CrowdSecAPIURL:           crowdsecAPIURL,
-		CrowdSecAPIKey:           crowdsecAPIKey,
-	})
+	srv := proxy.New(ctx, serverConfig(logger, proxyToken, parsedTrustedProxies, perf))
 
 	return srv.ListenAndServe(ctx, addr)
 }
 
+// serverConfig maps the parsed flags and environment onto the proxy config.
+// Kept separate from runServer so registering a new flag does not grow the
+// startup path.
+func serverConfig(logger *log.Logger, proxyToken string, trustedProxyList *trustedproxy.List, perf embed.Performance) proxy.Config {
+	return proxy.Config{
+		ListenAddr:                   addr,
+		Logger:                       logger,
+		Version:                      Version,
+		ManagementAddress:            mgmtAddr,
+		ProxyURL:                     proxyDomain,
+		ProxyToken:                   proxyToken,
+		CertificateDirectory:         certDir,
+		CertificateFile:              certFile,
+		CertificateKeyFile:           certKeyFile,
+		GenerateACMECertificates:     acmeCerts,
+		ACMEChallengeAddress:         acmeAddr,
+		ACMEDirectory:                acmeDir,
+		ACMEEABKID:                   acmeEABKID,
+		ACMEEABHMACKey:               acmeEABHMACKey,
+		ACMEChallengeType:            acmeChallengeType,
+		DebugEndpointEnabled:         debugEndpoint,
+		DebugEndpointAddress:         debugEndpointAddr,
+		HealthAddr:                   healthAddr,
+		ForwardedProto:               forwardedProto,
+		TrustedProxies:               trustedProxyList,
+		CertLockMethod:               nbacme.CertLockMethod(certLockMethod),
+		WildcardCertDir:              wildcardCertDir,
+		WireguardPort:                wgPort,
+		Performance:                  perf,
+		ProxyProtocol:                proxyProtocol,
+		PreSharedKey:                 preSharedKey,
+		SupportsCustomPorts:          supportsCustomPorts,
+		RequireSubdomain:             requireSubdomain,
+		Private:                      private,
+		MaxDialTimeout:               maxDialTimeout,
+		MaxSessionIdleTimeout:        maxSessionIdleTimeout,
+		MappingBatchWatchdog:         envDurationOrDefault("NB_PROXY_MAPPING_BATCH_WATCHDOG", 0),
+		GeoDataDir:                   geoDataDir,
+		CrowdSecAPIURL:               crowdsecAPIURL,
+		CrowdSecAPIKey:               crowdsecAPIKey,
+		CrowdSecAppSecURL:            appsecURL,
+		CrowdSecAppSecTimeout:        appsecTimeout,
+		CrowdSecAppSecMaxBodyBytes:   appsecMaxBodyBytes,
+		CrowdSecAppSecMaxConcurrent:  appsecMaxConcurrent,
+		MiddlewareCaptureBudgetBytes: captureBudgetBytes,
+	}
+}
+
 func envBoolOrDefault(key string, def bool) bool {
 	v, exists := os.LookupEnv(key)
 	if !exists {
@@ -293,6 +315,19 @@ func envUint16OrDefault(key string, def uint16) uint16 {
 	return uint16(parsed)
 }
 
+func envInt64OrDefault(key string, def int64) int64 {
+	v, exists := os.LookupEnv(key)
+	if !exists {
+		return def
+	}
+	parsed, err := strconv.ParseInt(v, 10, 64)
+	if err != nil {
+		log.Warnf("parse %s=%q: %v, using default %d", key, v, err, def)
+		return def
+	}
+	return parsed
+}
+
 func envDurationOrDefault(key string, def time.Duration) time.Duration {
 	v, exists := os.LookupEnv(key)
 	if !exists {

proxy/internal/appsec/body.go

@@ -0,0 +1,163 @@
+package appsec
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"mime"
+	"net/http"
+	"net/url"
+	"slices"
+	"strings"
+)
+
+// bufferBody reads up to limit+1 bytes from r.Body and always restores r.Body so
+// the request stays forwardable. oversize reports that the body exceeded limit, in
+// which case the returned prefix must not be used for inspection: the bytes are
+// only read so they can be replayed to the backend.
+func bufferBody(r *http.Request, limit int64) (body []byte, oversize bool, err error) {
+	original := r.Body
+	buf, readErr := io.ReadAll(io.LimitReader(original, limit+1))
+	if readErr != nil && !errors.Is(readErr, io.EOF) {
+		// Restore what was read so a downstream retry sees a consistent stream,
+		// then surface the failure.
+		r.Body = replay(buf, original)
+		return nil, false, readErr
+	}
+
+	if int64(len(buf)) > limit {
+		r.Body = replay(buf, original)
+		return nil, true, nil
+	}
+
+	// The whole body is buffered, so the original is drained and can be closed.
+	// A close error on a drained read-only body does not invalidate the bytes.
+	_ = original.Close()
+	r.Body = io.NopCloser(bytes.NewReader(buf))
+	// Framing is deliberately left as the client sent it. Rewriting a chunked
+	// request to a fixed Content-Length here would be invisible to the client
+	// but not to the rest of the chain: a later body capture with a smaller cap
+	// sees a known length over its cap and skips capture entirely, where an
+	// unknown length would have given it a truncated prefix. Inspecting a
+	// request must not change what any other layer gets to inspect.
+	return buf, false, nil
+}
+
+// replay returns a ReadCloser that yields the already-read prefix followed by
+// the remainder of the original stream, and closes the original.
+func replay(prefix []byte, rest io.ReadCloser) io.ReadCloser {
+	return struct {
+		io.Reader
+		io.Closer
+	}{
+		Reader: io.MultiReader(bytes.NewReader(prefix), rest),
+		Closer: rest,
+	}
+}
+
+// redactedPlaceholder replaces a credential value in the mirrored body. It is
+// inert for rule matching, and its fixed length leaks nothing about the secret.
+const redactedPlaceholder = "redacted"
+
+// redactFormFields returns the body to mirror for a URL-encoded form, with the
+// values of the named fields replaced. The proxy's own password / PIN login
+// form posts to the service path itself, so without this the plaintext
+// credential would reach the Security Engine.
+//
+// Only the credential values are removed, never the whole body: dropping the
+// body outright would let a caller exempt any payload from inspection just by
+// appending a field named "password". Everything else in the form stays
+// inspectable, which is the point.
+//
+// Returns body unchanged when it is not a URL-encoded form or carries none of
+// the fields.
+//
+// Substitution happens on the raw bytes rather than by re-encoding parsed
+// values. Re-encoding would drop pairs that url.ParseQuery rejects, so a
+// payload hidden in a malformed pair alongside a credential-named field would
+// never be inspected while a tolerant backend parser still acted on it. Working
+// byte-wise also avoids reordering keys and normalizing escapes, so the engine
+// sees the same bytes the backend will.
+//
+// Field names match case-sensitively, on purpose: the caller passes the exact
+// names the login handler reads via r.FormValue, and that lookup is itself
+// case-sensitive. A "Password" field is therefore never a credential as far as
+// the proxy is concerned, and redacting it would only blind the WAF to a value
+// the proxy does not own.
+func redactFormFields(contentType string, body []byte, fields []string) []byte {
+	if len(fields) == 0 || len(body) == 0 {
+		return body
+	}
+	media, _, err := mime.ParseMediaType(contentType)
+	if err != nil || media != "application/x-www-form-urlencoded" {
+		return body
+	}
+	return redactURLEncoded(body, fields)
+}
+
+// redactURLEncoded replaces the values of the named keys in a URL-encoded
+// key/value sequence, the shared syntax of a query string and a form body.
+func redactURLEncoded(raw []byte, fields []string) []byte {
+	// Split on "&" only, matching how Go's form parser delimits pairs.
+	segments := bytes.Split(raw, []byte("&"))
+	redacted := false
+	for i, segment := range segments {
+		rawKey, _, hasValue := bytes.Cut(segment, []byte("="))
+		if !hasValue {
+			continue
+		}
+		// Compare the decoded name, so an escaped spelling of the field
+		// ("pass%77ord") is redacted too: the reader decodes before looking it
+		// up. A key that fails to decode never reaches that reader either,
+		// since the parser drops the pair.
+		name, err := url.QueryUnescape(string(rawKey))
+		if err != nil || !slices.Contains(fields, name) {
+			continue
+		}
+		// Keep the key bytes as sent and replace only the value. Assigning a
+		// fresh slice leaves raw untouched, which matters: the caller restored
+		// the request body from the same buffer.
+		segments[i] = []byte(string(rawKey) + "=" + redactedPlaceholder)
+		redacted = true
+	}
+	if !redacted {
+		return raw
+	}
+	return bytes.Join(segments, []byte("&"))
+}
+
+// redactQuery replaces the values of the named query parameters in a raw query
+// string, leaving every other byte as sent.
+func redactQuery(rawQuery string, params []string) string {
+	if len(params) == 0 || rawQuery == "" {
+		return rawQuery
+	}
+	return string(redactURLEncoded([]byte(rawQuery), params))
+}
+
+// redactCookieHeader replaces the values of the named cookies in a Cookie
+// header, keeping the others intact: cookies are a zone WAF rules match on, so
+// dropping the whole header would cost real coverage.
+func redactCookieHeader(value string, names []string) string {
+	if len(names) == 0 || value == "" {
+		return value
+	}
+	parts := strings.Split(value, ";")
+	redacted := false
+	for i, part := range parts {
+		name, _, hasValue := strings.Cut(part, "=")
+		if !hasValue {
+			continue
+		}
+		// Cookie names are case-sensitive and are not percent-decoded.
+		if !slices.Contains(names, strings.TrimSpace(name)) {
+			continue
+		}
+		parts[i] = name + "=" + redactedPlaceholder
+		redacted = true
+	}
+	if !redacted {
+		return value
+	}
+	return strings.Join(parts, ";")
+}

proxy/internal/appsec/client.go

@@ -0,0 +1,571 @@
+// Package appsec implements the CrowdSec AppSec (WAF) side of the remediation
+// component protocol: each inspected HTTP request is mirrored to the Security
+// Engine's AppSec endpoint, which replies with an allow / ban / captcha verdict
+// for that request.
+//
+// This is a separate endpoint from the LAPI decision stream used by the
+// crowdsec package: LAPI answers "is this IP known bad", AppSec answers "is
+// this request an attack". The two are configured and enabled independently.
+package appsec
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/proxy/internal/netutil"
+	"github.com/netbirdio/netbird/proxy/internal/restrict"
+)
+
+// Header names the AppSec component reads off the mirrored request. IP, URI and
+// Verb are mandatory: the engine answers 500 when any of them is missing.
+const (
+	headerAPIKey        = "X-Crowdsec-Appsec-Api-Key" //nolint:gosec // G101: a header name, not a credential
+	headerIP            = "X-Crowdsec-Appsec-Ip"
+	headerURI           = "X-Crowdsec-Appsec-Uri"
+	headerVerb          = "X-Crowdsec-Appsec-Verb"
+	headerHost          = "X-Crowdsec-Appsec-Host"
+	headerUserAgent     = "X-Crowdsec-Appsec-User-Agent"
+	headerHTTPVersion   = "X-Crowdsec-Appsec-Http-Version"
+	headerTransactionID = "X-Crowdsec-Appsec-Transaction-Id"
+)
+
+// headerPrefix covers every protocol header. Any client-supplied header in this
+// namespace is dropped before forwarding so a caller cannot influence the
+// engine's view of its own address, or replay an API key.
+const headerPrefix = "X-Crowdsec-Appsec-"
+
+// Remediation actions the engine can return.
+const (
+	actionAllow   = "allow"
+	actionBan     = "ban"
+	actionCaptcha = "captcha"
+)
+
+const (
+	// DefaultTimeout matches the 200ms budget CrowdSec's remediation component
+	// spec sets for the blocking AppSec call.
+	DefaultTimeout = 200 * time.Millisecond
+	// MinTimeout and MaxTimeout bound the configured inspection timeout.
+	// Inspection is synchronous, so the upper bound is what keeps a
+	// mis-set value from parking every request to an inspected service on a
+	// slow engine; the lower bound keeps the call from timing out before the
+	// engine can realistically answer. Mirrors the per-middleware bounds the
+	// proxy already applies to in-path calls.
+	MinTimeout = 10 * time.Millisecond
+	MaxTimeout = 5 * time.Second
+	// DefaultMaxBodyBytes caps the request body mirrored to the engine.
+	// Requests with a larger body are inspected on headers and URI only.
+	DefaultMaxBodyBytes int64 = 64 << 10
+	// DefaultMaxConcurrent bounds inspections in flight toward the engine. The
+	// point is to fail fast instead of parking a goroutine per request for the
+	// whole timeout once the engine is saturated: a slow engine otherwise turns
+	// a traffic burst into a pile of waiters that all time out anyway. Sized so
+	// a healthy engine (single-digit milliseconds per call) never reaches it.
+	DefaultMaxConcurrent = 256
+	// MaxConcurrentLimit is the ceiling for that bound.
+	MaxConcurrentLimit = 4096
+	// MaxBodyBytesLimit is the ceiling for that cap. A single request can hold
+	// this much in memory; the shared Budget is what bounds the total across
+	// concurrent requests. Matches the proxy-wide body-capture ceiling.
+	MaxBodyBytesLimit int64 = 8 << 20
+	// maxResponseBytes bounds how much of a verdict response is read. The
+	// engine answers with a two-field JSON object, so anything beyond this is
+	// not a response we can act on.
+	maxResponseBytes int64 = 4 << 10
+)
+
+// Reasons the request body was not mirrored. Reported so an access-log reader
+// can distinguish "inspected and clean" from "never inspected", and so an
+// oversize opt-out is visible rather than silent.
+const (
+	BypassOversize = "oversize"
+	BypassUpgrade  = "upgrade"
+	BypassDisabled = "disabled"
+	BypassBudget   = "budget_exhausted"
+)
+
+// ErrUnavailable reports that the engine could not produce a verdict: the call
+// failed, timed out, or the engine rejected it (401 bad key, 500 malformed).
+// Distinguished from a block verdict so the caller can apply the per-service
+// mode: enforce fails closed, observe allows.
+var ErrUnavailable = errors.New("appsec engine unavailable")
+
+// Config configures a Client.
+type Config struct {
+	// URL is the AppSec endpoint, e.g. http://127.0.0.1:7422/.
+	URL string
+	// APIKey is the CrowdSec bouncer API key. The AppSec component validates it
+	// against LAPI, so the same key used for the decision stream works here.
+	APIKey string
+	// Timeout bounds a single inspection call. Zero means DefaultTimeout.
+	Timeout time.Duration
+	// MaxBodyBytes caps the mirrored request body. Zero means
+	// DefaultMaxBodyBytes; negative disables body forwarding entirely.
+	MaxBodyBytes int64
+	// MaxConcurrent bounds inspections in flight toward the engine. Zero means
+	// DefaultMaxConcurrent; negative disables the bound.
+	MaxConcurrent int
+	// Budget bounds the total body buffering in flight across all inspected
+	// requests. Nil disables that ceiling, which leaves the worst case at
+	// MaxBodyBytes times the concurrent request count; callers serving
+	// untrusted traffic should share the proxy-wide capture budget here.
+	Budget Budget
+	Logger *log.Entry
+}
+
+// Budget is the shared allowance for in-flight body buffering. Acquire reports
+// whether n bytes could be reserved; every successful Acquire is matched by a
+// Release of the same n. Satisfied by the proxy's capture budget, so AppSec and
+// the middleware body tap draw down one pool rather than two independent ones.
+type Budget interface {
+	Acquire(n int64) bool
+	Release(n int64)
+}
+
+// Client mirrors HTTP requests to a CrowdSec AppSec endpoint. It holds no
+// per-service state and is safe for concurrent use.
+type Client struct {
+	url          string
+	apiKey       string
+	maxBodyBytes int64
+	// sem bounds in-flight inspections. Nil when the bound is disabled.
+	sem    chan struct{}
+	budget Budget
+	http   *http.Client
+	logger *log.Entry
+}
+
+// New validates the config and returns a Client. The endpoint is not contacted
+// here: the engine may come up after the proxy.
+func New(cfg Config) (*Client, error) {
+	if cfg.URL == "" {
+		return nil, errors.New("appsec url is empty")
+	}
+	if cfg.APIKey == "" {
+		return nil, errors.New("appsec api key is empty")
+	}
+	parsed, err := url.Parse(cfg.URL)
+	if err != nil {
+		return nil, fmt.Errorf("parse appsec url: %w", err)
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return nil, fmt.Errorf("appsec url scheme %q is not http(s)", parsed.Scheme)
+	}
+	if parsed.Host == "" {
+		return nil, errors.New("appsec url has no host")
+	}
+
+	logger := cfg.Logger
+	if logger == nil {
+		logger = log.NewEntry(log.StandardLogger())
+	}
+
+	timeout := cfg.Timeout
+	switch {
+	case timeout <= 0:
+		timeout = DefaultTimeout
+	case timeout < MinTimeout:
+		logger.Warnf("appsec timeout %s is below the minimum, using %s", timeout, MinTimeout)
+		timeout = MinTimeout
+	case timeout > MaxTimeout:
+		logger.Warnf("appsec timeout %s exceeds the maximum, using %s", timeout, MaxTimeout)
+		timeout = MaxTimeout
+	}
+
+	// A negative cap is meaningful: forward no body at all.
+	maxBody := cfg.MaxBodyBytes
+	switch {
+	case maxBody == 0:
+		maxBody = DefaultMaxBodyBytes
+	case maxBody > MaxBodyBytesLimit:
+		logger.Warnf("appsec max body %d exceeds the maximum, using %d", maxBody, MaxBodyBytesLimit)
+		maxBody = MaxBodyBytesLimit
+	}
+
+	maxConcurrent := cfg.MaxConcurrent
+	switch {
+	case maxConcurrent == 0:
+		maxConcurrent = DefaultMaxConcurrent
+	case maxConcurrent > MaxConcurrentLimit:
+		logger.Warnf("appsec max concurrent %d exceeds the maximum, using %d", maxConcurrent, MaxConcurrentLimit)
+		maxConcurrent = MaxConcurrentLimit
+	}
+	var sem chan struct{}
+	if maxConcurrent > 0 {
+		sem = make(chan struct{}, maxConcurrent)
+	}
+
+	return &Client{
+		url:          cfg.URL,
+		apiKey:       cfg.APIKey,
+		maxBodyBytes: maxBody,
+		sem:          sem,
+		budget:       cfg.Budget,
+		logger:       logger,
+		http: &http.Client{
+			Timeout: timeout,
+			Transport: &http.Transport{
+				MaxIdleConns:        100,
+				MaxIdleConnsPerHost: 32,
+				IdleConnTimeout:     90 * time.Second,
+			},
+		},
+	}, nil
+}
+
+// Request is one inspection request.
+type Request struct {
+	// HTTP is the in-flight client request. Inspect buffers and restores its
+	// body, so the request stays forwardable afterwards.
+	HTTP *http.Request
+	// ClientIP is the resolved client address (after trusted-proxy handling).
+	ClientIP netip.Addr
+	// TransactionID correlates the engine's alert with the proxy's access log
+	// entry. Empty lets the engine generate its own UUID.
+	TransactionID string
+	// RedactBodyFields lists form fields whose values are replaced before the
+	// body is mirrored. Used to keep credentials submitted to the proxy's own
+	// login form out of the engine while still inspecting the rest.
+	RedactBodyFields []string
+	// RedactHeaders, RedactCookies and RedactQueryParams name the credentials
+	// the proxy already withholds from backends: the header-auth values, its
+	// session cookie, and the OIDC session token. The engine logs and alerts on
+	// what it inspects, so mirroring them there would reintroduce the leak the
+	// upstream strippers exist to prevent. Only the values are replaced, so the
+	// surrounding headers, cookies and query stay inspectable.
+	RedactHeaders     []string
+	RedactCookies     []string
+	RedactQueryParams []string
+}
+
+// Result is the outcome of an inspection.
+type Result struct {
+	Verdict restrict.Verdict
+	// BodyBypass names why the request body was not mirrored, empty when it
+	// was (or when the request had none). The engine still saw the headers and
+	// URI, so this is a coverage note, not a failure.
+	BodyBypass string
+	// Release returns the buffered body's budget reservation. Never nil, so it
+	// is always safe to defer. It must run only once the request has been
+	// served, not when Inspect returns: the buffer stays alive as r.Body for
+	// the backend to read, so releasing earlier would let the budget admit
+	// buffering that is still resident.
+	Release func()
+}
+
+// noopRelease is the Release for inspections that reserved no budget.
+func noopRelease() {}
+
+// Inspect mirrors r to the AppSec engine and returns its verdict. A nil error
+// with restrict.Allow means the request passed. On failure it returns
+// DenyAppSecUnavailable wrapped with ErrUnavailable; the caller decides whether
+// that blocks, based on the per-service mode.
+func (c *Client) Inspect(ctx context.Context, req Request) (Result, error) {
+	if c == nil {
+		return Result{Verdict: restrict.DenyAppSecUnavailable, Release: noopRelease}, ErrUnavailable
+	}
+	if req.HTTP == nil {
+		return Result{Verdict: restrict.DenyAppSecUnavailable, Release: noopRelease}, fmt.Errorf("%w: nil request", ErrUnavailable)
+	}
+
+	// release is carried out to the caller rather than deferred here: the
+	// buffered body outlives this call as r.Body.
+	if !c.acquireSlot() {
+		// Deny rather than wave through: a flood must not be a way to switch
+		// inspection off. Enforce blocks, observe logs and allows, exactly as
+		// for an unreachable engine.
+		return Result{Verdict: restrict.DenyAppSecUnavailable, Release: noopRelease},
+			fmt.Errorf("%w: %d inspections already in flight", ErrUnavailable, cap(c.sem))
+	}
+	defer c.releaseSlot()
+
+	body, bypass, release, err := c.readBody(req)
+	if err != nil {
+		return Result{Verdict: restrict.DenyAppSecUnavailable, Release: release}, fmt.Errorf("%w: read body: %w", ErrUnavailable, err)
+	}
+
+	outbound, err := c.buildRequest(ctx, req, body)
+	if err != nil {
+		return Result{Verdict: restrict.DenyAppSecUnavailable, BodyBypass: bypass, Release: release}, fmt.Errorf("%w: %w", ErrUnavailable, err)
+	}
+
+	resp, err := c.http.Do(outbound)
+	if err != nil {
+		return Result{Verdict: restrict.DenyAppSecUnavailable, BodyBypass: bypass, Release: release}, fmt.Errorf("%w: %w", ErrUnavailable, err)
+	}
+	defer func() {
+		// Drain before closing. net/http only returns a connection to the idle
+		// pool once its body is read to EOF; closing with bytes outstanding
+		// discards it. Every verdict carries a JSON body, so skipping this
+		// would cost a fresh handshake per inspected request, inside the
+		// timeout budget.
+		if _, err := io.Copy(io.Discard, io.LimitReader(resp.Body, maxResponseBytes)); err != nil {
+			c.logger.Tracef("drain appsec response body: %v", err)
+		}
+		if err := resp.Body.Close(); err != nil {
+			c.logger.Tracef("close appsec response body: %v", err)
+		}
+	}()
+
+	verdict, err := c.verdict(resp)
+	return Result{Verdict: verdict, BodyBypass: bypass, Release: release}, err
+}
+
+// acquireSlot takes an in-flight slot without blocking, reporting false when
+// the engine is already at capacity.
+func (c *Client) acquireSlot() bool {
+	if c.sem == nil {
+		return true
+	}
+	select {
+	case c.sem <- struct{}{}:
+		return true
+	default:
+		return false
+	}
+}
+
+// releaseSlot returns the slot. Scoped to the engine call, not the request: the
+// buffered body outlives the call but the engine's attention does not.
+func (c *Client) releaseSlot() {
+	if c.sem == nil {
+		return
+	}
+	select {
+	case <-c.sem:
+	default:
+	}
+}
+
+// readBody buffers the body so it can be mirrored, always restoring it on the
+// original request. Returns nil when there is no body to forward: no body at
+// all, an upgrade request, or a body over the cap. A login form is forwarded
+// with its credential values redacted rather than suppressed.
+// release is never nil; the caller invokes it once the request has been served.
+func (c *Client) readBody(req Request) (body []byte, bypass string, release func(), err error) {
+	r := req.HTTP
+	if r.Body == nil || r.Body == http.NoBody {
+		return nil, "", noopRelease, nil
+	}
+	if c.maxBodyBytes < 0 {
+		return nil, BypassDisabled, noopRelease, nil
+	}
+	// A genuine upgrade request carries no body to inspect (net/http hands us
+	// http.NoBody, caught above); the hijacked stream is reached through
+	// Hijacker, never r.Body. The test has to be the forwarder's own, because a
+	// looser one would skip inspection for requests the forwarder still
+	// delivers to the backend with their body intact.
+	if netutil.IsUpgradeRequest(r.Header) {
+		return nil, BypassUpgrade, noopRelease, nil
+	}
+	// A Content-Length over the cap is known to be too large before reading.
+	if r.ContentLength > c.maxBodyBytes {
+		return nil, BypassOversize, noopRelease, nil
+	}
+
+	// Reserve the whole cap rather than the eventual length: the reservation
+	// has to be made before the body is read, and until then the only bound
+	// known is the cap. Skipping inspection when the pool is drained keeps a
+	// burst of large bodies from being an out-of-memory lever; the bypass is
+	// recorded so the gap in coverage is visible.
+	release = noopRelease
+	if c.budget != nil {
+		if !c.budget.Acquire(c.maxBodyBytes) {
+			c.logger.Debugf("appsec buffer budget exhausted, inspecting headers and URI only")
+			return nil, BypassBudget, noopRelease, nil
+		}
+		var once sync.Once
+		release = func() { once.Do(func() { c.budget.Release(c.maxBodyBytes) }) }
+	}
+
+	buffered, oversize, err := bufferBody(r, c.maxBodyBytes)
+	if err != nil {
+		// bufferBody restored r.Body from the bytes it did read, so the
+		// reservation stays held until the caller releases it.
+		return nil, "", release, err
+	}
+	// An oversize body was only partially read: a truncated prefix changes the
+	// engine's verdict in both directions, so inspect headers and URI only.
+	if oversize {
+		return nil, BypassOversize, release, nil
+	}
+	return redactFormFields(r.Header.Get("Content-Type"), buffered, req.RedactBodyFields), "", release, nil
+}
+
+// buildRequest assembles the mirrored request. Per the protocol it is a GET
+// when there is no body and a POST otherwise; bytes.Reader gives the outbound
+// request an accurate Content-Length, which the engine relies on to read the
+// body at all.
+func (c *Client) buildRequest(ctx context.Context, req Request, body []byte) (*http.Request, error) {
+	method := http.MethodGet
+	var payload io.Reader
+	if len(body) > 0 {
+		method = http.MethodPost
+		payload = bytes.NewReader(body)
+	}
+
+	outbound, err := http.NewRequestWithContext(ctx, method, c.url, payload)
+	if err != nil {
+		return nil, fmt.Errorf("build appsec request: %w", err)
+	}
+
+	r := req.HTTP
+	copyInspectableHeaders(outbound.Header, r.Header)
+	redactSecrets(outbound.Header, req)
+
+	outbound.Header.Set(headerAPIKey, c.apiKey)
+	outbound.Header.Set(headerIP, req.ClientIP.Unmap().String())
+	outbound.Header.Set(headerURI, mirroredURI(r.URL, req.RedactQueryParams))
+	outbound.Header.Set(headerVerb, r.Method)
+	outbound.Header.Set(headerHost, r.Host)
+	if ua := r.UserAgent(); ua != "" {
+		outbound.Header.Set(headerUserAgent, ua)
+	}
+	outbound.Header.Set(headerHTTPVersion, httpVersion(r))
+	if req.TransactionID != "" {
+		outbound.Header.Set(headerTransactionID, req.TransactionID)
+	}
+	return outbound, nil
+}
+
+// verdict maps the engine's response to a restrict.Verdict. 200 is a pass and
+// 401/500 are engine-side failures; every other status carries a remediation in
+// the body. The blocked status code is operator-configurable
+// (blocked_http_code), so the action field decides, not the status.
+func (c *Client) verdict(resp *http.Response) (restrict.Verdict, error) {
+	switch resp.StatusCode {
+	case http.StatusUnauthorized:
+		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: rejected api key", ErrUnavailable)
+	case http.StatusInternalServerError:
+		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: engine error", ErrUnavailable)
+	}
+
+	// Every status, 200 included, has to carry a decodable remediation. Taking a
+	// bare 200 as a pass would mean a URL pointing at anything that answers 200
+	// (a health endpoint, a load balancer's default page) silently allows every
+	// request while the service reports itself as enforcing.
+
+	var decoded struct {
+		Action string `json:"action"`
+	}
+	if err := json.NewDecoder(io.LimitReader(resp.Body, maxResponseBytes)).Decode(&decoded); err != nil {
+		// Every remediation carries a decodable action, so a response without
+		// one is not a verdict: most often the URL points at something that is
+		// not the AppSec endpoint, which answers 404 with HTML. Reported as
+		// unavailable rather than a ban so the access log names the real fault
+		// instead of sending an operator hunting for a rule that never fired.
+		// Enforce still blocks either way; only the recorded reason differs.
+		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: undecodable response (status %d): %w", ErrUnavailable, resp.StatusCode, err)
+	}
+
+	switch decoded.Action {
+	case actionAllow:
+		return restrict.Allow, nil
+	case actionCaptcha:
+		return restrict.DenyAppSecCaptcha, nil
+	case actionBan:
+		return restrict.DenyAppSecBan, nil
+	case "":
+		// Decodable JSON without a remediation is not a verdict either: the
+		// endpoint answered, but not as the engine. Same reasoning as an
+		// undecodable body, and the same reason to point at configuration.
+		return restrict.DenyAppSecUnavailable,
+			fmt.Errorf("%w: response carried no remediation (status %d)", ErrUnavailable, resp.StatusCode)
+	default:
+		// A remediation we do not implement still means the engine flagged the
+		// request, so deny.
+		c.logger.Debugf("unknown appsec action %q (status %d), treating as ban", decoded.Action, resp.StatusCode)
+		return restrict.DenyAppSecBan, nil
+	}
+}
+
+// copyInspectableHeaders copies the client's headers, which are what the WAF
+// rules actually match on, dropping hop-by-hop headers that describe the
+// proxy-to-engine connection rather than the client request, and any header in
+// the AppSec protocol namespace.
+func copyInspectableHeaders(dst, src http.Header) {
+	for name, values := range src {
+		if hopByHopHeaders[http.CanonicalHeaderKey(name)] {
+			continue
+		}
+		if strings.HasPrefix(http.CanonicalHeaderKey(name), headerPrefix) {
+			continue
+		}
+		dst[http.CanonicalHeaderKey(name)] = append([]string(nil), values...)
+	}
+	// Content-Length describes the mirrored payload, not the client's: net/http
+	// sets it from the body we actually attach. Content-Type is kept either way
+	// so rules matching on it still fire when the body was not forwarded.
+	dst.Del("Content-Length")
+}
+
+// redactSecrets replaces the credential values the proxy withholds from
+// backends, so the mirrored copy does not carry them either.
+func redactSecrets(dst http.Header, req Request) {
+	for _, name := range req.RedactHeaders {
+		// Presence, not Get: a header whose first value is empty still carries
+		// its later values to the engine, while the upstream strip deletes the
+		// name outright. Set collapses every value into the placeholder.
+		if len(dst.Values(name)) > 0 {
+			dst.Set(name, redactedPlaceholder)
+		}
+	}
+	// Every Cookie line, not just the first: a client may send several, and Get
+	// would leave the session cookie in any later one mirrored in the clear.
+	if cookies := dst.Values("Cookie"); len(cookies) > 0 {
+		redacted := make([]string, len(cookies))
+		for i, cookie := range cookies {
+			redacted[i] = redactCookieHeader(cookie, req.RedactCookies)
+		}
+		dst["Cookie"] = redacted
+	}
+}
+
+// mirroredURI renders the request target for the URI header, with the named
+// query parameter values replaced.
+func mirroredURI(u *url.URL, redactParams []string) string {
+	uri := u.RequestURI()
+	if u.RawQuery == "" || len(redactParams) == 0 {
+		return uri
+	}
+	redacted := redactQuery(u.RawQuery, redactParams)
+	if redacted == u.RawQuery {
+		return uri
+	}
+	// RequestURI is path + "?" + RawQuery; swap only the query part so the
+	// path keeps its original encoding.
+	return strings.TrimSuffix(uri, u.RawQuery) + redacted
+}
+
+var hopByHopHeaders = map[string]bool{
+	"Connection":          true,
+	"Keep-Alive":          true,
+	"Proxy-Authenticate":  true,
+	"Proxy-Authorization": true,
+	"Proxy-Connection":    true,
+	"Te":                  true,
+	"Trailer":             true,
+	"Transfer-Encoding":   true,
+	"Upgrade":             true,
+}
+
+// httpVersion renders the two-digit form the engine parses ("11", "20").
+func httpVersion(r *http.Request) string {
+	major, minor := r.ProtoMajor, r.ProtoMinor
+	if major < 0 || major > 9 || minor < 0 || minor > 9 {
+		return ""
+	}
+	return fmt.Sprintf("%d%d", major, minor)
+}

proxy/internal/auth/appsec_test.go

@@ -0,0 +1,306 @@
+package auth
+
+import (
+	"crypto/ed25519"
+	"encoding/base64"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/appsec"
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/proxy/internal/restrict"
+	"github.com/netbirdio/netbird/proxy/internal/types"
+)
+
+// appsecEngine is a stub AppSec component returning a fixed remediation.
+func appsecEngine(t *testing.T, status int, body string) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(status)
+		if body != "" {
+			_, _ = w.Write([]byte(body))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+// serveWithAppSec runs a request through the middleware for a domain configured
+// with the given AppSec mode, returning the response and the captured metadata.
+func serveWithAppSec(t *testing.T, mode restrict.AppSecMode, client *appsec.Client, r *http.Request) (*httptest.ResponseRecorder, map[string]string, bool) {
+	t.Helper()
+
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	mw.SetAppSec(client)
+	require.NoError(t, mw.AddDomain("svc.example.com", DomainSettings{
+		AccountID:  types.AccountID("acct-1"),
+		ServiceID:  types.ServiceID("svc-1"),
+		AppSecMode: mode,
+	}))
+
+	reached := false
+	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	cd := proxy.NewCapturedData("req-1")
+	r = r.WithContext(proxy.WithCapturedData(r.Context(), cd))
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, r)
+
+	return rec, cd.GetMetadata(), reached
+}
+
+func appsecRequest() *http.Request {
+	r := httptest.NewRequest(http.MethodGet, "http://svc.example.com/?x=/etc/passwd", nil)
+	r.Host = "svc.example.com"
+	r.RemoteAddr = "203.0.113.7:44444"
+	return r
+}
+
+func TestCheckAppSec_EnforceBlocksBannedRequest(t *testing.T) {
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban","http_status":403}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
+
+	assert.Equal(t, http.StatusForbidden, rec.Code)
+	assert.False(t, reached, "a banned request must not reach the backend")
+	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
+	assert.NotContains(t, meta, "appsec_mode", "enforce is the default, only observe is annotated")
+}
+
+func TestCheckAppSec_ObserveAllowsAndRecordsVerdict(t *testing.T) {
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban","http_status":403}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecObserve, client, appsecRequest())
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.True(t, reached, "observe mode must not block")
+	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
+	assert.Equal(t, "observe", meta["appsec_mode"])
+}
+
+func TestCheckAppSec_AllowedRequestPasses(t *testing.T) {
+	srv := appsecEngine(t, http.StatusOK, `{"action":"allow","http_status":200}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.True(t, reached)
+	assert.NotContains(t, meta, "appsec_verdict", "a clean request records no verdict")
+}
+
+func TestCheckAppSec_OffSkipsInspection(t *testing.T) {
+	// An engine that would ban everything; the mode must keep us away from it.
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecOff, client, appsecRequest())
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.True(t, reached)
+	assert.Empty(t, meta)
+}
+
+func TestCheckAppSec_EnforceFailsClosedWithoutClient(t *testing.T) {
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, nil, appsecRequest())
+
+	assert.Equal(t, http.StatusForbidden, rec.Code,
+		"enforce with no configured endpoint must deny rather than pass traffic uninspected")
+	assert.False(t, reached)
+	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
+}
+
+func TestCheckAppSec_ObserveAllowsWithoutClient(t *testing.T) {
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecObserve, nil, appsecRequest())
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.True(t, reached)
+	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
+	assert.Equal(t, "observe", meta["appsec_mode"])
+}
+
+func TestCheckAppSec_EnforceFailsClosedWhenEngineUnreachable(t *testing.T) {
+	client, err := appsec.New(appsec.Config{URL: "http://127.0.0.1:1/", APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
+
+	assert.Equal(t, http.StatusForbidden, rec.Code)
+	assert.False(t, reached)
+	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
+}
+
+func TestCheckAppSec_InspectsOverlayTraffic(t *testing.T) {
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	// Requests arriving over the WireGuard overlay skip the geo and IP-reputation
+	// checks, but request content is just as inspectable.
+	r := appsecRequest()
+	r = r.WithContext(types.WithOverlayOrigin(r.Context()))
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
+
+	assert.Equal(t, http.StatusForbidden, rec.Code, "overlay traffic must still be inspected")
+	assert.False(t, reached)
+	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
+}
+
+func TestCheckAppSec_UnresolvableClientIPFailsClosed(t *testing.T) {
+	srv := appsecEngine(t, http.StatusOK, `{"action":"allow"}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	r := appsecRequest()
+	r.RemoteAddr = "not-an-address"
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
+
+	assert.Equal(t, http.StatusForbidden, rec.Code,
+		"the engine requires a client address; a request we cannot attribute must not pass")
+	assert.False(t, reached)
+	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
+}
+
+// The redaction sets are resolved from the domain's schemes at registration, so
+// what AppSec withholds cannot drift from what those schemes actually accept.
+func TestAddDomain_ResolvesRedactionSetsFromSchemes(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	require.NoError(t, mw.AddDomain("svc.example.com", DomainSettings{
+		Schemes: []Scheme{
+			NewPassword(nil, "svc-1", "acct-1"),
+			NewHeader(nil, "svc-1", "acct-1", "X-Api-Key"),
+		},
+		SessionPublicKey:  base64.StdEncoding.EncodeToString(make([]byte, ed25519.PublicKeySize)),
+		SessionExpiration: time.Hour,
+		AppSecMode:        restrict.AppSecEnforce,
+	}))
+
+	mw.domainsMux.RLock()
+	config := mw.domains["svc.example.com"]
+	mw.domainsMux.RUnlock()
+
+	assert.Equal(t, []string{"password"}, config.redactBodyFields)
+	assert.Equal(t, []string{"X-Api-Key"}, config.redactHeaders)
+	// r.FormValue merges the query into the form, so a credential passed there
+	// authenticates and must be redacted alongside the OIDC session token.
+	assert.Equal(t, []string{"session_token", "password"}, config.redactQueryParams)
+}
+
+// countingBudget records reservations so a test can observe when the
+// middleware hands them back.
+type countingBudget struct {
+	mu        sync.Mutex
+	total     int64
+	used      int64
+	maxAtOnce int64
+}
+
+func (b *countingBudget) Acquire(n int64) bool {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.used+n > b.total {
+		return false
+	}
+	b.used += n
+	if b.used > b.maxAtOnce {
+		b.maxAtOnce = b.used
+	}
+	return true
+}
+
+func (b *countingBudget) Release(n int64) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.used -= n
+}
+
+func (b *countingBudget) inUse() int64 {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.used
+}
+
+// The buffered body stays alive as r.Body until the backend has read it, so
+// Protect must hold the reservation for the whole request and return it only
+// once the handler chain has unwound. Releasing inside Inspect would let the
+// budget admit buffering that is still resident.
+func TestProtect_AppSecBudgetHeldForRequestAndReleasedAfter(t *testing.T) {
+	srv := appsecEngine(t, http.StatusOK, `{"action":"allow"}`)
+	budget := &countingBudget{total: 1 << 20}
+	client, err := appsec.New(appsec.Config{
+		URL:          srv.URL,
+		APIKey:       "k",
+		MaxBodyBytes: 4096,
+		Budget:       budget,
+	})
+	require.NoError(t, err)
+
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	mw.SetAppSec(client)
+	require.NoError(t, mw.AddDomain("svc.example.com", DomainSettings{
+		AccountID:  types.AccountID("acct-1"),
+		ServiceID:  types.ServiceID("svc-1"),
+		AppSecMode: restrict.AppSecEnforce,
+	}))
+
+	var inHandler int64
+	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// The backend reads the buffered body here, so the reservation must
+		// still be held at this point.
+		inHandler = budget.inUse()
+		_, _ = io.ReadAll(r.Body)
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	r := httptest.NewRequest(http.MethodPost, "http://svc.example.com/", strings.NewReader("payload"))
+	r.Host = "svc.example.com"
+	cd := proxy.NewCapturedData("req-1")
+	r = r.WithContext(proxy.WithCapturedData(r.Context(), cd))
+
+	handler.ServeHTTP(httptest.NewRecorder(), r)
+
+	assert.Equal(t, int64(4096), inHandler, "the reservation must be held while the backend reads the body")
+	assert.Equal(t, int64(0), budget.inUse(), "Protect must release the reservation once the request is served")
+}
+
+// A denied request never reaches the backend, but Protect still has to hand the
+// reservation back or the pool leaks one cap per blocked request.
+func TestProtect_AppSecBudgetReleasedOnDeny(t *testing.T) {
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
+	budget := &countingBudget{total: 1 << 20}
+	client, err := appsec.New(appsec.Config{
+		URL:          srv.URL,
+		APIKey:       "k",
+		MaxBodyBytes: 4096,
+		Budget:       budget,
+	})
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodPost, "http://svc.example.com/", strings.NewReader("payload"))
+	r.Host = "svc.example.com"
+	rec, _, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
+
+	assert.False(t, reached, "a banned request must not reach the backend")
+	assert.Equal(t, http.StatusForbidden, rec.Code)
+	assert.Equal(t, int64(0), budget.inUse(), "a blocked request must not leak its reservation")
+}

proxy/internal/auth/header.go

@@ -39,6 +39,11 @@ func (Header) Type() auth.Method {
 	return auth.MethodHeader
 }
 
+// HeaderName returns the request header this scheme reads its credential from.
+func (h Header) HeaderName() string {
+	return h.headerName
+}
+
 // Authenticate checks for the configured header in the request. If absent,
 // returns empty (unauthenticated). If present, validates via gRPC.
 func (h Header) Authenticate(r *http.Request) (string, string, error) {

proxy/internal/auth/middleware.go

@@ -18,6 +18,7 @@ import (
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/proxy/internal/appsec"
 	"github.com/netbirdio/netbird/proxy/internal/proxy"
 	"github.com/netbirdio/netbird/proxy/internal/restrict"
 	"github.com/netbirdio/netbird/proxy/internal/types"
@@ -25,6 +26,11 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
+// sessionCookieNames is the cookie set AppSec redacts before mirroring: the
+// proxy's session cookie is a bearer credential for the service, and the
+// reverse proxy already strips it before forwarding upstream.
+var sessionCookieNames = []string{auth.SessionCookieName}
+
 // errValidationUnavailable indicates that session validation failed due to
 // an infrastructure error (e.g. gRPC unavailable), not an invalid token.
 var errValidationUnavailable = errors.New("session validation unavailable")
@@ -59,6 +65,14 @@ type DomainConfig struct {
 	IPRestrictions    *restrict.Filter
 	// Private routes the domain through ValidateTunnelPeer; failure → 403.
 	Private bool
+	// AppSecMode enables CrowdSec AppSec request inspection for this domain.
+	AppSecMode restrict.AppSecMode
+	// redact* name the credentials this domain's schemes accept, resolved once
+	// at registration. AppSec replaces their values before mirroring a request,
+	// matching what the reverse proxy strips before forwarding upstream.
+	redactBodyFields  []string
+	redactHeaders     []string
+	redactQueryParams []string
 }
 
 type validationResult struct {
@@ -82,6 +96,9 @@ type Middleware struct {
 	sessionValidator SessionValidator
 	geo              restrict.GeoResolver
 	tunnelCache      *tunnelValidationCache
+	// appsec is the shared CrowdSec AppSec client, nil when the proxy has no
+	// AppSec endpoint configured. Set once during startup, before serving.
+	appsec *appsec.Client
 }
 
 // NewMiddleware creates a new authentication middleware. The sessionValidator is
@@ -99,6 +116,12 @@ func NewMiddleware(logger *log.Logger, sessionValidator SessionValidator, geo re
 	}
 }
 
+// SetAppSec installs the shared CrowdSec AppSec client. Must be called during
+// startup, before the middleware serves any request.
+func (mw *Middleware) SetAppSec(client *appsec.Client) {
+	mw.appsec = client
+}
+
 // Protect wraps next with per-domain authentication and IP restriction checks.
 // Requests whose Host is not registered pass through unchanged.
 func (mw *Middleware) Protect(next http.Handler) http.Handler {
@@ -123,6 +146,14 @@ func (mw *Middleware) Protect(next http.Handler) http.Handler {
 			return
 		}
 
+		// Deferred, not released here: the inspected body stays alive as r.Body
+		// until the backend has read it, which happens inside next.ServeHTTP.
+		appSecAllowed, releaseAppSec := mw.checkAppSec(w, r, config)
+		defer releaseAppSec()
+		if !appSecAllowed {
+			return
+		}
+
 		// Private services bypass operator schemes and gate on tunnel peer.
 		if config.Private {
 			if mw.forwardWithTunnelPeer(w, r, host, config, next) {
@@ -262,6 +293,134 @@ func (mw *Middleware) checkIPRestrictions(w http.ResponseWriter, r *http.Request
 	return false
 }
 
+// checkAppSec mirrors the request to the CrowdSec AppSec engine when the domain
+// enables inspection. Returns false when the request was blocked and a response
+// has been written.
+//
+// The returned release frees the body-buffering budget the inspection reserved
+// and is never nil. It must run only after the request has been served, since
+// the buffered body stays alive as r.Body for the backend to read.
+//
+// Every non-allow remediation blocks with 403, captcha included: the proxy has
+// no challenge flow to serve. The distinct verdict is still recorded so the
+// access log shows which remediation the engine actually chose.
+//
+// Unlike the geo and IP-reputation checks, this runs for overlay traffic too:
+// AppSec inspects request content, which is just as meaningful when the caller
+// reached the proxy through the WireGuard tunnel.
+func (mw *Middleware) checkAppSec(w http.ResponseWriter, r *http.Request, config DomainConfig) (bool, func()) {
+	if !config.AppSecMode.Enabled() {
+		return true, func() {}
+	}
+
+	verdict, release := mw.inspectAppSec(r, config)
+	if verdict == restrict.Allow {
+		return true, release
+	}
+
+	observe := config.AppSecMode == restrict.AppSecObserve
+	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+		cd.SetMetadata("appsec_verdict", verdict.String())
+		if observe {
+			cd.SetMetadata("appsec_mode", "observe")
+		}
+	}
+
+	if observe {
+		mw.logger.Debugf("AppSec observe: would block %s for %s (%s)", r.RemoteAddr, r.Host, verdict)
+		return true, release
+	}
+
+	mw.markDenied(r, verdict.String())
+	mw.logger.Debugf("AppSec: %s for %s %s", verdict, r.Host, r.RemoteAddr)
+	http.Error(w, "Forbidden", http.StatusForbidden)
+	return false, release
+}
+
+// inspectAppSec runs the AppSec call and returns its verdict. Failures come
+// back as DenyAppSecUnavailable regardless of mode so observe mode still
+// records that inspection did not happen; the caller decides what blocks. The
+// returned release is never nil.
+func (mw *Middleware) inspectAppSec(r *http.Request, config DomainConfig) (restrict.Verdict, func()) {
+	// Mode requested but the proxy has no AppSec endpoint configured. Management
+	// gates this on the cluster capability; a stale mapping can still arrive.
+	if mw.appsec == nil {
+		mw.logger.Debugf("AppSec mode %q requested for %s but no AppSec endpoint is configured", config.AppSecMode, r.Host)
+		return restrict.DenyAppSecUnavailable, func() {}
+	}
+
+	clientIP := mw.resolveClientIP(r)
+	if !clientIP.IsValid() {
+		// The engine requires a client address, and a request whose source we
+		// cannot establish is exactly the kind we must not wave through.
+		mw.logger.Debugf("AppSec: cannot resolve client address for %q", r.RemoteAddr)
+		return restrict.DenyAppSecUnavailable, func() {}
+	}
+
+	req := appsec.Request{
+		HTTP:              r,
+		ClientIP:          clientIP,
+		RedactBodyFields:  config.redactBodyFields,
+		RedactHeaders:     config.redactHeaders,
+		RedactCookies:     sessionCookieNames,
+		RedactQueryParams: config.redactQueryParams,
+	}
+	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+		req.TransactionID = cd.GetRequestID()
+	}
+
+	result, err := mw.appsec.Inspect(r.Context(), req)
+	if err != nil {
+		mw.logger.Debugf("AppSec inspection failed for %s: %v", r.Host, err)
+	}
+	// Record when the body went uninspected: headers and URI were still
+	// checked, but an operator reading the log should not read a clean verdict
+	// as "the payload was examined". Oversize is reachable by padding, so its
+	// absence from the log would hide a deliberate opt-out.
+	if result.BodyBypass != "" {
+		if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+			cd.SetMetadata("appsec_body_bypass", result.BodyBypass)
+		}
+	}
+	return result.Verdict, result.Release
+}
+
+// credentialFormFields lists the login form fields whose values are redacted
+// from the mirrored body, so a password or PIN submitted to the proxy's own
+// login form never reaches the Security Engine.
+func credentialFormFields(schemes []Scheme) []string {
+	var fields []string
+	for _, s := range schemes {
+		switch s.Type() {
+		case auth.MethodPassword:
+			fields = append(fields, passwordFormId)
+		case auth.MethodPIN:
+			fields = append(fields, pinFormId)
+		}
+	}
+	return fields
+}
+
+// credentialHeaders lists the request headers whose values are redacted from
+// the mirrored request. A header-auth scheme carries a session token the proxy
+// validates and never forwards upstream, so the engine must not see it either.
+func credentialHeaders(schemes []Scheme) []string {
+	var names []string
+	for _, s := range schemes {
+		// Structural, not a concrete Header assertion: if the scheme is ever
+		// registered as a pointer, a type assertion would quietly stop matching
+		// and the header would start reaching the engine again.
+		named, ok := s.(interface{ HeaderName() string })
+		if !ok {
+			continue
+		}
+		if name := named.HeaderName(); name != "" {
+			names = append(names, name)
+		}
+	}
+	return names
+}
+
 // resolveClientIP extracts the real client IP from CapturedData, falling back to r.RemoteAddr.
 func (mw *Middleware) resolveClientIP(r *http.Request) netip.Addr {
 	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
@@ -281,12 +440,18 @@ func (mw *Middleware) resolveClientIP(r *http.Request) netip.Addr {
 	return addr.Unmap()
 }
 
-// blockIPRestriction sets captured data fields for an IP-restriction block event.
-func (mw *Middleware) blockIPRestriction(r *http.Request, reason string) {
+// markDenied records the deny reason on the captured data so the access log
+// attributes the response to the proxy rather than the backend.
+func (mw *Middleware) markDenied(r *http.Request, reason string) {
 	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
 		cd.SetOrigin(proxy.OriginAuth)
 		cd.SetAuthMethod(reason)
 	}
+}
+
+// blockIPRestriction sets captured data fields for an IP-restriction block event.
+func (mw *Middleware) blockIPRestriction(r *http.Request, reason string) {
+	mw.markDenied(r, reason)
 	mw.logger.Debugf("IP restriction: %s for %s", reason, r.RemoteAddr)
 }
 
@@ -637,45 +802,61 @@ func wasCredentialSubmitted(r *http.Request, method auth.Method) bool {
 	case auth.MethodPassword:
 		return r.FormValue("password") != ""
 	case auth.MethodOIDC:
-		return r.URL.Query().Get("session_token") != ""
+		return r.URL.Query().Get(sessionTokenParam) != ""
 	}
 	return false
 }
 
-// AddDomain registers authentication schemes for the given domain. With schemes a valid session public key is required.
-// private=true forces ValidateTunnelPeer enforcement (403 on failure) regardless of the schemes list.
-func (mw *Middleware) AddDomain(domain string, schemes []Scheme, publicKeyB64 string, expiration time.Duration, accountID types.AccountID, serviceID types.ServiceID, ipRestrictions *restrict.Filter, private bool) error {
-	if len(schemes) == 0 {
-		mw.domainsMux.Lock()
-		defer mw.domainsMux.Unlock()
-		mw.domains[domain] = DomainConfig{
-			AccountID:      accountID,
-			ServiceID:      serviceID,
-			IPRestrictions: ipRestrictions,
-			Private:        private,
-		}
-		return nil
+// DomainSettings is the per-domain configuration AddDomain applies.
+type DomainSettings struct {
+	Schemes []Scheme
+	// SessionPublicKey is the base64-encoded ed25519 key used to verify session
+	// cookies. Required when Schemes is non-empty.
+	SessionPublicKey  string
+	SessionExpiration time.Duration
+	AccountID         types.AccountID
+	ServiceID         types.ServiceID
+	IPRestrictions    *restrict.Filter
+	// Private forces ValidateTunnelPeer enforcement (403 on failure) regardless
+	// of the schemes list.
+	Private    bool
+	AppSecMode restrict.AppSecMode
+}
+
+// AddDomain registers authentication schemes for the given domain. With schemes
+// a valid session public key is required.
+func (mw *Middleware) AddDomain(domain string, settings DomainSettings) error {
+	credentialFields := credentialFormFields(settings.Schemes)
+	config := DomainConfig{
+		AccountID:        settings.AccountID,
+		ServiceID:        settings.ServiceID,
+		IPRestrictions:   settings.IPRestrictions,
+		Private:          settings.Private,
+		AppSecMode:       settings.AppSecMode,
+		redactBodyFields: credentialFields,
+		redactHeaders:    credentialHeaders(settings.Schemes),
+		// A credential can arrive in the query too: r.FormValue merges the URL
+		// query into the form, so "?password=..." authenticates just as a form
+		// post does and must not be mirrored in the clear either.
+		redactQueryParams: append([]string{sessionTokenParam}, credentialFields...),
 	}
 
-	pubKeyBytes, err := base64.StdEncoding.DecodeString(publicKeyB64)
-	if err != nil {
-		return fmt.Errorf("decode session public key for domain %s: %w", domain, err)
-	}
-	if len(pubKeyBytes) != ed25519.PublicKeySize {
-		return fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
+	if len(settings.Schemes) > 0 {
+		pubKeyBytes, err := base64.StdEncoding.DecodeString(settings.SessionPublicKey)
+		if err != nil {
+			return fmt.Errorf("decode session public key for domain %s: %w", domain, err)
+		}
+		if len(pubKeyBytes) != ed25519.PublicKeySize {
+			return fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
+		}
+		config.Schemes = settings.Schemes
+		config.SessionPublicKey = pubKeyBytes
+		config.SessionExpiration = settings.SessionExpiration
 	}
 
 	mw.domainsMux.Lock()
 	defer mw.domainsMux.Unlock()
-	mw.domains[domain] = DomainConfig{
-		Schemes:           schemes,
-		SessionPublicKey:  pubKeyBytes,
-		SessionExpiration: expiration,
-		AccountID:         accountID,
-		ServiceID:         serviceID,
-		IPRestrictions:    ipRestrictions,
-		Private:           private,
-	}
+	mw.domains[domain] = config
 	return nil
 }
 
@@ -730,10 +911,10 @@ func (mw *Middleware) validateSessionToken(ctx context.Context, host, token stri
 // parameter removed so it doesn't linger in the browser's address bar or history.
 func stripSessionTokenParam(u *url.URL) string {
 	q := u.Query()
-	if !q.Has("session_token") {
+	if !q.Has(sessionTokenParam) {
 		return u.RequestURI()
 	}
-	q.Del("session_token")
+	q.Del(sessionTokenParam)
 	clean := *u
 	clean.RawQuery = q.Encode()
 	return clean.RequestURI()

proxy/internal/auth/middleware_test.go

@@ -64,7 +64,7 @@ func TestAddDomain_ValidKey(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour})
 	require.NoError(t, err)
 
 	mw.domainsMux.RLock()
@@ -81,7 +81,7 @@ func TestAddDomain_EmptyKey(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, "", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionExpiration: time.Hour})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid session public key size")
 
@@ -95,7 +95,7 @@ func TestAddDomain_InvalidBase64(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, "not-valid-base64!!!", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: "not-valid-base64!!!", SessionExpiration: time.Hour})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "decode session public key")
 
@@ -110,7 +110,7 @@ func TestAddDomain_WrongKeySize(t *testing.T) {
 
 	shortKey := base64.StdEncoding.EncodeToString([]byte("tooshort"))
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, shortKey, time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: shortKey, SessionExpiration: time.Hour})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid session public key size")
 
@@ -123,7 +123,7 @@ func TestAddDomain_WrongKeySize(t *testing.T) {
 func TestAddDomain_NoSchemes_NoKeyRequired(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{SessionExpiration: time.Hour})
 	require.NoError(t, err, "domains with no auth schemes should not require a key")
 
 	mw.domainsMux.RLock()
@@ -139,8 +139,8 @@ func TestAddDomain_OverwritesPreviousConfig(t *testing.T) {
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
 
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false))
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp2.PublicKey, 2*time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp1.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp2.PublicKey, SessionExpiration: 2 * time.Hour}))
 
 	mw.domainsMux.RLock()
 	config := mw.domains["example.com"]
@@ -156,7 +156,7 @@ func TestRemoveDomain(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	mw.RemoveDomain("example.com")
 
@@ -180,7 +180,7 @@ func TestProtect_UnknownDomainPassesThrough(t *testing.T) {
 
 func TestProtect_DomainWithNoSchemesPassesThrough(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
-	require.NoError(t, mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -197,7 +197,7 @@ func TestProtect_UnauthenticatedRequestIsBlocked(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -218,7 +218,7 @@ func TestProtect_HostWithPortIsMatched(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -239,7 +239,7 @@ func TestProtect_ValidSessionCookiePassesThrough(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
 	require.NoError(t, err)
@@ -272,7 +272,7 @@ func TestProtect_SessionCookieGroupsPropagate(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	groups := []string{"engineering", "sre"}
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, groups, nil, time.Hour)
@@ -337,7 +337,7 @@ func TestProtect_PrivateService_TunnelPeerGroupsPropagate(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	// Private service: no operator schemes — auth gates solely on the tunnel peer.
-	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("agent.example.com", DomainSettings{SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
 
 	cd := proxy.NewCapturedData("")
 	cd.SetClientIP(netip.MustParseAddr("100.90.1.14")) // CGNAT tunnel source
@@ -377,7 +377,7 @@ func TestProtect_PrivateService_TunnelPeerDenied(t *testing.T) {
 	}}
 	mw := NewMiddleware(log.StandardLogger(), validator, nil)
 	kp := generateTestKeyPair(t)
-	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("agent.example.com", DomainSettings{SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
 
 	cd := proxy.NewCapturedData("")
 	cd.SetClientIP(netip.MustParseAddr("100.90.1.14"))
@@ -405,7 +405,7 @@ func TestProtect_ExpiredSessionCookieIsRejected(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	// Sign a token that expired 1 second ago.
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, -time.Second)
@@ -431,7 +431,7 @@ func TestProtect_WrongDomainCookieIsRejected(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	// Token signed for a different domain audience.
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "other.com", auth.MethodPIN, nil, nil, time.Hour)
@@ -458,7 +458,7 @@ func TestProtect_WrongKeyCookieIsRejected(t *testing.T) {
 	kp2 := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp1.PublicKey, SessionExpiration: time.Hour}))
 
 	// Token signed with a different private key.
 	token, err := sessionkey.SignToken(kp2.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
@@ -495,7 +495,7 @@ func TestProtect_SchemeAuthRedirectsWithCookie(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -548,7 +548,7 @@ func TestProtect_FailedAuthDoesNotSetCookie(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -584,7 +584,7 @@ func TestProtect_MultipleSchemes(t *testing.T) {
 			return "", "password", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{pinScheme, passwordScheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{pinScheme, passwordScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -614,7 +614,7 @@ func TestProtect_InvalidTokenFromSchemeReturns400(t *testing.T) {
 			return "invalid-jwt-token", "", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -638,7 +638,7 @@ func TestAddDomain_RandomBytes32NotEd25519(t *testing.T) {
 	key := base64.StdEncoding.EncodeToString(randomBytes)
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
 
-	err = mw.AddDomain("example.com", []Scheme{scheme}, key, time.Hour, "", "", nil, false)
+	err = mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: key, SessionExpiration: time.Hour})
 	require.NoError(t, err, "any 32-byte key should be accepted at registration time")
 }
 
@@ -647,10 +647,10 @@ func TestAddDomain_InvalidKeyDoesNotCorruptExistingConfig(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	// Attempt to overwrite with an invalid key.
-	err := mw.AddDomain("example.com", []Scheme{scheme}, "bad", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: "bad", SessionExpiration: time.Hour})
 	require.Error(t, err)
 
 	// The original valid config should still be intact.
@@ -674,7 +674,7 @@ func TestProtect_FailedPinAuthCapturesAuthMethod(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -701,7 +701,7 @@ func TestProtect_FailedPasswordAuthCapturesAuthMethod(t *testing.T) {
 			return "", "password", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -728,7 +728,7 @@ func TestProtect_NoCredentialsDoesNotCaptureAuthMethod(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -815,8 +815,7 @@ func TestWasCredentialSubmitted(t *testing.T) {
 func TestCheckIPRestrictions_UnparseableAddress(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -851,8 +850,7 @@ func TestCheckIPRestrictions_UsesCapturedDataClientIP(t *testing.T) {
 	// trusted proxies), checkIPRestrictions should use that IP, not RemoteAddr.
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"203.0.113.0/24"}}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"203.0.113.0/24"}})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -892,8 +890,7 @@ func TestCheckIPRestrictions_NilGeoWithCountryRules(t *testing.T) {
 	// Geo is nil, country restrictions are configured: must deny (fail-close).
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCountries: []string{"US"}}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCountries: []string{"US"}})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -916,11 +913,10 @@ func TestCheckIPRestrictions_NilGeoWithCountryRules(t *testing.T) {
 func TestCheckIPRestrictions_OverlayOriginSkipsCountryRules(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{
-			AllowedCIDRs:     []string{"100.64.0.0/10"},
-			AllowedCountries: []string{"US"},
-		}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{
+		AllowedCIDRs:     []string{"100.64.0.0/10"},
+		AllowedCountries: []string{"US"},
+	})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -953,8 +949,7 @@ func TestCheckIPRestrictions_OverlayOriginSkipsCountryRules(t *testing.T) {
 func TestCheckIPRestrictions_OverlayOriginRespectsCIDR(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -982,7 +977,7 @@ func TestProtect_OIDCOnlyRedirectsDirectly(t *testing.T) {
 			return "", oidcURL, nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1011,7 +1006,7 @@ func TestProtect_OIDCWithOtherMethodShowsLoginPage(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{oidcScheme, pinScheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{oidcScheme, pinScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1055,7 +1050,7 @@ func TestProtect_HeaderAuth_ForwardsOnSuccess(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	var backendCalled bool
 	capturedData := proxy.NewCapturedData("")
@@ -1098,7 +1093,7 @@ func TestProtect_HeaderAuth_MissingHeaderFallsThrough(t *testing.T) {
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
 	// Also add a PIN scheme so we can verify fallthrough behavior.
 	pinScheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr, pinScheme}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr, pinScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1118,7 +1113,7 @@ func TestProtect_HeaderAuth_WrongValueReturns401(t *testing.T) {
 		return &proto.AuthenticateResponse{Success: false}, nil
 	}}
 	hdr := NewHeader(mock, "svc1", "acc1", "X-API-Key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -1141,7 +1136,7 @@ func TestProtect_HeaderAuth_InfraErrorReturns502(t *testing.T) {
 		return nil, errors.New("gRPC unavailable")
 	}}
 	hdr := NewHeader(mock, "svc1", "acc1", "X-API-Key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1158,7 +1153,7 @@ func TestProtect_HeaderAuth_SubsequentRequestUsesSessionCookie(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
@@ -1218,7 +1213,7 @@ func TestProtect_HeaderAuth_MultipleValuesSameHeader(t *testing.T) {
 
 	// Single Header scheme (as if one entry existed), but the mock checks both values.
 	hdr := NewHeader(mock, "svc1", "acc1", "Authorization")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	var backendCalled bool
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -1276,7 +1271,7 @@ func TestProtect_OIDCOnPlainHTTP_BlockedWith400(t *testing.T) {
 			return "", "https://idp.example.com/authorize", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1300,7 +1295,7 @@ func TestProtect_OIDCOverTLS_NotBlocked(t *testing.T) {
 			return "", "https://idp.example.com/authorize", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1320,7 +1315,7 @@ func TestProtect_NonOIDCSchemes_PlainHTTP_NotBlocked(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1350,7 +1345,7 @@ func TestProtect_TunnelPeerFastPath_RequiresInboundMarker(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1385,7 +1380,7 @@ func TestProtect_TunnelPeerFastPath_TakesPathWithInboundMarker(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 

proxy/internal/auth/oidc.go

@@ -13,6 +13,10 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
+// sessionTokenParam is the query parameter the management server uses to hand
+// the minted session token back to the proxy after an OIDC login.
+const sessionTokenParam = "session_token"
+
 type urlGenerator interface {
 	GetOIDCURL(context.Context, *proto.GetOIDCURLRequest, ...grpc.CallOption) (*proto.GetOIDCURLResponse, error)
 }
@@ -43,7 +47,7 @@ func (o OIDC) Authenticate(r *http.Request) (string, string, error) {
 	// Check for the session_token query param (from OIDC redirects).
 	// The management server passes the token in the URL because it cannot set
 	// cookies for the proxy's domain (cookies are domain-scoped per RFC 6265).
-	if token := r.URL.Query().Get("session_token"); token != "" {
+	if token := r.URL.Query().Get(sessionTokenParam); token != "" {
 		return token, "", nil
 	}
 

proxy/internal/auth/tunnel_lookup_test.go

@@ -44,7 +44,7 @@ func (s *stubSessionValidator) ValidateTunnelPeer(_ context.Context, in *proto.V
 func newTunnelMiddleware(t *testing.T, validator SessionValidator) *Middleware {
 	t.Helper()
 	mw := NewMiddleware(log.New(), validator, nil)
-	require.NoError(t, mw.AddDomain("svc.example", nil, "", 0, "acct-1", "svc-1", nil, false))
+	require.NoError(t, mw.AddDomain("svc.example", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1"}))
 	return mw
 }
 
@@ -235,8 +235,8 @@ func TestForwardWithTunnelPeer_RoutesAccountIDIntoCacheKey(t *testing.T) {
 	}
 	mw := NewMiddleware(log.New(), validator, nil)
 
-	require.NoError(t, mw.AddDomain("svc-a.example", nil, "", 0, "acct-a", "svc-a", nil, false))
-	require.NoError(t, mw.AddDomain("svc-b.example", nil, "", 0, "acct-b", "svc-b", nil, false))
+	require.NoError(t, mw.AddDomain("svc-a.example", DomainSettings{AccountID: "acct-a", ServiceID: "svc-a"}))
+	require.NoError(t, mw.AddDomain("svc-b.example", DomainSettings{AccountID: "acct-b", ServiceID: "svc-b"}))
 
 	// The fast-path requires the inbound-listener marker on the context.
 	// The peerstore lookup itself is account-agnostic at this level
@@ -299,7 +299,7 @@ func TestForwardWithTunnelPeer_LocalLookupShortCircuitDoesNotPopulateCache(t *te
 
 func TestPrivateService_FailsClosedOnTunnelPeerFailure(t *testing.T) {
 	mw := NewMiddleware(log.New(), nil, nil)
-	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("private.svc", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
 
 	called := false
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -328,7 +328,7 @@ func TestPrivateService_ForwardsOnTunnelPeerSuccess(t *testing.T) {
 		},
 	}
 	mw := NewMiddleware(log.New(), validator, nil)
-	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("private.svc", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
 
 	called := false
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {

proxy/internal/llm/pricing/defaults_coverage_test.go

@@ -28,12 +28,12 @@ func TestDefaultTable_FirstPartyModelCoverage(t *testing.T) {
 			"ministral-8b-latest", "mistral-embed",
 		},
 		"anthropic": {
-			"claude-fable-5", "claude-opus-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6",
+			"claude-fable-5", "claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6",
 			"claude-opus-4-1", "claude-sonnet-4-6", "claude-sonnet-4-5", "claude-haiku-4-5",
 		},
 		// bedrock keys are the normalized ids the request parser emits.
 		"bedrock": {
-			"anthropic.claude-opus-5", "anthropic.claude-opus-4-8", "anthropic.claude-opus-4-7", "anthropic.claude-opus-4-6",
+			"anthropic.claude-opus-4-8", "anthropic.claude-opus-4-7", "anthropic.claude-opus-4-6",
 			"anthropic.claude-opus-4-1", "anthropic.claude-sonnet-4-6", "anthropic.claude-sonnet-4-5",
 			"anthropic.claude-haiku-4-5", "meta.llama3-3-70b-instruct",
 			"amazon.nova-pro", "amazon.nova-lite", "amazon.nova-micro", "amazon.nova-2-lite",

proxy/internal/llm/pricing/defaults_pricing.yaml

@@ -180,11 +180,6 @@ anthropic:
     output_per_1k: 0.050
     cache_read_per_1k: 0.001
     cache_creation_per_1k: 0.0125
-  claude-opus-5:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
   claude-opus-4-8:
     input_per_1k: 0.005
     output_per_1k: 0.025
@@ -241,11 +236,6 @@ bedrock:
   # eu.anthropic.claude-sonnet-4-5-20250929-v1:0 -> anthropic.claude-sonnet-4-5.
   # Anthropic-on-Bedrock keeps the additive cache buckets (read ≈0.1x input,
   # write ≈1.25x input); Nova / Llama report no cache, so cost is input+output.
-  anthropic.claude-opus-5:
-    input_per_1k: 0.005
-    output_per_1k: 0.025
-    cache_read_per_1k: 0.0005
-    cache_creation_per_1k: 0.00625
   anthropic.claude-opus-4-8:
     input_per_1k: 0.005
     output_per_1k: 0.025

proxy/internal/middleware/bodytap/request.go

@@ -21,6 +21,8 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+
+	"github.com/netbirdio/netbird/proxy/internal/netutil"
 )
 
 // MaxRoutingScanBytes bounds how far ScanRoutingFields will read into a
@@ -34,7 +36,6 @@ const MaxRoutingScanBytes int64 = 32 << 20
 // metadata key by the chain when a request body is not surfaced.
 const (
 	BypassUpgradeHeader    = "upgrade_header"
-	BypassConnectionUpgrd  = "connection_upgrade"
 	BypassContentType      = "content_type_not_allowed"
 	BypassBudget           = "capture_budget_exhausted"
 	BypassNoConfig         = "no_capture_config"
@@ -125,12 +126,13 @@ func CaptureRequest(r *http.Request, cfg *Config, b Budget) (body []byte, trunca
 	if cfg.MaxRequestBytes <= 0 {
 		return nil, false, 0, BypassCapZero, release, nil
 	}
-	if r.Header.Get("Upgrade") != "" {
+	// The predicate has to be the forwarder's own: a looser one (either header
+	// on its own) skips capture for requests the forwarder still delivers to
+	// the upstream with their body intact, which hides them from every
+	// deny-capable middleware in the chain.
+	if netutil.IsUpgradeRequest(r.Header) {
 		return nil, false, 0, BypassUpgradeHeader, release, nil
 	}
-	if strings.EqualFold(r.Header.Get("Connection"), "upgrade") {
-		return nil, false, 0, BypassConnectionUpgrd, release, nil
-	}
 	if !contentTypeAllowed(r.Header.Get("Content-Type"), cfg.ContentTypes) {
 		return nil, false, 0, BypassContentType, release, nil
 	}

proxy/internal/netutil/upgrade.go

@@ -0,0 +1,23 @@
+package netutil
+
+import (
+	"net/http"
+
+	"golang.org/x/net/http/httpguts"
+)
+
+// IsUpgradeRequest reports whether r is a protocol-upgrade request, using the
+// same predicate httputil.ReverseProxy applies when it decides to hand the
+// connection over instead of proxying normally.
+//
+// Matching the forwarder exactly matters for anything that inspects a request
+// before it is proxied: a looser test (an Upgrade header on its own, say) marks
+// a request as an upgrade and skips inspection, while the forwarder still
+// delivers it to the backend as an ordinary request with its body intact. That
+// gap is a body-inspection bypass reachable by adding one header.
+func IsUpgradeRequest(h http.Header) bool {
+	if !httpguts.HeaderValuesContainsToken(h["Connection"], "Upgrade") {
+		return false
+	}
+	return h.Get("Upgrade") != ""
+}

proxy/internal/restrict/restrict.go

@@ -50,6 +50,37 @@ const (
 	CrowdSecObserve CrowdSecMode = "observe"
 )
 
+// AppSecMode is the per-service CrowdSec AppSec (WAF) enforcement mode.
+type AppSecMode string
+
+const (
+	// AppSecOff disables request inspection.
+	AppSecOff AppSecMode = ""
+	// AppSecEnforce blocks requests the engine flags, and fails closed when the
+	// engine is unreachable.
+	AppSecEnforce AppSecMode = "enforce"
+	// AppSecObserve records the verdict without blocking.
+	AppSecObserve AppSecMode = "observe"
+)
+
+// ParseAppSecMode maps a wire value to an AppSecMode. Unrecognized values map
+// to AppSecOff so a typo never turns inspection into an unintended block.
+func ParseAppSecMode(s string) AppSecMode {
+	switch AppSecMode(s) {
+	case AppSecEnforce:
+		return AppSecEnforce
+	case AppSecObserve:
+		return AppSecObserve
+	default:
+		return AppSecOff
+	}
+}
+
+// Enabled reports whether the mode asks for request inspection.
+func (m AppSecMode) Enabled() bool {
+	return m == AppSecEnforce || m == AppSecObserve
+}
+
 // Filter evaluates IP restrictions. CIDR checks are performed first
 // (cheap), followed by country lookups (more expensive) only when needed.
 type Filter struct {
@@ -146,6 +177,13 @@ const (
 	// DenyCrowdSecUnavailable indicates enforce mode but the bouncer has not
 	// completed its initial sync.
 	DenyCrowdSecUnavailable
+	// DenyAppSecBan indicates a CrowdSec AppSec "ban" remediation.
+	DenyAppSecBan
+	// DenyAppSecCaptcha indicates a CrowdSec AppSec "captcha" remediation.
+	DenyAppSecCaptcha
+	// DenyAppSecUnavailable indicates enforce mode but the AppSec engine could
+	// not produce a verdict (unreachable, timed out, or it rejected the call).
+	DenyAppSecUnavailable
 )
 
 // String returns the deny reason string matching the HTTP auth mechanism names.
@@ -167,6 +205,12 @@ func (v Verdict) String() string {
 		return "crowdsec_throttle"
 	case DenyCrowdSecUnavailable:
 		return "crowdsec_unavailable"
+	case DenyAppSecBan:
+		return "appsec_ban"
+	case DenyAppSecCaptcha:
+		return "appsec_captcha"
+	case DenyAppSecUnavailable:
+		return "appsec_unavailable"
 	default:
 		return "unknown"
 	}
@@ -182,6 +226,16 @@ func (v Verdict) IsCrowdSec() bool {
 	}
 }
 
+// IsAppSec returns true when the verdict originates from an AppSec inspection.
+func (v Verdict) IsAppSec() bool {
+	switch v {
+	case DenyAppSecBan, DenyAppSecCaptcha, DenyAppSecUnavailable:
+		return true
+	default:
+		return false
+	}
+}
+
 // IsObserveOnly returns true when v is a CrowdSec verdict and the filter is in
 // observe mode. Callers should log the verdict but not block the request.
 func (f *Filter) IsObserveOnly(v Verdict) bool {

proxy/lifecycle.go

@@ -126,6 +126,23 @@ type Config struct {
 	// CrowdSecAPIKey is the CrowdSec bouncer API key. Empty disables
 	// CrowdSec.
 	CrowdSecAPIKey string
+	// CrowdSecAppSecURL is the CrowdSec AppSec (WAF) endpoint. Empty disables
+	// HTTP request inspection.
+	CrowdSecAppSecURL string
+	// CrowdSecAppSecTimeout bounds a single AppSec inspection call. Zero falls
+	// back to the internal default.
+	CrowdSecAppSecTimeout time.Duration
+	// CrowdSecAppSecMaxBodyBytes caps the request body mirrored to AppSec.
+	// Zero falls back to the internal default; negative forwards no body.
+	CrowdSecAppSecMaxBodyBytes int64
+	// CrowdSecAppSecMaxConcurrent bounds AppSec inspections in flight toward
+	// the engine. Zero falls back to the internal default; negative removes
+	// the bound.
+	CrowdSecAppSecMaxConcurrent int
+	// MiddlewareCaptureBudgetBytes bounds the total request-body buffering in
+	// flight across the proxy, shared by AppSec inspection and the
+	// agent-network capture. Zero falls back to the internal default.
+	MiddlewareCaptureBudgetBytes int64
 }
 
 // New builds a Server from cfg without performing any I/O. No goroutines
@@ -135,42 +152,47 @@ type Config struct {
 // directly) byte-for-byte equivalent.
 func New(ctx context.Context, cfg Config) *Server {
 	return &Server{
-		ctx:                      ctx,
-		ListenAddr:               cfg.ListenAddr,
-		ID:                       cfg.ID,
-		Logger:                   cfg.Logger,
-		Version:                  cfg.Version,
-		ProxyURL:                 cfg.ProxyURL,
-		ManagementAddress:        cfg.ManagementAddress,
-		ProxyToken:               cfg.ProxyToken,
-		CertificateDirectory:     cfg.CertificateDirectory,
-		CertificateFile:          cfg.CertificateFile,
-		CertificateKeyFile:       cfg.CertificateKeyFile,
-		GenerateACMECertificates: cfg.GenerateACMECertificates,
-		ACMEChallengeAddress:     cfg.ACMEChallengeAddress,
-		ACMEDirectory:            cfg.ACMEDirectory,
-		ACMEEABKID:               cfg.ACMEEABKID,
-		ACMEEABHMACKey:           cfg.ACMEEABHMACKey,
-		ACMEChallengeType:        cfg.ACMEChallengeType,
-		CertLockMethod:           cfg.CertLockMethod,
-		WildcardCertDir:          cfg.WildcardCertDir,
-		DebugEndpointEnabled:     cfg.DebugEndpointEnabled,
-		DebugEndpointAddress:     cfg.DebugEndpointAddress,
-		HealthAddress:            cfg.HealthAddr,
-		ForwardedProto:           cfg.ForwardedProto,
-		TrustedProxies:           cfg.TrustedProxies,
-		WireguardPort:            cfg.WireguardPort,
-		ProxyProtocol:            cfg.ProxyProtocol,
-		PreSharedKey:             cfg.PreSharedKey,
-		Performance:              cfg.Performance,
-		SupportsCustomPorts:      cfg.SupportsCustomPorts,
-		RequireSubdomain:         cfg.RequireSubdomain,
-		Private:                  cfg.Private,
-		MaxDialTimeout:           cfg.MaxDialTimeout,
-		MaxSessionIdleTimeout:    cfg.MaxSessionIdleTimeout,
-		MappingBatchWatchdog:     cfg.MappingBatchWatchdog,
-		GeoDataDir:               cfg.GeoDataDir,
-		CrowdSecAPIURL:           cfg.CrowdSecAPIURL,
-		CrowdSecAPIKey:           cfg.CrowdSecAPIKey,
+		ctx:                          ctx,
+		ListenAddr:                   cfg.ListenAddr,
+		ID:                           cfg.ID,
+		Logger:                       cfg.Logger,
+		Version:                      cfg.Version,
+		ProxyURL:                     cfg.ProxyURL,
+		ManagementAddress:            cfg.ManagementAddress,
+		ProxyToken:                   cfg.ProxyToken,
+		CertificateDirectory:         cfg.CertificateDirectory,
+		CertificateFile:              cfg.CertificateFile,
+		CertificateKeyFile:           cfg.CertificateKeyFile,
+		GenerateACMECertificates:     cfg.GenerateACMECertificates,
+		ACMEChallengeAddress:         cfg.ACMEChallengeAddress,
+		ACMEDirectory:                cfg.ACMEDirectory,
+		ACMEEABKID:                   cfg.ACMEEABKID,
+		ACMEEABHMACKey:               cfg.ACMEEABHMACKey,
+		ACMEChallengeType:            cfg.ACMEChallengeType,
+		CertLockMethod:               cfg.CertLockMethod,
+		WildcardCertDir:              cfg.WildcardCertDir,
+		DebugEndpointEnabled:         cfg.DebugEndpointEnabled,
+		DebugEndpointAddress:         cfg.DebugEndpointAddress,
+		HealthAddress:                cfg.HealthAddr,
+		ForwardedProto:               cfg.ForwardedProto,
+		TrustedProxies:               cfg.TrustedProxies,
+		WireguardPort:                cfg.WireguardPort,
+		ProxyProtocol:                cfg.ProxyProtocol,
+		PreSharedKey:                 cfg.PreSharedKey,
+		Performance:                  cfg.Performance,
+		SupportsCustomPorts:          cfg.SupportsCustomPorts,
+		RequireSubdomain:             cfg.RequireSubdomain,
+		Private:                      cfg.Private,
+		MaxDialTimeout:               cfg.MaxDialTimeout,
+		MaxSessionIdleTimeout:        cfg.MaxSessionIdleTimeout,
+		MappingBatchWatchdog:         cfg.MappingBatchWatchdog,
+		GeoDataDir:                   cfg.GeoDataDir,
+		CrowdSecAPIURL:               cfg.CrowdSecAPIURL,
+		CrowdSecAPIKey:               cfg.CrowdSecAPIKey,
+		CrowdSecAppSecURL:            cfg.CrowdSecAppSecURL,
+		CrowdSecAppSecTimeout:        cfg.CrowdSecAppSecTimeout,
+		CrowdSecAppSecMaxBodyBytes:   cfg.CrowdSecAppSecMaxBodyBytes,
+		CrowdSecAppSecMaxConcurrent:  cfg.CrowdSecAppSecMaxConcurrent,
+		MiddlewareCaptureBudgetBytes: cfg.MiddlewareCaptureBudgetBytes,
 	}
 }

proxy/lifecycle_test.go

@@ -0,0 +1,45 @@
+package proxy
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// New maps Config onto Server field by field, and a field left out of that
+// literal still compiles: the knob is simply parsed and then dropped, so an
+// operator setting it sees the default with no error anywhere. These assertions
+// are the only thing standing between a new setting and that silent no-op.
+func TestNew_ForwardsOperatorTuning(t *testing.T) {
+	cfg := Config{
+		ManagementAddress:            "http://localhost:8080",
+		ProxyToken:                   "token",
+		CrowdSecAPIURL:               "http://crowdsec:8080/",
+		CrowdSecAPIKey:               "key",
+		CrowdSecAppSecURL:            "http://crowdsec:7422/",
+		CrowdSecAppSecTimeout:        321 * time.Millisecond,
+		CrowdSecAppSecMaxBodyBytes:   4321,
+		CrowdSecAppSecMaxConcurrent:  17,
+		MiddlewareCaptureBudgetBytes: 5 << 20,
+		MaxDialTimeout:               7 * time.Second,
+		MaxSessionIdleTimeout:        11 * time.Second,
+		GeoDataDir:                   "/var/lib/geo",
+	}
+
+	srv := New(context.Background(), cfg)
+	require.NotNil(t, srv)
+
+	assert.Equal(t, cfg.CrowdSecAPIURL, srv.CrowdSecAPIURL)
+	assert.Equal(t, cfg.CrowdSecAPIKey, srv.CrowdSecAPIKey)
+	assert.Equal(t, cfg.CrowdSecAppSecURL, srv.CrowdSecAppSecURL)
+	assert.Equal(t, cfg.CrowdSecAppSecTimeout, srv.CrowdSecAppSecTimeout)
+	assert.Equal(t, cfg.CrowdSecAppSecMaxBodyBytes, srv.CrowdSecAppSecMaxBodyBytes)
+	assert.Equal(t, cfg.CrowdSecAppSecMaxConcurrent, srv.CrowdSecAppSecMaxConcurrent)
+	assert.Equal(t, cfg.MiddlewareCaptureBudgetBytes, srv.MiddlewareCaptureBudgetBytes)
+	assert.Equal(t, cfg.MaxDialTimeout, srv.MaxDialTimeout)
+	assert.Equal(t, cfg.MaxSessionIdleTimeout, srv.MaxSessionIdleTimeout)
+	assert.Equal(t, cfg.GeoDataDir, srv.GeoDataDir)
+}

proxy/management_integration_test.go

@@ -240,6 +240,10 @@ func (m *testProxyManager) ClusterSupportsCrowdSec(_ context.Context, _ string)
 	return nil
 }
 
+func (m *testProxyManager) ClusterSupportsAppSec(_ context.Context, _ string) *bool {
+	return nil
+}
+
 func (m *testProxyManager) ClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }
@@ -562,16 +566,11 @@ func TestIntegration_ProxyConnection_ReconnectDoesNotDuplicateState(t *testing.T
 				addMappingCalls.Add(1)
 
 				// Apply to real auth middleware (idempotent)
-				err := authMw.AddDomain(
-					mapping.GetDomain(),
-					nil,
-					"",
-					0,
-					proxytypes.AccountID(mapping.GetAccountId()),
-					proxytypes.ServiceID(mapping.GetId()),
-					nil,
-					mapping.GetPrivate(),
-				)
+				err := authMw.AddDomain(mapping.GetDomain(), auth.DomainSettings{
+					AccountID: proxytypes.AccountID(mapping.GetAccountId()),
+					ServiceID: proxytypes.ServiceID(mapping.GetId()),
+					Private:   mapping.GetPrivate(),
+				})
 				require.NoError(t, err)
 
 				// Apply to real proxy (idempotent)

proxy/server.go

@@ -45,6 +45,7 @@ import (
 	"github.com/netbirdio/netbird/client/embed"
 	"github.com/netbirdio/netbird/proxy/internal/accesslog"
 	"github.com/netbirdio/netbird/proxy/internal/acme"
+	"github.com/netbirdio/netbird/proxy/internal/appsec"
 	"github.com/netbirdio/netbird/proxy/internal/auth"
 	"github.com/netbirdio/netbird/proxy/internal/certwatch"
 	"github.com/netbirdio/netbird/proxy/internal/conntrack"
@@ -126,6 +127,10 @@ type Server struct {
 	crowdsecMu       sync.Mutex
 	crowdsecServices map[types.ServiceID]bool
 
+	// appsecClient is the shared CrowdSec AppSec client, nil when no AppSec
+	// endpoint is configured. Stateless, so it needs no per-service lifecycle.
+	appsecClient *appsec.Client
+
 	// routerReady is closed once mainRouter is fully initialized.
 	// The mapping worker waits on this before processing updates.
 	routerReady chan struct{}
@@ -238,6 +243,20 @@ type Server struct {
 	CrowdSecAPIURL string
 	// CrowdSecAPIKey is the CrowdSec bouncer API key. Empty disables CrowdSec.
 	CrowdSecAPIKey string
+	// CrowdSecAppSecURL is the CrowdSec AppSec (WAF) endpoint, e.g.
+	// http://127.0.0.1:7422/. Empty disables request inspection. Requires
+	// CrowdSecAPIKey, which the AppSec component validates against LAPI.
+	CrowdSecAppSecURL string
+	// CrowdSecAppSecTimeout bounds a single AppSec inspection call.
+	// Zero means appsec.DefaultTimeout.
+	CrowdSecAppSecTimeout time.Duration
+	// CrowdSecAppSecMaxBodyBytes caps the request body mirrored to the AppSec
+	// engine. Zero means appsec.DefaultMaxBodyBytes; negative disables body
+	// forwarding, leaving header and URI inspection.
+	CrowdSecAppSecMaxBodyBytes int64
+	// CrowdSecAppSecMaxConcurrent bounds AppSec inspections in flight. Zero
+	// means appsec.DefaultMaxConcurrent; negative removes the bound.
+	CrowdSecAppSecMaxConcurrent int
 	// MaxSessionIdleTimeout caps the per-service session idle timeout.
 	// Zero means no cap (the proxy honors whatever management sends).
 	// Set via NB_PROXY_MAX_SESSION_IDLE_TIMEOUT for shared deployments.
@@ -384,6 +403,13 @@ func (s *Server) Start(ctx context.Context) error {
 
 	s.crowdsecRegistry = crowdsec.NewRegistry(s.CrowdSecAPIURL, s.CrowdSecAPIKey, log.NewEntry(s.Logger))
 	s.crowdsecServices = make(map[types.ServiceID]bool)
+	// Must precede the mapping worker: the worker opens the management stream
+	// and reports proxyCapabilities, which reads appsecClient. Building it
+	// afterwards would both race the read and, when the worker won, advertise
+	// the proxy as AppSec-incapable for the lifetime of that stream.
+	if err := s.initAppSec(); err != nil {
+		return err
+	}
 
 	go s.newManagementMappingWorker(runCtx, s.mgmtClient)
 
@@ -411,6 +437,7 @@ func (s *Server) Start(ctx context.Context) error {
 	}()
 
 	s.auth = auth.NewMiddleware(s.Logger, s.mgmtClient, s.geo)
+	s.auth.SetAppSec(s.appsecClient)
 	s.accessLog = accesslog.NewLogger(s.mgmtClient, s.Logger, s.TrustedProxies)
 
 	s.startDebugEndpoint()
@@ -1274,6 +1301,7 @@ func (s *Server) newManagementMappingWorker(ctx context.Context, client proto.Pr
 
 func (s *Server) proxyCapabilities() *proto.ProxyCapabilities {
 	supportsCrowdSec := s.crowdsecRegistry.Available()
+	supportsAppSec := s.appsecClient != nil
 	privateCapability := s.Private
 	// Always true: this build enforces ProxyMapping.private via the auth middleware.
 	supportsPrivateService := true
@@ -1281,6 +1309,7 @@ func (s *Server) proxyCapabilities() *proto.ProxyCapabilities {
 		SupportsCustomPorts:    &s.SupportsCustomPorts,
 		RequireSubdomain:       &s.RequireSubdomain,
 		SupportsCrowdsec:       &supportsCrowdSec,
+		SupportsAppsec:         &supportsAppSec,
 		Private:                &privateCapability,
 		SupportsPrivateService: &supportsPrivateService,
 	}
@@ -1908,6 +1937,67 @@ func (s *Server) parseRestrictions(mapping *proto.ProxyMapping) *restrict.Filter
 	})
 }
 
+// initAppSec builds the shared AppSec client when an endpoint is configured.
+// A configured-but-invalid endpoint is a startup error rather than a silent
+// downgrade: services asking for enforce would otherwise fail closed on every
+// request with no indication why.
+//
+// Runs before the management stream opens so the reported capability is stable;
+// the auth middleware picks the client up separately once it exists.
+func (s *Server) initAppSec() error {
+	if s.CrowdSecAppSecURL == "" {
+		return nil
+	}
+	if s.CrowdSecAPIKey == "" {
+		return errors.New("crowdsec appsec url is set but the crowdsec api key is empty")
+	}
+
+	// Share the middleware capture budget rather than opening a second pool:
+	// AppSec buffers before authentication, so its ceiling has to count against
+	// the same proxy-wide allowance the body tap draws from.
+	var budget appsec.Budget
+	if s.middlewareManager != nil {
+		budget = s.middlewareManager.Budget()
+	}
+
+	client, err := appsec.New(appsec.Config{
+		URL:           s.CrowdSecAppSecURL,
+		APIKey:        s.CrowdSecAPIKey,
+		Timeout:       s.CrowdSecAppSecTimeout,
+		MaxBodyBytes:  s.CrowdSecAppSecMaxBodyBytes,
+		MaxConcurrent: s.CrowdSecAppSecMaxConcurrent,
+		Budget:        budget,
+		Logger:        log.NewEntry(s.Logger),
+	})
+	if err != nil {
+		return fmt.Errorf("init crowdsec appsec: %w", err)
+	}
+
+	s.appsecClient = client
+	s.Logger.Infof("CrowdSec AppSec inspection available at %s", s.CrowdSecAppSecURL)
+	return nil
+}
+
+// appSecMode resolves the per-service AppSec mode. A service asking for
+// inspection on a proxy with no AppSec endpoint keeps its mode so the auth
+// middleware fails closed for enforce, mirroring the CrowdSec behavior.
+func (s *Server) appSecMode(mapping *proto.ProxyMapping) restrict.AppSecMode {
+	raw := mapping.GetAccessRestrictions().GetAppsecMode()
+	mode := restrict.ParseAppSecMode(raw)
+	// An unrecognized value disables inspection, which is the safe default but a
+	// silent one: with a newer management and an older proxy, a mode this build
+	// does not know would look identical to "off" on a service the operator set
+	// to enforce. Say so rather than leaving it to be discovered.
+	if mode == restrict.AppSecOff && raw != "" && raw != "off" {
+		s.Logger.Warnf("service %s requests unrecognized AppSec mode %q; this build supports %q and %q, so inspection is disabled",
+			mapping.GetId(), raw, restrict.AppSecEnforce, restrict.AppSecObserve)
+	}
+	if mode.Enabled() && s.appsecClient == nil {
+		s.Logger.Warnf("service %s requests AppSec mode %q but proxy has no AppSec endpoint configured", mapping.GetId(), mode)
+	}
+	return mode
+}
+
 // releaseCrowdSec releases the CrowdSec bouncer reference for the given
 // service if it had one.
 func (s *Server) releaseCrowdSec(svcID types.ServiceID) {
@@ -2074,7 +2164,17 @@ func (s *Server) updateMapping(ctx context.Context, mapping *proto.ProxyMapping)
 	s.warnIfGeoUnavailable(mapping.GetDomain(), mapping.GetAccessRestrictions())
 
 	maxSessionAge := time.Duration(mapping.GetAuth().GetMaxSessionAgeSeconds()) * time.Second
-	if err := s.auth.AddDomain(mapping.GetDomain(), schemes, mapping.GetAuth().GetSessionKey(), maxSessionAge, accountID, svcID, ipRestrictions, mapping.GetPrivate()); err != nil {
+	settings := auth.DomainSettings{
+		Schemes:           schemes,
+		SessionPublicKey:  mapping.GetAuth().GetSessionKey(),
+		SessionExpiration: maxSessionAge,
+		AccountID:         accountID,
+		ServiceID:         svcID,
+		IPRestrictions:    ipRestrictions,
+		Private:           mapping.GetPrivate(),
+		AppSecMode:        s.appSecMode(mapping),
+	}
+	if err := s.auth.AddDomain(mapping.GetDomain(), settings); err != nil {
 		return fmt.Errorf("auth setup for domain %s: %w", mapping.GetDomain(), err)
 	}
 	m := s.protoToMapping(ctx, mapping)

shared/management/http/api/openapi.yml

@@ -3379,6 +3379,18 @@ components:
             - "observe"
           default: "off"
           description: CrowdSec IP reputation mode. Only available when the proxy cluster supports CrowdSec.
+        appsec_mode:
+          type: string
+          enum:
+            - "off"
+            - "enforce"
+            - "observe"
+          default: "off"
+          description: >-
+            CrowdSec AppSec (WAF) request inspection mode. Only available when
+            the proxy cluster supports AppSec, and only applied to HTTP
+            services. "enforce" blocks requests the WAF flags; "observe" records
+            the verdict in the access log without blocking.
     PasswordAuthConfig:
       type: object
       properties:
@@ -3515,6 +3527,10 @@ components:
           type: boolean
           description: Whether all active proxies in the cluster have CrowdSec configured
           example: false
+        supports_appsec:
+          type: boolean
+          description: Whether all active proxies in the cluster have a CrowdSec AppSec (WAF) endpoint configured
+          example: false
         private:
           type: boolean
           description: True when at least one connected proxy in this cluster is running embedded in a netbird client (`netbird proxy`) and serving over a WireGuard tunnel. Lets the dashboard distinguish per-peer / private clusters from centralised ones.
@@ -3574,6 +3590,10 @@ components:
           type: boolean
           description: Whether the proxy cluster has CrowdSec configured
           example: false
+        supports_appsec:
+          type: boolean
+          description: Whether the proxy cluster has a CrowdSec AppSec (WAF) endpoint configured
+          example: false
         supports_private:
           type: boolean
           description: Whether the proxy cluster supports private (NetBird-only) services. True when at least one connected proxy in the cluster runs embedded in a netbird client.

shared/management/http/api/types.gen.go

@@ -17,6 +17,27 @@ const (
 	TokenAuthScopes  tokenAuthContextKey  = "TokenAuth.Scopes"
 )
 
+// Defines values for AccessRestrictionsAppsecMode.
+const (
+	AccessRestrictionsAppsecModeEnforce AccessRestrictionsAppsecMode = "enforce"
+	AccessRestrictionsAppsecModeObserve AccessRestrictionsAppsecMode = "observe"
+	AccessRestrictionsAppsecModeOff     AccessRestrictionsAppsecMode = "off"
+)
+
+// Valid indicates whether the value is a known member of the AccessRestrictionsAppsecMode enum.
+func (e AccessRestrictionsAppsecMode) Valid() bool {
+	switch e {
+	case AccessRestrictionsAppsecModeEnforce:
+		return true
+	case AccessRestrictionsAppsecModeObserve:
+		return true
+	case AccessRestrictionsAppsecModeOff:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for AccessRestrictionsCrowdsecMode.
 const (
 	AccessRestrictionsCrowdsecModeEnforce AccessRestrictionsCrowdsecMode = "enforce"
@@ -1540,6 +1561,9 @@ type AccessRestrictions struct {
 	// AllowedCountries ISO 3166-1 alpha-2 country codes to allow. If non-empty, only these countries are permitted.
 	AllowedCountries *[]string `json:"allowed_countries,omitempty"`
 
+	// AppsecMode CrowdSec AppSec (WAF) request inspection mode. Only available when the proxy cluster supports AppSec, and only applied to HTTP services. "enforce" blocks requests the WAF flags; "observe" records the verdict in the access log without blocking.
+	AppsecMode *AccessRestrictionsAppsecMode `json:"appsec_mode,omitempty"`
+
 	// BlockedCidrs CIDR blocklist. Connections from these CIDRs are rejected. Evaluated after allowed_cidrs.
 	BlockedCidrs *[]string `json:"blocked_cidrs,omitempty"`
 
@@ -1550,6 +1574,9 @@ type AccessRestrictions struct {
 	CrowdsecMode *AccessRestrictionsCrowdsecMode `json:"crowdsec_mode,omitempty"`
 }
 
+// AccessRestrictionsAppsecMode CrowdSec AppSec (WAF) request inspection mode. Only available when the proxy cluster supports AppSec, and only applied to HTTP services. "enforce" blocks requests the WAF flags; "observe" records the verdict in the access log without blocking.
+type AccessRestrictionsAppsecMode string
+
 // AccessRestrictionsCrowdsecMode CrowdSec IP reputation mode. Only available when the proxy cluster supports CrowdSec.
 type AccessRestrictionsCrowdsecMode string
 
@@ -4728,6 +4755,9 @@ type ProxyCluster struct {
 	// RequireSubdomain Whether services on this cluster must include a subdomain label
 	RequireSubdomain *bool `json:"require_subdomain,omitempty"`
 
+	// SupportsAppsec Whether all active proxies in the cluster have a CrowdSec AppSec (WAF) endpoint configured
+	SupportsAppsec *bool `json:"supports_appsec,omitempty"`
+
 	// SupportsCrowdsec Whether all active proxies in the cluster have CrowdSec configured
 	SupportsCrowdsec *bool `json:"supports_crowdsec,omitempty"`
 
@@ -4796,6 +4826,9 @@ type ReverseProxyDomain struct {
 	// RequireSubdomain Whether a subdomain label is required in front of this domain. When true, the domain cannot be used bare.
 	RequireSubdomain *bool `json:"require_subdomain,omitempty"`
 
+	// SupportsAppsec Whether the proxy cluster has a CrowdSec AppSec (WAF) endpoint configured
+	SupportsAppsec *bool `json:"supports_appsec,omitempty"`
+
 	// SupportsCrowdsec Whether the proxy cluster has CrowdSec configured
 	SupportsCrowdsec *bool `json:"supports_crowdsec,omitempty"`
 

shared/management/proto/proxy_service.proto

@@ -73,6 +73,10 @@ message ProxyCapabilities {
   optional bool private = 4;
   // Whether the proxy enforces ProxyMapping.private (fails closed on ValidateTunnelPeer failure). Management MUST NOT stream private mappings to proxies that don't claim this.
   optional bool supports_private_service = 5;
+  // Whether the proxy has a CrowdSec AppSec (WAF) endpoint configured and can
+  // inspect HTTP requests. Independent of supports_crowdsec: AppSec is a
+  // separate endpoint on the Security Engine and applies to HTTP services only.
+  optional bool supports_appsec = 6;
 }
 
 // GetMappingUpdateRequest is sent to initialise a mapping stream.
@@ -203,6 +207,10 @@ message AccessRestrictions {
   repeated string blocked_countries = 4;
   // CrowdSec IP reputation mode: "", "off", "enforce", or "observe".
   string crowdsec_mode = 5;
+  // CrowdSec AppSec (WAF) request inspection mode: "", "off", "enforce", or
+  // "observe". HTTP services only: "enforce" and "observe" are rejected at
+  // validation for TCP/UDP/TLS services, which carry no requests to inspect.
+  string appsec_mode = 7;
 }
 
 message ProxyMapping {

shared/signal/client/client.go

@@ -52,11 +52,6 @@ type CredentialPayload struct {
 	Credential      *Credential
 	RosenpassPubKey []byte
 	RosenpassAddr   string
-	// MlkemPayload is the opaque post-quantum KEM handshake message riding this
-	// OFFER/ANSWER (see Body.mlkemPayload). Nil when not running the PQ exchange.
-	MlkemPayload []byte
-	// MlkemPort is the sender's ML-KEM PQ service UDP port (0 when not running).
-	MlkemPort       int
 	RelaySrvAddress string
 	RelaySrvIP      netip.Addr
 	SessionID       []byte
@@ -94,13 +89,6 @@ func MarshalCredential(myKey wgtypes.Key, remoteKey string, p CredentialPayload)
 	if p.RelaySrvIP.IsValid() {
 		body.RelayServerIP = p.RelaySrvIP.Unmap().AsSlice()
 	}
-	if len(p.MlkemPayload) > 0 {
-		body.MlkemPayload = p.MlkemPayload
-	}
-	if p.MlkemPort > 0 {
-		port := uint32(p.MlkemPort)
-		body.MlkemPort = &port
-	}
 	return &proto.Message{
 		Key:       myKey.PublicKey().String(),
 		RemoteKey: remoteKey,

shared/signal/proto/signalexchange.pb.go

@@ -239,16 +239,6 @@ type Body struct {
 	// fallback dial target when DNS resolution of relayServerAddress fails.
 	// SNI/TLS verification still uses relayServerAddress.
 	RelayServerIP []byte `protobuf:"bytes,11,opt,name=relayServerIP,proto3,oneof" json:"relayServerIP,omitempty"`
-	// mlkemPayload carries a post-quantum X25519MLKEM768 handshake message that
-	// seeds the WireGuard PSK, riding this Body's OFFER/ANSWER: on an OFFER it is
-	// the KEM offer, on an ANSWER the KEM answer. It is opaque to signal — the
-	// pqkem library frames and parses it. Absent when the sender does not run the
-	// ML-KEM PQ exchange; unknown to older clients, which ignore it.
-	MlkemPayload []byte `protobuf:"bytes,12,opt,name=mlkemPayload,proto3,oneof" json:"mlkemPayload,omitempty"`
-	// mlkemPort is the UDP port of the sender's ML-KEM PQ service, bound on its
-	// WireGuard overlay IP. Peers send subsequent rekey messages there over the
-	// data path. Zero/absent when the ML-KEM PQ exchange is not running.
-	MlkemPort *uint32 `protobuf:"varint,13,opt,name=mlkemPort,proto3,oneof" json:"mlkemPort,omitempty"`
 }
 
 func (x *Body) Reset() {
@@ -353,20 +343,6 @@ func (x *Body) GetRelayServerIP() []byte {
 	return nil
 }
 
-func (x *Body) GetMlkemPayload() []byte {
-	if x != nil {
-		return x.MlkemPayload
-	}
-	return nil
-}
-
-func (x *Body) GetMlkemPort() uint32 {
-	if x != nil && x.MlkemPort != nil {
-		return *x.MlkemPort
-	}
-	return 0
-}
-
 // Mode indicates a connection mode
 type Mode struct {
 	state         protoimpl.MessageState
@@ -490,7 +466,7 @@ var file_signalexchange_proto_rawDesc = []byte{
 	0x52, 0x09, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x28, 0x0a, 0x04, 0x62,
 	0x6f, 0x64, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x73, 0x69, 0x67, 0x6e,
 	0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x42, 0x6f, 0x64, 0x79, 0x52,
-	0x04, 0x62, 0x6f, 0x64, 0x79, 0x22, 0xbd, 0x05, 0x0a, 0x04, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x2d,
+	0x04, 0x62, 0x6f, 0x64, 0x79, 0x22, 0xd2, 0x04, 0x0a, 0x04, 0x42, 0x6f, 0x64, 0x79, 0x12, 0x2d,
 	0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x19, 0x2e, 0x73,
 	0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x42, 0x6f,
 	0x64, 0x79, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a,
@@ -518,46 +494,39 @@ var file_signalexchange_proto_rawDesc = []byte{
 	0x52, 0x09, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x29,
 	0x0a, 0x0d, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x49, 0x50, 0x18,
 	0x0b, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x02, 0x52, 0x0d, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x49, 0x50, 0x88, 0x01, 0x01, 0x12, 0x27, 0x0a, 0x0c, 0x6d, 0x6c, 0x6b,
-	0x65, 0x6d, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0c, 0x48,
-	0x03, 0x52, 0x0c, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x88,
-	0x01, 0x01, 0x12, 0x21, 0x0a, 0x09, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x6f, 0x72, 0x74, 0x18,
-	0x0d, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x04, 0x52, 0x09, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x6f,
-	0x72, 0x74, 0x88, 0x01, 0x01, 0x22, 0x52, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x09, 0x0a,
-	0x05, 0x4f, 0x46, 0x46, 0x45, 0x52, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x41, 0x4e, 0x53, 0x57,
-	0x45, 0x52, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x43, 0x41, 0x4e, 0x44, 0x49, 0x44, 0x41, 0x54,
-	0x45, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x4d, 0x4f, 0x44, 0x45, 0x10, 0x04, 0x12, 0x0b, 0x0a,
-	0x07, 0x47, 0x4f, 0x5f, 0x49, 0x44, 0x4c, 0x45, 0x10, 0x05, 0x12, 0x0d, 0x0a, 0x09, 0x48, 0x45,
-	0x41, 0x52, 0x54, 0x42, 0x45, 0x41, 0x54, 0x10, 0x06, 0x42, 0x15, 0x0a, 0x13, 0x5f, 0x72, 0x65,
-	0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73,
-	0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x42, 0x10,
-	0x0a, 0x0e, 0x5f, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x49, 0x50,
-	0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61,
-	0x64, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x6d, 0x6c, 0x6b, 0x65, 0x6d, 0x50, 0x6f, 0x72, 0x74, 0x4a,
-	0x04, 0x08, 0x09, 0x10, 0x0a, 0x22, 0x2e, 0x0a, 0x04, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x1b, 0x0a,
-	0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52,
-	0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x88, 0x01, 0x01, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x64,
-	0x69, 0x72, 0x65, 0x63, 0x74, 0x22, 0x6d, 0x0a, 0x0f, 0x52, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61,
-	0x73, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x28, 0x0a, 0x0f, 0x72, 0x6f, 0x73, 0x65,
-	0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b,
-	0x65, 0x79, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x41, 0x64, 0x64, 0x72, 0x32, 0xb9, 0x01, 0x0a, 0x0e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x45,
-	0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x4c, 0x0a, 0x04, 0x53, 0x65, 0x6e, 0x64, 0x12,
-	0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65,
-	0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
-	0x65, 0x1a, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e,
-	0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
-	0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x59, 0x0a, 0x0d, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
-	0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x49, 0x50, 0x88, 0x01, 0x01, 0x22, 0x52, 0x0a, 0x04, 0x54, 0x79, 0x70,
+	0x65, 0x12, 0x09, 0x0a, 0x05, 0x4f, 0x46, 0x46, 0x45, 0x52, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06,
+	0x41, 0x4e, 0x53, 0x57, 0x45, 0x52, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x43, 0x41, 0x4e, 0x44,
+	0x49, 0x44, 0x41, 0x54, 0x45, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x4d, 0x4f, 0x44, 0x45, 0x10,
+	0x04, 0x12, 0x0b, 0x0a, 0x07, 0x47, 0x4f, 0x5f, 0x49, 0x44, 0x4c, 0x45, 0x10, 0x05, 0x12, 0x0d,
+	0x0a, 0x09, 0x48, 0x45, 0x41, 0x52, 0x54, 0x42, 0x45, 0x41, 0x54, 0x10, 0x06, 0x42, 0x15, 0x0a,
+	0x13, 0x5f, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64,
+	0x72, 0x65, 0x73, 0x73, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x49, 0x64, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x49, 0x50, 0x4a, 0x04, 0x08, 0x09, 0x10, 0x0a, 0x22, 0x2e, 0x0a, 0x04, 0x4d, 0x6f,
+	0x64, 0x65, 0x12, 0x1b, 0x0a, 0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x08, 0x48, 0x00, 0x52, 0x06, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x88, 0x01, 0x01, 0x42,
+	0x09, 0x0a, 0x07, 0x5f, 0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x22, 0x6d, 0x0a, 0x0f, 0x52, 0x6f,
+	0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x28, 0x0a,
+	0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73,
+	0x73, 0x50, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e,
+	0x70, 0x61, 0x73, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x53,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x64, 0x64, 0x72, 0x32, 0xb9, 0x01, 0x0a, 0x0e, 0x53, 0x69,
+	0x67, 0x6e, 0x61, 0x6c, 0x45, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x4c, 0x0a, 0x04,
+	0x53, 0x65, 0x6e, 0x64, 0x12, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63,
+	0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65,
 	0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65,
-	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e, 0x73, 0x69, 0x67, 0x6e, 0x61,
-	0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70,
-	0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x28, 0x01, 0x30, 0x01,
-	0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x59, 0x0a, 0x0d, 0x43, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x20, 0x2e, 0x73, 0x69,
+	0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45, 0x6e, 0x63,
+	0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x20, 0x2e,
+	0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x65, 0x78, 0x63, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x2e, 0x45,
+	0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22,
+	0x00, 0x28, 0x01, 0x30, 0x01, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

shared/signal/proto/signalexchange.proto

@@ -75,18 +75,6 @@ message Body {
   // fallback dial target when DNS resolution of relayServerAddress fails.
   // SNI/TLS verification still uses relayServerAddress.
   optional bytes relayServerIP = 11;
-
-  // mlkemPayload carries a post-quantum X25519MLKEM768 handshake message that
-  // seeds the WireGuard PSK, riding this Body's OFFER/ANSWER: on an OFFER it is
-  // the KEM offer, on an ANSWER the KEM answer. It is opaque to signal — the
-  // pqkem library frames and parses it. Absent when the sender does not run the
-  // ML-KEM PQ exchange; unknown to older clients, which ignore it.
-  optional bytes mlkemPayload = 12;
-
-  // mlkemPort is the UDP port of the sender's ML-KEM PQ service, bound on its
-  // WireGuard overlay IP. Peers send subsequent rekey messages there over the
-  // data path. Zero/absent when the ML-KEM PQ exchange is not running.
-  optional uint32 mlkemPort = 13;
 }
 
 // Mode indicates a connection mode