[client] Debug: add process tree and window inventory to GUI memory dumps

The webview runs in child processes whose memory the Go runtime profiles
cannot see, so each snapshot now also records the whole process tree with
RSS/VMS plus PSS and Private_Dirty from smaps_rollup on Linux, and the live
Wails window inventory. Snapshots now run at startup, 2 and 5 minutes.

.github/workflows/release.yml

@@ -475,132 +475,6 @@ jobs:
           path: dist/
           retention-days: 3
 
-  release_ui_gtk3:
-    # Legacy GTK3/WebKit2GTK 4.1 UI build for distros without WebKitGTK 6.0
-    # (Ubuntu 22.04, Debian 12, RHEL 9, Fedora <=39). Runs on ubuntu-22.04 so
-    # the binary links against the oldest supported glibc.
-    runs-on: ubuntu-22.04
-    outputs:
-      release_ui_gtk3_artifact_url: ${{ steps.upload_release_ui_gtk3.outputs.artifact-url }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 0 # It is required for GoReleaser to work properly
-          persist-credentials: false
-
-      - name: Parse semver string
-        id: semver_parser
-        uses: netbirdio/shared-actions/actions/parse-semver@be5df6047383da2236e02243cceb857d8567c27e # v0.0.2
-
-      - name: Set snapshot flag
-        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
-        run: |
-          echo "flags=--snapshot" >> $GITHUB_ENV
-
-      - name: Set build vars
-        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
-        run: |
-          if [[ "x-${{ steps.semver_parser.outputs.prerelease }}" == "x-" && "x-${{ github.repository }}" == "x-netbirdio/netbird" ]]; then
-            echo "x-${{ github.repository }}"
-            echo "x-${{ steps.semver_parser.outputs.prerelease }}"
-            echo "SKIP_PUBLISH=false" >> $GITHUB_ENV
-          else
-            echo "x-${{ github.repository }}"
-            echo "x-${{ steps.semver_parser.outputs.prerelease }}"
-          fi
-
-      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version-file: "go.mod"
-          cache: false
-      - name: Cache Go modules
-        # Restore-only from the release_ui cache written by trusted runs; the
-        # module cache is identical (same go.sum) and stale build-cache
-        # entries just miss.
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-ui-go-releaser-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-ui-go-releaser-
-
-      - name: Install modules
-        run: go mod tidy
-
-      - name: check git status
-        run: git --no-pager diff --exit-code
-
-      - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '22'
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
-        with:
-          version: 11
-
-      - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libwebkit2gtk-4.1-dev
-
-      - name: Decode GPG signing key
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        env:
-          GPG_RPM_PRIVATE_KEY: ${{ secrets.GPG_RPM_PRIVATE_KEY }}
-        run: |
-          echo "$GPG_RPM_PRIVATE_KEY" | base64 -d > /tmp/gpg-rpm-signing-key.asc
-          echo "GPG_RPM_KEY_FILE=/tmp/gpg-rpm-signing-key.asc" >> $GITHUB_ENV
-
-      - name: Install wails3 CLI
-        # Version derived from go.mod so the binding generator always matches
-        # the wails runtime the binary links against.
-        # -tags gtk3: the CLI links the wails runtime's cgo packages, and the
-        # default tags request gtk4/webkitgtk-6.0 pkg-config entries that do
-        # not exist on ubuntu-22.04.
-        run: |
-          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
-          go install -tags gtk3 github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
-
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
-        with:
-          version: ${{ env.GORELEASER_VER }}
-          args: release --config .goreleaser_ui_gtk3.yaml --clean ${{ env.flags }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          UPLOAD_DEBIAN_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
-          UPLOAD_YUM_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
-          GPG_RPM_KEY_FILE: ${{ env.GPG_RPM_KEY_FILE }}
-          NFPM_NETBIRD_UI_RPM_GTK3_PASSPHRASE: ${{ secrets.GPG_RPM_PASSPHRASE }}
-          SKIP_PUBLISH: ${{ env.SKIP_PUBLISH }}
-      - name: Verify RPM signatures
-        run: |
-          docker run --rm -v $(pwd)/dist:/dist fedora:41 bash -c '
-            dnf install -y -q rpm-sign curl >/dev/null 2>&1
-            curl -sSL https://pkgs.netbird.io/yum/repodata/repomd.xml.key -o /tmp/rpm-pub.key
-            rpm --import /tmp/rpm-pub.key
-            echo "=== Verifying RPM signatures ==="
-            for rpm_file in /dist/*.rpm; do
-              [ -f "$rpm_file" ] || continue
-              echo "--- $(basename $rpm_file) ---"
-              rpm -K "$rpm_file"
-            done
-          '
-      - name: Clean up GPG key
-        if: always()
-        run: rm -f /tmp/gpg-rpm-signing-key.asc
-      - name: upload non tags for debug purposes
-        id: upload_release_ui_gtk3
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
-        with:
-          name: release-ui-gtk3
-          path: dist/
-          retention-days: 3
-
   release_ui_darwin:
     runs-on: macos-latest
     outputs:
@@ -814,7 +688,7 @@ jobs:
   comment_release_artifacts:
     name: Comment release artifacts
     runs-on: ubuntu-latest
-    needs: [release, release_ui, release_ui_gtk3, release_ui_darwin]
+    needs: [release, release_ui, release_ui_darwin]
     if: ${{ always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
     permissions:
       contents: read
@@ -826,14 +700,12 @@ jobs:
         env:
           RELEASE_RESULT: ${{ needs.release.result }}
           RELEASE_UI_RESULT: ${{ needs.release_ui.result }}
-          RELEASE_UI_GTK3_RESULT: ${{ needs.release_ui_gtk3.result }}
           RELEASE_UI_DARWIN_RESULT: ${{ needs.release_ui_darwin.result }}
           RELEASE_ARTIFACT_URL: ${{ needs.release.outputs.release_artifact_url }}
           LINUX_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.linux_packages_artifact_url }}
           WINDOWS_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.windows_packages_artifact_url }}
           MACOS_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.macos_packages_artifact_url }}
           RELEASE_UI_ARTIFACT_URL: ${{ needs.release_ui.outputs.release_ui_artifact_url }}
-          RELEASE_UI_GTK3_ARTIFACT_URL: ${{ needs.release_ui_gtk3.outputs.release_ui_gtk3_artifact_url }}
           RELEASE_UI_DARWIN_ARTIFACT_URL: ${{ needs.release_ui_darwin.outputs.release_ui_darwin_artifact_url }}
           GHCR_IMAGES_MARKDOWN: ${{ needs.release.outputs.ghcr_images }}
         with:
@@ -856,7 +728,6 @@ jobs:
               ['Windows packages', process.env.WINDOWS_PACKAGES_ARTIFACT_URL, process.env.RELEASE_RESULT],
               ['macOS packages', process.env.MACOS_PACKAGES_ARTIFACT_URL, process.env.RELEASE_RESULT],
               ['UI artifacts', process.env.RELEASE_UI_ARTIFACT_URL, process.env.RELEASE_UI_RESULT],
-              ['UI GTK3 artifacts', process.env.RELEASE_UI_GTK3_ARTIFACT_URL, process.env.RELEASE_UI_GTK3_RESULT],
               ['UI macOS artifacts', process.env.RELEASE_UI_DARWIN_ARTIFACT_URL, process.env.RELEASE_UI_DARWIN_RESULT],
             ];
 
@@ -913,7 +784,7 @@ jobs:
 
   trigger_signer:
     runs-on: ubuntu-latest
-    needs: [release, release_ui, release_ui_gtk3, release_ui_darwin, test_windows_installer]
+    needs: [release, release_ui, release_ui_darwin, test_windows_installer]
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Trigger binaries sign pipelines

.github/workflows/test-infrastructure-files.yml

@@ -257,15 +257,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Verify fresh-install session cookie key hardening
-        run: |
-          grep -Fxq '  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)' infrastructure_files/getting-started.sh
-          grep -Fxq '    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"' infrastructure_files/getting-started.sh
-          grep -Fxq '  install -m 600 /dev/null config.yaml' infrastructure_files/getting-started.sh
-          grep -Fxq '  openssl rand -base64 32' infrastructure_files/getting-started-enterprise.sh
-          grep -Fxq '  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)' infrastructure_files/getting-started-enterprise.sh
-          grep -Fxq '    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"' infrastructure_files/getting-started-enterprise.sh
-
       - name: Verify Dex retirement notice
         run: |
           if infrastructure_files/getting-started-with-dex.sh >stdout.txt 2>stderr.txt; then

.goreleaser_ui_gtk3.yaml

@@ -1,131 +0,0 @@
-version: 2
-env:
-  - SKIP_PUBLISH={{ if index .Env "SKIP_PUBLISH" }}{{ .Env.SKIP_PUBLISH }}{{ else }}true{{ end }}
-project_name: netbird-ui
-
-before:
-  hooks:
-    # Bindings are gitignored; regenerate before the frontend build so
-    # the @wailsio/runtime Vite plugin can resolve them (vite refuses to
-    # build without them).
-    # -f '-tags gtk3': the generator type-checks client/ui, whose cgo imports
-    # would otherwise resolve gtk4/webkitgtk-6.0 pkg-config entries that do
-    # not exist on ubuntu-22.04.
-    - sh -c 'cd client/ui && wails3 generate bindings -clean=true -ts -f "-tags gtk3"'
-    - sh -c 'cd client/ui/frontend && pnpm install --frozen-lockfile && pnpm build'
-
-builds:
-  # Legacy GTK3 / WebKit2GTK 4.1 build for distros without WebKitGTK 6.0
-  # (Ubuntu 22.04, Debian 12, RHEL 9, Fedora <=39). The gtk3 tag flips the
-  # Wails Linux backend to the GTK3 stack and swaps our GTK4-only XEmbed
-  # tray host for the pure-Go stub (client/ui/xembed_host_gtk3_linux.go).
-  # Must be built on the oldest supported glibc (ubuntu-22.04 runner).
-  - id: netbird-ui-gtk3
-    dir: client/ui
-    binary: netbird-ui
-    env:
-      - CGO_ENABLED=1
-    goos:
-      - linux
-    goarch:
-      - amd64
-    ldflags:
-      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
-    mod_timestamp: "{{ .CommitTimestamp }}"
-    tags:
-      - production
-      - gtk3
-
-archives:
-  - id: linux-gtk3-arch
-    name_template: "{{ .ProjectName }}-linux-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
-    builds:
-      - netbird-ui-gtk3
-
-nfpms:
-  # Same package_name as the GTK4 packages -- the two are mutually-exclusive
-  # alternatives served from separate repo paths (see uploads below); a given
-  # distro points at exactly one of them. The file names must still differ:
-  # the Debian pool is shared storage keyed by file name, so a default-named
-  # gtk3 .deb would overwrite the stable one.
-  - maintainer: Netbird <dev@netbird.io>
-    description: Netbird client UI.
-    homepage: https://netbird.io/
-    license: BSD-3-Clause
-    vendor: NetBird
-    id: netbird_ui_deb_gtk3
-    package_name: netbird-ui
-    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
-    builds:
-      - netbird-ui-gtk3
-    formats:
-      - deb
-    scripts:
-      postinstall: "release_files/ui-post-install.sh"
-    contents:
-      - src: client/ui/build/linux/netbird.desktop
-        dst: /usr/share/applications/org.wails.netbird.desktop
-      - src: client/ui/build/appicon.png
-        dst: /usr/share/pixmaps/netbird.png
-    dependencies:
-      - netbird (>= 0.75.0)
-      - libgtk-3-0
-      - libwebkit2gtk-4.1-0
-
-  - maintainer: Netbird <dev@netbird.io>
-    description: Netbird client UI.
-    homepage: https://netbird.io/
-    license: BSD-3-Clause
-    vendor: NetBird
-    id: netbird_ui_rpm_gtk3
-    package_name: netbird-ui
-    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
-    builds:
-      - netbird-ui-gtk3
-    formats:
-      - rpm
-    scripts:
-      postinstall: "release_files/ui-post-install.sh"
-    contents:
-      - src: client/ui/build/linux/netbird.desktop
-        dst: /usr/share/applications/org.wails.netbird.desktop
-      - src: client/ui/build/appicon.png
-        dst: /usr/share/pixmaps/netbird.png
-    dependencies:
-      - netbird >= 0.75.0
-      - (gtk3 or libgtk-3-0)
-      - (webkit2gtk4.1 or libwebkit2gtk-4_1-0)
-
-    rpm:
-      signature:
-        key_file: '{{ if index .Env "GPG_RPM_KEY_FILE" }}{{ .Env.GPG_RPM_KEY_FILE }}{{ end }}'
-
-# The GTK4 UI job shares project_name, so the default checksum file name would
-# collide with it on the shared GitHub release.
-checksum:
-  name_template: "{{ .ProjectName }}_gtk3_checksums.txt"
-
-changelog:
-  disable: true
-
-uploads:
-  # The gtk3 packages reuse the netbird-ui package name, so they live in
-  # dedicated repo paths (deb distribution `gtk3`, yum path `yum-gtk3`) that
-  # legacy distros point their repo config at.
-  - name: debian-gtk3
-    skip: "{{ .Env.SKIP_PUBLISH }}"
-    ids:
-      - netbird_ui_deb_gtk3
-    mode: archive
-    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=gtk3;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
-    username: dev@wiretrustee.com
-    method: PUT
-
-  - name: yum-gtk3
-    skip: "{{ .Env.SKIP_PUBLISH }}"
-    ids:
-      - netbird_ui_rpm_gtk3
-    mode: archive
-    target: https://pkgs.wiretrustee.com/yum-gtk3/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
-    username: dev@wiretrustee.com
-    method: PUT

AGENTS.md

@@ -14,22 +14,20 @@ in this file, not duplicated there.
 
 ## Contents
 
-- [STOP and ask the user before](#stop-and-ask-the-user-before)
-- [Quick reference](#quick-reference)
-- [Structure](#structure)
-- [Where to look](#where-to-look)
-- [Security](#security)
-- [Agent conventions](#agent-conventions)
-- [Repo-wide principles](#repo-wide-principles)
-- [Type safety](#type-safety)
-- [Concurrency and lifecycle](#concurrency-and-lifecycle)
-- [Error handling](#error-handling)
-- [Comments](#comments)
-- [Testing](#testing)
-- [Pitfalls](#pitfalls)
-- [Commits, PRs, releases](#commits-prs-releases)
-- [After you push: CI and review bots](#after-you-push-ci-and-review-bots)
-- [Discussion and support](#discussion-and-support)
+- [NetBird Agent Guidelines](#netbird-agent-guidelines)
+  - [Contents](#contents)
+  - [STOP and ask the user before](#stop-and-ask-the-user-before)
+  - [Quick reference](#quick-reference)
+  - [Structure](#structure)
+  - [Where to look](#where-to-look)
+  - [Repo-wide principles](#repo-wide-principles)
+  - [Error handling](#error-handling)
+  - [Comments](#comments)
+  - [Testing](#testing)
+  - [Pitfalls](#pitfalls)
+  - [Commits, PRs, releases](#commits-prs-releases)
+  - [After you push: CI and review bots](#after-you-push-ci-and-review-bots)
+  - [Discussion and support](#discussion-and-support)
 
 ## STOP and ask the user before
 
@@ -159,125 +157,11 @@ netbird/
 | LLM routing / Agent Network | `proxy/internal/llm/`, `agent-network/`                      |
 | End-to-end tests            | `e2e/`                                                       |
 
-## Security
-
-### Never fail open
-
-When a security check — access control, an IP restriction, an auth decision —
-hits an error such as an unparseable value, an unavailable lookup, or a state it
-does not recognize, it must **deny**. Never skip the check or allow the request
-through because the check itself failed, and make the `default` and unknown cases
-of a security-related `switch` deny rather than fall through.
-
-### Daemon RPC input is untrusted
-
-The agent runs as root (LocalSystem on Windows), so a daemon RPC crosses a
-privilege boundary: treat every field as untrusted input rather than as something
-the UI or CLI validated on the way in.
-
-When you add or change an RPC, ask what the handler does with caller input while
-running as root. If the answer touches a filesystem path, a URL or host, or a
-privileged state change, it needs a gate **in the handler** — a check in the client
-that normally calls it is not a check at all.
-
-- **A caller-supplied path the daemon opens.** Never `os.Open` it as root.
-  Constrain it, then open it *as the caller* with `ipcauth.OpenOwnedFile`, which
-  opens `O_NOFOLLOW`, requires a regular file, and refuses a file the caller does
-  not own — so a symlink or hardlink aimed at a root-only file is rejected.
-- **A caller-supplied URL or host the daemon fetches.** Restrict the scheme and
-  allow only known hosts for unprivileged callers. Prefer a lexical host
-  allowlist plus TLS verification over "resolve the host, then reject private
-  IPs": the resolve-then-trust pattern has a DNS-rebinding race (public IP at
-  check time, attacker IP at connect time), while a name allowlist has no IP
-  check to race. Never accept `http://` where `https://` is expected.
-- **A privileged state change** (SSH root login, management URL, deregistration)
-  gates on the caller identity from `ipcauth.CallerIdentity(ctx)`.
-
-Caller identity comes from the kernel — `SO_PEERCRED`, `LOCAL_PEERCRED`, or the
-named-pipe client token — and never from an RPC field. When
-`ipcauth.CallerIdentity` reports that it could not determine an identity, **deny**;
-do not fall back to treating the caller as the transport peer.
-
-## Agent conventions
-
-### Three networking modes
-
-Where packets actually flow depends on the mode the agent is running in. The
-three are not interchangeable, so establish which one a change applies to — and
-what it should do in the other two — before you write it.
-
-- **kernel mode** (Linux only): in-kernel WireGuard®. The kernel handles both
-  peer-to-peer and routed traffic, and ACLs are iptables or nftables rules. The
-  client programs kernel facilities but never sees the traffic itself.
-- **userspace mode** (wireguard-go with a TUN): wireguard-go runs in-process. The
-  kernel handles peer-to-peer traffic once it leaves the TUN, while routed traffic
-  — exit nodes and network routes — goes through the userspace forwarder, which
-  terminates the connection and re-establishes it over OS sockets. Used on
-  platforms without kernel WireGuard® or when the user opts out.
-- **netstack mode**: wireguard-go in-process with no TUN and no kernel
-  networking. The forwarder does all routing by stitching userspace sockets, and
-  listeners such as the embedded SSH and DNS servers bind on a gVisor netstack.
-  Used where the process cannot create a TUN device, such as the embedded client
-  (`client/embed/`) and the WASM build.
-
-### The overlay interface is not "WireGuard"
-
-Do not put "WireGuard" in identifiers or comments unless the code is genuinely
-coupled to WireGuard® specifically — a wireguard-go call, a handshake field, a
-kernel WireGuard® netlink attribute. For the interface, the host, peers, or
-traffic in general, say "the NetBird interface", "the interface", or "the overlay".
-Most firewall, routing, and DNS code is transport-agnostic, so a WireGuard®
-reference there is simply inaccurate and rots as the transports change.
-
-### IPv6 is a soft feature
-
-The IPv6 overlay is opt-in dual-stack, and capability can change at runtime. Treat
-it as soft rather than a requirement:
-
-- Gate local v6 paths on the interface accessor (`wgIface.Address().HasIPv6()`),
-  not on raw state fields, and skip the v6 path when the host has no v6 rather
-  than returning an error.
-- Treat an empty or unparseable peer v6 address as "no v6 for that peer" and skip
-  it, keeping the v4 path working.
-- Never let a missing v6 break v4. Fail-closed is for security checks; a
-  capability mismatch skips the v6 work and carries on.
-
-### Environment variables
-
-Name the variable in a constant and parse booleans with `strconv.ParseBool` rather
-than comparing strings inline, so an unexpected value is logged instead of
-silently meaning false:
-
-```go
-const EnvDisableFeature = "NB_DISABLE_FEATURE"
-
-func isDisabledByEnv() bool {
-    val := os.Getenv(EnvDisableFeature)
-    if val == "" {
-        return false
-    }
-    disabled, err := strconv.ParseBool(val)
-    if err != nil {
-        log.Warnf("failed to parse %s: %v", EnvDisableFeature, err)
-        return false
-    }
-    return disabled
-}
-```
-
-### Validating against protocol specs
-
-When a change depends on what a protocol actually mandates, read the specification
-text from the [IETF datatracker](https://datatracker.ietf.org/) rather than a
-summary, and check that you have the current RFC — the widely cited one for a
-protocol is often superseded. Cite the section, not just the document, so a
-reviewer can jump straight to the rule.
-
 ## Repo-wide principles
 
 1. **Run `go fmt` on every modified Go file.** Formatting is not optional.
-2. **Zero unaddressed linter warnings.** Fix what `golangci-lint` reports on code
-   you touch, and delete imports, helpers, and parameters your refactor orphaned.
+2. **Zero unaddressed diagnostics.** Fix IDE and linter warnings on code you
+   touch, and delete imports, helpers, and parameters your refactor orphaned.
    Exception: unused parameters in shared code may be consumed by builds outside
    this repository — do not remove them, ask instead.
 3. **Function comments are mandatory for exported functions**, written as full
@@ -291,12 +175,9 @@ reviewer can jump straight to the rule.
 7. **Avoid LLM-slop tells:** em dashes, hedging narration, restating the diff in
    prose, trailing summaries. Defaults, not absolute bans. Applies to code,
    comments, commit messages, and PR descriptions alike.
-8. **Concurrency: do a two-pass race analysis after every change** that touches
-   shared state, including reads of existing maps and slices. Guard them with a
-   mutex (or an atomic or channel where that fits better), keep critical
-   sections short, and run `go test -race` on the touched packages. See
-   [Concurrency and lifecycle](#concurrency-and-lifecycle) for the failure modes
-   to check for.
+8. **Concurrency: do a two-pass race analysis after every change** that adds
+   shared state. Guard maps and slices with a mutex, keep critical sections
+   short, and run `go test -race` on the touched packages.
 9. **Cross-platform builds must keep working.** The agent targets Linux, macOS,
    Windows, FreeBSD, Android, and iOS. When you add a platform-specific file,
    add the counterpart or a build-tagged fallback for the others.
@@ -304,93 +185,6 @@ reviewer can jump straight to the rule.
 11. **Never log secrets** — private keys, setup keys, tokens, PAT values — and
     keep peer IPs and hostnames out of logs above debug level.
 
-## Type safety
-
-**No bare primitives for domain concepts.** A `string` parameter for an account
-ID next to a `string` parameter for a peer ID is two bugs waiting to happen,
-because the compiler cannot catch the swap. Declare the type once and use it
-throughout, converting only at the boundaries where data enters or leaves —
-protobuf, gRPC, HTTP, an external library.
-
-```go
-type ServiceID string
-type AccountID string
-
-// Internal: typed all the way through
-func (r *Router) RemoveRoute(host SNIHost, svcID ServiceID) { ... }
-
-// Proto boundary: convert once, on the way in and on the way out
-svcID := ServiceID(mapping.GetId())
-req.ServiceId = string(svcID)
-```
-
-- **IP addresses are `netip.Addr`**, not `string` and not `net.IP`. Parse at the
-  boundary and pass the typed value inward.
-- **Always `Unmap()`** after parsing an address, after converting from `net.IP`,
-  and after extracting one from `RemoteAddr()`. This normalizes a v4-mapped v6
-  address (`::ffff:10.1.2.3`) to plain v4 so IPv4 rules match it. A stored or
-  compared mapped address silently fails to match those rules.
-- **Ports are `uint16`** internally; use `int` only where a library forces it and
-  convert immediately.
-- **Enums are a typed string with constants**, so the valid set is discoverable
-  and a typo fails to compile.
-- **Map keys follow the same rule**, and must be a real type (`type ServiceID
-  string`) rather than an alias (`type serviceID = string`) — an alias silently
-  accepts bare strings.
-
-## Concurrency and lifecycle
-
-Beyond the mutex hygiene in the principles above, check for these failure
-modes.
-
-- **Never read a struct field inside a goroutine** when another goroutine may nil
-  or reassign it. Pass the value as a parameter, or capture it into a local before
-  launching. This matters most when `Stop()` nils a field without waiting for the
-  goroutine to finish.
-
-  ```go
-  go func(ifaceName string) {   // good: passed in, cannot be nilled underneath
-      m.Start(ctx, ifaceName)
-  }(iface.Name())
-  ```
-
-- **Never wait on a channel while holding a lock the sender needs.** Copy what you
-  need out from under the lock, release it, then wait.
-
-  ```go
-  func (m *Manager) Stop() {
-      m.mu.Lock()
-      cancel, done := m.cancel, m.done
-      m.mu.Unlock()
-      if cancel != nil {
-          cancel()
-          <-done
-      }
-  }
-  ```
-
-- **`Stop`/`Close` must be idempotent** — guard on an already-stopped flag or a
-  nil cancel — and must release the state they guarded. Clear maps and caches;
-  a cancelled goroutine holding a live map still pins that memory. Note that a
-  nil map only panics on writes; reads and iteration behave like an empty map,
-  so where post-close use must be rejected, check the stopped flag explicitly.
-- **Publish coupled state only after every fallible step succeeds.** When several
-  fields form an invariant, build them into locals and assign them to the receiver
-  at the end. Assigning as you go leaves the object half-initialized when a later
-  step fails, so a readiness predicate reports ready while a coupled field is nil.
-  If an earlier step already had an external side effect — a created chain, an
-  opened handle, an inserted rule — roll it back before returning the error.
-- **Clean up what you own on constructor error paths.** Once a constructor has
-  started something, every later error path must undo it: cancel a goroutine and
-  wait for it to exit, stop a ticker, close a watcher. The object is never
-  returned, so its `Close` will never run.
-- **A failed `Start` must undo everything it started.** When a component brings up
-  several subsystems in sequence — connection manager, watchers, routing, DNS,
-  flow, persisted state — a failure partway through has to tear down the ones
-  already running, not just close the handle the error came from. Put the
-  already-started guard *before* that teardown path, so a rejected second `Start`
-  cannot dismantle the one that is running.
-
 ## Error handling
 
 Use single-assignment form when the error is only needed inside the `if`:
@@ -454,45 +248,6 @@ Log the errors you choose not to act on:
 - Close errors may be ignored for read-only operations; log them at debug for
   writes.
 
-**Do not log and return the same error.** It gets reported twice, from two places,
-and the second reader cannot tell whether it happened once or twice. Return it and
-let the caller decide. The exception is an API handler that has already written a
-response. Internal helpers return errors rather than logging and swallowing them.
-
-**Never return a typed nil as an error.** A nil `*MyError` stored in an `error`
-interface is not nil, so `err != nil` is true and callers take the failure path on
-success. Return the error only where it is actually set:
-
-```go
-if _, err := conn.Write(buf); err != nil {   // good
-    return err
-}
-return nil
-```
-
-**Accumulate with `multierror` when an operation should continue past individual
-failures** — teardown, cleanup, or setup where partial success is acceptable.
-`client/errors.FormatErrorOrNil` returns nil for an empty accumulator, so callers
-still see a plain nil on full success:
-
-```go
-func (m *Manager) Cleanup() error {
-    var merr *multierror.Error
-    for _, r := range m.resources {
-        if err := r.Close(); err != nil {
-            merr = multierror.Append(merr, fmt.Errorf("close %s: %w", r.Name, err))
-        }
-    }
-    return nberrors.FormatErrorOrNil(merr)
-}
-```
-
-| Scenario              | Approach              | Why                                       |
-| --------------------- | --------------------- | ----------------------------------------- |
-| Cleanup / teardown    | Accumulate            | Clean up as much as possible              |
-| Setup with rollback   | Abort on first error  | Partial state is invalid; undo what stuck |
-| Setup with partial OK | Accumulate            | Degraded operation is still useful        |
-
 ## Comments
 
 Comment the **why**, never the **what**. Default to no comment, and add one only
@@ -514,14 +269,10 @@ checksum = updateChecksum(checksum, oldPort, newPort)
 
 ### Length budget
 
-Neither of these is linter-enforced, so they are conventions the surrounding code
-mostly follows rather than hard limits:
-
-- **Around 90 characters per line.** Wrap the comment rather than running well past
-  it.
-- **Roughly 250 characters per comment**, about three wrapped lines. Doc comments
-  on exported identifiers may exceed it when the API genuinely needs the
-  explanation; inline comments inside a function body rarely should.
+- **90 characters per line.** Wrap the comment, do not run past it.
+- **250 characters per comment**, roughly three wrapped lines. Doc comments on
+  exported identifiers may exceed it when the API genuinely needs the
+  explanation; inline comments inside a function body may not.
 
 The budget is a smell detector, not a rule to game. Do not compress a needed
 explanation into cryptic shorthand to fit — if a block of code needs more than
@@ -578,19 +329,6 @@ up, and the 250-character budget does not apply to them.
   otherwise.
 - **Message guidance:** optional for `NoError`/`Error`; always give context for
   comparison, boolean, and collection assertions.
-- **Reproduce a bug before fixing it.** Write the test, watch it fail *for the
-  reason you expect* — a test that fails for an unrelated reason proves nothing —
-  then apply the fix and confirm it passes. Add the thin surrounding cases while
-  you are there.
-- **Use `t.Setenv`** rather than `os.Setenv` so the previous value is restored on
-  cleanup. To test the unset case, call `t.Setenv` first to register the restore,
-  then `os.Unsetenv`.
-- **Prefer `t.Cleanup` over `defer`** in any test with parallel subtests: the
-  parent function returns, running its `defer`s, while parallel subtests are
-  still suspended. Sequential subtests finish inside `t.Run`, so `defer` is safe
-  there, but `t.Cleanup` works in both cases.
-- **Explanatory comments in tests are welcome.** Describe the scenario being set
-  up; the comment budget below does not apply to them.
 
 ```go
 server, err := StartTestServer()
@@ -642,8 +380,7 @@ assert.Equal(t, expectedResult, result, "Result should match expected")
   than replacing it with your own summary: describe the change, link the issue,
   tick the checklist honestly (including "ran locally" and "single purpose"),
   and complete the documentation section. Do not tick a box you have not
-  verified, and do not delete rows that do not apply — the docs gate in CI reads
-  that section and fails when it is missing.
+  verified, and do not delete rows that do not apply.
 
 - **Keep the PR description short.** Under 1000 words on top of the template's
   own text, and usually far less — a few paragraphs. Reviewers read the diff;
@@ -702,12 +439,6 @@ assert.Equal(t, expectedResult, result, "Result should match expected")
   on their own. Propose that split to the user rather than opening one large PR
   and hoping.
 
-  Prefer GitHub's stacked pull requests for such a sequence, rather than
-  hand-managing base branches: open each PR against the branch below it instead of
-  `main`, so every PR's diff shows only its own change. Merging a layer retargets
-  the PRs above it, and branch protections and required checks on the base branch
-  still apply to each one.
-
 - **User-facing changes need a docs PR** in
   [netbirdio/docs](https://github.com/netbirdio/docs), linked from the PR
   description.

client/android/client.go

@@ -82,8 +82,6 @@ type Client struct {
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
 	cacheDir      string
-	// Identifies the running profile for the SSO login hint; see profile_state.go.
-	cfgPath string
 
 	stateChangeMu    sync.Mutex
 	stateChangeSubID string
@@ -104,12 +102,11 @@ type Client struct {
 	extendCancel context.CancelFunc
 }
 
-func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cfgPath string, cc *internal.ConnectClient) {
+func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cc *internal.ConnectClient) {
 	c.stateMu.Lock()
 	defer c.stateMu.Unlock()
 	c.config = cfg
 	c.cacheDir = cacheDir
-	c.cfgPath = cfgPath
 	c.connectClient = cc
 }
 
@@ -119,16 +116,6 @@ func (c *Client) stateSnapshot() (*profilemanager.Config, string, *internal.Conn
 	return c.config, c.cacheDir, c.connectClient
 }
 
-// authSnapshot returns the config together with the path it was loaded from, in
-// one lock: the path identifies the profile whose account email backs the login
-// hint, so reading it separately could pair one profile's config with another's
-// hint when a profile switch lands in between.
-func (c *Client) authSnapshot() (*profilemanager.Config, string, *internal.ConnectClient) {
-	c.stateMu.RLock()
-	defer c.stateMu.RUnlock()
-	return c.config, c.cfgPath, c.connectClient
-}
-
 func (c *Client) getConnectClient() *internal.ConnectClient {
 	c.stateMu.RLock()
 	defer c.stateMu.RUnlock()
@@ -181,7 +168,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	defer c.ctxCancel()
 	c.ctxCancelLock.Unlock()
 
-	auth := NewAuthWithConfig(ctx, cfg, cfgFile)
+	auth := NewAuthWithConfig(ctx, cfg)
 	err = auth.login(urlOpener, isAndroidTV)
 	if err != nil {
 		return err
@@ -189,7 +176,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, cfgFile, connectClient)
+	c.setState(cfg, cacheDir, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
 	// only once the fresh connect client is installed: until then Status()
@@ -230,7 +217,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, cfgFile, connectClient)
+	c.setState(cfg, cacheDir, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
 

client/android/login.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"fmt"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/system"
@@ -63,14 +61,11 @@ func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	}, nil
 }
 
-// NewAuthWithConfig instantiate Auth based on existing config. cfgPath is the
-// file the config was loaded from; it identifies the profile whose account email
-// backs the login_hint.
-func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config, cfgPath string) *Auth {
+// NewAuthWithConfig instantiate Auth based on existing config
+func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config) *Auth {
 	return &Auth{
-		ctx:     ctx,
-		config:  config,
-		cfgPath: cfgPath,
+		ctx:    ctx,
+		config: config,
 	}
 }
 
@@ -163,14 +158,12 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 	}
 
 	jwtToken := ""
-	email := ""
 	if needsLogin {
 		tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 		if err != nil {
 			return fmt.Errorf("interactive sso login failed: %v", err)
 		}
 		jwtToken = tokenInfo.GetTokenToUse()
-		email = tokenInfo.Email
 	}
 
 	err, _ = authClient.Login(a.ctx, "", jwtToken)
@@ -178,42 +171,17 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 		return fmt.Errorf("login failed: %v", err)
 	}
 
-	// Stored after Login, not before: a rejected token must not leave a hint
-	// pointing at an account that cannot be used.
-	if email != "" && a.cfgPath != "" {
-		if err := writeProfileEmail(a.cfgPath, email); err != nil {
-			log.Warnf("failed to store profile account email: %v", err)
-		}
-	}
-
 	go urlOpener.OnLoginSuccess()
 
 	return nil
 }
 
-// loginHintSetter is implemented by both concrete flows (PKCE and device code)
-// but absent from the OAuthFlow interface, hence the assertion below — the same
-// way internal/auth wires it in authenticateWithPKCEFlow.
-type loginHintSetter interface {
-	SetLoginHint(hint string)
-}
-
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool) (*auth.TokenInfo, error) {
 	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
-	// An empty hint is deliberate, not a fallback: a fresh or logged-out profile
-	// leaves the choice to the IdP, which is how accounts get switched.
-	if a.cfgPath != "" {
-		if hint := readProfileEmail(a.cfgPath); hint != "" {
-			if setter, ok := oAuthFlow.(loginHintSetter); ok {
-				setter.SetLoginHint(hint)
-			}
-		}
-	}
-
 	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
 	if err != nil {
 		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)

client/android/profile_manager.go

@@ -13,17 +13,18 @@ import (
 )
 
 const (
+	// Android-specific config filename (different from desktop default.json)
+	defaultConfigFilename = "netbird.cfg"
+	// Subdirectory for non-default profiles (must match Java Preferences.java)
+	profilesSubdir = "profiles"
 	// Android uses a single user context per app (non-empty username required by ServiceManager)
 	androidUsername = "android"
 )
 
 // Profile represents a profile for gomobile
 type Profile struct {
-	ID   string
-	Name string
-	// Email is the account this profile last logged in with, "" if it never
-	// completed an SSO login or was logged out. See profile_state.go.
-	Email    string
+	ID       string
+	Name     string
 	IsActive bool
 }
 
@@ -100,7 +101,6 @@ func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
 		profiles = append(profiles, &Profile{
 			ID:       p.ID.String(),
 			Name:     p.Name,
-			Email:    pm.profileEmail(p.ID.String()),
 			IsActive: p.IsActive,
 		})
 	}
@@ -123,22 +123,7 @@ func (pm *ProfileManager) GetActiveProfile() (*Profile, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to resolve active profile %q: %w", activeState.ID, err)
 	}
-	return &Profile{
-		ID:       prof.ID.String(),
-		Name:     prof.Name,
-		Email:    pm.profileEmail(prof.ID.String()),
-		IsActive: true,
-	}, nil
-}
-
-// profileEmail returns the account email recorded for a profile. Display-only, so
-// an unresolvable path degrades to "" rather than an error.
-func (pm *ProfileManager) profileEmail(id string) string {
-	configPath, err := pm.getProfileConfigPath(id)
-	if err != nil {
-		return ""
-	}
-	return readProfileEmail(configPath)
+	return &Profile{ID: prof.ID.String(), Name: prof.Name, IsActive: true}, nil
 }
 
 // SwitchProfile switches to a different profile
@@ -200,11 +185,6 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 		return fmt.Errorf("failed to save config: %w", err)
 	}
 
-	// Not fatal: a stale hint costs an account switch, not the logout itself.
-	if err := removeProfileEmail(configPath); err != nil {
-		log.Warnf("failed to clear stored account email for profile %s: %v", id, err)
-	}
-
 	log.Infof("logged out from profile: %s", id)
 	return nil
 }

client/android/profile_state.go

@@ -1,108 +0,0 @@
-package android
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/util"
-)
-
-const (
-	// Android-specific config filename (different from desktop default.json)
-	defaultConfigFilename = "netbird.cfg"
-	// Subdirectory for non-default profiles (must match Java Preferences.java)
-	profilesSubdir = "profiles"
-	// profileAccountSuffix names the file holding the profile's account email.
-	// Deliberately not ".state.json", which desktop uses for the same data:
-	// there the email and the engine's state manager live in different
-	// directories, but on Android both resolve under files/, so sharing the name
-	// would have the two overwrite each other — the state manager rewrites the
-	// whole file from its own keys (see statemanager.Manager.PersistState), and
-	// this package's writer does the same in reverse.
-	profileAccountSuffix = ".account.json"
-)
-
-// profileAccountPathFor derives the account file path from a profile's config
-// path: netbird.cfg -> netbird.account.json, <id>.json -> <id>.account.json.
-//
-// Deriving from the config path rather than resolving the active profile keeps
-// the write on the profile the login actually ran for: Auth.login runs in a
-// goroutine, so the active profile can change under a flow already in flight.
-func profileAccountPathFor(configPath string) (string, error) {
-	if configPath == "" {
-		return "", fmt.Errorf("empty config path")
-	}
-
-	base := filepath.Base(configPath)
-	stem := strings.TrimSuffix(base, filepath.Ext(base))
-	if stem == "" || stem == "." {
-		return "", fmt.Errorf("config path %q has no filename stem", configPath)
-	}
-
-	return filepath.Join(filepath.Dir(configPath), stem+profileAccountSuffix), nil
-}
-
-// readProfileEmail returns the account email stored for the profile whose config
-// lives at configPath. A missing or unreadable file yields "", which leaves the
-// account choice to the IdP.
-func readProfileEmail(configPath string) string {
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		log.Debugf("no profile account path for login hint: %v", err)
-		return ""
-	}
-
-	var state profilemanager.ProfileState
-	if _, err := util.ReadJson(accountPath, &state); err != nil {
-		if !os.IsNotExist(err) {
-			log.Debugf("failed to read profile account for login hint: %v", err)
-		}
-		return ""
-	}
-
-	return state.Email
-}
-
-// writeProfileEmail records the account email for the profile whose config lives
-// at configPath, so later logins can pass it as an OIDC login_hint. An empty
-// email is ignored rather than blanking what is already stored.
-func writeProfileEmail(configPath string, email string) error {
-	if email == "" {
-		return nil
-	}
-
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		return fmt.Errorf("resolve profile account path: %w", err)
-	}
-
-	state := profilemanager.ProfileState{Email: email}
-	if err := util.WriteJsonWithRestrictedPermission(context.Background(), accountPath, state); err != nil {
-		return fmt.Errorf("write profile account: %w", err)
-	}
-
-	return nil
-}
-
-// removeProfileEmail drops the stored account email. Called on logout: while the
-// email is on disk it goes out as a login_hint, which would steer the next login
-// straight back into the account just logged out of. Mirrors the desktop UI's
-// RemoveProfileState call.
-func removeProfileEmail(configPath string) error {
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		return fmt.Errorf("resolve profile account path: %w", err)
-	}
-
-	if err := os.Remove(accountPath); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("remove profile account: %w", err)
-	}
-
-	return nil
-}

client/android/profile_state_test.go

@@ -1,161 +0,0 @@
-package android
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestProfileAccountPathFor(t *testing.T) {
-	tests := []struct {
-		name       string
-		configPath string
-		want       string
-		wantErr    bool
-	}{
-		{
-			name:       "default profile",
-			configPath: "/data/data/io.netbird.client/files/netbird.cfg",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/netbird.account.json"),
-		},
-		{
-			name:       "id profile",
-			configPath: "/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.json",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.account.json"),
-		},
-		{
-			name:       "legacy name-keyed profile is handled the same way",
-			configPath: "/data/data/io.netbird.client/files/profiles/work.json",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/profiles/work.account.json"),
-		},
-		{
-			name:       "empty path is rejected",
-			configPath: "",
-			wantErr:    true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := profileAccountPathFor(tt.configPath)
-			if tt.wantErr {
-				if err == nil {
-					t.Fatalf("expected an error, got path %q", got)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if got != tt.want {
-				t.Errorf("got %q, want %q", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestProfileAccountPathForDefaultDoesNotCollide(t *testing.T) {
-	root := "/data/data/io.netbird.client/files"
-
-	defaultAccount, err := profileAccountPathFor(filepath.Join(root, defaultConfigFilename))
-	if err != nil {
-		t.Fatalf("default profile: %v", err)
-	}
-
-	idAccount, err := profileAccountPathFor(filepath.Join(root, profilesSubdir, "abc123.json"))
-	if err != nil {
-		t.Fatalf("id profile: %v", err)
-	}
-
-	if defaultAccount == idAccount {
-		t.Fatalf("default and id profile share an account file: %q", defaultAccount)
-	}
-}
-
-// The account file must never land on the engine state file: on Android both
-// resolve under files/, and the state manager rewrites the whole file from its
-// own keys, so sharing a path would have the two overwrite each other. The
-// expected names here mirror ProfileManager.GetStateFilePath.
-func TestProfileAccountPathAvoidsEngineStateFile(t *testing.T) {
-	root := "/data/data/io.netbird.client/files"
-
-	cases := []struct {
-		configPath  string
-		engineState string
-	}{
-		{
-			configPath:  filepath.Join(root, defaultConfigFilename),
-			engineState: filepath.Join(root, "state.json"),
-		},
-		{
-			configPath:  filepath.Join(root, profilesSubdir, "abc123.json"),
-			engineState: filepath.Join(root, profilesSubdir, "abc123.state.json"),
-		},
-	}
-
-	for _, c := range cases {
-		account, err := profileAccountPathFor(c.configPath)
-		if err != nil {
-			t.Fatalf("%s: %v", c.configPath, err)
-		}
-		if account == c.engineState {
-			t.Errorf("account file collides with the engine state file: %q", account)
-		}
-	}
-}
-
-func TestWriteThenReadProfileEmail(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
-	if err := ensureDirFor(t, configPath); err != nil {
-		t.Fatalf("prepare dir: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email before a login, got %q", got)
-	}
-
-	const email = "user@example.com"
-	if err := writeProfileEmail(configPath, email); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != email {
-		t.Errorf("got %q, want %q", got, email)
-	}
-
-	if err := removeProfileEmail(configPath); err != nil {
-		t.Fatalf("remove: %v", err)
-	}
-	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email after logout, got %q", got)
-	}
-
-	// Logout may run on a never-logged-in profile, so a second remove must pass.
-	if err := removeProfileEmail(configPath); err != nil {
-		t.Fatalf("second remove should be a no-op: %v", err)
-	}
-}
-
-func TestWriteProfileEmailIgnoresEmpty(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
-	if err := ensureDirFor(t, configPath); err != nil {
-		t.Fatalf("prepare dir: %v", err)
-	}
-
-	const email = "user@example.com"
-	if err := writeProfileEmail(configPath, email); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-	if err := writeProfileEmail(configPath, ""); err != nil {
-		t.Fatalf("write empty: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != email {
-		t.Errorf("empty write clobbered the stored email: got %q, want %q", got, email)
-	}
-}
-
-func ensureDirFor(t *testing.T, path string) error {
-	t.Helper()
-	return os.MkdirAll(filepath.Dir(path), 0o700)
-}

client/android/session.go

@@ -278,7 +278,7 @@ func (c *Client) endExtend() {
 }
 
 func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isAndroidTV bool) error {
-	cfg, cfgPath, cc := c.authSnapshot()
+	cfg, _, cc := c.stateSnapshot()
 	if cfg == nil || cc == nil {
 		return fmt.Errorf("engine is not running")
 	}
@@ -293,10 +293,7 @@ func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isA
 	}
 	defer authClient.Close()
 
-	// Passing the config path makes the flow pick up the login_hint: an extend
-	// renews the session of the account already signed in, so it must not stop to
-	// offer a choice.
-	a := NewAuthWithConfig(ctx, cfg, cfgPath)
+	a := &Auth{ctx: ctx, config: cfg}
 	tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 	if err != nil {
 		return fmt.Errorf("interactive sso login failed: %v", err)

client/firewall/firewalld/firewalld.go

@@ -2,8 +2,8 @@
 // its wg interface into firewalld's "trusted" zone. This is required because
 // firewalld's nftables chains are created with NFT_CHAIN_OWNER on recent
 // versions, which returns EPERM to any other process that tries to insert
-// rules into them. Trusting the interface makes firewalld itself add the
-// accept rules to its own chains instead.
+// rules into them. The workaround mirrors what Tailscale does: let firewalld
+// itself add the accept rules to its own chains by trusting the interface.
 package firewalld
 
 // TrustedZone is the firewalld zone name used for interfaces whose traffic

client/server/login_outcome_test.go

@@ -8,6 +8,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/proto"
@@ -25,9 +27,9 @@ func TestLogin_ManagementUnreachableIsReturnedInsteadOfDemandingSSO(t *testing.T
 
 	unreachable := errors.New("create connection: dial context: context deadline exceeded")
 	attempts := 0
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
 		attempts++
-		return false, unreachable
+		return internal.StatusLoginFailed, unreachable
 	}
 
 	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
@@ -53,12 +55,15 @@ func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
 	s.rootCtx = internal.CtxInitState(context.Background())
 	breakProfilePrivateKey(t, cfgPath)
 
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
-		return true, nil
+	refused := gstatus.Error(codes.PermissionDenied, "peer is not registered")
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		return internal.StatusNeedsLogin, refused
 	}
 
 	_, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
 	require.Error(t, err)
+	require.NotErrorIs(t, err, refused,
+		"the refusal was handed back to the caller instead of starting the SSO flow")
 
 	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
 	require.NoError(t, stateErr)
@@ -66,32 +71,6 @@ func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
 		"the SSO flow setup was never reached with the broken key")
 }
 
-func TestLogin_SetupKeyStillRunsWhenPeerNeedsLogin(t *testing.T) {
-	s, _, _, username, _ := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
-		return true, nil
-	}
-
-	var keysTried []string
-	s.loginAttemptFn = func(_ context.Context, setupKey, _ string) (internal.StatusType, error) {
-		keysTried = append(keysTried, setupKey)
-		return "", nil
-	}
-
-	setupKey := "A2C8E32F-AEB2-4B45-8FD3-8A0C1B2D3E4F"
-	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username, SetupKey: setupKey})
-	require.NoError(t, err, "the probe's outcome leaked out as the login result")
-	require.NotNil(t, resp)
-	require.Equal(t, []string{setupKey}, keysTried, "the setup key never reached the login attempt")
-	require.Nil(t, s.oauthAuthFlow.flow, "a setup-key login started an SSO flow")
-
-	status, err := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, err)
-	require.Equal(t, internal.StatusIdle, status)
-}
-
 // breakProfilePrivateKey replaces the profile's private key with an unparseable
 // one, which makes any attempt to build a Management client fail on the spot.
 func breakProfilePrivateKey(t *testing.T, cfgPath string) {

client/server/server.go

@@ -140,8 +140,6 @@ type Server struct {
 	// it to drive the login outcomes that need a server on the other end;
 	// production leaves it nil, and every login goes through loginAttempt.
 	loginAttemptFn func(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error)
-
-	isLoginRequiredFn func(ctx context.Context) (bool, error)
 }
 
 type oauthAuthFlow struct {
@@ -386,21 +384,6 @@ func (s *Server) attemptLogin(ctx context.Context, setupKey, jwtToken string) (i
 	return s.loginAttempt(ctx, setupKey, jwtToken)
 }
 
-func (s *Server) isLoginRequired(ctx context.Context) (bool, error) {
-	if s.isLoginRequiredFn != nil {
-		return s.isLoginRequiredFn(ctx)
-	}
-
-	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
-	if err != nil {
-		log.Errorf("failed to create auth client: %v", err)
-		return false, err
-	}
-	defer authClient.Close()
-
-	return authClient.IsLoginRequired(ctx)
-}
-
 // loginAttempt attempts to login using the provided information. It returns
 // StatusNeedsLogin when Management refused the peer's credentials and
 // StatusLoginFailed for every other failure, so callers can tell an
@@ -657,22 +640,22 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.config = config
 	s.mutex.Unlock()
 
-	// A probe that errors leaves the login undecided: Management unreachable, a
+	loginStatus, err := s.attemptLogin(ctx, "", "")
+	if err == nil {
+		state.Set(internal.StatusIdle)
+		return &proto.LoginResponse{}, nil
+	}
+
+	// Only an authentication refusal means the peer has to (re-)authenticate.
+	// Any other failure leaves the login undecided: Management unreachable, a
 	// restart mid-request, an internal error. Those are returned for the caller
 	// to retry, because turning them into an SSO prompt asks the user to solve
 	// something that is not theirs to solve, and a browser login cannot succeed
-	// while Management is unreachable anyway. Only Management refusing the
-	// peer's key is a decision, and IsLoginRequired reports that as
-	// needsLogin=true rather than an error.
-	needsLogin, err := s.isLoginRequired(ctx)
-	if err != nil {
-		state.Set(internal.StatusLoginFailed)
+	// while Management is unreachable anyway.
+	if loginStatus != internal.StatusNeedsLogin {
+		state.Set(loginStatus)
 		return nil, err
 	}
-	if !needsLogin {
-		state.Set(internal.StatusIdle)
-		return &proto.LoginResponse{}, nil
-	}
 
 	if msg.SetupKey == "" {
 		hint := ""
@@ -1815,9 +1798,6 @@ func (s *Server) RequestExtendAuthSession(
 	if connectClient == nil {
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running")
 	}
-	if connectClient.Engine() == nil {
-		return nil, gstatus.Errorf(codes.FailedPrecondition, "session can no longer be extended, log in again to reconnect")
-	}
 
 	hint := ""
 	if msg.Hint != nil {

client/ui/frontend/src/hooks/useKeepConnectedOnQuit.ts

@@ -1,35 +0,0 @@
-import { useCallback, useEffect, useState } from "react";
-import { Preferences } from "@bindings/services";
-
-export const useKeepConnectedOnQuit = () => {
-    const [keepConnected, setKeepConnected] = useState<boolean | null>(null);
-
-    useEffect(() => {
-        let cancelled = false;
-        Preferences.Get()
-            .then((prefs) => {
-                if (cancelled) return;
-                setKeepConnected(prefs?.keepConnectedOnQuit ?? false);
-            })
-            .catch((err: unknown) => {
-                if (cancelled) return;
-                console.warn("[useKeepConnectedOnQuit] load preferences failed", err);
-                setKeepConnected(false);
-            });
-        return () => {
-            cancelled = true;
-        };
-    }, []);
-
-    const setKeepConnectedOnQuit = useCallback(async (keep: boolean) => {
-        setKeepConnected(keep);
-        try {
-            await Preferences.SetKeepConnectedOnQuit(keep);
-        } catch (err: unknown) {
-            setKeepConnected(!keep);
-            console.error("[useKeepConnectedOnQuit] SetKeepConnectedOnQuit failed", err);
-        }
-    }, []);
-
-    return { keepConnected, setKeepConnectedOnQuit };
-};

client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx

@@ -11,7 +11,7 @@ import { DialogHeading } from "@/components/dialog/DialogHeading";
 import { SquareIcon } from "@/components/SquareIcon";
 import { Connection, Profiles as ProfilesSvc, Session, WindowManager } from "@bindings/services";
 import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
-import { EVENT_BROWSER_LOGIN_CANCEL, EVENT_TRIGGER_LOGIN } from "@/lib/connection";
+import { EVENT_BROWSER_LOGIN_CANCEL } from "@/lib/connection";
 import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
 import { formatRemaining } from "@/lib/formatters";
 
@@ -131,21 +131,6 @@ export default function SessionExpirationDialog() {
         }
     }, [busy, t]);
 
-    const authenticate = useCallback(async () => {
-        if (busy) return;
-        setBusy(true);
-        try {
-            await Events.Emit(EVENT_TRIGGER_LOGIN);
-            await WindowManager.CloseSessionExpiration();
-        } catch (e) {
-            setBusy(false);
-            await errorDialog({
-                Title: t("connect.error.loginTitle"),
-                Message: formatErrorMessage(e),
-            });
-        }
-    }, [busy, t]);
-
     const logout = useCallback(async () => {
         if (busy) return;
         setBusy(true);
@@ -200,7 +185,7 @@ export default function SessionExpirationDialog() {
                     variant={"primary"}
                     size={"md"}
                     className={"w-full"}
-                    onClick={expired ? authenticate : stay}
+                    onClick={stay}
                     disabled={busy}
                 >
                     {expired ? t("sessionExpiration.authenticate") : t("sessionExpiration.stay")}

client/ui/frontend/src/modules/settings/SettingsGeneral.tsx

@@ -11,7 +11,6 @@ import { ManagementServerSwitch } from "@/components/ManagementServerSwitch.tsx"
 import { ManagementMode, useManagementUrl } from "@/hooks/useManagementUrl.ts";
 import { LanguagePicker } from "@/components/LanguagePicker.tsx";
 import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
-import { useKeepConnectedOnQuit } from "@/hooks/useKeepConnectedOnQuit.ts";
 
 export function SettingsGeneral() {
     const { t } = useTranslation();
@@ -20,7 +19,6 @@ export function SettingsGeneral() {
     const { mode, setMode, setUrl, displayUrl, showError, canSave, save, checking, unreachable } =
         useManagementUrl();
     const { mdm, features } = useRestrictions();
-    const { keepConnected, setKeepConnectedOnQuit } = useKeepConnectedOnQuit();
 
     const inputRef = useRef<HTMLInputElement>(null);
     const managementUrlId = useId();
@@ -59,15 +57,6 @@ export function SettingsGeneral() {
                         helpText={t("settings.general.autostart.help")}
                     />
                 )}
-                <FancyToggleSwitch
-                    value={keepConnected ?? false}
-                    onChange={(v) => {
-                        void setKeepConnectedOnQuit(v);
-                    }}
-                    loading={keepConnected === null}
-                    label={t("settings.general.keepConnectedOnQuit.label")}
-                    helpText={t("settings.general.keepConnectedOnQuit.help")}
-                />
             </SectionGroup>
 
             {!mdm.managementURL && !features.disableUpdateSettings && (

client/ui/i18n/locales/de/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Ändern des Autostarts fehlgeschlagen"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Nach dem Beenden verbunden bleiben",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "Die Verbindung bleibt im Hintergrund bestehen, nachdem Sie NetBird schließen. Sie endet erst, wenn Sie sie selbst trennen.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Anzeigesprache"
     },

client/ui/i18n/locales/en/common.json

@@ -735,14 +735,6 @@
         "message": "Autostart Change Failed",
         "description": "Error-dialog title when changing the autostart setting fails."
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Stay Connected After Quitting",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "The connection stays up in the background after you close NetBird. It only stops when you disconnect it yourself.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Display Language",
         "description": "Label for the display-language picker."

client/ui/i18n/locales/es/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Error al cambiar el inicio automático"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Permanecer conectado al salir",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La conexión sigue activa en segundo plano después de cerrar NetBird. Solo se detiene cuando la desconectas tú.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Idioma de la interfaz"
     },

client/ui/i18n/locales/fr/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Échec de la modification du démarrage automatique"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Rester connecté après la fermeture",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La connexion reste active en arrière-plan après la fermeture de NetBird. Elle ne s'arrête que si vous la coupez vous-même.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Langue d’affichage"
     },

client/ui/i18n/locales/hu/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Az automatikus indítás módosítása sikertelen"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Kapcsolat megtartása kilépéskor",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "A kapcsolat a háttérben megmarad, miután bezárod a NetBirdöt. Csak akkor szakad meg, ha te magad bontod.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Megjelenítési nyelv"
     },

client/ui/i18n/locales/it/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Modifica avvio automatico non riuscita"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Resta connesso dopo la chiusura",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La connessione resta attiva in background dopo la chiusura di NetBird. Si interrompe solo quando la disconnetti tu.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Lingua dell'interfaccia"
     },

client/ui/i18n/locales/ja/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "自動起動の変更に失敗しました"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "終了後も接続を維持",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "NetBird を閉じたあとも接続はバックグラウンドで維持されます。自分で切断したときにだけ停止します。",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "表示言語"
     },

client/ui/i18n/locales/pt/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Falha ao alterar o início automático"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Permanecer conectado ao sair",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "A conexão continua ativa em segundo plano depois de fechar o NetBird. Ela só para quando você mesmo a desconecta.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Idioma de exibição"
     },

client/ui/i18n/locales/ru/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Не удалось изменить автозапуск"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Оставаться подключённым после выхода",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "Соединение остаётся активным в фоне после закрытия NetBird. Оно прервётся, только когда вы отключите его сами.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Язык интерфейса"
     },

client/ui/i18n/locales/zh-CN/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "更改自启动设置失败"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "退出后保持连接",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "关闭 NetBird 后，连接会在后台保持。只有你自己断开时才会停止。",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "显示语言"
     },

client/ui/main.go

@@ -95,6 +95,10 @@ func main() {
 		}
 	})
 
+	// Debug patch, not for release: dumps heap/goroutine profiles and the
+	// process tree to /tmp/nbgui for the memory consumption investigation.
+	startMemProfiler(app)
+
 	profiles := services.NewProfiles(conn)
 	// updater.Holder owns the typed update State; DaemonFeed feeds it and the
 	// Update service is a thin Wails-bound facade over it plus the install RPCs.
@@ -180,7 +184,6 @@ func main() {
 		WindowManager:   windowManager,
 		Session:         authSession,
 		Localizer:       localizer,
-		Preferences:     prefStore,
 	})
 	listenForShowSignal(context.Background(), tray)
 

client/ui/memprof.go

@@ -0,0 +1,319 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"runtime/pprof"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/shirou/gopsutil/v4/process"
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/events"
+)
+
+// memProfOffsets are the snapshot times measured from application startup.
+var memProfOffsets = []time.Duration{0, 2 * time.Minute, 5 * time.Minute}
+
+// memProfMaxDepth bounds the child walk so a cycle in the reported parent links
+// cannot spin forever.
+const memProfMaxDepth = 4
+
+type memProfileSpec struct {
+	profile string
+	file    string
+	debug   int
+}
+
+var memProfileSpecs = []memProfileSpec{
+	{profile: "heap", file: "heap.pprof", debug: 0},
+	{profile: "heap", file: "heap.txt", debug: 1},
+	{profile: "goroutine", file: "goroutine.txt", debug: 1},
+	{profile: "threadcreate", file: "threadcreate.txt", debug: 1},
+}
+
+var memProfStart = time.Now()
+
+// startMemProfiler dumps a profile snapshot at every memProfOffsets mark, each
+// into its own timestamped directory under memProfBaseDir. The first runs once
+// the application is up so the window inventory sees the eagerly created
+// windows. Every failure is logged and never stops the GUI.
+func startMemProfiler(app *application.App) {
+	log.Infof("memory profiler enabled, writing to %s (snapshots at %v after startup)", memProfBaseDir(), memProfOffsets)
+
+	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
+		go func() {
+			started := time.Now()
+			for _, offset := range memProfOffsets {
+				if wait := time.Until(started.Add(offset)); wait > 0 {
+					time.Sleep(wait)
+				}
+				writeMemProfile(app)
+			}
+		}()
+	})
+}
+
+// memProfBaseDir returns the directory holding the snapshot directories.
+func memProfBaseDir() string {
+	if runtime.GOOS == "windows" {
+		return filepath.Join(os.TempDir(), "nbgui")
+	}
+	return "/tmp/nbgui"
+}
+
+// writeMemProfile creates a <timestamp>-<pid> directory and fills it with the
+// runtime profiles, the memory statistics summary and the process tree.
+func writeMemProfile(app *application.App) {
+	name := fmt.Sprintf("%s-%d", time.Now().Format("20060102-150405"), os.Getpid())
+	dir := filepath.Join(memProfBaseDir(), name)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		log.Warnf("create memory profile dir %s: %v", dir, err)
+		return
+	}
+
+	// The heap profile reports live objects as of the last collection, so force
+	// one to keep inuse_space from counting garbage that is already unreachable.
+	runtime.GC()
+
+	if err := writeMemStats(filepath.Join(dir, "memstats.txt"), app); err != nil {
+		log.Warnf("write memory statistics: %v", err)
+	}
+
+	if err := writeProcTree(filepath.Join(dir, "proctree.txt")); err != nil {
+		log.Warnf("write process tree: %v", err)
+	}
+
+	for _, spec := range memProfileSpecs {
+		if err := writeMemProfileFile(spec, filepath.Join(dir, spec.file)); err != nil {
+			log.Warnf("write %s profile: %v", spec.profile, err)
+		}
+	}
+
+	log.Infof("memory profile written to %s", dir)
+}
+
+// writeMemProfileFile writes a single runtime profile to path.
+func writeMemProfileFile(spec memProfileSpec, path string) error {
+	p := pprof.Lookup(spec.profile)
+	if p == nil {
+		return fmt.Errorf("unknown profile %q", spec.profile)
+	}
+
+	f, err := os.Create(path)
+	if err != nil {
+		return fmt.Errorf("create %s: %w", path, err)
+	}
+	defer func() {
+		if err := f.Close(); err != nil {
+			log.Debugf("close %s: %v", path, err)
+		}
+	}()
+
+	if err := p.WriteTo(f, spec.debug); err != nil {
+		return fmt.Errorf("write %s: %w", path, err)
+	}
+	return nil
+}
+
+// writeMemStats dumps the runtime memory statistics next to the process
+// resident set size. A resident set much larger than Sys means the memory sits
+// outside the Go heap (webview, GTK, other cgo allocations), where the pprof
+// profiles cannot see it.
+func writeMemStats(path string, app *application.App) error {
+	var m runtime.MemStats
+	runtime.ReadMemStats(&m)
+
+	var b strings.Builder
+	fmt.Fprintf(&b, "time:           %s\n", time.Now().Format(time.RFC3339))
+	fmt.Fprintf(&b, "uptime:         %s\n", time.Since(memProfStart).Round(time.Second))
+	fmt.Fprintf(&b, "pid:            %d\n", os.Getpid())
+	fmt.Fprintf(&b, "\n")
+
+	rss, vms := processMemory()
+	fmt.Fprintf(&b, "process_rss:    %s\n", rss)
+	fmt.Fprintf(&b, "process_vms:    %s\n", vms)
+	fmt.Fprintf(&b, "\n")
+
+	fmt.Fprintf(&b, "sys:            %s\n", formatMemBytes(m.Sys))
+	fmt.Fprintf(&b, "heap_alloc:     %s\n", formatMemBytes(m.HeapAlloc))
+	fmt.Fprintf(&b, "heap_sys:       %s\n", formatMemBytes(m.HeapSys))
+	fmt.Fprintf(&b, "heap_inuse:     %s\n", formatMemBytes(m.HeapInuse))
+	fmt.Fprintf(&b, "heap_idle:      %s\n", formatMemBytes(m.HeapIdle))
+	fmt.Fprintf(&b, "heap_released:  %s\n", formatMemBytes(m.HeapReleased))
+	fmt.Fprintf(&b, "heap_objects:   %d\n", m.HeapObjects)
+	fmt.Fprintf(&b, "stack_inuse:    %s\n", formatMemBytes(m.StackInuse))
+	fmt.Fprintf(&b, "stack_sys:      %s\n", formatMemBytes(m.StackSys))
+	fmt.Fprintf(&b, "mspan_sys:      %s\n", formatMemBytes(m.MSpanSys))
+	fmt.Fprintf(&b, "mcache_sys:     %s\n", formatMemBytes(m.MCacheSys))
+	fmt.Fprintf(&b, "gc_sys:         %s\n", formatMemBytes(m.GCSys))
+	fmt.Fprintf(&b, "other_sys:      %s\n", formatMemBytes(m.OtherSys))
+	fmt.Fprintf(&b, "next_gc:        %s\n", formatMemBytes(m.NextGC))
+	fmt.Fprintf(&b, "num_gc:         %d\n", m.NumGC)
+	fmt.Fprintf(&b, "\n")
+
+	fmt.Fprintf(&b, "goroutines:     %d\n", runtime.NumGoroutine())
+	fmt.Fprintf(&b, "cgo_calls:      %d\n", runtime.NumCgoCall())
+	fmt.Fprintf(&b, "gomaxprocs:     %d\n", runtime.GOMAXPROCS(0))
+	fmt.Fprintf(&b, "\n")
+
+	writeWindowInventory(&b, app)
+
+	if err := os.WriteFile(path, []byte(b.String()), 0o644); err != nil {
+		return fmt.Errorf("write %s: %w", path, err)
+	}
+	return nil
+}
+
+// writeWindowInventory lists the live Wails windows. A window that exists holds
+// a webview process even while hidden, so this tells apart a leaked window (the
+// count grows) from windows whose content grew (the count stays put).
+func writeWindowInventory(b *strings.Builder, app *application.App) {
+	windows := app.Window.GetAll()
+	fmt.Fprintf(b, "windows:        %d\n", len(windows))
+	for _, w := range windows {
+		visible := "unknown"
+		if ww, ok := w.(*application.WebviewWindow); ok {
+			visible = strconv.FormatBool(ww.IsVisible())
+		}
+		fmt.Fprintf(b, "  id=%-3d name=%-20q visible=%-7s minimised=%-5t focused=%t\n",
+			w.ID(), w.Name(), visible, w.IsMinimised(), w.IsFocused())
+	}
+}
+
+// writeProcTree dumps this process and its descendants with their memory
+// footprint. The webview runs in child processes whose memory the Go runtime
+// profiles cannot see, so this is what attributes a footprint to a component.
+func writeProcTree(path string) error {
+	self, err := process.NewProcess(int32(os.Getpid()))
+	if err != nil {
+		return fmt.Errorf("open own process: %w", err)
+	}
+
+	var b strings.Builder
+	fmt.Fprintf(&b, "time: %s\n", time.Now().Format(time.RFC3339))
+	fmt.Fprintf(&b, "uptime: %s\n\n", time.Since(memProfStart).Round(time.Second))
+	fmt.Fprintf(&b, "%-8s %-8s %-28s %12s %12s %12s %12s\n", "PID", "PPID", "NAME", "RSS", "VMS", "PSS", "PRIV_DIRTY")
+
+	var totalRSS, totalPSS, totalPrivate uint64
+	walkProcTree(&b, self, 0, &totalRSS, &totalPSS, &totalPrivate)
+
+	fmt.Fprintf(&b, "\n%-8s %-8s %-28s %12s %12s %12s %12s\n", "", "", "TOTAL",
+		formatKB(totalRSS), "", formatKB(totalPSS), formatKB(totalPrivate))
+	fmt.Fprintf(&b, "\nPSS and PRIV_DIRTY come from /proc/<pid>/smaps_rollup and are Linux only.\n")
+
+	if err := os.WriteFile(path, []byte(b.String()), 0o644); err != nil {
+		return fmt.Errorf("write %s: %w", path, err)
+	}
+	return nil
+}
+
+// walkProcTree appends one line per process, depth-first, accumulating totals.
+func walkProcTree(b *strings.Builder, p *process.Process, depth int, totalRSS, totalPSS, totalPrivate *uint64) {
+	name, err := p.Name()
+	if err != nil {
+		name = "unknown"
+	}
+
+	var rss, vms uint64
+	if info, err := p.MemoryInfo(); err == nil {
+		rss, vms = info.RSS, info.VMS
+	}
+
+	pss, private := smapsRollup(p.Pid)
+	*totalRSS += rss
+	*totalPSS += pss
+	*totalPrivate += private
+
+	ppid, err := p.Ppid()
+	if err != nil {
+		ppid = -1
+	}
+
+	fmt.Fprintf(b, "%-8d %-8d %-28s %12s %12s %12s %12s\n", p.Pid, ppid,
+		strings.Repeat("  ", depth)+name, formatKB(rss), formatKB(vms), formatKB(pss), formatKB(private))
+
+	if depth >= memProfMaxDepth {
+		return
+	}
+
+	children, err := p.Children()
+	if err != nil {
+		return
+	}
+	for _, child := range children {
+		walkProcTree(b, child, depth+1, totalRSS, totalPSS, totalPrivate)
+	}
+}
+
+// smapsRollup returns the proportional set size and private dirty bytes of pid,
+// both zero on platforms without /proc.
+func smapsRollup(pid int32) (uint64, uint64) {
+	f, err := os.Open(fmt.Sprintf("/proc/%d/smaps_rollup", pid))
+	if err != nil {
+		return 0, 0
+	}
+	defer func() {
+		if err := f.Close(); err != nil {
+			log.Debugf("close smaps_rollup for %d: %v", pid, err)
+		}
+	}()
+
+	var pss, private uint64
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		fields := strings.Fields(scanner.Text())
+		if len(fields) < 2 {
+			continue
+		}
+		kb, err := strconv.ParseUint(fields[1], 10, 64)
+		if err != nil {
+			continue
+		}
+		switch fields[0] {
+		case "Pss:":
+			pss = kb * 1024
+		case "Private_Dirty:":
+			private = kb * 1024
+		}
+	}
+	return pss, private
+}
+
+// processMemory returns the formatted resident and virtual size of this process.
+func processMemory() (string, string) {
+	p, err := process.NewProcess(int32(os.Getpid()))
+	if err != nil {
+		unavailable := fmt.Sprintf("unavailable (%v)", err)
+		return unavailable, unavailable
+	}
+
+	info, err := p.MemoryInfo()
+	if err != nil {
+		unavailable := fmt.Sprintf("unavailable (%v)", err)
+		return unavailable, unavailable
+	}
+
+	return formatMemBytes(info.RSS), formatMemBytes(info.VMS)
+}
+
+// formatMemBytes renders a byte count as megabytes with the raw value kept.
+func formatMemBytes(n uint64) string {
+	return fmt.Sprintf("%8.1f MB (%d bytes)", float64(n)/(1024*1024), n)
+}
+
+// formatKB renders a byte count as megabytes for the process tree columns, and
+// a dash when the platform did not report the value.
+func formatKB(n uint64) string {
+	if n == 0 {
+		return "-"
+	}
+	return fmt.Sprintf("%.1f MB", float64(n)/(1024*1024))
+}

client/ui/preferences/store.go

@@ -58,10 +58,6 @@ type UIPreferences struct {
 	// decision has run for this OS user. It only ever transitions to true
 	// and is never reset, so the default-on flow runs at most once, ever.
 	AutostartInitialized bool `json:"autostartInitialized"`
-	// KeepConnectedOnQuit leaves the daemon connected when the GUI quits.
-	// Its false zero value preserves the historical disconnect-on-quit
-	// behaviour for preference files written before the field existed.
-	KeepConnectedOnQuit bool `json:"keepConnectedOnQuit"`
 }
 
 // LanguageValidator rejects SetLanguage inputs with no shipped bundle.
@@ -187,26 +183,6 @@ func (s *Store) SetAutostartInitialized(done bool) error {
 	return nil
 }
 
-// SetKeepConnectedOnQuit persists the disconnect-on-quit opt-out. No-op if unchanged.
-func (s *Store) SetKeepConnectedOnQuit(keep bool) error {
-	s.mu.Lock()
-	if s.current.KeepConnectedOnQuit == keep {
-		s.mu.Unlock()
-		return nil
-	}
-	next := s.current
-	next.KeepConnectedOnQuit = keep
-	if err := s.persistLocked(next); err != nil {
-		s.mu.Unlock()
-		return fmt.Errorf("persist preferences: %w", err)
-	}
-	s.current = next
-	s.mu.Unlock()
-
-	s.broadcast(next)
-	return nil
-}
-
 // SetLanguage validates, persists, and broadcasts. No-op if unchanged.
 func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
 	if lang == "" {

client/ui/preferences/store_test.go

@@ -238,42 +238,6 @@ func TestStore_SetAutostartInitializedPersistsAcrossReload(t *testing.T) {
 	assert.True(t, reloaded.Get().AutostartInitialized, "marker must survive a reload from disk")
 }
 
-func TestStore_SetKeepConnectedOnQuitPersistsAcrossReload(t *testing.T) {
-	withTempConfigDir(t)
-	emitter := &recordingEmitter{}
-	s, err := NewStore(nil, emitter)
-	require.NoError(t, err)
-
-	assert.False(t, s.Get().KeepConnectedOnQuit, "quitting must disconnect by default")
-
-	require.NoError(t, s.SetKeepConnectedOnQuit(true))
-	assert.True(t, s.Get().KeepConnectedOnQuit, "Get should reflect the persisted opt-out")
-	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first write should broadcast")
-
-	require.NoError(t, s.SetKeepConnectedOnQuit(true))
-	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent write should not broadcast again")
-
-	reloaded, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.True(t, reloaded.Get().KeepConnectedOnQuit, "opt-out must survive a reload from disk")
-}
-
-func TestStore_KeepConnectedOnQuitDefaultsFalseForPreExistingFile(t *testing.T) {
-	withTempConfigDir(t)
-
-	// A preferences file written before the field existed must keep the
-	// historical disconnect-on-quit behaviour rather than silently opting out.
-	path, err := preferencesPath()
-	require.NoError(t, err)
-	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
-	require.NoError(t, os.WriteFile(path, []byte(`{"language":"en","viewMode":"default"}`), 0o600))
-
-	s, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.False(t, s.Get().KeepConnectedOnQuit, "a file predating the field must not opt out of disconnect-on-quit")
-	assert.True(t, s.ExistedAtLoad(), "the pre-existing file must be seen on disk")
-}
-
 func TestStore_ExistedAtLoad(t *testing.T) {
 	withTempConfigDir(t)
 

client/ui/services/cursor_linux.go

@@ -49,11 +49,5 @@ func getCursorPosition(app *application.App) (application.Point, bool) {
 	if app == nil || app.Screen == nil {
 		return p, true
 	}
-	// The wails GTK3 backend caches screens from the active window; a tray app
-	// has none at startup, so the cache is empty and PhysicalToDipPoint would
-	// dereference a nil nearest screen. Raw pixels are correct there anyway.
-	if app.Screen.ScreenNearestPhysicalPoint(p) == nil {
-		return p, true
-	}
 	return app.Screen.PhysicalToDipPoint(p), true
 }

client/ui/services/preferences.go

@@ -34,7 +34,3 @@ func (s *Preferences) SetViewMode(_ context.Context, mode preferences.ViewMode)
 func (s *Preferences) SetOnboardingCompleted(_ context.Context, done bool) error {
 	return s.store.SetOnboardingCompleted(done)
 }
-
-func (s *Preferences) SetKeepConnectedOnQuit(_ context.Context, keep bool) error {
-	return s.store.SetKeepConnectedOnQuit(keep)
-}

client/ui/tray.go

@@ -16,7 +16,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
-	"github.com/netbirdio/netbird/client/ui/preferences"
 	"github.com/netbirdio/netbird/client/ui/services"
 	"github.com/netbirdio/netbird/version"
 )
@@ -51,9 +50,8 @@ type TrayServices struct {
 	WindowManager   *services.WindowManager
 	// Session is bound to authsession directly because the services wrapper
 	// only re-exposes the React subset.
-	Session     *authsession.Session
-	Localizer   *Localizer
-	Preferences *preferences.Store
+	Session   *authsession.Session
+	Localizer *Localizer
 }
 
 type Tray struct {
@@ -463,12 +461,10 @@ func (t *Tray) handleQuit() {
 	t.profileMu.Unlock()
 	t.svc.DaemonFeed.CancelProfileSwitch()
 
-	if t.svc.Preferences == nil || !t.svc.Preferences.Get().KeepConnectedOnQuit {
-		ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
-		defer cancel()
-		if err := t.svc.Connection.Down(ctx); err != nil {
-			log.Errorf("disconnect on quit: %v", err)
-		}
+	ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
+	defer cancel()
+	if err := t.svc.Connection.Down(ctx); err != nil {
+		log.Errorf("disconnect on quit: %v", err)
 	}
 	t.app.Quit()
 }

client/ui/tray_click_linux.go

@@ -4,26 +4,17 @@ package main
 
 // bindTrayClick wires the tray icon's left-click handler on Linux.
 //
-// Expected behaviour per tray host:
-//
-//	Host                           Left click              Right click
-//	KDE Plasma, Waybar             main window (Activate)  menu (host-rendered)
-//	GNOME Shell + AppIndicator     menu only               menu only
-//	Minimal WMs via XEmbed host    main window (Activate)  XEmbed GTK popup
-//
-// OnClick fires only on org.kde.StatusNotifierItem.Activate — a real left
-// click. KDE/Waybar send it over D-Bus; the in-process XEmbed host
-// (xembed_host_linux.go) maps a Button1 press to the same Activate call.
-//
-// GNOME Shell + AppIndicator never sends Activate: it renders the dbusmenu
-// on ANY click and only reports the menu opening via dbusmenu
-// Event("opened"). Upstream Wails treated that event as a click, so on GNOME
-// both buttons raised the main window on top of the menu, and on KDE/Waybar
-// a right click raised it over the freshly opened menu. The netbirdio/wails
-// fork (go.mod replace) drops that heuristic: a menu open never fires
-// OnClick. On GNOME the main window is reached via the "Open NetBird" menu
-// entry; left-click-opens-window is not achievable there anyway, since the
-// host always opens the menu itself.
+// Both Linux click paths converge on Wails' linuxSystemTray.Activate, which
+// fires the registered clickHandler:
+//   - Real SNI hosts (KDE Plasma, Waybar, GNOME Shell + AppIndicator) invoke
+//     org.kde.StatusNotifierItem.Activate over D-Bus on left-click.
+//   - The in-process StatusNotifierWatcher + XEmbed host used on minimal WMs
+//     (Fluxbox, i3, dwm, OpenBox) maps a Button1 press to that same Activate
+//     call itself (xembed_host_linux.go), so it routes through the same hook.
+// Registering OnClick here therefore covers both paths with one handler — no
+// changes to the watcher or XEmbed C code are needed. Left-click now opens the
+// main window; right-click still opens the menu via Wails' default
+// SecondaryActivate→OpenMenu handler (and the XEmbed GTK popup on minimal WMs).
 //
 // We do NOT register OnDoubleClick: Wails' Linux SNI backend never fires it
 // (unlike Windows). And we deliberately skip AttachWindow — it plus Wails3's

client/ui/tray_session.go

@@ -27,10 +27,11 @@ const (
 	finalWarningCountdownSeconds = 120
 )
 
-// handleSessionExpired notifies and brings the window forward so the user can reconnect.
+// handleSessionExpired notifies and brings the window forward so the frontend's /login route drives renewal.
 func (t *Tray) handleSessionExpired() {
 	t.notify(t.loc.T("notify.sessionExpired.title"), t.loc.T("notify.sessionExpired.body"), notifyIDSessionExpired)
 	if t.window != nil {
+		t.window.SetURL("/#/login")
 		t.window.Show()
 		t.window.Focus()
 	}
@@ -307,7 +308,11 @@ func (t *Tray) openSessionExtendFlow() {
 	}
 	seconds := int(time.Until(deadline).Seconds())
 	if seconds <= 0 {
-		t.app.Event.Emit(services.EventTriggerLogin)
+		if t.window != nil {
+			t.window.SetURL("/#/login")
+			t.window.Show()
+			t.window.Focus()
+		}
 		return
 	}
 	if t.svc.WindowManager == nil {

client/ui/xembed_host_gtk3_linux.go

@@ -1,40 +0,0 @@
-//go:build linux && gtk3 && !(linux && 386)
-
-package main
-
-import (
-	"errors"
-
-	"github.com/godbus/dbus/v5"
-)
-
-// The legacy GTK3 / WebKit2GTK 4.1 build (-tags gtk3) drops the in-process
-// XEmbed StatusNotifierWatcher entirely. The real implementation
-// (xembed_host_linux.go + xembed_tray_linux.c) links GTK4 and uses GTK4-only
-// popup-menu APIs that have no drop-in GTK3 equivalent, so rather than port the
-// C layer we stub the host out on gtk3 builds. The tray still works on every
-// desktop that ships its own StatusNotifierWatcher (KDE, GNOME+AppIndicator,
-// Cinnamon/xapp, XFCE, …); only the minimal-WM fallback (Fluxbox/OpenBox/i3/
-// dwm/vanilla GNOME) is unavailable on gtk3 packages. See LINUX-TRAY.md.
-
-// xembedHost is a placeholder so the package compiles on gtk3 builds; the real
-// type (with X11/GTK4 state) lives in xembed_host_linux.go. It is never
-// instantiated here because xembedTrayAvailable always reports false.
-type xembedHost struct{}
-
-// run satisfies the call in tray_watcher_linux.go; unreachable on gtk3 because
-// newXembedHost never returns a non-nil host.
-func (*xembedHost) run() {}
-
-// xembedTrayAvailable always reports false on gtk3 builds, so the watcher probe
-// loop in startStatusNotifierWatcher exits immediately and newXembedHost is
-// never reached. recenter_linux.go's predicate becomes a harmless no-op too.
-func xembedTrayAvailable() bool {
-	return false
-}
-
-// newXembedHost exists only to satisfy the reference in tray_watcher_linux.go;
-// it is unreachable because xembedTrayAvailable returns false on gtk3.
-func newXembedHost(conn *dbus.Conn, busName string, objPath dbus.ObjectPath) (*xembedHost, error) {
-	return nil, errors.New("xembed host unsupported on gtk3 build")
-}

client/ui/xembed_host_linux.go

@@ -1,4 +1,4 @@
-//go:build linux && !gtk3 && !(linux && 386)
+//go:build linux && !(linux && 386)
 
 package main
 

client/ui/xembed_tray_linux.c

@@ -1,5 +1,3 @@
-//go:build linux && !gtk3 && !(linux && 386)
-
 #include "xembed_tray_linux.h"
 
 #include <X11/Xatom.h>

e2e/agentnetwork/chat_test.go

@@ -438,10 +438,14 @@ func TestProvidersMatrix(t *testing.T) {
 	// Create every provider, all enabled, each with a unique model string so the
 	// proxy's connect-time snapshot carries them all and model→provider routing
 	// is unambiguous (provider toggles after connect don't reconcile to the
-	// proxy, so we enable everything up front).
+	// proxy, so we enable everything up front). The first create bootstraps the
+	// cluster.
 	ids := make([]string, 0, len(matrix))
-	for _, pc := range matrix {
+	for i, pc := range matrix {
 		req := providerRequest(pc)
+		if i == 0 {
+			req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+		}
 		prov, perr := srv.CreateProvider(ctx, req)
 		require.NoError(t, perr, "create provider %s", pc.name)
 		ids = append(ids, prov.Id)

e2e/agentnetwork/custom_pricing_test.go

@@ -82,12 +82,13 @@ func provisionPricedProvider(t *testing.T, ctx context.Context, name string, mod
 	// need NOT be in the catalog — the operator names it and prices it here.
 	dummyKey := "sk-price-e2e"
 	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        name,
-		ProviderId:  "openai_api",
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &dummyKey,
-		Enabled:     ptr(true),
-		Models:      &models,
+		Name:             name,
+		ProviderId:       "openai_api",
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &dummyKey,
+		Enabled:          ptr(true),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
+		Models:           &models,
 	})
 	require.NoError(t, err, "create provider")
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })

e2e/agentnetwork/guardrail_block_test.go

@@ -113,14 +113,15 @@ func runPathRoutedGuardrailCase(t *testing.T, tc pathRoutedGuardrailCase) {
 
 	// Catch-all provider (no models) so the router forwards any model; a static
 	// bearer key means the router injects a static auth header instead of minting
-	// a GCP token.
+	// a GCP token. Bootstraps the cluster if it isn't already.
 	staticKey := "static-e2e-token"
 	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        tc.name,
-		ProviderId:  tc.catalogID,
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &staticKey,
-		Enabled:     ptr(true),
+		Name:             tc.name,
+		ProviderId:       tc.catalogID,
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &staticKey,
+		Enabled:          ptr(true),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
 	})
 	require.NoError(t, err, "create %s provider", tc.name)
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })

e2e/agentnetwork/guardrail_groupswitch_test.go

@@ -73,6 +73,7 @@ func TestGuardrailGroupSwitchTakesEffectAfterTTL(t *testing.T) {
 			{Id: modelA, InputPer1k: 0.001, OutputPer1k: 0.001},
 			{Id: modelB, InputPer1k: 0.001, OutputPer1k: 0.001},
 		},
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
 	})
 	require.NoError(t, err, "create provider")
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })

e2e/agentnetwork/guardrail_multipolicy_test.go

@@ -61,14 +61,15 @@ func TestGuardrailMultiPolicyModelAllowlist(t *testing.T) {
 	}
 
 	// pRestricted declares the two guardrailed models so routing is deterministic
-	// (model -> provider).
+	// (model -> provider). Created first, so it carries the bootstrap cluster.
 	pRestricted, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        "restricted",
-		ProviderId:  "openai_api",
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &staticKey,
-		Enabled:     ptr(true),
-		Models:      models(modelSelected, modelOther),
+		Name:             "restricted",
+		ProviderId:       "openai_api",
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &staticKey,
+		Enabled:          ptr(true),
+		Models:           models(modelSelected, modelOther),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
 	})
 	require.NoError(t, err, "create restricted provider")
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), pRestricted.Id) })

e2e/agentnetwork/guardrail_pergroup_providers_test.go

@@ -115,7 +115,7 @@ func TestGuardrailPerGroupAllowlist_AllProviders(t *testing.T) {
 	staticKey := "static-e2e-token"
 	enabled := true
 
-	for _, c := range cases {
+	for i, c := range cases {
 		req := api.AgentNetworkProviderRequest{
 			Name:        "e2e-pergroup-" + c.name,
 			ProviderId:  c.catalogID,
@@ -124,6 +124,9 @@ func TestGuardrailPerGroupAllowlist_AllProviders(t *testing.T) {
 			Enabled:     ptr(true),
 			Models:      c.models,
 		}
+		if i == 0 {
+			req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+		}
 		prov, perr := srv.CreateProvider(ctx, req)
 		require.NoError(t, perr, "create provider %s", c.name)
 		c.providerID = prov.Id
@@ -280,12 +283,13 @@ func TestGuardrailMultiGroupUser(t *testing.T) {
 
 	// P1 — union scenario: two restricting policies, one per group.
 	p1, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        "e2e-mg-union",
-		ProviderId:  "openai_api",
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &staticKey,
-		Enabled:     ptr(true),
-		Models:      priced(unionA, unionB, unionC),
+		Name:             "e2e-mg-union",
+		ProviderId:       "openai_api",
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &staticKey,
+		Enabled:          ptr(true),
+		Models:           priced(unionA, unionB, unionC),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
 	})
 	require.NoError(t, err, "create union provider")
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), p1.Id) })

e2e/agentnetwork/guardrail_test.go

@@ -115,11 +115,14 @@ func TestModelAllowlistEnforced(t *testing.T) {
 	})
 	require.NoError(t, err, "mint setup key")
 
-	// Providers with their configured (allowed) models
+	// Providers with their configured (allowed) models; the first bootstraps the cluster.
 	ids := make([]string, 0, len(providers))
 	allowed := make([]string, 0, len(providers))
-	for _, pc := range providers {
+	for i, pc := range providers {
 		req := providerRequest(pc)
+		if i == 0 {
+			req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+		}
 		prov, perr := srv.CreateProvider(ctx, req)
 		require.NoError(t, perr, "create provider %s", pc.name)
 		id := prov.Id

e2e/agentnetwork/main_test.go

@@ -14,7 +14,6 @@ import (
 	"time"
 
 	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
 )
 
 // srv is the shared combined server for the package, ready (PAT-authenticated)
@@ -43,14 +42,5 @@ func run(m *testing.M) int {
 		return 1
 	}
 
-	// Bootstrap the account's agent-network endpoint once for the package:
-	// providers no longer have settings side effects, and every data-plane
-	// test expects the shared account pinned to the combined proxy cluster.
-	cluster := harness.AgentNetworkCluster
-	if _, err := srv.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{ProxyAddress: &cluster}); err != nil {
-		fmt.Fprintf(os.Stderr, "e2e: bootstrap agent-network endpoint: %v\n", err)
-		return 1
-	}
-
 	return m.Run()
 }

e2e/agentnetwork/management_test.go

@@ -21,10 +21,11 @@ func ptr[T any](v T) *T { return &v }
 func newProvider(t *testing.T, ctx context.Context, name string) api.AgentNetworkProvider {
 	t.Helper()
 	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        name,
-		ProviderId:  "openai_api",
-		UpstreamUrl: "https://api.openai.com",
-		ApiKey:      ptr("sk-dummy-e2e-key"),
+		Name:             name,
+		ProviderId:       "openai_api",
+		UpstreamUrl:      "https://api.openai.com",
+		ApiKey:           ptr("sk-dummy-e2e-key"),
+		BootstrapCluster: ptr("eu.proxy.netbird.test"),
 	})
 	require.NoError(t, err, "create provider %q", name)
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
@@ -56,11 +57,17 @@ func TestProviderLifecycle(t *testing.T) {
 		}}
 	}
 
-	for _, pc := range cases {
-		pc := pc
+	for i, pc := range cases {
+		i, pc := i, pc
 		t.Run(pc.name, func(t *testing.T) {
 			req := providerRequest(pc)
 			req.Name = "lc-" + pc.name
+			// Bootstrap the cluster on the first create in case the matrix has
+			// not run (e.g. no provider keys → settings not yet bootstrapped).
+			if i == 0 {
+				req.BootstrapCluster = ptr(harness.AgentNetworkCluster)
+			}
+
 			prov, err := srv.CreateProvider(ctx, req)
 			require.NoError(t, err, "create %s provider", pc.name)
 			t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), prov.Id) })
@@ -130,17 +137,17 @@ func TestProviderValidation(t *testing.T) {
 	requireClientError(t, err)
 }
 
-// TestSettingsRoundTrip flips the collection toggles and confirms the
-// endpoint and proxy address stay immutable, then restores the original
-// state. A second bootstrap attempt must be rejected as a conflict.
+// TestSettingsRoundTrip flips the collection toggles and confirms cluster /
+// subdomain stay immutable, then restores the original state.
 func TestSettingsRoundTrip(t *testing.T) {
 	ctx := context.Background()
 
-	// The package's TestMain bootstrapped the shared account's endpoint.
+	// Settings are bootstrapped on first provider create.
+	newProvider(t, ctx, "Settings Bootstrap")
+
 	before, err := srv.GetSettings(ctx)
 	require.NoError(t, err, "get settings")
-	require.NotEmpty(t, before.Endpoint, "settings must carry the bootstrapped endpoint")
-	require.NotEmpty(t, before.ProxyAddress, "settings must carry the bootstrapped proxy address")
+	require.NotEmpty(t, before.Cluster, "settings must carry an assigned cluster")
 
 	flipped, err := srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
 		EnableLogCollection:    !before.EnableLogCollection,
@@ -150,15 +157,8 @@ func TestSettingsRoundTrip(t *testing.T) {
 	require.NoError(t, err, "update settings")
 	assert.Equal(t, !before.EnableLogCollection, flipped.EnableLogCollection, "log collection toggle must flip")
 	assert.Equal(t, !before.EnablePromptCollection, flipped.EnablePromptCollection, "prompt collection toggle must flip")
-	assert.Equal(t, before.Endpoint, flipped.Endpoint, "endpoint must be immutable across updates")
-	assert.Equal(t, before.ProxyAddress, flipped.ProxyAddress, "proxy address must be immutable across updates")
-
-	// The account is already bootstrapped: a second bootstrap is a conflict,
-	// whatever shape it asks for.
-	_, err = srv.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
-		Endpoint: ptr("attacker.cluster.invalid"),
-	})
-	requireClientError(t, err)
+	assert.Equal(t, before.Cluster, flipped.Cluster, "cluster must be immutable across updates")
+	assert.Equal(t, before.Subdomain, flipped.Subdomain, "subdomain must be immutable across updates")
 
 	// Restore the original toggles.
 	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{

e2e/agentnetwork/settings_bootstrap_test.go

@@ -1,138 +0,0 @@
-//go:build e2e
-
-package agentnetwork
-
-import (
-	"context"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// harnessStartFresh boots a dedicated combined server with its own fresh
-// account and registers its teardown on t. Unlike the shared srv, the fresh
-// account has NOT had its agent-network endpoint bootstrapped.
-func harnessStartFresh(ctx context.Context, t *testing.T) (*harness.Combined, error) {
-	t.Helper()
-	fresh, err := harness.StartCombined(ctx)
-	if err != nil {
-		return nil, err
-	}
-	t.Cleanup(func() { _ = fresh.Terminate(context.Background()) })
-	if _, err := fresh.Bootstrap(ctx); err != nil {
-		return nil, err
-	}
-	return fresh, nil
-}
-
-// TestSettingsBootstrapViaPost covers the explicit bootstrap contract on an
-// account that has never been bootstrapped: the GET reads as the defaults
-// with an empty endpoint/proxy_address, a PUT has no row to update and fails,
-// and a POST creates the row and assigns the immutable endpoint — labeled
-// beneath a proxy address here, with the toggle overrides from the same
-// request applied. The shared srv cannot provide that starting state
-// (TestMain bootstraps it), so this boots a dedicated combined server — the
-// image is already built and cached by TestMain's StartCombined, so the extra
-// cost is one container start.
-func TestSettingsBootstrapViaPost(t *testing.T) {
-	ctx := context.Background()
-
-	fresh, err := harnessStartFresh(ctx, t)
-	require.NoError(t, err, "start dedicated combined server")
-
-	// Before agent-network bootstrap the settings read as the defaults, not
-	// as an error and not as a null body.
-	before, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings on a fresh account must succeed")
-	assert.Empty(t, before.Endpoint, "endpoint must be empty before bootstrap")
-	assert.Empty(t, before.ProxyAddress, "proxy address must be empty before bootstrap")
-	assert.False(t, before.Dedicated, "an unbootstrapped account has no serving shape")
-	assert.True(t, before.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
-	assert.False(t, before.EnablePromptCollection, "defaults must show prompt collection off")
-
-	// A PUT has no row to update yet — bootstrap is the explicit POST.
-	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		EnableLogCollection: true,
-	})
-	requireClientError(t, err)
-
-	// A POST with a proxy address bootstraps a labeled endpoint and applies
-	// the toggles from the same request. Every toggle is set away from its
-	// bootstrap default so each assertion can actually fail.
-	const cluster = "e2e.bootstrap.netbird.selfhosted"
-	bootstrapped, err := fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
-		ProxyAddress:           ptr(cluster),
-		EnableLogCollection:    ptr(false),
-		EnablePromptCollection: ptr(true),
-		RedactPii:              ptr(true),
-	})
-	require.NoError(t, err, "bootstrap settings via POST must succeed")
-	assert.Equal(t, cluster, bootstrapped.ProxyAddress, "proxy address must be pinned from the request")
-	require.NotEmpty(t, bootstrapped.Endpoint, "endpoint must be assigned at bootstrap")
-	assert.True(t, strings.HasSuffix(bootstrapped.Endpoint, "."+cluster),
-		"labeled endpoint must hang one label beneath the proxy address: %s", bootstrapped.Endpoint)
-	assert.False(t, bootstrapped.Dedicated, "a labeled pin is not dedicated")
-	assert.False(t, bootstrapped.EnableLogCollection, "log collection from the bootstrap request must override the default")
-	assert.True(t, bootstrapped.EnablePromptCollection, "prompt collection from the bootstrap request must apply")
-	assert.True(t, bootstrapped.RedactPii, "redact toggle from the bootstrap request must apply")
-
-	// The row is persisted: an independent read agrees on every field.
-	after, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings after bootstrap must succeed")
-	assert.Equal(t, bootstrapped.Endpoint, after.Endpoint, "bootstrap must persist across reads")
-	assert.Equal(t, bootstrapped.EnableLogCollection, after.EnableLogCollection, "log collection must persist")
-	assert.Equal(t, bootstrapped.EnablePromptCollection, after.EnablePromptCollection, "prompt collection must persist")
-	assert.Equal(t, bootstrapped.RedactPii, after.RedactPii, "redact toggle must persist")
-
-	// Once bootstrapped, PUT updates the toggles; the identity fields are not
-	// part of its schema and survive by construction.
-	persisted, err := fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		EnableLogCollection:    true,
-		EnablePromptCollection: false,
-		RedactPii:              true,
-	})
-	require.NoError(t, err, "post-bootstrap update must succeed")
-	assert.Equal(t, bootstrapped.Endpoint, persisted.Endpoint, "endpoint must survive updates untouched")
-	assert.Equal(t, cluster, persisted.ProxyAddress, "proxy address must survive updates untouched")
-	assert.True(t, persisted.EnableLogCollection, "post-bootstrap toggle must apply")
-	assert.False(t, persisted.EnablePromptCollection, "post-bootstrap toggle must apply")
-
-	// The endpoint is immutable: a second bootstrap is rejected as a
-	// conflict, and the rejected create must not disturb anything.
-	_, err = fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
-		Endpoint: ptr("other.cluster.invalid"),
-	})
-	requireClientError(t, err)
-
-	final, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings after the rejected bootstrap must succeed")
-	assert.Equal(t, persisted.Endpoint, final.Endpoint, "rejected bootstrap must not change the endpoint")
-	assert.Equal(t, persisted.ProxyAddress, final.ProxyAddress, "rejected bootstrap must not change the proxy address")
-	assert.Equal(t, persisted.EnableLogCollection, final.EnableLogCollection, "rejected bootstrap must not apply its toggles")
-	assert.Equal(t, persisted.EnablePromptCollection, final.EnablePromptCollection, "rejected bootstrap must not apply its toggles")
-	assert.Equal(t, persisted.RedactPii, final.RedactPii, "rejected bootstrap must not apply its toggles")
-}
-
-// TestSettingsBootstrapSelfAddressed covers the dedicated shape end to end:
-// a POST carrying an endpoint claims the hostname verbatim, the proxy address
-// equals it, and the pin reads as dedicated — the address-first flow a
-// self-hosted operator uses before deploying the proxy that will declare it.
-func TestSettingsBootstrapSelfAddressed(t *testing.T) {
-	ctx := context.Background()
-
-	fresh, err := harnessStartFresh(ctx, t)
-	require.NoError(t, err, "start dedicated combined server")
-
-	created, err := fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
-		Endpoint: ptr("gw.e2e.netbird.selfhosted"),
-	})
-	require.NoError(t, err, "self-addressed bootstrap must succeed")
-	assert.Equal(t, "gw.e2e.netbird.selfhosted", created.Endpoint, "endpoint must be claimed verbatim")
-	assert.Equal(t, created.Endpoint, created.ProxyAddress, "self-addressed: proxy address is the endpoint")
-	assert.True(t, created.Dedicated, "a self-addressed pin is dedicated")
-}

e2e/agentnetwork/skiptls_test.go

@@ -66,7 +66,9 @@ func TestProviderSkipTLSVerification(t *testing.T) {
 		}
 	}
 
+	// First create bootstraps the account cluster.
 	insecureReq := newReq("skip-tls", insecureModel, true)
+	insecureReq.BootstrapCluster = ptr(harness.AgentNetworkCluster)
 	insecureProv, err := srv.CreateProvider(ctx, insecureReq)
 	require.NoError(t, err, "create skip-tls provider")
 	t.Cleanup(func() { _ = srv.DeleteProvider(context.Background(), insecureProv.Id) })

e2e/agentnetwork/vllm_test.go

@@ -57,11 +57,12 @@ func TestVLLMProvider(t *testing.T) {
 	// is enumerated so the router dispatches this model string to this provider.
 	dummyKey := "sk-vllm-e2e"
 	prov, err := srv.CreateProvider(ctx, api.AgentNetworkProviderRequest{
-		Name:        "vllm",
-		ProviderId:  "vllm",
-		UpstreamUrl: vllm.URL,
-		ApiKey:      &dummyKey,
-		Enabled:     ptr(true),
+		Name:             "vllm",
+		ProviderId:       "vllm",
+		UpstreamUrl:      vllm.URL,
+		ApiKey:           &dummyKey,
+		Enabled:          ptr(true),
+		BootstrapCluster: ptr(harness.AgentNetworkCluster),
 		Models: &[]api.AgentNetworkProviderModel{
 			{Id: harness.VLLMModel, InputPer1k: 0.001, OutputPer1k: 0.002},
 		},

e2e/harness/agentnetwork.go

@@ -126,16 +126,8 @@ func (c *Combined) DeleteGuardrail(ctx context.Context, id string) error {
 	return anDelete(ctx, c, "/api/agent-network/guardrails/"+id)
 }
 
-// CreateSettings bootstraps the account's agent-network settings row,
-// assigning the immutable endpoint. Exactly one of req.ProxyAddress (labeled
-// endpoint beneath that cluster) and req.Endpoint (self-addressed dedicated
-// endpoint) must be set; a second bootstrap returns a conflict.
-func (c *Combined) CreateSettings(ctx context.Context, req api.AgentNetworkSettingsCreateRequest) (api.AgentNetworkSettings, error) {
-	return anRequest[api.AgentNetworkSettings](ctx, c, http.MethodPost, "/api/agent-network/settings", req)
-}
-
-// GetSettings returns the account's agent-network settings row. Before the
-// CreateSettings bootstrap it reads as the defaults with an empty endpoint.
+// GetSettings returns the account's agent-network settings row. It exists only
+// after the first provider create bootstraps it.
 func (c *Combined) GetSettings(ctx context.Context) (api.AgentNetworkSettings, error) {
 	return anRequest[api.AgentNetworkSettings](ctx, c, http.MethodGet, "/api/agent-network/settings", nil)
 }

go.mod

@@ -114,7 +114,7 @@ require (
 	github.com/ti-mo/conntrack v0.5.1
 	github.com/ti-mo/netfilter v0.5.2
 	github.com/vmihailenco/msgpack/v5 v5.4.1
-	github.com/wailsapp/wails/v3 v3.0.0-beta.3
+	github.com/wailsapp/wails/v3 v3.0.0-alpha2.117
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
@@ -339,5 +339,3 @@ replace github.com/dexidp/dex => github.com/netbirdio/dex v0.244.1-0.20260716205
 replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-20260512110716-8d70ad8647c1
 
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
-
-replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701

go.sum

@@ -490,8 +490,6 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701 h1:QL9nupfRom0L9jcY7N9l/Bc6QK2PtC6pHzC+ftpTqpw=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
@@ -662,6 +660,8 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.117 h1:udyjqPG3AIgkod5QDR/WblCkpV8R86BFPSrsWxSyt5Y=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.117/go.mod h1:74WH2FScMsgucZvHHvv7eOefDXCm/CjuIxqhhZgPhKg=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=

infrastructure_files/getting-started-enterprise.sh

@@ -11,10 +11,6 @@ SED_STRIP_PADDING='s/=//g'
 
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
-# Static IP for Traefik inside the compose bridge network. The management
-# server trusts X-Forwarded-* headers from this address only.
-TRAEFIK_IP="172.30.0.10"
-
 check_docker_compose() {
   if command -v docker-compose &> /dev/null; then
     echo "docker-compose"
@@ -84,7 +80,7 @@ read_nb_domain() {
   if ! check_domain_resolves "$value"; then
     echo "" > /dev/stderr
     echo "Warning: '$value' does not resolve via DNS from this host." > /dev/stderr
-    echo "Traefik will not be able to issue TLS certificates until it does." > /dev/stderr
+    echo "Caddy will not be able to issue TLS certificates until it does." > /dev/stderr
     local confirm=""
     echo -n "Continue anyway? [y/N]: " > /dev/stderr
     read -r confirm < /dev/tty
@@ -96,23 +92,6 @@ read_nb_domain() {
   echo "$value"
 }
 
-read_letsencrypt_email() {
-  if [[ -n "${NETBIRD_LETSENCRYPT_EMAIL:-}" ]]; then
-    echo "$NETBIRD_LETSENCRYPT_EMAIL"
-    return
-  fi
-  local value=""
-  echo "Enter your email for Let's Encrypt certificate notifications." > /dev/stderr
-  echo -n "Email address: " > /dev/stderr
-  read -r value < /dev/tty
-  if [[ -z "$value" ]]; then
-    echo "Email is required for Let's Encrypt." > /dev/stderr
-    read_letsencrypt_email
-    return
-  fi
-  echo "$value"
-}
-
 read_required() {
   local prompt="$1"
   local value=""
@@ -225,11 +204,11 @@ init_environment() {
   check_openssl
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
 
-  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]]; then
+  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]] || [[ -f Caddyfile ]]; then
     echo "Generated files already exist in $(pwd)."
     echo "If you want to reinitialize the environment, please remove them first:"
     echo "  $DOCKER_COMPOSE_COMMAND down --volumes # removes all containers and volumes"
-    echo "  rm -f .env docker-compose.yml config.yaml"
+    echo "  rm -f .env docker-compose.yml Caddyfile config.yaml"
     echo "Be aware this will remove all data from the database."
     exit 1
   fi
@@ -251,9 +230,6 @@ init_environment() {
   echo ""
   NETBIRD_DOMAIN=$(read_nb_domain)
 
-  echo ""
-  NETBIRD_LETSENCRYPT_EMAIL=$(read_letsencrypt_email)
-
   echo ""
 
   NETBIRD_LICENSE_KEY=$(read_secret "Enter license key (input hidden)")
@@ -262,7 +238,6 @@ init_environment() {
   POSTGRES_DB="netbird"
   POSTGRES_PASSWORD=$(rand_secret)
   NETBIRD_ENCRYPTION_KEY=$(rand_b64_key)
-  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)
   NETBIRD_RELAY_AUTH_SECRET=$(rand_secret)
 
   POSTGRES_DSN="host=postgres user=${POSTGRES_USER} password=${POSTGRES_PASSWORD} dbname=${POSTGRES_DB} port=5432 sslmode=disable TimeZone=UTC"
@@ -272,7 +247,6 @@ init_environment() {
   echo "Selected:"
   echo "  Traffic flow: ${NETBIRD_TRAFFIC_FLOW}"
   echo "  Domain:       ${NETBIRD_DOMAIN}"
-  echo "  ACME email:   ${NETBIRD_LETSENCRYPT_EMAIL}"
   echo ""
   echo "Rendering files into $(pwd) ..."
   install -m 600 /dev/null .env
@@ -282,6 +256,7 @@ init_environment() {
   if [[ -z "${NETBIRD_LICENSE_SERVER_BASE_URL:-}" ]]; then
     sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' docker-compose.yml && rm -f docker-compose.yml.bak
   fi
+  render_caddyfile > Caddyfile
   install -m 600 /dev/null config.yaml
   render_config_yaml >> config.yaml
 
@@ -308,7 +283,7 @@ init_environment() {
   echo "All configuration and secrets are stored (mode 600) in $(pwd)/.env"
   echo ""
   echo "Tail logs:"
-  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server traefik"
+  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server caddy"
 }
 
 # ------------------------------------------------------------------
@@ -331,11 +306,6 @@ NETBIRD_TRAFFIC_FLOW_ENABLED=${NETBIRD_TRAFFIC_FLOW}
 # Domain
 NETBIRD_DOMAIN=${NETBIRD_DOMAIN}
 
-# Reverse proxy (Traefik)
-NETBIRD_LETSENCRYPT_EMAIL=${NETBIRD_LETSENCRYPT_EMAIL}
-NETBIRD_TRAEFIK_TAG=${NETBIRD_TRAEFIK_TAG:-v3.6}
-NETBIRD_TRAEFIK_IP=${TRAEFIK_IP}
-
 # Image tags. Default to "latest"
 NETBIRD_DASHBOARD_TAG=${NETBIRD_DASHBOARD_TAG:-latest}
 NETBIRD_SERVER_TAG=${NETBIRD_SERVER_TAG:-latest}
@@ -408,78 +378,26 @@ EOF
 
 render_compose_common() {
   cat <<'EOF'
-  # Reverse proxy with automatic TLS via Let's Encrypt. Routes are declared as
-  # labels on the services below and picked up through the Docker provider.
-  traefik:
+  caddy:
     <<: *default
-    image: traefik:${NETBIRD_TRAEFIK_TAG}
-    container_name: netbird-traefik
-    networks:
-      netbird:
-        ipv4_address: ${NETBIRD_TRAEFIK_IP}
-    command:
-      # Logging
-      - "--log.level=INFO"
-      - "--accesslog=true"
-      # Docker provider
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=netbird"
-      # Entrypoints
-      - "--entrypoints.web.address=:80"
-      - "--entrypoints.websecure.address=:443"
-      - "--entrypoints.websecure.allowACMEByPass=true"
-      # readTimeout bounds the whole request, and gRPC streams / relay WebSockets
-      # never end one; idleTimeout would close the keep-alive connection they
-      # are reused over. Entrypoint-wide is the only scope Traefik offers here.
-      # writeTimeout is left alone: it already defaults to 0.
-      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
-      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0"
-      # HTTP to HTTPS redirect
-      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
-      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
-      # Let's Encrypt ACME
-      - "--certificatesresolvers.letsencrypt.acme.email=${NETBIRD_LETSENCRYPT_EMAIL}"
-      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
+    image: caddy:2
+    container_name: netbird-caddy
+    networks: [netbird]
+    environment:
+      - CADDY_SECURE_DOMAIN=${NETBIRD_DOMAIN}
     ports:
       - '443:443'
+      - '443:443/udp'
       - '80:80'
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - netbird_traefik_letsencrypt:/letsencrypt
-    labels:
-      - traefik.enable=true
-      # Shared security headers, referenced by every NetBird router below. A
-      # label-declared middleware only exists while its container runs, so this
-      # lives on Traefik itself: declaring it on an app container would drop
-      # every router referencing it whenever that container restarts.
-      - traefik.http.middlewares.nb-security.headers.stsSeconds=3600
-      - traefik.http.middlewares.nb-security.headers.stsIncludeSubdomains=true
-      - traefik.http.middlewares.nb-security.headers.contentTypeNosniff=true
-      - traefik.http.middlewares.nb-security.headers.browserXssFilter=true
-      - traefik.http.middlewares.nb-security.headers.referrerPolicy=strict-origin-when-cross-origin
-      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN
-      # Empty value strips the header. Only the dashboard's nginx sets one; the
-      # server emits none. Do not quote it — "" would send a literal Server: "".
-      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.Server=
+      - netbird_caddy_data:/data
+      - ./Caddyfile:/etc/caddy/Caddyfile
 
   dashboard:
     <<: *default
     image: ghcr.io/netbirdio/dashboard-cloud:${NETBIRD_DASHBOARD_TAG}
     container_name: netbird-dashboard
     networks: [netbird]
-    labels:
-      - traefik.enable=true
-      # Dashboard catch-all: lowest priority so every route below wins
-      - traefik.http.routers.netbird-dashboard.rule=Host(`${NETBIRD_DOMAIN}`)
-      - traefik.http.routers.netbird-dashboard.entrypoints=websecure
-      - traefik.http.routers.netbird-dashboard.tls=true
-      - traefik.http.routers.netbird-dashboard.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-dashboard.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-dashboard.service=dashboard
-      - traefik.http.routers.netbird-dashboard.priority=1
-      - traefik.http.services.dashboard.loadbalancer.server.port=80
     environment:
       - NETBIRD_MGMT_API_ENDPOINT=https://${NETBIRD_DOMAIN}
       - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://${NETBIRD_DOMAIN}
@@ -517,28 +435,6 @@ render_compose_server() {
       - netbird_data:/var/lib/netbird
       - ./config.yaml:/etc/netbird/config.yaml
     command: ["--config", "/etc/netbird/config.yaml"]
-    labels:
-      - traefik.enable=true
-      # Signal + Management gRPC (needs an h2c backend for HTTP/2 cleartext)
-      - traefik.http.routers.netbird-grpc.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
-      - traefik.http.routers.netbird-grpc.entrypoints=websecure
-      - traefik.http.routers.netbird-grpc.tls=true
-      - traefik.http.routers.netbird-grpc.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-grpc.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-grpc.service=netbird-server-h2c
-      - traefik.http.routers.netbird-grpc.priority=100
-      # Relay WebSocket, management API, and the embedded IdP
-      - traefik.http.routers.netbird-backend.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
-      - traefik.http.routers.netbird-backend.entrypoints=websecure
-      - traefik.http.routers.netbird-backend.tls=true
-      - traefik.http.routers.netbird-backend.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-backend.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-backend.service=netbird-server
-      - traefik.http.routers.netbird-backend.priority=100
-      # Services
-      - traefik.http.services.netbird-server.loadbalancer.server.port=80
-      - traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80
-      - traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c
     environment:
       - NB_LICENSE_KEY=${NETBIRD_LICENSE_KEY}
       - NETBIRD_LICENSE_SERVER_BASE_URL=${NETBIRD_LICENSE_SERVER_BASE_URL}
@@ -601,18 +497,6 @@ render_compose_flow() {
       - NB_FLOW_NATS_ENDPOINTS=nats://nats:4222
       - NB_FLOW_NATS_STREAM=traffic-events
       - NB_FLOW_AUTH_SECRET=${NETBIRD_RELAY_AUTH_SECRET}
-    labels:
-      - traefik.enable=true
-      # Flow receiver gRPC (h2c backend)
-      - traefik.http.routers.netbird-flow.rule=Host(`${NETBIRD_DOMAIN}`) && PathPrefix(`/flow.FlowService/`)
-      - traefik.http.routers.netbird-flow.entrypoints=websecure
-      - traefik.http.routers.netbird-flow.tls=true
-      - traefik.http.routers.netbird-flow.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-flow.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-flow.service=netbird-flow-h2c
-      - traefik.http.routers.netbird-flow.priority=100
-      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.port=80
-      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.scheme=h2c
 
 EOF
 }
@@ -652,16 +536,61 @@ EOF
   fi
   cat <<'EOF'
   netbird_postgres:
-  netbird_traefik_letsencrypt:
+  netbird_caddy_data:
 
 networks:
   netbird:
-    name: netbird
-    driver: bridge
-    ipam:
-      config:
-        - subnet: 172.30.0.0/24
-          gateway: 172.30.0.1
+EOF
+}
+
+render_caddyfile() {
+  cat <<'EOF'
+{
+  servers :80,:443 {
+    protocols h1 h2c h2 h3
+  }
+}
+
+(security_headers) {
+    header * {
+        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "SAMEORIGIN"
+        X-XSS-Protection "1; mode=block"
+        -Server
+        Referrer-Policy strict-origin-when-cross-origin
+    }
+}
+
+:80 {
+    redir https://{$CADDY_SECURE_DOMAIN}{uri} permanent
+}
+
+{$CADDY_SECURE_DOMAIN}:443 {
+    import security_headers
+    # Signal (gRPC over h2c)
+    reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-server:80
+    # Management (gRPC over h2c + HTTP)
+    reverse_proxy /management.ManagementService/* h2c://netbird-server:80
+    reverse_proxy /api/* netbird-server:80
+    reverse_proxy /ws-proxy/* netbird-server:80
+    # Embedded IdP (OAuth2 endpoints served by netbird server)
+    reverse_proxy /oauth2/* netbird-server:80
+    # Relay (WebSocket multiplexed on the same port)
+    reverse_proxy /relay* netbird-server:80
+EOF
+
+  if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
+    cat <<'EOF'
+    # Flow receiver (gRPC over h2c)
+    reverse_proxy /flow.FlowService/* h2c://receiver:80
+EOF
+  fi
+
+  cat <<'EOF'
+    # Dashboard
+    reverse_proxy /* dashboard:80
+}
 EOF
 }
 
@@ -680,7 +609,7 @@ server:
   logLevel: "info"
   logFile: "console"
 
-  # TLS is terminated by Traefik in front; leave this block empty.
+  # TLS is terminated by Caddy in front; leave this block empty.
   tls:
     certFile: ""
     keyFile: ""
@@ -697,23 +626,12 @@ server:
     issuer: "https://${NETBIRD_DOMAIN}/oauth2"
     localAuthDisabled: false
     signKeyRefreshEnabled: false
-    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"
     dashboardRedirectURIs:
       - "https://${NETBIRD_DOMAIN}/nb-auth"
       - "https://${NETBIRD_DOMAIN}/nb-silent-auth"
     cliRedirectURIs:
       - "http://localhost:53000/"
 
-  # Trust X-Forwarded-* only from the Traefik container's static address. Both
-  # keys must stay in step with the ipv4_address pinned in docker-compose.yml:
-  # trustedPeers decides whether forwarded headers are read at all, and leaving
-  # it unset falls back to 0.0.0.0/0.
-  reverseProxy:
-    trustedPeers:
-      - "${TRAEFIK_IP}/32"
-    trustedHTTPProxies:
-      - "${TRAEFIK_IP}/32"
-
   store:
     engine: "postgres"
     dsn: "${POSTGRES_DSN}"

infrastructure_files/getting-started.sh

@@ -348,7 +348,6 @@ initialize_default_values() {
   NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
   # Note: DataStoreEncryptionKey must keep base64 padding (=) for Go's base64.StdEncoding
   DATASTORE_ENCRYPTION_KEY=$(openssl rand -base64 32)
-  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)
   NETBIRD_STUN_PORT=3478
 
   # Docker images
@@ -528,8 +527,7 @@ generate_configuration_files() {
 
   # Common files for all configurations
   render_dashboard_env > dashboard.env
-  install -m 600 /dev/null config.yaml
-  render_combined_yaml >> config.yaml
+  render_combined_yaml > config.yaml
   return 0
 }
 
@@ -913,7 +911,6 @@ server:
   auth:
     issuer: "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/oauth2"
     signKeyRefreshEnabled: true
-    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"
     dashboardRedirectURIs:
       - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-auth"
       - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-silent-auth"

infrastructure_files/migrate-to-enterprise.sh

@@ -15,11 +15,7 @@ set -o pipefail
 #   2. Postgres migration — add Postgres, migrate SQLite data via migrate-store.
 #   3. Traffic flow       — add NATS + flow-enricher + flow-receiver.
 #
-# If any step fails once the stack has been touched, the script rolls itself
-# back automatically: generated files are removed, the Postgres volume this run
-# created is dropped, and the original deployment is started again.
-#
-# To revert a successful migration:
+# To revert:
 #   docker compose down
 #   rm -f docker-compose.override.yml config.yaml.enterprise
 #   # If Postgres migration was done, also restore the SQLite backup printed
@@ -29,15 +25,6 @@ set -o pipefail
 OVERRIDE_FILE="docker-compose.override.yml"
 ENTERPRISE_CONFIG_FILE="config.yaml.enterprise"
 
-# Rollback bookkeeping. ROLLBACK_STATE flips to "armed" the moment the script
-# starts mutating the deployment, and back to "disarmed" once the migration has
-# completed successfully.
-ROLLBACK_STATE="disarmed"
-ENV_EXISTED="unknown"
-ENV_BACKUP=""
-PG_VOLUME_NAME=""
-BACKUP_DIR=""
-
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
 check_docker_compose() {
@@ -374,77 +361,7 @@ render_enterprise_config() {
 # Execution steps
 # ---------------------------------------------------------------------------
 
-combined_container_id() {
-  $DOCKER_COMPOSE_COMMAND ps -aq "$COMBINED_SERVICE" 2>/dev/null | head -1
-}
-
-container_data_mount() {
-  local container="$1"
-  [[ -n "$container" ]] || return 0
-  docker inspect "$container" --format \
-    '{{range .Mounts}}{{if eq .Destination "/var/lib/netbird"}}{{if .Name}}{{.Name}}{{else}}{{.Source}}{{end}}{{end}}{{end}}' 2>/dev/null
-}
-
-# The name comes from the container, so `-v` cannot invent an empty volume here.
-# 0 = empty, 1 = holds data, 2 = could not determine. A failed listing must not
-# be reported as empty: that would abort a healthy migration over a pull error
-# or an unreadable bind mount.
-data_dir_state() {
-  local src="$1" out
-  if [[ "$src" == /* ]]; then
-    [[ -d "$src" ]] || return 2
-    out=$(ls -A "$src" 2>/dev/null) || return 2
-  else
-    docker volume inspect "$src" &> /dev/null || return 0
-    out=$(docker run --rm -v "${src}:/d:ro" busybox sh -c 'ls -A /d' 2>/dev/null) || return 2
-  fi
-  [[ -z "$out" ]] && return 0
-  return 1
-}
-
-check_data_directory() {
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
-
-  local container
-  container=$(combined_container_id)
-  if [[ -z "$container" ]]; then
-    echo "" > /dev/stderr
-    echo "No container found for service '$COMBINED_SERVICE'." > /dev/stderr
-    echo "The migration backs up the store by copying it out of that container," > /dev/stderr
-    echo "so it has to exist. Start the deployment and re-run:" > /dev/stderr
-    echo "  $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
-    exit 1
-  fi
-
-  local src
-  src=$(container_data_mount "$container")
-  if [[ -z "$src" ]]; then
-    echo "" > /dev/stderr
-    echo "The '$COMBINED_SERVICE' container has nothing mounted at /var/lib/netbird." > /dev/stderr
-    echo "Cannot locate the NetBird store to back it up." > /dev/stderr
-    exit 1
-  fi
-
-  local state=0
-  data_dir_state "$src" || state=$?
-  if [[ $state -eq 0 ]]; then
-    echo "" > /dev/stderr
-    echo "The NetBird data directory is empty:" > /dev/stderr
-    echo "  $src" > /dev/stderr
-    echo "There is nothing to migrate. Check that you are running this from the" > /dev/stderr
-    echo "deployment directory of the NetBird install you mean to migrate." > /dev/stderr
-    exit 1
-  fi
-  if [[ $state -eq 2 ]]; then
-    echo "  ⚠ Could not read $src to confirm it holds data — continuing." > /dev/stderr
-    echo "    The backup step still fails loudly if it turns out to be empty." > /dev/stderr
-  fi
-
-  echo "  Data directory:   $src"
-}
-
-# Only for the Postgres volume, which has no container to read it off yet.
-resolve_compose_volume() {
+resolve_data_volume() {
   local short="$1"
   local actual
   # Resolve project-prefixed volume name from Docker Compose config first.
@@ -474,21 +391,18 @@ resolve_compose_volume() {
 backup_sqlite() {
   BACKUP_DIR="$(pwd)/backups/sqlite-pre-enterprise-$(date +%Y%m%d-%H%M%S)"
   mkdir -p "$BACKUP_DIR"
-
-  local container
-  container=$(combined_container_id)
-  if [[ -z "$container" ]]; then
-    echo "  ⚠ No container found for '$COMBINED_SERVICE' — cannot back up the store." > /dev/stderr
-    exit 1
-  fi
-
-  echo "Backing up the NetBird store to $BACKUP_DIR ..."
-  docker cp "${container}:/var/lib/netbird/." "$BACKUP_DIR/"
-
+  local data_volume_actual
+  data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
+  echo "Backing up SQLite store from volume '$data_volume_actual' to $BACKUP_DIR ..."
+  docker run --rm \
+    -v "${data_volume_actual}:/var/lib/netbird:ro" \
+    -v "${BACKUP_DIR}:/backup" \
+    busybox \
+    sh -c 'cp -a /var/lib/netbird/. /backup/ 2>/dev/null || true'
   local copied
   copied=$(find "$BACKUP_DIR" -mindepth 1 | head -1)
   if [[ -z "$copied" ]]; then
-    echo "  ⚠ Backup directory is empty — /var/lib/netbird held no data. Aborting." > /dev/stderr
+    echo "  ⚠ Backup directory is empty — the volume '$data_volume_actual' didn't contain data. Aborting." > /dev/stderr
     exit 1
   fi
   echo "  done"
@@ -500,135 +414,6 @@ run_migrate_store() {
   echo "  done"
 }
 
-# ---------------------------------------------------------------------------
-# Rollback — a failed run must not leave the operator with a stopped stack and
-# half-written artifacts.
-# ---------------------------------------------------------------------------
-
-# Resolve the name Compose would give the Postgres volume before the override
-# exists, so a leftover volume can be spotted up front.
-compose_project_name() {
-  local container project
-  container=$($DOCKER_COMPOSE_COMMAND ps -aq 2>/dev/null | head -1)
-  if [[ -n "$container" ]]; then
-    project=$(docker inspect "$container" \
-      --format '{{index .Config.Labels "com.docker.compose.project"}}' 2>/dev/null)
-    if [[ -n "$project" ]]; then
-      echo "$project"
-      return 0
-    fi
-  fi
-  project=$($DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval '.name // ""' - 2>/dev/null)
-  if [[ -n "$project" ]] && [[ "$project" != "null" ]]; then
-    echo "$project"
-  fi
-  return 0
-}
-
-postgres_volume_name() {
-  local project
-  project=$(compose_project_name)
-  if [[ -n "$project" ]]; then
-    echo "${project}_netbird_postgres"
-  fi
-  return 0
-}
-
-# Postgres skips initdb when its data directory is non-empty, so a volume left
-# behind by an interrupted run would keep the old password and old contents,
-# and migrate-store would fail against it.
-check_stale_postgres_volume() {
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
-
-  PG_VOLUME_NAME=$(postgres_volume_name)
-  if [[ -z "$PG_VOLUME_NAME" ]]; then
-    echo ""
-    echo "  ⚠ Could not determine the Compose project name, so a Postgres volume"
-    echo "    left over from an earlier attempt cannot be checked for. If a"
-    echo "    previous run failed, remove it before continuing:"
-    echo "      docker volume ls | grep netbird_postgres"
-    return 0
-  fi
-  docker volume inspect "$PG_VOLUME_NAME" &> /dev/null || return 0
-
-  echo ""
-  echo "  ⚠  A Postgres volume from an earlier attempt already exists:"
-  echo "       $PG_VOLUME_NAME"
-  echo "     Postgres does not re-initialise a non-empty data directory, so the"
-  echo "     migration would run against stale credentials and stale data."
-  local remove
-  remove=$(read_yes_no "  Remove it and continue?" "y")
-  if [[ "$remove" != "yes" ]]; then
-    echo "" > /dev/stderr
-    echo "Aborted. Remove it manually with: docker volume rm $PG_VOLUME_NAME" > /dev/stderr
-    exit 1
-  fi
-  docker volume rm "$PG_VOLUME_NAME" > /dev/null
-  echo "  Removed."
-}
-
-# Undo whatever this run changed and start the previous deployment again.
-rollback() {
-  ROLLBACK_STATE="done"
-
-  echo ""
-  echo "──────────────────────────────────────────────────────────────────────"
-  echo " Migration failed — restoring the previous deployment"
-  echo "──────────────────────────────────────────────────────────────────────"
-
-  # Resolve while the override is still present; without it Compose no longer
-  # knows about the Postgres volume.
-  local pg_volume="$PG_VOLUME_NAME"
-  if [[ -z "$pg_volume" ]] && [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    pg_volume=$(postgres_volume_name)
-  fi
-
-  echo ""
-  echo "Stopping services ..."
-  $DOCKER_COMPOSE_COMMAND down || true
-
-  echo "Removing generated files ..."
-  rm -f "$OVERRIDE_FILE" "$ENTERPRISE_CONFIG_FILE"
-
-  # Restore .env to exactly what it was, or remove it if this run created it.
-  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
-    mv -f "$ENV_BACKUP" .env || echo "  ⚠ Could not restore .env from $ENV_BACKUP." > /dev/stderr
-  elif [[ "$ENV_EXISTED" == "no" ]]; then
-    rm -f .env || true
-  fi
-
-  # Only ever the volume this run created — never the NetBird data volume.
-  if [[ -n "$pg_volume" ]] && [[ "$pg_volume" != "null" ]]; then
-    echo "Removing Postgres volume $pg_volume ..."
-    docker volume rm "$pg_volume" &> /dev/null || true
-  fi
-
-  echo "Starting the previous deployment ..."
-  if ! $DOCKER_COMPOSE_COMMAND up -d; then
-    echo ""
-    echo "  ⚠ Could not start the previous deployment automatically." > /dev/stderr
-    echo "    Run: $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
-  fi
-
-  echo ""
-  echo "Rolled back. Your docker-compose.yml, config.yaml and the NetBird data"
-  echo "volume were never modified."
-  if [[ -n "$BACKUP_DIR" ]] && [[ -d "$BACKUP_DIR" ]]; then
-    echo "The SQLite backup taken during this run is kept at:"
-    echo "  $BACKUP_DIR"
-  fi
-  echo "──────────────────────────────────────────────────────────────────────"
-}
-
-on_exit() {
-  local code=$?
-  trap - EXIT
-  if [[ $code -ne 0 ]] && [[ "$ROLLBACK_STATE" == "armed" ]]; then
-    rollback
-  fi
-  exit $code
-}
-
 # ---------------------------------------------------------------------------
 # Main
 # ---------------------------------------------------------------------------
@@ -756,15 +541,9 @@ init_migration() {
     ENABLE_FLOW="no"
     echo "Step 3 (traffic flow) skipped — requires Postgres."
   fi
-
-  check_data_directory
-  check_stale_postgres_volume
 }
 
 apply_changes() {
-  # From here on a failure must roll the deployment back.
-  ROLLBACK_STATE="armed"
-
   echo ""
   echo "Writing $OVERRIDE_FILE ..."
   install -m 644 /dev/null "$OVERRIDE_FILE"
@@ -785,14 +564,6 @@ apply_changes() {
   # picks it up automatically.
   echo "Writing .env additions (mode 600) ..."
   local ENV_FILE=".env"
-  # Snapshot the operator's .env so a rollback can restore it byte for byte.
-  if [[ -f "$ENV_FILE" ]]; then
-    ENV_EXISTED="yes"
-    ENV_BACKUP="${ENV_FILE}.pre-enterprise-$(date +%Y%m%d-%H%M%S)"
-    cp -p "$ENV_FILE" "$ENV_BACKUP"
-  else
-    ENV_EXISTED="no"
-  fi
   touch "$ENV_FILE"
   chmod 600 "$ENV_FILE"
   {
@@ -821,16 +592,11 @@ apply_changes() {
 
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     echo ""
-    # Stop, but keep the containers: the backup reads the store out of one.
-    echo "Stopping services so the store is quiescent ..."
-    $DOCKER_COMPOSE_COMMAND stop
+    echo "Stopping existing services (volumes preserved) ..."
+    $DOCKER_COMPOSE_COMMAND down
 
     backup_sqlite
 
-    echo ""
-    echo "Removing stopped containers (volumes preserved) ..."
-    $DOCKER_COMPOSE_COMMAND down
-
     echo ""
     echo "Starting Postgres ..."
     $DOCKER_COMPOSE_COMMAND up -d postgres
@@ -860,9 +626,6 @@ apply_changes() {
 
   echo ""
   echo "Migration complete."
-
-  # Nothing left to undo.
-  ROLLBACK_STATE="disarmed"
 }
 
 print_summary() {
@@ -880,7 +643,6 @@ print_summary() {
   echo "    $OVERRIDE_FILE"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
   echo "    .env  (license key + secrets, mode 600)"
-  [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]] && echo "    $ENV_BACKUP  (.env as it was before this run)"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    backups/sqlite-pre-enterprise-*/  (SQLite backup)"
   echo ""
   echo " Tail logs:"
@@ -889,27 +651,19 @@ print_summary() {
   echo "──────────────────────────────────────────────────────────────────────"
   echo " To revert"
   echo "──────────────────────────────────────────────────────────────────────"
+  echo "  $DOCKER_COMPOSE_COMMAND down"
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    # Resolve the project-prefixed volume name now, before the override is gone.
-    local pg_volume
-    pg_volume=$(resolve_compose_volume "netbird_postgres")
-    echo "  # Stop, but keep the containers so the store can be copied back in:"
-    echo "  $DOCKER_COMPOSE_COMMAND stop"
-    echo "  # Restore SQLite from the backup created during this run:"
-    echo "  docker cp ${BACKUP_DIR}/. \$($DOCKER_COMPOSE_COMMAND ps -aq $COMBINED_SERVICE):/var/lib/netbird/"
-    echo "  $DOCKER_COMPOSE_COMMAND down"
+    # Resolve project-prefixed volume names now (before override is removed).
+    local pg_volume data_volume_actual
+    pg_volume=$(resolve_data_volume "netbird_postgres")
+    data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
+    echo "  # Remove the Postgres volume FIRST, before deleting the override file:"
     echo "  docker volume rm $pg_volume"
-  else
-    echo "  $DOCKER_COMPOSE_COMMAND down"
+    echo "  # Restore SQLite from the backup created during this run:"
+    echo "  docker run --rm -v ${data_volume_actual}:/var/lib/netbird -v ${BACKUP_DIR}:/backup busybox sh -c 'cp -a /backup/. /var/lib/netbird/'"
   fi
   echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
-  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
-    echo "  mv $ENV_BACKUP .env   # restores .env as it was before this run"
-  elif [[ "$ENV_EXISTED" == "no" ]]; then
-    echo "  rm -f .env   # created by this run"
-  else
-    echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
-  fi
+  echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
   echo "  $DOCKER_COMPOSE_COMMAND up -d"
   echo "──────────────────────────────────────────────────────────────────────"
 }
@@ -918,10 +672,6 @@ print_summary() {
 # Run
 # ---------------------------------------------------------------------------
 
-trap on_exit EXIT
-# Turn signals into a normal exit so the EXIT trap can roll back.
-trap 'exit 130' INT TERM
-
 init_migration
 apply_changes
 print_summary

management/internals/modules/agentnetwork/handlers/budget_handler_test.go

@@ -102,8 +102,8 @@ func TestSettingsHandler_GetExposesCollectionToggles(t *testing.T) {
 
 	require.NoError(t, f.store.SaveAgentNetworkSettings(context.Background(), &agentNetworkTypes.Settings{
 		AccountID:              testAccountID,
-		Domain:                 "violet.eu.proxy.netbird.io",
-		ProxyAddress:           "eu.proxy.netbird.io",
+		Cluster:                "eu.proxy.netbird.io",
+		Subdomain:              "violet",
 		EnableLogCollection:    true,
 		EnablePromptCollection: true,
 		RedactPii:              false,

management/internals/modules/agentnetwork/handlers/handlers_test.go

@@ -17,7 +17,6 @@ import (
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/account"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -62,23 +61,10 @@ func newAgentNetworkHandlerFixture(t *testing.T) *agentNetworkHandlerFixture {
 		Return(true, context.Background(), nil).
 		AnyTimes()
 
-	// Swallow activity events so the mutation paths (create/update/delete)
-	// are exercisable through the HTTP layer.
-	accounts := account.NewMockManager(ctrl)
-	accounts.EXPECT().
-		StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
-		AnyTimes()
-	accounts.EXPECT().
-		UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).
-		AnyTimes()
-
-	manager := agentnetwork.NewManager(st, perms, accounts, nil)
+	manager := agentnetwork.NewManager(st, perms, nil, nil)
 	h := &handler{manager: manager}
 
 	router := mux.NewRouter()
-	router.HandleFunc("/agent-network/providers", h.createProvider).Methods("POST")
-	router.HandleFunc("/agent-network/providers/{providerId}", h.getProvider).Methods("GET")
-	router.HandleFunc("/agent-network/providers/{providerId}", h.updateProvider).Methods("PUT")
 	h.addPolicyEndpoints(router)
 	h.addConsumptionEndpoints(router)
 	h.addBudgetRuleEndpoints(router)

management/internals/modules/agentnetwork/handlers/providers_handler.go

@@ -155,7 +155,12 @@ func (h *handler) createProvider(w http.ResponseWriter, r *http.Request) {
 	provider := types.NewProvider(userAuth.AccountId)
 	provider.FromAPIRequest(&req)
 
-	created, err := h.manager.CreateProvider(r.Context(), userAuth.UserId, provider)
+	bootstrapCluster := ""
+	if req.BootstrapCluster != nil {
+		bootstrapCluster = *req.BootstrapCluster
+	}
+
+	created, err := h.manager.CreateProvider(r.Context(), userAuth.UserId, provider, bootstrapCluster)
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return

management/internals/modules/agentnetwork/handlers/providers_handler_test.go

@@ -1,9 +1,7 @@
 package handlers
 
 import (
-	"encoding/json"
 	"math"
-	nethttp "net/http"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -53,50 +51,3 @@ func TestValidate_ModelRates(t *testing.T) {
 		assert.Error(t, validate(base(m), true), "case %q must be rejected", name)
 	}
 }
-
-// TestProviderHandler_UpdateReplacesFullState pins the update contract shared
-// with the other PUT endpoints: the request replaces the provider's mutable
-// state, so optional fields absent from the JSON land as their zero values.
-// The two exceptions are server-side: the api_key (a secret — omitted means
-// "not rotated") and the session keypair, both preserved by the manager. The
-// identity headers stay on the wire as explicit empty strings so a cleared
-// value round-trips.
-func TestProviderHandler_UpdateReplacesFullState(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	create := `{
-        "provider_id": "openai_api",
-        "name": "openai",
-        "upstream_url": "https://api.openai.com",
-        "api_key": "sk-test",
-        "enabled": true,
-        "metadata_disabled": true,
-        "skip_tls_verification": true,
-        "extra_values": {"x-portkey-config": "pc-prod-3f2a"},
-        "identity_header_user_id": "x-bf-dim-netbird_user_id",
-        "models": [{"id": "gpt-4o", "input_per_1k": 0.0025, "output_per_1k": 0.01}]
-    }`
-	rec := f.do(t, nethttp.MethodPost, "/agent-network/providers", create)
-	require.Equal(t, nethttp.StatusOK, rec.Code, "create must succeed: %s", rec.Body.String())
-
-	var created api.AgentNetworkProvider
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &created))
-
-	// Minimal update: only the required fields, no api_key. Everything
-	// optional must land as its zero value.
-	update := `{"provider_id": "openai_api", "name": "openai-renamed", "upstream_url": "https://api.openai.com", "enabled": true}`
-	rec = f.do(t, nethttp.MethodPut, "/agent-network/providers/"+created.Id, update)
-	require.Equal(t, nethttp.StatusOK, rec.Code, "update without api_key must succeed (key is preserved): %s", rec.Body.String())
-
-	var updated api.AgentNetworkProvider
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &updated))
-	assert.Equal(t, "openai-renamed", updated.Name, "sent field must apply")
-	assert.True(t, updated.Enabled, "sent field must apply")
-	assert.False(t, updated.MetadataDisabled, "omitted metadata_disabled must land as false — PUT replaces the full state")
-	assert.False(t, updated.SkipTlsVerification, "omitted skip_tls_verification must land as false")
-	assert.Nil(t, updated.ExtraValues, "omitted extra_values must be cleared")
-	assert.Equal(t, "", updated.IdentityHeaderUserId, "omitted identity header must be cleared yet stay on the wire")
-	assert.Empty(t, updated.Models, "omitted models must be cleared")
-	assert.Contains(t, rec.Body.String(), `"identity_header_user_id":""`,
-		"cleared identity header must round-trip as an explicit empty string")
-}

management/internals/modules/agentnetwork/handlers/settings_handler.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"encoding/json"
+	"errors"
 	"net/http"
 
 	"github.com/gorilla/mux"
@@ -10,59 +11,19 @@ import (
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 	"github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
 )
 
-// addSettingsEndpoints registers the Agent Network settings routes. POST
-// bootstraps the settings row, assigning the account's immutable endpoint;
-// GET reads it (defaults with an empty endpoint before bootstrap) and PUT
-// replaces the mutable collection toggles. The identity fields are not part
-// of the PUT schema — immutability by shape, not by rejection.
+// addSettingsEndpoints registers the Agent Network settings routes. The
+// settings row is bootstrapped server-side on first provider create; GET reads
+// it and PUT updates the mutable collection toggles (cluster/subdomain stay
+// immutable).
 func (h *handler) addSettingsEndpoints(router *mux.Router) {
 	router.HandleFunc("/agent-network/settings", h.getSettings).Methods("GET", "OPTIONS")
-	router.HandleFunc("/agent-network/settings", h.createSettings).Methods("POST", "OPTIONS")
 	router.HandleFunc("/agent-network/settings", h.updateSettings).Methods("PUT", "OPTIONS")
 }
 
-// createSettings bootstraps the account's settings row. Exactly one of
-// proxy_address (labeled endpoint; the server allocates the label) and
-// endpoint (self-addressed, claimed verbatim) must be provided; optional
-// collection toggles ride along with defaults for omitted fields.
-func (h *handler) createSettings(w http.ResponseWriter, r *http.Request) {
-	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-
-	var req api.AgentNetworkSettingsCreateRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		util.WriteErrorResponse("couldn't parse JSON request", http.StatusBadRequest, w)
-		return
-	}
-
-	settings := types.DefaultSettings(userAuth.AccountId)
-	settings.FromAPICreateRequest(&req)
-
-	proxyAddress := ""
-	if req.ProxyAddress != nil {
-		proxyAddress = *req.ProxyAddress
-	}
-	endpoint := ""
-	if req.Endpoint != nil {
-		endpoint = *req.Endpoint
-	}
-
-	created, err := h.manager.CreateSettings(r.Context(), userAuth.UserId, settings, proxyAddress, endpoint)
-	if err != nil {
-		util.WriteError(r.Context(), err, w)
-		return
-	}
-	util.WriteJSONObject(r.Context(), w, created.ToAPIResponse())
-}
-
-// updateSettings replaces the mutable settings fields on the account's row.
-// A request carrying a cluster bootstraps the row when the account doesn't
-// have one yet.
+// updateSettings applies the collection toggles to the account's settings row.
 func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -87,9 +48,11 @@ func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
 }
 
-// getSettings returns the account's agent-network settings. Accounts that
-// haven't been bootstrapped yet read as the defaults with an empty cluster,
-// subdomain and endpoint; the manager synthesises that view.
+// getSettings returns the account's agent-network settings. The settings
+// row is bootstrapped on first provider create, so freshly-onboarded
+// accounts have nothing to read. Rather than 404-ing in that case (which
+// the dashboard would have to special-case), return a JSON null with 200
+// so consumers can branch on the body alone.
 func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -99,6 +62,11 @@ func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
 
 	settings, err := h.manager.GetSettings(r.Context(), userAuth.AccountId, userAuth.UserId)
 	if err != nil {
+		var sErr *status.Error
+		if errors.As(err, &sErr) && sErr.Type() == status.NotFound {
+			util.WriteJSONObject(r.Context(), w, nil)
+			return
+		}
 		util.WriteError(r.Context(), err, w)
 		return
 	}

management/internals/modules/agentnetwork/handlers/settings_handler_test.go

@@ -1,197 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"net/http"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// TestSettingsHandler_GetUnbootstrappedReturnsDefaults pins the settings-read
-// convention shared with the account and DNS settings endpoints: settings
-// always read as a JSON object. Before bootstrap that object carries the
-// defaults with an empty endpoint/proxy_address (the "not bootstrapped"
-// signal) and no timestamps — never a 404 and never the legacy null body.
-func TestSettingsHandler_GetUnbootstrappedReturnsDefaults(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodGet, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code,
-		"unbootstrapped account must read as 200 with defaults: got %d body=%s", rec.Code, rec.Body.String())
-	require.NotEqual(t, "null", trimSpace(rec.Body.String()),
-		"the legacy 200+null shape must not come back")
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Empty(t, got.Endpoint, "endpoint must be empty until bootstrapped")
-	assert.Empty(t, got.ProxyAddress, "proxy address must be empty until bootstrapped")
-	assert.False(t, got.Dedicated, "an unbootstrapped account has no serving shape")
-	assert.True(t, got.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
-	assert.False(t, got.EnablePromptCollection, "defaults must show prompt collection off")
-	assert.False(t, got.RedactPii, "defaults must show redaction off")
-	require.NotNil(t, got.AccessLogRetentionDays)
-	assert.Equal(t, 30, *got.AccessLogRetentionDays, "defaults must show the bootstrap retention")
-	assert.Nil(t, got.CreatedAt, "no timestamps before a row exists")
-	assert.Nil(t, got.UpdatedAt, "no timestamps before a row exists")
-}
-
-// TestSettingsHandler_PostBootstrapsLabeled covers the labeled bootstrap
-// shape: a POST carrying a proxy_address allocates a label beneath it, so the
-// endpoint hangs one label under the shared cluster's address and the pin is
-// not dedicated. Toggles riding along apply; omitted ones keep defaults.
-func TestSettingsHandler_PostBootstrapsLabeled(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPost, "/agent-network/settings",
-		`{"proxy_address": "eu.proxy.netbird.io", "enable_prompt_collection": true, "access_log_retention_days": 14}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, "eu.proxy.netbird.io", got.ProxyAddress, "proxy address must be pinned from the request")
-	require.NotEmpty(t, got.Endpoint, "endpoint must be allocated at bootstrap")
-	assert.True(t, strings.HasSuffix(got.Endpoint, ".eu.proxy.netbird.io"),
-		"labeled endpoint must hang off the proxy address: %s", got.Endpoint)
-	label := strings.TrimSuffix(got.Endpoint, ".eu.proxy.netbird.io")
-	assert.NotContains(t, label, ".", "the allocated label must be a single DNS label: %s", label)
-	assert.False(t, got.Dedicated, "a labeled pin is not dedicated")
-	assert.True(t, got.EnableLogCollection, "omitted toggle must keep its default")
-	assert.True(t, got.EnablePromptCollection, "toggle from the bootstrap request must apply")
-	require.NotNil(t, got.AccessLogRetentionDays)
-	assert.Equal(t, 14, *got.AccessLogRetentionDays, "retention from the bootstrap request must apply")
-	assert.NotNil(t, got.CreatedAt, "a persisted row carries timestamps")
-
-	// The row is now readable via GET.
-	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code, "GET after bootstrap must succeed")
-	var read api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &read))
-	assert.Equal(t, got.Endpoint, read.Endpoint, "GET must return the bootstrapped endpoint")
-}
-
-// TestSettingsHandler_PostBootstrapsSelfAddressed covers the dedicated shape:
-// a POST carrying an endpoint claims the hostname verbatim, the proxy address
-// equals it, and the pin reads as dedicated. The claim is legitimate before
-// any proxy declares the address (address-first).
-func TestSettingsHandler_PostBootstrapsSelfAddressed(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPost, "/agent-network/settings",
-		`{"endpoint": "Brave-Otter.Gateway.Example.com"}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, "brave-otter.gateway.example.com", got.Endpoint,
-		"endpoint must be claimed verbatim, lowercased")
-	assert.Equal(t, got.Endpoint, got.ProxyAddress, "self-addressed: the proxy address is the endpoint")
-	assert.True(t, got.Dedicated, "a self-addressed pin is dedicated")
-	assert.True(t, got.EnableLogCollection, "omitted toggles must keep their defaults")
-}
-
-// TestSettingsHandler_PostRequiresExactlyOneIdentityField pins the request
-// contract: proxy_address and endpoint are mutually exclusive and one is
-// required — both or neither is a validation error, not a guess.
-func TestSettingsHandler_PostRequiresExactlyOneIdentityField(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPost, "/agent-network/settings", `{}`)
-	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
-		"empty POST must be rejected: got %d body=%s", rec.Code, rec.Body.String())
-
-	rec = f.do(t, http.MethodPost, "/agent-network/settings",
-		`{"proxy_address": "eu.proxy.netbird.io", "endpoint": "brave-otter.gateway.example.com"}`)
-	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
-		"POST with both identity fields must be rejected: got %d body=%s", rec.Code, rec.Body.String())
-}
-
-// TestSettingsHandler_PostRejectsMalformedHostnames pins per-write input
-// validation: shapes canonicalization cannot repair — trailing dots, embedded
-// whitespace, empty labels — are rejected with a validation error instead of
-// landing in an immutable column.
-func TestSettingsHandler_PostRejectsMalformedHostnames(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	for name, body := range map[string]string{
-		"trailing dot":     `{"endpoint": "gateway.example.com."}`,
-		"leading dot":      `{"endpoint": ".gateway.example.com"}`,
-		"inner whitespace": `{"endpoint": "gate way.example.com"}`,
-		"empty label":      `{"proxy_address": "eu..proxy.netbird.io"}`,
-	} {
-		rec := f.do(t, http.MethodPost, "/agent-network/settings", body)
-		assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
-			"%s must be rejected: got %d body=%s", name, rec.Code, rec.Body.String())
-	}
-}
-
-// TestSettingsHandler_PostConflictsOnSecondBootstrap pins that bootstrap is a
-// one-time create: a second POST returns 409 and leaves the row untouched.
-func TestSettingsHandler_PostConflictsOnSecondBootstrap(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPost, "/agent-network/settings", `{"proxy_address": "eu.proxy.netbird.io"}`)
-	require.Equal(t, http.StatusOK, rec.Code, "first bootstrap must succeed: %s", rec.Body.String())
-	var first api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &first))
-
-	rec = f.do(t, http.MethodPost, "/agent-network/settings", `{"proxy_address": "us.proxy.netbird.io"}`)
-	assert.Equal(t, http.StatusConflict, rec.Code,
-		"second bootstrap must 409: got %d body=%s", rec.Code, rec.Body.String())
-
-	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
-	require.Equal(t, http.StatusOK, rec.Code)
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.Equal(t, first.Endpoint, got.Endpoint, "the original endpoint must survive the rejected bootstrap")
-	assert.Equal(t, first.ProxyAddress, got.ProxyAddress, "the original proxy address must survive")
-}
-
-// TestSettingsHandler_PutBeforeBootstrapIs404 pins that a PUT cannot conjure a
-// settings row out of nothing — bootstrap is the explicit POST — and the
-// error points the caller there.
-func TestSettingsHandler_PutBeforeBootstrapIs404(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"enable_log_collection": false, "enable_prompt_collection": false, "redact_pii": false}`)
-	assert.Equal(t, http.StatusNotFound, rec.Code,
-		"PUT on an unbootstrapped account must 404: got %d body=%s", rec.Code, rec.Body.String())
-	assert.Contains(t, rec.Body.String(), "/api/agent-network/settings",
-		"the error must point the caller at the bootstrap POST: %s", rec.Body.String())
-}
-
-// TestSettingsHandler_PutReplacesMutableFields pins the update contract shared
-// with the other PUT endpoints: the request replaces every mutable field, so a
-// toggle absent from the JSON lands as its zero value rather than being
-// preserved. The identity fields are not part of the PUT schema at all, so
-// the endpoint and proxy address survive updates by construction.
-func TestSettingsHandler_PutReplacesMutableFields(t *testing.T) {
-	f := newAgentNetworkHandlerFixture(t)
-
-	rec := f.do(t, http.MethodPost, "/agent-network/settings",
-		`{"proxy_address": "eu.proxy.netbird.io", "enable_prompt_collection": true, "redact_pii": true, "access_log_retention_days": 14}`)
-	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
-
-	var before api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &before))
-
-	rec = f.do(t, http.MethodPut, "/agent-network/settings",
-		`{"enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
-	require.Equal(t, http.StatusOK, rec.Code, "update PUT must succeed: %s", rec.Body.String())
-
-	var got api.AgentNetworkSettings
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
-	assert.True(t, got.EnableLogCollection, "sent toggle must apply")
-	assert.False(t, got.EnablePromptCollection, "sent toggle must apply")
-	assert.False(t, got.RedactPii, "sent toggle must apply")
-	require.NotNil(t, got.AccessLogRetentionDays)
-	assert.Equal(t, 0, *got.AccessLogRetentionDays,
-		"retention absent from the request must land as the zero value — PUT replaces all mutable fields")
-	assert.Equal(t, before.Endpoint, got.Endpoint, "endpoint must survive updates untouched")
-	assert.Equal(t, before.ProxyAddress, got.ProxyAddress, "proxy address must survive updates untouched")
-}

management/internals/modules/agentnetwork/labelgen/adjectives.go

@@ -1,37 +0,0 @@
-package labelgen
-
-// adjectives is the descriptor half of a generated label. It pairs with the
-// noun pool in words.go to form `<adjective>-<noun>` labels, and is kept
-// separate because words.go is almost entirely nouns — drawing both halves
-// from it produced unreadable pairs like "millet-hammock". Entries are
-// lowercase ASCII, 4-12 chars, free of hyphens and digits, screened for
-// offensive/brand/region-specific terms, and disjoint from the noun pool
-// (enforced by TestAdjectives_AreDisjointFromNouns).
-var adjectives = []string{
-	"able", "active", "adept", "agile", "airy", "alert", "amiable", "ample",
-	"ancient", "ardent", "artful", "astute", "balmy", "blithe", "bold", "bonny",
-	"brave", "breezy", "brisk", "bubbly", "buoyant", "bushy", "candid", "canny",
-	"cheery", "chilly", "chipper", "chunky", "civil", "classic", "clever", "comely",
-	"compact", "cordial", "cosmic", "courtly", "crafty", "creamy", "crisp", "cuddly",
-	"curious", "dainty", "dapper", "daring", "dashing", "deft", "dewy", "diligent",
-	"downy", "dreamy", "dulcet", "durable", "dusky", "eager", "earnest", "earthy",
-	"easy", "elated", "elegant", "epic", "fabled", "faithful", "fancy", "fearless",
-	"feisty", "fervent", "fleet", "fluffy", "fond", "frisky", "frosty", "gallant",
-	"genial", "genteel", "gentle", "giddy", "gilded", "glad", "glassy", "gleaming",
-	"glossy", "graceful", "grand", "grainy", "hale", "hardy", "hearty", "hefty",
-	"honest", "hopeful", "humble", "hushed", "immense", "jaunty", "jolly", "jovial",
-	"joyful", "jubilant", "keen", "kindly", "kindred", "lanky", "leafy", "limber",
-	"lively", "lofty", "loyal", "lucent", "lucid", "luminous", "lush", "maroon",
-	"mellow", "merry", "mighty", "mindful", "mirthful", "misty", "modest", "muted",
-	"nifty", "nimble", "noble", "patient", "peaceful", "pearly", "peppy", "perky",
-	"petite", "placid", "playful", "pleasant", "plucky", "plush", "polite", "posh",
-	"prancing", "pristine", "prompt", "proud", "prudent", "quaint", "quick", "quirky",
-	"radiant", "ready", "regal", "restful", "robust", "rosy", "ruddy", "rugged",
-	"sandy", "satin", "saucy", "savvy", "sedate", "serene", "shady", "shiny",
-	"silken", "silky", "sincere", "sleek", "slender", "smart", "smooth", "snappy",
-	"snug", "soaring", "sparkly", "spiffy", "spirited", "sprightly", "spry", "stalwart",
-	"stately", "steady", "sterling", "stoic", "stormy", "stout", "sturdy", "sunlit",
-	"supple", "svelte", "tawny", "tender", "tidy", "timeless", "trusty", "upbeat",
-	"urbane", "valiant", "vast", "vernal", "vibrant", "vintage", "whimsy", "willing",
-	"windy", "winsome", "wintry", "witty", "worthy", "zesty", "zippy",
-}

management/internals/modules/agentnetwork/labelgen/labelgen.go

@@ -64,20 +64,3 @@ func PickUnique(rng *rand.Rand, taken map[string]struct{}, fallbackSuffix string
 	w := pool[rng.Intn(len(pool))]
 	return fmt.Sprintf("%s-%s", w, fallbackSuffix)
 }
-
-// PickTuple returns an adjective-noun label such as "brave-otter". It is still
-// a single DNS label.
-//
-// Unlike PickUnique it takes no `taken` set and has no fallback suffix. The
-// noun pool holds 857 entries, which is ample per cluster but a hard ceiling
-// once labels must be unique across one shared zone; pairing an adjective with
-// a noun spans len(adjectives) * 857 instead. Uniqueness is enforced by a
-// database constraint and retried by the caller, rather than guessed from a
-// pre-read set that a concurrent allocation can invalidate.
-func PickTuple(rng *rand.Rand) string {
-	nouns := uniqueWords()
-	if len(nouns) == 0 || len(adjectives) == 0 {
-		return ""
-	}
-	return adjectives[rng.Intn(len(adjectives))] + "-" + nouns[rng.Intn(len(nouns))]
-}

management/internals/modules/agentnetwork/labelgen/labelgen_test.go

@@ -99,82 +99,3 @@ func TestUniqueWords_DropsDuplicates(t *testing.T) {
 	}
 	assert.GreaterOrEqual(t, len(pool), 500, "Pool must contain at least 500 unique words")
 }
-
-// TestPickTuple_ShapeAndPoolMembership locks the wire-visible shape: an
-// adjective and a noun, each from its own pool, joined by a single hyphen so
-// the result stays one DNS label.
-func TestPickTuple_ShapeAndPoolMembership(t *testing.T) {
-	nouns := uniqueWords()
-	inNouns := make(map[string]struct{}, len(nouns))
-	for _, w := range nouns {
-		inNouns[w] = struct{}{}
-	}
-	inAdjectives := make(map[string]struct{}, len(adjectives))
-	for _, a := range adjectives {
-		inAdjectives[a] = struct{}{}
-	}
-
-	rng := rand.New(rand.NewSource(7))
-	for i := 0; i < 200; i++ {
-		got := PickTuple(rng)
-
-		parts := strings.Split(got, "-")
-		require.Len(t, parts, 2, "PickTuple must produce exactly two hyphen-joined words; got %q", got)
-
-		_, adjOK := inAdjectives[parts[0]]
-		assert.True(t, adjOK, "First half must be an adjective; %q not in adjectives (from %q)", parts[0], got)
-		_, nounOK := inNouns[parts[1]]
-		assert.True(t, nounOK, "Second half must be a noun; %q not in words (from %q)", parts[1], got)
-
-		assert.LessOrEqual(t, len(got), 63, "Label must fit a DNS label; got %q (%d chars)", got, len(got))
-	}
-}
-
-// TestAdjectives_AreDisjointFromNouns keeps the namespace a clean product and
-// prevents nonsense like "azure-azure": a handful of the noun pool's entries
-// are adjectival, and any overlap would let the same word land on both sides.
-func TestAdjectives_AreDisjointFromNouns(t *testing.T) {
-	nouns := make(map[string]struct{}, len(uniqueWords()))
-	for _, w := range uniqueWords() {
-		nouns[w] = struct{}{}
-	}
-	for _, a := range adjectives {
-		_, clash := nouns[a]
-		assert.False(t, clash, "Adjective %q also appears in the noun pool; remove it from one list", a)
-	}
-}
-
-// TestAdjectives_AreDNSSafeAndDeduplicated mirrors the curation contract stated
-// in words.go: lowercase ASCII, 4-12 chars, no digits or hyphens, no repeats.
-func TestAdjectives_AreDNSSafeAndDeduplicated(t *testing.T) {
-	seen := make(map[string]struct{}, len(adjectives))
-	for _, a := range adjectives {
-		_, dup := seen[a]
-		assert.False(t, dup, "Duplicate adjective %q", a)
-		seen[a] = struct{}{}
-
-		assert.Regexp(t, `^[a-z]{4,12}$`, a, "Adjective %q must be 4-12 lowercase ASCII letters", a)
-	}
-	assert.Greater(t, len(adjectives), 150, "Adjective pool too small to give a useful namespace")
-}
-
-// TestPickTuple_DeterministicWithSeededRng documents that generation is a pure
-// function of the rng, which is what makes allocation retries reproducible in tests.
-func TestPickTuple_DeterministicWithSeededRng(t *testing.T) {
-	a := PickTuple(rand.New(rand.NewSource(42)))
-	b := PickTuple(rand.New(rand.NewSource(42)))
-	assert.Equal(t, a, b, "Same seed must yield the same tuple")
-}
-
-// TestPickTuple_SpansALargeNamespace guards the reason we moved to tuples: a
-// single-word pool caps the GLOBAL namespace at 857. Drawing many tuples must
-// yield overwhelmingly distinct values.
-func TestPickTuple_SpansALargeNamespace(t *testing.T) {
-	rng := rand.New(rand.NewSource(11))
-	seen := make(map[string]struct{}, 2000)
-	for i := 0; i < 2000; i++ {
-		seen[PickTuple(rng)] = struct{}{}
-	}
-	assert.Greater(t, len(seen), 1900,
-		"2000 draws should be nearly all distinct across a ~200k namespace; got %d unique", len(seen))
-}

management/internals/modules/agentnetwork/manager.go

@@ -22,6 +22,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -47,7 +48,7 @@ func ensureSessionKeys(p *types.Provider) error {
 type Manager interface {
 	GetAllProviders(ctx context.Context, accountID, userID string) ([]*types.Provider, error)
 	GetProvider(ctx context.Context, accountID, userID, providerID string) (*types.Provider, error)
-	CreateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error)
+	CreateProvider(ctx context.Context, userID string, provider *types.Provider, bootstrapCluster string) (*types.Provider, error)
 	UpdateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error)
 	DeleteProvider(ctx context.Context, accountID, userID, providerID string) error
 
@@ -70,7 +71,6 @@ type Manager interface {
 	DeleteBudgetRule(ctx context.Context, accountID, userID, ruleID string) error
 
 	GetSettings(ctx context.Context, accountID, userID string) (*types.Settings, error)
-	CreateSettings(ctx context.Context, userID string, settings *types.Settings, proxyAddress, endpoint string) (*types.Settings, error)
 	UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error)
 
 	ListConsumption(ctx context.Context, accountID, userID string) ([]*types.Consumption, error)
@@ -123,10 +123,11 @@ type managerImpl struct {
 	proxyController    proxy.Controller
 
 	// reconcileCache holds the last set of synthesised proxy mappings
-	// per account, each paired with the proxy that served it, so a change
-	// of serving proxy can be diffed without re-deriving it.
+	// per account so reconcile can emit precise Create/Update/Delete
+	// updates instead of a full re-push on every mutation. Keyed by
+	// accountID, then by synthesised service ID.
 	reconcileMu    sync.Mutex
-	reconcileCache map[string]map[string]syntheticMapping
+	reconcileCache map[string]map[string]*proto.ProxyMapping
 
 	// labelRngMu guards labelRng. PickUnique consumes math/rand.Source
 	// state; concurrent provider creates would otherwise race.
@@ -150,7 +151,7 @@ func NewManager(
 		accountManager:     accountManager,
 		permissionsManager: permissionsManager,
 		proxyController:    proxyController,
-		reconcileCache:     make(map[string]map[string]syntheticMapping),
+		reconcileCache:     make(map[string]map[string]*proto.ProxyMapping),
 		labelRng:           rand.New(rand.NewSource(time.Now().UnixNano())),
 	}
 }
@@ -169,14 +170,19 @@ func (m *managerImpl) GetProvider(ctx context.Context, accountID, userID, provid
 	return m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, providerID)
 }
 
-// CreateProvider persists a new provider for the account. Providers have no
-// settings side effects: the account's endpoint is bootstrapped separately and
-// explicitly via CreateSettings, and every provider in the account routes
-// through it.
-func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error) {
+// CreateProvider persists a new provider for the account. bootstrapCluster
+// is used only when the per-account agent-network Settings row hasn't
+// been created yet; otherwise it is ignored (the cluster is pinned on
+// Settings and every provider in the account routes through it).
+func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provider *types.Provider, bootstrapCluster string) (*types.Provider, error) {
 	if err := m.requirePermission(ctx, provider.AccountID, userID, modules.AgentNetworkProviders, operations.Create); err != nil {
 		return nil, err
 	}
+	if strings.TrimSpace(bootstrapCluster) != "" {
+		if err := m.requireSettingsBootstrapPermission(ctx, provider.AccountID, userID); err != nil {
+			return nil, err
+		}
+	}
 
 	// An empty api_key would silently produce a synthesised service
 	// that 401s on every upstream request. Surface the misconfiguration
@@ -200,6 +206,16 @@ func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provide
 		return nil, fmt.Errorf("save agent network provider: %w", err)
 	}
 
+	if strings.TrimSpace(bootstrapCluster) != "" {
+		if _, err := m.bootstrapSettingsIfNeeded(ctx, provider.AccountID, bootstrapCluster); err != nil {
+			// The provider create has already succeeded; logging the
+			// bootstrap miss matches the plan's PoC behaviour. The synth
+			// path treats a missing settings row as a no-op, and the next
+			// provider create retries the bootstrap.
+			log.WithContext(ctx).Debugf("agent-network bootstrap settings for account %s on cluster %s: %v", provider.AccountID, bootstrapCluster, err)
+		}
+	}
+
 	m.accountManager.StoreEvent(ctx, userID, provider.ID, provider.AccountID, activity.AgentNetworkProviderCreated, provider.EventMeta())
 	m.reconcile(ctx, provider.AccountID)
 
@@ -543,63 +559,40 @@ func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, r
 	return nil
 }
 
-// UpdateSettings replaces the mutable account-level settings — the collection
-// toggles and retention — on the account's row. The identity fields (Domain,
-// ProxyAddress) are assigned at bootstrap (CreateSettings) and are not part of
-// the update surface at all; when the account has no settings row yet the
-// update fails with NotFound. Because the collection toggles change the
-// synthesised service config (prompt-capture gating, access-log emission), a
-// reconcile is triggered so the proxy and peer network maps converge on the
-// new state.
+// UpdateSettings applies the mutable account-level settings — the collection
+// toggles — onto the existing row. Cluster and Subdomain are immutable and are
+// preserved from the persisted row regardless of the input. Because the
+// collection toggles change the synthesised service config (prompt-capture
+// gating, access-log emission), a reconcile is triggered so the proxy and peer
+// network maps converge on the new state.
 func (m *managerImpl) UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error) {
 	if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Update); err != nil {
 		return nil, err
 	}
 
-	// The row lock from LockingStrengthUpdate only holds for the duration of
-	// the surrounding transaction, so the read and the save must share one —
-	// otherwise concurrent PUTs could interleave between them.
-	var updated *types.Settings
-	err := m.store.ExecuteInTransaction(ctx, func(tx store.Store) error {
-		existing, err := tx.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, settings.AccountID)
-		switch {
-		case err == nil:
-		case isNotFound(err):
-			return status.Errorf(status.NotFound, "agent network settings have not been bootstrapped yet; POST /api/agent-network/settings to bootstrap them")
-		default:
-			return fmt.Errorf("get agent network settings: %w", err)
-		}
-
-		existing.EnableLogCollection = settings.EnableLogCollection
-		existing.EnablePromptCollection = settings.EnablePromptCollection
-		existing.RedactPii = settings.RedactPii
-		existing.AccessLogRetentionDays = settings.AccessLogRetentionDays
-		existing.UpdatedAt = time.Now().UTC()
-
-		if err := tx.SaveAgentNetworkSettings(ctx, existing); err != nil {
-			return fmt.Errorf("save agent network settings: %w", err)
-		}
-		updated = existing
-		return nil
-	})
+	existing, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, settings.AccountID)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("get agent network settings: %w", err)
+	}
+
+	existing.EnableLogCollection = settings.EnableLogCollection
+	existing.EnablePromptCollection = settings.EnablePromptCollection
+	existing.RedactPii = settings.RedactPii
+	existing.AccessLogRetentionDays = settings.AccessLogRetentionDays
+	existing.UpdatedAt = time.Now().UTC()
+
+	if err := m.store.SaveAgentNetworkSettings(ctx, existing); err != nil {
+		return nil, fmt.Errorf("save agent network settings: %w", err)
 	}
 
 	m.accountManager.StoreEvent(ctx, userID, settings.AccountID, settings.AccountID, activity.AgentNetworkSettingsUpdated, map[string]any{
-		"log_collection":    updated.EnableLogCollection,
-		"prompt_collection": updated.EnablePromptCollection,
-		"redact_pii":        updated.RedactPii,
+		"log_collection":    existing.EnableLogCollection,
+		"prompt_collection": existing.EnablePromptCollection,
+		"redact_pii":        existing.RedactPii,
 	})
 	m.reconcile(ctx, settings.AccountID)
 
-	return updated, nil
-}
-
-// isNotFound reports whether err is a status.NotFound error.
-func isNotFound(err error) bool {
-	var sErr *status.Error
-	return errors.As(err, &sErr) && sErr.Type() == status.NotFound
+	return existing, nil
 }
 
 // validateProviderRefs ensures every destination provider id refers to a
@@ -623,181 +616,91 @@ func (m *managerImpl) validateProviderRefs(ctx context.Context, accountID string
 	return nil
 }
 
-// GetSettings returns the agent-network settings row for the account. When no
-// row has been bootstrapped yet, the defaults are returned (without
-// persisting) with cluster and subdomain empty — settings always read as an
-// object, like the account and DNS settings endpoints.
+// GetSettings returns the agent-network settings row for the account.
+// Returns the underlying status.NotFound when no row has been
+// bootstrapped yet (i.e. the account has no providers).
 func (m *managerImpl) GetSettings(ctx context.Context, accountID, userID string) (*types.Settings, error) {
 	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Read); err != nil {
 		return nil, err
 	}
-	settings, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
-	switch {
-	case err == nil:
-		return settings, nil
-	case isNotFound(err):
-		return types.DefaultSettings(accountID), nil
-	default:
-		return nil, err
-	}
+	return m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
 }
 
-// maxDomainAllocationAttempts bounds the label search when bootstrapping a
-// labeled endpoint. Package-level (rather than function-local) so tests can
-// assert on the exhaustion path without duplicating the literal.
-const maxDomainAllocationAttempts = 10
-
-// CreateSettings bootstraps the per-account settings row, assigning the
-// account's immutable endpoint. Exactly one of proxyAddress and endpoint must
-// be non-empty: proxyAddress allocates a labeled endpoint one label beneath
-// the given cluster address; endpoint claims the given hostname verbatim as a
-// self-addressed (dedicated) endpoint — a legitimate claim before any proxy
-// declares the address (address-first). settings carries the account ID and
-// the initial collection toggles; its identity fields are assigned here.
-func (m *managerImpl) CreateSettings(ctx context.Context, userID string, settings *types.Settings, proxyAddress, endpoint string) (*types.Settings, error) {
-	if settings == nil || settings.AccountID == "" {
-		return nil, status.Errorf(status.InvalidArgument, "account id is required")
+// bootstrapSettingsIfNeeded creates the per-account agent-network
+// settings row when missing. The cluster comes from the create-time
+// hint the dashboard sends (auto-picked from the active cluster list);
+// the subdomain is picked from the curated wordlist avoiding
+// collisions on the same cluster. Idempotent: if a row already exists
+// it is returned untouched and the hint is ignored.
+// requireSettingsBootstrapPermission gates the one-time settings bootstrap a
+// first provider create performs. Pinning the account's cluster and subdomain
+// is a settings write, so it needs the settings permission on top of the
+// provider one. No-op once the settings row exists.
+func (m *managerImpl) requireSettingsBootstrapPermission(ctx context.Context, accountID, userID string) error {
+	_, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	if err == nil {
+		return nil
 	}
-	if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Create); err != nil {
-		return nil, err
+	var sErr *status.Error
+	if !errors.As(err, &sErr) || sErr.Type() != status.NotFound {
+		return fmt.Errorf("get agent network settings: %w", err)
+	}
+	return m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Create)
+}
+
+func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID, providerCluster string) (*types.Settings, error) {
+	if accountID == "" {
+		return nil, fmt.Errorf("bootstrap settings: account id is required")
+	}
+	if strings.TrimSpace(providerCluster) == "" {
+		return nil, fmt.Errorf("bootstrap settings: provider cluster is required")
 	}
 
-	hasProxyAddress := strings.TrimSpace(proxyAddress) != ""
-	hasEndpoint := strings.TrimSpace(endpoint) != ""
-	if hasProxyAddress == hasEndpoint {
-		return nil, status.Errorf(status.InvalidArgument, "exactly one of proxy_address and endpoint is required")
+	existing, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	if err == nil {
+		return existing, nil
 	}
-
-	// Fail fast on an existing row for a clean 409; the insert below stays
-	// the authority against concurrent bootstraps (the primary key wins).
-	if _, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, settings.AccountID); err == nil {
-		return nil, status.Errorf(status.AlreadyExists, "agent network settings already bootstrapped for account %s", settings.AccountID)
-	} else if !isNotFound(err) {
+	var sErr *status.Error
+	if !errors.As(err, &sErr) || sErr.Type() != status.NotFound {
 		return nil, fmt.Errorf("get agent network settings: %w", err)
 	}
 
+	siblings, err := m.store.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, providerCluster)
+	if err != nil {
+		return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
+	}
+	taken := make(map[string]struct{}, len(siblings))
+	for _, s := range siblings {
+		taken[s.Subdomain] = struct{}{}
+	}
+
+	suffix := accountID
+	if len(suffix) > 4 {
+		suffix = suffix[:4]
+	}
+
+	m.labelRngMu.Lock()
+	subdomain := labelgen.PickUnique(m.labelRng, taken, suffix)
+	m.labelRngMu.Unlock()
+
 	now := time.Now().UTC()
-	settings.CreatedAt = now
-	settings.UpdatedAt = now
-
-	var err error
-	if hasEndpoint {
-		err = m.bootstrapSelfAddressed(ctx, settings, endpoint)
-	} else {
-		err = m.bootstrapLabeled(ctx, settings, proxyAddress)
+	settings := &types.Settings{
+		AccountID: accountID,
+		Cluster:   providerCluster,
+		Subdomain: subdomain,
+		// Logs on by default; usage is collected regardless. Retention bounds
+		// how long full log rows are kept.
+		EnableLogCollection:    true,
+		AccessLogRetentionDays: types.DefaultAccessLogRetentionDays,
+		CreatedAt:              now,
+		UpdatedAt:              now,
 	}
-	if err != nil {
-		return nil, err
+	if err := m.store.SaveAgentNetworkSettings(ctx, settings); err != nil {
+		return nil, fmt.Errorf("save agent network settings: %w", err)
 	}
-
-	m.accountManager.StoreEvent(ctx, userID, settings.AccountID, settings.AccountID, activity.AgentNetworkSettingsUpdated, map[string]any{
-		"bootstrapped": true,
-		"endpoint":     settings.Domain,
-		"dedicated":    settings.Dedicated(),
-	})
-	m.reconcile(ctx, settings.AccountID)
-
 	return settings, nil
 }
 
-// bootstrapSelfAddressed claims the given hostname as the account's endpoint,
-// served only by a proxy declaring exactly that address (Domain ==
-// ProxyAddress). The domain unique index is the arbiter of availability.
-func (m *managerImpl) bootstrapSelfAddressed(ctx context.Context, settings *types.Settings, endpoint string) error {
-	hostname, err := types.NormalizeHostname(endpoint)
-	if err != nil {
-		return status.Errorf(status.InvalidArgument, "invalid endpoint: %s", err)
-	}
-
-	settings.Domain = hostname
-	settings.ProxyAddress = hostname
-	if err := m.store.CreateAgentNetworkSettings(ctx, settings); err != nil {
-		if isUniqueConstraintError(err) {
-			// The violation is either the account primary key (a concurrent
-			// bootstrap for the same account won) or the domain index
-			// (another account holds the hostname). Distinguish by re-read.
-			if _, getErr := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, settings.AccountID); getErr == nil {
-				return status.Errorf(status.AlreadyExists, "agent network settings already bootstrapped for account %s", settings.AccountID)
-			}
-			return status.Errorf(status.AlreadyExists, "endpoint %s is already taken", hostname)
-		}
-		return fmt.Errorf("create agent network settings: %w", err)
-	}
-	return nil
-}
-
-// bootstrapLabeled allocates a labeled endpoint one label beneath the given
-// cluster address: Domain = <label>.<proxyAddress>, served by whichever proxy
-// declares the parent. Labels are adjective-noun tuples; a candidate is
-// checked by read and the domain unique index stays the authority, so a
-// concurrent allocation of the same tuple surfaces as a unique violation and
-// another tuple is drawn.
-func (m *managerImpl) bootstrapLabeled(ctx context.Context, settings *types.Settings, proxyAddress string) error {
-	parent, err := types.NormalizeHostname(proxyAddress)
-	if err != nil {
-		return status.Errorf(status.InvalidArgument, "invalid proxy_address: %s", err)
-	}
-
-	for attempt := 1; attempt <= maxDomainAllocationAttempts; attempt++ {
-		m.labelRngMu.Lock()
-		label := labelgen.PickTuple(m.labelRng)
-		m.labelRngMu.Unlock()
-		if label == "" {
-			// Only reachable if either word pool were emptied. An empty label
-			// would produce a broken endpoint like ".example.com", so fail
-			// loudly rather than looping or inserting.
-			return fmt.Errorf("allocate agent network endpoint for account %s: label generator returned an empty label", settings.AccountID)
-		}
-
-		candidate, err := types.NormalizeHostname(label + "." + parent)
-		if err != nil {
-			return status.Errorf(status.InvalidArgument, "proxy_address leaves no room for a label: %s", err)
-		}
-
-		_, err = m.store.GetAgentNetworkSettingsByDomain(ctx, store.LockingStrengthNone, candidate)
-		if err == nil {
-			log.WithContext(ctx).Tracef("agent-network endpoint %q taken, retrying (attempt %d/%d)", candidate, attempt, maxDomainAllocationAttempts)
-			continue
-		}
-		if !isNotFound(err) {
-			return fmt.Errorf("check agent network endpoint availability: %w", err)
-		}
-
-		settings.Domain = candidate
-		settings.ProxyAddress = parent
-		if err := m.store.CreateAgentNetworkSettings(ctx, settings); err != nil {
-			if isUniqueConstraintError(err) {
-				// A concurrent bootstrap for the same account may have won on
-				// the primary key — return the conflict. A lost race on the
-				// domain index just means the tuple was taken between the
-				// read and the insert: draw another.
-				if _, getErr := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, settings.AccountID); getErr == nil {
-					return status.Errorf(status.AlreadyExists, "agent network settings already bootstrapped for account %s", settings.AccountID)
-				}
-				log.WithContext(ctx).Tracef("agent-network endpoint %q lost an allocation race, retrying (attempt %d/%d)", candidate, attempt, maxDomainAllocationAttempts)
-				continue
-			}
-			return fmt.Errorf("create agent network settings: %w", err)
-		}
-		return nil
-	}
-
-	return fmt.Errorf("allocate agent network endpoint for account %s: %d attempts exhausted", settings.AccountID, maxDomainAllocationAttempts)
-}
-
-// isUniqueConstraintError reports whether err is a database unique-constraint
-// violation, matched on the driver message because CreateAgentNetworkSettings
-// deliberately returns the driver error unwrapped.
-func isUniqueConstraintError(err error) bool {
-	if err == nil {
-		return false
-	}
-	msg := err.Error()
-	return strings.Contains(msg, "(SQLSTATE 23505)") || // postgres
-		strings.Contains(msg, "Error 1062 (23000)") || // mysql
-		strings.Contains(msg, "UNIQUE constraint failed") // sqlite
-}
-
 // ListConsumption returns every consumption row recorded for the
 // account, ordered window-newest-first. Backs the dashboard's basic
 // counter view; permission gate is the same Read role that gates
@@ -931,7 +834,7 @@ func (*mockManager) GetProvider(_ context.Context, _, _, _ string) (*types.Provi
 	return &types.Provider{}, nil
 }
 
-func (*mockManager) CreateProvider(_ context.Context, _ string, p *types.Provider) (*types.Provider, error) {
+func (*mockManager) CreateProvider(_ context.Context, _ string, p *types.Provider, _ string) (*types.Provider, error) {
 	return p, nil
 }
 
@@ -995,19 +898,8 @@ func (*mockManager) UpdateBudgetRule(_ context.Context, _ string, r *types.Accou
 
 func (*mockManager) DeleteBudgetRule(_ context.Context, _, _, _ string) error { return nil }
 
-func (*mockManager) GetSettings(_ context.Context, accountID, _ string) (*types.Settings, error) {
-	return types.DefaultSettings(accountID), nil
-}
-
-func (*mockManager) CreateSettings(_ context.Context, _ string, s *types.Settings, proxyAddress, endpoint string) (*types.Settings, error) {
-	if endpoint != "" {
-		s.Domain = endpoint
-		s.ProxyAddress = endpoint
-	} else {
-		s.Domain = "mock." + proxyAddress
-		s.ProxyAddress = proxyAddress
-	}
-	return s, nil
+func (*mockManager) GetSettings(_ context.Context, _, _ string) (*types.Settings, error) {
+	return nil, status.Errorf(status.NotFound, "agent network settings not found")
 }
 
 func (*mockManager) UpdateSettings(_ context.Context, _ string, s *types.Settings) (*types.Settings, error) {

management/internals/modules/agentnetwork/provider_bootstrap_test.go

@@ -0,0 +1,134 @@
+package agentnetwork
+
+import (
+	"context"
+	"runtime"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/store"
+	nbtypes "github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// bootstrapFixture wires a real sqlite store to a gomock permissions manager
+// so tests can grant the provider permission while denying (or never
+// expecting) the settings one.
+type bootstrapFixture struct {
+	manager Manager
+	store   store.Store
+	perms   *permissions.MockManager
+}
+
+func newBootstrapFixture(t *testing.T) *bootstrapFixture {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		t.Skip("sqlite store not properly supported on Windows yet")
+	}
+	t.Setenv("NETBIRD_STORE_ENGINE", string(nbtypes.SqliteStoreEngine))
+
+	st, cleanUp, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err, "test store setup must succeed")
+	t.Cleanup(cleanUp)
+
+	ctrl := gomock.NewController(t)
+	perms := permissions.NewMockManager(ctrl)
+
+	accounts := account.NewMockManager(ctrl)
+	accounts.EXPECT().StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	accounts.EXPECT().UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	accounts.EXPECT().BufferUpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+
+	return &bootstrapFixture{
+		manager: NewManager(st, perms, accounts, nil),
+		store:   st,
+		perms:   perms,
+	}
+}
+
+func (f *bootstrapFixture) expectPermission(accountID, userID string, module modules.Module, op operations.Operation, allowed bool) {
+	f.perms.EXPECT().
+		ValidateUserPermissions(gomock.Any(), accountID, userID, module, op).
+		Return(allowed, context.Background(), nil)
+}
+
+func newBootstrapProvider(accountID string) *types.Provider {
+	p := types.NewProvider(accountID)
+	p.Name = "openai"
+	p.UpstreamURL = "https://api.openai.com"
+	p.APIKey = "sk-test"
+	p.Enabled = true
+	return p
+}
+
+// TestCreateProviderBootstrapRequiresSettingsPermission pins the gate on the
+// one-time settings bootstrap: creating the first provider with a
+// bootstrap_cluster pins the account's cluster and subdomain, which is a
+// settings write and must not ride on the providers permission alone.
+func TestCreateProviderBootstrapRequiresSettingsPermission(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("denied without settings permission", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, false)
+
+		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
+		require.Error(t, err, "bootstrap without settings permission must fail")
+		var sErr *status.Error
+		require.ErrorAs(t, err, &sErr)
+		assert.Equal(t, status.PermissionDenied, sErr.Type(), "denial should surface as permission denied")
+
+		providers, err := f.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "account1")
+		require.NoError(t, err)
+		assert.Empty(t, providers, "provider must not be persisted when bootstrap is denied")
+		_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+		assert.Error(t, err, "settings row must not be created when bootstrap is denied")
+	})
+
+	t.Run("allowed with settings permission", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+		created, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
+		require.NoError(t, err, "bootstrap with both permissions must succeed")
+		require.NotNil(t, created)
+
+		settings, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+		require.NoError(t, err, "bootstrap must create the settings row")
+		assert.Equal(t, "cluster1.example.com", settings.Cluster, "settings should pin the bootstrap cluster")
+	})
+
+	t.Run("existing settings need no settings permission", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		require.NoError(t, f.store.SaveAgentNetworkSettings(ctx, &types.Settings{
+			AccountID: "account1",
+			Cluster:   "cluster1.example.com",
+			Subdomain: "existing",
+		}), "pre-existing settings row setup must succeed")
+
+		// Only the providers permission may be consulted: gomock fails the
+		// test on any unexpected settings-permission call.
+		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
+		require.NoError(t, err, "create with existing settings must not require the settings permission")
+	})
+
+	t.Run("no bootstrap cluster needs no settings permission", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "")
+		require.NoError(t, err, "create without bootstrap must not require the settings permission")
+	})
+}

management/internals/modules/agentnetwork/reconcile.go

@@ -10,17 +10,6 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
-// syntheticMapping pairs a synthesised proxy mapping with the address of the
-// proxy that serves it. The cluster is recorded rather than derived from the
-// mapping's domain: ProxyMapping does not carry it, and the previous derivation
-// -- everything after the first DNS label -- is wrong whenever the service's
-// domain is not one label under its proxy's address, which silently addressed
-// updates to a cluster no proxy declares.
-type syntheticMapping struct {
-	mapping *proto.ProxyMapping
-	cluster string
-}
-
 // reconcile recomputes the synthesised reverse-proxy services for an
 // account, diffs them against the previously-synthesised set in the
 // in-memory cache, and emits Create / Update / Delete proxy mappings
@@ -56,21 +45,18 @@ func (m *managerImpl) reconcile(ctx context.Context, accountID string) {
 	}
 
 	oidcCfg := m.proxyController.GetOIDCValidationConfig()
-	current := make(map[string]syntheticMapping, len(services))
+	current := make(map[string]*proto.ProxyMapping, len(services))
 	for _, svc := range services {
 		if svc == nil || svc.ID == "" {
 			continue
 		}
-		current[svc.ID] = syntheticMapping{
-			mapping: svc.ToProtoMapping(rpservice.Update, "", oidcCfg),
-			cluster: svc.ProxyCluster,
-		}
+		current[svc.ID] = svc.ToProtoMapping(rpservice.Update, "", oidcCfg)
 	}
 
 	m.reconcileMu.Lock()
 	previous := m.reconcileCache[accountID]
 	if previous == nil {
-		previous = make(map[string]syntheticMapping)
+		previous = make(map[string]*proto.ProxyMapping)
 	}
 
 	creates, updates, deletes := diffMappings(previous, current)
@@ -81,36 +67,34 @@ func (m *managerImpl) reconcile(ctx context.Context, accountID string) {
 	}
 	m.reconcileMu.Unlock()
 
-	for _, entry := range creates {
-		entry.mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED
-		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, entry.mapping, entry.cluster)
+	for _, mapping := range creates {
+		mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_CREATED
+		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, mapping, clusterFromMapping(mapping))
 	}
-	for _, entry := range updates {
-		entry.mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_MODIFIED
-		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, entry.mapping, entry.cluster)
+	for _, mapping := range updates {
+		mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_MODIFIED
+		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, mapping, clusterFromMapping(mapping))
 	}
-	for _, entry := range deletes {
-		entry.mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED
-		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, entry.mapping, entry.cluster)
+	for _, mapping := range deletes {
+		mapping.Type = proto.ProxyMappingUpdateType_UPDATE_TYPE_REMOVED
+		m.proxyController.SendServiceUpdateToCluster(ctx, accountID, mapping, clusterFromMapping(mapping))
 	}
 }
 
-// diffMappings classifies the previous→current transition for a single
-// account into Create / Update / Delete sets.
+// diffMappings classifies the previous→current transition for a
+// single account into Create / Update / Delete sets.
 //
-// A change of serving proxy for the same service ID is surfaced as a Delete
-// addressed to the old proxy plus a Create addressed to the new one, so the
-// mapping actually moves. Comparing the recorded cluster is what makes that
-// detectable: with a placement-free endpoint the mapping's domain is identical
-// before and after the move, so nothing about the mapping itself reveals it.
-func diffMappings(previous, current map[string]syntheticMapping) (creates, updates, deletes []syntheticMapping) {
+// Cluster moves (current.cluster != previous.cluster) are surfaced as
+// a Delete on the old cluster + Create on the new — handled by
+// emitting both a delete (on previous mapping) and a create (on the
+// current mapping) for that service ID.
+func diffMappings(previous, current map[string]*proto.ProxyMapping) (creates, updates, deletes []*proto.ProxyMapping) {
 	for id, cur := range current {
 		prev, existed := previous[id]
 		switch {
 		case !existed:
 			creates = append(creates, cur)
-		case prev.mapping.GetDomain() == "" ||
-			cur.mapping.GetAccountId() == prev.mapping.GetAccountId() && prev.cluster != cur.cluster:
+		case prev.GetDomain() == "" || cur.GetAccountId() == prev.GetAccountId() && currentClusterChanged(prev, cur):
 			deletes = append(deletes, prev)
 			creates = append(creates, cur)
 		default:
@@ -124,3 +108,24 @@ func diffMappings(previous, current map[string]syntheticMapping) (creates, updat
 	}
 	return creates, updates, deletes
 }
+
+func currentClusterChanged(prev, cur *proto.ProxyMapping) bool {
+	return clusterFromMapping(prev) != clusterFromMapping(cur)
+}
+
+// clusterFromMapping returns the cluster the mapping should be sent
+// to. ProxyMapping doesn't carry the cluster directly, so we rely on
+// the synthesised service's domain (`<slug>.<cluster>`) and split on
+// the first '.'.
+func clusterFromMapping(m *proto.ProxyMapping) string {
+	if m == nil {
+		return ""
+	}
+	domain := m.GetDomain()
+	for i := 0; i < len(domain); i++ {
+		if domain[i] == '.' {
+			return domain[i+1:]
+		}
+	}
+	return ""
+}

management/internals/modules/agentnetwork/reconcile_test.go

@@ -21,7 +21,7 @@ func newReconcileMgr(t *testing.T, ctrl *gomock.Controller) (*managerImpl, *stor
 	return &managerImpl{
 		store:           mockStore,
 		proxyController: mockProxy,
-		reconcileCache:  make(map[string]map[string]syntheticMapping),
+		reconcileCache:  make(map[string]map[string]*proto.ProxyMapping),
 	}, mockStore, mockProxy
 }
 
@@ -52,9 +52,9 @@ func newReconcileTestPolicy(providerID, sourceGroupID string) *types.Policy {
 
 func newReconcileTestSettings() *types.Settings {
 	return &types.Settings{
-		AccountID:    "acct-1",
-		Domain:       "violet.eu.proxy.netbird.io",
-		ProxyAddress: "eu.proxy.netbird.io",
+		AccountID: "acct-1",
+		Cluster:   "eu.proxy.netbird.io",
+		Subdomain: "violet",
 	}
 }
 
@@ -196,7 +196,7 @@ func TestReconcile_PolicyRemoved_EmitsDelete(t *testing.T) {
 func TestReconcile_NilProxyController_NoOp(t *testing.T) {
 	ctx := context.Background()
 	mgr := &managerImpl{
-		reconcileCache: make(map[string]map[string]syntheticMapping),
+		reconcileCache: make(map[string]map[string]*proto.ProxyMapping),
 	}
 	// Must not panic; must not query the store.
 	mgr.reconcile(ctx, "acct-1")
@@ -212,78 +212,21 @@ func TestReconcile_EmptyAccountID_NoOp(t *testing.T) {
 	mgr.reconcile(ctx, "")
 }
 
-// TestDiffMappings_ServingProxyChange — when the proxy serving an account
-// changes, the same service ID must be deleted on the old proxy and created on
-// the new one. The cluster cannot be recovered from the mapping's domain: with a
-// placement-free endpoint the domain does not change at all when the serving
-// proxy does, so a domain-derived cluster sees no change and emits a plain
-// update, addressed to a proxy that does not exist.
-func TestDiffMappings_ServingProxyChange(t *testing.T) {
-	previous := map[string]syntheticMapping{
-		"svc-1": {
-			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "brave-otter.gateway.example.com"},
-			cluster: "proxy.example.com",
-		},
+func TestClusterFromMapping(t *testing.T) {
+	tests := []struct {
+		name   string
+		domain string
+		want   string
+	}{
+		{"simple", "openai.eu.proxy.netbird.io", "eu.proxy.netbird.io"},
+		{"deeply nested", "a.b.c.d", "b.c.d"},
+		{"no dot", "openai", ""},
+		{"empty", "", ""},
 	}
-	current := map[string]syntheticMapping{
-		"svc-1": {
-			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "brave-otter.gateway.example.com"},
-			cluster: "brave-otter.gateway.example.com",
-		},
-	}
-
-	creates, updates, deletes := diffMappings(previous, current)
-
-	if assert.Len(t, deletes, 1, "the old proxy must be told to drop the mapping") {
-		assert.Equal(t, "proxy.example.com", deletes[0].cluster)
-	}
-	if assert.Len(t, creates, 1, "the new proxy must be told to add it") {
-		assert.Equal(t, "brave-otter.gateway.example.com", creates[0].cluster)
-	}
-	assert.Empty(t, updates, "a serving-proxy move is a delete plus a create, not an update")
-}
-
-// TestDiffMappings_UnchangedClusterIsAnUpdate keeps the ordinary path: same
-// service, same proxy, changed contents.
-func TestDiffMappings_UnchangedClusterIsAnUpdate(t *testing.T) {
-	previous := map[string]syntheticMapping{
-		"svc-1": {
-			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "otter.proxy.example.com"},
-			cluster: "proxy.example.com",
-		},
-	}
-	current := map[string]syntheticMapping{
-		"svc-1": {
-			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "otter.proxy.example.com"},
-			cluster: "proxy.example.com",
-		},
-	}
-
-	creates, updates, deletes := diffMappings(previous, current)
-
-	assert.Empty(t, creates)
-	assert.Empty(t, deletes)
-	if assert.Len(t, updates, 1) {
-		assert.Equal(t, "proxy.example.com", updates[0].cluster)
-	}
-}
-
-// TestDiffMappings_RemovedServiceIsDeletedOnItsOwnCluster — a service that has
-// gone away is deleted on the cluster it was last served by, which is recorded
-// rather than re-derived.
-func TestDiffMappings_RemovedServiceIsDeletedOnItsOwnCluster(t *testing.T) {
-	previous := map[string]syntheticMapping{
-		"svc-1": {
-			mapping: &proto.ProxyMapping{Id: "svc-1", AccountId: "acct-1", Domain: "brave-otter.gateway.example.com"},
-			cluster: "brave-otter.gateway.example.com",
-		},
-	}
-
-	creates, updates, deletes := diffMappings(previous, map[string]syntheticMapping{})
-
-	assert.Empty(t, creates)
-	assert.Empty(t, updates)
-	if assert.Len(t, deletes, 1) {
-		assert.Equal(t, "brave-otter.gateway.example.com", deletes[0].cluster)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := clusterFromMapping(&proto.ProxyMapping{Domain: tt.domain})
+			assert.Equal(t, tt.want, got)
+		})
 	}
 }

management/internals/modules/agentnetwork/settings_bootstrap_test.go

@@ -1,225 +0,0 @@
-package agentnetwork
-
-import (
-	"context"
-	"runtime"
-	"strings"
-	"testing"
-
-	"github.com/golang/mock/gomock"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/server/account"
-	"github.com/netbirdio/netbird/management/server/permissions"
-	"github.com/netbirdio/netbird/management/server/permissions/modules"
-	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/management/server/store"
-	nbtypes "github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/management/status"
-)
-
-// bootstrapFixture wires a real sqlite store to a gomock permissions manager
-// so tests can grant or deny the settings permission per case.
-type bootstrapFixture struct {
-	manager Manager
-	store   store.Store
-	perms   *permissions.MockManager
-}
-
-func newBootstrapFixture(t *testing.T) *bootstrapFixture {
-	t.Helper()
-	if runtime.GOOS == "windows" {
-		t.Skip("sqlite store not properly supported on Windows yet")
-	}
-	t.Setenv("NETBIRD_STORE_ENGINE", string(nbtypes.SqliteStoreEngine))
-
-	st, cleanUp, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	require.NoError(t, err, "test store setup must succeed")
-	t.Cleanup(cleanUp)
-
-	ctrl := gomock.NewController(t)
-	perms := permissions.NewMockManager(ctrl)
-
-	accounts := account.NewMockManager(ctrl)
-	accounts.EXPECT().StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
-	accounts.EXPECT().UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
-	accounts.EXPECT().BufferUpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
-
-	return &bootstrapFixture{
-		manager: NewManager(st, perms, accounts, nil),
-		store:   st,
-		perms:   perms,
-	}
-}
-
-func (f *bootstrapFixture) expectPermission(accountID, userID string, module modules.Module, op operations.Operation, allowed bool) {
-	f.perms.EXPECT().
-		ValidateUserPermissions(gomock.Any(), accountID, userID, module, op).
-		Return(allowed, context.Background(), nil)
-}
-
-func (f *bootstrapFixture) createSettings(ctx context.Context, accountID, userID, proxyAddress, endpoint string) (*types.Settings, error) {
-	return f.manager.CreateSettings(ctx, userID, types.DefaultSettings(accountID), proxyAddress, endpoint)
-}
-
-// TestCreateSettingsRequiresPermission pins the gate: bootstrap assigns the
-// account's immutable endpoint, a settings write requiring the settings
-// Create permission — and a denial leaves no row behind.
-func TestCreateSettingsRequiresPermission(t *testing.T) {
-	ctx := context.Background()
-	f := newBootstrapFixture(t)
-	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, false)
-
-	_, err := f.createSettings(ctx, "account1", "user1", "cluster1.example.com", "")
-	require.Error(t, err, "bootstrap without the settings permission must fail")
-	var sErr *status.Error
-	require.ErrorAs(t, err, &sErr)
-	assert.Equal(t, status.PermissionDenied, sErr.Type(), "denial should surface as permission denied")
-
-	_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-	assert.Error(t, err, "settings row must not be created when bootstrap is denied")
-}
-
-// TestCreateSettingsLabeled pins the labeled shape: the server allocates an
-// adjective-noun label beneath the proxy address, the pin is not dedicated,
-// and the domain records the full endpoint hostname.
-func TestCreateSettingsLabeled(t *testing.T) {
-	ctx := context.Background()
-	f := newBootstrapFixture(t)
-	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-
-	created, err := f.createSettings(ctx, "account1", "user1", "Cluster1.Example.com", "")
-	require.NoError(t, err, "labeled bootstrap must succeed")
-	assert.Equal(t, "cluster1.example.com", created.ProxyAddress, "proxy address must be pinned lowercased")
-	require.True(t, strings.HasSuffix(created.Domain, ".cluster1.example.com"),
-		"domain must hang one label beneath the proxy address: %s", created.Domain)
-	label := strings.TrimSuffix(created.Domain, ".cluster1.example.com")
-	assert.NotContains(t, label, ".", "the allocated label must be a single DNS label: %s", label)
-	assert.False(t, created.Dedicated(), "a labeled pin is not dedicated")
-	assert.Equal(t, created.Domain, created.Endpoint(), "the endpoint is the domain column")
-
-	stored, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-	require.NoError(t, err, "bootstrap must persist the row")
-	assert.Equal(t, created.Domain, stored.Domain)
-	assert.Equal(t, created.ProxyAddress, stored.ProxyAddress)
-}
-
-// TestCreateSettingsSelfAddressed pins the dedicated shape: the endpoint is
-// claimed verbatim (normalized), Domain == ProxyAddress, and the claim
-// succeeds with no proxy declaring the address yet (address-first).
-func TestCreateSettingsSelfAddressed(t *testing.T) {
-	ctx := context.Background()
-	f := newBootstrapFixture(t)
-	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-
-	created, err := f.createSettings(ctx, "account1", "user1", "", "Brave-Otter.GW.Example.com")
-	require.NoError(t, err, "self-addressed bootstrap must succeed")
-	assert.Equal(t, "brave-otter.gw.example.com", created.Domain, "endpoint must be claimed lowercased")
-	assert.Equal(t, created.Domain, created.ProxyAddress, "self-addressed: proxy address is the endpoint")
-	assert.True(t, created.Dedicated(), "a self-addressed pin is dedicated")
-}
-
-// TestCreateSettingsIdentityFieldValidation pins the request contract: exactly
-// one of proxyAddress and endpoint, and both must be well-formed hostnames.
-func TestCreateSettingsIdentityFieldValidation(t *testing.T) {
-	ctx := context.Background()
-
-	cases := map[string]struct {
-		proxyAddress string
-		endpoint     string
-	}{
-		"neither":               {"", ""},
-		"both":                  {"cluster1.example.com", "gw.example.com"},
-		"trailing dot endpoint": {"", "gw.example.com."},
-		"leading dot endpoint":  {"", ".gw.example.com"},
-		"whitespace inside":     {"", "g w.example.com"},
-		"empty label in parent": {"eu..example.com", ""},
-		"hyphen-edged label":    {"", "-gw.example.com"},
-	}
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			f := newBootstrapFixture(t)
-			f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-
-			_, err := f.createSettings(ctx, "account1", "user1", tc.proxyAddress, tc.endpoint)
-			require.Error(t, err, "invalid identity input must be rejected")
-			var sErr *status.Error
-			require.ErrorAs(t, err, &sErr)
-			assert.Equal(t, status.InvalidArgument, sErr.Type(), "rejection must be a validation error")
-
-			_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-			assert.Error(t, err, "no row may be left behind by a rejected bootstrap")
-		})
-	}
-}
-
-// TestCreateSettingsConflictsOnSecondBootstrap pins that bootstrap is a
-// one-time create per account: a second call is a conflict, whatever shape it
-// asks for, and the original row survives untouched.
-func TestCreateSettingsConflictsOnSecondBootstrap(t *testing.T) {
-	ctx := context.Background()
-	f := newBootstrapFixture(t)
-	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-
-	first, err := f.createSettings(ctx, "account1", "user1", "cluster1.example.com", "")
-	require.NoError(t, err)
-
-	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-	_, err = f.createSettings(ctx, "account1", "user1", "", "other.example.com")
-	require.Error(t, err, "second bootstrap must fail")
-	var sErr *status.Error
-	require.ErrorAs(t, err, &sErr)
-	assert.Equal(t, status.AlreadyExists, sErr.Type(), "second bootstrap must surface as a conflict")
-
-	stored, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-	require.NoError(t, err)
-	assert.Equal(t, first.Domain, stored.Domain, "the original endpoint must survive the rejected bootstrap")
-}
-
-// TestCreateSettingsEndpointTaken pins global hostname uniqueness: a hostname
-// held by one account cannot be claimed by another, in either direction —
-// self-addressed onto self-addressed, or self-addressed onto an allocated
-// labeled endpoint.
-func TestCreateSettingsEndpointTaken(t *testing.T) {
-	ctx := context.Background()
-	f := newBootstrapFixture(t)
-
-	f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-	first, err := f.createSettings(ctx, "account1", "user1", "", "gw.example.com")
-	require.NoError(t, err)
-
-	f.expectPermission("account2", "user2", modules.AgentNetworkSettings, operations.Create, true)
-	_, err = f.createSettings(ctx, "account2", "user2", "", "gw.example.com")
-	require.Error(t, err, "a taken hostname must be refused")
-	var sErr *status.Error
-	require.ErrorAs(t, err, &sErr)
-	assert.Equal(t, status.AlreadyExists, sErr.Type(), "the refusal must surface as a conflict")
-
-	f.expectPermission("account3", "user3", modules.AgentNetworkSettings, operations.Create, true)
-	_, err = f.createSettings(ctx, "account3", "user3", "", first.Domain)
-	require.Error(t, err, "claiming another account's endpoint must be refused")
-}
-
-// TestCreateProviderHasNoSettingsSideEffects pins the decoupling: provider
-// create needs only the providers permission (gomock fails the test on any
-// settings-permission call) and never creates a settings row.
-func TestCreateProviderHasNoSettingsSideEffects(t *testing.T) {
-	ctx := context.Background()
-	f := newBootstrapFixture(t)
-	f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
-
-	provider := types.NewProvider("account1")
-	provider.Name = "openai"
-	provider.UpstreamURL = "https://api.openai.com"
-	provider.APIKey = "sk-test"
-	provider.Enabled = true
-
-	created, err := f.manager.CreateProvider(ctx, "user1", provider)
-	require.NoError(t, err, "provider create must succeed on the providers permission alone")
-	require.NotNil(t, created)
-
-	_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
-	assert.Error(t, err, "provider create must not conjure a settings row")
-}

management/internals/modules/agentnetwork/synthesizer.go

@@ -89,7 +89,7 @@ func SynthesizeServicesForCluster(ctx context.Context, s store.Store, clusterAdd
 		return nil, nil
 	}
 
-	settingsRows, err := s.GetAgentNetworkSettingsByProxyAddress(ctx, store.LockingStrengthNone, clusterAddr)
+	settingsRows, err := s.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, clusterAddr)
 	if err != nil {
 		return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
 	}
@@ -116,41 +116,53 @@ func SynthesizeServicesForCluster(ctx context.Context, s store.Store, clusterAdd
 }
 
 // SynthesizeServiceForDomain resolves a single agent-network service by its
-// public endpoint domain — a point query on the settings domain unique index,
-// then synthesis of just that account. Returns nil (no error) when no account
-// owns the domain.
+// public endpoint domain. It lists the (few) settings rows on the domain's
+// cluster, matches the one whose endpoint equals the domain, and synthesises
+// only that account — avoiding full per-account synthesis for every tenant on
+// the cluster, which is what auth/session paths previously paid. Returns nil
+// (no error) when no account owns the domain.
 func SynthesizeServiceForDomain(ctx context.Context, s store.Store, domain string) (*rpservice.Service, error) {
-	domain = strings.ToLower(strings.TrimSpace(domain))
-	if domain == "" {
-		return nil, nil //nolint:nilnil // optional lookup: no account owns the domain
-	}
-
-	settings, err := s.GetAgentNetworkSettingsByDomain(ctx, store.LockingStrengthNone, domain)
-	if err != nil {
-		if isNotFound(err) {
-			return nil, nil //nolint:nilnil // optional lookup: no account owns the domain
+	domain = strings.TrimSpace(domain)
+	cluster := clusterFromDomain(domain)
+	if domain != "" && cluster != "" {
+		settingsRows, err := s.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, cluster)
+		if err != nil {
+			return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
 		}
-		return nil, fmt.Errorf("get agent network settings by domain: %w", err)
-	}
-
-	services, err := SynthesizeServices(ctx, s, settings.AccountID)
-	if err != nil {
-		return nil, err
-	}
-	for _, svc := range services {
-		if svc != nil && svc.Domain == domain {
-			return svc, nil
+		for _, settings := range settingsRows {
+			if settings == nil || settings.Endpoint() != domain {
+				continue
+			}
+			services, serr := SynthesizeServices(ctx, s, settings.AccountID)
+			if serr != nil {
+				return nil, serr
+			}
+			for _, svc := range services {
+				if svc != nil && svc.Domain == domain {
+					return svc, nil
+				}
+			}
+			break
 		}
 	}
 	return nil, nil //nolint:nilnil // optional lookup: no account owns the domain
 }
 
+// clusterFromDomain returns the cluster portion of an endpoint domain (every
+// label after the first).
+func clusterFromDomain(domain string) string {
+	if i := strings.IndexByte(domain, '.'); i >= 0 {
+		return domain[i+1:]
+	}
+	return ""
+}
+
 // SynthesizeServices builds the in-memory reverse-proxy service that
 // fronts the account's agent-network gateway. Returns nil when the
 // account has no settings row, no enabled providers, or no enabled
 // policies — in any of those cases there's nothing useful to expose.
 //
-// One service per (account, settings.ProxyAddress) is emitted. The router
+// One service per (account, settings.Cluster) is emitted. The router
 // middleware encodes a denormalised model→provider routing table
 // (auth headers + decrypted API keys baked in); the policy_check
 // middleware encodes per-provider authorised group IDs derived from
@@ -163,7 +175,7 @@ func SynthesizeServices(ctx context.Context, s store.Store, accountID string) ([
 	if err != nil {
 		return nil, err
 	}
-	if !ok || strings.TrimSpace(settings.ProxyAddress) == "" {
+	if !ok || strings.TrimSpace(settings.Cluster) == "" {
 		return nil, nil
 	}
 
@@ -922,7 +934,7 @@ func buildAccountService(
 	middlewares []rpservice.MiddlewareConfig,
 	sessionPriv, sessionPub string,
 ) *rpservice.Service {
-	cluster := settings.ProxyAddress
+	cluster := settings.Cluster
 	domain := settings.Endpoint()
 	serviceID := SynthesizedServiceIDPrefix + accountID
 

management/internals/modules/agentnetwork/synthesizer_realstore_test.go

@@ -147,7 +147,7 @@ func TestReconcile_RealStore_PushesPrivateAfterStatusToggle(t *testing.T) {
 		store:           s,
 		accountManager:  noopAccountManager{},
 		proxyController: ctrl,
-		reconcileCache:  make(map[string]map[string]syntheticMapping),
+		reconcileCache:  make(map[string]map[string]*proto.ProxyMapping),
 	}
 
 	m.reconcile(ctx, testAccountID) // initial, provider enabled

management/internals/modules/agentnetwork/synthesizer_test.go

@@ -19,14 +19,15 @@ import (
 const (
 	testAccountID = "acct-1"
 	testCluster   = "eu.proxy.netbird.io"
+	testSubdomain = "violet"
 	testEndpoint  = "violet.eu.proxy.netbird.io"
 )
 
 func newSynthTestSettings() *types.Settings {
 	return &types.Settings{
-		AccountID:    testAccountID,
-		Domain:       testEndpoint,
-		ProxyAddress: testCluster,
+		AccountID: testAccountID,
+		Cluster:   testCluster,
+		Subdomain: testSubdomain,
 	}
 }
 

management/internals/modules/agentnetwork/types/provider.go

@@ -164,7 +164,9 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 		p.MetadataDisabled = *req.MetadataDisabled
 	}
 	// Identity-header overrides for catalogs flagged Customizable.
-	// Empty or omitted disables stamping for this dimension.
+	// nil pointer = "field omitted on the wire" → leave the stored
+	// value untouched (per the openapi description). Empty string is
+	// an explicit clear that disables stamping for this dimension.
 	if req.IdentityHeaderUserId != nil {
 		p.IdentityHeaderUserID = strings.TrimSpace(*req.IdentityHeaderUserId)
 	}
@@ -190,20 +192,16 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 	created := p.CreatedAt
 	updated := p.UpdatedAt
 	resp := &api.AgentNetworkProvider{
-		Id:          p.ID,
-		ProviderId:  p.ProviderID,
-		Name:        p.Name,
-		UpstreamUrl: p.UpstreamURL,
-		Models:      models,
-		// Always present on the wire so an explicitly cleared header
-		// round-trips as "" instead of vanishing from the response.
-		IdentityHeaderUserId: p.IdentityHeaderUserID,
-		IdentityHeaderGroups: p.IdentityHeaderGroups,
-		Enabled:              p.Enabled,
-		SkipTlsVerification:  p.SkipTLSVerification,
-		MetadataDisabled:     p.MetadataDisabled,
-		CreatedAt:            &created,
-		UpdatedAt:            &updated,
+		Id:                  p.ID,
+		ProviderId:          p.ProviderID,
+		Name:                p.Name,
+		UpstreamUrl:         p.UpstreamURL,
+		Models:              models,
+		Enabled:             p.Enabled,
+		SkipTlsVerification: p.SkipTLSVerification,
+		MetadataDisabled:    p.MetadataDisabled,
+		CreatedAt:           &created,
+		UpdatedAt:           &updated,
 	}
 	if len(p.ExtraValues) > 0 {
 		out := make(map[string]string, len(p.ExtraValues))
@@ -212,6 +210,14 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 		}
 		resp.ExtraValues = &out
 	}
+	if p.IdentityHeaderUserID != "" {
+		v := p.IdentityHeaderUserID
+		resp.IdentityHeaderUserId = &v
+	}
+	if p.IdentityHeaderGroups != "" {
+		v := p.IdentityHeaderGroups
+		resp.IdentityHeaderGroups = &v
+	}
 	return resp
 }
 

management/internals/modules/agentnetwork/types/provider_test.go

@@ -77,41 +77,3 @@ func TestProvider_MetadataDisabled_RoundTrip(t *testing.T) {
 	assert.False(t, p.MetadataDisabled, "explicit false must clear metadata_disabled")
 	assert.False(t, p.ToAPIResponse().MetadataDisabled, "response must reflect the cleared value")
 }
-
-// TestProvider_IdentityHeaders_AlwaysOnWire pins that the identity header
-// fields are always present in the API response — an explicitly cleared
-// ("") header must round-trip as "" rather than vanish, so API consumers
-// (e.g. the Terraform provider) never observe a value other than the one
-// they wrote.
-func TestProvider_IdentityHeaders_AlwaysOnWire(t *testing.T) {
-	set := "x-bf-dim-netbird_user_id"
-	empty := ""
-
-	base := func() *api.AgentNetworkProviderRequest {
-		return &api.AgentNetworkProviderRequest{
-			ProviderId:  "custom",
-			Name:        "bifrost",
-			UpstreamUrl: "https://bifrost.internal",
-		}
-	}
-
-	p := NewProvider("acc-1")
-	resp := p.ToAPIResponse()
-	assert.Equal(t, "", resp.IdentityHeaderUserId, "unset header must surface as empty string, not be omitted")
-	assert.Equal(t, "", resp.IdentityHeaderGroups, "unset header must surface as empty string, not be omitted")
-
-	req := base()
-	req.IdentityHeaderUserId = &set
-	p.FromAPIRequest(req)
-	assert.Equal(t, set, p.ToAPIResponse().IdentityHeaderUserId, "configured header must round-trip")
-
-	// Omitting the field preserves it.
-	p.FromAPIRequest(base())
-	assert.Equal(t, set, p.ToAPIResponse().IdentityHeaderUserId, "omitted header must preserve the stored value")
-
-	// An explicit "" clears it AND stays visible on the wire.
-	req = base()
-	req.IdentityHeaderUserId = &empty
-	p.FromAPIRequest(req)
-	assert.Equal(t, "", p.ToAPIResponse().IdentityHeaderUserId, "cleared header must round-trip as empty string")
-}

management/internals/modules/agentnetwork/types/settings.go

@@ -1,8 +1,6 @@
 package types
 
 import (
-	"fmt"
-	"strings"
 	"time"
 
 	"github.com/netbirdio/netbird/shared/management/http/api"
@@ -13,23 +11,13 @@ import (
 // the long-term aggregate and are retained independently.
 const DefaultAccessLogRetentionDays = 30
 
-// Settings is the per-account agent-network configuration row. One row per
-// account. Domain and ProxyAddress are assigned at bootstrap and immutable
-// thereafter; a persisted row is always fully allocated — there is no "row
-// exists, endpoint pending" state.
+// Settings is the per-account agent-network configuration row. One
+// row per account. Cluster + Subdomain are immutable once written and
+// produce the public endpoint agents call (`<subdomain>.<cluster>`).
 type Settings struct {
 	AccountID string `gorm:"primaryKey"`
-
-	// Domain is the gateway endpoint hostname agents call. Globally unique
-	// across accounts. Sized explicitly because MySQL cannot index an
-	// unbounded TEXT column; 255 covers the RFC 1035 253-octet bound.
-	Domain string `gorm:"type:varchar(255);uniqueIndex:idx_agent_network_settings_domain"`
-
-	// ProxyAddress is the declared cluster address of the proxy serving this
-	// account's gateway. Either equal to Domain — a proxy dedicated to this
-	// account, declaring the tenant's own hostname — or Domain's immediate
-	// parent, with the endpoint one label beneath it on a shared cluster.
-	ProxyAddress string `gorm:"type:varchar(255);index:idx_agent_network_settings_proxy_address"`
+	Cluster   string
+	Subdomain string `gorm:"index:idx_agent_network_settings_cluster_subdomain"`
 
 	// Account-level collection controls sourced by the synthesizer.
 	// EnableLogCollection gates the per-request access-log trail and defaults
@@ -54,58 +42,32 @@ type Settings struct {
 // schema cohesive.
 func (Settings) TableName() string { return "agent_network_settings" }
 
-// DefaultSettings returns the settings an account observes before its row is
-// bootstrapped: log collection on with the default retention, everything else
-// off, and no domain or proxy address assigned yet. Bootstrap persists exactly
-// these values plus the assigned domain and proxy address, so the
-// pre-bootstrap read and the freshly bootstrapped row agree.
-func DefaultSettings(accountID string) *Settings {
-	return &Settings{
-		AccountID:              accountID,
-		EnableLogCollection:    true,
-		AccessLogRetentionDays: DefaultAccessLogRetentionDays,
-	}
+// Endpoint returns the bare hostname agents reach this account at:
+// `<subdomain>.<cluster>`.
+func (s *Settings) Endpoint() string {
+	return s.Subdomain + "." + s.Cluster
 }
 
-// Endpoint returns the bare hostname agents reach this account at — the
-// Domain column. Empty until the row is bootstrapped.
-func (s *Settings) Endpoint() string { return s.Domain }
-
-// Dedicated reports whether the account's gateway is served by a proxy
-// dedicated to it — the self-addressed shape, where the serving proxy declares
-// the endpoint hostname itself. The alternative (labeled) shape has the
-// endpoint one label beneath a shared cluster's address.
-func (s *Settings) Dedicated() bool { return s.Domain != "" && s.Domain == s.ProxyAddress }
-
-// ToAPIResponse renders the settings as the API representation. The
-// timestamps are omitted while zero — a default (not yet bootstrapped) view
-// has no persisted row to date.
+// ToAPIResponse renders the settings as the API representation.
 func (s *Settings) ToAPIResponse() *api.AgentNetworkSettings {
+	created := s.CreatedAt
+	updated := s.UpdatedAt
 	retention := s.AccessLogRetentionDays
-	resp := &api.AgentNetworkSettings{
+	return &api.AgentNetworkSettings{
+		Cluster:                s.Cluster,
+		Subdomain:              s.Subdomain,
 		Endpoint:               s.Endpoint(),
-		ProxyAddress:           s.ProxyAddress,
-		Dedicated:              s.Dedicated(),
 		EnableLogCollection:    s.EnableLogCollection,
 		EnablePromptCollection: s.EnablePromptCollection,
 		RedactPii:              s.RedactPii,
 		AccessLogRetentionDays: &retention,
+		CreatedAt:              &created,
+		UpdatedAt:              &updated,
 	}
-	if !s.CreatedAt.IsZero() {
-		created := s.CreatedAt
-		resp.CreatedAt = &created
-	}
-	if !s.UpdatedAt.IsZero() {
-		updated := s.UpdatedAt
-		resp.UpdatedAt = &updated
-	}
-	return resp
 }
 
-// FromAPIRequest applies the update request onto the receiver: the mutable
-// collection fields are always replaced with the request values. The identity
-// fields (Domain, ProxyAddress) are assigned at bootstrap and are not part of
-// the update schema at all — immutability by shape, not by rejection.
+// FromAPIRequest applies the mutable settings fields from the request. Cluster
+// and Subdomain are immutable and intentionally not touched here.
 func (s *Settings) FromAPIRequest(req *api.AgentNetworkSettingsRequest) {
 	s.EnableLogCollection = req.EnableLogCollection
 	s.EnablePromptCollection = req.EnablePromptCollection
@@ -114,69 +76,3 @@ func (s *Settings) FromAPIRequest(req *api.AgentNetworkSettingsRequest) {
 		s.AccessLogRetentionDays = *req.AccessLogRetentionDays
 	}
 }
-
-// FromAPICreateRequest applies the optional collection toggles of a bootstrap
-// request onto the receiver (typically DefaultSettings), leaving defaults in
-// place for omitted fields. The identity fields are resolved by the manager
-// from the request's proxy_address / endpoint, not copied here.
-func (s *Settings) FromAPICreateRequest(req *api.AgentNetworkSettingsCreateRequest) {
-	if req.EnableLogCollection != nil {
-		s.EnableLogCollection = *req.EnableLogCollection
-	}
-	if req.EnablePromptCollection != nil {
-		s.EnablePromptCollection = *req.EnablePromptCollection
-	}
-	if req.RedactPii != nil {
-		s.RedactPii = *req.RedactPii
-	}
-	if req.AccessLogRetentionDays != nil {
-		s.AccessLogRetentionDays = *req.AccessLogRetentionDays
-	}
-}
-
-// maxHostnameLength is the RFC 1035 bound on a full domain name.
-const maxHostnameLength = 253
-
-// NormalizeHostname lowercases and trims a caller-supplied hostname and
-// validates its shape: non-empty DNS labels of letters, digits and inner
-// hyphens, joined by single dots, within length bounds. Shapes that
-// canonicalization cannot repair — leading/trailing dots, empty labels,
-// whitespace inside the name — are rejected rather than guessed at, because
-// the value lands in an immutable column.
-func NormalizeHostname(raw string) (string, error) {
-	hostname := strings.ToLower(strings.TrimSpace(raw))
-	if hostname == "" {
-		return "", fmt.Errorf("hostname is empty")
-	}
-	if len(hostname) > maxHostnameLength {
-		return "", fmt.Errorf("hostname exceeds %d characters", maxHostnameLength)
-	}
-	for _, label := range strings.Split(hostname, ".") {
-		if err := validateHostnameLabel(label); err != nil {
-			return "", fmt.Errorf("invalid hostname %q: %w", hostname, err)
-		}
-	}
-	return hostname, nil
-}
-
-func validateHostnameLabel(label string) error {
-	if label == "" {
-		return fmt.Errorf("empty label (leading, trailing or doubled dot)")
-	}
-	if len(label) > 63 {
-		return fmt.Errorf("label %q exceeds 63 characters", label)
-	}
-	if label[0] == '-' || label[len(label)-1] == '-' {
-		return fmt.Errorf("label %q must not start or end with a hyphen", label)
-	}
-	for _, r := range label {
-		switch {
-		case r >= 'a' && r <= 'z':
-		case r >= '0' && r <= '9':
-		case r == '-':
-		default:
-			return fmt.Errorf("label %q contains invalid character %q", label, r)
-		}
-	}
-	return nil
-}

management/internals/modules/reverseproxy/domain/manager/manager.go

@@ -2,28 +2,24 @@ package manager
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"net"
 	"strings"
 
 	log "github.com/sirupsen/logrus"
 
-	agentnetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	nbstore "github.com/netbirdio/netbird/management/server/store"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 type store interface {
 	GetAccount(ctx context.Context, accountID string) (*types.Account, error)
-	GetAgentNetworkSettings(ctx context.Context, lockStrength nbstore.LockingStrength, accountID string) (*agentnetworkTypes.Settings, error)
 
 	GetCustomDomain(ctx context.Context, accountID string, domainID string) (*domain.Domain, error)
 	ListFreeDomains(ctx context.Context, accountID string) ([]string, error)
@@ -315,21 +311,17 @@ func (m Manager) getClusterAllowList(ctx context.Context, accountID string) ([]s
 	if err != nil {
 		return nil, fmt.Errorf("get public cluster addresses: %w", err)
 	}
-	reserved, err := m.reservedGatewayAddress(ctx, accountID)
-	if err != nil {
-		return nil, err
-	}
 	seen := make(map[string]struct{}, len(byopAddresses)+len(publicAddresses))
 	merged := make([]string, 0, len(byopAddresses)+len(publicAddresses))
 	for _, addr := range byopAddresses {
-		if _, ok := seen[addr]; ok || addr == reserved {
+		if _, ok := seen[addr]; ok {
 			continue
 		}
 		seen[addr] = struct{}{}
 		merged = append(merged, addr)
 	}
 	for _, addr := range publicAddresses {
-		if _, ok := seen[addr]; ok || addr == reserved {
+		if _, ok := seen[addr]; ok {
 			continue
 		}
 		seen[addr] = struct{}{}
@@ -338,31 +330,6 @@ func (m Manager) getClusterAllowList(ctx context.Context, accountID string) ([]s
 	return merged, nil
 }
 
-// reservedGatewayAddress returns the account's agent-network gateway address
-// when its settings pin is self-addressed — a proxy dedicated to serving
-// exactly the gateway. Dropping that address from the cluster allow list keeps
-// it from being offered as a cluster for ordinary services, and because the
-// free-domain suffix match is depth-independent, dropping the address rejects
-// every name beneath it as well as the bare one. Only the account's own
-// gateway address can ever appear in its allow list (another tenant's gateway
-// proxy is account-scoped to them), so this single-address exclusion is
-// sufficient. Returns "" when the account has no settings row or a labeled
-// (shared-cluster) pin.
-func (m Manager) reservedGatewayAddress(ctx context.Context, accountID string) (string, error) {
-	settings, err := m.store.GetAgentNetworkSettings(ctx, nbstore.LockingStrengthNone, accountID)
-	if err != nil {
-		var sErr *status.Error
-		if errors.As(err, &sErr) && sErr.Type() == status.NotFound {
-			return "", nil
-		}
-		return "", fmt.Errorf("get agent network settings: %w", err)
-	}
-	if settings == nil || !settings.Dedicated() {
-		return "", nil
-	}
-	return settings.ProxyAddress, nil
-}
-
 func extractClusterFromCustomDomains(serviceDomain string, customDomains []*domain.Domain) (string, bool) {
 	bestCluster := ""
 	bestLen := -1

management/internals/modules/reverseproxy/domain/manager/manager_test.go

@@ -7,12 +7,6 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-
-	agentnetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
-	nbstore "github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 type mockProxyManager struct {
@@ -61,7 +55,7 @@ func TestGetClusterAllowList_BYOPMergedWithPublic(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"byop.example.com", "eu.proxy.netbird.io"}, result)
@@ -77,7 +71,7 @@ func TestGetClusterAllowList_DeduplicatesBYOPAndPublic(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"shared.example.com", "byop.example.com", "eu.proxy.netbird.io"}, result)
@@ -93,7 +87,7 @@ func TestGetClusterAllowList_NoBYOP_FallbackToShared(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"eu.proxy.netbird.io", "us.proxy.netbird.io"}, result)
@@ -106,7 +100,7 @@ func TestGetClusterAllowList_BYOPError_ReturnsError(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.Error(t, err)
 	assert.Nil(t, result)
@@ -123,7 +117,7 @@ func TestGetClusterAllowList_PublicError_ReturnsError(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.Error(t, err)
 	assert.Nil(t, result)
@@ -140,7 +134,7 @@ func TestGetClusterAllowList_BYOPEmptySlice_FallbackToShared(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"eu.proxy.netbird.io"}, result)
@@ -156,138 +150,8 @@ func TestGetClusterAllowList_PublicEmpty_BYOPOnly(t *testing.T) {
 		},
 	}
 
-	mgr := Manager{store: &stubStore{}, proxyManager: pm}
+	mgr := Manager{proxyManager: pm}
 	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
 	require.NoError(t, err)
 	assert.Equal(t, []string{"byop.example.com"}, result)
 }
-
-// stubStore satisfies the manager's narrow store interface for allow-list
-// tests. Only the agent-network settings lookup participates; the default (a
-// nil func) reads as "no settings row", the state most accounts are in.
-type stubStore struct {
-	getAgentNetworkSettingsFunc func(ctx context.Context, accountID string) (*agentnetworkTypes.Settings, error)
-}
-
-func (s *stubStore) GetAccount(context.Context, string) (*types.Account, error) {
-	panic("not used in allow-list tests")
-}
-
-func (s *stubStore) GetAgentNetworkSettings(ctx context.Context, _ nbstore.LockingStrength, accountID string) (*agentnetworkTypes.Settings, error) {
-	if s.getAgentNetworkSettingsFunc != nil {
-		return s.getAgentNetworkSettingsFunc(ctx, accountID)
-	}
-	return nil, status.Errorf(status.NotFound, "agent network settings for account %s not found", accountID)
-}
-
-func (s *stubStore) GetCustomDomain(context.Context, string, string) (*domain.Domain, error) {
-	panic("not used in allow-list tests")
-}
-
-func (s *stubStore) ListFreeDomains(context.Context, string) ([]string, error) {
-	panic("not used in allow-list tests")
-}
-
-func (s *stubStore) ListCustomDomains(context.Context, string) ([]*domain.Domain, error) {
-	panic("not used in allow-list tests")
-}
-
-func (s *stubStore) CreateCustomDomain(context.Context, string, string, string, bool) (*domain.Domain, error) {
-	panic("not used in allow-list tests")
-}
-
-func (s *stubStore) UpdateCustomDomain(context.Context, string, *domain.Domain) (*domain.Domain, error) {
-	panic("not used in allow-list tests")
-}
-
-func (s *stubStore) DeleteCustomDomain(context.Context, string, string) error {
-	panic("not used in allow-list tests")
-}
-
-// TestGetClusterAllowList_DedicatedGatewayAddressExcluded pins invariant (B)'s
-// chokepoint: a self-addressed settings pin reserves the account's gateway
-// address, so it is dropped from the allow list — which, because the
-// free-domain suffix match is depth-independent, rejects every name beneath
-// it as well as the bare one. Other addresses are unaffected.
-func TestGetClusterAllowList_DedicatedGatewayAddressExcluded(t *testing.T) {
-	pm := &mockProxyManager{
-		getActiveClusterAddressesForAccountFunc: func(_ context.Context, _ string) ([]string, error) {
-			return []string{"brave-otter.gateway.example.com", "byop.example.com"}, nil
-		},
-		getActiveClusterAddressesFunc: func(_ context.Context) ([]string, error) {
-			return []string{"eu.proxy.netbird.io"}, nil
-		},
-	}
-	st := &stubStore{
-		getAgentNetworkSettingsFunc: func(_ context.Context, accountID string) (*agentnetworkTypes.Settings, error) {
-			assert.Equal(t, "acc-123", accountID,
-				"the exclusion must look up the requesting account's own settings")
-			return &agentnetworkTypes.Settings{
-				AccountID:    accountID,
-				Domain:       "brave-otter.gateway.example.com",
-				ProxyAddress: "brave-otter.gateway.example.com",
-			}, nil
-		},
-	}
-
-	mgr := Manager{store: st, proxyManager: pm}
-	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
-	require.NoError(t, err)
-	assert.Equal(t, []string{"byop.example.com", "eu.proxy.netbird.io"}, result,
-		"the dedicated gateway address must be reserved from cluster selection")
-}
-
-// TestGetClusterAllowList_LabeledPinDoesNotExclude pins the counterpart: a
-// labeled pin means the gateway rides on a shared cluster serving ordinary
-// services too, so nothing is reserved.
-func TestGetClusterAllowList_LabeledPinDoesNotExclude(t *testing.T) {
-	pm := &mockProxyManager{
-		getActiveClusterAddressesForAccountFunc: func(_ context.Context, _ string) ([]string, error) {
-			return []string{"byop.example.com"}, nil
-		},
-		getActiveClusterAddressesFunc: func(_ context.Context) ([]string, error) {
-			return []string{"eu.proxy.netbird.io"}, nil
-		},
-	}
-	st := &stubStore{
-		getAgentNetworkSettingsFunc: func(_ context.Context, accountID string) (*agentnetworkTypes.Settings, error) {
-			return &agentnetworkTypes.Settings{
-				AccountID:    accountID,
-				Domain:       "violet.eu.proxy.netbird.io",
-				ProxyAddress: "eu.proxy.netbird.io",
-			}, nil
-		},
-	}
-
-	mgr := Manager{store: st, proxyManager: pm}
-	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
-	require.NoError(t, err)
-	assert.Equal(t, []string{"byop.example.com", "eu.proxy.netbird.io"}, result,
-		"a labeled pin reserves nothing")
-}
-
-// TestGetClusterAllowList_SettingsLookupError_ReturnsError pins that a store
-// outage is surfaced rather than silently treated as "nothing reserved" —
-// failing open here would offer a reserved gateway address for ordinary
-// services.
-func TestGetClusterAllowList_SettingsLookupError_ReturnsError(t *testing.T) {
-	pm := &mockProxyManager{
-		getActiveClusterAddressesForAccountFunc: func(_ context.Context, _ string) ([]string, error) {
-			return []string{"byop.example.com"}, nil
-		},
-		getActiveClusterAddressesFunc: func(_ context.Context) ([]string, error) {
-			return []string{"eu.proxy.netbird.io"}, nil
-		},
-	}
-	st := &stubStore{
-		getAgentNetworkSettingsFunc: func(_ context.Context, _ string) (*agentnetworkTypes.Settings, error) {
-			return nil, status.Errorf(status.Internal, "store outage")
-		},
-	}
-
-	mgr := Manager{store: st, proxyManager: pm}
-	result, err := mgr.getClusterAllowList(context.Background(), "acc-123")
-	require.Error(t, err)
-	assert.Nil(t, result)
-	assert.Contains(t, err.Error(), "agent network settings")
-}

management/server/agentnetwork_budgetrule_realstack_test.go

@@ -68,8 +68,7 @@ func TestAgentNetwork_BudgetRuleCRUD_RealManager(t *testing.T) {
 
 // TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection is the
 // GC-1 guard for UpdateSettings: it must apply the collection toggles while
-// preserving the immutable Domain/ProxyAddress assigned at bootstrap — the
-// identity fields are not part of the update surface at all.
+// preserving the immutable Cluster/Subdomain pinned at bootstrap.
 func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *testing.T) {
 	am, _, err := createManager(t)
 	require.NoError(t, err, "createManager must succeed")
@@ -85,14 +84,7 @@ func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *t
 
 	mgr := agentnetwork.NewManager(am.Store, permissions.NewManager(am.Store), am, nil)
 
-	// Bootstrap is an explicit settings create; providers have no settings
-	// side effects anymore.
-	before, err := mgr.CreateSettings(ctx, adminUserID, agenttypes.DefaultSettings(accountID), clusterAddr, "")
-	require.NoError(t, err, "CreateSettings must bootstrap the row")
-	require.Equal(t, clusterAddr, before.ProxyAddress, "proxy address pinned at bootstrap")
-	require.NotEmpty(t, before.Domain, "endpoint allocated at bootstrap")
-	assert.False(t, before.EnablePromptCollection, "prompt collection defaults off")
-
+	// Creating a provider bootstraps the settings row (cluster + subdomain).
 	_, err = mgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
 		AccountID:   accountID,
 		ProviderID:  "openai_api",
@@ -101,30 +93,34 @@ func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *t
 		APIKey:      "sk-test",
 		Enabled:     true,
 		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
-	})
-	require.NoError(t, err, "CreateProvider must succeed")
+	}, clusterAddr)
+	require.NoError(t, err, "CreateProvider must bootstrap settings")
 
-	// Flipping the toggles works; identity fields set on the request value
-	// are ignored by FromAPIRequest/UpdateSettings by construction, but even
-	// a hand-rolled Settings value cannot smuggle them into the row.
+	before, err := mgr.GetSettings(ctx, accountID, adminUserID)
+	require.NoError(t, err, "GetSettings must succeed after bootstrap")
+	require.Equal(t, clusterAddr, before.Cluster, "cluster pinned at bootstrap")
+	require.NotEmpty(t, before.Subdomain, "subdomain pinned at bootstrap")
+	assert.False(t, before.EnablePromptCollection, "prompt collection defaults off")
+
+	// Attempt to flip toggles AND smuggle a different cluster/subdomain — the
+	// immutable fields must be ignored.
 	updated, err := mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
 		AccountID:              accountID,
-		Domain:                 "evil.example.com",
-		ProxyAddress:           "attacker.cluster",
+		Cluster:                "attacker.cluster",
+		Subdomain:              "evil",
 		EnableLogCollection:    true,
 		EnablePromptCollection: true,
 		RedactPii:              true,
 	})
 	require.NoError(t, err, "UpdateSettings must succeed")
-	assert.Equal(t, before.Domain, updated.Domain, "domain is immutable and must be preserved")
-	assert.Equal(t, before.ProxyAddress, updated.ProxyAddress, "proxy address is immutable and must be preserved")
+	assert.Equal(t, before.Cluster, updated.Cluster, "cluster is immutable and must be preserved")
+	assert.Equal(t, before.Subdomain, updated.Subdomain, "subdomain is immutable and must be preserved")
 	assert.True(t, updated.EnableLogCollection, "log collection toggle must apply")
 	assert.True(t, updated.EnablePromptCollection, "prompt collection toggle must apply")
 	assert.True(t, updated.RedactPii, "redact toggle must apply")
 
 	reloaded, err := am.Store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
 	require.NoError(t, err)
-	assert.Equal(t, before.Domain, reloaded.Domain, "persisted domain unchanged")
-	assert.Equal(t, before.ProxyAddress, reloaded.ProxyAddress, "persisted proxy address unchanged")
+	assert.Equal(t, before.Cluster, reloaded.Cluster, "persisted cluster unchanged")
 	assert.True(t, reloaded.EnablePromptCollection, "persisted prompt collection toggled on")
 }

management/server/agentnetwork_realstack_test.go

@@ -92,14 +92,6 @@ func TestAgentNetwork_ProviderCRUD_FansOutToProxyAndClientPeers(t *testing.T) {
 	// UpdateAccountPeers, which is the path under test.
 	agentMgr := agentnetwork.NewManager(am.Store, permissions.NewManager(am.Store), am, nil)
 
-	_, err = agentMgr.CreateSettings(ctx, adminUserID, agenttypes.DefaultSettings(accountID), clusterAddr, "")
-	require.NoError(t, err, "CreateSettings must bootstrap the endpoint")
-	// The bootstrap itself reconciles and queues updates on both channels;
-	// drain them so the fan-out assertions below can only be satisfied by the
-	// operation under test, not by this leftover.
-	drain(clientCh)
-	drain(proxyCh)
-
 	provider, err := agentMgr.CreateProvider(ctx, adminUserID, &agenttypes.Provider{
 		AccountID:   accountID,
 		ProviderID:  "openai_api",
@@ -108,7 +100,7 @@ func TestAgentNetwork_ProviderCRUD_FansOutToProxyAndClientPeers(t *testing.T) {
 		APIKey:      "sk-test-key",
 		Enabled:     true,
 		Models:      []agenttypes.ProviderModel{{ID: "gpt-5.4"}},
-	})
+	}, clusterAddr)
 	require.NoError(t, err, "CreateProvider must succeed")
 
 	policy, err := agentMgr.CreatePolicy(ctx, adminUserID, &agenttypes.Policy{

management/server/group.go

@@ -6,8 +6,6 @@ import (
 	"fmt"
 	"slices"
 
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 
@@ -746,14 +744,6 @@ func validateDeleteGroup(ctx context.Context, transaction store.Store, group *ty
 		return &GroupLinkError{"network router", linkedRouter.ID}
 	}
 
-	if isLinked, linkedService := isGroupLinkedToReverseProxyService(ctx, transaction, group.AccountID, group.ID); isLinked {
-		return &GroupLinkError{"reverse proxy service", linkedService.Domain}
-	}
-
-	if isLinked, linkedPolicy := isGroupLinkedToAgentNetworkPolicy(ctx, transaction, group.AccountID, group.ID); isLinked {
-		return &GroupLinkError{"agent network policy", linkedPolicy.Name}
-	}
-
 	return checkGroupLinkedToSettings(ctx, transaction, group)
 }
 
@@ -885,46 +875,6 @@ func isGroupLinkedToNetworkRouter(ctx context.Context, transaction store.Store,
 	return false, nil
 }
 
-// isGroupLinkedToReverseProxyService checks if a group is used as an access group
-// of a private reverse proxy service or as a bearer-auth distribution group.
-func isGroupLinkedToReverseProxyService(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *service.Service) {
-	services, err := transaction.GetAccountServices(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		log.WithContext(ctx).Errorf("error retrieving reverse proxy services while checking group linkage: %v", err)
-		return false, nil
-	}
-
-	for _, svc := range services {
-		if svc.Private && slices.Contains(svc.AccessGroups, groupID) {
-			return true, svc
-		}
-		if svc.Auth.BearerAuth != nil && svc.Auth.BearerAuth.Enabled && slices.Contains(svc.Auth.BearerAuth.DistributionGroups, groupID) {
-			return true, svc
-		}
-	}
-	return false, nil
-}
-
-// isGroupLinkedToAgentNetworkPolicy checks if a group is used as a source group by any
-// agent network policy in the account.
-func isGroupLinkedToAgentNetworkPolicy(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *agentNetworkTypes.Policy) {
-	policies, err := transaction.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		log.WithContext(ctx).Errorf("error retrieving agent network policies while checking group linkage: %v", err)
-		return false, nil
-	}
-
-	for _, policy := range policies {
-		if policy == nil {
-			continue
-		}
-		if slices.Contains(policy.SourceGroups, groupID) {
-			return true, policy
-		}
-	}
-	return false, nil
-}
-
 // areGroupChangesAffectPeers checks if any changes to the specified groups will affect peers.
 // It fetches each collection once and checks all groupIDs against them in memory.
 func areGroupChangesAffectPeers(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) (bool, error) {

management/server/group_test.go

@@ -18,8 +18,6 @@ import (
 	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
@@ -127,21 +125,6 @@ func TestDefaultAccountManager_DeleteGroup(t *testing.T) {
 			"grp-for-integration",
 			"only service users with admin power can delete integration group",
 		},
-		{
-			"agent network policy",
-			"grp-for-agent-network-policy",
-			"agent network policy",
-		},
-		{
-			"reverse proxy private service access group",
-			"grp-for-rp-private",
-			"reverse proxy service",
-		},
-		{
-			"reverse proxy bearer distribution group",
-			"grp-for-rp-bearer",
-			"reverse proxy service",
-		},
 	}
 
 	for _, testCase := range testCases {
@@ -235,17 +218,6 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 			groupIDs:        []string{"grp-for-integration"},
 			expectedReasons: []string{"only service users with admin power can delete integration group"},
 		},
-		{
-			name:            "agent network policy",
-			groupIDs:        []string{"grp-for-agent-network-policy"},
-			expectedReasons: []string{"agent network policy"},
-		},
-		{
-			name:               "reverse proxy services",
-			groupIDs:           []string{"grp-for-rp-private", "grp-for-rp-bearer"},
-			expectedReasons:    []string{"reverse proxy service", "reverse proxy service"},
-			expectedNotDeleted: []string{"grp-for-rp-private", "grp-for-rp-bearer"},
-		},
 		{
 			name:            "successfully delete multiple groups",
 			groupIDs:        []string{"group-1", "group-2"},
@@ -313,65 +285,6 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 	}
 }
 
-func TestDefaultAccountManager_DeleteGroupUnlinkedFromReverseProxyService(t *testing.T) {
-	am, _, err := createManager(t)
-	require.NoError(t, err, "Failed to create account manager")
-
-	_, account, err := initTestGroupAccount(am)
-	require.NoError(t, err, "Failed to init testing account")
-
-	deletableGroups := []*types.Group{
-		{
-			ID:        "grp-rp-bearer-disabled",
-			AccountID: account.Id,
-			Name:      "Group only in a disabled bearer auth",
-			Issued:    types.GroupIssuedAPI,
-			Peers:     make([]string, 0),
-		},
-		{
-			ID:        "grp-rp-nonprivate-access",
-			AccountID: account.Id,
-			Name:      "Group only in a non-private service's access groups",
-			Issued:    types.GroupIssuedAPI,
-			Peers:     make([]string, 0),
-		},
-	}
-	for _, group := range deletableGroups {
-		require.NoError(t, am.CreateGroup(context.Background(), account.Id, groupAdminUserID, group))
-	}
-
-	// Disabled bearer auth and stale access groups on a non-private service
-	// are inert configuration and must not block group deletion.
-	services := []*rpservice.Service{
-		{
-			ID:        "rp-svc-bearer-disabled",
-			AccountID: account.Id,
-			Domain:    "bearer-disabled.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            false,
-					DistributionGroups: []string{"grp-rp-bearer-disabled"},
-				},
-			},
-		},
-		{
-			ID:           "rp-svc-nonprivate-access",
-			AccountID:    account.Id,
-			Domain:       "nonprivate.services.example.com",
-			Private:      false,
-			AccessGroups: []string{"grp-rp-nonprivate-access"},
-		},
-	}
-	for _, svc := range services {
-		require.NoError(t, am.Store.CreateService(context.Background(), svc))
-	}
-
-	for _, group := range deletableGroups {
-		err = am.DeleteGroup(context.Background(), account.Id, groupAdminUserID, group.ID)
-		assert.NoError(t, err, "group %s is not referenced by an active reverse proxy gate and should be deletable", group.ID)
-	}
-}
-
 func TestDefaultAccountManager_DeleteGroupLinkedToFlowGroup(t *testing.T) {
 	am, _, err := createManager(t)
 	require.NoError(t, err)
@@ -493,30 +406,6 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 		Peers:     make([]string, 0),
 	}
 
-	groupForAgentNetworkPolicy := &types.Group{
-		ID:        "grp-for-agent-network-policy",
-		AccountID: "account-id",
-		Name:      "Group for agent network policies",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
-	groupForRPPrivate := &types.Group{
-		ID:        "grp-for-rp-private",
-		AccountID: "account-id",
-		Name:      "Group for private reverse proxy service",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
-	groupForRPBearer := &types.Group{
-		ID:        "grp-for-rp-bearer",
-		AccountID: "account-id",
-		Name:      "Group for bearer reverse proxy service",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
 	routeResource := &route.Route{
 		ID:     "example route",
 		Groups: []string{groupForRoute.ID},
@@ -572,66 +461,6 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForSetupKeys)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForUsers)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForIntegration)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForAgentNetworkPolicy)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPPrivate)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPBearer)
-
-	agentNetworkPolicy := &agentNetworkTypes.Policy{
-		ID:           "example agent network policy",
-		AccountID:    accountID,
-		Name:         "Example agent network policy",
-		Enabled:      true,
-		SourceGroups: []string{groupForAgentNetworkPolicy.ID},
-	}
-	if err := am.Store.SaveAgentNetworkPolicy(context.Background(), agentNetworkPolicy); err != nil {
-		return nil, nil, err
-	}
-
-	// The decoy services are created first so the linkage check has to scan
-	// past services that do not reference the groups under test.
-	rpServices := []*rpservice.Service{
-		{
-			ID:           "rp-svc-private-decoy",
-			AccountID:    accountID,
-			Domain:       "private-decoy.services.example.com",
-			Private:      true,
-			AccessGroups: []string{"unrelated-group"},
-		},
-		{
-			ID:        "rp-svc-bearer-decoy",
-			AccountID: accountID,
-			Domain:    "bearer-decoy.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            true,
-					DistributionGroups: []string{"unrelated-group"},
-				},
-			},
-		},
-		{
-			ID:           "rp-svc-private",
-			AccountID:    accountID,
-			Domain:       "private.services.example.com",
-			Private:      true,
-			AccessGroups: []string{groupForRPPrivate.ID},
-		},
-		{
-			ID:        "rp-svc-bearer",
-			AccountID: accountID,
-			Domain:    "bearer.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            true,
-					DistributionGroups: []string{groupForRPBearer.ID},
-				},
-			},
-		},
-	}
-	for _, svc := range rpServices {
-		if err := am.Store.CreateService(context.Background(), svc); err != nil {
-			return nil, nil, err
-		}
-	}
 
 	acc, err := am.Store.GetAccount(context.Background(), account.Id)
 	if err != nil {

management/server/migration/migration_agentnetwork.go

@@ -1,112 +0,0 @@
-package migration
-
-import (
-	"context"
-	"fmt"
-
-	log "github.com/sirupsen/logrus"
-	"gorm.io/gorm"
-)
-
-// agentNetworkSettingsMigration is a local view of the agent_network_settings
-// table spanning both the legacy identity columns (cluster, subdomain) and
-// their replacement (domain, proxy_address), so the migrator can address all
-// four during the reshape without importing the current model.
-type agentNetworkSettingsMigration struct {
-	AccountID    string `gorm:"primaryKey"`
-	Cluster      string
-	Subdomain    string
-	Domain       string `gorm:"type:varchar(255)"`
-	ProxyAddress string `gorm:"type:varchar(255)"`
-}
-
-func (agentNetworkSettingsMigration) TableName() string { return "agent_network_settings" }
-
-// MigrateAgentNetworkSettingsToDomain reshapes agent_network_settings from the
-// legacy (cluster, subdomain) identity columns to (domain, proxy_address):
-// domain becomes `<subdomain>.<cluster>` — the endpoint hostname the old
-// columns derived — and proxy_address becomes the cluster address, preserving
-// which proxy serves the account. Runs before AutoMigrate, which then creates
-// the unique index on the freshly backfilled domain column.
-//
-// A legacy row missing either half cannot be given an endpoint; the old
-// bootstrap always wrote both, so such a row indicates corruption and the
-// migration fails loudly rather than leaving an empty domain to collide with
-// the unique index confusingly.
-//
-// The transaction is real only on sqlite and postgres, where DDL is
-// transactional. MySQL implicitly commits around every ALTER TABLE, so there
-// each step stands alone; what makes an interrupted run resumable on MySQL is
-// that every step is guarded by the schema state it changes — the entry check
-// fires while either legacy column remains, the adds skip existing columns,
-// the backfill and its loud-failure check run only while the legacy cluster
-// column exists (they provably completed before any drop), and each drop
-// skips what is already gone.
-func MigrateAgentNetworkSettingsToDomain(ctx context.Context, db *gorm.DB) error {
-	model := &agentNetworkSettingsMigration{}
-	migrator := db.Migrator()
-
-	if !migrator.HasTable(model) {
-		return nil
-	}
-	hasCluster := migrator.HasColumn(model, "cluster")
-	if !hasCluster && !migrator.HasColumn(model, "subdomain") {
-		// Fresh schema or already migrated — nothing to reshape.
-		return nil
-	}
-
-	return db.Transaction(func(tx *gorm.DB) error {
-		txMigrator := tx.Migrator()
-		for _, field := range []string{"Domain", "ProxyAddress"} {
-			if !txMigrator.HasColumn(model, field) {
-				if err := txMigrator.AddColumn(model, field); err != nil {
-					return fmt.Errorf("add %s column to agent_network_settings: %w", field, err)
-				}
-			}
-		}
-
-		if hasCluster {
-			concat := "subdomain || '.' || cluster"
-			if tx.Name() == "mysql" {
-				concat = "CONCAT(subdomain, '.', cluster)"
-			}
-			res := tx.Exec(fmt.Sprintf(
-				"UPDATE agent_network_settings SET domain = %s, proxy_address = cluster WHERE (domain IS NULL OR domain = '') AND cluster <> '' AND subdomain <> ''",
-				concat,
-			))
-			if res.Error != nil {
-				return fmt.Errorf("backfill agent_network_settings domain: %w", res.Error)
-			}
-
-			var unmigratable int64
-			if err := tx.Model(model).Where("domain IS NULL OR domain = ''").Count(&unmigratable).Error; err != nil {
-				return fmt.Errorf("count unmigratable agent_network_settings rows: %w", err)
-			}
-			if unmigratable > 0 {
-				return fmt.Errorf(
-					"%d agent_network_settings row(s) have no cluster/subdomain to derive an endpoint from; resolve them manually before upgrading",
-					unmigratable,
-				)
-			}
-
-			if res.RowsAffected > 0 {
-				log.WithContext(ctx).Infof("migrated %d agent_network_settings row(s) to domain/proxy_address", res.RowsAffected)
-			}
-		}
-
-		if txMigrator.HasIndex(model, "idx_agent_network_settings_cluster_subdomain") {
-			if err := txMigrator.DropIndex(model, "idx_agent_network_settings_cluster_subdomain"); err != nil {
-				return fmt.Errorf("drop legacy agent_network_settings index: %w", err)
-			}
-		}
-		for _, field := range []string{"Cluster", "Subdomain"} {
-			if txMigrator.HasColumn(model, field) {
-				if err := txMigrator.DropColumn(model, field); err != nil {
-					return fmt.Errorf("drop legacy agent_network_settings column %s: %w", field, err)
-				}
-			}
-		}
-
-		return nil
-	})
-}

management/server/migration/migration_test.go

@@ -736,125 +736,3 @@ func TestFoldCostAggregatesIntoBuckets_SkipsAlreadyMigrated(t *testing.T) {
 	assert.InDelta(t, 0.004, row.OutputCostUSD, 1e-9)
 	assert.InDelta(t, 0.01, row.TotalCostUSD(), 1e-9, "derived total sums the four buckets")
 }
-
-// legacyAgentNetworkSettings is the pre-reshape schema: identity carried as
-// (cluster, subdomain) instead of (domain, proxy_address).
-type legacyAgentNetworkSettings struct {
-	AccountID           string `gorm:"primaryKey"`
-	Cluster             string
-	Subdomain           string
-	EnableLogCollection bool
-}
-
-func (legacyAgentNetworkSettings) TableName() string { return "agent_network_settings" }
-
-// TestMigrateAgentNetworkSettingsToDomain_BackfillsAndDropsLegacyColumns pins
-// the reshape: domain becomes `<subdomain>.<cluster>`, proxy_address becomes
-// the cluster, the legacy columns are dropped, and non-identity fields ride
-// through untouched.
-func TestMigrateAgentNetworkSettingsToDomain_BackfillsAndDropsLegacyColumns(t *testing.T) {
-	ctx := context.Background()
-	db := setupDatabase(t)
-	require.NoError(t, db.Migrator().DropTable(&legacyAgentNetworkSettings{}))
-	require.NoError(t, db.AutoMigrate(&legacyAgentNetworkSettings{}))
-	require.NoError(t, db.Create(&legacyAgentNetworkSettings{
-		AccountID: "acct-1", Cluster: "eu.proxy.netbird.io", Subdomain: "violet", EnableLogCollection: true,
-	}).Error)
-	require.NoError(t, db.Create(&legacyAgentNetworkSettings{
-		AccountID: "acct-2", Cluster: "us.proxy.netbird.io", Subdomain: "violet",
-	}).Error)
-
-	require.NoError(t, migration.MigrateAgentNetworkSettingsToDomain(ctx, db))
-	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.Settings{}),
-		"AutoMigrate must create the domain unique index over the backfilled values")
-
-	var one, two agentNetworkTypes.Settings
-	require.NoError(t, db.First(&one, "account_id = ?", "acct-1").Error)
-	assert.Equal(t, "violet.eu.proxy.netbird.io", one.Domain, "domain must combine subdomain and cluster")
-	assert.Equal(t, "eu.proxy.netbird.io", one.ProxyAddress, "proxy address must carry the cluster")
-	assert.True(t, one.EnableLogCollection, "non-identity fields must ride through")
-	require.NoError(t, db.First(&two, "account_id = ?", "acct-2").Error)
-	assert.Equal(t, "violet.us.proxy.netbird.io", two.Domain,
-		"duplicate labels on different clusters are distinct hostnames and must both survive")
-
-	migrator := db.Migrator()
-	assert.False(t, migrator.HasColumn(&legacyAgentNetworkSettings{}, "cluster"), "legacy cluster column must be dropped")
-	assert.False(t, migrator.HasColumn(&legacyAgentNetworkSettings{}, "subdomain"), "legacy subdomain column must be dropped")
-}
-
-// TestMigrateAgentNetworkSettingsToDomain_SkipsAlreadyMigrated proves the
-// migration is safe to re-run: with no legacy column present it is a no-op.
-func TestMigrateAgentNetworkSettingsToDomain_SkipsAlreadyMigrated(t *testing.T) {
-	ctx := context.Background()
-	db := setupDatabase(t)
-	require.NoError(t, db.Migrator().DropTable(&agentNetworkTypes.Settings{}))
-	require.NoError(t, db.AutoMigrate(&agentNetworkTypes.Settings{}))
-	require.NoError(t, db.Create(&agentNetworkTypes.Settings{
-		AccountID: "acct-1", Domain: "gw.example.com", ProxyAddress: "gw.example.com",
-	}).Error)
-
-	require.NoError(t, migration.MigrateAgentNetworkSettingsToDomain(ctx, db),
-		"running against an already-migrated table must be a no-op, not an error")
-
-	var row agentNetworkTypes.Settings
-	require.NoError(t, db.First(&row, "account_id = ?", "acct-1").Error)
-	assert.Equal(t, "gw.example.com", row.Domain, "migrated rows must be untouched")
-}
-
-// TestMigrateAgentNetworkSettingsToDomain_FailsOnUnmigratableRow pins the
-// loud-failure contract: a legacy row missing its identity halves cannot be
-// given an endpoint, and silently leaving an empty domain would collide with
-// the unique index confusingly later.
-func TestMigrateAgentNetworkSettingsToDomain_FailsOnUnmigratableRow(t *testing.T) {
-	ctx := context.Background()
-	db := setupDatabase(t)
-	require.NoError(t, db.Migrator().DropTable(&legacyAgentNetworkSettings{}))
-	require.NoError(t, db.AutoMigrate(&legacyAgentNetworkSettings{}))
-	require.NoError(t, db.Create(&legacyAgentNetworkSettings{
-		AccountID: "acct-broken", Cluster: "", Subdomain: "",
-	}).Error)
-
-	err := migration.MigrateAgentNetworkSettingsToDomain(ctx, db)
-	require.Error(t, err, "a row with no identity to derive an endpoint from must fail the migration")
-	assert.Contains(t, err.Error(), "resolve them manually", "the error must tell the operator what to do")
-}
-
-// partialAgentNetworkSettings models the one non-atomic state a MySQL run can
-// be interrupted in: DDL auto-commits there, so a crash between the two legacy
-// column drops leaves subdomain behind while cluster (and the completed
-// backfill) are already committed.
-type partialAgentNetworkSettings struct {
-	AccountID    string `gorm:"primaryKey"`
-	Subdomain    string
-	Domain       string `gorm:"type:varchar(255)"`
-	ProxyAddress string `gorm:"type:varchar(255)"`
-}
-
-func (partialAgentNetworkSettings) TableName() string { return "agent_network_settings" }
-
-// TestMigrateAgentNetworkSettingsToDomain_ResumesAfterPartialDrop pins MySQL
-// resumability: a rerun over the interrupted state must remove the leftover
-// subdomain column without re-running the backfill (the cluster column that
-// feeds it is gone) and without touching the migrated values.
-func TestMigrateAgentNetworkSettingsToDomain_ResumesAfterPartialDrop(t *testing.T) {
-	ctx := context.Background()
-	db := setupDatabase(t)
-	require.NoError(t, db.Migrator().DropTable(&partialAgentNetworkSettings{}))
-	require.NoError(t, db.AutoMigrate(&partialAgentNetworkSettings{}))
-	require.NoError(t, db.Create(&partialAgentNetworkSettings{
-		AccountID: "acct-1", Subdomain: "violet",
-		Domain: "violet.eu.proxy.netbird.io", ProxyAddress: "eu.proxy.netbird.io",
-	}).Error)
-
-	require.NoError(t, migration.MigrateAgentNetworkSettingsToDomain(ctx, db),
-		"a rerun over a partially-dropped schema must resume, not error")
-
-	migrator := db.Migrator()
-	assert.False(t, migrator.HasColumn(&partialAgentNetworkSettings{}, "subdomain"),
-		"the leftover legacy column must be dropped on resume")
-
-	var row agentNetworkTypes.Settings
-	require.NoError(t, db.First(&row, "account_id = ?", "acct-1").Error)
-	assert.Equal(t, "violet.eu.proxy.netbird.io", row.Domain, "migrated values must be untouched")
-	assert.Equal(t, "eu.proxy.netbird.io", row.ProxyAddress, "migrated values must be untouched")
-}

management/server/store/sql_store_agentnetwork.go

@@ -315,65 +315,25 @@ func (s *SqlStore) GetAllAgentNetworkSettings(ctx context.Context, lockStrength
 	return settings, nil
 }
 
-// GetAgentNetworkSettingsByProxyAddress returns every Settings row whose
-// gateway is served by the proxy declaring the given cluster address. Used by
-// cluster-scoped synthesis to find the accounts a shared proxy serves.
-func (s *SqlStore) GetAgentNetworkSettingsByProxyAddress(ctx context.Context, lockStrength LockingStrength, proxyAddress string) ([]*agentNetworkTypes.Settings, error) {
+// GetAgentNetworkSettingsByCluster returns every Settings row pinned to
+// the given proxy cluster. Used by the bootstrap label generator to
+// build the set of subdomains already taken on a cluster.
+func (s *SqlStore) GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error) {
 	tx := s.db
 	if lockStrength != LockingStrengthNone {
 		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
 	}
 
 	var settings []*agentNetworkTypes.Settings
-	result := tx.Find(&settings, "proxy_address = ?", proxyAddress)
+	result := tx.Find(&settings, "cluster = ?", cluster)
 	if result.Error != nil {
-		log.WithContext(ctx).Errorf("failed to get agent network settings by proxy address from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get agent network settings by proxy address from store")
+		log.WithContext(ctx).Errorf("failed to get agent network settings by cluster from store: %v", result.Error)
+		return nil, status.Errorf(status.Internal, "failed to get agent network settings by cluster from store")
 	}
 
 	return settings, nil
 }
 
-// GetAgentNetworkSettingsByDomain resolves the single Settings row holding the
-// given endpoint hostname — a point query on the domain unique index. Returns
-// status.NotFound when no account owns the domain.
-func (s *SqlStore) GetAgentNetworkSettingsByDomain(ctx context.Context, lockStrength LockingStrength, domain string) (*agentNetworkTypes.Settings, error) {
-	tx := s.db
-	if lockStrength != LockingStrengthNone {
-		tx = tx.Clauses(clause.Locking{Strength: string(lockStrength)})
-	}
-
-	var settings agentNetworkTypes.Settings
-	result := tx.Take(&settings, "domain = ?", domain)
-	if result.Error != nil {
-		if errors.Is(result.Error, gorm.ErrRecordNotFound) {
-			return nil, status.Errorf(status.NotFound, "agent network settings for domain %s not found", domain)
-		}
-
-		log.WithContext(ctx).Errorf("failed to get agent network settings by domain from store: %v", result.Error)
-		return nil, status.Errorf(status.Internal, "failed to get agent network settings by domain from store")
-	}
-
-	return &settings, nil
-}
-
-// CreateAgentNetworkSettings inserts a new settings row.
-//
-// Unlike SaveAgentNetworkSettings (an upsert) this is a plain INSERT, and it
-// returns the driver error unwrapped. Both properties are required by the
-// bootstrap allocator: an upsert would overwrite whichever row it collided
-// with, and the allocator classifies the rejection by matching the driver's
-// message — a unique violation on the account primary key means a concurrent
-// bootstrap for the same account won, and one on the domain index means the
-// hostname is taken.
-func (s *SqlStore) CreateAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error {
-	if err := s.db.Create(settings).Error; err != nil {
-		log.WithContext(ctx).Debugf("failed to create agent network settings: %v", err)
-		return err
-	}
-	return nil
-}
-
 // SaveAgentNetworkSettings upserts the per-account Agent Network
 // settings row.
 func (s *SqlStore) SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error {

management/server/store/sql_store_agentnetwork_budgetrule_test.go

@@ -88,9 +88,9 @@ func TestAgentNetworkSettings_RealStore_CollectionTogglesRoundTrip(t *testing.T)
 
 	const accountID = "acc-settings-toggles"
 	require.NoError(t, s.SaveAgentNetworkSettings(ctx, &agentNetworkTypes.Settings{
-		AccountID:    accountID,
-		Domain:       "violet.eu.proxy.netbird.io",
-		ProxyAddress: "eu.proxy.netbird.io",
+		AccountID: accountID,
+		Cluster:   "eu.proxy.netbird.io",
+		Subdomain: "violet",
 	}))
 
 	got, err := s.GetAgentNetworkSettings(ctx, LockingStrengthNone, accountID)

management/server/store/store.go

@@ -360,9 +360,7 @@ type Store interface {
 	DeleteAgentNetworkGuardrail(ctx context.Context, accountID, guardrailID string) error
 	GetAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength, accountID string) (*agentNetworkTypes.Settings, error)
 	GetAllAgentNetworkSettings(ctx context.Context, lockStrength LockingStrength) ([]*agentNetworkTypes.Settings, error)
-	GetAgentNetworkSettingsByProxyAddress(ctx context.Context, lockStrength LockingStrength, proxyAddress string) ([]*agentNetworkTypes.Settings, error)
-	GetAgentNetworkSettingsByDomain(ctx context.Context, lockStrength LockingStrength, domain string) (*agentNetworkTypes.Settings, error)
-	CreateAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error
+	GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*agentNetworkTypes.Settings, error)
 	SaveAgentNetworkSettings(ctx context.Context, settings *agentNetworkTypes.Settings) error
 	IncrementAgentNetworkConsumption(ctx context.Context, accountID string, kind agentNetworkTypes.ConsumptionDimension, dimID string, windowSeconds int64, windowStart time.Time, tokensIn, tokensOut int64, costUSD float64) error
 	IncrementAgentNetworkConsumptionBatch(ctx context.Context, accountID string, keys []agentNetworkTypes.ConsumptionKey, tokensIn, tokensOut int64, costUSD float64) error
@@ -610,9 +608,6 @@ func getMigrationsPreAuto(ctx context.Context) []migrationFunc {
 		func(db *gorm.DB) error {
 			return migration.BackfillPublicIDs[posture.Checks](ctx, db)
 		},
-		func(db *gorm.DB) error {
-			return migration.MigrateAgentNetworkSettingsToDomain(ctx, db)
-		},
 	}
 }
 

management/server/store/store_mock.go

@@ -268,20 +268,6 @@ func (mr *MockStoreMockRecorder) CreateAgentNetworkAccessLog(ctx, entry, groups
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkAccessLog", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkAccessLog), ctx, entry, groups)
 }
 
-// CreateAgentNetworkSettings mocks base method.
-func (m *MockStore) CreateAgentNetworkSettings(ctx context.Context, settings *types.Settings) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CreateAgentNetworkSettings", ctx, settings)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// CreateAgentNetworkSettings indicates an expected call of CreateAgentNetworkSettings.
-func (mr *MockStoreMockRecorder) CreateAgentNetworkSettings(ctx, settings interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).CreateAgentNetworkSettings), ctx, settings)
-}
-
 // CreateAgentNetworkUsage mocks base method.
 func (m *MockStore) CreateAgentNetworkUsage(ctx context.Context, usage *types.AgentNetworkUsage, groups []types.AgentNetworkUsageGroup) error {
 	m.ctrl.T.Helper()
@@ -1701,34 +1687,19 @@ func (mr *MockStoreMockRecorder) GetAgentNetworkSettings(ctx, lockStrength, acco
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettings", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettings), ctx, lockStrength, accountID)
 }
 
-// GetAgentNetworkSettingsByDomain mocks base method.
-func (m *MockStore) GetAgentNetworkSettingsByDomain(ctx context.Context, lockStrength LockingStrength, domain string) (*types.Settings, error) {
+// GetAgentNetworkSettingsByCluster mocks base method.
+func (m *MockStore) GetAgentNetworkSettingsByCluster(ctx context.Context, lockStrength LockingStrength, cluster string) ([]*types.Settings, error) {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsByDomain", ctx, lockStrength, domain)
-	ret0, _ := ret[0].(*types.Settings)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAgentNetworkSettingsByDomain indicates an expected call of GetAgentNetworkSettingsByDomain.
-func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByDomain(ctx, lockStrength, domain interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByDomain", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByDomain), ctx, lockStrength, domain)
-}
-
-// GetAgentNetworkSettingsByProxyAddress mocks base method.
-func (m *MockStore) GetAgentNetworkSettingsByProxyAddress(ctx context.Context, lockStrength LockingStrength, proxyAddress string) ([]*types.Settings, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsByProxyAddress", ctx, lockStrength, proxyAddress)
+	ret := m.ctrl.Call(m, "GetAgentNetworkSettingsByCluster", ctx, lockStrength, cluster)
 	ret0, _ := ret[0].([]*types.Settings)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
 
-// GetAgentNetworkSettingsByProxyAddress indicates an expected call of GetAgentNetworkSettingsByProxyAddress.
-func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByProxyAddress(ctx, lockStrength, proxyAddress interface{}) *gomock.Call {
+// GetAgentNetworkSettingsByCluster indicates an expected call of GetAgentNetworkSettingsByCluster.
+func (mr *MockStoreMockRecorder) GetAgentNetworkSettingsByCluster(ctx, lockStrength, cluster interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByProxyAddress", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByProxyAddress), ctx, lockStrength, proxyAddress)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAgentNetworkSettingsByCluster", reflect.TypeOf((*MockStore)(nil).GetAgentNetworkSettingsByCluster), ctx, lockStrength, cluster)
 }
 
 // GetAgentNetworkUsageRows mocks base method.

management/server/types/account.go

@@ -1707,34 +1707,14 @@ func (a *Account) injectPrivateServicePolicies(svc *service.Service, proxyPeers
 	if len(proxyPeers) == 0 {
 		return
 	}
-	// A service's AccessGroups can name groups that no longer exist — persisted
-	// services and the agent-network synthesiser both carry the ids verbatim from
-	// their own state. An unresolvable source authorises nothing, so drop it here
-	// rather than let the network-map assembly resolve it to a nil group.
-	sources := a.existingGroupIDs(svc.AccessGroups)
-	if len(sources) == 0 {
-		return
-	}
 	for _, proxyPeer := range proxyPeers {
-		a.Policies = append(a.Policies, a.createPrivateServicePolicy(svc, proxyPeer, sources))
+		a.Policies = append(a.Policies, a.createPrivateServicePolicy(svc, proxyPeer))
 	}
 }
 
-// existingGroupIDs returns the subset of groupIDs that resolve to a group in the account,
-// preserving the input order.
-func (a *Account) existingGroupIDs(groupIDs []string) []string {
-	out := make([]string, 0, len(groupIDs))
-	for _, groupID := range groupIDs {
-		if _, ok := a.Groups[groupID]; ok {
-			out = append(out, groupID)
-		}
-	}
-	return out
-}
-
-func (a *Account) createPrivateServicePolicy(svc *service.Service, proxyPeer *nbpeer.Peer, accessGroups []string) *Policy {
+func (a *Account) createPrivateServicePolicy(svc *service.Service, proxyPeer *nbpeer.Peer) *Policy {
 	policyID := fmt.Sprintf("private-access-%s-%s", svc.ID, proxyPeer.ID)
-	sources := append([]string(nil), accessGroups...)
+	sources := append([]string(nil), svc.AccessGroups...)
 	return &Policy{
 		ID:      policyID,
 		Name:    fmt.Sprintf("Private Access to %s", svc.Name),

proxy/internal/proxy/agent_network_chain_realstack_test.go

@@ -73,8 +73,8 @@ func TestReverseProxy_AgentNetworkRequest_FullChain(t *testing.T) {
 		testAdminUser = "user-admin-1"
 		adminGroupID  = "grp-admins"
 		providerID    = "prov-openai-test"
-		domain        = "fullchain.test.proxy.local"
-		proxyAddress  = "test.proxy.local"
+		cluster       = "test.proxy.local"
+		subdomain     = "fullchain"
 	)
 	testLogger := log.New()
 	testLogger.SetLevel(log.PanicLevel) // keep test output clean
@@ -127,8 +127,8 @@ func TestReverseProxy_AgentNetworkRequest_FullChain(t *testing.T) {
 	// increments on the response leg.
 	require.NoError(t, st.SaveAgentNetworkSettings(ctx, &agentNetworkTypes.Settings{
 		AccountID:              testAccountID,
-		Domain:                 domain,
-		ProxyAddress:           proxyAddress,
+		Cluster:                cluster,
+		Subdomain:              subdomain,
 		EnablePromptCollection: true,
 		EnableLogCollection:    true,
 		RedactPii:              true,

release_files/darwin_pkg/preinstall

@@ -4,67 +4,9 @@ set -x
 
 LOG_FILE=/var/log/netbird/client_pre_install.log
 AGENT=/usr/local/bin/netbird
-UI_PROCESS=netbird-ui
 
 mkdir -p /var/log/netbird/
 
-# wait_for_ui_exit polls for up to $1 seconds, returning 0 as soon as no UI
-# process is left and 1 if one is still running when the time is up.
-wait_for_ui_exit() {
-    waited=0
-    while [ "$waited" -lt "$1" ]; do
-        pgrep -x "$UI_PROCESS" > /dev/null 2>&1 || return 0
-        sleep 1
-        waited=$((waited + 1))
-    done
-    return 1
-}
-
-# request_ui_quit asks the UI to quit from inside the console user's session and
-# reports whether the request could be sent at all. The installer runs as root
-# outside that session, so a quit Apple event sent straight from here always
-# fails with -600.
-request_ui_quit() {
-    console_user=$(stat -f%Su /dev/console 2>/dev/null)
-    case "$console_user" in
-        ""|root|loginwindow|_mbsetupuser)
-            echo "No active GUI user session (console user: '${console_user:-none}'); skipping the quit request."
-            return 1
-            ;;
-    esac
-
-    uid=$(id -u "$console_user" 2>/dev/null)
-    if [ -z "$uid" ]; then
-        echo "Could not resolve uid for console user '$console_user'; skipping the quit request."
-        return 1
-    fi
-
-    echo "Asking the NetBird UI to quit as console user $console_user (uid $uid)."
-    launchctl asuser "$uid" sudo -u "$console_user" -H osascript -e 'quit app "NetBird"' || true
-}
-
-# quit_ui stops a running UI so the app bundle can be replaced underneath it. A
-# UI process that survives the install keeps serving the old binary until it is
-# quit by hand, so anything still running once the quit request is out of the
-# way is signalled. Waiting for a graceful exit only makes sense when a quit
-# request was actually sent.
-quit_ui() {
-    if request_ui_quit && wait_for_ui_exit 10; then
-        return 0
-    fi
-
-    pgrep -x "$UI_PROCESS" > /dev/null 2>&1 || return 0
-
-    echo "NetBird UI still running; terminating it."
-    pkill -x "$UI_PROCESS" || true
-    if wait_for_ui_exit 3; then
-        return 0
-    fi
-
-    echo "NetBird UI ignored SIGTERM; killing it."
-    pkill -KILL -x "$UI_PROCESS" || true
-}
-
 {
     # check if it was installed with brew
     brew list --formula | grep netbird
@@ -73,9 +15,10 @@ quit_ui() {
         echo "NetBird has been installed with Brew. Please use Brew to update the package."
         exit 1
     fi
-    quit_ui
+    osascript -e 'quit app "Netbird"' || true
     $AGENT service stop || true
 
     echo "Preinstall complete"
     exit 0 # all good
 } &> $LOG_FILE
+

shared/management/client/rest/agentnetwork.go

@@ -1,400 +0,0 @@
-package rest
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// AgentNetworkAPI APIs for the Agent Network (AI/LLM gateway), do not use directly
-// see more: https://docs.netbird.io/api/resources/agent-network
-type AgentNetworkAPI struct {
-	c *Client
-}
-
-// ListCatalogProviders lists the catalog of supported upstream AI providers
-// (openai_api, anthropic_api, bedrock_api, ...) with their default models and
-// pricing, used to prefill provider create forms.
-func (a *AgentNetworkAPI) ListCatalogProviders(ctx context.Context) ([]api.AgentNetworkCatalogProvider, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/catalog/providers", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.AgentNetworkCatalogProvider](resp)
-	return ret, err
-}
-
-// ListProviders lists all Agent Network providers
-func (a *AgentNetworkAPI) ListProviders(ctx context.Context) ([]api.AgentNetworkProvider, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/providers", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.AgentNetworkProvider](resp)
-	return ret, err
-}
-
-// GetProvider gets Agent Network provider info
-func (a *AgentNetworkAPI) GetProvider(ctx context.Context, providerID string) (*api.AgentNetworkProvider, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/providers/"+providerID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkProvider](resp)
-	return &ret, err
-}
-
-// CreateProvider creates a new Agent Network provider. Providers have no
-// settings side effects — bootstrap the account's gateway endpoint separately
-// via CreateSettings.
-func (a *AgentNetworkAPI) CreateProvider(ctx context.Context, request api.PostApiAgentNetworkProvidersJSONRequestBody) (*api.AgentNetworkProvider, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/providers", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkProvider](resp)
-	return &ret, err
-}
-
-// UpdateProvider updates an Agent Network provider. The request replaces the
-// provider's mutable state; only an omitted api_key keeps the stored key
-// (secrets are never required to round-trip).
-func (a *AgentNetworkAPI) UpdateProvider(ctx context.Context, providerID string, request api.PutApiAgentNetworkProvidersProviderIdJSONRequestBody) (*api.AgentNetworkProvider, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/providers/"+providerID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkProvider](resp)
-	return &ret, err
-}
-
-// DeleteProvider deletes an Agent Network provider. Fails while any policy
-// still references the provider — detach it first.
-func (a *AgentNetworkAPI) DeleteProvider(ctx context.Context, providerID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/providers/"+providerID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
-
-// ListPolicies lists all Agent Network policies
-func (a *AgentNetworkAPI) ListPolicies(ctx context.Context) ([]api.AgentNetworkPolicy, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/policies", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.AgentNetworkPolicy](resp)
-	return ret, err
-}
-
-// GetPolicy gets Agent Network policy info
-func (a *AgentNetworkAPI) GetPolicy(ctx context.Context, policyID string) (*api.AgentNetworkPolicy, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/policies/"+policyID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkPolicy](resp)
-	return &ret, err
-}
-
-// CreatePolicy creates a new Agent Network policy
-func (a *AgentNetworkAPI) CreatePolicy(ctx context.Context, request api.PostApiAgentNetworkPoliciesJSONRequestBody) (*api.AgentNetworkPolicy, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/policies", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkPolicy](resp)
-	return &ret, err
-}
-
-// UpdatePolicy updates an Agent Network policy
-func (a *AgentNetworkAPI) UpdatePolicy(ctx context.Context, policyID string, request api.PutApiAgentNetworkPoliciesPolicyIdJSONRequestBody) (*api.AgentNetworkPolicy, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/policies/"+policyID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkPolicy](resp)
-	return &ret, err
-}
-
-// DeletePolicy deletes an Agent Network policy
-func (a *AgentNetworkAPI) DeletePolicy(ctx context.Context, policyID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/policies/"+policyID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
-
-// ListGuardrails lists all Agent Network guardrails
-func (a *AgentNetworkAPI) ListGuardrails(ctx context.Context) ([]api.AgentNetworkGuardrail, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/guardrails", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.AgentNetworkGuardrail](resp)
-	return ret, err
-}
-
-// GetGuardrail gets Agent Network guardrail info
-func (a *AgentNetworkAPI) GetGuardrail(ctx context.Context, guardrailID string) (*api.AgentNetworkGuardrail, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/guardrails/"+guardrailID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkGuardrail](resp)
-	return &ret, err
-}
-
-// CreateGuardrail creates a new Agent Network guardrail
-func (a *AgentNetworkAPI) CreateGuardrail(ctx context.Context, request api.PostApiAgentNetworkGuardrailsJSONRequestBody) (*api.AgentNetworkGuardrail, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/guardrails", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkGuardrail](resp)
-	return &ret, err
-}
-
-// UpdateGuardrail updates an Agent Network guardrail
-func (a *AgentNetworkAPI) UpdateGuardrail(ctx context.Context, guardrailID string, request api.PutApiAgentNetworkGuardrailsGuardrailIdJSONRequestBody) (*api.AgentNetworkGuardrail, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/guardrails/"+guardrailID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkGuardrail](resp)
-	return &ret, err
-}
-
-// DeleteGuardrail deletes an Agent Network guardrail
-func (a *AgentNetworkAPI) DeleteGuardrail(ctx context.Context, guardrailID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/guardrails/"+guardrailID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
-
-// ListBudgetRules lists all account-level Agent Network budget rules
-func (a *AgentNetworkAPI) ListBudgetRules(ctx context.Context) ([]api.AgentNetworkBudgetRule, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/budget-rules", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[[]api.AgentNetworkBudgetRule](resp)
-	return ret, err
-}
-
-// GetBudgetRule gets Agent Network budget rule info
-func (a *AgentNetworkAPI) GetBudgetRule(ctx context.Context, ruleID string) (*api.AgentNetworkBudgetRule, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/budget-rules/"+ruleID, nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkBudgetRule](resp)
-	return &ret, err
-}
-
-// CreateBudgetRule creates a new Agent Network budget rule
-func (a *AgentNetworkAPI) CreateBudgetRule(ctx context.Context, request api.PostApiAgentNetworkBudgetRulesJSONRequestBody) (*api.AgentNetworkBudgetRule, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/budget-rules", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkBudgetRule](resp)
-	return &ret, err
-}
-
-// UpdateBudgetRule updates an Agent Network budget rule
-func (a *AgentNetworkAPI) UpdateBudgetRule(ctx context.Context, ruleID string, request api.PutApiAgentNetworkBudgetRulesRuleIdJSONRequestBody) (*api.AgentNetworkBudgetRule, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/budget-rules/"+ruleID, bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkBudgetRule](resp)
-	return &ret, err
-}
-
-// DeleteBudgetRule deletes an Agent Network budget rule
-func (a *AgentNetworkAPI) DeleteBudgetRule(ctx context.Context, ruleID string) error {
-	resp, err := a.c.NewRequest(ctx, "DELETE", "/api/agent-network/budget-rules/"+ruleID, nil, nil)
-	if err != nil {
-		return err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-
-	return nil
-}
-
-// GetSettings gets the account's Agent Network gateway settings (endpoint,
-// proxy address, collection toggles). An account that has not been
-// bootstrapped yet — via CreateSettings — reads as the defaults with an empty
-// Endpoint and ProxyAddress. Management servers prior to that contract
-// answered 200 with a JSON null body instead; that legacy shape is translated
-// to an APIError matchable via IsNotFound rather than fabricating defaults
-// the server never stated.
-func (a *AgentNetworkAPI) GetSettings(ctx context.Context) (*api.AgentNetworkSettings, error) {
-	resp, err := a.c.NewRequest(ctx, "GET", "/api/agent-network/settings", nil, nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	body, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return nil, err
-	}
-	if trimmed := bytes.TrimSpace(body); len(trimmed) == 0 || bytes.Equal(trimmed, []byte("null")) {
-		return nil, &APIError{StatusCode: http.StatusNotFound, Message: "agent network settings not found"}
-	}
-	var ret api.AgentNetworkSettings
-	if err := json.Unmarshal(body, &ret); err != nil {
-		return nil, err
-	}
-	return &ret, nil
-}
-
-// CreateSettings bootstraps the account's Agent Network settings row,
-// assigning the immutable endpoint. Exactly one of request.ProxyAddress
-// (labeled endpoint beneath that cluster; the server allocates the label) and
-// request.Endpoint (self-addressed dedicated endpoint, claimed verbatim) must
-// be set. Returns a conflict when the account already has a settings row.
-func (a *AgentNetworkAPI) CreateSettings(ctx context.Context, request api.PostApiAgentNetworkSettingsJSONRequestBody) (*api.AgentNetworkSettings, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "POST", "/api/agent-network/settings", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkSettings](resp)
-	return &ret, err
-}
-
-// UpdateSettings updates the account's Agent Network settings; the request
-// replaces every mutable field (collection toggles and retention). The
-// endpoint and proxy address are assigned at bootstrap (CreateSettings) and
-// are not part of the update schema. Returns not-found until the account is
-// bootstrapped.
-func (a *AgentNetworkAPI) UpdateSettings(ctx context.Context, request api.PutApiAgentNetworkSettingsJSONRequestBody) (*api.AgentNetworkSettings, error) {
-	requestBytes, err := json.Marshal(request)
-	if err != nil {
-		return nil, err
-	}
-	resp, err := a.c.NewRequest(ctx, "PUT", "/api/agent-network/settings", bytes.NewReader(requestBytes), nil)
-	if err != nil {
-		return nil, err
-	}
-	if resp.Body != nil {
-		defer resp.Body.Close()
-	}
-	ret, err := parseResponse[api.AgentNetworkSettings](resp)
-	return &ret, err
-}

shared/management/client/rest/agentnetwork_test.go

@@ -1,530 +0,0 @@
-//go:build integration
-
-package rest_test
-
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/shared/management/client/rest"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-	"github.com/netbirdio/netbird/shared/management/http/util"
-)
-
-var (
-	testAgentNetworkProvider = api.AgentNetworkProvider{
-		Id:          "ainp_test",
-		ProviderId:  "openai_api",
-		Name:        "OpenAI",
-		UpstreamUrl: "https://api.openai.com",
-		Models:      []api.AgentNetworkProviderModel{},
-		Enabled:     true,
-	}
-
-	testAgentNetworkPolicy = api.AgentNetworkPolicy{
-		Id:                     "ainpol_test",
-		Name:                   "Engineering → OpenAI",
-		Enabled:                true,
-		SourceGroups:           []string{"grp-eng"},
-		DestinationProviderIds: []string{"ainp_test"},
-	}
-
-	testAgentNetworkGuardrail = api.AgentNetworkGuardrail{
-		Id:   "aingr_test",
-		Name: "No secrets",
-	}
-
-	testAgentNetworkBudgetRule = api.AgentNetworkBudgetRule{
-		Id:      "ainbud_test",
-		Name:    "Org monthly ceiling",
-		Enabled: true,
-	}
-
-	testAgentNetworkSettings = api.AgentNetworkSettings{
-		Endpoint:               "violet.eu.proxy.netbird.io",
-		ProxyAddress:           "eu.proxy.netbird.io",
-		Dedicated:              false,
-		EnableLogCollection:    true,
-		AccessLogRetentionDays: ptr(30),
-	}
-)
-
-func TestAgentNetwork_ListCatalogProviders_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/catalog/providers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.AgentNetworkCatalogProvider{{Id: "openai_api", Name: "OpenAI"}})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.ListCatalogProviders(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, "openai_api", ret[0].Id)
-	})
-}
-
-func TestAgentNetwork_ListProviders_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/providers", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.AgentNetworkProvider{testAgentNetworkProvider})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.ListProviders(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testAgentNetworkProvider, ret[0])
-	})
-}
-
-func TestAgentNetwork_GetProvider_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/providers/ainp_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "GET", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkProvider)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetProvider(context.Background(), "ainp_test")
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkProvider, *ret)
-	})
-}
-
-func TestAgentNetwork_GetProvider_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/providers/ainp_test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "not found", Code: 404})
-			w.WriteHeader(404)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		_, err := c.AgentNetwork.GetProvider(context.Background(), "ainp_test")
-		require.Error(t, err)
-		assert.True(t, rest.IsNotFound(err), "a 404 must be matchable via IsNotFound")
-	})
-}
-
-func TestAgentNetwork_CreateProvider_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/providers", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			var req api.PostApiAgentNetworkProvidersJSONRequestBody
-			require.NoError(t, json.Unmarshal(reqBytes, &req))
-			assert.Equal(t, "OpenAI", req.Name)
-			retBytes, _ := json.Marshal(testAgentNetworkProvider)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.CreateProvider(context.Background(), api.PostApiAgentNetworkProvidersJSONRequestBody{
-			ProviderId:  "openai_api",
-			Name:        "OpenAI",
-			UpstreamUrl: "https://api.openai.com",
-			ApiKey:      ptr("sk-test"),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkProvider, *ret)
-	})
-}
-
-func TestAgentNetwork_UpdateProvider_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/providers/ainp_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			// Omitted optional fields must be absent from the wire (not
-			// zero-valued) so the server-side merge preserves them.
-			assert.NotContains(t, string(reqBytes), "api_key")
-			assert.NotContains(t, string(reqBytes), "models")
-			retBytes, _ := json.Marshal(testAgentNetworkProvider)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.UpdateProvider(context.Background(), "ainp_test", api.PutApiAgentNetworkProvidersProviderIdJSONRequestBody{
-			ProviderId:  "openai_api",
-			Name:        "OpenAI",
-			UpstreamUrl: "https://api.openai.com",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkProvider, *ret)
-	})
-}
-
-func TestAgentNetwork_DeleteProvider_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/providers/ainp_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			_, err := w.Write([]byte("{}"))
-			require.NoError(t, err)
-		})
-		err := c.AgentNetwork.DeleteProvider(context.Background(), "ainp_test")
-		require.NoError(t, err)
-	})
-}
-
-func TestAgentNetwork_ListPolicies_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/policies", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.AgentNetworkPolicy{testAgentNetworkPolicy})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.ListPolicies(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testAgentNetworkPolicy, ret[0])
-	})
-}
-
-func TestAgentNetwork_GetPolicy_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/policies/ainpol_test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testAgentNetworkPolicy)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetPolicy(context.Background(), "ainpol_test")
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkPolicy, *ret)
-	})
-}
-
-func TestAgentNetwork_CreatePolicy_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/policies", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkPolicy)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.CreatePolicy(context.Background(), api.PostApiAgentNetworkPoliciesJSONRequestBody{
-			Name:                   "Engineering → OpenAI",
-			SourceGroups:           []string{"grp-eng"},
-			DestinationProviderIds: []string{"ainp_test"},
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkPolicy, *ret)
-	})
-}
-
-func TestAgentNetwork_UpdatePolicy_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/policies/ainpol_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkPolicy)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.UpdatePolicy(context.Background(), "ainpol_test", api.PutApiAgentNetworkPoliciesPolicyIdJSONRequestBody{
-			Name:                   "Engineering → OpenAI",
-			SourceGroups:           []string{"grp-eng"},
-			DestinationProviderIds: []string{"ainp_test"},
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkPolicy, *ret)
-	})
-}
-
-func TestAgentNetwork_DeletePolicy_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/policies/ainpol_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			_, err := w.Write([]byte("{}"))
-			require.NoError(t, err)
-		})
-		err := c.AgentNetwork.DeletePolicy(context.Background(), "ainpol_test")
-		require.NoError(t, err)
-	})
-}
-
-func TestAgentNetwork_ListGuardrails_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/guardrails", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.AgentNetworkGuardrail{testAgentNetworkGuardrail})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.ListGuardrails(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testAgentNetworkGuardrail, ret[0])
-	})
-}
-
-func TestAgentNetwork_GetGuardrail_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/guardrails/aingr_test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testAgentNetworkGuardrail)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetGuardrail(context.Background(), "aingr_test")
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkGuardrail, *ret)
-	})
-}
-
-func TestAgentNetwork_CreateGuardrail_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/guardrails", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkGuardrail)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.CreateGuardrail(context.Background(), api.PostApiAgentNetworkGuardrailsJSONRequestBody{
-			Name: "No secrets",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkGuardrail, *ret)
-	})
-}
-
-func TestAgentNetwork_UpdateGuardrail_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/guardrails/aingr_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkGuardrail)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.UpdateGuardrail(context.Background(), "aingr_test", api.PutApiAgentNetworkGuardrailsGuardrailIdJSONRequestBody{
-			Name: "No secrets",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkGuardrail, *ret)
-	})
-}
-
-func TestAgentNetwork_DeleteGuardrail_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/guardrails/aingr_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			_, err := w.Write([]byte("{}"))
-			require.NoError(t, err)
-		})
-		err := c.AgentNetwork.DeleteGuardrail(context.Background(), "aingr_test")
-		require.NoError(t, err)
-	})
-}
-
-func TestAgentNetwork_ListBudgetRules_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/budget-rules", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal([]api.AgentNetworkBudgetRule{testAgentNetworkBudgetRule})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.ListBudgetRules(context.Background())
-		require.NoError(t, err)
-		assert.Len(t, ret, 1)
-		assert.Equal(t, testAgentNetworkBudgetRule, ret[0])
-	})
-}
-
-func TestAgentNetwork_GetBudgetRule_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/budget-rules/ainbud_test", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testAgentNetworkBudgetRule)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetBudgetRule(context.Background(), "ainbud_test")
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkBudgetRule, *ret)
-	})
-}
-
-func TestAgentNetwork_CreateBudgetRule_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/budget-rules", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkBudgetRule)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.CreateBudgetRule(context.Background(), api.PostApiAgentNetworkBudgetRulesJSONRequestBody{
-			Name: "Org monthly ceiling",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkBudgetRule, *ret)
-	})
-}
-
-func TestAgentNetwork_UpdateBudgetRule_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/budget-rules/ainbud_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			retBytes, _ := json.Marshal(testAgentNetworkBudgetRule)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.UpdateBudgetRule(context.Background(), "ainbud_test", api.PutApiAgentNetworkBudgetRulesRuleIdJSONRequestBody{
-			Name: "Org monthly ceiling",
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkBudgetRule, *ret)
-	})
-}
-
-func TestAgentNetwork_DeleteBudgetRule_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/budget-rules/ainbud_test", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "DELETE", r.Method)
-			_, err := w.Write([]byte("{}"))
-			require.NoError(t, err)
-		})
-		err := c.AgentNetwork.DeleteBudgetRule(context.Background(), "ainbud_test")
-		require.NoError(t, err)
-	})
-}
-
-func TestAgentNetwork_GetSettings_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(testAgentNetworkSettings)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetSettings(context.Background())
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkSettings, *ret)
-	})
-}
-
-// TestAgentNetwork_GetSettings_UnbootstrappedDefaults pins the settings-read
-// contract: an unbootstrapped account answers 200 with the defaults and empty
-// cluster/subdomain/endpoint, which the client passes through untouched.
-func TestAgentNetwork_GetSettings_UnbootstrappedDefaults(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(api.AgentNetworkSettings{
-				EnableLogCollection:    true,
-				AccessLogRetentionDays: ptr(30),
-			})
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetSettings(context.Background())
-		require.NoError(t, err)
-		assert.Empty(t, ret.Endpoint, "empty endpoint is the not-bootstrapped signal")
-		assert.True(t, ret.EnableLogCollection, "defaults must pass through")
-	})
-}
-
-func TestAgentNetwork_GetSettings_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "no", Code: 403})
-			w.WriteHeader(403)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		_, err := c.AgentNetwork.GetSettings(context.Background())
-		require.Error(t, err)
-		assert.Equal(t, "no", err.Error())
-	})
-}
-
-// TestAgentNetwork_GetSettings_LegacyNullBody pins the compatibility shim for
-// management servers that answered 200 with a JSON null body before the
-// defaults contract: the client translates that shape into an IsNotFound
-// error instead of returning a bogus zero-valued settings object or
-// fabricating defaults the server never stated.
-func TestAgentNetwork_GetSettings_LegacyNullBody(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			_, err := w.Write([]byte("null"))
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.GetSettings(context.Background())
-		require.Error(t, err)
-		assert.Nil(t, ret)
-		assert.True(t, rest.IsNotFound(err), "the legacy 200+null shape must surface as IsNotFound")
-	})
-}
-
-func TestAgentNetwork_CreateSettings_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "POST", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			var req api.PostApiAgentNetworkSettingsJSONRequestBody
-			require.NoError(t, json.Unmarshal(reqBytes, &req))
-			require.NotNil(t, req.ProxyAddress, "proxy address must be on the wire")
-			assert.Equal(t, "eu.proxy.netbird.io", *req.ProxyAddress)
-			assert.Nil(t, req.Endpoint, "endpoint must stay off the wire for a labeled bootstrap")
-			retBytes, _ := json.Marshal(testAgentNetworkSettings)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.CreateSettings(context.Background(), api.PostApiAgentNetworkSettingsJSONRequestBody{
-			ProxyAddress: ptr("eu.proxy.netbird.io"),
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkSettings, *ret)
-	})
-}
-
-func TestAgentNetwork_CreateSettings_Conflict(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "agent network settings already bootstrapped for account acct1", Code: 409})
-			w.WriteHeader(409)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		_, err := c.AgentNetwork.CreateSettings(context.Background(), api.PostApiAgentNetworkSettingsJSONRequestBody{
-			Endpoint: ptr("gw.example.com"),
-		})
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), "already bootstrapped")
-	})
-}
-
-func TestAgentNetwork_UpdateSettings_200(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			assert.Equal(t, "PUT", r.Method)
-			reqBytes, err := io.ReadAll(r.Body)
-			require.NoError(t, err)
-			var req api.PutApiAgentNetworkSettingsJSONRequestBody
-			require.NoError(t, json.Unmarshal(reqBytes, &req))
-			assert.True(t, req.EnableLogCollection)
-			retBytes, _ := json.Marshal(testAgentNetworkSettings)
-			_, err = w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		ret, err := c.AgentNetwork.UpdateSettings(context.Background(), api.PutApiAgentNetworkSettingsJSONRequestBody{
-			EnableLogCollection: true,
-		})
-		require.NoError(t, err)
-		assert.Equal(t, testAgentNetworkSettings, *ret)
-	})
-}
-
-func TestAgentNetwork_UpdateSettings_Err(t *testing.T) {
-	withMockClient(func(c *rest.Client, mux *http.ServeMux) {
-		mux.HandleFunc("/api/agent-network/settings", func(w http.ResponseWriter, r *http.Request) {
-			retBytes, _ := json.Marshal(util.ErrorResponse{Message: "agent network settings have not been bootstrapped yet; POST /api/agent-network/settings to bootstrap them", Code: 404})
-			w.WriteHeader(404)
-			_, err := w.Write(retBytes)
-			require.NoError(t, err)
-		})
-		_, err := c.AgentNetwork.UpdateSettings(context.Background(), api.PutApiAgentNetworkSettingsJSONRequestBody{
-			EnableLogCollection: true,
-		})
-		require.Error(t, err)
-		assert.True(t, rest.IsNotFound(err), "an unbootstrapped account must surface as IsNotFound")
-	})
-}

shared/management/client/rest/client.go

@@ -147,10 +147,6 @@ type Client struct {
 	// ReverseProxyTokens account-scoped proxy access tokens used to register
 	// self-hosted (bring-your-own-proxy) `netbird proxy` instances.
 	ReverseProxyTokens *ReverseProxyTokensAPI
-
-	// AgentNetwork NetBird Agent Network (AI/LLM gateway) APIs: catalog,
-	// providers, policies, guardrails, budget rules and account settings.
-	AgentNetwork *AgentNetworkAPI
 }
 
 // New initialize new Client instance using PAT token
@@ -213,7 +209,6 @@ func (c *Client) initialize() {
 	c.ReverseProxyClusters = &ReverseProxyClustersAPI{c}
 	c.ReverseProxyDomains = &ReverseProxyDomainsAPI{c}
 	c.ReverseProxyTokens = &ReverseProxyTokensAPI{c}
-	c.AgentNetwork = &AgentNetworkAPI{c}
 }
 
 // NewRequest creates and executes new management API request

shared/management/http/api/openapi.yml

@@ -5149,12 +5149,12 @@ components:
         identity_header_user_id:
           type: string
           description: |
-            Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
+            Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
           example: "x-bf-dim-netbird_user_id"
         identity_header_groups:
           type: string
           description: |
-            Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
+            Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
           example: "x-bf-dim-netbird_groups"
         enabled:
           type: boolean
@@ -5186,8 +5186,6 @@ components:
         - name
         - upstream_url
         - models
-        - identity_header_user_id
-        - identity_header_groups
         - enabled
         - skip_tls_verification
         - metadata_disabled
@@ -5208,6 +5206,10 @@ components:
           type: string
           description: Full upstream URL (with scheme) that NetBird forwards traffic to.
           example: "https://api.openai.com"
+        bootstrap_cluster:
+          type: string
+          description: Proxy cluster used to bootstrap the per-account agent-network endpoint when the first provider is created. Ignored on subsequent creates and on updates because the cluster is pinned on the account-level Settings row.
+          example: "eu.proxy.netbird.io"
         api_key:
           type: string
           description: Upstream provider API key. Sealed at rest on the management server and never returned in responses. Required on create; optional on update (omit to keep the existing key).
@@ -5220,7 +5222,7 @@ components:
         extra_values:
           type: object
           description: |
-            Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). The request's map replaces the stored values; empty strings drop the corresponding key.
+            Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). When present on a request, the whole map replaces the stored values. Empty strings drop the corresponding key.
           additionalProperties:
             type: string
           example:
@@ -5228,12 +5230,12 @@ components:
         identity_header_user_id:
           type: string
           description: |
-            Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. Empty or omitted disables stamping for this dimension.
+            Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. When omitted on a request, the stored value is left unchanged; pass an empty string explicitly to clear it (which disables stamping for this dimension).
           example: "x-bf-dim-netbird_user_id"
         identity_header_groups:
           type: string
           description: |
-            Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same semantics as `identity_header_user_id`.
+            Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same omit / empty semantics as `identity_header_user_id`.
           example: "x-bf-dim-netbird_groups"
         enabled:
           type: boolean
@@ -5241,11 +5243,11 @@ components:
           example: true
         skip_tls_verification:
           type: boolean
-          description: Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false.
+          description: Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false. When omitted on update, the stored value is left unchanged.
           example: false
         metadata_disabled:
           type: boolean
-          description: Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected).
+          description: Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected). When omitted on update, the stored value is left unchanged.
           example: false
       required:
         - provider_id
@@ -6189,20 +6191,20 @@ components:
         - cache_cost_usd
     AgentNetworkSettings:
       type: object
-      description: Per-account Agent Network gateway settings. One row per account; endpoint and proxy_address are assigned at bootstrap (POST) and immutable thereafter. Before bootstrap the account reads as the default values with empty endpoint and proxy_address.
+      description: Per-account Agent Network gateway settings. One row per account; cluster and subdomain are auto-assigned on first provider create and immutable thereafter.
       properties:
+        cluster:
+          type: string
+          description: Address of the NetBird proxy cluster fronting this account's agent-network endpoint.
+          example: "eu.proxy.netbird.io"
+        subdomain:
+          type: string
+          description: Auto-generated DNS-safe label that prefixes the cluster to form the agent-network endpoint.
+          example: "violet"
         endpoint:
           type: string
-          description: Bare hostname agents call for this account. Empty until the account is bootstrapped.
-          example: "brave-otter.eu.proxy.netbird.io"
-        proxy_address:
-          type: string
-          description: Declared cluster address of the proxy serving this account's gateway. Equal to `endpoint` when a dedicated proxy serves the account; otherwise the endpoint's immediate parent (a shared cluster the endpoint hangs one label beneath). Empty until the account is bootstrapped.
-          example: "eu.proxy.netbird.io"
-        dedicated:
-          type: boolean
-          description: Whether the account's gateway is served by a proxy dedicated to it (endpoint equals proxy_address).
-          example: false
+          description: Bare hostname agents call for this account, computed as `<subdomain>.<cluster>`.
+          example: "violet.eu.proxy.netbird.io"
         enable_log_collection:
           type: boolean
           description: Whether per-request access-log entries are collected for this account's agent-network traffic.
@@ -6222,53 +6224,27 @@ components:
         created_at:
           type: string
           format: date-time
-          description: Timestamp when the settings row was created. Absent until the account is bootstrapped.
+          description: Timestamp when the settings row was created.
           readOnly: true
           example: "2026-04-26T10:30:00Z"
         updated_at:
           type: string
           format: date-time
-          description: Timestamp when the settings row was last updated. Absent until the account is bootstrapped.
+          description: Timestamp when the settings row was last updated.
           readOnly: true
           example: "2026-04-26T10:30:00Z"
       required:
+        - cluster
+        - subdomain
         - endpoint
-        - proxy_address
-        - dedicated
         - enable_log_collection
         - enable_prompt_collection
         - redact_pii
-    AgentNetworkSettingsCreateRequest:
-      type: object
-      description: Bootstraps the per-account Agent Network settings row, assigning the account's immutable endpoint. Exactly one of `proxy_address` and `endpoint` must be provided. `proxy_address` requests a labeled endpoint — the server allocates a label and the endpoint becomes `<label>.<proxy_address>`, served by whichever proxy declares that parent address. `endpoint` claims the given hostname itself as a self-addressed (dedicated) endpoint, served only by a proxy declaring exactly that address — the claim is legitimate before the proxy exists (address-first). Collection toggles may ride along; omitted toggles take their defaults.
-      properties:
-        proxy_address:
-          type: string
-          description: Cluster address to allocate a labeled endpoint beneath. Mutually exclusive with `endpoint`.
-          example: "eu.proxy.netbird.io"
-        endpoint:
-          type: string
-          description: Hostname to claim as the account's self-addressed (dedicated) endpoint. Mutually exclusive with `proxy_address`. Rejected when another account already holds it.
-          example: "brave-otter.gateway.example.com"
-        enable_log_collection:
-          type: boolean
-          description: Whether per-request access-log entries are collected for this account's agent-network traffic. Defaults to true.
-          example: true
-        enable_prompt_collection:
-          type: boolean
-          description: Master switch for request/response prompt capture. Defaults to false.
-          example: false
-        redact_pii:
-          type: boolean
-          description: Whether captured prompts have PII redacted. Defaults to false.
-          example: false
-        access_log_retention_days:
-          type: integer
-          description: Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely. Defaults to 30.
-          example: 30
+        - created_at
+        - updated_at
     AgentNetworkSettingsRequest:
       type: object
-      description: Account-level Agent Network settings update. The request replaces every mutable field (the collection toggles and retention). The endpoint and proxy address are assigned at bootstrap (POST) and are not part of this schema.
+      description: Mutable account-level Agent Network settings. Cluster and subdomain are immutable and not accepted here.
       properties:
         enable_log_collection:
           type: boolean
@@ -13714,7 +13690,7 @@ paths:
   /api/agent-network/settings:
     get:
       summary: Retrieve Agent Network settings
-      description: Returns the per-account Agent Network gateway settings (endpoint, proxy address, collection toggles). Before the account is bootstrapped via POST, the response carries the default values with an empty endpoint and proxy address.
+      description: Returns the per-account Agent Network gateway settings (cluster, subdomain, endpoint). Returns 404 when no provider has been created yet — settings are lazily bootstrapped on first provider create.
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13730,43 +13706,13 @@ paths:
           "$ref": "#/components/responses/requires_authentication"
         '403':
           "$ref": "#/components/responses/forbidden"
-        '500':
-          "$ref": "#/components/responses/internal_error"
-    post:
-      summary: Bootstrap Agent Network settings
-      description: Creates the per-account Agent Network settings row and allocates the account's endpoint. Exactly one of `proxy_address` (labeled endpoint under that cluster; the server allocates the label) and `endpoint` (self-addressed dedicated endpoint, claimed verbatim) must be provided. The endpoint and proxy address are immutable once assigned. Returns 409 when the account already has a settings row.
-      tags: [ Agent Network ]
-      security:
-        - BearerAuth: [ ]
-        - TokenAuth: [ ]
-      requestBody:
-        description: Settings bootstrap request
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/AgentNetworkSettingsCreateRequest'
-      responses:
-        '200':
-          description: The freshly bootstrapped Agent Network settings
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/AgentNetworkSettings'
-        '400':
-          "$ref": "#/components/responses/bad_request"
-        '401':
-          "$ref": "#/components/responses/requires_authentication"
-        '403':
-          "$ref": "#/components/responses/forbidden"
-        '409':
-          "$ref": "#/components/responses/conflict"
-        '422':
-          "$ref": "#/components/responses/validation_failed"
+        '404':
+          "$ref": "#/components/responses/not_found"
         '500':
           "$ref": "#/components/responses/internal_error"
     put:
       summary: Update Agent Network settings
-      description: Updates the account-level Agent Network settings; the request replaces every mutable field (collection toggles and retention). Returns 404 when the account has no settings row yet — bootstrap it with POST first. The endpoint and proxy address are assigned at bootstrap and are not part of the update schema.
+      description: Updates the mutable account-level Agent Network settings (collection toggles). Cluster and subdomain are immutable and ignored if sent. Returns 404 when settings have not been bootstrapped (no provider created yet).
       tags: [ Agent Network ]
       security:
         - BearerAuth: [ ]
@@ -13792,8 +13738,6 @@ paths:
           "$ref": "#/components/responses/forbidden"
         '404':
           "$ref": "#/components/responses/not_found"
-        '422':
-          "$ref": "#/components/responses/validation_failed"
         '500':
           "$ref": "#/components/responses/internal_error"
   /api/agent-network/budget-rules:

shared/management/http/api/types.gen.go

@@ -2275,11 +2275,11 @@ type AgentNetworkProvider struct {
 	// Id Provider ID
 	Id string `json:"id"`
 
-	// IdentityHeaderGroups Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
-	IdentityHeaderGroups string `json:"identity_header_groups"`
+	// IdentityHeaderGroups Wire header name the proxy stamps with the caller's NetBird groups as a comma-separated list (sorted) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Same per-catalog semantics as `identity_header_user_id`.
+	IdentityHeaderGroups *string `json:"identity_header_groups,omitempty"`
 
-	// IdentityHeaderUserId Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Always present in responses; empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
-	IdentityHeaderUserId string `json:"identity_header_user_id"`
+	// IdentityHeaderUserId Wire header name the proxy stamps with the caller's display identity (user email or peer name) when the catalog entry's HeaderPair is `customizable`. Empty disables stamping for this dimension. Ignored when the catalog entry has a fixed HeaderPair (e.g. LiteLLM, Portkey). Used today by Bifrost: typical values are `x-bf-lh-netbird_user_id` (always-on log metadata) or `x-bf-dim-netbird_user_id` (Prometheus / OTEL — requires the label to be pre-declared in the gateway's `client.prometheus_labels` config).
+	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
 
 	// MetadataDisabled Whether identity metadata injection is disabled for this provider. When enabled (the default), the proxy stamps the caller's user and authorizing group onto upstream requests as provider-specific metadata (e.g. AWS Bedrock's X-Amzn-Bedrock-Request-Metadata header). Set true to suppress it.
 	MetadataDisabled bool `json:"metadata_disabled"`
@@ -2329,19 +2329,22 @@ type AgentNetworkProviderRequest struct {
 	// ApiKey Upstream provider API key. Sealed at rest on the management server and never returned in responses. Required on create; optional on update (omit to keep the existing key).
 	ApiKey *string `json:"api_key,omitempty"`
 
+	// BootstrapCluster Proxy cluster used to bootstrap the per-account agent-network endpoint when the first provider is created. Ignored on subsequent creates and on updates because the cluster is pinned on the account-level Settings row.
+	BootstrapCluster *string `json:"bootstrap_cluster,omitempty"`
+
 	// Enabled Whether the provider is enabled. Defaults to true on create.
 	Enabled *bool `json:"enabled,omitempty"`
 
-	// ExtraValues Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). The request's map replaces the stored values; empty strings drop the corresponding key.
+	// ExtraValues Operator-typed values for catalog-declared extra headers (see AgentNetworkProvider.extra_values). When present on a request, the whole map replaces the stored values. Empty strings drop the corresponding key.
 	ExtraValues *map[string]string `json:"extra_values,omitempty"`
 
-	// IdentityHeaderGroups Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same semantics as `identity_header_user_id`.
+	// IdentityHeaderGroups Wire header name for the caller's groups CSV. See AgentNetworkProvider.identity_header_groups. Same omit / empty semantics as `identity_header_user_id`.
 	IdentityHeaderGroups *string `json:"identity_header_groups,omitempty"`
 
-	// IdentityHeaderUserId Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. Empty or omitted disables stamping for this dimension.
+	// IdentityHeaderUserId Wire header name for the caller's display identity. See AgentNetworkProvider.identity_header_user_id. When omitted on a request, the stored value is left unchanged; pass an empty string explicitly to clear it (which disables stamping for this dimension).
 	IdentityHeaderUserId *string `json:"identity_header_user_id,omitempty"`
 
-	// MetadataDisabled Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected).
+	// MetadataDisabled Disable identity metadata injection (the caller's user + authorizing group) for this provider. Defaults to false (metadata is injected). When omitted on update, the stored value is left unchanged.
 	MetadataDisabled *bool `json:"metadata_disabled,omitempty"`
 
 	// Models Models exposed through this endpoint, with the operator's per-1k input/output prices. Empty means all catalog models are allowed at catalog prices.
@@ -2353,23 +2356,23 @@ type AgentNetworkProviderRequest struct {
 	// ProviderId Catalog identifier for the upstream AI provider (e.g. openai_api, anthropic_api, azure_openai_api, bedrock_api, vertex_ai_api, mistral_api, custom).
 	ProviderId string `json:"provider_id"`
 
-	// SkipTlsVerification Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false.
+	// SkipTlsVerification Skip upstream TLS certificate verification when the proxy dials this provider's URL. For self-hosted / internal gateways behind a private or self-signed certificate. Defaults to false. When omitted on update, the stored value is left unchanged.
 	SkipTlsVerification *bool `json:"skip_tls_verification,omitempty"`
 
 	// UpstreamUrl Full upstream URL (with scheme) that NetBird forwards traffic to.
 	UpstreamUrl string `json:"upstream_url"`
 }
 
-// AgentNetworkSettings Per-account Agent Network gateway settings. One row per account; endpoint and proxy_address are assigned at bootstrap (POST) and immutable thereafter. Before bootstrap the account reads as the default values with empty endpoint and proxy_address.
+// AgentNetworkSettings Per-account Agent Network gateway settings. One row per account; cluster and subdomain are auto-assigned on first provider create and immutable thereafter.
 type AgentNetworkSettings struct {
 	// AccessLogRetentionDays Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely. Usage records are retained independently.
 	AccessLogRetentionDays *int `json:"access_log_retention_days,omitempty"`
 
-	// CreatedAt Timestamp when the settings row was created. Absent until the account is bootstrapped.
-	CreatedAt *time.Time `json:"created_at,omitempty"`
+	// Cluster Address of the NetBird proxy cluster fronting this account's agent-network endpoint.
+	Cluster string `json:"cluster"`
 
-	// Dedicated Whether the account's gateway is served by a proxy dedicated to it (endpoint equals proxy_address).
-	Dedicated bool `json:"dedicated"`
+	// CreatedAt Timestamp when the settings row was created.
+	CreatedAt *time.Time `json:"created_at,omitempty"`
 
 	// EnableLogCollection Whether per-request access-log entries are collected for this account's agent-network traffic.
 	EnableLogCollection bool `json:"enable_log_collection"`
@@ -2377,41 +2380,20 @@ type AgentNetworkSettings struct {
 	// EnablePromptCollection Master switch for request/response prompt capture. Capture runs only when this is on AND a policy guardrail also enables it.
 	EnablePromptCollection bool `json:"enable_prompt_collection"`
 
-	// Endpoint Bare hostname agents call for this account. Empty until the account is bootstrapped.
+	// Endpoint Bare hostname agents call for this account, computed as `<subdomain>.<cluster>`.
 	Endpoint string `json:"endpoint"`
 
-	// ProxyAddress Declared cluster address of the proxy serving this account's gateway. Equal to `endpoint` when a dedicated proxy serves the account; otherwise the endpoint's immediate parent (a shared cluster the endpoint hangs one label beneath). Empty until the account is bootstrapped.
-	ProxyAddress string `json:"proxy_address"`
-
 	// RedactPii Whether captured prompts have PII redacted. Effective redaction is the OR of this and any policy guardrail's redact setting.
 	RedactPii bool `json:"redact_pii"`
 
-	// UpdatedAt Timestamp when the settings row was last updated. Absent until the account is bootstrapped.
+	// Subdomain Auto-generated DNS-safe label that prefixes the cluster to form the agent-network endpoint.
+	Subdomain string `json:"subdomain"`
+
+	// UpdatedAt Timestamp when the settings row was last updated.
 	UpdatedAt *time.Time `json:"updated_at,omitempty"`
 }
 
-// AgentNetworkSettingsCreateRequest Bootstraps the per-account Agent Network settings row, assigning the account's immutable endpoint. Exactly one of `proxy_address` and `endpoint` must be provided. `proxy_address` requests a labeled endpoint — the server allocates a label and the endpoint becomes `<label>.<proxy_address>`, served by whichever proxy declares that parent address. `endpoint` claims the given hostname itself as a self-addressed (dedicated) endpoint, served only by a proxy declaring exactly that address — the claim is legitimate before the proxy exists (address-first). Collection toggles may ride along; omitted toggles take their defaults.
-type AgentNetworkSettingsCreateRequest struct {
-	// AccessLogRetentionDays Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely. Defaults to 30.
-	AccessLogRetentionDays *int `json:"access_log_retention_days,omitempty"`
-
-	// EnableLogCollection Whether per-request access-log entries are collected for this account's agent-network traffic. Defaults to true.
-	EnableLogCollection *bool `json:"enable_log_collection,omitempty"`
-
-	// EnablePromptCollection Master switch for request/response prompt capture. Defaults to false.
-	EnablePromptCollection *bool `json:"enable_prompt_collection,omitempty"`
-
-	// Endpoint Hostname to claim as the account's self-addressed (dedicated) endpoint. Mutually exclusive with `proxy_address`. Rejected when another account already holds it.
-	Endpoint *string `json:"endpoint,omitempty"`
-
-	// ProxyAddress Cluster address to allocate a labeled endpoint beneath. Mutually exclusive with `endpoint`.
-	ProxyAddress *string `json:"proxy_address,omitempty"`
-
-	// RedactPii Whether captured prompts have PII redacted. Defaults to false.
-	RedactPii *bool `json:"redact_pii,omitempty"`
-}
-
-// AgentNetworkSettingsRequest Account-level Agent Network settings update. The request replaces every mutable field (the collection toggles and retention). The endpoint and proxy address are assigned at bootstrap (POST) and are not part of this schema.
+// AgentNetworkSettingsRequest Mutable account-level Agent Network settings. Cluster and subdomain are immutable and not accepted here.
 type AgentNetworkSettingsRequest struct {
 	// AccessLogRetentionDays Days to retain full access-log rows; older rows are swept. 0 or less means keep indefinitely.
 	AccessLogRetentionDays *int `json:"access_log_retention_days,omitempty"`
@@ -6191,9 +6173,6 @@ type PostApiAgentNetworkProvidersJSONRequestBody = AgentNetworkProviderRequest
 // PutApiAgentNetworkProvidersProviderIdJSONRequestBody defines body for PutApiAgentNetworkProvidersProviderId for application/json ContentType.
 type PutApiAgentNetworkProvidersProviderIdJSONRequestBody = AgentNetworkProviderRequest
 
-// PostApiAgentNetworkSettingsJSONRequestBody defines body for PostApiAgentNetworkSettings for application/json ContentType.
-type PostApiAgentNetworkSettingsJSONRequestBody = AgentNetworkSettingsCreateRequest
-
 // PutApiAgentNetworkSettingsJSONRequestBody defines body for PutApiAgentNetworkSettings for application/json ContentType.
 type PutApiAgentNetworkSettingsJSONRequestBody = AgentNetworkSettingsRequest
 

shared/relay/client/guard.go

@@ -156,11 +156,9 @@ func (g *Guard) notifyReconnected() {
 func (g *Guard) exponentTicker(ctx context.Context) *backoff.Ticker {
 	bo := backoff.WithContext(&backoff.ExponentialBackOff{
 		InitialInterval: 2 * time.Second,
-		// Spreads the reconnects of every client that lost the same relay server.
-		RandomizationFactor: backoff.DefaultRandomizationFactor,
-		Multiplier:          2,
-		MaxInterval:         g.maxBackoffInterval,
-		Clock:               backoff.SystemClock,
+		Multiplier:      2,
+		MaxInterval:     g.maxBackoffInterval,
+		Clock:           backoff.SystemClock,
 	}, ctx)
 
 	return backoff.NewTicker(bo)