[management] State the sqlite precision caveat without the review history

A comment explaining why the truncation guard sits on the type recorded how
the gap came to be noticed rather than the constraint itself, which AGENTS.md
rules out. The technical point is the one worth keeping: sqlite preserves
nanoseconds, so a sqlite-only suite cannot observe the truncation.

The neighbouring back-compatibility comment gets the same treatment — "clients
written before this existed" leans on the reader knowing what "this" was, and
naming conditional requests outright says it plainly.

.git-branches.toml

@@ -3,7 +3,7 @@
 [branches]
 main = "main"
 perennials = []
-perennial-regex = "^release-"
+perennial-regex = ""
 
 [create]
 new-branch-type = "feature"

.github/workflows/check-license-dependencies.yml

@@ -2,7 +2,7 @@ name: Check License Dependencies
 
 on:
   push:
-    branches: [main, "release-*"]
+    branches: [main]
     paths:
       - "go.mod"
       - "go.sum"

.github/workflows/frontend-ui.yml

@@ -10,7 +10,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
     paths:
       - "client/ui/frontend/**"
       - "client/ui/i18n/**"

.github/workflows/golang-test-darwin.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.github/workflows/golang-test-freebsd.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.github/workflows/golang-test-linux.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.github/workflows/golang-test-windows.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 env:

.github/workflows/install-script-test.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
     paths:
       - "release_files/install.sh"

.github/workflows/mobile-build-validation.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.github/workflows/release.yml

@@ -6,7 +6,6 @@ on:
       - "v*"
     branches:
       - main
-      - "release-*"
   pull_request:
 
 env:
@@ -255,23 +254,15 @@ jobs:
         id: tag_and_push_images
         if: |
           (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
-          (github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-')))
+          (github.event_name == 'push' && github.ref == 'refs/heads/main')
         run: |
           set -euo pipefail
 
-          # $GITHUB_REF / $GITHUB_EVENT_NAME are read from the runner
-          # environment rather than substituted into this script with the
-          # workflow expression syntax: branch names may legally contain
-          # $(…), and interpolating github.ref would execute it.
           resolve_tags() {
-            if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
+            if [[ "${{ github.event_name }}" == "pull_request" ]]; then
               echo "pr-${{ github.event.pull_request.number }}"
-            elif [[ "$GITHUB_REF" == "refs/heads/main" ]]; then
-              echo "main sha-$(git rev-parse --short HEAD)"
             else
-              # Release branches get an immutable sha-* tag only — the floating
-              # "main" tag must never move from a release branch.
-              echo "sha-$(git rev-parse --short HEAD)"
+              echo "main sha-$(git rev-parse --short HEAD)"
             fi
           }
 

.github/workflows/sync-tag.yml

@@ -9,9 +9,21 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
   cancel-in-progress: true
 
-# The receiving bump-netbird workflows expect the short tag form
-# (e.g. v0.30.0), not refs/tags/v0.30.0 — github.ref_name, not github.ref.
+# Receiving workflows (cloud sync-tag, mobile bump-netbird) expect the short
+# tag form (e.g. v0.30.0), not refs/tags/v0.30.0 — github.ref_name, not github.ref.
 jobs:
+  trigger_sync_tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger release tag sync
+        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
+        with:
+          workflow: sync-tag.yml
+          ref: main
+          repo: ${{ secrets.UPSTREAM_REPO }}
+          token: ${{ secrets.NC_GITHUB_TOKEN }}
+          inputs: '{ "tag": "${{ github.ref_name }}" }'
+
   trigger_android_bump:
     runs-on: ubuntu-latest
     if: github.event.created && !github.event.deleted && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')

.github/workflows/test-infrastructure-files.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
     paths:
       - "infrastructure_files/**"

.github/workflows/ui-translations.yml

@@ -1,42 +0,0 @@
-name: UI Translations
-
-on:
-  pull_request:
-    paths:
-      - "client/ui/i18n/locales/**"
-      - "client/ui/i18n/check-translations.mjs"
-      - ".github/workflows/ui-translations.yml"
-  push:
-    branches:
-      - main
-    paths:
-      - "client/ui/i18n/locales/**"
-      - "client/ui/i18n/check-translations.mjs"
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
-  cancel-in-progress: true
-
-jobs:
-  check-translations:
-    name: Check translation key parity
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "22"
-
-      # English (en) is the source of truth for translation keys; every other
-      # locale declared in _index.json must carry the exact same key set.
-      - name: Check translation key parity
-        run: node client/ui/i18n/check-translations.mjs

.github/workflows/wasm-build-validation.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.goreleaser.yaml

@@ -468,13 +468,6 @@ checksum:
     - glob: ./infrastructure_files/migrate-to-enterprise.sh
 
 release:
-  # The signing pipeline (netbirdio/sign-pipelines, dispatched by
-  # trigger_signer) marks the release latest once the Windows and macOS
-  # artifacts are signed. Without this override goreleaser marks it latest
-  # at publish time, while those artifacts are still unsigned.
-  make_latest: false
-  # Mark x.y.z-rc.* and other prerelease tags as prereleases on GitHub.
-  prerelease: auto
   extra_files:
     - glob: ./infrastructure_files/getting-started-with-zitadel.sh
     - glob: ./release_files/install.sh

.goreleaser_ui.yaml

@@ -144,11 +144,3 @@ uploads:
     target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
     username: dev@wiretrustee.com
     method: PUT
-
-release:
-  # Uploads into the release created by the main .goreleaser.yaml run.
-  # make_latest stays false everywhere: the signing pipeline
-  # (netbirdio/sign-pipelines) marks the release latest after the Windows
-  # and macOS artifacts are signed.
-  make_latest: false
-  prerelease: auto

.goreleaser_ui_darwin.yaml

@@ -43,11 +43,3 @@ checksum:
   name_template: "{{ .ProjectName }}_darwin_checksums.txt"
 changelog:
   disable: true
-
-release:
-  # Uploads into the release created by the main .goreleaser.yaml run.
-  # make_latest stays false everywhere: the signing pipeline
-  # (netbirdio/sign-pipelines) marks the release latest after the Windows
-  # and macOS artifacts are signed.
-  make_latest: false
-  prerelease: auto

.goreleaser_ui_gtk3.yaml

@@ -43,17 +43,19 @@ archives:
       - netbird-ui-gtk3
 
 nfpms:
-  # Mutually-exclusive alternative to the GTK4 netbird-ui package -- both
-  # ship the same /usr/bin/netbird-ui from the shared stable/yum repos, so
-  # this one carries its own name and conflicts with the GTK4 package.
+  # Same package_name as the GTK4 packages -- the two are mutually-exclusive
+  # alternatives served from separate repo paths (see uploads below); a given
+  # distro points at exactly one of them. The file names must still differ:
+  # the Debian pool is shared storage keyed by file name, so a default-named
+  # gtk3 .deb would overwrite the stable one.
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
     homepage: https://netbird.io/
     license: BSD-3-Clause
     vendor: NetBird
     id: netbird_ui_deb_gtk3
-    package_name: netbird-ui-gtk3
-    file_name_template: "{{ .PackageName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    package_name: netbird-ui
+    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
     builds:
       - netbird-ui-gtk3
     formats:
@@ -65,10 +67,6 @@ nfpms:
         dst: /usr/share/applications/org.wails.netbird.desktop
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
-    conflicts:
-      - netbird-ui
-    replaces:
-      - netbird-ui
     dependencies:
       - netbird (>= 0.75.0)
       - libgtk-3-0
@@ -81,8 +79,8 @@ nfpms:
     license: BSD-3-Clause
     vendor: NetBird
     id: netbird_ui_rpm_gtk3
-    package_name: netbird-ui-gtk3
-    file_name_template: "{{ .PackageName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    package_name: netbird-ui
+    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
     builds:
       - netbird-ui-gtk3
     formats:
@@ -94,10 +92,6 @@ nfpms:
         dst: /usr/share/applications/org.wails.netbird.desktop
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
-    # No `replaces` here: nfpm maps it to rpm Obsoletes, which would make
-    # dnf swap installed GTK4 netbird-ui packages for this one on upgrade.
-    conflicts:
-      - netbird-ui
     dependencies:
       - netbird >= 0.75.0
       - (gtk3 or libgtk-3-0)
@@ -117,28 +111,32 @@ changelog:
   disable: true
 
 uploads:
-  - name: debian
+  # The gtk3 packages reuse the netbird-ui package name, so they live in
+  # dedicated repo paths (deb distribution `gtk3`, yum path `yum-gtk3`) that
+  # legacy distros point their repo config at.
+  #
+  # GoReleaser derives the credential env var from the upload name, so these
+  # would look for UPLOAD_DEBIAN-GTK3_SECRET / UPLOAD_YUM-GTK3_SECRET. The
+  # release workflow only exports UPLOAD_DEBIAN_SECRET / UPLOAD_YUM_SECRET, and
+  # a missing secret is a silent skip rather than a failure -- the packages
+  # reached the GitHub release but never the package repositories. Point
+  # `password` at the exported vars so both uploads authenticate.
+  - name: debian-gtk3
     skip: "{{ .Env.SKIP_PUBLISH }}"
     ids:
       - netbird_ui_deb_gtk3
     mode: archive
-    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=stable;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
+    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=gtk3;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
     username: dev@wiretrustee.com
+    password: "{{ .Env.UPLOAD_DEBIAN_SECRET }}"
     method: PUT
 
-  - name: yum
+  - name: yum-gtk3
     skip: "{{ .Env.SKIP_PUBLISH }}"
     ids:
       - netbird_ui_rpm_gtk3
     mode: archive
-    target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
+    target: https://pkgs.wiretrustee.com/yum-gtk3/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
     username: dev@wiretrustee.com
+    password: "{{ .Env.UPLOAD_YUM_SECRET }}"
     method: PUT
-
-release:
-  # Uploads into the release created by the main .goreleaser.yaml run.
-  # make_latest stays false everywhere: the signing pipeline
-  # (netbirdio/sign-pipelines) marks the release latest after the Windows
-  # and macOS artifacts are signed.
-  make_latest: false
-  prerelease: auto

CONTRIBUTING.md

@@ -112,7 +112,6 @@ aligns with our security standards and design expectations.
         - [Test suite](#test-suite)
     - [Checklist before submitting a PR](#checklist-before-submitting-a-pr)
     - [When we close a PR](#when-we-close-a-pr)
-    - [Translations](#translations)
     - [Other project repositories](#other-project-repositories)
     - [Contributor License Agreement](#contributor-license-agreement)
 
@@ -613,17 +612,6 @@ A closed PR is not a rejected idea. Take it back to the
 [discussion](https://github.com/netbirdio/netbird/discussions), settle the
 approach, and reopen the work from there.
 
-## Translations
-
-Desktop UI translations are not contributed through pull requests. Translate on
-[Crowdin](https://crowdin.com/project/netbird) instead: no ticket needed, just
-join the project and pick your language. Crowdin syncs with this repository and
-opens the service PRs itself, so hand-edited locale files would conflict with
-the next sync. Style, terminology, and review guidance live in
-[client/ui/i18n/TRANSLATING.md](client/ui/i18n/TRANSLATING.md). To request a
-language the project does not offer yet, ask on the Crowdin project page or in
-a [discussion](https://github.com/netbirdio/netbird/discussions).
-
 ## Other project repositories
 
 NetBird project is composed of 3 main repositories:

client/anonymize/anonymize.go

@@ -305,12 +305,6 @@ func (a *Anonymizer) AnonymizeDomain(domain string) string {
 		return domain
 	}
 
-	// A reverse zone names an address prefix, so it follows the address rules,
-	// which also keeps its digit labels intact.
-	if zone, ok := a.anonymizeReverseZone(baseDomain); ok {
-		return withTrailingDot(zone, hasDot)
-	}
-
 	if suffix := protectedSuffix(baseDomain); suffix != "" {
 		if a.level < LevelStrict || baseDomain == suffix || suffix == infraDomain {
 			return domain
@@ -411,10 +405,6 @@ func (a *Anonymizer) AnonymizeString(str string) string {
 	ipv4Regex := regexp.MustCompile(`\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b`)
 	ipv6Regex := regexp.MustCompile(`\b([0-9a-fA-F:]+:+[0-9a-fA-F]{0,4})(?:%[0-9a-zA-Z]+)?(?:\/[0-9]{1,3})?(?::[0-9]{1,5})?\b`)
 
-	// Reverse zones go first and are then held out of the passes below: their
-	// labels are digits, which the address patterns would otherwise consume.
-	str, restoreZones := a.replaceReverseZones(str)
-
 	str = ipv4Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 	str = ipv6Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 
@@ -435,7 +425,7 @@ func (a *Anonymizer) AnonymizeString(str string) string {
 		str = wgKeyRegex.ReplaceAllStringFunc(str, a.AnonymizeWGKey)
 	}
 
-	return restoreZones(str)
+	return str
 }
 
 // sortedDomains returns the domain mappings longest-first, so a full-FQDN

client/anonymize/reverse_zone.go

@@ -1,174 +0,0 @@
-package anonymize
-
-import (
-	"encoding/hex"
-	"net/netip"
-	"regexp"
-	"strconv"
-	"strings"
-)
-
-const (
-	reverseZoneSuffixV4 = ".in-addr.arpa"
-	reverseZoneSuffixV6 = ".ip6.arpa"
-
-	v6Nibbles = 32
-	v4Octets  = 4
-)
-
-// reverseZoneRegexes match a reverse zone or a full reverse name in free text.
-// They are applied before the address passes of AnonymizeString, whose IPv4
-// pattern would otherwise consume the digit labels of a zone and replace parts
-// of it with unrelated addresses.
-var reverseZoneRegexes = []*regexp.Regexp{
-	regexp.MustCompile(`(?:[0-9]{1,3}\.){1,4}in-addr\.arpa\b`),
-	regexp.MustCompile(`(?:[0-9a-fA-F]\.){1,32}ip6\.arpa\b`),
-}
-
-// anonymizeReverseZone maps a reverse zone to the zone of the anonymized form
-// of the prefix it encodes, so it follows the address rules rather than the
-// domain ones: the zone of an address that is preserved is preserved too, and
-// the zone of one that is replaced names the replacement. This keeps a reverse
-// zone recognizable as such, and consistent with the addresses it belongs to
-// elsewhere in the same output. It reports false for anything that is not a
-// reverse zone.
-func (a *Anonymizer) anonymizeReverseZone(domain string) (string, bool) {
-	prefix, labelCount, suffix, ok := parseReverseZone(domain)
-	if !ok {
-		return "", false
-	}
-
-	anonymized := a.AnonymizeIP(prefix)
-	if anonymized == prefix {
-		return domain, true
-	}
-
-	return reverseZoneName(anonymized, labelCount) + suffix, true
-}
-
-// replaceReverseZones anonymizes every reverse zone in str and swaps each one
-// for a placeholder, returning a function that puts the anonymized zones back.
-// The placeholders carry no dots, digits or colons, so no later pass matches
-// them.
-func (a *Anonymizer) replaceReverseZones(str string) (string, func(string) string) {
-	var zones []string
-
-	for _, re := range reverseZoneRegexes {
-		str = re.ReplaceAllStringFunc(str, func(match string) string {
-			zone, ok := a.anonymizeReverseZone(match)
-			if !ok {
-				return match
-			}
-
-			zones = append(zones, zone)
-			return reverseZonePlaceholder(len(zones) - 1)
-		})
-	}
-
-	if len(zones) == 0 {
-		return str, func(s string) string { return s }
-	}
-
-	return str, func(s string) string {
-		for i, zone := range zones {
-			s = strings.ReplaceAll(s, reverseZonePlaceholder(i), zone)
-		}
-		return s
-	}
-}
-
-func reverseZonePlaceholder(index int) string {
-	return "\x00reversezone" + strconv.Itoa(index) + "\x00"
-}
-
-// parseReverseZone turns a reverse zone into the address of the prefix its
-// labels spell backwards, padding the absent low-order part with zeroes, and
-// returns the label count and zone suffix so the name can be rebuilt.
-func parseReverseZone(domain string) (netip.Addr, int, string, bool) {
-	lower := strings.ToLower(domain)
-
-	switch {
-	case strings.HasSuffix(lower, reverseZoneSuffixV4):
-		labels := strings.Split(strings.TrimSuffix(lower, reverseZoneSuffixV4), ".")
-		addr, ok := reverseZoneAddrV4(labels)
-		return addr, len(labels), reverseZoneSuffixV4, ok
-	case strings.HasSuffix(lower, reverseZoneSuffixV6):
-		labels := strings.Split(strings.TrimSuffix(lower, reverseZoneSuffixV6), ".")
-		addr, ok := reverseZoneAddrV6(labels)
-		return addr, len(labels), reverseZoneSuffixV6, ok
-	default:
-		return netip.Addr{}, 0, "", false
-	}
-}
-
-func reverseZoneAddrV4(labels []string) (netip.Addr, bool) {
-	if len(labels) == 0 || len(labels) > v4Octets {
-		return netip.Addr{}, false
-	}
-
-	var octets [v4Octets]byte
-	for i, label := range labels {
-		octet, err := strconv.ParseUint(label, 10, 8)
-		if err != nil {
-			return netip.Addr{}, false
-		}
-		octets[len(labels)-1-i] = byte(octet)
-	}
-
-	return netip.AddrFrom4(octets), true
-}
-
-func reverseZoneAddrV6(labels []string) (netip.Addr, bool) {
-	if len(labels) == 0 || len(labels) > v6Nibbles {
-		return netip.Addr{}, false
-	}
-
-	nibbles := make([]byte, 0, v6Nibbles)
-	for i := len(labels) - 1; i >= 0; i-- {
-		if len(labels[i]) != 1 || !isHexDigit(labels[i][0]) {
-			return netip.Addr{}, false
-		}
-		nibbles = append(nibbles, labels[i][0])
-	}
-	for len(nibbles) < v6Nibbles {
-		nibbles = append(nibbles, '0')
-	}
-
-	var groups []string
-	for i := 0; i < len(nibbles); i += 4 {
-		groups = append(groups, string(nibbles[i:i+4]))
-	}
-
-	addr, err := netip.ParseAddr(strings.Join(groups, ":"))
-	if err != nil {
-		return netip.Addr{}, false
-	}
-
-	return addr, true
-}
-
-// reverseZoneName spells the first labelCount labels of addr backwards, the
-// inverse of parseReverseZone, without the zone suffix.
-func reverseZoneName(addr netip.Addr, labelCount int) string {
-	labels := make([]string, 0, labelCount)
-
-	if addr.Is4() {
-		octets := addr.As4()
-		for i := labelCount - 1; i >= 0; i-- {
-			labels = append(labels, strconv.Itoa(int(octets[i])))
-		}
-		return strings.Join(labels, ".")
-	}
-
-	address := addr.As16()
-	nibbles := hex.EncodeToString(address[:])
-	for i := labelCount - 1; i >= 0; i-- {
-		labels = append(labels, string(nibbles[i]))
-	}
-
-	return strings.Join(labels, ".")
-}
-
-func isHexDigit(c byte) bool {
-	return c >= '0' && c <= '9' || c >= 'a' && c <= 'f' || c >= 'A' && c <= 'F'
-}

client/anonymize/reverse_zone_test.go

@@ -1,171 +0,0 @@
-package anonymize
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func newLeveledAnonymizer(level Level) *Anonymizer {
-	a := NewAnonymizer(DefaultAddresses())
-	a.SetLevel(level)
-	return a
-}
-
-// TestAnonymizeDomainReverseZone covers reverse zones going through the address
-// rules instead of the domain ones, so a zone stays a zone and an address that
-// is preserved keeps the zone that names it.
-func TestAnonymizeDomainReverseZone(t *testing.T) {
-	// 100.64.0.0/10 is the overlay range, which is CGNAT: preserved at the
-	// default level and replaced from the internal pool at the strict one
-	const overlayZone = "64.100.in-addr.arpa"
-
-	t.Run("overlay zone preserved at the default level", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-		assert.Equal(t, overlayZone, a.AnonymizeDomain(overlayZone), "should keep the zone of a preserved address")
-	})
-
-	t.Run("private zone preserved at the default level", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-		assert.Equal(t, "168.192.in-addr.arpa", a.AnonymizeDomain("168.192.in-addr.arpa"), "should keep the zone of a private address")
-	})
-
-	t.Run("overlay zone replaced at the strict level", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelStrict)
-
-		got := a.AnonymizeDomain(overlayZone)
-		require.True(t, strings.HasSuffix(got, reverseZoneSuffixV4), "should stay a reverse zone, got %q", got)
-		assert.NotEqual(t, overlayZone, got, "should replace the encoded prefix")
-		assert.Len(t, strings.Split(strings.TrimSuffix(got, reverseZoneSuffixV4), "."), 2,
-			"should keep the label count, got %q", got)
-	})
-
-	t.Run("public zone replaced at the default level", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		got := a.AnonymizeDomain("113.0.203.in-addr.arpa")
-		require.True(t, strings.HasSuffix(got, reverseZoneSuffixV4), "should stay a reverse zone, got %q", got)
-		assert.NotEqual(t, "113.0.203.in-addr.arpa", got, "should replace a public prefix")
-	})
-
-	t.Run("zone of an address keeps that address mapping", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		anonymizedAddr := a.AnonymizeIPString("203.0.113.7")
-		got := a.AnonymizeDomain("7.113.0.203.in-addr.arpa")
-
-		octets := strings.Split(anonymizedAddr, ".")
-		want := octets[3] + "." + octets[2] + "." + octets[1] + "." + octets[0] + reverseZoneSuffixV4
-		assert.Equal(t, want, got, "should name the same replacement as the address itself")
-	})
-
-	t.Run("ipv6 nibble labels stay single digits", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		zone := "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0" + reverseZoneSuffixV6
-		got := a.AnonymizeDomain(zone)
-
-		require.True(t, strings.HasSuffix(got, reverseZoneSuffixV6), "should stay a reverse zone, got %q", got)
-		labels := strings.Split(strings.TrimSuffix(got, reverseZoneSuffixV6), ".")
-		assert.Len(t, labels, 28, "should keep every nibble label, got %q", got)
-		for _, label := range labels {
-			assert.Len(t, label, 1, "nibble label %q should stay a single digit", label)
-		}
-	})
-
-	t.Run("trailing dot is kept", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-		assert.Equal(t, "64.100.in-addr.arpa.", a.AnonymizeDomain("64.100.in-addr.arpa."), "should keep the trailing dot")
-	})
-
-	t.Run("a domain that only looks like a zone is anonymized as a domain", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		got := a.AnonymizeDomain("not-a-zone.in-addr.arpa")
-		assert.NotContains(t, got, "in-addr.arpa", "should fall back to domain anonymization")
-	})
-}
-
-// TestAnonymizeStringReverseZone verifies that a zone inside free text, such as
-// a DNS log line, is not chewed up by the address passes. The IPv4 pattern
-// matches any run of dotted digits, which a reverse zone is made of.
-func TestAnonymizeStringReverseZone(t *testing.T) {
-	t.Run("ipv6 zone survives the address passes", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		zone := "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0" + reverseZoneSuffixV6
-		got := a.AnonymizeString("question: domain=" + zone + " type=PTR")
-
-		assert.Contains(t, got, "type=PTR", "should keep the rest of the line")
-		assert.NotContains(t, got, "198.51.100", "should not rewrite nibble labels as an address")
-
-		labels := strings.Split(strings.TrimSuffix(strings.TrimPrefix(got, "question: domain="), reverseZoneSuffixV6+" type=PTR"), ".")
-		assert.Len(t, labels, 28, "should keep every nibble label, got %q", got)
-	})
-
-	t.Run("preserved ipv4 zone is untouched", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		line := "reverse zone 64.100.in-addr.arpa registered"
-		assert.Equal(t, line, a.AnonymizeString(line), "should keep the zone of a preserved address")
-	})
-
-	t.Run("public ipv4 zone is replaced consistently", func(t *testing.T) {
-		a := newLeveledAnonymizer(LevelDefault)
-
-		got := a.AnonymizeString("zone 113.0.203.in-addr.arpa and address 203.0.113.7")
-		assert.NotContains(t, got, "113.0.203.in-addr.arpa", "should replace the zone")
-		assert.NotContains(t, got, "203.0.113.7", "should replace the address")
-		assert.Contains(t, got, reverseZoneSuffixV4, "should keep the zone suffix")
-	})
-}
-
-func TestParseReverseZone(t *testing.T) {
-	tests := []struct {
-		name   string
-		zone   string
-		addr   string
-		labels int
-	}{
-		{name: "v4 two labels", zone: "0.100" + reverseZoneSuffixV4, addr: "100.0.0.0", labels: 2},
-		{name: "v4 three labels", zone: "1.168.192" + reverseZoneSuffixV4, addr: "192.168.1.0", labels: 3},
-		{name: "v4 full address", zone: "7.113.0.203" + reverseZoneSuffixV4, addr: "203.0.113.7", labels: 4},
-		{
-			name:   "v6 prefix",
-			zone:   "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.0.0" + reverseZoneSuffixV6,
-			addr:   "2::",
-			labels: 28,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			addr, labels, suffix, ok := parseReverseZone(tc.zone)
-			require.True(t, ok, "should decode the reverse zone")
-			assert.Equal(t, tc.addr, addr.String(), "should decode to the encoded prefix")
-			assert.Equal(t, tc.labels, labels, "should count the labels")
-			assert.Equal(t, tc.zone, reverseZoneName(addr, labels)+suffix, "should re-encode to the original zone")
-		})
-	}
-}
-
-func TestParseReverseZoneRejectsNonZones(t *testing.T) {
-	tests := []string{
-		"example.com",
-		"in-addr.arpa",
-		"x.100" + reverseZoneSuffixV4,
-		"256" + reverseZoneSuffixV4,
-		"1.2.3.4.5" + reverseZoneSuffixV4,
-		"ab" + reverseZoneSuffixV6,
-		"g" + reverseZoneSuffixV6,
-	}
-
-	for _, zone := range tests {
-		t.Run(zone, func(t *testing.T) {
-			_, _, _, ok := parseReverseZone(zone)
-			assert.False(t, ok, "should reject %q", zone)
-		})
-	}
-}

client/cmd/login.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"os/user"
+	"runtime"
 	"strings"
 
 	log "github.com/sirupsen/logrus"
@@ -120,7 +121,7 @@ func doDaemonLogin(ctx context.Context, cmd *cobra.Command, providedSetupKey str
 	loginRequest := proto.LoginRequest{
 		SetupKey:            providedSetupKey,
 		ManagementUrl:       managementURL,
-		IsUnixDesktopClient: util.HasGraphicalSession(),
+		IsUnixDesktopClient: isUnixRunningDesktop(),
 		Hostname:            hostName,
 		DnsLabels:           dnsLabelsReq,
 		ProfileName:         &handle,
@@ -188,8 +189,7 @@ func doExtendSession(ctx context.Context, cmd *cobra.Command) error {
 
 	client := proto.NewDaemonServiceClient(conn)
 
-	// the CLI runs in the user's session, the daemon does not: tell it what we can see
-	req := &proto.RequestExtendAuthSessionRequest{HasGraphicalSession: util.HasGraphicalSession()}
+	req := &proto.RequestExtendAuthSessionRequest{}
 	// Pre-fill the IdP login hint from the active profile so the user
 	// doesn't have to retype their email. Best-effort: we still proceed
 	// without a hint if the lookup fails.
@@ -408,7 +408,7 @@ func foregroundGetTokenInfo(ctx context.Context, cmd *cobra.Command, config *pro
 		hint = profileState.Email
 	}
 
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, util.HasGraphicalSession(), false, hint)
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isUnixRunningDesktop(), false, hint)
 	if err != nil {
 		return nil, err
 	}
@@ -458,6 +458,14 @@ func openURL(cmd *cobra.Command, verificationURIComplete, userCode string, noBro
 	}
 }
 
+// isUnixRunningDesktop checks if a Linux OS is running desktop environment
+func isUnixRunningDesktop() bool {
+	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
+		return false
+	}
+	return os.Getenv("DESKTOP_SESSION") != "" || os.Getenv("XDG_CURRENT_DESKTOP") != ""
+}
+
 func setEnvAndFlags(cmd *cobra.Command) error {
 	SetFlagsFromEnvVars(rootCmd)
 

client/cmd/up.go

@@ -21,8 +21,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
+	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -626,7 +626,7 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 		NatExternalIPs:      natExternalIPs,
 		CleanNATExternalIPs: natExternalIPs != nil && len(natExternalIPs) == 0,
 		CustomDNSAddress:    customDNSAddressConverted,
-		IsUnixDesktopClient: util.HasGraphicalSession(),
+		IsUnixDesktopClient: isUnixRunningDesktop(),
 		Hostname:            hostName,
 		ExtraIFaceBlacklist: extraIFaceBlackList,
 		DnsLabels:           dnsLabels,

client/firewall/iptables/acl_linux.go

@@ -42,7 +42,6 @@ type aclManager struct {
 	optionalEntries map[string][]entry
 	ipsetStore      *ipsetStore
 	v6              bool
-	ipsetSupported  bool
 
 	stateManager *statemanager.Manager
 }
@@ -61,8 +60,6 @@ func newAclManager(iptablesClient *iptables.IPTables, wgIface iFaceMapper) (*acl
 func (m *aclManager) init(stateManager *statemanager.Manager) error {
 	m.stateManager = stateManager
 
-	m.ipsetSupported = m.probeIPSetSupport()
-
 	m.seedInitialEntries()
 	m.seedInitialOptionalEntries()
 
@@ -94,12 +91,6 @@ func (m *aclManager) AddPeerFiltering(
 	if m.v6 && ipsetName != "" {
 		ipsetName += "-v6"
 	}
-	// When the kernel lacks the required ipset hash module, fall back to
-	// per-IP iptables rules (pre-0.68 behavior) so ACLs keep working instead
-	// of silently leaving the chain empty.
-	if ipsetName != "" && !m.ipsetSupported {
-		ipsetName = ""
-	}
 	proto := protoForFamily(protocol, m.v6)
 	specs := filterRuleSpecs(ip, proto, sPort, dPort, action, ipsetName)
 
@@ -507,40 +498,6 @@ func transformIPsetName(ipsetName string, sPort, dPort *firewall.Port, action fi
 	}
 }
 
-// probeIPSetSupport checks whether the kernel can create the ipset type used for
-// ACL rules. On kernels lacking the required ipset hash module, ipset creation
-// fails (e.g. "invalid argument"), which would otherwise leave the ACL chain
-// empty and silently drop all policy-permitted inbound traffic. When unsupported,
-// the manager falls back to per-IP iptables rules.
-func (m *aclManager) probeIPSetSupport() bool {
-	// Use a unique name so concurrent processes don't collide and we only ever
-	// destroy the set we created ourselves. ipset names are limited to 31 chars,
-	// so use a short random suffix.
-	probeName := "nb-probe-" + uuid.New().String()[:8]
-
-	opts := ipset.CreateOptions{
-		Replace: true,
-	}
-	if m.v6 {
-		opts.Family = ipset.FamilyIPV6
-	}
-
-	if err := ipset.Create(probeName, ipset.TypeHashNet, opts); err != nil {
-		log.Warnf("ipset is not available (failed to create probe set: %v); "+
-			"falling back to per-IP iptables ACL rules. Ensure the kernel provides "+
-			"the ipset hash:net module (ip_set_hash_net) for better performance with large rule sets", err)
-		return false
-	}
-
-	defer func() {
-		if err := ipset.Destroy(probeName); err != nil {
-			log.Debugf("destroy ipset probe set %q: %v", probeName, err)
-		}
-	}()
-
-	return true
-}
-
 func (m *aclManager) createIPSet(name string) error {
 	opts := ipset.CreateOptions{
 		Replace: true,

client/firewall/iptables/dnat_refcount_linux_test.go

@@ -1,240 +0,0 @@
-//go:build privileged
-
-package iptables
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-func iptRefcountIfaceV4() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("10.20.0.1"),
-				Network: netip.MustParsePrefix("10.20.0.0/24"),
-			}
-		},
-	}
-}
-
-func iptRefcountIfaceDual() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("10.20.0.1"),
-				Network: netip.MustParsePrefix("10.20.0.0/24"),
-				IPv6:    netip.MustParseAddr("fd00::1"),
-				IPv6Net: netip.MustParsePrefix("fd00::/64"),
-			}
-		},
-	}
-}
-
-func newIptRefcountManager(t *testing.T, dual bool) *Manager {
-	t.Helper()
-	var ifMock *iFaceMock
-	if dual {
-		ifMock = iptRefcountIfaceDual()
-	} else {
-		ifMock = iptRefcountIfaceV4()
-	}
-	m, err := Create(ifMock, iface.DefaultMTU)
-	require.NoError(t, err, "create manager")
-	require.NoError(t, m.Init(nil), "init manager")
-	t.Cleanup(func() {
-		require.NoError(t, m.Close(nil), "close manager")
-	})
-	return m
-}
-
-func iptDnatV4(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("10.20.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-func iptDnatV6(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-// TestIptablesRouting_RepeatedEnableSingleReference verifies that EnableRouting
-// (called on every network-map update) holds at most one reference per family
-// and a single DisableRouting drops both back to zero.
-func TestIptablesRouting_RepeatedEnableSingleReference(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	require.NoError(t, m.EnableRouting(), "first enable")
-	require.NoError(t, m.EnableRouting(), "second enable")
-	require.NoError(t, m.EnableRouting(), "third enable")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "repeated enable holds a single v4 reference")
-	assert.Equal(t, 1, v6, "repeated enable holds a single v6 reference")
-
-	require.NoError(t, m.DisableRouting(), "disable")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "single disable releases the v4 reference")
-	assert.Equal(t, 0, v6, "single disable releases the v6 reference")
-}
-
-// TestIptablesRouting_DisableKeepsDNATReference verifies that an unpaired
-// DisableRouting does not release references held by active DNAT rules.
-func TestIptablesRouting_DisableKeepsDNATReference(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9095))
-	require.NoError(t, err, "add v6 dnat")
-
-	require.NoError(t, m.DisableRouting(), "unpaired disable")
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6, "DNAT-held reference survives unpaired DisableRouting")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "delete releases the DNAT reference")
-}
-
-// TestIptablesDNAT_RefcountBalancedV4 covers a Balanced Add/Delete pair on v4.
-func TestIptablesDNAT_RefcountBalancedV4(t *testing.T) {
-	m := newIptRefcountManager(t, false)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV4(7081))
-	require.NoError(t, err, "add v4 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	r2, err := m.AddDNATRule(iptDnatV4(7082))
-	require.NoError(t, err, "add v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 2, v4, "v4 refcount after second add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r2))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount after second delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-}
-
-// TestIptablesDNAT_RefcountBalancedV6 checks the v6 path increments v6 only and
-// decrements back to zero.
-func TestIptablesDNAT_RefcountBalancedV6(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	require.NotNil(t, m.router6, "v6 router")
-	require.Same(t, m.router.ipFwdState, m.router6.ipFwdState, "shared state")
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9081))
-	require.NoError(t, err, "add v6 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 1, v6, "v6 refcount after first add")
-
-	r2, err := m.AddDNATRule(iptDnatV6(9082))
-	require.NoError(t, err, "add v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 2, v6, "v6 refcount after second add")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first delete")
-
-	require.NoError(t, m.DeleteDNATRule(r2))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount after second delete")
-}
-
-// TestIptablesDNAT_DuplicateAddNoLeak verifies the duplicate-rule path returns
-// without bumping the refcount.
-func TestIptablesDNAT_DuplicateAddNoLeak(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	rule := iptDnatV4(7083)
-	r1, err := m.AddDNATRule(rule)
-	require.NoError(t, err)
-	v4, _ := state.Counts()
-	assert.Equal(t, 1, v4)
-
-	_, err = m.AddDNATRule(rule)
-	require.NoError(t, err, "duplicate add")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "duplicate add must not increment")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, _ = state.Counts()
-	assert.Equal(t, 0, v4, "single delete must drop to zero")
-}
-
-// TestIptablesDNAT_DeleteMissingNoUnderflow verifies Delete on an unknown rule
-// neither errors nor releases the refcount.
-func TestIptablesDNAT_DeleteMissingNoUnderflow(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	phantom := iptDnatV4(7099)
-	require.NoError(t, m.DeleteDNATRule(&phantom), "delete missing v4")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6)
-
-	phantom6 := iptDnatV6(9099)
-	require.NoError(t, m.DeleteDNATRule(&phantom6), "delete missing v6")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6)
-
-	r1, err := m.AddDNATRule(iptDnatV4(7100))
-	require.NoError(t, err)
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "real add still increments after phantom delete")
-	require.NoError(t, m.DeleteDNATRule(r1))
-}
-
-// TestIptablesDNAT_DoubleDeleteNoUnderflow verifies a second Delete on the same
-// rule is a no-op.
-func TestIptablesDNAT_DoubleDeleteNoUnderflow(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9083))
-	require.NoError(t, err)
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "first delete")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "second delete must be no-op")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "double delete must not underflow")
-}

client/firewall/iptables/manager_linux.go

@@ -89,7 +89,7 @@ func (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {
 	}
 
 	// Share the same IP forwarding state with the v4 router, since
-	// Forwarding refcounter is per-family but shared between v4 and v6 routers.
+	// EnableIPForwarding controls both v4 and v6 sysctls.
 	m.router6.ipFwdState = m.router.ipFwdState
 
 	m.aclMgr6, err = newAclManager(ip6Client, wgIface)
@@ -402,12 +402,17 @@ func (m *Manager) SetLogLevel(log.Level) {
 }
 
 func (m *Manager) EnableRouting() error {
-	// v6 only when the overlay actually has v6.
-	return m.router.ipFwdState.RequestRouting(m.router6 != nil)
+	if err := m.router.ipFwdState.RequestForwarding(); err != nil {
+		return fmt.Errorf("enable IP forwarding: %w", err)
+	}
+	return nil
 }
 
 func (m *Manager) DisableRouting() error {
-	return m.router.ipFwdState.ReleaseRouting()
+	if err := m.router.ipFwdState.ReleaseForwarding(); err != nil {
+		return fmt.Errorf("disable IP forwarding: %w", err)
+	}
+	return nil
 }
 
 // AddDNATRule adds a DNAT rule

client/firewall/iptables/manager_linux_test.go

@@ -291,40 +291,3 @@ func TestIptablesCreatePerformance(t *testing.T) {
 		})
 	}
 }
-
-// TestIptablesACLIPSetFallback verifies that when the kernel lacks ipset support,
-// the ACL manager falls back to per-IP iptables rules (-s <ip>) instead of
-// silently leaving the chain empty. See discussion #6125.
-func TestIptablesACLIPSetFallback(t *testing.T) {
-	ipv4Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
-	require.NoError(t, err)
-
-	// Use Create()/Init() so the router-owned chains (chainRTFWDIN/OUT) are
-	// created before the ACL manager's createDefaultChains() references them.
-	manager, err := Create(ifaceMock, iface.DefaultMTU)
-	require.NoError(t, err)
-	require.NoError(t, manager.Init(nil))
-
-	aclMgr := manager.aclMgr
-	// Simulate a kernel without the ipset hash module.
-	aclMgr.ipsetSupported = false
-
-	defer func() {
-		require.NoError(t, manager.Close(nil))
-	}()
-
-	ip := netip.MustParseAddr("10.20.0.42")
-	port := &fw.Port{Values: []uint16{22}}
-
-	rules, err := aclMgr.AddPeerFiltering(nil, ip.AsSlice(), "tcp", nil, port, fw.ActionAccept, "nb0000001")
-	require.NoError(t, err, "AddPeerFiltering should succeed via fallback")
-	require.NotEmpty(t, rules)
-
-	rule := rules[0].(*Rule)
-	require.Empty(t, rule.ipsetName, "fallback rule must not reference an ipset")
-	require.Contains(t, strings.Join(rule.specs, " "), "-s 10.20.0.42", "fallback rule must match by source IP")
-	require.NotContains(t, strings.Join(rule.specs, " "), "--match-set", "fallback rule must not use ipset matching")
-
-	// The rule must actually be present in the ACL chain (not silently dropped).
-	checkRuleSpecs(t, ipv4Client, rule.chain, true, rule.specs...)
-}

client/firewall/iptables/router_linux.go

@@ -102,7 +102,7 @@ func newRouter(iptablesClient *iptables.IPTables, wgIface iFaceMapper, mtu uint1
 		wgIface:        wgIface,
 		mtu:            mtu,
 		v6:             iptablesClient.Proto() == iptables.ProtocolIPv6,
-		ipFwdState:     ipfwdstate.NewIPForwardingState(wgIface.Name()),
+		ipFwdState:     ipfwdstate.NewIPForwardingState(),
 	}
 
 	r.ipsetCounter = refcounter.New(
@@ -770,6 +770,10 @@ func (r *router) updateState() {
 }
 
 func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
+	if err := r.ipFwdState.RequestForwarding(); err != nil {
+		return nil, err
+	}
+
 	ruleKey := rule.ID()
 	if _, exists := r.rules[ruleKey+dnatSuffix]; exists {
 		return rule, nil
@@ -836,34 +840,18 @@ func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
 
 	for key, ruleInfo := range rules {
 		if err := r.iptablesClient.Append(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
-			r.cleanupFailedDNATAdd(rules)
+			if rollbackErr := r.rollbackRules(rules); rollbackErr != nil {
+				log.Errorf("rollback failed: %v", rollbackErr)
+			}
 			return nil, fmt.Errorf("add rule %s: %w", key, err)
 		}
 		r.rules[key] = ruleInfo.rule
 	}
 
-	if err := r.ipFwdState.RequestForwarding(r.v6); err != nil {
-		r.cleanupFailedDNATAdd(rules)
-		return nil, fmt.Errorf("enable forwarding: %w", err)
-	}
-
 	r.updateState()
 	return rule, nil
 }
 
-// cleanupFailedDNATAdd removes the bookkeeping written by a partially applied
-// AddDNATRule before rolling back the kernel rules, so no entries remain that
-// never got a forwarding refcount. rollbackRules re-adds entries it failed to
-// remove from the kernel.
-func (r *router) cleanupFailedDNATAdd(rules map[string]ruleInfo) {
-	for key := range rules {
-		delete(r.rules, key)
-	}
-	if err := r.rollbackRules(rules); err != nil {
-		log.Errorf("rollback failed: %v", err)
-	}
-}
-
 func (r *router) rollbackRules(rules map[string]ruleInfo) error {
 	var merr *multierror.Error
 	for key, ruleInfo := range rules {
@@ -880,47 +868,32 @@ func (r *router) rollbackRules(rules map[string]ruleInfo) error {
 }
 
 func (r *router) DeleteDNATRule(rule firewall.Rule) error {
-	ruleKey := rule.ID()
-
-	_, hadDNAT := r.rules[ruleKey+dnatSuffix]
-	_, hadSNAT := r.rules[ruleKey+snatSuffix]
-	_, hadFWD := r.rules[ruleKey+fwdSuffix]
-	if !hadDNAT && !hadSNAT && !hadFWD {
-		return nil
+	if err := r.ipFwdState.ReleaseForwarding(); err != nil {
+		log.Errorf("%v", err)
 	}
 
+	ruleKey := rule.ID()
+
 	var merr *multierror.Error
 	if dnatRule, exists := r.rules[ruleKey+dnatSuffix]; exists {
 		if err := r.iptablesClient.Delete(tableNat, chainRTRDR, dnatRule...); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("delete DNAT rule: %w", err))
-		} else {
-			delete(r.rules, ruleKey+dnatSuffix)
 		}
+		delete(r.rules, ruleKey+dnatSuffix)
 	}
 
 	if snatRule, exists := r.rules[ruleKey+snatSuffix]; exists {
 		if err := r.iptablesClient.Delete(tableNat, chainRTNAT, snatRule...); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("delete SNAT rule: %w", err))
-		} else {
-			delete(r.rules, ruleKey+snatSuffix)
 		}
+		delete(r.rules, ruleKey+snatSuffix)
 	}
 
 	if fwdRule, exists := r.rules[ruleKey+fwdSuffix]; exists {
 		if err := r.iptablesClient.Delete(tableFilter, chainRTFWDOUT, fwdRule...); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("delete forward rule: %w", err))
-		} else {
-			delete(r.rules, ruleKey+fwdSuffix)
-		}
-	}
-
-	// Release the refcount only once all rules are gone from the kernel. On
-	// partial failure the failed entries stay in r.rules so a retry can remove
-	// them and release then.
-	if merr == nil {
-		if err := r.ipFwdState.ReleaseForwarding(r.v6); err != nil {
-			log.Errorf("%v", err)
 		}
+		delete(r.rules, ruleKey+fwdSuffix)
 	}
 
 	r.updateState()

client/firewall/nftables/dnat_refcount_linux_test.go

@@ -1,249 +0,0 @@
-//go:build privileged
-
-package nftables
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-func nftRefcountIfaceV4() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("100.96.0.1"),
-				Network: netip.MustParsePrefix("100.96.0.0/16"),
-			}
-		},
-	}
-}
-
-func nftRefcountIfaceDual() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("100.96.0.1"),
-				Network: netip.MustParsePrefix("100.96.0.0/16"),
-				IPv6:    netip.MustParseAddr("fd00::1"),
-				IPv6Net: netip.MustParsePrefix("fd00::/64"),
-			}
-		},
-	}
-}
-
-func newNftRefcountManager(t *testing.T, dual bool) *Manager {
-	t.Helper()
-	if check() != NFTABLES {
-		t.Skip("nftables not supported on this system")
-	}
-	var ifMock *iFaceMock
-	if dual {
-		ifMock = nftRefcountIfaceDual()
-	} else {
-		ifMock = nftRefcountIfaceV4()
-	}
-	m, err := Create(ifMock, iface.DefaultMTU)
-	require.NoError(t, err, "create manager")
-	require.NoError(t, m.Init(nil), "init manager")
-	t.Cleanup(func() {
-		require.NoError(t, m.Close(nil), "close manager")
-	})
-	return m
-}
-
-func dnatV4(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("100.96.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-func dnatV6(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-// TestNftablesDNAT_RefcountBalancedV4 verifies that Add/Delete pairs leave the
-// v4 refcount at zero.
-func TestNftablesDNAT_RefcountBalancedV4(t *testing.T) {
-	m := newNftRefcountManager(t, false)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV4(8081))
-	require.NoError(t, err, "add v4 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	r2, err := m.AddDNATRule(dnatV4(8082))
-	require.NoError(t, err, "add v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 2, v4, "v4 refcount after second add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v4 dnat 1")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r2), "delete v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount after second delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-}
-
-// TestNftablesDNAT_RefcountBalancedV6 verifies the v6 path increments v6 only
-// and decrements back to zero on Delete.
-func TestNftablesDNAT_RefcountBalancedV6(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	require.NotNil(t, m.router6, "v6 router")
-	require.Same(t, m.router.ipFwdState, m.router6.ipFwdState, "shared state")
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9091))
-	require.NoError(t, err, "add v6 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first add")
-
-	r2, err := m.AddDNATRule(dnatV6(9092))
-	require.NoError(t, err, "add v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 2, v6, "v6 refcount after second add")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat 1")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first delete")
-
-	require.NoError(t, m.DeleteDNATRule(r2), "delete v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount after second delete")
-}
-
-// TestNftablesDNAT_DuplicateAddNoLeak verifies that a duplicate Add (same
-// ForwardRule) does not double-increment the refcount.
-func TestNftablesDNAT_DuplicateAddNoLeak(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	rule := dnatV4(8083)
-	r1, err := m.AddDNATRule(rule)
-	require.NoError(t, err, "add v4 dnat")
-	v4, _ := state.Counts()
-	assert.Equal(t, 1, v4)
-
-	// duplicate add: same rule ID, must be a no-op for the refcount.
-	_, err = m.AddDNATRule(rule)
-	require.NoError(t, err, "duplicate add")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "duplicate add must not increment")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v4 dnat")
-	v4, _ = state.Counts()
-	assert.Equal(t, 0, v4, "single delete must drop to zero")
-}
-
-// TestNftablesDNAT_DeleteMissingNoUnderflow verifies deleting a rule that was
-// never added does not underflow the refcount.
-func TestNftablesDNAT_DeleteMissingNoUnderflow(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	// Construct a Rule reference for something never added. The router stores
-	// rules by ID(), and DeleteDNATRule looks them up in r.rules; a missing
-	// entry must be a no-op rather than calling Release.
-	phantom := dnatV4(8099)
-	require.NoError(t, m.DeleteDNATRule(&phantom), "delete missing v4 dnat")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unaffected by missing delete")
-	assert.Equal(t, 0, v6, "v6 refcount unaffected")
-
-	phantom6 := dnatV6(9099)
-	require.NoError(t, m.DeleteDNATRule(&phantom6), "delete missing v6 dnat")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount unaffected by missing delete")
-
-	// And after a phantom delete, a real add still results in count=1.
-	r1, err := m.AddDNATRule(dnatV4(8100))
-	require.NoError(t, err, "add v4 dnat after phantom delete")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "real add still increments after phantom delete")
-	require.NoError(t, m.DeleteDNATRule(r1))
-}
-
-// TestNftablesRouting_RepeatedEnableSingleReference verifies that EnableRouting
-// (called on every network-map update) holds at most one reference per family
-// and a single DisableRouting drops both back to zero.
-func TestNftablesRouting_RepeatedEnableSingleReference(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	require.NoError(t, m.EnableRouting(), "first enable")
-	require.NoError(t, m.EnableRouting(), "second enable")
-	require.NoError(t, m.EnableRouting(), "third enable")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "repeated enable holds a single v4 reference")
-	assert.Equal(t, 1, v6, "repeated enable holds a single v6 reference")
-
-	require.NoError(t, m.DisableRouting(), "disable")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "single disable releases the v4 reference")
-	assert.Equal(t, 0, v6, "single disable releases the v6 reference")
-}
-
-// TestNftablesRouting_DisableKeepsDNATReference verifies that an unpaired
-// DisableRouting does not release references held by active DNAT rules.
-func TestNftablesRouting_DisableKeepsDNATReference(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9095))
-	require.NoError(t, err, "add v6 dnat")
-
-	require.NoError(t, m.DisableRouting(), "unpaired disable")
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6, "DNAT-held reference survives unpaired DisableRouting")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "delete releases the DNAT reference")
-}
-
-// TestNftablesDNAT_DoubleDeleteNoUnderflow verifies that deleting the same rule
-// twice does not underflow the refcount (the second delete is a no-op).
-func TestNftablesDNAT_DoubleDeleteNoUnderflow(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9093))
-	require.NoError(t, err)
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "first delete")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "second delete must be no-op")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "double delete must not underflow")
-}

client/firewall/nftables/manager_linux.go

@@ -105,8 +105,8 @@ func (m *Manager) createIPv6Components(tableName string, wgIface iFaceMapper, mt
 		return fmt.Errorf("create v6 router: %w", err)
 	}
 
-	// Share the per-family forwarding refcounter with the v4 router so a v4
-	// rule and a v6 rule against the same state machine cooperate cleanly.
+	// Share the same IP forwarding state with the v4 router, since
+	// EnableIPForwarding controls both v4 and v6 sysctls.
 	m.router6.ipFwdState = m.router.ipFwdState
 
 	m.aclManager6, err = newAclManager(workTable6, wgIface, chainNameRoutingFw)
@@ -530,12 +530,17 @@ func (m *Manager) SetLogLevel(log.Level) {
 }
 
 func (m *Manager) EnableRouting() error {
-	// v6 only when the overlay actually has v6.
-	return m.router.ipFwdState.RequestRouting(m.router6 != nil)
+	if err := m.router.ipFwdState.RequestForwarding(); err != nil {
+		return fmt.Errorf("enable IP forwarding: %w", err)
+	}
+	return nil
 }
 
 func (m *Manager) DisableRouting() error {
-	return m.router.ipFwdState.ReleaseRouting()
+	if err := m.router.ipFwdState.ReleaseForwarding(); err != nil {
+		return fmt.Errorf("disable IP forwarding: %w", err)
+	}
+	return nil
 }
 
 // Flush rule/chain/set operations from the buffer

client/firewall/nftables/router_linux.go

@@ -93,7 +93,7 @@ func newRouter(workTable *nftables.Table, wgIface iFaceMapper, mtu uint16) (*rou
 		rules:      make(map[string]*nftables.Rule),
 		af:         familyForAddr(workTable.Family == nftables.TableFamilyIPv4),
 		wgIface:    wgIface,
-		ipFwdState: ipfwdstate.NewIPForwardingState(wgIface.Name()),
+		ipFwdState: ipfwdstate.NewIPForwardingState(),
 		mtu:        mtu,
 	}
 
@@ -1553,6 +1553,10 @@ func (r *router) refreshRulesMap() error {
 }
 
 func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
+	if err := r.ipFwdState.RequestForwarding(); err != nil {
+		return nil, err
+	}
+
 	ruleKey := rule.ID()
 	if _, exists := r.rules[ruleKey+dnatSuffix]; exists {
 		return rule, nil
@@ -1563,18 +1567,7 @@ func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
 		return nil, fmt.Errorf("convert protocol to number: %w", err)
 	}
 
-	// Request forwarding before queueing rules: addDnatRedirect/addDnatMasq
-	// buffer netlink messages on r.conn that the next caller's Flush would
-	// commit if we returned without flushing them ourselves.
-	v6 := r.af.tableFamily == nftables.TableFamilyIPv6
-	if err := r.ipFwdState.RequestForwarding(v6); err != nil {
-		return nil, fmt.Errorf("enable forwarding: %w", err)
-	}
-
 	if err := r.addDnatRedirect(rule, protoNum, ruleKey); err != nil {
-		if rerr := r.ipFwdState.ReleaseForwarding(v6); rerr != nil {
-			log.Warnf("rollback forwarding refcount: %v", rerr)
-		}
 		return nil, err
 	}
 
@@ -1586,11 +1579,6 @@ func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
 	// TODO: find chains with drop policies and add rules there
 
 	if err := r.conn.Flush(); err != nil {
-		if rerr := r.ipFwdState.ReleaseForwarding(v6); rerr != nil {
-			log.Warnf("rollback forwarding refcount: %v", rerr)
-		}
-		delete(r.rules, ruleKey+dnatSuffix)
-		delete(r.rules, ruleKey+snatSuffix)
 		return nil, fmt.Errorf("flush rules: %w", err)
 	}
 
@@ -1793,18 +1781,16 @@ func (r *router) addDnatMasq(rule firewall.ForwardRule, protoNum uint8, ruleKey
 }
 
 func (r *router) DeleteDNATRule(rule firewall.Rule) error {
+	if err := r.ipFwdState.ReleaseForwarding(); err != nil {
+		log.Errorf("%v", err)
+	}
+
 	ruleKey := rule.ID()
 
 	if err := r.refreshRulesMap(); err != nil {
 		return fmt.Errorf(refreshRulesMapError, err)
 	}
 
-	_, hadDNAT := r.rules[ruleKey+dnatSuffix]
-	_, hadSNAT := r.rules[ruleKey+snatSuffix]
-	if !hadDNAT && !hadSNAT {
-		return nil
-	}
-
 	var merr *multierror.Error
 	var needsFlush bool
 
@@ -1836,16 +1822,9 @@ func (r *router) DeleteDNATRule(rule firewall.Rule) error {
 		}
 	}
 
-	// Release the refcount only once the rules are gone from the kernel. On
-	// failure (including the refreshRulesMap error above) the rules and their
-	// map entries remain, keeping forwarding on until a retry removes them.
 	if merr == nil {
 		delete(r.rules, ruleKey+dnatSuffix)
 		delete(r.rules, ruleKey+snatSuffix)
-
-		if err := r.ipFwdState.ReleaseForwarding(r.af.tableFamily == nftables.TableFamilyIPv6); err != nil {
-			log.Errorf("%v", err)
-		}
 	}
 
 	return nberrors.FormatErrorOrNil(merr)

client/installer.nsis

@@ -22,6 +22,8 @@
 !define UI_REG_APP_PATH "Software\Microsoft\Windows\CurrentVersion\App Paths\${UI_APP_EXE}"
 !define UI_UNINSTALL_PATH "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UI_APP_NAME}"
 
+!define AUTOSTART_REG_KEY "Software\Microsoft\Windows\CurrentVersion\Run"
+
 !define NETBIRD_DATA_DIR "$COMMONPROGRAMDATA\Netbird"
 
 Unicode True
@@ -226,6 +228,13 @@ WriteRegStr ${REG_ROOT} "${UNINSTALL_PATH}"  "Publisher" "${COMP_NAME}"
 
 WriteRegStr ${REG_ROOT} "${UI_REG_APP_PATH}" "" "$INSTDIR\${UI_APP_EXE}"
 
+; Autostart is owned by the UI's per-user setting (HKCU\...\Run via Wails),
+; not the installer. Drop the machine-wide entry older installers wrote so the
+; toggle is the single source of truth. HKCU is left untouched -- it may hold
+; the user's own toggle state, which must survive upgrades.
+DetailPrint "Removing installer-managed autostart registry entry if present..."
+DeleteRegValue HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}"
+
 EnVar::SetHKLM
 EnVar::AddValueEx "path" "$INSTDIR"
 
@@ -290,6 +299,15 @@ ExecWait '"$INSTDIR\${MAIN_APP_EXE}" service uninstall'
 DetailPrint "Terminating Netbird UI process..."
 ExecWait `taskkill /im ${UI_APP_EXE}.exe /f`
 
+; Remove autostart registry entries
+DetailPrint "Removing autostart registry entries if they exist..."
+; Legacy machine-wide entry written by older installers.
+DeleteRegValue HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}"
+; Per-user entry the UI toggle writes via Wails (value name is the lowercase
+; app-name slug). Uninstall removes the app, so drop it too.
+DeleteRegValue HKCU "${AUTOSTART_REG_KEY}" "${APP_NAME}"
+DeleteRegValue HKCU "${AUTOSTART_REG_KEY}" "netbird"
+
 ; Handle data deletion based on checkbox
 DetailPrint "Checking if user requested data deletion..."
 ${If} $DeleteDataEnabled == "1"

client/internal/debug/debug.go

@@ -51,7 +51,6 @@ nftables.txt: Anonymized nftables rules with packet counters across all families
 sysctls.txt: Forwarding, reverse-path filter, source-validation, and conntrack accounting sysctl values that the NetBird client may read or modify, if --system-info flag was provided (Linux only).
 resolv.conf: DNS resolver configuration from /etc/resolv.conf (Unix systems only), if --system-info flag was provided.
 scutil_dns.txt: DNS configuration from scutil --dns (macOS only), if --system-info flag was provided.
-dns_windows.txt: Anonymized NRPT rules and policy table in effect, DNS client policy, and per-interface and per-adapter DNS configuration (Windows only), if --system-info flag was provided.
 resolved_domains.txt: Anonymized resolved domain IP addresses from the status recorder.
 config.txt: Anonymized configuration information of the NetBird client.
 network_map.json: Anonymized sync response containing peer configurations, routes, DNS settings, and firewall rules.
@@ -238,13 +237,6 @@ scutil_dns.txt (macOS only):
 - Shows DNS configuration for all network interfaces
 - Includes search domains, nameservers, and DNS resolver settings
 - All IP addresses and domain names are anonymized
-
-dns_windows.txt (Windows only):
-- Lists the NRPT rules of both policy stores, the local one and the group policy one, marking the rules the client created
-- Follows them with the policy table the resolver has loaded, which differs from the rules while a change has not been picked up yet
-- Includes the DNS client group policy, the global TCP/IP and Dnscache parameters, and the DNS values of every interface that has any
-- Ends with the resolver configuration in effect per adapter, from GetAdaptersAddresses
-- All IP addresses and domain names are anonymized
 `
 
 const (

client/internal/debug/debug_linux.go

@@ -844,10 +844,6 @@ func collectSysctls() string {
 		[]string{"net.ipv4.conf.all.src_valid_mark", "net.ipv4.conf.default.src_valid_mark"},
 		listInterfaceSysctls("ipv4", "src_valid_mark")...,
 	))
-	writeSysctlGroup(&builder, "accept_ra", append(
-		[]string{"net.ipv6.conf.all.accept_ra", "net.ipv6.conf.default.accept_ra"},
-		listInterfaceSysctls("ipv6", "accept_ra")...,
-	))
 	writeSysctlGroup(&builder, "conntrack", []string{
 		"net.netfilter.nf_conntrack_acct",
 		"net.netfilter.nf_conntrack_tcp_loose",

client/internal/debug/debug_nonunix.go

@@ -1,4 +1,4 @@
-//go:build !unix && !windows
+//go:build !unix
 
 package debug
 

client/internal/debug/debug_windows.go

@@ -1,443 +0,0 @@
-//go:build windows
-
-package debug
-
-import (
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"net/netip"
-	"strings"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-	"golang.org/x/sys/windows/registry"
-
-	nbdns "github.com/netbirdio/netbird/client/internal/dns"
-)
-
-const dnsInfoFileName = "dns_windows.txt"
-
-const (
-	gpoDNSClientRoot = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient`
-	tcpipParamsPath  = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters`
-	dnscacheParams   = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters`
-)
-
-// interfaceDNSValues are the per-interface values that decide how a name is
-// resolved and registered. Everything the DNS host manager writes is in here,
-// so a bundle shows both what we set and what it replaced.
-var interfaceDNSValues = []string{
-	"NameServer",
-	"DhcpNameServer",
-	"Domain",
-	"DhcpDomain",
-	"SearchList",
-	"RegistrationEnabled",
-	"DisableDynamicUpdate",
-	"MaxNumberOfAddressesToRegister",
-	"EnableDHCP",
-}
-
-// addDNSInfo collects and adds DNS configuration information to the archive
-func (g *BundleGenerator) addDNSInfo() error {
-	if err := g.addFileToZip(strings.NewReader(g.collectDNSInfo()), dnsInfoFileName); err != nil {
-		return fmt.Errorf("add DNS info to zip: %w", err)
-	}
-
-	return nil
-}
-
-// collectDNSInfo renders the report. Everything below it reaches the platform
-// through COM and through lazily resolved procedures, which panic when a
-// procedure is missing rather than returning an error, and a debug bundle is not
-// allowed to take the daemon down. The panic is contained here, and whatever was
-// collected before it is kept and reported with it.
-func (g *BundleGenerator) collectDNSInfo() (content string) {
-	var sb strings.Builder
-
-	defer func() {
-		if r := recover(); r != nil {
-			log.Errorf("collecting Windows DNS configuration panicked: %v", r)
-			fmt.Fprintf(&sb, "\nerror: collection stopped: %v\n", r)
-		}
-		content = sb.String()
-	}()
-
-	sb.WriteString("Windows DNS configuration\n")
-	sb.WriteString("=========================\n")
-
-	adapters, adaptersErr := adapterAddresses()
-
-	g.writeNRPTRules(&sb, "NRPT rules, local policy store", nbdns.DNSPolicyConfigRoot)
-	g.writeNRPTRules(&sb, "NRPT rules, group policy store", nbdns.GPODNSPolicyConfigRoot)
-	g.writeEffectiveNRPTPolicies(&sb)
-	g.writeRegistryKey(&sb, "DNS client group policy", gpoDNSClientRoot)
-	g.writeRegistryKey(&sb, "Global TCP/IP parameters", tcpipParamsPath)
-	g.writeRegistryKey(&sb, "Dnscache parameters", dnscacheParams)
-	g.writeInterfaceDNS(&sb, "Per-interface DNS, IPv4", nbdns.InterfaceConfigPath, adapterNames(adapters))
-	g.writeInterfaceDNS(&sb, "Per-interface DNS, IPv6", nbdns.InterfaceConfigPathV6, adapterNames(adapters))
-	g.writeAdapterDNS(&sb, adapters, adaptersErr)
-
-	return sb.String()
-}
-
-// writeNRPTRules lists every rule in a policy store, ours and any other
-// product's, since a foreign rule for the same namespace decides resolution
-// just as ours does. Rules the client wrote are marked.
-func (g *BundleGenerator) writeNRPTRules(sb *strings.Builder, title, root string) {
-	writeSection(sb, title, root)
-
-	names, err := subKeyNames(root)
-	if err != nil {
-		fmt.Fprintf(sb, "error: %v\n", err)
-		return
-	}
-
-	if len(names) == 0 {
-		sb.WriteString("no rules\n")
-		return
-	}
-
-	for _, name := range names {
-		owner := ""
-		if strings.HasPrefix(strings.ToLower(name), strings.ToLower(nbdns.NRPTKeyPrefix)) {
-			owner = "  (netbird)"
-		}
-		fmt.Fprintf(sb, "%s%s\n", name, owner)
-		g.writeValues(sb, root+`\`+name, nil, "  ")
-	}
-}
-
-// writeEffectiveNRPTPolicies reports the table the resolver answers from, which
-// the registry cannot show: a rule is written before it is loaded, and it keeps
-// being enforced after its key is gone until the resolver reloads its policy.
-func (g *BundleGenerator) writeEffectiveNRPTPolicies(sb *strings.Builder) {
-	writeSection(sb, "NRPT policy table in effect", nrptPolicyClass+"."+nrptPolicyMethod+" in "+nrptPolicyNamespace)
-
-	entries, err := effectiveNRPTPolicies()
-	if err != nil {
-		fmt.Fprintf(sb, "error: %v\n", err)
-		return
-	}
-
-	if len(entries) == 0 {
-		sb.WriteString("no policies\n")
-		return
-	}
-
-	for _, entry := range entries {
-		fmt.Fprintf(sb, "%s\n", g.anonymizeValue("Namespace", entry.namespace))
-		for _, value := range entry.values {
-			fmt.Fprintf(sb, "  %s: %s\n", value.name, g.anonymizeValue(value.name, value.value))
-		}
-	}
-}
-
-// writeInterfaceDNS reports the DNS values of every interface that has any, so
-// the netbird interface can be compared against the physical ones. The registry
-// keys the values by GUID, so each is named from the adapter list; a GUID with
-// no adapter is a leftover key of an interface that no longer exists.
-func (g *BundleGenerator) writeInterfaceDNS(sb *strings.Builder, title, root string, names map[string]string) {
-	writeSection(sb, title, root)
-
-	guids, err := subKeyNames(root)
-	if err != nil {
-		fmt.Fprintf(sb, "error: %v\n", err)
-		return
-	}
-
-	var reported int
-	for _, guid := range guids {
-		var iface strings.Builder
-		g.writeValues(&iface, root+`\`+guid, interfaceDNSValues, "  ")
-		if iface.Len() == 0 {
-			continue
-		}
-
-		name, ok := names[strings.ToLower(guid)]
-		if !ok {
-			name = "no adapter with this GUID"
-		}
-
-		reported++
-		fmt.Fprintf(sb, "%s (%s)\n%s", guid, name, iface.String())
-	}
-
-	if reported == 0 {
-		sb.WriteString("no interface holds DNS values\n")
-	}
-}
-
-// writeRegistryKey reports the values of a single key, without its subkeys.
-func (g *BundleGenerator) writeRegistryKey(sb *strings.Builder, title, path string) {
-	writeSection(sb, title, path)
-
-	var values strings.Builder
-	g.writeValues(&values, path, nil, "")
-	if values.Len() == 0 {
-		sb.WriteString("no values\n")
-		return
-	}
-
-	sb.WriteString(values.String())
-}
-
-// writeValues renders the values of a key. A nil names list reports every
-// value, otherwise only those named and present.
-func (g *BundleGenerator) writeValues(sb *strings.Builder, path string, names []string, indent string) {
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, path, registry.QUERY_VALUE)
-	switch {
-	case errors.Is(err, registry.ErrNotExist), errors.Is(err, windows.ERROR_PATH_NOT_FOUND):
-		// an absent key is the normal state for the GPO store and for
-		// interfaces without DNS settings
-		log.Debugf("HKEY_LOCAL_MACHINE\\%s does not exist", path)
-		return
-	case err != nil:
-		fmt.Fprintf(sb, "%serror: open HKEY_LOCAL_MACHINE\\%s: %v\n", indent, path, err)
-		return
-	}
-	defer closeKey(k)
-
-	if names == nil {
-		names, err = k.ReadValueNames(-1)
-		if err != nil {
-			fmt.Fprintf(sb, "%serror: read value names: %v\n", indent, err)
-			return
-		}
-	}
-
-	for _, name := range names {
-		value, err := readRegistryValue(k, name)
-		switch {
-		case errors.Is(err, registry.ErrNotExist):
-			// the caller asks for a fixed set of values, most of which a
-			// given interface does not carry
-			continue
-		case err != nil:
-			// report rather than omit: a value that is there but cannot be
-			// read reads as unset otherwise
-			fmt.Fprintf(sb, "%s%s: error: %v\n", indent, name, err)
-			continue
-		}
-
-		fmt.Fprintf(sb, "%s%s: %s\n", indent, name, g.anonymizeValue(name, value))
-	}
-}
-
-// anonymizeValue redacts a registry value according to what its name says it
-// holds. Domains and addresses are handled per entry rather than by the string
-// pass: the pass only replaces domains something else in the bundle already
-// seeded, and its address regex would eat the digit labels of a reverse zone.
-func (g *BundleGenerator) anonymizeValue(name, value string) string {
-	if !g.anonymize || value == "" {
-		return value
-	}
-
-	switch {
-	case holdsDomains(name):
-		return joinValueEntries(splitValueEntries(value), g.anonymizeDomain)
-	case holdsAddresses(name):
-		return joinValueEntries(splitValueEntries(value), g.anonymizer.AnonymizeIPString)
-	default:
-		return g.anonymizer.AnonymizeString(value)
-	}
-}
-
-// holdsDomains reports whether a value name holds domains: the domain list of
-// an NRPT rule (Name) or of the policy table (Namespace), a search list, the
-// DNS suffix values of the TCP/IP and policy keys, which all end in "Domain"
-// (Domain, DhcpDomain, NV Domain, ICSDomain), and a proxy host name.
-func holdsDomains(name string) bool {
-	lower := strings.ToLower(name)
-	return lower == "name" || lower == "namespace" || lower == "searchlist" ||
-		strings.HasSuffix(lower, "domain") || strings.HasSuffix(lower, "proxyname")
-}
-
-// holdsAddresses reports whether a value name holds DNS server addresses
-// (NameServer, DhcpNameServer, GenericDNSServers, NameServers).
-func holdsAddresses(name string) bool {
-	lower := strings.ToLower(name)
-	return strings.Contains(lower, "nameserver") || strings.Contains(lower, "dnsserver")
-}
-
-// adapterNames maps adapter GUIDs, as the registry keys the interfaces, to the
-// names an operator sees.
-func adapterNames(adapters []*windows.IpAdapterAddresses) map[string]string {
-	names := make(map[string]string, len(adapters))
-	for _, adapter := range adapters {
-		guid := windows.BytePtrToString(adapter.AdapterName)
-		names[strings.ToLower(guid)] = windows.UTF16PtrToString(adapter.FriendlyName)
-	}
-	return names
-}
-
-// writeAdapterDNS reports the resolver configuration in effect per adapter,
-// which is what the resolver uses for a name no NRPT rule matches.
-func (g *BundleGenerator) writeAdapterDNS(sb *strings.Builder, adapters []*windows.IpAdapterAddresses, err error) {
-	writeSection(sb, "Adapter DNS configuration", "GetAdaptersAddresses")
-
-	if err != nil {
-		fmt.Fprintf(sb, "error: %v\n", err)
-		return
-	}
-
-	for _, adapter := range adapters {
-		name := windows.UTF16PtrToString(adapter.FriendlyName)
-		suffix := g.anonymizeDomain(windows.UTF16PtrToString(adapter.DnsSuffix))
-
-		fmt.Fprintf(sb, "%s (index %d, oper status %d)\n", name, adapter.IfIndex, adapter.OperStatus)
-		fmt.Fprintf(sb, "  DNS suffix: %s\n", suffix)
-
-		var servers []string
-		for server := adapter.FirstDnsServerAddress; server != nil; server = server.Next {
-			addr, ok := netip.AddrFromSlice(server.Address.IP())
-			if !ok {
-				continue
-			}
-
-			addr = addr.Unmap()
-			if g.anonymize {
-				addr = g.anonymizer.AnonymizeIP(addr)
-			}
-			servers = append(servers, addr.String())
-		}
-
-		fmt.Fprintf(sb, "  DNS servers: %s\n", strings.Join(servers, ", "))
-	}
-}
-
-// anonymizeDomain anonymizes a single domain, keeping the leading dot an NRPT
-// match domain carries.
-func (g *BundleGenerator) anonymizeDomain(entry string) string {
-	if !g.anonymize {
-		return entry
-	}
-
-	domain, dot := strings.CutPrefix(entry, ".")
-	if domain == "" {
-		return entry
-	}
-
-	anonymized := g.anonymizer.AnonymizeDomain(domain)
-	if dot {
-		anonymized = "." + anonymized
-	}
-	return anonymized
-}
-
-// splitValueEntries splits a registry value that holds a list. The separator
-// differs per value: a REG_MULTI_SZ arrives joined with ", ", a SearchList is
-// comma separated and a NameServer may use commas or spaces.
-func splitValueEntries(value string) []string {
-	return strings.FieldsFunc(value, func(r rune) bool {
-		return r == ',' || r == ';' || r == ' ' || r == '\t'
-	})
-}
-
-func joinValueEntries(entries []string, anonymize func(string) string) string {
-	for i, entry := range entries {
-		entries[i] = anonymize(entry)
-	}
-	return strings.Join(entries, ", ")
-}
-
-func writeSection(sb *strings.Builder, title, source string) {
-	fmt.Fprintf(sb, "\n%s\n%s\n%s\n", title, strings.Repeat("-", len(title)), source)
-}
-
-func subKeyNames(root string) ([]string, error) {
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, root, registry.ENUMERATE_SUB_KEYS)
-	if err != nil {
-		return nil, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", root, err)
-	}
-	defer closeKey(k)
-
-	names, err := k.ReadSubKeyNames(-1)
-	if err != nil {
-		return nil, fmt.Errorf("read subkey names: %w", err)
-	}
-
-	return names, nil
-}
-
-// readRegistryValue renders a value as text regardless of its type, so an
-// unexpected type in a policy key still shows up instead of being dropped.
-func readRegistryValue(k registry.Key, name string) (string, error) {
-	_, valueType, err := k.GetValue(name, nil)
-	if err != nil {
-		return "", fmt.Errorf("get value %s: %w", name, err)
-	}
-
-	switch valueType {
-	case registry.SZ, registry.EXPAND_SZ:
-		value, _, err := k.GetStringValue(name)
-		if err != nil {
-			return "", fmt.Errorf("get string value %s: %w", name, err)
-		}
-		return value, nil
-	case registry.MULTI_SZ:
-		values, _, err := k.GetStringsValue(name)
-		if err != nil {
-			return "", fmt.Errorf("get strings value %s: %w", name, err)
-		}
-		return strings.Join(values, ", "), nil
-	case registry.DWORD, registry.QWORD:
-		value, _, err := k.GetIntegerValue(name)
-		if err != nil {
-			return "", fmt.Errorf("get integer value %s: %w", name, err)
-		}
-		return fmt.Sprintf("%d (0x%x)", value, value), nil
-	case registry.BINARY:
-		value, _, err := k.GetBinaryValue(name)
-		if err != nil {
-			return "", fmt.Errorf("get binary value %s: %w", name, err)
-		}
-		return hex.EncodeToString(value), nil
-	default:
-		return fmt.Sprintf("<unhandled registry type %d>", valueType), nil
-	}
-}
-
-// adapterAddresses returns the adapter list including DNS servers. The call
-// reports the size it needs, so grow the buffer and retry until it fits.
-func adapterAddresses() (adapters []*windows.IpAdapterAddresses, err error) {
-	// GetAdaptersAddresses is resolved on first use and panics when it is
-	// missing, so this reports it as an error and leaves the rest of the
-	// report intact.
-	defer func() {
-		if r := recover(); r != nil {
-			adapters, err = nil, fmt.Errorf("GetAdaptersAddresses: %v", r)
-		}
-	}()
-
-	const flags = windows.GAA_FLAG_SKIP_ANYCAST | windows.GAA_FLAG_SKIP_MULTICAST
-
-	size := uint32(15000)
-	for range 3 {
-		buf := make([]byte, size)
-		first := (*windows.IpAdapterAddresses)(unsafe.Pointer(&buf[0]))
-
-		err := windows.GetAdaptersAddresses(windows.AF_UNSPEC, flags, 0, first, &size)
-		if errors.Is(err, windows.ERROR_BUFFER_OVERFLOW) {
-			continue
-		}
-		if err != nil {
-			return nil, fmt.Errorf("GetAdaptersAddresses: %w", err)
-		}
-
-		for adapter := first; adapter != nil; adapter = adapter.Next {
-			adapters = append(adapters, adapter)
-		}
-		return adapters, nil
-	}
-
-	return nil, fmt.Errorf("GetAdaptersAddresses: buffer kept growing")
-}
-
-func closeKey(k registry.Key) {
-	if err := k.Close(); err != nil {
-		log.Debugf("close registry key: %v", err)
-	}
-}

client/internal/debug/debug_windows_test.go

@@ -1,146 +0,0 @@
-//go:build windows
-
-package debug
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/anonymize"
-)
-
-func newDNSValueGenerator(level anonymize.Level) *BundleGenerator {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(level)
-
-	return &BundleGenerator{
-		anonymize:      true,
-		anonymizeLevel: level,
-		anonymizer:     anonymizer,
-	}
-}
-
-// TestAnonymizeValueByName covers the value kinds of the DNS registry keys. The
-// names decide the treatment, because the string pass alone replaces only
-// domains another part of the bundle already seeded.
-func TestAnonymizeValueByName(t *testing.T) {
-	tests := []struct {
-		name      string
-		valueName string
-		value     string
-		assert    func(t *testing.T, got string)
-	}{
-		{
-			name:      "NRPT match domains keep the leading dot",
-			valueName: "Name",
-			value:     ".internal.example.com, .corp.example.org",
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				for _, entry := range strings.Split(got, ", ") {
-					assert.True(t, strings.HasPrefix(entry, "."), "entry %q should keep its leading dot", entry)
-					assert.NotContains(t, entry, "example", "entry %q should not keep the original domain", entry)
-				}
-			},
-		},
-		{
-			name:      "any value name ending in Domain is treated as a domain",
-			valueName: "ICSDomain",
-			value:     "mshome.net",
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				assert.NotContains(t, got, "mshome", "should anonymize a domain suffix value")
-			},
-		},
-		{
-			name:      "search list is a comma separated domain list",
-			valueName: "SearchList",
-			value:     "corp.example.com,branch.example.com",
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				assert.NotContains(t, got, "example", "should anonymize every search domain")
-				assert.Len(t, strings.Split(got, ", "), 2, "should keep both search domains")
-			},
-		},
-		{
-			name:      "name servers are anonymized as addresses",
-			valueName: "DhcpNameServer",
-			value:     "203.0.113.10 8.8.8.8",
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				assert.NotContains(t, got, "203.0.113.10", "should anonymize a public resolver address")
-				// well-known resolvers stay readable at every level
-				assert.Contains(t, got, "8.8.8.8", "should keep a well-known resolver address")
-			},
-		},
-		{
-			name:      "opaque values are left to the string pass",
-			valueName: "DataBasePath",
-			value:     `%SystemRoot%\System32\drivers\etc`,
-			assert: func(t *testing.T, got string) {
-				t.Helper()
-				assert.Equal(t, `%SystemRoot%\System32\drivers\etc`, got, "should not alter a path")
-			},
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			g := newDNSValueGenerator(anonymize.LevelDefault)
-			tc.assert(t, g.anonymizeValue(tc.valueName, tc.value))
-		})
-	}
-}
-
-// TestParseNRPTPolicyTable parses the MOF text of the policy table out
-// parameters, as the provider on a client with one NRPT rule renders it.
-func TestParseNRPTPolicyTable(t *testing.T) {
-	const text = `[abstract]
-class __PARAMETERS
-{
-	[Out, EmbeddedInstance("DnsClientPolicyConfiguration"): ToSubClass, ID(2): DisableOverride ToInstance] DnsClientPolicyConfiguration cmdletOutput[] = {
-instance of DnsClientPolicyConfiguration
-{
-	DirectAccessProxyType = "NoProxy";
-	DirectAccessQueryIPsecRequired = FALSE;
-	NameEncoding = "Utf8WithoutMapping";
-	Namespace = ".0.100.in-addr.arpa";
-}, 
-instance of DnsClientPolicyConfiguration
-{
-	DirectAccessProxyType = "NoProxy";
-	NameEncoding = "Utf8WithoutMapping";
-	NameServers = {"100.0.255.254", "100.0.255.253"};
-	Namespace = ".nb.internal";
-}};
-	[in] boolean Effective;
-	[out] uint32 ReturnValue = 0;
-};
-`
-
-	entries := parseNRPTPolicyTable(text)
-	require.Len(t, entries, 2, "should parse both embedded instances")
-
-	assert.Equal(t, ".0.100.in-addr.arpa", entries[0].namespace, "should read the namespace of the first instance")
-	assert.Equal(t, ".nb.internal", entries[1].namespace, "should read the namespace of the second instance")
-
-	assert.Equal(t, []registryValue{
-		{name: "DirectAccessProxyType", value: "NoProxy"},
-		{name: "DirectAccessQueryIPsecRequired", value: "FALSE"},
-		{name: "NameEncoding", value: "Utf8WithoutMapping"},
-	}, entries[0].values, "should keep the remaining values in order")
-
-	assert.Contains(t, entries[1].values, registryValue{name: "NameServers", value: "100.0.255.254, 100.0.255.253"},
-		"should flatten a MOF array")
-
-	for _, value := range entries[1].values {
-		assert.NotContains(t, value.name, "ReturnValue", "should not read the class level parameters as values")
-	}
-}
-
-func TestParseNRPTPolicyTableEmpty(t *testing.T) {
-	assert.Empty(t, parseNRPTPolicyTable(""), "should parse no entries from empty text")
-	assert.Empty(t, parseNRPTPolicyTable("class __PARAMETERS\n{\n};\n"), "should parse no entries from a table with no instances")
-}

client/internal/debug/nrpt_windows.go

@@ -1,317 +0,0 @@
-//go:build windows
-
-package debug
-
-import (
-	"errors"
-	"fmt"
-	"runtime"
-	"strings"
-	"time"
-
-	"github.com/go-ole/go-ole"
-	"github.com/go-ole/go-ole/oleutil"
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	// The NRPT policy table is reachable through the CIM class that backs
-	// Get-DnsClientNrptPolicy. Unlike the rules in the registry, the table is
-	// what the resolver currently has loaded, which is the only way to tell an
-	// applied rule from one that is merely written, in either direction.
-	nrptPolicyNamespace = `root\Microsoft\Windows\DNS`
-	nrptPolicyClass     = "PS_DnsClientNrptPolicy"
-	nrptPolicyMethod    = "Get"
-
-	// The class has no instances, so the table comes from the out parameters
-	// of a static method call, rendered as MOF text: the embedded instances
-	// arrive as a safe array of objects, which cannot be read back through the
-	// COM bindings, and the text form carries all of them.
-	nrptPolicyInstanceKeyword = "instance of DnsClientPolicyConfiguration"
-
-	nrptPolicyTimeout = 15 * time.Second
-)
-
-// COM initialization results that leave the calling thread usable: S_FALSE for
-// a thread this process already initialized, RPC_E_CHANGED_MODE for one that
-// belongs to another apartment.
-const (
-	sFalse          = 0x00000001
-	rpcEChangedMode = 0x80010106
-)
-
-// nrptQueryInFlight admits one read of the policy table at a time. A provider
-// that stops answering keeps its goroutine and the OS thread that goroutine
-// pinned, so a later bundle reports that instead of pinning another one.
-var nrptQueryInFlight = make(chan struct{}, 1)
-
-// nrptPolicyEntry is one namespace of the effective policy table, holding the
-// values of an embedded DnsClientPolicyConfiguration instance in the order the
-// provider reported them.
-type nrptPolicyEntry struct {
-	namespace string
-	values    []registryValue
-}
-
-// registryValue is a name and its rendered value, shared by the registry and
-// policy table readers so both anonymize by value name the same way.
-type registryValue struct {
-	name  string
-	value string
-}
-
-// effectiveNRPTPolicies reads the effective NRPT table. The call is bounded
-// because a WMI provider can block indefinitely and a debug bundle must not.
-func effectiveNRPTPolicies() ([]nrptPolicyEntry, error) {
-	type result struct {
-		text string
-		err  error
-	}
-
-	select {
-	case nrptQueryInFlight <- struct{}{}:
-	default:
-		return nil, errors.New("an earlier read of the policy table has not returned")
-	}
-
-	done := make(chan result, 1)
-	go func() {
-		// the slot is released here rather than by the caller, so a read that
-		// outlives the timeout holds it until the provider answers
-		defer func() { <-nrptQueryInFlight }()
-
-		text, err := nrptPolicyTableText()
-		done <- result{text: text, err: err}
-	}()
-
-	select {
-	case res := <-done:
-		if res.err != nil {
-			return nil, res.err
-		}
-		return parseNRPTPolicyTable(res.text), nil
-	case <-time.After(nrptPolicyTimeout):
-		return nil, errors.New("read of the policy table timed out")
-	}
-}
-
-// nrptPolicyTableText calls the policy table method and returns the MOF text of
-// its out parameters.
-func nrptPolicyTableText() (text string, err error) {
-	// COM is per thread, and the collection is short lived, so the thread is
-	// pinned for the duration rather than initialized for the process.
-	runtime.LockOSThread()
-	defer runtime.UnlockOSThread()
-
-	defer func() {
-		// The COM call chain is dynamically typed, so a provider that answers
-		// with an unexpected shape must not take the daemon down with it.
-		if r := recover(); r != nil {
-			err = fmt.Errorf("read NRPT policy table: %v", r)
-		}
-	}()
-
-	owns, err := coInitialize()
-	if err != nil {
-		return "", err
-	}
-	if owns {
-		defer ole.CoUninitialize()
-	}
-
-	locator, err := oleutil.CreateObject("WbemScripting.SWbemLocator")
-	if err != nil {
-		return "", fmt.Errorf("create WMI locator: %w", err)
-	}
-	defer locator.Release()
-
-	dispatch, err := locator.QueryInterface(ole.IID_IDispatch)
-	if err != nil {
-		return "", fmt.Errorf("query WMI locator interface: %w", err)
-	}
-	defer dispatch.Release()
-
-	service, err := dispatchCall(dispatch, "ConnectServer", nil, nrptPolicyNamespace)
-	if err != nil {
-		return "", fmt.Errorf("connect to %s: %w", nrptPolicyNamespace, err)
-	}
-	defer service.Release()
-
-	inParams, err := spawnMethodInParams(service)
-	if err != nil {
-		return "", err
-	}
-	defer inParams.Release()
-
-	// The effective table is the merge of the local and the group policy
-	// store, which is what the resolver answers from.
-	if _, err := oleutil.PutProperty(inParams, "Effective", true); err != nil {
-		return "", fmt.Errorf("set Effective parameter: %w", err)
-	}
-
-	outParams, err := dispatchCall(service, "ExecMethod", nrptPolicyClass, nrptPolicyMethod, inParams)
-	if err != nil {
-		return "", fmt.Errorf("call %s.%s: %w", nrptPolicyClass, nrptPolicyMethod, err)
-	}
-	defer outParams.Release()
-
-	textVariant, err := oleutil.CallMethod(outParams, "GetObjectText_")
-	if err != nil {
-		return "", fmt.Errorf("render policy table: %w", err)
-	}
-	defer func() {
-		if err := textVariant.Clear(); err != nil {
-			log.Debugf("clear policy table variant: %v", err)
-		}
-	}()
-
-	return textVariant.ToString(), nil
-}
-
-// spawnMethodInParams builds the in parameters instance the method needs. The
-// provider rejects the call without one, even when every parameter is optional.
-func spawnMethodInParams(service *ole.IDispatch) (*ole.IDispatch, error) {
-	class, err := dispatchCall(service, "Get", nrptPolicyClass)
-	if err != nil {
-		return nil, fmt.Errorf("get class %s: %w", nrptPolicyClass, err)
-	}
-	defer class.Release()
-
-	methods, err := dispatchProperty(class, "Methods_")
-	if err != nil {
-		return nil, fmt.Errorf("get class methods: %w", err)
-	}
-	defer methods.Release()
-
-	method, err := dispatchCall(methods, "Item", nrptPolicyMethod)
-	if err != nil {
-		return nil, fmt.Errorf("get method %s: %w", nrptPolicyMethod, err)
-	}
-	defer method.Release()
-
-	params, err := dispatchProperty(method, "InParameters")
-	if err != nil {
-		return nil, fmt.Errorf("get method parameters: %w", err)
-	}
-	defer params.Release()
-
-	inParams, err := dispatchCall(params, "SpawnInstance_")
-	if err != nil {
-		return nil, fmt.Errorf("spawn parameter instance: %w", err)
-	}
-
-	return inParams, nil
-}
-
-// parseNRPTPolicyTable pulls the embedded instances out of the MOF text. Each
-// instance is a namespace of the table, with one name and value per line.
-func parseNRPTPolicyTable(text string) []nrptPolicyEntry {
-	var entries []nrptPolicyEntry
-	var current *nrptPolicyEntry
-
-	for _, line := range strings.Split(text, "\n") {
-		line = strings.TrimSpace(strings.TrimSuffix(strings.TrimSpace(line), ";"))
-
-		switch {
-		case strings.HasPrefix(line, nrptPolicyInstanceKeyword):
-			entries = append(entries, nrptPolicyEntry{})
-			current = &entries[len(entries)-1]
-			continue
-		case strings.HasPrefix(line, "}"):
-			// closes an instance, and the array with the last one, so the
-			// class level parameters that follow are not read as values
-			current = nil
-			continue
-		case current == nil, line == "{":
-			continue
-		}
-
-		name, value, ok := strings.Cut(line, " = ")
-		if !ok {
-			continue
-		}
-
-		value = unquoteMOFValue(value)
-		if name == "Namespace" {
-			current.namespace = value
-			continue
-		}
-
-		current.values = append(current.values, registryValue{name: name, value: value})
-	}
-
-	return entries
-}
-
-// unquoteMOFValue renders a MOF scalar or array as plain text: "a" becomes a,
-// and {"a", "b"} becomes a, b.
-func unquoteMOFValue(value string) string {
-	value = strings.TrimSpace(value)
-
-	if inner, ok := strings.CutPrefix(value, "{"); ok {
-		value = strings.TrimSuffix(inner, "}")
-
-		entries := strings.Split(value, ",")
-		for i, entry := range entries {
-			entries[i] = strings.Trim(strings.TrimSpace(entry), `"`)
-		}
-		return strings.Join(entries, ", ")
-	}
-
-	return strings.Trim(value, `"`)
-}
-
-// coInitialize prepares the calling thread for COM and reports whether this
-// call owns the initialization, which decides whether it may be balanced with
-// CoUninitialize. S_FALSE took a reference on a thread this process had already
-// initialized and so has to be released, while RPC_E_CHANGED_MODE took none:
-// the thread belongs to another apartment, which is usable but is not ours to
-// uninitialize.
-func coInitialize() (bool, error) {
-	err := ole.CoInitializeEx(0, ole.COINIT_MULTITHREADED)
-	if err == nil {
-		return true, nil
-	}
-
-	var oleErr *ole.OleError
-	if errors.As(err, &oleErr) {
-		switch oleErr.Code() {
-		case sFalse:
-			return true, nil
-		case rpcEChangedMode:
-			return false, nil
-		}
-	}
-
-	return false, fmt.Errorf("initialize COM: %w", err)
-}
-
-// dispatchCall calls a COM method that returns an object.
-func dispatchCall(dispatch *ole.IDispatch, method string, params ...any) (*ole.IDispatch, error) {
-	variant, err := oleutil.CallMethod(dispatch, method, params...)
-	if err != nil {
-		return nil, err
-	}
-
-	object := variant.ToIDispatch()
-	if object == nil {
-		return nil, fmt.Errorf("%s returned no object", method)
-	}
-
-	return object, nil
-}
-
-// dispatchProperty reads a COM property that holds an object.
-func dispatchProperty(dispatch *ole.IDispatch, property string) (*ole.IDispatch, error) {
-	variant, err := oleutil.GetProperty(dispatch, property)
-	if err != nil {
-		return nil, err
-	}
-
-	object := variant.ToIDispatch()
-	if object == nil {
-		return nil, fmt.Errorf("property %s holds no object", property)
-	}
-
-	return object, nil
-}

client/internal/dns/host_darwin.go

@@ -267,38 +267,18 @@ func (s *systemConfigurator) getSystemDNSSettings() (SystemDNSSettings, error) {
 		return SystemDNSSettings{}, fmt.Errorf("sending the command: %w", err)
 	}
 
-	dnsSettings, serverAddresses, err := parseSystemDNSSettings(b)
-	if err != nil {
-		return dnsSettings, err
-	}
-
-	s.mu.Lock()
-	s.origNameservers = serverAddresses
-	s.mu.Unlock()
-
-	return dnsSettings, nil
-}
-
-// parseSystemDNSSettings parses the output of `scutil show State:/Network/Service/<id>/DNS`.
-// Lines that don't match the expected "index : value" shape are skipped: hosts with unusual
-// network services (e.g. orphaned hardware ports) can produce entries without a value.
-func parseSystemDNSSettings(out []byte) (SystemDNSSettings, []netip.Addr, error) {
-	// port is not exposed by scutil, default to 53
-	dnsSettings := SystemDNSSettings{ServerPort: DefaultPort}
+	var dnsSettings SystemDNSSettings
 	var serverAddresses []netip.Addr
 	inSearchDomainsArray := false
 	inServerAddressesArray := false
 
-	scanner := bufio.NewScanner(bytes.NewReader(out))
+	scanner := bufio.NewScanner(bytes.NewReader(b))
 	for scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())
 		switch {
 		case strings.HasPrefix(line, "DomainName :"):
-			domainName := strings.TrimSpace(strings.TrimPrefix(line, "DomainName :"))
-			if domainName != "" {
-				dnsSettings.Domains = append(dnsSettings.Domains, domainName)
-			}
-			continue
+			domainName := strings.TrimSpace(strings.Split(line, ":")[1])
+			dnsSettings.Domains = append(dnsSettings.Domains, domainName)
 		case line == "SearchDomains : <array> {":
 			inSearchDomainsArray = true
 			continue
@@ -308,45 +288,36 @@ func parseSystemDNSSettings(out []byte) (SystemDNSSettings, []netip.Addr, error)
 		case line == "}":
 			inSearchDomainsArray = false
 			inServerAddressesArray = false
-			continue
-		}
-
-		if !inSearchDomainsArray && !inServerAddressesArray {
-			continue
-		}
-
-		parts := strings.SplitN(line, " : ", 2)
-		if len(parts) != 2 {
-			log.Debugf("skipping unexpected scutil DNS line %q", line)
-			continue
-		}
-		value := strings.TrimSpace(parts[1])
-		if value == "" {
-			continue
 		}
 
 		if inSearchDomainsArray {
-			dnsSettings.Domains = append(dnsSettings.Domains, value)
-			continue
-		}
-
-		ip, err := netip.ParseAddr(value)
-		if err != nil || ip.IsUnspecified() {
-			continue
-		}
-		ip = ip.Unmap()
-		serverAddresses = append(serverAddresses, ip)
-		// Prefer the first IPv4 server as ServerIP since our DNS listener is IPv4.
-		if !dnsSettings.ServerIP.IsValid() && ip.Is4() {
-			dnsSettings.ServerIP = ip
+			searchDomain := strings.Split(line, " : ")[1]
+			dnsSettings.Domains = append(dnsSettings.Domains, searchDomain)
+		} else if inServerAddressesArray {
+			address := strings.Split(line, " : ")[1]
+			if ip, err := netip.ParseAddr(address); err == nil && !ip.IsUnspecified() {
+				ip = ip.Unmap()
+				serverAddresses = append(serverAddresses, ip)
+				// Prefer the first IPv4 server as ServerIP since our DNS listener is IPv4.
+				if !dnsSettings.ServerIP.IsValid() && ip.Is4() {
+					dnsSettings.ServerIP = ip
+				}
+			}
 		}
 	}
 
 	if err := scanner.Err(); err != nil {
-		return dnsSettings, serverAddresses, err
+		return dnsSettings, err
 	}
 
-	return dnsSettings, serverAddresses, nil
+	// default to 53 port
+	dnsSettings.ServerPort = DefaultPort
+
+	s.mu.Lock()
+	s.origNameservers = serverAddresses
+	s.mu.Unlock()
+
+	return dnsSettings, nil
 }
 
 func (s *systemConfigurator) getOriginalNameservers() []netip.Addr {
@@ -464,15 +435,11 @@ func (s *systemConfigurator) getPrimaryService() (string, string, error) {
 	router := ""
 	for scanner.Scan() {
 		text := scanner.Text()
-		parts := strings.SplitN(text, ":", 2)
-		if len(parts) != 2 {
-			continue
-		}
 		if strings.Contains(text, "PrimaryService") {
-			primaryService = strings.TrimSpace(parts[1])
+			primaryService = strings.TrimSpace(strings.Split(text, ":")[1])
 		}
 		if strings.Contains(text, "Router") {
-			router = strings.TrimSpace(parts[1])
+			router = strings.TrimSpace(strings.Split(text, ":")[1])
 		}
 	}
 	if err := scanner.Err(); err != nil && err != io.EOF {

client/internal/dns/host_darwin_test.go

@@ -328,120 +328,6 @@ func removeTestDNSKey(key string) error {
 	return err
 }
 
-func TestParseSystemDNSSettings(t *testing.T) {
-	tests := []struct {
-		name            string
-		output          string
-		expectedDomains []string
-		expectedServers []netip.Addr
-		expectedIP      netip.Addr
-	}{
-		{
-			name: "well_formed",
-			output: `<dictionary> {
-  DomainName : example.com
-  SearchDomains : <array> {
-    0 : example.com
-    1 : corp.example.com
-  }
-  ServerAddresses : <array> {
-    0 : 192.168.1.1
-    1 : fd00::53
-  }
-}
-`,
-			expectedDomains: []string{"example.com", "example.com", "corp.example.com"},
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1"), netip.MustParseAddr("fd00::53")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			// entries without a value after the separator used to panic with
-			// "index out of range [1] with length 1"
-			name: "malformed_array_entries_skipped",
-			output: `<dictionary> {
-  SearchDomains : <array> {
-    0 :
-    (null)
-
-    1 : corp.example.com
-  }
-  ServerAddresses : <array> {
-    0 :
-    1 : 192.168.1.1
-  }
-}
-`,
-			expectedDomains: []string{"corp.example.com"},
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name: "domain_name_without_value_skipped",
-			output: `<dictionary> {
-  DomainName :
-  ServerAddresses : <array> {
-    0 : 192.168.1.1
-  }
-}
-`,
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name: "ipv6_first_prefers_ipv4_server_ip",
-			output: `<dictionary> {
-  ServerAddresses : <array> {
-    0 : fd00::53
-    1 : 192.168.1.1
-  }
-}
-`,
-			expectedServers: []netip.Addr{netip.MustParseAddr("fd00::53"), netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name: "invalid_and_unspecified_addresses_skipped",
-			output: `<dictionary> {
-  ServerAddresses : <array> {
-    0 : (null)
-    1 : 0.0.0.0
-    2 : 192.168.1.1
-  }
-}
-`,
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name: "v4_mapped_address_unmapped",
-			output: `<dictionary> {
-  ServerAddresses : <array> {
-    0 : ::ffff:192.168.1.1
-  }
-}
-`,
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name:   "empty_output",
-			output: "",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			settings, servers, err := parseSystemDNSSettings([]byte(tc.output))
-			require.NoError(t, err, "parsing should not fail")
-
-			assert.Equal(t, tc.expectedDomains, settings.Domains, "domains should match")
-			assert.Equal(t, tc.expectedServers, servers, "server addresses should match")
-			assert.Equal(t, tc.expectedIP, settings.ServerIP, "server IP should match")
-			assert.Equal(t, DefaultPort, settings.ServerPort, "server port should default to 53")
-		})
-	}
-}
-
 func TestGetOriginalNameservers(t *testing.T) {
 	configurator := &systemConfigurator{
 		createdKeys: make(map[string]struct{}),

client/internal/dns/host_windows.go

@@ -31,28 +31,10 @@ var (
 	dnsFlushResolverCacheFn = dnsapi.NewProc("DnsFlushResolverCache")
 )
 
-// Registry locations of the host DNS configuration this package programs,
-// exported so a diagnostic reader reports the same locations that are written.
 const (
-	// NRPTKeyPrefix starts the name of every NRPT rule key this client creates.
-	NRPTKeyPrefix = "NetBird-Match"
-
-	// DNSPolicyConfigRoot holds the NRPT rules of the local policy store.
-	DNSPolicyConfigRoot = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig`
-
-	// GPODNSPolicyConfigRoot holds the NRPT rules of the group policy store,
-	// which takes precedence over the local one when it is present.
-	GPODNSPolicyConfigRoot = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`
-
-	// InterfaceConfigPath and InterfaceConfigPathV6 hold the per-interface DNS
-	// settings, keyed by interface GUID, in separate hives per address family.
-	InterfaceConfigPath   = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
-	InterfaceConfigPathV6 = `SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces`
-)
-
-const (
-	dnsPolicyConfigMatchPath    = DNSPolicyConfigRoot + `\` + NRPTKeyPrefix
-	gpoDnsPolicyConfigMatchPath = GPODNSPolicyConfigRoot + `\` + NRPTKeyPrefix
+	dnsPolicyConfigMatchPath    = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-Match`
+	gpoDnsPolicyRoot            = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`
+	gpoDnsPolicyConfigMatchPath = gpoDnsPolicyRoot + `\NetBird-Match`
 
 	dnsPolicyConfigVersionKey           = "Version"
 	dnsPolicyConfigVersionValue         = 2
@@ -63,6 +45,8 @@ const (
 
 	nrptMaxDomainsPerRule = 50
 
+	interfaceConfigPath           = `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces`
+	interfaceConfigPathV6         = `SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces`
 	interfaceConfigNameServerKey  = "NameServer"
 	interfaceConfigDhcpNameSrvKey = "DhcpNameServer"
 	interfaceConfigSearchListKey  = "SearchList"
@@ -100,7 +84,7 @@ func newHostManager(wgInterface WGIface) (*registryConfigurator, error) {
 	}
 
 	var useGPO bool
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, GPODNSPolicyConfigRoot, registry.QUERY_VALUE)
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, gpoDnsPolicyRoot, registry.QUERY_VALUE)
 	if err != nil {
 		log.Debugf("failed to open GPO DNS policy root: %v", err)
 	} else {
@@ -139,7 +123,7 @@ func (r *registryConfigurator) captureOriginalNameservers() ([]netip.Addr, error
 	seen := make(map[netip.Addr]struct{})
 	var out []netip.Addr
 	var merr *multierror.Error
-	for _, root := range []string{InterfaceConfigPath, InterfaceConfigPathV6} {
+	for _, root := range []string{interfaceConfigPath, interfaceConfigPathV6} {
 		addrs, err := r.captureFromTcpipRoot(root)
 		if err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("%s: %w", root, err))
@@ -512,7 +496,7 @@ func (r *registryConfigurator) deleteInterfaceRegistryKeyProperty(propertyKey st
 }
 
 func (r *registryConfigurator) getInterfaceRegistryKey() (registry.Key, error) {
-	regKeyPath := InterfaceConfigPath + "\\" + r.guid
+	regKeyPath := interfaceConfigPath + "\\" + r.guid
 	regKey, err := registry.OpenKey(registry.LOCAL_MACHINE, regKeyPath, registry.SET_VALUE)
 	if err != nil {
 		return regKey, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", regKeyPath, err)

client/internal/routemanager/ipfwdstate/ipfwdstate.go

@@ -2,183 +2,54 @@ package ipfwdstate
 
 import (
 	"fmt"
-	"sync"
 
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/internal/routemanager/systemops"
 )
 
-// IPForwardingState tracks v4 and v6 IP-forwarding sysctl enables with
-// independent refcounts so a v4-only routing setup doesn't flip v6 sysctls.
+// IPForwardingState is a struct that keeps track of the IP forwarding state.
+// todo: read initial state of the IP forwarding from the system and reset the state based on it.
+// todo: separate v4/v6 forwarding state, since the sysctls are independent
+// (net.ipv4.ip_forward vs net.ipv6.conf.all.forwarding). Currently the nftables
+// manager shares one instance between both routers, which works only because
+// EnableIPForwarding enables both sysctls in a single call.
 type IPForwardingState struct {
-	mu sync.Mutex
-
-	v4Count int
-	v6Count int
-
-	// routingV4/routingV6 track whether the routing path currently holds a
-	// reference, so repeated EnableRouting calls (one per network-map update)
-	// hold at most one reference per family and an unpaired DisableRouting
-	// can't release references held by DNAT rules.
-	routingV4 bool
-	routingV6 bool
-
-	wgIfaceName string
-	v6Saved     map[string]int
+	enabledCounter int
 }
 
-// NewIPForwardingState returns a state tracker for the IP-forwarding sysctls.
-// wgIfaceName is excluded from the per-interface accept_ra handling.
-func NewIPForwardingState(wgIfaceName string) *IPForwardingState {
-	return &IPForwardingState{wgIfaceName: wgIfaceName}
+func NewIPForwardingState() *IPForwardingState {
+	return &IPForwardingState{}
 }
 
-// Counts returns the current v4 and v6 refcounts. Intended for diagnostics
-// and tests.
-func (f *IPForwardingState) Counts() (v4, v6 int) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return f.v4Count, f.v6Count
-}
-
-// RequestRouting takes the forwarding references for the routing path. It is
-// idempotent: while routing already holds a reference, further calls don't
-// increment the refcounts, and a v4-only request releases a previously held v6
-// reference. A v6 sysctl failure is logged and not returned so it can't take
-// down v4 routing (the sysctl may be unwritable, e.g. read-only /proc/sys or
-// IPv6 disabled on the kernel command line); v6 is retried on the next call.
-func (f *IPForwardingState) RequestRouting(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if !f.routingV4 {
-		if err := f.requestV4(); err != nil {
-			return err
-		}
-		f.routingV4 = true
-	}
-
-	if !v6 {
-		if !f.routingV6 {
-			return nil
-		}
-		f.routingV6 = false
-		return f.releaseV6()
-	}
-
-	if f.routingV6 {
-		return nil
-	}
-	if err := f.requestV6(); err != nil {
-		log.Warnf("enable IPv6 forwarding for routing: %v", err)
-		return nil
-	}
-	f.routingV6 = true
-	return nil
-}
-
-// ReleaseRouting releases the references RequestRouting holds. Calls without a
-// held reference are no-ops.
-func (f *IPForwardingState) ReleaseRouting() error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if f.routingV4 {
-		f.routingV4 = false
-		f.releaseV4()
-	}
-	if f.routingV6 {
-		f.routingV6 = false
-		return f.releaseV6()
-	}
-	return nil
-}
-
-// RequestForwarding enables the family's forwarding sysctl on first request.
-func (f *IPForwardingState) RequestForwarding(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if v6 {
-		return f.requestV6()
-	}
-	return f.requestV4()
-}
-
-// ReleaseForwarding decrements the family counter. The last v6 release restores
-// what enable captured. v4 stays on: net.ipv4.ip_forward is co-owned by other
-// tooling (docker, k8s, libvirt).
-func (f *IPForwardingState) ReleaseForwarding(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if v6 {
-		return f.releaseV6()
-	}
-	f.releaseV4()
-	return nil
-}
-
-func (f *IPForwardingState) requestV4() error {
-	if f.v4Count == 0 {
-		if err := systemops.EnableV4IPForwarding(); err != nil {
-			return fmt.Errorf("enable IPv4 forwarding: %w", err)
-		}
-		log.Info("IPv4 forwarding enabled")
-	}
-	f.v4Count++
-	return nil
-}
-
-func (f *IPForwardingState) releaseV4() {
-	if f.v4Count > 0 {
-		f.v4Count--
-	}
-}
-
-func (f *IPForwardingState) requestV6() error {
-	if f.v6Count == 0 {
-		saved, err := systemops.EnableV6IPForwarding(f.wgIfaceName)
-		if err != nil {
-			if rerr := systemops.DisableV6IPForwarding(saved); rerr != nil {
-				log.Warnf("rollback partial v6 sysctls: %v", rerr)
-			}
-			return fmt.Errorf("enable IPv6 forwarding: %w", err)
-		}
-		// A failed restore on a previous release keeps its saved values; those
-		// are the true originals, so keep them over what this enable captured.
-		if f.v6Saved == nil {
-			f.v6Saved = saved
-		} else {
-			for k, v := range saved {
-				if _, ok := f.v6Saved[k]; !ok {
-					f.v6Saved[k] = v
-				}
-			}
-		}
-		log.Info("IPv6 forwarding enabled")
-	}
-	f.v6Count++
-	return nil
-}
-
-func (f *IPForwardingState) releaseV6() error {
-	if f.v6Count == 0 {
-		return nil
-	}
-	f.v6Count--
-	if f.v6Count > 0 {
+func (f *IPForwardingState) RequestForwarding() error {
+	if f.enabledCounter != 0 {
+		f.enabledCounter++
 		return nil
 	}
 
-	// Keep the saved values on failure so a later release or enable/release
-	// cycle can still restore them; re-restoring an already-restored key is a
-	// no-op since the sysctl already holds the desired value.
-	if err := systemops.DisableV6IPForwarding(f.v6Saved); err != nil {
-		return fmt.Errorf("disable IPv6 forwarding: %w", err)
+	if err := systemops.EnableIPForwarding(); err != nil {
+		return fmt.Errorf("failed to enable IP forwarding with sysctl: %w", err)
 	}
-	f.v6Saved = nil
-	log.Info("IPv6 forwarding disabled")
+	f.enabledCounter = 1
+	log.Info("IP forwarding enabled")
+
+	return nil
+}
+
+func (f *IPForwardingState) ReleaseForwarding() error {
+	if f.enabledCounter == 0 {
+		return nil
+	}
+
+	if f.enabledCounter > 1 {
+		f.enabledCounter--
+		return nil
+	}
+
+	// if failed to disable IP forwarding we anyway decrement the counter
+	f.enabledCounter = 0
+
+	// todo call systemops.DisableIPForwarding()
 	return nil
 }

client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go

@@ -1,39 +0,0 @@
-//go:build privileged
-
-package ipfwdstate
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestRequestRoutingV6ToV4Transition verifies that a v4-only routing request
-// releases a previously held routing-owned v6 reference without touching
-// references held by DNAT rules.
-func TestRequestRoutingV6ToV4Transition(t *testing.T) {
-	f := NewIPForwardingState("wt-fwd-test")
-
-	require.NoError(t, f.RequestRouting(true), "request routing with v6")
-	v4, v6 := f.Counts()
-	assert.Equal(t, 1, v4, "v4 reference held")
-	assert.Equal(t, 1, v6, "v6 reference held")
-
-	require.NoError(t, f.RequestRouting(false), "request routing v4-only")
-	v4, v6 = f.Counts()
-	assert.Equal(t, 1, v4, "v4 reference kept")
-	assert.Equal(t, 0, v6, "routing-owned v6 reference released")
-
-	// A DNAT-held reference survives a v4-only routing request.
-	require.NoError(t, f.RequestForwarding(true), "dnat v6 reference")
-	require.NoError(t, f.RequestRouting(false), "repeat v4-only request")
-	_, v6 = f.Counts()
-	assert.Equal(t, 1, v6, "dnat-held v6 reference survives")
-	require.NoError(t, f.ReleaseForwarding(true), "release dnat v6 reference")
-
-	require.NoError(t, f.ReleaseRouting(), "release routing")
-	v4, v6 = f.Counts()
-	assert.Equal(t, 0, v4, "all v4 references released")
-	assert.Equal(t, 0, v6, "all v6 references released")
-}

client/internal/routemanager/sysctl/sysctl_linux.go

@@ -58,7 +58,11 @@ func Setup(wgIface iface) (map[string]int, error) {
 			continue
 		}
 
-		i := fmt.Sprintf(rpFilterInterfacePath, EscapeInterfaceName(intf.Name))
+		// Escape '%' and '.' so they survive the dot-to-slash conversion in Set()
+		safeName := strings.ReplaceAll(intf.Name, "%", percentEscape)
+		safeName = strings.ReplaceAll(safeName, ".", dotEscape)
+
+		i := fmt.Sprintf(rpFilterInterfacePath, safeName)
 		oldVal, err := Set(i, 2, true)
 		if err != nil {
 			result = multierror.Append(result, err)
@@ -70,13 +74,6 @@ func Setup(wgIface iface) (map[string]int, error) {
 	return keys, nberrors.FormatErrorOrNil(result)
 }
 
-// EscapeInterfaceName escapes '%' and '.' in an interface name (e.g. VLANs
-// like eth0.100) so the name survives the dot-to-slash conversion in Set.
-func EscapeInterfaceName(name string) string {
-	safe := strings.ReplaceAll(name, "%", percentEscape)
-	return strings.ReplaceAll(safe, ".", dotEscape)
-}
-
 // Set sets a sysctl configuration, if onlyIfOne is true it will only set the new value if it's set to 1
 func Set(key string, desiredValue int, onlyIfOne bool) (int, error) {
 	path := strings.ReplaceAll(key, ".", "/")

client/internal/routemanager/systemops/systemops_android.go

@@ -32,17 +32,8 @@ func (r *SysOps) removeFromRouteTable(netip.Prefix, Nexthop) error {
 	return nil
 }
 
-func EnableV4IPForwarding() error {
-	log.Infof("Enable IPv4 forwarding is not implemented on %s", runtime.GOOS)
-	return nil
-}
-
-func EnableV6IPForwarding(string) (map[string]int, error) {
-	log.Infof("Enable IPv6 forwarding is not implemented on %s", runtime.GOOS)
-	return map[string]int{}, nil
-}
-
-func DisableV6IPForwarding(map[string]int) error {
+func EnableIPForwarding() error {
+	log.Infof("Enable IP forwarding is not implemented on %s", runtime.GOOS)
 	return nil
 }
 

client/internal/routemanager/systemops/systemops_ios.go

@@ -58,17 +58,8 @@ func (r *SysOps) removeFromRouteTable(netip.Prefix, Nexthop) error {
 	return nil
 }
 
-func EnableV4IPForwarding() error {
-	log.Infof("Enable IPv4 forwarding is not implemented on %s", runtime.GOOS)
-	return nil
-}
-
-func EnableV6IPForwarding(string) (map[string]int, error) {
-	log.Infof("Enable IPv6 forwarding is not implemented on %s", runtime.GOOS)
-	return map[string]int{}, nil
-}
-
-func DisableV6IPForwarding(map[string]int) error {
+func EnableIPForwarding() error {
+	log.Infof("Enable IP forwarding is not implemented on %s", runtime.GOOS)
 	return nil
 }
 

client/internal/routemanager/systemops/systemops_linux.go

@@ -763,10 +763,13 @@ func flushRoutes(tableID, family int) error {
 	return nberrors.FormatErrorOrNil(result)
 }
 
-func EnableV4IPForwarding() error {
+func EnableIPForwarding() error {
 	if _, err := sysctl.Set(ipv4ForwardingPath, 1, false); err != nil {
 		return err
 	}
+	if _, err := sysctl.Set(ipv6ForwardingPath, 1, false); err != nil {
+		log.Warnf("failed to enable IPv6 forwarding: %v", err)
+	}
 	return nil
 }
 

client/internal/routemanager/systemops/systemops_nonlinux.go

@@ -43,17 +43,8 @@ func (r *SysOps) RemoveVPNRoute(prefix netip.Prefix, intf *net.Interface) error
 	return r.genericRemoveVPNRoute(prefix, intf)
 }
 
-func EnableV4IPForwarding() error {
-	log.Infof("Enable IPv4 forwarding is not implemented on %s", runtime.GOOS)
-	return nil
-}
-
-func EnableV6IPForwarding(string) (map[string]int, error) {
-	log.Infof("Enable IPv6 forwarding is not implemented on %s", runtime.GOOS)
-	return map[string]int{}, nil
-}
-
-func DisableV6IPForwarding(map[string]int) error {
+func EnableIPForwarding() error {
+	log.Infof("Enable IP forwarding is not implemented on %s", runtime.GOOS)
 	return nil
 }
 

client/internal/routemanager/systemops/v6forwarding_linux.go

@@ -1,92 +0,0 @@
-//go:build !android
-
-package systemops
-
-import (
-	"fmt"
-	"net"
-	"os"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/client/internal/routemanager/sysctl"
-)
-
-const (
-	// 1 (default) accepts RAs only while forwarding is off; 2 keeps RA
-	// acceptance on regardless, so RA-installed host defaults survive our
-	// v6 forwarding flip.
-	acceptRAInterfacePath  = "net.ipv6.conf.%s.accept_ra"
-	acceptRADefaultPath    = "net.ipv6.conf.default.accept_ra"
-	acceptRAProcPathFormat = "/proc/sys/net/ipv6/conf/%s/accept_ra"
-)
-
-// EnableV6IPForwarding bumps accept_ra=2 on host v6 interfaces before flipping
-// forwarding=1, so RA-installed host defaults survive. Returns the prior values
-// of sysctls we actually changed; entries already at the target are omitted.
-func EnableV6IPForwarding(wgIfaceName string) (map[string]int, error) {
-	saved := map[string]int{}
-	bumpAcceptRA(saved, wgIfaceName)
-
-	oldVal, err := sysctl.Set(ipv6ForwardingPath, 1, false)
-	if err != nil {
-		return saved, err
-	}
-	if oldVal != 1 {
-		saved[ipv6ForwardingPath] = oldVal
-	}
-	return saved, nil
-}
-
-// DisableV6IPForwarding restores what EnableV6IPForwarding captured.
-func DisableV6IPForwarding(saved map[string]int) error {
-	var result *multierror.Error
-	for key, value := range saved {
-		if _, err := sysctl.Set(key, value, false); err != nil {
-			result = multierror.Append(result, fmt.Errorf("restore %s: %w", key, err))
-		}
-	}
-	return nberrors.FormatErrorOrNil(result)
-}
-
-func bumpAcceptRA(saved map[string]int, wgIfaceName string) {
-	// Also bump conf.default so interfaces created while forwarding is on
-	// (hotplug, new Wi-Fi/dock) inherit accept_ra=2 and keep accepting RAs.
-	bumpAcceptRAKey(saved, acceptRADefaultPath)
-
-	interfaces, err := net.Interfaces()
-	if err != nil {
-		log.Warnf("list interfaces for accept_ra: %v", err)
-		return
-	}
-	for _, intf := range interfaces {
-		if intf.Name == "lo" || intf.Name == wgIfaceName {
-			continue
-		}
-		bumpAcceptRAForInterface(saved, intf.Name)
-	}
-}
-
-func bumpAcceptRAForInterface(saved map[string]int, name string) {
-	// Build procfs path from name, not the dotted key: VLAN names like eth0.100.
-	if _, err := os.Stat(fmt.Sprintf(acceptRAProcPathFormat, name)); err != nil {
-		return
-	}
-	bumpAcceptRAKey(saved, fmt.Sprintf(acceptRAInterfacePath, sysctl.EscapeInterfaceName(name)))
-}
-
-func bumpAcceptRAKey(saved map[string]int, key string) {
-	// onlyIfOne=true: leave admin overrides (0, 2) alone.
-	oldVal, err := sysctl.Set(key, 2, true)
-	if err != nil {
-		log.Warnf("bump %s: %v", key, err)
-		return
-	}
-	// With onlyIfOne, a write only happened when the old value was 1; values
-	// left untouched (0, 2) must not be recorded for restore.
-	if oldVal == 1 {
-		saved[key] = oldVal
-	}
-}

client/proto/daemon.pb.go

@@ -5628,13 +5628,9 @@ func (x *GetPeerSSHHostKeyResponse) GetFound() bool {
 type RequestJWTAuthRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// hint for OIDC login_hint parameter (typically email address)
-	Hint *string `protobuf:"bytes,1,opt,name=hint,proto3,oneof" json:"hint,omitempty"`
-	// hasGraphicalSession tells the daemon that the caller has a graphical session,
-	// which decides whether PKCE or the device code flow is preferred. The daemon
-	// cannot detect this itself: it does not inherit the session environment.
-	HasGraphicalSession bool `protobuf:"varint,2,opt,name=hasGraphicalSession,proto3" json:"hasGraphicalSession,omitempty"`
-	unknownFields       protoimpl.UnknownFields
-	sizeCache           protoimpl.SizeCache
+	Hint          *string `protobuf:"bytes,1,opt,name=hint,proto3,oneof" json:"hint,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RequestJWTAuthRequest) Reset() {
@@ -5674,13 +5670,6 @@ func (x *RequestJWTAuthRequest) GetHint() string {
 	return ""
 }
 
-func (x *RequestJWTAuthRequest) GetHasGraphicalSession() bool {
-	if x != nil {
-		return x.HasGraphicalSession
-	}
-	return false
-}
-
 // RequestJWTAuthResponse contains authentication flow information
 type RequestJWTAuthResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
@@ -5905,13 +5894,9 @@ type RequestExtendAuthSessionRequest struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Optional OIDC login_hint (typically the user's email) to pre-fill the
 	// IdP login form.
-	Hint *string `protobuf:"bytes,1,opt,name=hint,proto3,oneof" json:"hint,omitempty"`
-	// hasGraphicalSession tells the daemon that the caller has a graphical session,
-	// which decides whether PKCE or the device code flow is preferred. The daemon
-	// cannot detect this itself: it does not inherit the session environment.
-	HasGraphicalSession bool `protobuf:"varint,2,opt,name=hasGraphicalSession,proto3" json:"hasGraphicalSession,omitempty"`
-	unknownFields       protoimpl.UnknownFields
-	sizeCache           protoimpl.SizeCache
+	Hint          *string `protobuf:"bytes,1,opt,name=hint,proto3,oneof" json:"hint,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
 }
 
 func (x *RequestExtendAuthSessionRequest) Reset() {
@@ -5951,13 +5936,6 @@ func (x *RequestExtendAuthSessionRequest) GetHint() string {
 	return ""
 }
 
-func (x *RequestExtendAuthSessionRequest) GetHasGraphicalSession() bool {
-	if x != nil {
-		return x.HasGraphicalSession
-	}
-	return false
-}
-
 // RequestExtendAuthSessionResponse carries the verification URI the UI
 // should open in a browser. The daemon retains the flow state and resolves
 // it via WaitExtendAuthSession.
@@ -7525,10 +7503,9 @@ const file_daemon_proto_rawDesc = "" +
 	"sshHostKey\x12\x16\n" +
 	"\x06peerIP\x18\x02 \x01(\tR\x06peerIP\x12\x1a\n" +
 	"\bpeerFQDN\x18\x03 \x01(\tR\bpeerFQDN\x12\x14\n" +
-	"\x05found\x18\x04 \x01(\bR\x05found\"k\n" +
+	"\x05found\x18\x04 \x01(\bR\x05found\"9\n" +
 	"\x15RequestJWTAuthRequest\x12\x17\n" +
-	"\x04hint\x18\x01 \x01(\tH\x00R\x04hint\x88\x01\x01\x120\n" +
-	"\x13hasGraphicalSession\x18\x02 \x01(\bR\x13hasGraphicalSessionB\a\n" +
+	"\x04hint\x18\x01 \x01(\tH\x00R\x04hint\x88\x01\x01B\a\n" +
 	"\x05_hint\"\x9a\x02\n" +
 	"\x16RequestJWTAuthResponse\x12(\n" +
 	"\x0fverificationURI\x18\x01 \x01(\tR\x0fverificationURI\x128\n" +
@@ -7548,10 +7525,9 @@ const file_daemon_proto_rawDesc = "" +
 	"\x14WaitJWTTokenResponse\x12\x14\n" +
 	"\x05token\x18\x01 \x01(\tR\x05token\x12\x1c\n" +
 	"\ttokenType\x18\x02 \x01(\tR\ttokenType\x12\x1c\n" +
-	"\texpiresIn\x18\x03 \x01(\x03R\texpiresIn\"u\n" +
+	"\texpiresIn\x18\x03 \x01(\x03R\texpiresIn\"C\n" +
 	"\x1fRequestExtendAuthSessionRequest\x12\x17\n" +
-	"\x04hint\x18\x01 \x01(\tH\x00R\x04hint\x88\x01\x01\x120\n" +
-	"\x13hasGraphicalSession\x18\x02 \x01(\bR\x13hasGraphicalSessionB\a\n" +
+	"\x04hint\x18\x01 \x01(\tH\x00R\x04hint\x88\x01\x01B\a\n" +
 	"\x05_hint\"\xe0\x01\n" +
 	" RequestExtendAuthSessionResponse\x12(\n" +
 	"\x0fverificationURI\x18\x01 \x01(\tR\x0fverificationURI\x128\n" +

client/proto/daemon.proto

@@ -894,10 +894,6 @@ message GetPeerSSHHostKeyResponse {
 message RequestJWTAuthRequest {
   // hint for OIDC login_hint parameter (typically email address)
   optional string hint = 1;
-  // hasGraphicalSession tells the daemon that the caller has a graphical session,
-  // which decides whether PKCE or the device code flow is preferred. The daemon
-  // cannot detect this itself: it does not inherit the session environment.
-  bool hasGraphicalSession = 2;
 }
 
 // RequestJWTAuthResponse contains authentication flow information
@@ -941,10 +937,6 @@ message RequestExtendAuthSessionRequest {
   // Optional OIDC login_hint (typically the user's email) to pre-fill the
   // IdP login form.
   optional string hint = 1;
-  // hasGraphicalSession tells the daemon that the caller has a graphical session,
-  // which decides whether PKCE or the device code flow is preferred. The daemon
-  // cannot detect this itself: it does not inherit the session environment.
-  bool hasGraphicalSession = 2;
 }
 
 // RequestExtendAuthSessionResponse carries the verification URI the UI

client/server/server.go

@@ -1723,8 +1723,8 @@ func (s *Server) RequestJWTAuth(
 		hint = profilemanager.GetLoginHint()
 	}
 
-	// the daemon has no graphical session of its own, only the caller can answer this
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint)
+	isDesktop := isUnixRunningDesktop()
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isDesktop, false, hint)
 	if err != nil {
 		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
 	}
@@ -1827,8 +1827,8 @@ func (s *Server) RequestExtendAuthSession(
 		hint = profilemanager.GetLoginHint()
 	}
 
-	// the daemon has no graphical session of its own, only the caller can answer this
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint)
+	isDesktop := isUnixRunningDesktop()
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, isDesktop, false, hint)
 	if err != nil {
 		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
 	}
@@ -2000,6 +2000,13 @@ func (s *Server) ExposeService(req *proto.ExposeServiceRequest, srv proto.Daemon
 	return nil
 }
 
+func isUnixRunningDesktop() bool {
+	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
+		return false
+	}
+	return os.Getenv("DESKTOP_SESSION") != "" || os.Getenv("XDG_CURRENT_DESKTOP") != ""
+}
+
 func (s *Server) runProbes(ctx context.Context, waitForProbeResult bool) {
 	if s.connectClient == nil {
 		return

client/ssh/common.go

@@ -13,7 +13,6 @@ import (
 	"golang.org/x/crypto/ssh"
 
 	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/util"
 )
 
 const (
@@ -93,8 +92,7 @@ func printAuthInstructions(stderr io.Writer, authResponse *proto.RequestJWTAuthR
 
 // RequestJWTToken requests or retrieves a JWT token for SSH authentication
 func RequestJWTToken(ctx context.Context, client proto.DaemonServiceClient, stdout, stderr io.Writer, useCache bool, hint string, openBrowser func(string) error) (string, error) {
-	// the ssh client runs in the user's session, the daemon does not: tell it what we can see
-	req := &proto.RequestJWTAuthRequest{HasGraphicalSession: util.HasGraphicalSession()}
+	req := &proto.RequestJWTAuthRequest{}
 	if hint != "" {
 		req.Hint = &hint
 	}
@@ -195,3 +193,4 @@ func buildAddressList(hostname string, remote net.Addr) []string {
 	}
 	return addresses
 }
+

client/ssh/server/command_execution_windows.go

@@ -243,7 +243,7 @@ func (s *Server) setUserEnvironmentVariables(envMap map[string]string, userProfi
 
 // prepareCommandEnv prepares environment variables for command execution on Windows
 func (s *Server) prepareCommandEnv(logger *log.Entry, localUser *user.User, session ssh.Session) []string {
-	username, domain := parseUsername(localUser.Username)
+	username, domain := s.parseUsername(localUser.Username)
 	userEnv, err := s.getUserEnvironment(logger, username, domain)
 	if err != nil {
 		log.Debugf("failed to get user environment for %s\\%s, using fallback: %v", domain, username, err)
@@ -383,7 +383,7 @@ func (s *Server) executeCommandWithPty(logger *log.Entry, session ssh.Session, _
 		return false
 	}
 
-	username, domain := parseUsername(localUser.Username)
+	username, domain := s.parseUsername(localUser.Username)
 	shell := getUserShell(localUser.Uid)
 
 	req := PtyExecutionRequest{

client/ssh/server/port_forwarding.go

@@ -133,12 +133,7 @@ func (s *Server) checkPrivilegedPortAccess(forwardType string, port uint32, resu
 		return nil
 	}
 
-	// Only uid 0 may bind below the threshold, which is the kernel's own rule and
-	// is asked directly rather than through isPrivilegedOrUnknown: that helper
-	// reports an account it cannot evaluate as privileged, which is safe for a
-	// refusal and unsafe for a grant such as this one. Windows has returned
-	// above, so Uid here is a Unix uid and never a SID.
-	if result.User != nil && result.User.Uid == "0" {
+	if result.User != nil && isPrivilegedUsername(result.User.Username) {
 		return nil
 	}
 

client/ssh/server/privileges_other.go

@@ -1,16 +0,0 @@
-//go:build !windows
-
-package server
-
-// isProcessElevated is only meaningful on Windows; other platforms use the
-// effective UID check in isCurrentProcessPrivileged.
-func isProcessElevated() bool {
-	return false
-}
-
-// isWindowsAccountPrivilegedOrUnknown is only reachable on Windows. Report
-// privileged on other platforms so a caller refusing privileged accounts fails
-// closed.
-func isWindowsAccountPrivilegedOrUnknown(string) bool {
-	return true
-}

client/ssh/server/privileges_windows.go

@@ -1,228 +0,0 @@
-//go:build windows
-
-package server
-
-import (
-	"fmt"
-	"strings"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-)
-
-var (
-	netapi32                  = windows.NewLazySystemDLL("netapi32.dll")
-	procNetUserGetLocalGroups = netapi32.NewProc("NetUserGetLocalGroups")
-)
-
-const (
-	// lgIncludeIndirect makes NetUserGetLocalGroups also return local groups
-	// the user belongs to through a global group.
-	lgIncludeIndirect  = 0x1
-	maxPreferredLength = 0xFFFFFFFF
-)
-
-// localGroupUsersInfo0 mirrors LOCALGROUP_USERS_INFO_0.
-type localGroupUsersInfo0 struct {
-	name *uint16
-}
-
-// isProcessElevated reports whether the current process token is elevated
-// (TokenElevation): true for elevated administrators, the built-in
-// Administrator, administrators with UAC disabled, and SYSTEM; false for
-// standard users and administrators running with a UAC-filtered token.
-func isProcessElevated() bool {
-	return windows.GetCurrentProcessToken().IsElevated()
-}
-
-// isWindowsAccountPrivilegedOrUnknown reports whether the account is privileged
-// on this machine: a well-known service account, a built-in Administrator
-// (RID 500), or a member of the local Administrators group, directly or through
-// nested groups.
-//
-// An account whose privilege cannot be determined counts as privileged, which
-// is why the name says "or unknown". That is fail-closed for a caller that
-// refuses privileged accounts, and fail-open for a caller that grants something
-// to them, so only the former may use this.
-func isWindowsAccountPrivilegedOrUnknown(username string) bool {
-	sid, _, _, err := windows.LookupSID("", username)
-	if err != nil {
-		log.Warnf("privilege check: SID lookup for %q failed, treating as privileged: %v", username, err)
-		return true
-	}
-
-	if isPrivilegedUserSID(sid) {
-		return true
-	}
-
-	member, err := isLocalAdminsMember(username)
-	if err != nil {
-		log.Warnf("privilege check: cannot determine Administrators membership for %q, treating as privileged: %v", username, err)
-		return true
-	}
-	return member
-}
-
-// isPrivilegedUserSID reports whether the SID itself identifies a privileged
-// principal, without consulting group membership.
-func isPrivilegedUserSID(sid *windows.SID) bool {
-	wellKnown := []windows.WELL_KNOWN_SID_TYPE{
-		windows.WinLocalSystemSid,
-		windows.WinLocalServiceSid,
-		windows.WinNetworkServiceSid,
-		windows.WinBuiltinAdministratorsSid,
-	}
-	for _, sidType := range wellKnown {
-		if sid.IsWellKnown(sidType) {
-			return true
-		}
-	}
-	return isBuiltinAdministratorSID(sid)
-}
-
-// isBuiltinAdministratorSID reports whether the SID is a machine or domain
-// built-in Administrator account (S-1-5-21-...-500). RID 500 is reserved for
-// that account; it can be renamed but cannot be removed from the
-// Administrators group.
-func isBuiltinAdministratorSID(sid *windows.SID) bool {
-	if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
-		return false
-	}
-	count := sid.SubAuthorityCount()
-	if count < 2 || sid.SubAuthority(0) != 21 {
-		return false
-	}
-	return sid.SubAuthority(uint32(count-1)) == 500
-}
-
-// isLocalAdminsMember reports whether the account is a member of the local
-// Administrators group.
-//
-// Local accounts are checked against the local SAM, which is authoritative for
-// them and, unlike a token, cannot under-report: UAC filters the tokens of
-// local administrators, and a filtered token carries Administrators as
-// deny-only, which a membership check on the token would read as "not a
-// member". Domain accounts are exempt from that filtering, so for them an S4U
-// token is preferred because its group list is LSA's transitive expansion and
-// therefore covers nested and universal groups plus the machine's own local
-// groups. NetUserGetLocalGroups expands only one global-group hop but needs no
-// logon, so it serves as the fallback when no token can be obtained.
-func isLocalAdminsMember(username string) (bool, error) {
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	if err != nil {
-		return false, fmt.Errorf("create Administrators SID: %w", err)
-	}
-
-	account, domain := parseUsername(username)
-	if NewPrivilegeDropper().isLocalUser(domain) {
-		return localGroupsContainSID(account, adminSid)
-	}
-
-	member, s4uErr := s4uTokenIsMember(account, domain, adminSid)
-	if s4uErr == nil {
-		return member, nil
-	}
-	log.Debugf("privilege check: S4U membership check for %q failed, falling back to local group enumeration: %v", username, s4uErr)
-
-	member, err = localGroupsContainSID(buildUserCpn(account, domain), adminSid)
-	if err != nil {
-		return false, fmt.Errorf("S4U check: %w; local group enumeration: %w", s4uErr, err)
-	}
-	return member, nil
-}
-
-// s4uTokenIsMember obtains an S4U token for the account and checks whether the
-// given SID is enabled in it.
-func s4uTokenIsMember(account, domain string, sid *windows.SID) (bool, error) {
-	token, err := generateS4UUserToken(log.NewEntry(log.StandardLogger()), account, domain)
-	if err != nil {
-		return false, err
-	}
-	defer func() {
-		if err := windows.CloseHandle(token); err != nil {
-			log.Debugf("close S4U token: %v", err)
-		}
-	}()
-	return windows.Token(token).IsMember(sid)
-}
-
-// localGroupsContainSID reports whether the wanted group is among the local
-// groups the account belongs to, directly or through a global group.
-//
-// The wanted SID is resolved to its group name once and compared against the
-// enumerated names. Well-known SIDs resolve from a static table, so that lookup
-// needs no domain controller, and it keeps the comparison correct for a renamed
-// or localized group because both sides then carry the new name. Resolving each
-// enumerated name back to a SID instead would add a lookup per group that can
-// block until it times out while a domain controller is unreachable, and cannot
-// change the outcome: the names enumerated here are local groups of this
-// machine, whose names are unique, so a name match identifies the group.
-//
-// A failure to resolve the wanted SID is returned rather than reported as
-// "not a member", so a privilege check built on this fails closed.
-func localGroupsContainSID(username string, want *windows.SID) (bool, error) {
-	wantName, _, _, err := want.LookupAccount("")
-	if err != nil {
-		return false, fmt.Errorf("resolve group SID %s to a name: %w", want, err)
-	}
-
-	groups, err := netUserGetLocalGroups(username)
-	if err != nil {
-		return false, err
-	}
-
-	for _, group := range groups {
-		if strings.EqualFold(group, wantName) {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-// netUserGetLocalGroups returns the names of the local groups the account is a
-// member of, including indirect membership through global groups.
-func netUserGetLocalGroups(username string) ([]string, error) {
-	name16, err := windows.UTF16PtrFromString(username)
-	if err != nil {
-		return nil, fmt.Errorf("convert username: %w", err)
-	}
-
-	var buf *byte
-	var entriesRead, totalEntries uint32
-	status, _, _ := procNetUserGetLocalGroups.Call(
-		0, // local server
-		uintptr(unsafe.Pointer(name16)),
-		0, // level 0: LOCALGROUP_USERS_INFO_0
-		lgIncludeIndirect,
-		uintptr(unsafe.Pointer(&buf)),
-		maxPreferredLength,
-		uintptr(unsafe.Pointer(&entriesRead)),
-		uintptr(unsafe.Pointer(&totalEntries)),
-	)
-	if status != 0 {
-		return nil, fmt.Errorf("NetUserGetLocalGroups for %q: status %d", username, status)
-	}
-	if buf == nil {
-		return nil, nil
-	}
-	defer func() {
-		if err := windows.NetApiBufferFree(buf); err != nil {
-			log.Debugf("free NetApi buffer: %v", err)
-		}
-	}()
-
-	// MAX_PREFERRED_LENGTH makes the API allocate as much as it needs, so a
-	// short read is not expected. Report it rather than silently returning a
-	// subset of the account's groups.
-	if entriesRead != totalEntries {
-		return nil, fmt.Errorf("NetUserGetLocalGroups for %q returned %d of %d groups", username, entriesRead, totalEntries)
-	}
-
-	entries := unsafe.Slice((*localGroupUsersInfo0)(unsafe.Pointer(buf)), entriesRead)
-	groups := make([]string, 0, entriesRead)
-	for _, entry := range entries {
-		groups = append(groups, windows.UTF16PtrToString(entry.name))
-	}
-	return groups, nil
-}

client/ssh/server/privileges_windows_test.go

@@ -1,293 +0,0 @@
-//go:build windows
-
-package server
-
-import (
-	"os/user"
-	"testing"
-	"unsafe"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sys/windows"
-)
-
-// filterNormalAccount limits NetUserEnum to normal user accounts.
-const filterNormalAccount = 0x2
-
-// TOKEN_ELEVATION_TYPE values.
-const (
-	tokenElevationTypeDefault = 1
-	tokenElevationTypeFull    = 2
-	tokenElevationTypeLimited = 3
-)
-
-// tokenElevationType reads TokenElevationType from a token.
-func tokenElevationType(token windows.Token) (uint32, error) {
-	var elevationType, returnedLen uint32
-	err := windows.GetTokenInformation(token, windows.TokenElevationType,
-		(*byte)(unsafe.Pointer(&elevationType)), uint32(unsafe.Sizeof(elevationType)), &returnedLen)
-	if err != nil {
-		return 0, err
-	}
-	return elevationType, nil
-}
-
-// userInfo0 mirrors USER_INFO_0.
-type userInfo0 struct {
-	name *uint16
-}
-
-func mustParseSID(t *testing.T, s string) *windows.SID {
-	t.Helper()
-	sid, err := windows.StringToSid(s)
-	require.NoError(t, err, "parse SID %s", s)
-	return sid
-}
-
-// localAccountNames returns the names of the local user accounts.
-func localAccountNames(t *testing.T) []string {
-	t.Helper()
-
-	var buf *byte
-	var entriesRead, totalEntries, resume uint32
-	err := windows.NetUserEnum(nil, 0, filterNormalAccount, &buf, maxPreferredLength,
-		&entriesRead, &totalEntries, &resume)
-	require.NoError(t, err, "enumerate local users")
-	t.Cleanup(func() {
-		require.NoError(t, windows.NetApiBufferFree(buf), "free NetApi buffer")
-	})
-
-	entries := unsafe.Slice((*userInfo0)(unsafe.Pointer(buf)), entriesRead)
-	names := make([]string, 0, entriesRead)
-	for _, entry := range entries {
-		names = append(names, windows.UTF16PtrToString(entry.name))
-	}
-	return names
-}
-
-// localAccountNameByRID returns the name of the local account carrying the
-// given RID. Accounts such as Administrator and Guest can be renamed and are
-// localized, so tests must not name them literally.
-func localAccountNameByRID(t *testing.T, rid uint32) string {
-	t.Helper()
-
-	for _, name := range localAccountNames(t) {
-		sid, _, _, err := windows.LookupSID("", name)
-		if err != nil {
-			continue
-		}
-		if sid.IdentifierAuthority() != windows.SECURITY_NT_AUTHORITY {
-			continue
-		}
-		count := sid.SubAuthorityCount()
-		if count < 2 || sid.SubAuthority(0) != 21 {
-			continue
-		}
-		if sid.SubAuthority(uint32(count-1)) == rid {
-			return name
-		}
-	}
-
-	t.Fatalf("no local account with RID %d", rid)
-	return ""
-}
-
-// wellKnownAccountName resolves a well-known SID to the qualified account name
-// the local system uses for it, which is localized.
-func wellKnownAccountName(t *testing.T, sidType windows.WELL_KNOWN_SID_TYPE) string {
-	t.Helper()
-
-	sid, err := windows.CreateWellKnownSid(sidType)
-	require.NoError(t, err, "create well-known SID")
-	name, domain, _, err := sid.LookupAccount("")
-	require.NoError(t, err, "resolve %s to an account name", sid)
-	if domain == "" {
-		return name
-	}
-	return domain + `\` + name
-}
-
-func TestIsBuiltinAdministratorSID(t *testing.T) {
-	tests := []struct {
-		name string
-		sid  string
-		want bool
-	}{
-		{"machine_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
-		{"domain_administrator", "S-1-5-21-3390233681-4087452608-412898826-500", true},
-		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
-		{"guest_account", "S-1-5-21-1111111111-2222222222-3333333333-501", false},
-		{"domain_admins_group", "S-1-5-21-1111111111-2222222222-3333333333-512", false},
-		{"system", "S-1-5-18", false},
-		{"administrators_group", "S-1-5-32-544", false},
-		{"non_nt_authority", "S-1-1-0", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isBuiltinAdministratorSID(mustParseSID(t, tt.sid))
-			assert.Equal(t, tt.want, result, "RID 500 detection for %s", tt.sid)
-		})
-	}
-}
-
-func TestIsPrivilegedUserSID(t *testing.T) {
-	tests := []struct {
-		name string
-		sid  string
-		want bool
-	}{
-		{"local_system", "S-1-5-18", true},
-		{"local_service", "S-1-5-19", true},
-		{"network_service", "S-1-5-20", true},
-		{"administrators_group", "S-1-5-32-544", true},
-		{"builtin_administrator", "S-1-5-21-1111111111-2222222222-3333333333-500", true},
-		{"regular_user", "S-1-5-21-1111111111-2222222222-3333333333-1001", false},
-		{"users_group", "S-1-5-32-545", false},
-		{"everyone", "S-1-1-0", false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isPrivilegedUserSID(mustParseSID(t, tt.sid))
-			assert.Equal(t, tt.want, result, "SID privilege classification for %s", tt.sid)
-		})
-	}
-}
-
-func TestIsWindowsAccountPrivilegedOrUnknown(t *testing.T) {
-	tests := []struct {
-		name     string
-		username string
-		want     bool
-	}{
-		{"system", wellKnownAccountName(t, windows.WinLocalSystemSid), true},
-		{"local_service", wellKnownAccountName(t, windows.WinLocalServiceSid), true},
-		{"network_service", wellKnownAccountName(t, windows.WinNetworkServiceSid), true},
-		{"administrators_group", wellKnownAccountName(t, windows.WinBuiltinAdministratorsSid), true},
-		// The built-in Administrator (RID 500) and Guest (RID 501) accounts
-		// exist on every Windows installation, though they may be disabled.
-		{"builtin_administrator", localAccountNameByRID(t, 500), true},
-		{"guest", localAccountNameByRID(t, 501), false},
-		// Unresolvable accounts fail closed.
-		{"nonexistent_user", "netbird-no-such-user", true},
-		{"empty_username", "", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isWindowsAccountPrivilegedOrUnknown(tt.username)
-			assert.Equal(t, tt.want, result, "account privilege classification for %q", tt.username)
-		})
-	}
-}
-
-func TestIsProcessElevated(t *testing.T) {
-	elevated := isProcessElevated()
-
-	// TokenElevationType is a second, independent view of the same token:
-	// Full means elevated and Limited means a filtered administrator, while
-	// Default covers both a standard user and an administrator with no linked
-	// token (UAC off, the built-in Administrator, SYSTEM), so it implies nothing.
-	elevationType, err := tokenElevationType(windows.GetCurrentProcessToken())
-	require.NoError(t, err, "read token elevation type")
-
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	// Token(0) makes CheckTokenMembership evaluate the caller's own token. It
-	// counts only enabled SIDs, so a filtered administrator reports false here.
-	member, err := windows.Token(0).IsMember(adminSid)
-	require.NoError(t, err, "check own Administrators membership")
-
-	t.Logf("elevated=%v elevationType=%d memberOfAdministrators=%v", elevated, elevationType, member)
-
-	switch elevationType {
-	case tokenElevationTypeFull:
-		assert.True(t, elevated, "a token of elevation type Full must report elevated")
-	case tokenElevationTypeLimited:
-		assert.False(t, elevated, "a filtered administrator token must not report elevated")
-	}
-
-	// Administrators enabled in the token means the token wields administrative
-	// rights, which is what elevation reports.
-	if member {
-		assert.True(t, elevated, "token with enabled Administrators membership must report elevated")
-	}
-}
-
-// TestS4UMembershipAgreesWithLocalGroups exercises the S4U token path used
-// for domain accounts. S4U logons need the TCB privilege, so the test runs
-// only as SYSTEM (which is how CI executes the suite). For local accounts the
-// token's Administrators membership must agree with the SAM enumeration.
-func TestS4UMembershipAgreesWithLocalGroups(t *testing.T) {
-	system, err := windows.CreateWellKnownSid(windows.WinLocalSystemSid)
-	require.NoError(t, err, "create SYSTEM SID")
-	current, err := user.Current()
-	require.NoError(t, err, "get current user")
-	if current.Uid != system.String() {
-		t.Skipf("S4U logon requires SYSTEM (running as %s)", current.Username)
-	}
-
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	checked := 0
-	for _, name := range localAccountNames(t) {
-		viaToken, err := s4uTokenIsMember(name, ".", adminSid)
-		if err != nil {
-			// Disabled or logon-restricted accounts cannot get an S4U logon.
-			t.Logf("skipping %s: %v", name, err)
-			continue
-		}
-		viaSAM, err := localGroupsContainSID(name, adminSid)
-		require.NoError(t, err, "enumerate local groups for %s", name)
-
-		assert.Equal(t, viaSAM, viaToken, "S4U token and SAM enumeration must agree on Administrators membership for %s", name)
-		checked++
-	}
-	// Ineligible accounts are skipped, so without this the test could report
-	// success while comparing nothing at all.
-	require.Positive(t, checked, "no local account completed an S4U logon, so nothing was compared")
-	t.Logf("checked %d local accounts via S4U", checked)
-}
-
-// TestLocalGroupsContainSID_Administrator checks the positive case against the
-// built-in Administrator, a member of Administrators on every installation.
-func TestLocalGroupsContainSID_Administrator(t *testing.T) {
-	adminSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	administrator := localAccountNameByRID(t, 500)
-	member, err := localGroupsContainSID(administrator, adminSid)
-	require.NoError(t, err, "enumerate local groups for %s", administrator)
-	assert.True(t, member, "%s is a member of the Administrators group", administrator)
-}
-
-// TestLocalGroupsContainSID_UnresolvableGroupFailsClosed covers a wanted SID
-// that resolves to no group: the error must surface rather than being reported
-// as "not a member", so the privilege check treats the account as privileged.
-func TestLocalGroupsContainSID_UnresolvableGroupFailsClosed(t *testing.T) {
-	unknown := mustParseSID(t, "S-1-5-21-1111111111-2222222222-3333333333-4444")
-
-	_, err := localGroupsContainSID(localAccountNameByRID(t, 500), unknown)
-	require.Error(t, err, "must report an error when the wanted group cannot be identified")
-}
-
-func TestLocalGroupsContainSID_Guest(t *testing.T) {
-	guestsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinGuestsSid)
-	require.NoError(t, err, "create Guests SID")
-	adminsSid, err := windows.CreateWellKnownSid(windows.WinBuiltinAdministratorsSid)
-	require.NoError(t, err, "create Administrators SID")
-
-	guest := localAccountNameByRID(t, 501)
-
-	inGuests, err := localGroupsContainSID(guest, guestsSid)
-	require.NoError(t, err, "enumerate local groups for %s", guest)
-	assert.True(t, inGuests, "%s is a member of the Guests group", guest)
-
-	inAdmins, err := localGroupsContainSID(guest, adminsSid)
-	require.NoError(t, err, "enumerate local groups for %s", guest)
-	assert.False(t, inAdmins, "%s is not a member of the Administrators group", guest)
-}

client/ssh/server/server_config_test.go

@@ -239,7 +239,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 		forwardType   string
 		port          uint32
 		username      string
-		uid           string
 		expectError   bool
 		errorMsg      string
 		skipOnWindows bool
@@ -249,7 +248,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType:   "remote",
 			port:          80,
 			username:      "testuser",
-			uid:           "1000",
 			expectError:   true,
 			errorMsg:      "cannot bind to privileged port",
 			skipOnWindows: true,
@@ -259,7 +257,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType:   "tcpip-forward",
 			port:          443,
 			username:      "testuser",
-			uid:           "1000",
 			expectError:   true,
 			errorMsg:      "cannot bind to privileged port",
 			skipOnWindows: true,
@@ -269,7 +266,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        8080,
 			username:    "testuser",
-			uid:         "1000",
 			expectError: false,
 		},
 		{
@@ -277,7 +273,6 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        0,
 			username:    "testuser",
-			uid:         "1000",
 			expectError: false,
 		},
 		{
@@ -285,35 +280,13 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 			forwardType: "remote",
 			port:        22,
 			username:    "root",
-			uid:         "0",
 			expectError: false,
 		},
-		{
-			// Only uid 0 is privileged, whatever the account is called.
-			name:          "uid 0 under another name may bind a privileged port",
-			forwardType:   "remote",
-			port:          22,
-			username:      "toor",
-			uid:           "0",
-			expectError:   false,
-			skipOnWindows: true,
-		},
-		{
-			name:          "account named root without uid 0 may not",
-			forwardType:   "remote",
-			port:          22,
-			username:      "root",
-			uid:           "1000",
-			expectError:   true,
-			errorMsg:      "cannot bind to privileged port",
-			skipOnWindows: true,
-		},
 		{
 			name:        "local forward privileged port allowed for non-root",
 			forwardType: "local",
 			port:        80,
 			username:    "testuser",
-			uid:         "1000",
 			expectError: false,
 		},
 	}
@@ -326,7 +299,7 @@ func TestServer_PrivilegedPortAccess(t *testing.T) {
 
 			result := PrivilegeCheckResult{
 				Allowed: true,
-				User:    &user.User{Username: tt.username, Uid: tt.uid},
+				User:    &user.User{Username: tt.username},
 			}
 
 			err := server.checkPrivilegedPortAccess(tt.forwardType, tt.port, result)
@@ -447,13 +420,6 @@ func TestServer_PortConflictHandling(t *testing.T) {
 
 func TestServer_IsPrivilegedUser(t *testing.T) {
 
-	// Windows classification depends on account SIDs and group membership, and
-	// the accounts involved carry localized, renameable names. It is covered by
-	// TestIsWindowsAccountPrivileged, which resolves them from well-known SIDs.
-	if runtime.GOOS == "windows" {
-		t.Skip("covered by TestIsWindowsAccountPrivileged")
-	}
-
 	tests := []struct {
 		username    string
 		expected    bool
@@ -474,16 +440,44 @@ func TestServer_IsPrivilegedUser(t *testing.T) {
 			expected:    false,
 			description: "empty username should not be privileged",
 		},
-		{
-			username:    "Administrator",
-			expected:    false,
-			description: "Administrator should not be privileged on non-Windows systems",
-		},
+	}
+
+	// Add Windows-specific tests
+	if runtime.GOOS == "windows" {
+		tests = append(tests, []struct {
+			username    string
+			expected    bool
+			description string
+		}{
+			{
+				username:    "Administrator",
+				expected:    true,
+				description: "Administrator should be considered privileged on Windows",
+			},
+			{
+				username:    "administrator",
+				expected:    true,
+				description: "administrator should be considered privileged on Windows (case insensitive)",
+			},
+		}...)
+	} else {
+		// On non-Windows systems, Administrator should not be privileged
+		tests = append(tests, []struct {
+			username    string
+			expected    bool
+			description string
+		}{
+			{
+				username:    "Administrator",
+				expected:    false,
+				description: "Administrator should not be privileged on non-Windows systems",
+			},
+		}...)
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.description, func(t *testing.T) {
-			result := isPrivilegedOrUnknown(tt.username)
+			result := isPrivilegedUsername(tt.username)
 			assert.Equal(t, tt.expected, result, tt.description)
 		})
 	}

client/ssh/server/sftp_windows.go

@@ -17,7 +17,7 @@ import (
 // createSftpCommand creates a Windows SFTP command with user switching.
 // The caller must close the returned token handle after starting the process.
 func (s *Server) createSftpCommand(targetUser *user.User, sess ssh.Session) (*exec.Cmd, windows.Token, error) {
-	username, domain := parseUsername(targetUser.Username)
+	username, domain := s.parseUsername(targetUser.Username)
 
 	netbirdPath, err := os.Executable()
 	if err != nil {

client/ssh/server/user_utils.go

@@ -16,6 +16,11 @@ var (
 	ErrPrivilegedUserSwitch = errors.New("cannot switch to privileged user - current user lacks required privileges")
 )
 
+// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
+func isPlatformUnix() bool {
+	return getCurrentOS() != "windows"
+}
+
 // Dependency injection variables for testing - allows mocking dynamic runtime checks
 var (
 	getCurrentUser         = currentUserWithGetent
@@ -24,9 +29,6 @@ var (
 	getIsProcessPrivileged = isCurrentProcessPrivileged
 
 	getEuid = os.Geteuid
-
-	getProcessElevated                   = isProcessElevated
-	getWindowsAccountPrivilegedOrUnknown = isWindowsAccountPrivilegedOrUnknown
 )
 
 const (
@@ -63,13 +65,6 @@ type PrivilegeCheckResult struct {
 	RequiresUserSwitching bool
 }
 
-// privilegeCheckContext holds all context needed for privilege checking
-type privilegeCheckContext struct {
-	currentUser           *user.User
-	currentUserPrivileged bool
-	allowRoot             bool
-}
-
 // CheckPrivileges performs comprehensive privilege checking for all SSH features.
 // This is the single source of truth for privilege decisions across the SSH server.
 func (s *Server) CheckPrivileges(req PrivilegeCheckRequest) PrivilegeCheckResult {
@@ -80,7 +75,7 @@ func (s *Server) CheckPrivileges(req PrivilegeCheckRequest) PrivilegeCheckResult
 
 	// Handle empty username case - but still check root access controls
 	if req.RequestedUsername == "" {
-		if isPrivilegedOrUnknown(context.currentUser.Username) && !context.allowRoot {
+		if isPrivilegedUsername(context.currentUser.Username) && !context.allowRoot {
 			return PrivilegeCheckResult{
 				Allowed: false,
 				Error:   &PrivilegedUserError{Username: context.currentUser.Username},
@@ -140,7 +135,7 @@ func (s *Server) checkUserRequest(ctx *privilegeCheckContext, req PrivilegeCheck
 
 	needsUserSwitching := !isSameResolvedUser(resolvedUser, ctx.currentUser)
 
-	if isPrivilegedOrUnknown(resolvedUser.Username) && !ctx.allowRoot {
+	if isPrivilegedUsername(resolvedUser.Username) && !ctx.allowRoot {
 		return PrivilegeCheckResult{
 			Allowed:               false,
 			Error:                 &PrivilegedUserError{Username: resolvedUser.Username},
@@ -180,42 +175,6 @@ func (s *Server) resolveRequestedUser(requestedUsername string) (*user.User, err
 	return u, nil
 }
 
-// SetAllowRootLogin configures root login access
-func (s *Server) SetAllowRootLogin(allow bool) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.allowRootLogin = allow
-}
-
-// userNameLookup performs user lookup with root login permission check
-func (s *Server) userNameLookup(username string) (*user.User, error) {
-	result, err := s.userPrivilegeCheck(username)
-	if err != nil {
-		return nil, err
-	}
-	return result.User, nil
-}
-
-// userPrivilegeCheck performs user lookup with full privilege check result
-func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
-	result := s.CheckPrivileges(PrivilegeCheckRequest{
-		RequestedUsername:         username,
-		FeatureSupportsUserSwitch: true,
-		FeatureName:               FeatureSSHLogin,
-	})
-
-	if !result.Allowed {
-		return result, result.Error
-	}
-
-	return result, nil
-}
-
-// isPlatformUnix returns true for Unix-like platforms (Linux, macOS, etc.)
-func isPlatformUnix() bool {
-	return getCurrentOS() != "windows"
-}
-
 // isSameResolvedUser compares two resolved user identities
 func isSameResolvedUser(user1, user2 *user.User) bool {
 	if user1 == nil || user2 == nil {
@@ -224,6 +183,13 @@ func isSameResolvedUser(user1, user2 *user.User) bool {
 	return user1.Uid == user2.Uid
 }
 
+// privilegeCheckContext holds all context needed for privilege checking
+type privilegeCheckContext struct {
+	currentUser           *user.User
+	currentUserPrivileged bool
+	allowRoot             bool
+}
+
 // isSameUser checks if two usernames refer to the same user
 // SECURITY: This function must be conservative - it should only return true
 // when we're certain both usernames refer to the exact same user identity
@@ -287,30 +253,159 @@ func isWindowsSameUser(requestedUsername, currentUsername string) bool {
 	return strings.EqualFold(reqDomain, curDomain)
 }
 
-// isPrivilegedOrUnknown reports whether the given username represents a
-// privileged user, or on Windows an account whose privilege could not be
-// determined.
-// On Unix: root.
-// On Windows: well-known service accounts, built-in Administrator accounts,
-// and members of the local Administrators group; handles domain-qualified
-// usernames like "DOMAIN\user" or "user@domain.com". An account that cannot be
-// resolved or evaluated is reported as privileged.
-//
-// Use this to refuse privileged accounts, never to grant them anything: the
-// undetermined case is safe for a refusal and unsafe for a grant.
-func isPrivilegedOrUnknown(username string) bool {
+// SetAllowRootLogin configures root login access
+func (s *Server) SetAllowRootLogin(allow bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.allowRootLogin = allow
+}
+
+// userNameLookup performs user lookup with root login permission check
+func (s *Server) userNameLookup(username string) (*user.User, error) {
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         username,
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               FeatureSSHLogin,
+	})
+
+	if !result.Allowed {
+		return nil, result.Error
+	}
+
+	return result.User, nil
+}
+
+// userPrivilegeCheck performs user lookup with full privilege check result
+func (s *Server) userPrivilegeCheck(username string) (PrivilegeCheckResult, error) {
+	result := s.CheckPrivileges(PrivilegeCheckRequest{
+		RequestedUsername:         username,
+		FeatureSupportsUserSwitch: true,
+		FeatureName:               FeatureSSHLogin,
+	})
+
+	if !result.Allowed {
+		return result, result.Error
+	}
+
+	return result, nil
+}
+
+// isPrivilegedUsername checks if the given username represents a privileged user across platforms.
+// On Unix: root
+// On Windows: Administrator, SYSTEM (case-insensitive)
+// Handles domain-qualified usernames like "DOMAIN\Administrator" or "user@domain.com"
+func isPrivilegedUsername(username string) bool {
 	if getCurrentOS() != "windows" {
 		return username == "root"
 	}
-	return getWindowsAccountPrivilegedOrUnknown(username)
+
+	bareUsername := username
+	// Handle Windows domain format: DOMAIN\username
+	if idx := strings.LastIndex(username, `\`); idx != -1 {
+		bareUsername = username[idx+1:]
+	}
+	// Handle email-style format: username@domain.com
+	if idx := strings.Index(bareUsername, "@"); idx != -1 {
+		bareUsername = bareUsername[:idx]
+	}
+
+	return isWindowsPrivilegedUser(bareUsername)
+}
+
+// isWindowsPrivilegedUser checks if a bare username (domain already stripped) represents a Windows privileged account
+func isWindowsPrivilegedUser(bareUsername string) bool {
+	// common privileged usernames (case insensitive)
+	privilegedNames := []string{
+		"administrator",
+		"admin",
+		"root",
+		"system",
+		"localsystem",
+		"networkservice",
+		"localservice",
+	}
+
+	usernameLower := strings.ToLower(bareUsername)
+	for _, privilegedName := range privilegedNames {
+		if usernameLower == privilegedName {
+			return true
+		}
+	}
+
+	// computer accounts (ending with $) are not privileged by themselves
+	// They only gain privileges through group membership or specific SIDs
+
+	if targetUser, err := lookupUser(bareUsername); err == nil {
+		return isWindowsPrivilegedSID(targetUser.Uid)
+	}
+
+	return false
+}
+
+// isWindowsPrivilegedSID checks if a Windows SID represents a privileged account
+func isWindowsPrivilegedSID(sid string) bool {
+	privilegedSIDs := []string{
+		"S-1-5-18",     // Local System (SYSTEM)
+		"S-1-5-19",     // Local Service (NT AUTHORITY\LOCAL SERVICE)
+		"S-1-5-20",     // Network Service (NT AUTHORITY\NETWORK SERVICE)
+		"S-1-5-32-544", // Administrators group (BUILTIN\Administrators)
+		"S-1-5-500",    // Built-in Administrator account (local machine RID 500)
+	}
+
+	for _, privilegedSID := range privilegedSIDs {
+		if sid == privilegedSID {
+			return true
+		}
+	}
+
+	// Check for domain administrator accounts (RID 500 in any domain)
+	// Format: S-1-5-21-domain-domain-domain-500
+	// This is reliable as RID 500 is reserved for the domain Administrator account
+	if strings.HasPrefix(sid, "S-1-5-21-") && strings.HasSuffix(sid, "-500") {
+		return true
+	}
+
+	// Check for other well-known privileged RIDs in domain contexts
+	// RID 512 = Domain Admins group, RID 516 = Domain Controllers group
+	if strings.HasPrefix(sid, "S-1-5-21-") {
+		if strings.HasSuffix(sid, "-512") || // Domain Admins group
+			strings.HasSuffix(sid, "-516") || // Domain Controllers group
+			strings.HasSuffix(sid, "-519") { // Enterprise Admins group
+			return true
+		}
+	}
+
+	return false
 }
 
 // isCurrentProcessPrivileged checks if the current process is running with elevated privileges.
 // On Unix systems, this means running as root (UID 0).
-// On Windows, this means the process token is elevated (administrators, SYSTEM).
+// On Windows, this means running as Administrator or SYSTEM.
 func isCurrentProcessPrivileged() bool {
 	if getCurrentOS() == "windows" {
-		return getProcessElevated()
+		return isWindowsElevated()
 	}
 	return getEuid() == 0
 }
+
+// isWindowsElevated checks if the current process is running with elevated privileges on Windows
+func isWindowsElevated() bool {
+	currentUser, err := getCurrentUser()
+	if err != nil {
+		log.Errorf("failed to get current user for privilege check, assuming non-privileged: %v", err)
+		return false
+	}
+
+	if isWindowsPrivilegedSID(currentUser.Uid) {
+		log.Debugf("Windows user switching supported: running as privileged SID %s", currentUser.Uid)
+		return true
+	}
+
+	if isPrivilegedUsername(currentUser.Username) {
+		log.Debugf("Windows user switching supported: running as privileged username %s", currentUser.Username)
+		return true
+	}
+
+	log.Debugf("Windows user switching not supported: not running as privileged user (current: %s)", currentUser.Uid)
+	return false
+}

client/ssh/server/user_utils_test.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"os/user"
 	"runtime"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -28,8 +27,8 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 	originalLookupUser := lookupUser
 	originalGetCurrentOS := getCurrentOS
 	originalGetEuid := getEuid
-	originalGetProcessElevated := getProcessElevated
-	originalGetWindowsAccountPrivilegedOrUnknown := getWindowsAccountPrivilegedOrUnknown
+
+	// Reset caches to ensure clean test state
 
 	// Set test values - inject platform dependencies
 	getCurrentUser = func() (*user.User, error) {
@@ -54,31 +53,16 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 		return euid
 	}
 
-	// Simulate the Windows token elevation check based on the fixture user:
-	// the built-in Administrator (RID 500) and SYSTEM run elevated.
-	getProcessElevated = func() bool {
+	// Mock privilege detection based on the test user
+	getIsProcessPrivileged = func() bool {
 		if currentUser == nil {
 			return false
 		}
-		return currentUser.Uid == "S-1-5-18" || strings.HasSuffix(currentUser.Uid, "-500")
-	}
-
-	// Simulate the Windows account classifier for the fixture accounts.
-	// "root" does not exist on Windows; the real classifier fails closed on
-	// unresolvable accounts, so it counts as privileged here too.
-	getWindowsAccountPrivilegedOrUnknown = func(username string) bool {
-		bare := username
-		if idx := strings.LastIndex(bare, `\`); idx != -1 {
-			bare = bare[idx+1:]
-		}
-		if idx := strings.Index(bare, "@"); idx != -1 {
-			bare = bare[:idx]
-		}
-		switch strings.ToLower(bare) {
-		case "administrator", "system", "root":
+		// Check both username and SID for Windows systems
+		if os == "windows" && isWindowsPrivilegedSID(currentUser.Uid) {
 			return true
 		}
-		return false
+		return isPrivilegedUsername(currentUser.Username)
 	}
 
 	// Return cleanup function
@@ -87,8 +71,10 @@ func setupTestDependencies(currentUser *user.User, currentUserErr error, os stri
 		lookupUser = originalLookupUser
 		getCurrentOS = originalGetCurrentOS
 		getEuid = originalGetEuid
-		getProcessElevated = originalGetProcessElevated
-		getWindowsAccountPrivilegedOrUnknown = originalGetWindowsAccountPrivilegedOrUnknown
+
+		getIsProcessPrivileged = isCurrentProcessPrivileged
+
+		// Reset caches after test
 	}
 }
 
@@ -435,9 +421,6 @@ func TestUsedFallback_MeansNoPrivilegeDropping(t *testing.T) {
 }
 
 func TestPrivilegedUsernameDetection(t *testing.T) {
-	// Windows classification is syscall-backed (SID resolution, group
-	// membership) and is covered by privileges_windows_test.go; here only the
-	// Unix logic and the platform dispatch are exercised.
 	tests := []struct {
 		name       string
 		username   string
@@ -449,9 +432,25 @@ func TestPrivilegedUsernameDetection(t *testing.T) {
 		{"unix_regular_user", "alice", "linux", false},
 		{"unix_root_capital", "Root", "linux", false}, // Case-sensitive
 
-		// Windows dispatch to the (mocked) account classifier
+		// Windows tests
 		{"windows_administrator", "Administrator", "windows", true},
+		{"windows_system", "SYSTEM", "windows", true},
+		{"windows_admin", "admin", "windows", true},
+		{"windows_admin_lowercase", "administrator", "windows", true}, // Case-insensitive
+		{"windows_domain_admin", "DOMAIN\\Administrator", "windows", true},
+		{"windows_email_admin", "admin@domain.com", "windows", true},
 		{"windows_regular_user", "alice", "windows", false},
+		{"windows_domain_user", "DOMAIN\\alice", "windows", false},
+		{"windows_localsystem", "localsystem", "windows", true},
+		{"windows_networkservice", "networkservice", "windows", true},
+		{"windows_localservice", "localservice", "windows", true},
+
+		// Computer accounts (these depend on current user context in real implementation)
+		{"windows_computer_account", "WIN2K19-C2$", "windows", false},      // Computer account by itself not privileged
+		{"windows_domain_computer", "DOMAIN\\COMPUTER$", "windows", false}, // Domain computer account
+
+		// Cross-platform
+		{"root_on_windows", "root", "windows", true}, // Root should be privileged everywhere
 	}
 
 	for _, tt := range tests {
@@ -460,8 +459,50 @@ func TestPrivilegedUsernameDetection(t *testing.T) {
 			cleanup := setupTestDependencies(nil, nil, tt.platform, 1000, nil, nil)
 			defer cleanup()
 
-			result := isPrivilegedOrUnknown(tt.username)
-			assert.Equal(t, tt.privileged, result, "privilege classification for %s on %s", tt.username, tt.platform)
+			result := isPrivilegedUsername(tt.username)
+			assert.Equal(t, tt.privileged, result)
+		})
+	}
+}
+
+func TestWindowsPrivilegedSIDDetection(t *testing.T) {
+	tests := []struct {
+		name        string
+		sid         string
+		privileged  bool
+		description string
+	}{
+		// Well-known system accounts
+		{"system_account", "S-1-5-18", true, "Local System (SYSTEM)"},
+		{"local_service", "S-1-5-19", true, "Local Service"},
+		{"network_service", "S-1-5-20", true, "Network Service"},
+		{"administrators_group", "S-1-5-32-544", true, "Administrators group"},
+		{"builtin_administrator", "S-1-5-500", true, "Built-in Administrator"},
+
+		// Domain accounts
+		{"domain_administrator", "S-1-5-21-1234567890-1234567890-1234567890-500", true, "Domain Administrator (RID 500)"},
+		{"domain_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-512", true, "Domain Admins group"},
+		{"domain_controllers_group", "S-1-5-21-1234567890-1234567890-1234567890-516", true, "Domain Controllers group"},
+		{"enterprise_admins_group", "S-1-5-21-1234567890-1234567890-1234567890-519", true, "Enterprise Admins group"},
+
+		// Regular users
+		{"regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1001", false, "Regular domain user"},
+		{"another_regular_user", "S-1-5-21-1234567890-1234567890-1234567890-1234", false, "Another regular user"},
+		{"local_user", "S-1-5-21-1234567890-1234567890-1234567890-1000", false, "Local regular user"},
+
+		// Groups that are not privileged
+		{"domain_users", "S-1-5-21-1234567890-1234567890-1234567890-513", false, "Domain Users group"},
+		{"power_users", "S-1-5-32-547", false, "Power Users group"},
+
+		// Invalid SIDs
+		{"malformed_sid", "S-1-5-invalid", false, "Malformed SID"},
+		{"empty_sid", "", false, "Empty SID"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := isWindowsPrivilegedSID(tt.sid)
+			assert.Equal(t, tt.privileged, result, "Failed for %s: %s", tt.description, tt.sid)
 		})
 	}
 }

client/ssh/server/userswitching_windows.go

@@ -91,7 +91,7 @@ func validateUsernameFormat(username string) error {
 func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, localUser *user.User, hasPty bool) (*exec.Cmd, func(), error) {
 	logger.Debugf("creating Windows executor command for user %s (Pty: %v)", localUser.Username, hasPty)
 
-	username, _ := parseUsername(localUser.Username)
+	username, _ := s.parseUsername(localUser.Username)
 	if err := validateUsername(username); err != nil {
 		return nil, nil, fmt.Errorf("invalid username %q: %w", username, err)
 	}
@@ -102,7 +102,7 @@ func (s *Server) createExecutorCommand(logger *log.Entry, session ssh.Session, l
 // createUserSwitchCommand creates a command with Windows user switching.
 // Returns the command and a cleanup function that must be called after starting the process.
 func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session, localUser *user.User) (*exec.Cmd, func(), error) {
-	username, domain := parseUsername(localUser.Username)
+	username, domain := s.parseUsername(localUser.Username)
 
 	shell := getUserShell(localUser.Uid)
 
@@ -138,7 +138,7 @@ func (s *Server) createUserSwitchCommand(logger *log.Entry, session ssh.Session,
 }
 
 // parseUsername extracts username and domain from a Windows username
-func parseUsername(fullUsername string) (username, domain string) {
+func (s *Server) parseUsername(fullUsername string) (username, domain string) {
 	// Handle DOMAIN\username format
 	if idx := strings.LastIndex(fullUsername, `\`); idx != -1 {
 		domain = fullUsername[:idx]

client/ui/authsession/service.go

@@ -58,8 +58,7 @@ func (s *Session) RequestExtend(ctx context.Context, p ExtendStartParams) (Exten
 		return ExtendStartResult{}, err
 	}
 
-	// a request from the UI implies a graphical session, which the daemon cannot detect itself
-	req := &proto.RequestExtendAuthSessionRequest{HasGraphicalSession: true}
+	req := &proto.RequestExtendAuthSessionRequest{}
 	if p.Hint != "" {
 		h := p.Hint
 		req.Hint = &h

client/ui/frontend/package.json

@@ -15,8 +15,7 @@
     "lint": "eslint \"src/**/*.{ts,tsx}\"",
     "lint:fix": "eslint \"src/**/*.{ts,tsx}\" --fix",
     "check": "pnpm lint && pnpm typecheck && pnpm format:check",
-    "check:fix": "pnpm lint:fix && pnpm format && pnpm typecheck",
-    "i18n:check": "node ../i18n/check-translations.mjs"
+    "check:fix": "pnpm lint:fix && pnpm format && pnpm typecheck"
   },
   "dependencies": {
     "@radix-ui/react-dialog": "^1.1.15",

client/ui/i18n/TRANSLATING.md

@@ -2,24 +2,9 @@
 
 A short brief for translating the desktop UI — for any translator, human or AI agent (*"you"* = whoever's translating).
 
-**Translations are managed on Crowdin: <https://crowdin.com/project/netbird>.** Join the project, pick your language, and translate in the editor. Each string carries a context note (the `description` from the source file) telling you what it is and where it shows up, and the project's glossary, style guide, and QA checks mirror this document.
+**Drive an agent with:** *"Read `i18n/TRANSLATING.md` and translate the UI to Russian"* — or *"…and review the existing German translation."*
 
-> 💡 **The one habit that matters most:** read each string's context before translating it. Labels are terse and ambiguous on their own; the context tells you what the string is, where it shows up, what to keep verbatim, and what it actually means.
-
----
-
-## How contributions flow
-
-```text
-i18n/locales/en/common.json ──sync──▶ Crowdin ──service PR──▶ i18n/locales/<code>/common.json
-```
-
-- `i18n/locales/en/common.json` is the source of truth. New and changed strings sync to Crowdin automatically (see `crowdin.yml` in the repository root).
-- Crowdin opens and updates a service pull request with the translated bundles, keeping the source's file shape and key order. Keys nobody has translated yet are left out of the export; the app falls back to English for them at runtime. Maintainers review and merge that PR.
-- Don't hand-edit `i18n/locales/<code>/common.json` in your own PRs: the next sync would conflict with or overwrite your changes. Translate on Crowdin instead.
-- Missing your language? Request it on the Crowdin project page or in a [GitHub discussion](https://github.com/netbirdio/netbird/discussions). When a language first ships, a maintainer adds its row to `i18n/locales/_index.json` with `code`, `displayName` (the native name), and `englishName`, which puts it in the app's language picker.
-
-**Prefer translating with an AI agent?** That still works: drive it with *"Read `i18n/TRANSLATING.md` and translate the UI to Russian"* as before, but deliver the result to Crowdin instead of a pull request. Download your language's file from the Crowdin editor, let the agent translate it, and upload it back (the editor's offline translation flow). Crowdin runs its QA checks on upload, and the next service PR carries the strings into the repo.
+> 💡 **The one habit that matters most:** read each key's `description` before translating it. Labels are terse and ambiguous on their own; the `description` tells you what the string is, where it shows up, what to keep verbatim, and what it actually means.
 
 ---
 
@@ -45,6 +30,25 @@ A **business zero-trust VPN** — an encrypted **overlay mesh** between a compan
 
 ---
 
+## The files
+
+```
+i18n/locales/_index.json         shipped-language list
+i18n/locales/en/common.json      source of truth — message + description
+i18n/locales/<code>/common.json  a target — message only
+```
+
+Chrome-extension JSON, each key → `{ "message", "description" }`. You translate the **`message`**.
+
+| ✅ Do | ❌ Don't |
+|---|---|
+| Keep **every key** from `en`, in the same order | Translate, rename, reorder, drop, or add keys (they're identifiers; the set grows over time) |
+| Put **only `message`** in target bundles | Copy `description` into a target bundle |
+| Give every key a non-empty `message` | Leave keys missing or empty |
+| Save valid UTF-8 JSON, no BOM | Add trailing commas or break the JSON |
+
+---
+
 ## Hard rules — get these exactly right
 
 These are the usual ways a translation *breaks the app*, not just reads oddly.
@@ -54,7 +58,7 @@ These are the usual ways a translation *breaks the app*, not just reads oddly.
 | Copy `{placeholders}` verbatim — `{version}`, `{count}`, `{name}`… | Translate the word inside the braces (`{verbleibend}` breaks it) |
 | Reposition a placeholder so the sentence flows | Drop or duplicate a placeholder |
 | Preserve every `\n`, leading/trailing space, and trailing `...` | Trim "invisible" spaces or the `...` (they're load-bearing) |
-| Keep `®` in WireGuard® and quotes around `{name}` | Strip punctuation the context flags |
+| Keep `®` in WireGuard® and quotes around `{name}` | Strip punctuation the description flags |
 
 **Plurals:** the app has only a *one / other* split — the singular key fires only when `count == 1`; the `{count}` key covers everything else (0, 2, 5, 100…). Languages with more than two forms (ru, pl, uk) can't be fully correct here — use the form that fits the widest range (Russian genitive plural: `минут` / `часов` / `дней`). Don't invent extra keys or cram multiple forms into one string. When no single form fits every value — a unit label after a number field, say — reach for a number-agnostic form (an abbreviation, or wording that reads the same for 1 and 100) instead of forcing a plural the *one / other* split can't supply.
 
@@ -74,15 +78,13 @@ When a brand sits beside a common noun, keep its exact spelling but join them th
 
 > **Use the word that language's IT users actually say.** Translate when a natural, common term exists; keep the English term *only* when the literal translation would be awkward or no one in that field really uses it.
 
-Apply each term **consistently** — same English term → same translation everywhere — and keep a term once you've settled it. Whether a term stays English or takes a native word is **language-dependent**: a technical loanword (e.g. *Daemon*, *Handshake*) often stays, an everyday word (e.g. *Latency*, *Public key*) usually localizes, and some (*Exit Node*, *Peer*) go either way depending on the language. Decide per term with the rule above — a foreign origin alone is no reason to keep English. **Your main reference is the existing translation:** match how a term was already rendered for your language rather than re-deciding it.
+Apply each term **consistently** — same English term → same translation everywhere — and keep a term once you've settled it. Whether a term stays English or takes a native word is **language-dependent**: a technical loanword (e.g. *Daemon*, *Handshake*) often stays, an everyday word (e.g. *Latency*, *Public key*) usually localizes, and some (*Exit Node*, *Peer*) go either way depending on the language. Decide per term with the rule above — a foreign origin alone is no reason to keep English. **Your main reference is the existing bundles:** match how a term was already rendered for your language rather than re-deciding it.
 
 Two checks before you commit a term:
 
 - **Prefer established localized wording.** If a widely used tool in this space (for example WireGuard) ships your language, its wording for a shared term such as *handshake* is what users already expect — look at the translated app, not just English docs. For generic UI verbs and formal address, follow your OS vendor's style guide (Microsoft / Apple / Google).
 - **Watch for false friends.** A literal translation can collide with a *different* established term in your field — confirm your word doesn't already mean something else in this domain before using it.
 
-These tiers are mirrored in the Crowdin project glossary, so the editor highlights them inline. When you settle a new Tier C term for your language, add its translation to the glossary entry so it sticks for everyone who comes after you.
-
 ---
 
 ## Style
@@ -96,7 +98,7 @@ These tiers are mirrored in the Crowdin project glossary, so the editor highligh
 
 Where it reads naturally, aim to keep each string **roughly the same length** as the English — the UI is tight and over-long strings can wrap or truncate. It's a soft preference, not a rule: if your language simply needs more words, use them.
 
-A few habits that keep a translation reading like one product rather than a word-for-word port:
+A few habits that keep a bundle reading like one product rather than a word-for-word port:
 
 - **Translate meaning, not words.** Render what a string *does*. An idiom or an awkward source phrase should become natural in your language, not a literal calque.
 - **Keep one voice within a family.** Sibling strings — the connection states, every settings *help* caption, every "… Failed" title — should share a grammatical form. If one member sounds wrong in that form, re-voice the whole family rather than leave one odd sibling.
@@ -105,26 +107,27 @@ A few habits that keep a translation reading like one product rather than a word
 
 ---
 
-## Reviewing a language
+## Procedure
 
-**On Crowdin:** proofread in the editor — context, glossary highlights, and QA flags sit inline next to each string.
+**New language** — read `en/common.json` *with* descriptions → settle your Tier C terms → write `i18n/locales/<code>/common.json` (same keys and order as `en`, `message` only, placeholders & brands preserved) → add a row to `_index.json` (`{"code","displayName"` = native name`,"englishName"}`) → run the QA list. Use the locale-code style the existing entries use (e.g. `fr`, `pt`, `zh-CN`).
 
-**In the repo** — e.g. driving an AI agent with *"Read `i18n/TRANSLATING.md` and review the existing German translation"* — read source and target side by side; for each key check glossary conformance (e.g. de `Exit-Node` → `Exit Node`, hu `Kilépő csomópont` → `Exit Node`), placeholder/`\n` integrity, consistency, tone, and that the meaning matches the English `description`. Report what you found, and apply the fixes **on Crowdin** — direct edits to the locale files are overwritten by the next sync.
+**Review (de / hu / …)** — read source and target side by side; for each key check glossary conformance (e.g. de `Exit-Node` → `Exit Node`, hu `Kilépő csomópont` → `Exit Node`), placeholder/`\n` integrity, consistency, tone, and that the meaning matches the English `description`. Fix in place, then report what you changed (especially term standardizations) so a native speaker can sanity-check.
 
 ---
 
 ## QA before you finish
 
+- [ ] Valid JSON · **every `en` key** present, same order · **no `description`** fields
 - [ ] Every `{placeholder}`, `\n`, and intentional space preserved · `...` / `… Failed` / `{name}` quotes kept
-- [ ] Tier A/B left intact · Tier C applied consistently (and matching the existing translation for your language)
+- [ ] Tier A/B left intact · Tier C applied consistently (and matching the existing bundle for your language)
 - [ ] Buttons & tray short · locale punctuation and capitalization applied
-- [ ] Crowdin QA flags resolved (variables, glossary terms, punctuation)
+- [ ] New language added to `_index.json`
 - [ ] **Tested in the running app** ↓
 
 ---
 
 ## Test it in the app
 
-A translation can pass every check above and still read wrong on screen. **Run the app, switch to your language, and click through the real surfaces** — tray menu, main window, every Settings tab, the dialogs. Watch for text overflow or truncation, labels that are technically right but wrong *for what the control does*, leaked placeholders, and terms that drift between screens.
+A bundle can pass every check above and still read wrong on screen. **Run the app, switch to your language, and click through the real surfaces** — tray menu, main window, every Settings tab, the dialogs. Watch for text overflow or truncation, labels that are technically right but wrong *for what the control does*, leaked placeholders, and terms that drift between screens.
 
 How to run the app and switch language: see the project README. Can't run it (e.g. a headless agent)? Say so in your summary — don't silently skip this step.

client/ui/i18n/check-translations.mjs

@@ -1,104 +0,0 @@
-#!/usr/bin/env node
-// Validates that every shipped translation bundle carries exactly the same set
-// of keys as the English source of truth. English (en) defines the keys; every
-// other locale declared in _index.json must match it 1:1:
-//
-//   - no missing keys — a missing key silently falls back to English at runtime
-//     (see i18n bundle fallback), so the gap never surfaces to users or CI
-//     without this check;
-//   - no orphaned keys — keys left behind after an English key is renamed or
-//     removed are dead weight and a sign the locale is drifting.
-//
-// Pure Node, no dependencies, so it runs without installing the frontend
-// toolchain.
-//
-//   Local:  node client/ui/i18n/check-translations.mjs   (or: pnpm i18n:check)
-//   CI:     .github/workflows/ui-translations.yml
-
-import { readdirSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const SOURCE = "en";
-const localesDir = join(dirname(fileURLToPath(import.meta.url)), "locales");
-const isCI = Boolean(process.env.GITHUB_ACTIONS);
-
-function readJSON(path) {
-    return JSON.parse(readFileSync(path, "utf8"));
-}
-
-function keysOf(langCode) {
-    return Object.keys(readJSON(join(localesDir, langCode, "common.json")));
-}
-
-// Emit a GitHub Actions annotation so failures render inline on the PR diff.
-function annotate(file, message) {
-    if (isCI) console.log(`::error file=${file}::${message}`);
-}
-
-const index = readJSON(join(localesDir, "_index.json"));
-const declared = index.languages.map((l) => l.code);
-
-if (!declared.includes(SOURCE)) {
-    console.error(`FATAL: source language "${SOURCE}" is not declared in _index.json`);
-    process.exit(1);
-}
-
-const sourceKeys = keysOf(SOURCE);
-const sourceSet = new Set(sourceKeys);
-console.log(`Source of truth: ${SOURCE}/common.json — ${sourceKeys.length} keys\n`);
-
-let failed = false;
-
-for (const code of declared) {
-    if (code === SOURCE) continue;
-    const file = `client/ui/i18n/locales/${code}/common.json`;
-
-    let keys;
-    try {
-        keys = keysOf(code);
-    } catch (e) {
-        failed = true;
-        const msg = `bundle is declared in _index.json but common.json is missing or invalid (${e.message})`;
-        console.error(`✗ ${code}: ${msg}`);
-        annotate("client/ui/i18n/locales/_index.json", `${code}: ${msg}`);
-        continue;
-    }
-
-    const set = new Set(keys);
-    const missing = sourceKeys.filter((k) => !set.has(k));
-    const extra = keys.filter((k) => !sourceSet.has(k));
-
-    if (missing.length === 0 && extra.length === 0) {
-        console.log(`✓ ${code}: ${keys.length} keys`);
-        continue;
-    }
-
-    failed = true;
-    console.error(`✗ ${code}: ${keys.length} keys (expected ${sourceKeys.length})`);
-    if (missing.length) {
-        console.error(`    missing ${missing.length}: ${missing.join(", ")}`);
-        annotate(file, `Missing ${missing.length} key(s) present in ${SOURCE}: ${missing.join(", ")}`);
-    }
-    if (extra.length) {
-        console.error(`    extra ${extra.length}: ${extra.join(", ")}`);
-        annotate(file, `Has ${extra.length} key(s) not present in ${SOURCE}: ${extra.join(", ")}`);
-    }
-}
-
-// Locale directories present on disk but not declared in _index.json are never
-// loaded by the app — surface them so dead translation files don't rot silently.
-const onDisk = readdirSync(localesDir, { withFileTypes: true })
-    .filter((e) => e.isDirectory())
-    .map((e) => e.name);
-const undeclared = onDisk.filter((d) => !declared.includes(d));
-if (undeclared.length) {
-    console.warn(`\n⚠ locale directories not declared in _index.json (not shipped): ${undeclared.join(", ")}`);
-}
-
-console.log();
-if (failed) {
-    console.error("Translation check FAILED — every locale must match the English key set.");
-    process.exit(1);
-}
-console.log("Translation check passed — all locales match the English key set.");

client/ui/i18n/locales/ja/common.json

@@ -1312,9 +1312,6 @@
     "daemon.outdated.description": {
         "message": "このアプリを使用するには NetBird サービスを更新してください。"
     },
-    "daemon.outdated.download": {
-        "message": "最新版をダウンロード"
-    },
     "error.jwt_clock_skew": {
         "message": "サインインに失敗しました: このデバイスの時計がサーバーと同期していません。システムの時計を同期してからもう一度お試しください。"
     },

client/ui/services/connection.go

@@ -108,11 +108,10 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	}
 
 	req := &proto.LoginRequest{
-		ManagementUrl: p.ManagementURL,
-		SetupKey:      p.SetupKey,
-		Hostname:      p.Hostname,
-		// a login driven by the UI always has a graphical session available
-		IsUnixDesktopClient: true,
+		ManagementUrl:       p.ManagementURL,
+		SetupKey:            p.SetupKey,
+		Hostname:            p.Hostname,
+		IsUnixDesktopClient: runtime.GOOS == "linux",
 	}
 	if profileName != "" {
 		req.ProfileName = ptrStr(profileName)

crowdin.yml

@@ -1,11 +0,0 @@
-skip_untranslated_strings: true
-skip_untranslated_files: true
-import_eq_suggestions: true
-
-files:
-  - source: /client/ui/i18n/locales/en/common.json
-    translation: /client/ui/i18n/locales/%two_letters_code%/common.json
-    type: chrome
-    languages_mapping:
-      two_letters_code:
-        zh-CN: zh-CN

e2e/agentnetwork/settings_bootstrap_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/client/rest"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 )
 
@@ -177,3 +178,89 @@ func TestSettingsBootstrapSelfAddressed(t *testing.T) {
 	require.NoError(t, err, "bootstrap after delete must succeed")
 	assert.Equal(t, "gw2.e2e.netbird.selfhosted", recreated.Endpoint, "the fresh bootstrap claims the new hostname")
 }
+
+// TestSettingsConditionalWrites covers the lost-update guard end to end, over
+// the same REST client the Terraform provider uses: read the settings, take
+// the entity-tag, and have a write refused when the row moved underneath it.
+//
+// The scenario is the one that motivates the feature. A client reads the
+// settings and computes an update. An operator turns PII redaction on in the
+// dashboard in the meantime. Without a precondition the client's write puts
+// redaction straight back off — no error, no drift warning, a
+// compliance-relevant control silently disabled. With one, the write is
+// refused and the client can read again.
+func TestSettingsConditionalWrites(t *testing.T) {
+	ctx := context.Background()
+
+	fresh, err := harnessStartFresh(ctx, t)
+	require.NoError(t, err, "start dedicated combined server")
+
+	const cluster = "eu.e2e.netbird.selfhosted"
+	bootstrapped, err := fresh.CreateSettings(ctx, api.AgentNetworkSettingsCreateRequest{
+		ProxyAddress: ptr(cluster),
+	})
+	require.NoError(t, err, "bootstrap must succeed")
+
+	// What the client plans against.
+	planned, etag, err := fresh.GetSettingsWithETag(ctx)
+	require.NoError(t, err, "read must succeed")
+	require.NotEmpty(t, etag, "the read must carry a validator")
+	assert.Equal(t, bootstrapped.Endpoint, planned.Endpoint)
+
+	_, again, err := fresh.GetSettingsWithETag(ctx)
+	require.NoError(t, err, "second read must succeed")
+	assert.Equal(t, etag, again, "an unchanged row must read as the same validator")
+
+	update := func(redactPii bool, retention int) api.AgentNetworkSettingsRequest {
+		return api.AgentNetworkSettingsRequest{
+			Endpoint:               planned.Endpoint,
+			ProxyAddress:           planned.ProxyAddress,
+			EnableLogCollection:    true,
+			EnablePromptCollection: true,
+			RedactPii:              redactPii,
+			AccessLogRetentionDays: retention,
+		}
+	}
+
+	// The operator's change, which the planning client never saw.
+	_, err = fresh.UpdateSettings(ctx, update(true, 21))
+	require.NoError(t, err, "the intervening update must succeed")
+
+	// The client's write, planned against the earlier read, would have turned
+	// redaction back off. It is refused instead.
+	_, _, err = fresh.UpdateSettingsIfMatch(ctx, update(false, 7), etag)
+	require.Error(t, err, "a stale precondition must be refused")
+	require.True(t, rest.IsPreconditionFailed(err),
+		"the refusal must be a precondition failure, got: %v", err)
+
+	intact, current, err := fresh.GetSettingsWithETag(ctx)
+	require.NoError(t, err, "read after the refusal must succeed")
+	assert.True(t, intact.RedactPii, "the refused write must not have turned redaction off")
+	require.NotNil(t, intact.AccessLogRetentionDays)
+	assert.Equal(t, 21, *intact.AccessLogRetentionDays, "the refused write must not have changed retention")
+	assert.NotEqual(t, etag, current, "the validator must have moved with the intervening update")
+
+	// Retrying against the current validator goes through, and hands back the
+	// validator for the write after it.
+	updated, next, err := fresh.UpdateSettingsIfMatch(ctx, update(true, 7), current)
+	require.NoError(t, err, "a matching precondition must be honoured")
+	require.NotNil(t, updated.AccessLogRetentionDays)
+	assert.Equal(t, 7, *updated.AccessLogRetentionDays, "the conditional write must apply")
+	assert.NotEmpty(t, next, "the write must return a validator")
+	assert.NotEqual(t, current, next, "the write must move the validator")
+
+	// The delete is conditional too, and refusing a stale one leaves the
+	// endpoint claimed.
+	err = fresh.DeleteSettingsIfMatch(ctx, etag)
+	require.Error(t, err, "a stale precondition must refuse the delete")
+	require.True(t, rest.IsPreconditionFailed(err),
+		"the delete must be refused for staleness rather than for a state guard or a server error, got: %v", err)
+	stillThere, err := fresh.GetSettings(ctx)
+	require.NoError(t, err, "read after the refused delete must succeed")
+	assert.Equal(t, planned.Endpoint, stillThere.Endpoint, "the refused delete must leave the endpoint claimed")
+
+	require.NoError(t, fresh.DeleteSettingsIfMatch(ctx, next), "a matching precondition must be honoured")
+	gone, err := fresh.GetSettings(ctx)
+	require.NoError(t, err, "read after the delete must succeed")
+	assert.Empty(t, gone.Endpoint, "the row must be gone")
+}

e2e/harness/Dockerfile.client

@@ -20,9 +20,5 @@ ENV NETBIRD_BIN="/usr/local/bin/netbird" \
     NB_ENABLE_CAPTURE="false" \
     NB_ENTRYPOINT_SERVICE_TIMEOUT="30"
 ENTRYPOINT [ "/usr/local/bin/netbird-entrypoint.sh" ]
-# --chmod because the build context is not always a git checkout. A suite in
-# another module builds from this module's extracted copy in the module cache,
-# where every file is 0444 — the cache drops the executable bit git records — and
-# a bare COPY then produces an entrypoint the runtime cannot exec.
-COPY --chmod=0755 client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
+COPY client/netbird-entrypoint.sh /usr/local/bin/netbird-entrypoint.sh
 COPY --from=builder /out/netbird /usr/local/bin/netbird

e2e/harness/agentnetwork.go

@@ -153,6 +153,37 @@ func (c *Combined) DeleteSettings(ctx context.Context) error {
 	return anDelete(ctx, c, "/api/agent-network/settings")
 }
 
+// The conditional-request wrappers go through the typed REST client rather
+// than anRequest, so the e2e run exercises the client's own header handling —
+// the quoting on the way out and the unquoting on the way back — against a
+// real server, which is the path the Terraform provider takes.
+
+// GetSettingsWithETag reads the settings along with the entity-tag that makes
+// a following write conditional.
+func (c *Combined) GetSettingsWithETag(ctx context.Context) (api.AgentNetworkSettings, string, error) {
+	settings, etag, err := c.api.AgentNetwork.GetSettingsWithETag(ctx)
+	if err != nil {
+		return api.AgentNetworkSettings{}, "", err
+	}
+	return *settings, etag, nil
+}
+
+// UpdateSettingsIfMatch applies the update only if etag is still current,
+// returning the entity-tag of the row it wrote.
+func (c *Combined) UpdateSettingsIfMatch(ctx context.Context, req api.AgentNetworkSettingsRequest, etag string) (api.AgentNetworkSettings, string, error) {
+	settings, newETag, err := c.api.AgentNetwork.UpdateSettingsIfMatch(ctx, req, etag)
+	if err != nil {
+		return api.AgentNetworkSettings{}, "", err
+	}
+	return *settings, newETag, nil
+}
+
+// DeleteSettingsIfMatch deletes the settings row only if etag is still
+// current.
+func (c *Combined) DeleteSettingsIfMatch(ctx context.Context, etag string) error {
+	return c.api.AgentNetwork.DeleteSettingsIfMatch(ctx, etag)
+}
+
 // ListConsumption returns the account's consumption rows (possibly empty).
 func (c *Combined) ListConsumption(ctx context.Context) ([]api.AgentNetworkConsumption, error) {
 	return anRequest[[]api.AgentNetworkConsumption](ctx, c, http.MethodGet, "/api/agent-network/consumption", nil)

e2e/harness/client.go

@@ -32,36 +32,12 @@ type Client struct {
 	container testcontainers.Container
 }
 
-// clientOptions is what the ClientOption values assemble.
-type clientOptions struct {
-	name string
-}
-
-// ClientOption adjusts how StartClient runs the agent.
-type ClientOption func(*clientOptions)
-
-// WithClientName names the agent, which sets both its network alias and its
-// container hostname. The hostname matters beyond addressing: the agent reports
-// it to management at registration, so it is the name the peer appears under in
-// the API.
-//
-// Required to run more than one agent against the same server — the default name
-// is shared, and two containers cannot hold the same alias on one network.
-func WithClientName(name string) ClientOption {
-	return func(o *clientOptions) { o.name = name }
-}
-
 // StartClient builds the client image and runs it on the combined server's
 // network, joining via the given setup key. The image entrypoint brings the
 // daemon up automatically; callers wait for connectivity with WaitConnected /
 // WaitProxyPeer.
-func StartClient(ctx context.Context, c *Combined, setupKey string, opts ...ClientOption) (*Client, error) {
-	o := clientOptions{name: clientAlias}
-	for _, opt := range opts {
-		opt(&o)
-	}
-
-	root, err := repoRoot(ctx)
+func StartClient(ctx context.Context, c *Combined, setupKey string) (*Client, error) {
+	root, err := repoRoot()
 	if err != nil {
 		return nil, err
 	}
@@ -71,13 +47,9 @@ func StartClient(ctx context.Context, c *Combined, setupKey string, opts ...Clie
 	}
 
 	req := testcontainers.ContainerRequest{
-		Image: clientImage,
-		// The agent reports the container's hostname to management, so this is
-		// the name the peer is addressable by in the API as well as on the
-		// network. The entrypoint takes no hostname flag of its own.
-		Hostname:       o.name,
+		Image:          clientImage,
 		Networks:       []string{c.network.Name},
-		NetworkAliases: map[string][]string{c.network.Name: {o.name}},
+		NetworkAliases: map[string][]string{c.network.Name: {clientAlias}},
 		Env: map[string]string{
 			"NB_MANAGEMENT_URL": combinedExposedURL,
 			"NB_SETUP_KEY":      setupKey,

e2e/harness/combined.go

@@ -61,68 +61,11 @@ type Combined struct {
 	workDir string
 }
 
-// combinedOptions is what the CombinedOption values assemble.
-type combinedOptions struct {
-	geolocation bool
-	env         map[string]string
-}
-
-// CombinedOption adjusts how StartCombined boots the server. The defaults suit a
-// suite that only drives the API; the options exist for the ones that need more
-// of the product than that.
-type CombinedOption func(*combinedOptions)
-
-// WithGeolocation leaves the GeoLite database download enabled. It is off by
-// default because the download adds startup latency that most suites get nothing
-// for. A suite asserting on location-based posture checks needs it: management
-// evaluates those rules against the database, and without it the rule fails
-// instead of passing without having been checked.
-func WithGeolocation() CombinedOption {
-	return func(o *combinedOptions) { o.geolocation = true }
-}
-
-// WithServerEnv adds environment variables to the combined container, overriding
-// the defaults on a key collision. For settings this harness does not model
-// directly, so a suite needing one does not have to fork the harness to get it.
-func WithServerEnv(env map[string]string) CombinedOption {
-	return func(o *combinedOptions) {
-		if o.env == nil {
-			o.env = map[string]string{}
-		}
-		for k, v := range env {
-			o.env[k] = v
-		}
-	}
-}
-
-// combinedEnv is the combined container's environment: setup-PAT enabled so the
-// caller can mint an admin token through /api/setup, geolocation off unless the
-// suite asked for it, and whatever the suite added on top.
-func combinedEnv(o combinedOptions) map[string]string {
-	env := map[string]string{
-		"NB_SETUP_PAT_ENABLED": "true",
-	}
-	if !o.geolocation {
-		// Skip the GeoLite DB download — it blocks startup and agent-network
-		// ingest doesn't use geolocation.
-		env["NB_DISABLE_GEOLOCATION"] = "true"
-	}
-	for k, v := range o.env {
-		env[k] = v
-	}
-	return env
-}
-
 // StartCombined builds the combined server from its multistage Dockerfile and
 // boots it with setup-PAT enabled on a fresh shared network, returning once the
 // API is serving. The caller still owns minting the admin PAT via Bootstrap.
-func StartCombined(ctx context.Context, opts ...CombinedOption) (*Combined, error) {
-	var o combinedOptions
-	for _, opt := range opts {
-		opt(&o)
-	}
-
-	root, err := repoRoot(ctx)
+func StartCombined(ctx context.Context) (*Combined, error) {
+	root, err := repoRoot()
 	if err != nil {
 		return nil, err
 	}
@@ -145,7 +88,7 @@ func StartCombined(ctx context.Context, opts ...CombinedOption) (*Combined, erro
 		return nil, fmt.Errorf("create work dir: %w", err)
 	}
 
-	cfg := fmt.Sprintf(combinedConfigYAML, combinedExposedURL, !o.geolocation, containerIssuer)
+	cfg := fmt.Sprintf(combinedConfigYAML, combinedExposedURL, containerIssuer)
 	if err := os.WriteFile(filepath.Join(workDir, "config.yaml"), []byte(cfg), 0o644); err != nil { //nolint:gosec // non-secret config, bind-mounted and read by the container
 		_ = net.Remove(ctx)
 		return nil, fmt.Errorf("write combined config: %w", err)
@@ -169,8 +112,13 @@ func StartCombined(ctx context.Context, opts ...CombinedOption) (*Combined, erro
 		ExposedPorts:   []string{combinedHTTPPort},
 		Networks:       []string{net.Name},
 		NetworkAliases: map[string][]string{net.Name: {combinedAlias}},
-		Env:            combinedEnv(o),
-		Cmd:            []string{"--config", "/nb/config.yaml"},
+		Env: map[string]string{
+			"NB_SETUP_PAT_ENABLED": "true",
+			// Skip the GeoLite DB download — it blocks startup and agent-network
+			// ingest doesn't use geolocation.
+			"NB_DISABLE_GEOLOCATION": "true",
+		},
+		Cmd: []string{"--config", "/nb/config.yaml"},
 		HostConfigModifier: func(hc *container.HostConfig) {
 			hc.Binds = append(hc.Binds, workDir+":/nb")
 		},

e2e/harness/config.go

@@ -15,11 +15,6 @@ package harness
 // server is required to load it — a broken path or malformed file fails startup
 // rather than silently falling back to the compiled-in rates, and TestMain then
 // fails with the container logs.
-//
-// disableGeoliteUpdate is a parameter rather than a fixed true because a suite
-// that exercises geolocation needs the database: management can only evaluate a
-// location rule with GeoLite loaded, and a rule it cannot evaluate fails rather
-// than passing vacuously. See WithGeolocation.
 const combinedConfigYAML = `server:
   listenAddress: ":8080"
   exposedAddress: "%s"
@@ -30,7 +25,7 @@ const combinedConfigYAML = `server:
   authSecret: "e2e-relay-secret"
   dataDir: "/nb/data"
   disableAnonymousMetrics: true
-  disableGeoliteUpdate: %t
+  disableGeoliteUpdate: true
   auth:
     issuer: "%s"
   store:

e2e/harness/options_test.go

@@ -1,161 +0,0 @@
-//go:build e2e
-
-package harness
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// The options exist so a suite can ask for a deployment this harness would not
-// otherwise give it. What they configure is a container environment and a config
-// file, both assembled before anything is started, so they are checkable without
-// Docker — which is the point: a wiring mistake here would otherwise only show up
-// as a puzzling failure minutes into a container run.
-
-func TestCombinedEnvGeolocation(t *testing.T) {
-	var off combinedOptions
-	assert.Equal(t, "true", combinedEnv(off)["NB_DISABLE_GEOLOCATION"],
-		"geolocation should be off by default")
-
-	var on combinedOptions
-	WithGeolocation()(&on)
-	assert.NotContains(t, combinedEnv(on), "NB_DISABLE_GEOLOCATION",
-		"WithGeolocation must leave NB_DISABLE_GEOLOCATION unset, so the server downloads the database")
-	assert.Equal(t, "true", combinedEnv(on)["NB_SETUP_PAT_ENABLED"],
-		"the setup PAT must stay enabled whatever else is configured; Bootstrap depends on it")
-}
-
-// The config file carries the same decision as the environment variable, and the
-// server needs both to agree: disableGeoliteUpdate suppresses the download even
-// when geolocation itself is enabled.
-func TestCombinedConfigGeolocation(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		opts []CombinedOption
-		want string
-	}{
-		{name: "default", want: "disableGeoliteUpdate: true"},
-		{name: "with geolocation", opts: []CombinedOption{WithGeolocation()}, want: "disableGeoliteUpdate: false"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			var o combinedOptions
-			for _, opt := range tc.opts {
-				opt(&o)
-			}
-			cfg := fmt.Sprintf(combinedConfigYAML, combinedExposedURL, !o.geolocation, containerIssuer)
-			assert.Contains(t, cfg, tc.want, "geolocation not rendered as expected")
-			// The issuer is the last verb; a mis-ordered argument list would put
-			// the boolean here instead and the server would fail to start.
-			assert.Contains(t, cfg, `issuer: "`+containerIssuer+`"`, "issuer not rendered")
-		})
-	}
-}
-
-func TestWithServerEnvOverrides(t *testing.T) {
-	var o combinedOptions
-	WithServerEnv(map[string]string{"NB_LOG_LEVEL": "debug"})(&o)
-	WithServerEnv(map[string]string{"NB_SETUP_PAT_ENABLED": "false"})(&o)
-
-	env := combinedEnv(o)
-	assert.Equal(t, "debug", env["NB_LOG_LEVEL"], "added variable missing")
-	assert.Equal(t, "false", env["NB_SETUP_PAT_ENABLED"], "a suite must be able to override a default")
-}
-
-// Two agents on one network cannot share an alias, so the name has to reach both
-// the alias and the hostname. The hostname is the one management records, so it is
-// also what the peer is addressable by through the API.
-func TestWithClientName(t *testing.T) {
-	o := clientOptions{name: clientAlias}
-	require.Equal(t, "client", o.name, "unexpected default client name")
-
-	WithClientName("peer2")(&o)
-	assert.Equal(t, "peer2", o.name, "WithClientName did not take")
-}
-
-// repoRoot has to recognise this module rather than merely finding a go.mod, or a
-// suite in another module gets its own root and a build context without the
-// component Dockerfiles in it.
-func TestIsModule(t *testing.T) {
-	dir := t.TempDir()
-
-	other := filepath.Join(dir, "go.mod")
-	require.NoError(t, os.WriteFile(other, []byte("module example.com/other\n\ngo 1.25\n"), 0o600))
-	assert.False(t, isModule(other, modulePath), "another module's go.mod must not be taken for this repo")
-
-	ours := filepath.Join(dir, "ours.mod")
-	require.NoError(t, os.WriteFile(ours, []byte("// a comment\n\nmodule "+modulePath+"\n\ngo 1.25\n"), 0o600))
-	assert.True(t, isModule(ours, modulePath), "this repo's go.mod was not recognised")
-
-	assert.False(t, isModule(filepath.Join(dir, "absent.mod"), modulePath),
-		"a missing go.mod must not report a match")
-}
-
-// Running from inside the repo, repoRoot finds it by walking up — the module
-// lookup is only the fallback, and this asserts the walk still wins so an in-repo
-// run never depends on the module cache.
-func TestRepoRootFindsThisRepo(t *testing.T) {
-	root, err := repoRoot(context.Background())
-	require.NoError(t, err)
-	assert.True(t, isModule(filepath.Join(root, "go.mod"), modulePath),
-		"repoRoot returned %s, which is not this module", root)
-
-	for _, f := range []string{combinedDockerfile, clientDockerfile} {
-		_, err := os.Stat(filepath.Join(root, f))
-		assert.NoError(t, err, "%s is not present under the reported root %s", f, root)
-	}
-}
-
-// A caller that vendors its dependencies puts the go command in automatic vendor
-// mode, where `go list -m -f {{.Dir}}` succeeds and reports an EMPTY directory:
-// vendor/ holds packages, not module source. Without -mod=readonly the lookup
-// would come back empty and the harness would report a missing module for a
-// dependency that is present.
-func TestModuleDirResolvesUnderVendorMode(t *testing.T) {
-	if _, err := exec.LookPath("go"); err != nil {
-		t.Skip("no go tool on PATH")
-	}
-	ctx := context.Background()
-
-	base := t.TempDir()
-	dep := filepath.Join(base, "dep")
-	main := filepath.Join(base, "main")
-	require.NoError(t, os.MkdirAll(dep, 0o750))
-	require.NoError(t, os.MkdirAll(main, 0o750))
-
-	// A local replacement rather than a real dependency, so this needs no network.
-	require.NoError(t, os.WriteFile(filepath.Join(dep, "go.mod"),
-		[]byte("module example.com/dep\n\ngo 1.25\n"), 0o600))
-	require.NoError(t, os.WriteFile(filepath.Join(dep, "dep.go"),
-		[]byte("package dep\n"), 0o600))
-	require.NoError(t, os.WriteFile(filepath.Join(main, "go.mod"),
-		[]byte("module example.com/main\n\ngo 1.25\n\nrequire example.com/dep v0.0.0\n\nreplace example.com/dep v0.0.0 => ../dep\n"), 0o600))
-	require.NoError(t, os.WriteFile(filepath.Join(main, "main.go"),
-		[]byte("package main\n\nimport _ \"example.com/dep\"\n\nfunc main() {}\n"), 0o600))
-
-	t.Chdir(main)
-	vendor := exec.CommandContext(ctx, "go", "mod", "vendor")
-	out, err := vendor.CombinedOutput()
-	require.NoError(t, err, "go mod vendor: %s", out)
-
-	dir, err := moduleDir(ctx, "example.com/dep")
-	require.NoError(t, err, "the module must still resolve with a vendor directory present")
-	assert.Equal(t, dep, dir, "resolved the wrong directory")
-}
-
-// A cancelled context has to stop the lookup rather than leaving the caller
-// waiting on a subprocess it has already given up on.
-func TestModuleDirHonoursContext(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-
-	_, err := moduleDir(ctx, modulePath)
-	assert.ErrorIs(t, err, context.Canceled, "a cancelled context must stop the lookup")
-}

e2e/harness/paths.go

@@ -3,82 +3,27 @@
 package harness
 
 import (
-	"context"
 	"fmt"
 	"os"
-	"os/exec"
 	"path/filepath"
-	"strings"
 )
 
-// modulePath is this module, used both to recognise the repo when walking up
-// from the working directory and to locate it when the suite lives elsewhere.
-const modulePath = "github.com/netbirdio/netbird"
-
-// repoRoot returns the directory the component Dockerfiles are built from.
-//
-// Walking up from the working directory finds it for any test inside this repo,
-// no matter which package it runs from. A suite in another module gets a
-// different answer that way — its own module root, where combined/Dockerfile
-// does not exist — so the ancestor has to be this module and not merely some
-// module. When it is not, the build context is the extracted module directory of
-// whichever version that suite depends on, which is the right one: the server it
-// tests against is then built from the same revision as the client library it
-// was compiled with.
-func repoRoot(ctx context.Context) (string, error) {
+// repoRoot walks up from the working directory to the module root (the
+// directory holding go.mod), so the Docker build context is correct no matter
+// which package the test runs from.
+func repoRoot() (string, error) {
 	dir, err := os.Getwd()
 	if err != nil {
 		return "", err
 	}
 	for {
-		if isModule(filepath.Join(dir, "go.mod"), modulePath) {
+		if _, statErr := os.Stat(filepath.Join(dir, "go.mod")); statErr == nil {
 			return dir, nil
 		}
 		parent := filepath.Dir(dir)
 		if parent == dir {
-			break
+			return "", fmt.Errorf("go.mod not found above %s", dir)
 		}
 		dir = parent
 	}
-	return moduleDir(ctx, modulePath)
-}
-
-// isModule reports whether the go.mod at path declares the given module.
-func isModule(path, want string) bool {
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return false
-	}
-	for _, line := range strings.Split(string(b), "\n") {
-		if rest, ok := strings.CutPrefix(strings.TrimSpace(line), "module "); ok {
-			return strings.TrimSpace(rest) == want
-		}
-	}
-	return false
-}
-
-// moduleDir asks the go tool where a module's source is, which for a dependent
-// module is its extracted copy in the module cache. The cache is read-only, and
-// a Docker build context is only ever read.
-//
-// -mod=readonly is required rather than cosmetic. A caller that vendors its
-// dependencies puts the go command in automatic vendor mode, where this lookup
-// succeeds with an EMPTY directory — vendor/ holds packages, not module source,
-// so there is nothing to report. Asking in readonly mode resolves against the
-// module graph instead, which answers for both a cached module and a local
-// replacement, and neither writes to go.mod.
-func moduleDir(ctx context.Context, module string) (string, error) {
-	cmd := exec.CommandContext(ctx, "go", "list", "-mod=readonly", "-m", "-f", "{{.Dir}}", module)
-	out, err := cmd.Output()
-	if err != nil {
-		return "", fmt.Errorf("locate %s: %w", module, err)
-	}
-	dir := strings.TrimSpace(string(out))
-	if dir == "" {
-		return "", fmt.Errorf("locate %s: the go tool reported no directory; run `go mod download %s`", module, module)
-	}
-	if _, err := os.Stat(dir); err != nil {
-		return "", fmt.Errorf("locate %s: %w", module, err)
-	}
-	return dir, nil
 }

e2e/harness/proxy.go

@@ -43,7 +43,7 @@ type Proxy struct {
 // or override any NB_PROXY_* var (e.g. NB_PROXY_TUNNEL_CACHE_TTL for tests that
 // need a short authorization-cache window).
 func StartProxy(ctx context.Context, c *Combined, proxyToken string, envOverrides ...map[string]string) (*Proxy, error) {
-	root, err := repoRoot(ctx)
+	root, err := repoRoot()
 	if err != nil {
 		return nil, err
 	}

go.mod

@@ -57,7 +57,6 @@ require (
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/gliderlabs/ssh v0.3.8
 	github.com/go-jose/go-jose/v4 v4.1.4
-	github.com/go-ole/go-ole v1.3.0
 	github.com/gobwas/ws v1.4.0
 	github.com/goccy/go-yaml v1.18.0
 	github.com/godbus/dbus/v5 v5.2.2
@@ -200,6 +199,7 @@ require (
 	github.com/go-ldap/ldap/v3 v3.4.13 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/go-openapi/analysis v0.23.0 // indirect
 	github.com/go-openapi/errors v0.22.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.1 // indirect

infrastructure_files/getting-started.sh

@@ -111,59 +111,6 @@ check_nb_domain() {
   return 0
 }
 
-# Non-interactive configuration
-# ------------------------------
-# Every prompt below can be pre-answered with an environment variable, so the
-# script runs unattended (cloud-init, CI, Terraform, curl | bash). resolve()
-# is the single place that decides env var vs prompt vs default; the read_*
-# helpers stay pure prompts.
-#
-# Supported env vars:
-#   NETBIRD_DOMAIN                    domain/FQDN (required)
-#   NETBIRD_LETSENCRYPT_EMAIL         ACME email (required for built-in Traefik)
-#   NETBIRD_AGENT_NETWORK             true enables the agent-network preset
-#   NETBIRD_REVERSE_PROXY_TYPE        0-5 (default 0 = built-in Traefik)
-#   NETBIRD_ENABLE_PROXY              true/false (default false)
-#   NETBIRD_ENABLE_CROWDSEC           true/false (default false)
-#   NETBIRD_TRAEFIK_EXTERNAL_NETWORK  external-Traefik network (type 1)
-#   NETBIRD_TRAEFIK_ENTRYPOINT        external-Traefik entrypoint (type 1, default websecure)
-#   NETBIRD_TRAEFIK_CERTRESOLVER      external-Traefik cert resolver (type 1)
-#   NETBIRD_BIND_LOCALHOST_ONLY       true/false (default true, types 2-5)
-#   NETBIRD_EXTERNAL_PROXY_NETWORK    docker network to join (types 2-4)
-#   NETBIRD_NON_INTERACTIVE           true forces unattended mode even with a TTY
-
-# tty_available succeeds only when we may prompt: never when the operator has
-# set NETBIRD_NON_INTERACTIVE=true, otherwise only when /dev/tty can actually
-# be opened. A PTY can be attached in automation (CI runners, some
-# provisioners), so the env override is the authoritative signal and the
-# /dev/tty probe is the fallback. /dev/tty is a world-rw device node even with
-# no terminal, so a permission test ([ -r ]) is not enough - we must open it.
-tty_available() {
-  [[ "${NETBIRD_NON_INTERACTIVE:-}" == "true" ]] && return 1
-  { true < /dev/tty; } 2>/dev/null
-}
-
-# resolve ENV_VAR_NAME DEFAULT PROMPT_FN [prompt args...]
-#   env var set and non-empty -> its value
-#   interactive               -> PROMPT_FN "$@" (prompt behavior unchanged)
-#   otherwise                 -> DEFAULT, or abort when DEFAULT is "required"
-resolve() {
-  local env_name="$1" default="$2" prompt_fn="$3"
-  shift 3
-  local env_value="${!env_name:-}"
-  if [[ -n "$env_value" ]]; then
-    echo "$env_value"
-  elif tty_available; then
-    "$prompt_fn" "$@"
-  elif [[ "$default" == "required" ]]; then
-    echo "$env_name is required for a non-interactive install." > /dev/stderr
-    exit 1
-  else
-    echo "$default"
-  fi
-  return 0
-}
-
 read_nb_domain() {
   READ_NETBIRD_DOMAIN=""
   echo -n "Enter the domain you want to use for NetBird (e.g. netbird.my-domain.com): " > /dev/stderr
@@ -436,14 +383,7 @@ initialize_default_values() {
 }
 
 configure_domain() {
-  # Domain is validated (not a free-form value), so it keeps its own guard
-  # rather than going through resolve(): a valid NETBIRD_DOMAIN is used as-is,
-  # otherwise we prompt, or abort when there is no terminal to prompt on.
   if ! check_nb_domain "$NETBIRD_DOMAIN"; then
-    if ! tty_available; then
-      echo "NETBIRD_DOMAIN is required for a non-interactive install." > /dev/stderr
-      exit 1
-    fi
     NETBIRD_DOMAIN=$(read_nb_domain)
   fi
 
@@ -471,7 +411,11 @@ apply_agent_network_preset() {
   ENABLE_PROXY="true"
   ENABLE_CROWDSEC="false"
 
-  TRAEFIK_ACME_EMAIL=$(resolve NETBIRD_LETSENCRYPT_EMAIL required read_traefik_acme_email)
+  if [[ -n "${NETBIRD_LETSENCRYPT_EMAIL}" ]]; then
+    TRAEFIK_ACME_EMAIL="${NETBIRD_LETSENCRYPT_EMAIL}"
+  else
+    TRAEFIK_ACME_EMAIL=$(read_traefik_acme_email)
+  fi
 
   echo "" > /dev/stderr
   echo "Agent-network preset enabled (NETBIRD_AGENT_NETWORK=true):" > /dev/stderr
@@ -493,35 +437,35 @@ configure_reverse_proxy() {
     return 0
   fi
 
-  # Reverse proxy type (env NETBIRD_REVERSE_PROXY_TYPE, else prompt, else 0)
-  REVERSE_PROXY_TYPE=$(resolve NETBIRD_REVERSE_PROXY_TYPE 0 read_reverse_proxy_type)
+  # Prompt for reverse proxy type
+  REVERSE_PROXY_TYPE=$(read_reverse_proxy_type)
 
   # Handle built-in Traefik prompts (option 0)
   if [[ "$REVERSE_PROXY_TYPE" == "0" ]]; then
-    TRAEFIK_ACME_EMAIL=$(resolve NETBIRD_LETSENCRYPT_EMAIL required read_traefik_acme_email)
-    ENABLE_PROXY=$(resolve NETBIRD_ENABLE_PROXY false read_enable_proxy)
+    TRAEFIK_ACME_EMAIL=$(read_traefik_acme_email)
+    ENABLE_PROXY=$(read_enable_proxy)
     if [[ "$ENABLE_PROXY" == "true" ]]; then
-      ENABLE_CROWDSEC=$(resolve NETBIRD_ENABLE_CROWDSEC false read_enable_crowdsec)
+      ENABLE_CROWDSEC=$(read_enable_crowdsec)
     fi
   fi
 
   # Handle external Traefik-specific prompts (option 1)
   if [[ "$REVERSE_PROXY_TYPE" == "1" ]]; then
-    TRAEFIK_EXTERNAL_NETWORK=$(resolve NETBIRD_TRAEFIK_EXTERNAL_NETWORK "" read_traefik_network)
-    TRAEFIK_ENTRYPOINT=$(resolve NETBIRD_TRAEFIK_ENTRYPOINT websecure read_traefik_entrypoint)
-    TRAEFIK_CERTRESOLVER=$(resolve NETBIRD_TRAEFIK_CERTRESOLVER "" read_traefik_certresolver)
+    TRAEFIK_EXTERNAL_NETWORK=$(read_traefik_network)
+    TRAEFIK_ENTRYPOINT=$(read_traefik_entrypoint)
+    TRAEFIK_CERTRESOLVER=$(read_traefik_certresolver)
   fi
 
   # Handle port binding for external proxy options (2-5)
   if [[ "$REVERSE_PROXY_TYPE" -ge 2 ]]; then
-    BIND_LOCALHOST_ONLY=$(resolve NETBIRD_BIND_LOCALHOST_ONLY true read_port_binding_preference)
+    BIND_LOCALHOST_ONLY=$(read_port_binding_preference)
   fi
 
   # Handle Docker network prompts for external proxies (options 2-4)
   case "$REVERSE_PROXY_TYPE" in
-    2) EXTERNAL_PROXY_NETWORK=$(resolve NETBIRD_EXTERNAL_PROXY_NETWORK "" read_proxy_docker_network "Nginx") ;;
-    3) EXTERNAL_PROXY_NETWORK=$(resolve NETBIRD_EXTERNAL_PROXY_NETWORK "" read_proxy_docker_network "Nginx Proxy Manager") ;;
-    4) EXTERNAL_PROXY_NETWORK=$(resolve NETBIRD_EXTERNAL_PROXY_NETWORK "" read_proxy_docker_network "Caddy") ;;
+    2) EXTERNAL_PROXY_NETWORK=$(read_proxy_docker_network "Nginx") ;;
+    3) EXTERNAL_PROXY_NETWORK=$(read_proxy_docker_network "Nginx Proxy Manager") ;;
+    4) EXTERNAL_PROXY_NETWORK=$(read_proxy_docker_network "Caddy") ;;
     *) ;; # No network prompt for other options
   esac
   return 0
@@ -699,13 +643,8 @@ start_services_and_show_instructions() {
     print_post_setup_instructions
 
     echo ""
-    if tty_available; then
-      echo -n "Press Enter when your reverse proxy is configured (or Ctrl+C to exit)... "
-      read -r < /dev/tty
-    else
-      echo "Non-interactive mode: starting NetBird containers now. Finish configuring"
-      echo "your reverse proxy using the instructions above so it can reach them."
-    fi
+    echo -n "Press Enter when your reverse proxy is configured (or Ctrl+C to exit)... "
+    read -r < /dev/tty
 
     echo -e "$MSG_STARTING_SERVICES"
     $DOCKER_COMPOSE_COMMAND up -d

infrastructure_files/migrate-to-enterprise.sh

@@ -15,12 +15,6 @@ set -o pipefail
 #   2. Postgres migration — add Postgres, migrate SQLite data via migrate-store.
 #   3. Traffic flow       — add NATS + flow-enricher + flow-receiver.
 #
-# Step 2 is skipped when the deployment already runs on Postgres
-# (server.store.engine: postgres in config.yaml). Nothing is provisioned or
-# migrated in that case and the store config is left exactly as the operator
-# wrote it — the enterprise image reads the same Postgres the community image
-# did. Such a deployment gets the image swap, and can still opt into step 3.
-#
 # If any step fails once the stack has been touched, the script rolls itself
 # back automatically: generated files are removed, the Postgres volume this run
 # created is dropped, and the original deployment is started again.
@@ -44,18 +38,6 @@ ENV_BACKUP=""
 PG_VOLUME_NAME=""
 BACKUP_DIR=""
 
-# Store state. STORE_ENGINE is what the deployment runs on today; when it is
-# already postgres, MIGRATE_POSTGRES stays "no" and nothing is provisioned.
-# POSTGRES_SERVICE is empty when Postgres lives outside this compose project.
-STORE_ENGINE=""
-EXISTING_POSTGRES="no"
-POSTGRES_DSN=""
-POSTGRES_SERVICE=""
-POSTGRES_DEPENDS_CONDITION="service_healthy"
-# Whether this run needs to generate config.yaml.enterprise at all. A pure
-# image swap does not.
-ENTERPRISE_CONFIG="no"
-
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
 check_docker_compose() {
@@ -210,85 +192,6 @@ detect_exposed_address() {
   yq eval '.server.exposedAddress // ""' "$CONFIG_YAML_HOST"
 }
 
-# The engine is a config.yaml-only setting — there is no env override for it
-# (combined/cmd/root.go reads it from YAML and derives the env vars), so
-# config.yaml is authoritative. Absent means the sqlite default.
-detect_store_engine() {
-  local engine
-  engine=$(yq eval '.server.store.engine // ""' "$CONFIG_YAML_HOST")
-  if [[ -z "$engine" ]] || [[ "$engine" == "null" ]]; then
-    engine="sqlite"
-  fi
-  echo "$engine" | tr '[:upper:]' '[:lower:]'
-}
-
-detect_store_dsn() {
-  yq eval '.server.store.dsn // ""' "$CONFIG_YAML_HOST"
-}
-
-# config.yaml is where a combined deployment carries its DSN; this only covers
-# hand-rolled installs that keep it in the environment instead.
-detect_store_dsn_from_compose() {
-  # `compose config` re-escapes a literal $ as $$ on the way out, so undo that
-  # to get the value the container actually receives.
-  $DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval "
-    .services[\"$COMBINED_SERVICE\"].environment.NB_STORE_ENGINE_POSTGRES_DSN //
-    .services[\"$COMBINED_SERVICE\"].environment.NETBIRD_STORE_ENGINE_POSTGRES_DSN // \"\"
-  " - 2>/dev/null | sed 's/\$\$/$/g'
-}
-
-# Reads either DSN form: "host=db ..." or "postgres://user:pass@db:5432/name".
-dsn_host() {
-  local dsn="$1"
-  case "$dsn" in
-    *://*) printf '%s' "$dsn" | sed -n 's,^[a-zA-Z+]*://\([^/?]*\).*,\1,p' | sed -e 's,.*@,,' -e 's,:.*,,' ;;
-    *) printf '%s' "$dsn" | sed -n 's/.*[[:space:]]*host=\([^[:space:]]*\).*/\1/p' ;;
-  esac
-}
-
-# flow-enricher is its own container, so a loopback host or a socket path would
-# reach the enricher rather than Postgres. Only flag hosts we can positively
-# identify — an unparseable DSN must not leave the operator with no way forward.
-dsn_host_reachable() {
-  local dsn="$1"
-  case "$(dsn_host "$dsn")" in
-    localhost | 127.* | ::1 | 0.0.0.0 | /*) return 1 ;;
-    *) return 0 ;;
-  esac
-}
-
-# Names the compose service running this deployment's Postgres, for depends_on.
-# Empty means external — the DSN host matched no service. A DSN with no readable
-# host falls back to matching on image.
-detect_postgres_service() {
-  local host
-  host=$(dsn_host "$POSTGRES_DSN")
-  if [[ -n "$host" ]]; then
-    if [[ "$(host="$host" yq eval '.services | has(env(host))' "$COMPOSE_FILE" 2>/dev/null)" == "true" ]]; then
-      echo "$host"
-    fi
-    return
-  fi
-  yq eval '.services | to_entries | map(select(.value.image // "" | test("(^|/)(postgres|postgis|pgvector|timescaledb)(:|@|$)"))) | .[0].key // ""' "$COMPOSE_FILE"
-}
-
-# depends_on: service_healthy is only legal if the service defines a healthcheck.
-detect_postgres_depends_condition() {
-  local tag
-  tag=$(yq eval ".services[\"$POSTGRES_SERVICE\"].healthcheck | tag" "$COMPOSE_FILE" 2>/dev/null)
-  if [[ "$tag" == "!!map" ]]; then
-    echo "service_healthy"
-  else
-    echo "service_started"
-  fi
-}
-
-env_value() {
-  local value="$1"
-  value=$(printf '%s' "$value" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\$/$$/g')
-  printf '"%s"' "$value"
-}
-
 detect_compose_network() {
   local tag
   tag=$(yq eval ".services[\"$COMBINED_SERVICE\"].networks | tag" "$COMPOSE_FILE" 2>/dev/null)
@@ -328,30 +231,16 @@ services:
       NETBIRD_LICENSE_SERVER_BASE_URL: \${NETBIRD_LICENSE_SERVER_BASE_URL}
 EOF
 
-  # An existing Postgres is already wired up by the operator's own compose file,
-  # so only a Postgres this run creates needs a depends_on.
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     cat <<EOF
     depends_on:
-      ${POSTGRES_SERVICE}:
-        condition: ${POSTGRES_DEPENDS_CONDITION}
-EOF
-  fi
-
-  # The server is only pointed at a different config file when this run
-  # generates one. A pure image swap leaves it on its original config.yaml.
-  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
-    cat <<EOF
+      postgres:
+        condition: service_healthy
     volumes:
       - ./${ENTERPRISE_CONFIG_FILE}:/etc/netbird/config.yaml.enterprise:ro
     command: ["--config", "/etc/netbird/config.yaml.enterprise"]
-EOF
-  fi
 
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    cat <<EOF
-
-  ${POSTGRES_SERVICE}:
+  postgres:
     image: postgres:17
     container_name: netbird-postgres
     restart: unless-stopped
@@ -371,14 +260,6 @@ EOF
   fi
 
   if [[ "$ENABLE_FLOW" == "yes" ]]; then
-    # Nothing to wait on when Postgres is managed outside this compose project.
-    local enricher_depends=""
-    if [[ -n "$POSTGRES_SERVICE" ]]; then
-      enricher_depends="
-      ${POSTGRES_SERVICE}:
-        condition: ${POSTGRES_DEPENDS_CONDITION}"
-    fi
-
     cat <<EOF
 
   nats:
@@ -395,7 +276,9 @@ EOF
     container_name: netbird-flow-enricher
     restart: unless-stopped
     networks: [${COMPOSE_NETWORK}]
-    depends_on:${enricher_depends}
+    depends_on:
+      postgres:
+        condition: service_healthy
       nats:
         condition: service_started
     environment:
@@ -403,10 +286,10 @@ EOF
       NETBIRD_LICENSE_SERVER_BASE_URL: \${NETBIRD_LICENSE_SERVER_BASE_URL}
       NB_DATADIR: /var/lib/netbird
       NB_MANAGEMENT_STORE_ENGINE: postgres
-      NB_MANAGEMENT_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
-      NB_STORE_ENGINE_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
+      NB_MANAGEMENT_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+      NB_STORE_ENGINE_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
       NB_TRAFFIC_EVENT_STORE_ENGINE: postgres
-      NB_TRAFFIC_EVENT_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
+      NB_TRAFFIC_EVENT_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
       NB_MANAGEMENT_STORE_KEY: \${NETBIRD_ENCRYPTION_KEY}
       NB_FLOW_ADAPTER_TYPE: nats
       NB_FLOW_NATS_ENDPOINTS: nats://nats:4222
@@ -463,41 +346,27 @@ EOF
   fi
 }
 
-# Build config.yaml.enterprise from the operator's existing config.yaml. We
-# don't touch the original file. Values go through strenv() so a DSN carrying
-# quotes, backslashes or $ cannot break out of the expression.
+# Build config.yaml.enterprise by yq-editing the operator's existing
+# config.yaml. We don't touch the original file.
 render_enterprise_config() {
-  {
-    echo "# Generated by migrate-to-enterprise.sh from ${CONFIG_YAML_HOST}."
-    echo "# The enterprise server is started with --config pointing at this file,"
-    echo "# so later edits to ${CONFIG_YAML_HOST} have no effect until copied here."
-    cat "$CONFIG_YAML_HOST"
-  } > "$ENTERPRISE_CONFIG_FILE"
+  local pg_dsn="host=postgres user=netbird password=${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
 
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    # Fresh Postgres: point every store section at it. migrate-store carries the
-    # SQLite contents across.
-    POSTGRES_DSN="$POSTGRES_DSN" yq eval -i '
-      .server.store.engine = "postgres" |
-      .server.store.dsn = strenv(POSTGRES_DSN) |
-      .server.activityStore.engine = "postgres" |
-      .server.activityStore.dsn = strenv(POSTGRES_DSN) |
-      .server.authStore.engine = "postgres" |
-      .server.authStore.dsn = strenv(POSTGRES_DSN)
-    ' "$ENTERPRISE_CONFIG_FILE"
-  fi
-  # Otherwise the store config is the operator's and stays untouched.
-  # activityStore and authStore do not inherit from server.store — each falls
-  # back to its own SQLite file under dataDir — so repointing them at Postgres
-  # here would silently strand the existing audit log and the embedded IdP's
-  # users, with no migrate-store run to carry them over.
+  yq eval "
+    .server.store.engine = \"postgres\" |
+    .server.store.dsn = \"$pg_dsn\" |
+    .server.activityStore.engine = \"postgres\" |
+    .server.activityStore.dsn = \"$pg_dsn\" |
+    .server.authStore.engine = \"postgres\" |
+    .server.authStore.dsn = \"$pg_dsn\"
+  " "$CONFIG_YAML_HOST" > "$ENTERPRISE_CONFIG_FILE"
 
   if [[ "$ENABLE_FLOW" == "yes" ]]; then
-    NETBIRD_DOMAIN="$NETBIRD_DOMAIN" yq eval -i '
+    local flow_addr="${NETBIRD_DOMAIN}"
+    yq eval -i "
       .server.trafficFlow.enabled = true |
-      .server.trafficFlow.address = strenv(NETBIRD_DOMAIN) |
-      .server.trafficFlow.interval = "60s"
-    ' "$ENTERPRISE_CONFIG_FILE"
+      .server.trafficFlow.address = \"$flow_addr\" |
+      .server.trafficFlow.interval = \"60s\"
+    " "$ENTERPRISE_CONFIG_FILE"
   fi
 }
 
@@ -764,91 +633,6 @@ on_exit() {
 # Main
 # ---------------------------------------------------------------------------
 
-# Already on Postgres: there is nothing to provision and nothing to migrate.
-# The enterprise image reads the very same store config the community image
-# did, so step 2 collapses to a no-op and the run is a plain image swap.
-configure_existing_postgres() {
-  EXISTING_POSTGRES="yes"
-  MIGRATE_POSTGRES="no"
-
-  # DSN first — detect_postgres_service prefers the host it names.
-  POSTGRES_DSN=$(detect_store_dsn)
-  if [[ -z "$POSTGRES_DSN" ]] || [[ "$POSTGRES_DSN" == "null" ]]; then
-    POSTGRES_DSN=$(detect_store_dsn_from_compose)
-  fi
-  if [[ "$POSTGRES_DSN" == "null" ]]; then
-    POSTGRES_DSN=""
-  fi
-
-  POSTGRES_SERVICE=$(detect_postgres_service)
-  if [[ -n "$POSTGRES_SERVICE" ]]; then
-    POSTGRES_DEPENDS_CONDITION=$(detect_postgres_depends_condition)
-  fi
-
-  echo "Step 2: Postgres migration not needed — this deployment already runs on"
-  echo "        Postgres. Its store configuration is reused as-is and left"
-  echo "        untouched; no database is created and no data is moved."
-  if [[ -n "$POSTGRES_SERVICE" ]]; then
-    echo "        Postgres service: $POSTGRES_SERVICE (in $COMPOSE_FILE)"
-  else
-    echo "        Postgres service: managed outside $COMPOSE_FILE"
-  fi
-}
-
-configure_sqlite_store() {
-  MIGRATE_POSTGRES=$(read_yes_no "Step 2: Migrate storage from SQLite to Postgres? (recommended)" "n")
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
-
-  # The override would otherwise merge into a service of the same name and
-  # quietly rewrite its image and credentials.
-  local existing
-  existing=$(yq eval '.services | has("postgres")' "$COMPOSE_FILE")
-  if [[ "$existing" == "true" ]]; then
-    echo "" > /dev/stderr
-    echo "$COMPOSE_FILE already defines a service named 'postgres', but config.yaml" > /dev/stderr
-    echo "still has server.store.engine: sqlite. This script would add its own" > /dev/stderr
-    echo "'postgres' service and Compose would merge the two." > /dev/stderr
-    echo "" > /dev/stderr
-    echo "Point server.store.engine at that Postgres yourself, or rename the service," > /dev/stderr
-    echo "then re-run." > /dev/stderr
-    exit 1
-  fi
-
-  echo ""
-  echo "  ⚠  Data will be migrated from SQLite to Postgres. The SQLite store"
-  echo "     will be backed up automatically. To fully revert later, restore"
-  echo "     that backup and delete docker-compose.override.yml +"
-  echo "     config.yaml.enterprise."
-  local confirm
-  confirm=$(read_yes_no "  Continue?" "y")
-  if [[ "$confirm" != "yes" ]]; then
-    MIGRATE_POSTGRES="no"
-    echo "  Skipping Postgres migration."
-    return 0
-  fi
-
-  POSTGRES_PASSWORD=$(rand_password)
-  POSTGRES_SERVICE="postgres"
-  POSTGRES_DEPENDS_CONDITION="service_healthy"
-  POSTGRES_DSN="host=postgres user=netbird password=${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
-}
-
-# mysql, or something this script has never seen. Swapping the images is still
-# valid; touching the store is not.
-configure_unsupported_store() {
-  MIGRATE_POSTGRES="no"
-  echo "  ⚠  server.store.engine is '$STORE_ENGINE'. This script only migrates"
-  echo "     SQLite to Postgres, and traffic flow requires Postgres, so both are"
-  echo "     unavailable here. The store configuration will be left untouched."
-  echo ""
-  local proceed
-  proceed=$(read_yes_no "Step 2 skipped. Continue with the image swap only?" "n")
-  if [[ "$proceed" != "yes" ]]; then
-    echo "Aborted."
-    exit 0
-  fi
-}
-
 init_migration() {
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
   check_yq
@@ -898,15 +682,12 @@ init_migration() {
     exit 1
   fi
 
-  STORE_ENGINE=$(detect_store_engine)
-
   echo "Detected existing deployment:"
   echo "  Combined service: $COMBINED_SERVICE"
   echo "  Dashboard:        $DASHBOARD_SERVICE"
   echo "  config.yaml:      $CONFIG_YAML_HOST"
   echo "  Data volume:      $DATA_VOLUME"
   echo "  Network:          $COMPOSE_NETWORK"
-  echo "  Store engine:     $STORE_ENGINE"
   echo ""
 
   require_eula_acceptance
@@ -925,17 +706,28 @@ init_migration() {
   echo "Step 1: Image swap (community → Enterprise). License key required."
   NB_LICENSE_KEY=$(read_secret "  License key")
 
-  # Step 2 — what this does depends on what the deployment already stores in.
+  # Step 2 — optional
   echo ""
-  case "$STORE_ENGINE" in
-    postgres) configure_existing_postgres ;;
-    sqlite) configure_sqlite_store ;;
-    *) configure_unsupported_store ;;
-  esac
+  MIGRATE_POSTGRES=$(read_yes_no "Step 2: Migrate storage from SQLite to Postgres? (recommended)" "n")
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    echo ""
+    echo "  ⚠  Data will be migrated from SQLite to Postgres. The SQLite store"
+    echo "     will be backed up automatically. To fully revert later, restore"
+    echo "     that backup and delete docker-compose.override.yml +"
+    echo "     config.yaml.enterprise."
+    local confirm
+    confirm=$(read_yes_no "  Continue?" "y")
+    if [[ "$confirm" != "yes" ]]; then
+      MIGRATE_POSTGRES="no"
+      echo "  Skipping Postgres migration."
+    else
+      POSTGRES_PASSWORD=$(rand_password)
+    fi
+  fi
 
   # Step 3 — optional, only if Postgres is on (flow requires Postgres)
   echo ""
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]] || [[ "$EXISTING_POSTGRES" == "yes" ]]; then
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     ENABLE_FLOW=$(read_yes_no "Step 3: Enable traffic flow? (requires Postgres)" "n")
     if [[ "$ENABLE_FLOW" == "yes" ]]; then
       # Auth secret MUST match server.authSecret from config.yaml
@@ -959,43 +751,12 @@ init_migration() {
         echo "Could not read server.store.encryptionKey from $CONFIG_YAML_HOST." > /dev/stderr
         exit 1
       fi
-
-      # flow-enricher talks to Postgres directly, so this is the one place an
-      # existing deployment's DSN is actually needed — and the one place a host
-      # that only works from inside the server container shows up.
-      while :; do
-        local dsn_problem=""
-        if [[ -z "$POSTGRES_DSN" ]]; then
-          dsn_problem="No DSN could be read from $CONFIG_YAML_HOST or from the $COMBINED_SERVICE environment."
-        elif ! dsn_host_reachable "$POSTGRES_DSN"; then
-          dsn_problem="Its host '$(dsn_host "$POSTGRES_DSN")' only resolves inside the server container."
-        fi
-        [[ -n "$dsn_problem" ]] || break
-
-        echo ""
-        echo "  The flow enricher reaches Postgres from a container of its own."
-        echo "  $dsn_problem"
-        echo "  Enter a DSN reachable from other containers, or press Ctrl-C to abort."
-        POSTGRES_DSN=$(read_required "  Postgres DSN (host=… user=… password=… dbname=… port=5432 sslmode=disable)")
-      done
-
-      # A DSN entered above names a different host, which decides what to wait on.
-      POSTGRES_SERVICE=$(detect_postgres_service)
-      if [[ -n "$POSTGRES_SERVICE" ]]; then
-        POSTGRES_DEPENDS_CONDITION=$(detect_postgres_depends_condition)
-      fi
     fi
   else
     ENABLE_FLOW="no"
     echo "Step 3 (traffic flow) skipped — requires Postgres."
   fi
 
-  # config.yaml.enterprise only exists to hold changes; without any there is
-  # nothing to generate and the server keeps running on its own config.yaml.
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]] || [[ "$ENABLE_FLOW" == "yes" ]]; then
-    ENTERPRISE_CONFIG="yes"
-  fi
-
   check_data_directory
   check_stale_postgres_volume
 }
@@ -1013,7 +774,7 @@ apply_changes() {
     sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' "$OVERRIDE_FILE" && rm -f "$OVERRIDE_FILE.bak"
   fi
 
-  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     echo "Writing $ENTERPRISE_CONFIG_FILE ..."
     install -m 600 /dev/null "$ENTERPRISE_CONFIG_FILE"
     render_enterprise_config
@@ -1049,9 +810,6 @@ apply_changes() {
       echo "POSTGRES_PASSWORD=${POSTGRES_PASSWORD}"
     fi
     if [[ "$ENABLE_FLOW" == "yes" ]]; then
-      # Own variable name rather than NB_STORE_ENGINE_POSTGRES_DSN so that a
-      # deployment already setting that one keeps its own value.
-      echo "NB_ENTERPRISE_POSTGRES_DSN=$(env_value "$POSTGRES_DSN")"
       echo "NB_FLOW_AUTH_SECRET=${NB_FLOW_AUTH_SECRET}"
       echo "NETBIRD_ENCRYPTION_KEY=${NETBIRD_ENCRYPTION_KEY}"
     fi
@@ -1113,19 +871,14 @@ print_summary() {
   echo " Summary"
   echo "──────────────────────────────────────────────────────────────────────"
   echo "  Images:           swapped to enterprise"
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    echo "  Storage:          Postgres (data migrated from SQLite)"
-  elif [[ "$EXISTING_POSTGRES" == "yes" ]]; then
-    echo "  Storage:          Postgres (pre-existing, configuration unchanged)"
-  else
-    echo "  Storage:          $STORE_ENGINE (unchanged)"
-  fi
+  [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "  Storage:          Postgres (data migrated from SQLite)"
+  [[ "$MIGRATE_POSTGRES" != "yes" ]] && echo "  Storage:          SQLite (unchanged)"
   [[ "$ENABLE_FLOW" == "yes" ]] && echo "  Traffic flow:     enabled"
   [[ "$ENABLE_FLOW" != "yes" ]] && echo "  Traffic flow:     disabled"
   echo ""
   echo "  Generated files (next to your docker-compose.yml):"
   echo "    $OVERRIDE_FILE"
-  [[ "$ENTERPRISE_CONFIG" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
+  [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
   echo "    .env  (license key + secrets, mode 600)"
   [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]] && echo "    $ENV_BACKUP  (.env as it was before this run)"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    backups/sqlite-pre-enterprise-*/  (SQLite backup)"
@@ -1149,11 +902,7 @@ print_summary() {
   else
     echo "  $DOCKER_COMPOSE_COMMAND down"
   fi
-  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
-    echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
-  else
-    echo "  rm -f $OVERRIDE_FILE"
-  fi
+  echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
   if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
     echo "  mv $ENV_BACKUP .env   # restores .env as it was before this run"
   elif [[ "$ENV_EXISTED" == "no" ]]; then

management/internals/modules/agentnetwork/handlers/handlers_test.go

@@ -92,6 +92,13 @@ func newAgentNetworkHandlerFixture(t *testing.T) *agentNetworkHandlerFixture {
 }
 
 func (f *agentNetworkHandlerFixture) do(t *testing.T, method, path, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	return f.doWithHeaders(t, method, path, body, nil)
+}
+
+// doWithHeaders is do with request headers, for the cases where the header is
+// the thing under test (conditional requests).
+func (f *agentNetworkHandlerFixture) doWithHeaders(t *testing.T, method, path, body string, headers map[string]string) *httptest.ResponseRecorder {
 	t.Helper()
 	var reader io.Reader
 	if body != "" {
@@ -101,6 +108,9 @@ func (f *agentNetworkHandlerFixture) do(t *testing.T, method, path, body string)
 	if body != "" {
 		req.Header.Set("Content-Type", "application/json")
 	}
+	for name, value := range headers {
+		req.Header.Set(name, value)
+	}
 	req = nbcontext.SetUserAuthInRequest(req, auth.UserAuth{
 		UserId:    testUserID,
 		AccountId: testAccountID,

management/internals/modules/agentnetwork/handlers/settings_handler.go

@@ -60,12 +60,20 @@ func (h *handler) createSettings(w http.ResponseWriter, r *http.Request) {
 		util.WriteError(r.Context(), err, w)
 		return
 	}
+	// Emitting the validator here lets a client that just bootstrapped issue a
+	// conditional PUT without an intervening GET.
+	util.SetETag(w, created.ETag())
 	util.WriteJSONObject(r.Context(), w, created.ToAPIResponse())
 }
 
 // updateSettings replaces the mutable settings fields on the account's row.
 // A request carrying a cluster bootstraps the row when the account doesn't
 // have one yet.
+//
+// An If-Match header makes the update conditional: it is honoured against the
+// stored row inside the write's transaction, and a stale validator is refused
+// with 412 rather than overwriting what changed since the client read. Omitting
+// the header keeps the pre-existing last-write-wins behaviour.
 func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -82,11 +90,12 @@ func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	settings := &types.Settings{AccountID: userAuth.AccountId}
 	settings.FromAPIRequest(&req)
 
-	updated, err := h.manager.UpdateSettings(r.Context(), userAuth.UserId, settings)
+	updated, err := h.manager.UpdateSettings(r.Context(), userAuth.UserId, settings, util.IfMatch(r))
 	if err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
 	}
+	util.SetETag(w, updated.ETag())
 	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
 }
 
@@ -94,6 +103,11 @@ func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 // The manager refuses (412) while providers exist or a proxy is actively
 // serving the endpoint; a later POST bootstraps fresh, allocating a new
 // endpoint.
+//
+// An If-Match header makes the delete conditional, and is worth sending here
+// even more than on update: both existing guards are about state rather than
+// staleness, so nothing else stops a client from deleting a row that was
+// replaced since it read one.
 func (h *handler) deleteSettings(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -101,7 +115,7 @@ func (h *handler) deleteSettings(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err := h.manager.DeleteSettings(r.Context(), userAuth.AccountId, userAuth.UserId); err != nil {
+	if err := h.manager.DeleteSettings(r.Context(), userAuth.AccountId, userAuth.UserId, util.IfMatch(r)); err != nil {
 		util.WriteError(r.Context(), err, w)
 		return
 	}
@@ -123,5 +137,9 @@ func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
 		util.WriteError(r.Context(), err, w)
 		return
 	}
+	// The pre-bootstrap defaults are a representation like any other and carry
+	// a validator too, so an If-Match taken before bootstrap cannot silently
+	// match the row that appeared since.
+	util.SetETag(w, settings.ETag())
 	util.WriteJSONObject(r.Context(), w, settings.ToAPIResponse())
 }

management/internals/modules/agentnetwork/handlers/settings_handler_test.go

@@ -393,3 +393,202 @@ func TestSettingsHandler_DeleteReleasesEndpointForFreshBootstrap(t *testing.T) {
 		"the fresh row must carry bootstrap defaults, not the deleted row's toggles")
 	assert.NotNil(t, second.CreatedAt, "the fresh row is persisted and carries timestamps")
 }
+
+// bootstrapForETag bootstraps a settings row and returns the response body
+// alongside the validator the bootstrap emitted, which is what a client would
+// carry into its first conditional write.
+func bootstrapForETag(t *testing.T, f *agentNetworkHandlerFixture) (api.AgentNetworkSettings, string) {
+	t.Helper()
+
+	rec := f.do(t, http.MethodPost, "/agent-network/settings",
+		`{"proxy_address": "eu.proxy.netbird.io", "enable_prompt_collection": true, "redact_pii": true, "access_log_retention_days": 14}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap POST must succeed: %s", rec.Body.String())
+
+	var settings api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &settings))
+
+	etag := rec.Header().Get("ETag")
+	require.NotEmpty(t, etag, "bootstrap must emit a validator so a client can PUT without an intervening GET")
+	return settings, etag
+}
+
+// putBody renders a complete settings update — every field, with the identity
+// echo the endpoint requires — so the conditional-request tests differ only in
+// their headers.
+func putBody(settings api.AgentNetworkSettings, redactPii bool, retention int) string {
+	return fmt.Sprintf(
+		`{"endpoint": %q, "proxy_address": %q, "enable_log_collection": true, "enable_prompt_collection": true, "redact_pii": %t, "access_log_retention_days": %d}`,
+		settings.Endpoint, settings.ProxyAddress, redactPii, retention)
+}
+
+// TestSettingsHandler_EmitsETag pins that every read and every write hands the
+// client back a validator, quoted as a strong entity-tag. Without one on the
+// write responses a client would have to re-GET after every update to stay
+// able to make the next one conditional.
+func TestSettingsHandler_EmitsETag(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	// The pre-bootstrap defaults are a representation too, and validate like
+	// one — an If-Match taken here must not match the row that appears later.
+	rec := f.do(t, http.MethodGet, "/agent-network/settings", "")
+	require.Equal(t, http.StatusOK, rec.Code)
+	defaultsETag := rec.Header().Get("ETag")
+	assert.NotEmpty(t, defaultsETag, "the unbootstrapped view must carry a validator")
+
+	settings, bootstrapETag := bootstrapForETag(t, f)
+	assert.Regexp(t, `^"[0-9a-f]+"$`, bootstrapETag, "the validator must be a quoted strong entity-tag")
+	assert.NotEqual(t, defaultsETag, bootstrapETag, "bootstrapping must move the validator")
+
+	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
+	require.Equal(t, http.StatusOK, rec.Code)
+	assert.Equal(t, bootstrapETag, rec.Header().Get("ETag"),
+		"reading an unchanged row must derive the same validator the bootstrap returned")
+
+	rec = f.do(t, http.MethodPut, "/agent-network/settings", putBody(settings, false, 7))
+	require.Equal(t, http.StatusOK, rec.Code, "update must succeed: %s", rec.Body.String())
+	assert.NotEqual(t, bootstrapETag, rec.Header().Get("ETag"),
+		"an update that changed the representation must return a different validator")
+}
+
+// TestSettingsHandler_PutIfMatch walks the conditional-update contract. The
+// stale case is the one the feature exists for: a client that planned against
+// an earlier read must be refused rather than silently reverting whatever
+// changed in between — RedactPii above all, where a silent revert turns a
+// compliance control off with no error and no drift warning.
+func TestSettingsHandler_PutIfMatch(t *testing.T) {
+	t.Run("matching validator succeeds", func(t *testing.T) {
+		f := newAgentNetworkHandlerFixture(t)
+		settings, etag := bootstrapForETag(t, f)
+
+		rec := f.doWithHeaders(t, http.MethodPut, "/agent-network/settings",
+			putBody(settings, false, 7), map[string]string{"If-Match": etag})
+		require.Equal(t, http.StatusOK, rec.Code,
+			"a matching precondition must be honoured: got %d body=%s", rec.Code, rec.Body.String())
+		assert.NotEqual(t, etag, rec.Header().Get("ETag"),
+			"the response must carry the new validator, not the one that was matched")
+	})
+
+	t.Run("stale validator is refused and changes nothing", func(t *testing.T) {
+		f := newAgentNetworkHandlerFixture(t)
+		settings, stale := bootstrapForETag(t, f)
+
+		// Someone else writes in between — the dashboard operator enabling
+		// something the planning client never saw.
+		rec := f.do(t, http.MethodPut, "/agent-network/settings", putBody(settings, true, 21))
+		require.Equal(t, http.StatusOK, rec.Code, "the intervening update must succeed: %s", rec.Body.String())
+		var intervened api.AgentNetworkSettings
+		require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &intervened))
+
+		rec = f.doWithHeaders(t, http.MethodPut, "/agent-network/settings",
+			putBody(settings, false, 7), map[string]string{"If-Match": stale})
+		require.Equal(t, http.StatusPreconditionFailed, rec.Code,
+			"a stale precondition must be refused: got %d body=%s", rec.Code, rec.Body.String())
+
+		// Asserting the state, not just the status: a partial write would pass
+		// a status-only check.
+		rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
+		require.Equal(t, http.StatusOK, rec.Code)
+		var after api.AgentNetworkSettings
+		require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &after))
+		assert.Equal(t, intervened, after, "the refused update must leave the row byte-identical")
+	})
+
+	t.Run("star matches the existing row", func(t *testing.T) {
+		f := newAgentNetworkHandlerFixture(t)
+		settings, _ := bootstrapForETag(t, f)
+
+		rec := f.doWithHeaders(t, http.MethodPut, "/agent-network/settings",
+			putBody(settings, false, 7), map[string]string{"If-Match": "*"})
+		assert.Equal(t, http.StatusOK, rec.Code,
+			"* must match any current representation: got %d body=%s", rec.Code, rec.Body.String())
+	})
+
+	t.Run("no precondition still succeeds", func(t *testing.T) {
+		f := newAgentNetworkHandlerFixture(t)
+		settings, _ := bootstrapForETag(t, f)
+
+		// The back-compatibility guarantee: clients that predate conditional
+		// requests — the dashboard among them — keep last-write-wins.
+		rec := f.do(t, http.MethodPut, "/agent-network/settings", putBody(settings, false, 7))
+		assert.Equal(t, http.StatusOK, rec.Code,
+			"an unconditional update must keep working: got %d body=%s", rec.Code, rec.Body.String())
+	})
+
+	t.Run("precondition is checked before the immutability echo", func(t *testing.T) {
+		f := newAgentNetworkHandlerFixture(t)
+		settings, stale := bootstrapForETag(t, f)
+
+		rec := f.do(t, http.MethodPut, "/agent-network/settings", putBody(settings, true, 21))
+		require.Equal(t, http.StatusOK, rec.Code, "the intervening update must succeed: %s", rec.Body.String())
+
+		// A client stale enough to hold an old validator may be stale in its
+		// identity echo too. Answering 412 tells it the useful thing — go and
+		// read again — where 422 would send it hunting an immutability bug.
+		body := fmt.Sprintf(
+			`{"endpoint": "other.gateway.example.com", "proxy_address": %q, "enable_log_collection": true, "enable_prompt_collection": true, "redact_pii": false, "access_log_retention_days": 7}`,
+			settings.ProxyAddress)
+		rec = f.doWithHeaders(t, http.MethodPut, "/agent-network/settings", body,
+			map[string]string{"If-Match": stale})
+		assert.Equal(t, http.StatusPreconditionFailed, rec.Code,
+			"staleness must be reported ahead of the identity mismatch: got %d body=%s", rec.Code, rec.Body.String())
+	})
+}
+
+// TestSettingsHandler_DeleteIfMatch covers the conditional delete, which
+// carries more weight than the conditional update: both existing delete guards
+// are about state — no providers, no serving proxy — so nothing else stops a
+// client from deleting a row that was replaced since it read one.
+func TestSettingsHandler_DeleteIfMatch(t *testing.T) {
+	t.Run("stale validator is refused and the row survives", func(t *testing.T) {
+		f := newAgentNetworkHandlerFixture(t)
+		settings, stale := bootstrapForETag(t, f)
+
+		rec := f.do(t, http.MethodPut, "/agent-network/settings", putBody(settings, true, 21))
+		require.Equal(t, http.StatusOK, rec.Code, "the intervening update must succeed: %s", rec.Body.String())
+
+		rec = f.doWithHeaders(t, http.MethodDelete, "/agent-network/settings", "",
+			map[string]string{"If-Match": stale})
+		require.Equal(t, http.StatusPreconditionFailed, rec.Code,
+			"a stale precondition must refuse the delete: got %d body=%s", rec.Code, rec.Body.String())
+
+		rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
+		require.Equal(t, http.StatusOK, rec.Code)
+		var after api.AgentNetworkSettings
+		require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &after))
+		assert.Equal(t, settings.Endpoint, after.Endpoint, "the refused delete must leave the row in place")
+	})
+
+	t.Run("matching validator deletes", func(t *testing.T) {
+		f := newAgentNetworkHandlerFixture(t)
+		_, etag := bootstrapForETag(t, f)
+
+		rec := f.doWithHeaders(t, http.MethodDelete, "/agent-network/settings", "",
+			map[string]string{"If-Match": etag})
+		require.Equal(t, http.StatusOK, rec.Code,
+			"a matching precondition must be honoured: got %d body=%s", rec.Code, rec.Body.String())
+
+		rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
+		require.Equal(t, http.StatusOK, rec.Code)
+		var after api.AgentNetworkSettings
+		require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &after))
+		assert.Empty(t, after.Endpoint, "the row must be gone")
+	})
+
+	t.Run("precondition is checked before the state guards", func(t *testing.T) {
+		f := newAgentNetworkHandlerFixture(t)
+		settings, stale := bootstrapForETag(t, f)
+
+		rec := f.do(t, http.MethodPut, "/agent-network/settings", putBody(settings, true, 21))
+		require.Equal(t, http.StatusOK, rec.Code, "the intervening update must succeed: %s", rec.Body.String())
+		f.seedProvider(t, "prov-precondition")
+
+		// Both refusals are 412, so the status cannot tell them apart — the
+		// message must, or a stale client is sent to delete providers it may
+		// not even know about.
+		rec = f.doWithHeaders(t, http.MethodDelete, "/agent-network/settings", "",
+			map[string]string{"If-Match": stale})
+		require.Equal(t, http.StatusPreconditionFailed, rec.Code, "the delete must be refused: %s", rec.Body.String())
+		assert.Contains(t, rec.Body.String(), "if-match",
+			"staleness must be reported ahead of the provider guard: %s", rec.Body.String())
+	})
+}

management/internals/modules/agentnetwork/manager.go

@@ -22,6 +22,7 @@ import (
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
 	"github.com/netbirdio/netbird/management/server/store"
+	httputil "github.com/netbirdio/netbird/shared/management/http/util"
 	"github.com/netbirdio/netbird/shared/management/status"
 )
 
@@ -71,8 +72,8 @@ type Manager interface {
 
 	GetSettings(ctx context.Context, accountID, userID string) (*types.Settings, error)
 	CreateSettings(ctx context.Context, userID string, settings *types.Settings, proxyAddress, endpoint string) (*types.Settings, error)
-	UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error)
-	DeleteSettings(ctx context.Context, accountID, userID string) error
+	UpdateSettings(ctx context.Context, userID string, settings *types.Settings, precondition *httputil.Precondition) (*types.Settings, error)
+	DeleteSettings(ctx context.Context, accountID, userID string, precondition *httputil.Precondition) error
 
 	ListConsumption(ctx context.Context, accountID, userID string) ([]*types.Consumption, error)
 	ListAccessLogs(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLog, int64, error)
@@ -544,6 +545,13 @@ func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, r
 	return nil
 }
 
+// stalePreconditionMsg is the refusal both conditional settings writes return.
+// Shared so the two cannot drift: DeleteSettings answers 412 for its state
+// guards as well, so the message is the only thing telling a client that it is
+// working from an old read rather than tripping over providers or a serving
+// proxy.
+const stalePreconditionMsg = "if-match precondition failed: the settings have changed since they were read; GET them again and retry"
+
 // UpdateSettings replaces the mutable account-level settings — the collection
 // toggles and retention — on the account's row. The identity fields (Domain,
 // ProxyAddress) are assigned at bootstrap (CreateSettings) and immutable: the
@@ -554,7 +562,11 @@ func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, r
 // Because the collection toggles change the synthesised service config
 // (prompt-capture gating, access-log emission), a reconcile is triggered so
 // the proxy and peer network maps converge on the new state.
-func (m *managerImpl) UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error) {
+//
+// precondition carries the caller's If-Match, and is nil for an unconditional
+// update — last write wins, which is what the dashboard wants and what every
+// client that predates conditional requests gets.
+func (m *managerImpl) UpdateSettings(ctx context.Context, userID string, settings *types.Settings, precondition *httputil.Precondition) (*types.Settings, error) {
 	if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Update); err != nil {
 		return nil, err
 	}
@@ -573,6 +585,20 @@ func (m *managerImpl) UpdateSettings(ctx context.Context, userID string, setting
 			return fmt.Errorf("get agent network settings: %w", err)
 		}
 
+		// Evaluated here, under the row lock and inside the write's own
+		// transaction, rather than in the handler: comparing before the
+		// transaction only narrows the race, since two requests can both pass
+		// the check before either writes. Locking the row first makes it a
+		// genuine compare-and-set.
+		//
+		// It comes before the identity comparison because a client holding a
+		// stale validator is stale in its identity echo too, and "you are
+		// working from an old read" is the more accurate answer than "the
+		// endpoint is immutable".
+		if !precondition.Matches(existing.ETag()) {
+			return status.Errorf(status.PreconditionFailed, "%s", stalePreconditionMsg)
+		}
+
 		// The identity echo is compared leniently (trimmed, case-insensitive):
 		// the stored values are normalized lowercase, and a client replaying a
 		// GET response must never be rejected over casing it didn't choose.
@@ -635,7 +661,12 @@ func hostnamesEquivalent(supplied, stored string) bool {
 // is not reserved. That full-reset semantic is what gives clients that model
 // immutability as replace-on-change (e.g. Terraform's RequiresReplace) a real
 // path: tear down providers, delete, re-create.
-func (m *managerImpl) DeleteSettings(ctx context.Context, accountID, userID string) error {
+//
+// precondition carries the caller's If-Match, and is nil for an unconditional
+// delete. It matters more here than on update: the two guards above are about
+// state rather than staleness, so without it nothing stops a client from
+// deleting a row that was replaced since it last read one.
+func (m *managerImpl) DeleteSettings(ctx context.Context, accountID, userID string, precondition *httputil.Precondition) error {
 	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Delete); err != nil {
 		return err
 	}
@@ -651,6 +682,13 @@ func (m *managerImpl) DeleteSettings(ctx context.Context, accountID, userID stri
 			return fmt.Errorf("get agent network settings: %w", err)
 		}
 
+		// Under the row lock, for the same reason as in UpdateSettings, and
+		// before the state guards: a caller working from an old read should
+		// learn that first, not be told about providers it may not know exist.
+		if !precondition.Matches(existing.ETag()) {
+			return status.Errorf(status.PreconditionFailed, "%s", stalePreconditionMsg)
+		}
+
 		providers, err := tx.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
 		if err != nil {
 			return fmt.Errorf("get agent network providers: %w", err)
@@ -1100,11 +1138,13 @@ func (*mockManager) CreateSettings(_ context.Context, _ string, s *types.Setting
 	return s, nil
 }
 
-func (*mockManager) UpdateSettings(_ context.Context, _ string, s *types.Settings) (*types.Settings, error) {
+func (*mockManager) UpdateSettings(_ context.Context, _ string, s *types.Settings, _ *httputil.Precondition) (*types.Settings, error) {
 	return s, nil
 }
 
-func (*mockManager) DeleteSettings(_ context.Context, _, _ string) error { return nil }
+func (*mockManager) DeleteSettings(_ context.Context, _, _ string, _ *httputil.Precondition) error {
+	return nil
+}
 
 func (*mockManager) ListConsumption(_ context.Context, _, _ string) ([]*types.Consumption, error) {
 	return nil, nil

management/internals/modules/agentnetwork/settings_etag_test.go

@@ -0,0 +1,199 @@
+package agentnetwork
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"sync"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/store"
+	httputil "github.com/netbirdio/netbird/shared/management/http/util"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// ifMatch builds the precondition a client sending this validator would
+// produce, by going through the same header parse the handler uses rather than
+// reaching past it.
+func ifMatch(t *testing.T, etag string) *httputil.Precondition {
+	t.Helper()
+
+	r := httptest.NewRequest(http.MethodPut, "/", nil)
+	r.Header.Set("If-Match", strconv.Quote(etag))
+	return httputil.IfMatch(r)
+}
+
+// updateFor renders a complete update for the given row, echoing the identity
+// fields the endpoint requires and setting retention to tell writers apart.
+func updateFor(settings *types.Settings, retention int) *types.Settings {
+	return &types.Settings{
+		AccountID:              settings.AccountID,
+		Domain:                 settings.Domain,
+		ProxyAddress:           settings.ProxyAddress,
+		EnableLogCollection:    true,
+		EnablePromptCollection: true,
+		RedactPii:              true,
+		AccessLogRetentionDays: retention,
+	}
+}
+
+// TestUpdateSettingsPreconditionSerializesConcurrentWriters is the test the
+// design rests on. Two writers start from the same validator and race; exactly
+// one may win.
+//
+// An implementation that compares the validator before opening the write
+// transaction passes every sequential test in this suite and fails here: both
+// writers read the same row, both find their precondition satisfied, and both
+// then write — which is the lost update the feature exists to prevent, merely
+// narrowed to a smaller window. Holding the row under LockingStrengthUpdate
+// and comparing inside the write's own transaction is what makes it a genuine
+// compare-and-set.
+//
+// The test store is sqlite, which serializes writers of its own accord, so
+// what this pins directly is the outcome — exactly one success — rather than
+// the mechanism. It still has teeth against the check-before-transaction
+// shape, whose two reads interleave freely before either write. Running it
+// against postgres (NB_STORE_ENGINE_POSTGRES_DSN) exercises real concurrent
+// transactions.
+func TestUpdateSettingsPreconditionSerializesConcurrentWriters(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+
+	const accountID, userID = "account1", "user1"
+	f.expectPermission(accountID, userID, modules.AgentNetworkSettings, operations.Create, true)
+	f.expectPermission(accountID, userID, modules.AgentNetworkSettings, operations.Update, true)
+	f.expectPermission(accountID, userID, modules.AgentNetworkSettings, operations.Update, true)
+
+	created, err := f.createSettings(ctx, accountID, userID, "cluster1.example.com", "")
+	require.NoError(t, err, "bootstrap must succeed")
+
+	// Both writers plan against this one read, as a client that read, computed
+	// a diff and is about to write the whole object back would.
+	shared := created.ETag()
+
+	// noWrite is a retention value neither writer sends and the API would
+	// never store, so an assertion that lands on it is a test bug rather than
+	// a silently satisfied comparison. Zero would not do: the API documents 0
+	// as "keep indefinitely", so it is a value the row could legitimately hold.
+	const noWrite = -1
+
+	var (
+		wg       sync.WaitGroup
+		start    = make(chan struct{})
+		errs     = make([]error, 2)
+		wrote    = []int{7, 21}
+		returned = []int{noWrite, noWrite}
+	)
+	for i := range 2 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			<-start
+			updated, err := f.manager.UpdateSettings(ctx, userID, updateFor(created, wrote[i]), ifMatch(t, shared))
+			errs[i] = err
+			if err == nil {
+				returned[i] = updated.AccessLogRetentionDays
+			}
+		}()
+	}
+	close(start)
+	wg.Wait()
+
+	succeeded, winner := 0, noWrite
+	for i, err := range errs {
+		if err == nil {
+			succeeded++
+			winner = wrote[i]
+			assert.Equal(t, wrote[i], returned[i], "the winner's response must carry what it sent")
+			continue
+		}
+		assert.Truef(t, isPreconditionFailed(err),
+			"the losing writer must be refused for staleness, got: %v (writer %d)", err, i)
+	}
+	require.Equal(t, 1, succeeded, "exactly one writer may win: %v", errs)
+
+	// The row must carry the winner's value and nothing blended.
+	stored, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err, "the row must survive the race")
+	assert.Equal(t, winner, stored.AccessLogRetentionDays,
+		"the stored row must be exactly what the winning writer sent")
+	assert.NotEqual(t, shared, stored.ETag(), "the surviving row must derive a new validator")
+}
+
+// TestUpdateSettingsUnconditionalIgnoresStaleness pins the back-compatibility
+// half: without a precondition the manager keeps last-write-wins, which is
+// what the dashboard relies on and what any client that predates conditional
+// requests does.
+func TestUpdateSettingsUnconditionalIgnoresStaleness(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+
+	const accountID, userID = "account1", "user1"
+	f.expectPermission(accountID, userID, modules.AgentNetworkSettings, operations.Create, true)
+	f.expectPermission(accountID, userID, modules.AgentNetworkSettings, operations.Update, true)
+	f.expectPermission(accountID, userID, modules.AgentNetworkSettings, operations.Update, true)
+
+	created, err := f.createSettings(ctx, accountID, userID, "cluster1.example.com", "")
+	require.NoError(t, err, "bootstrap must succeed")
+
+	_, err = f.manager.UpdateSettings(ctx, userID, updateFor(created, 21), nil)
+	require.NoError(t, err, "the first unconditional update must succeed")
+
+	// The second writer is working from a read that is now stale, and with no
+	// precondition it overwrites regardless.
+	updated, err := f.manager.UpdateSettings(ctx, userID, updateFor(created, 7), nil)
+	require.NoError(t, err, "an unconditional update must not be refused for staleness")
+	assert.Equal(t, 7, updated.AccessLogRetentionDays, "last write wins without a precondition")
+}
+
+// TestDeleteSettingsPreconditionRefusesStale pins the conditional delete at
+// the manager level: a stale validator refuses, and the row is still there
+// afterwards. Deletion is the destructive operation and its two other guards
+// are about state rather than staleness, so this is the only thing standing
+// between a client working from an old read and a released endpoint.
+func TestDeleteSettingsPreconditionRefusesStale(t *testing.T) {
+	ctx := context.Background()
+	f := newBootstrapFixture(t)
+
+	const accountID, userID = "account1", "user1"
+	f.expectPermission(accountID, userID, modules.AgentNetworkSettings, operations.Create, true)
+	f.expectPermission(accountID, userID, modules.AgentNetworkSettings, operations.Update, true)
+	f.expectPermission(accountID, userID, modules.AgentNetworkSettings, operations.Delete, true)
+	f.expectPermission(accountID, userID, modules.AgentNetworkSettings, operations.Delete, true)
+
+	created, err := f.createSettings(ctx, accountID, userID, "cluster1.example.com", "")
+	require.NoError(t, err, "bootstrap must succeed")
+	stale := created.ETag()
+
+	updated, err := f.manager.UpdateSettings(ctx, userID, updateFor(created, 21), nil)
+	require.NoError(t, err, "the intervening update must succeed")
+
+	err = f.manager.DeleteSettings(ctx, accountID, userID, ifMatch(t, stale))
+	require.Error(t, err, "a stale precondition must refuse the delete")
+	assert.True(t, isPreconditionFailed(err), "the refusal must be a precondition failure, got: %v", err)
+
+	stored, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	require.NoError(t, err, "the refused delete must leave the row in place")
+	assert.Equal(t, created.Domain, stored.Domain, "the endpoint must not have been released")
+
+	// The validator the intervening update returned is the current one, and
+	// deleting with it goes through.
+	require.NoError(t, f.manager.DeleteSettings(ctx, accountID, userID, ifMatch(t, updated.ETag())),
+		"a matching precondition must be honoured")
+	_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	assert.Error(t, err, "the row must be gone")
+}
+
+// isPreconditionFailed reports whether err is the 412-mapped status error.
+func isPreconditionFailed(err error) bool {
+	var sErr *status.Error
+	return errors.As(err, &sErr) && sErr.Type() == status.PreconditionFailed
+}

management/internals/modules/agentnetwork/types/settings.go

@@ -1,6 +1,8 @@
 package types
 
 import (
+	"crypto/sha256"
+	"encoding/hex"
 	"fmt"
 	"strings"
 	"time"
@@ -67,6 +69,64 @@ func DefaultSettings(accountID string) *Settings {
 	}
 }
 
+// etagLength is how much of the hash the validator carries. 16 hex characters
+// — 64 bits — is far more than enough to make an accidental collision between
+// two representations of one account's settings unreachable, and keeps the
+// header short enough to read in a log line.
+const etagLength = 16
+
+// ETag returns a strong validator over the settings representation, for
+// conditional requests (RFC 9110 If-Match). The value is unquoted; applying
+// the quoting is the transport layer's job.
+//
+// The hash covers an explicit field tuple rather than the marshalled API
+// representation: field ordering in the generated API types is not a contract,
+// so hashing serialized output would make the validator churn with codegen.
+// Two exclusions are deliberate:
+//
+//   - AccountID identifies the resource — it is the URL, not the
+//     representation. Including it would make the validator differ between
+//     accounts whose settings are genuinely identical, which no client can
+//     observe and no precondition needs.
+//   - UpdatedAt is excluded so that equal representations always yield equal
+//     validators. A write that changes nothing must not invalidate a
+//     precondition another client is holding.
+//
+// Everything else is in, including the identity fields and CreatedAt. A
+// validator that covered only the mutable toggles would survive a delete
+// followed by a fresh bootstrap onto the same toggle values, and an If-Match
+// held across that gap would then authorize a write against what is really a
+// different resource. CreatedAt is what distinguishes the re-bootstrapped row.
+//
+// CreatedAt is hashed at whole-second precision because the validator has to
+// agree across a store round-trip. A freshly bootstrapped row derives its
+// validator in memory, from a time.Time carrying nanoseconds, while every
+// later comparison derives it from a row read back out of the store — and the
+// engines truncate: PostgreSQL to microseconds, MySQL DATETIME to whole
+// seconds without an fsp. At nanosecond precision the two never agree again,
+// so the validator a bootstrap hands out is permanently unusable. Seconds is
+// the floor every supported engine preserves. The cost is that a delete and
+// re-bootstrap within the same second, onto the same endpoint and the same
+// toggles, derives the same validator; a labeled bootstrap draws a fresh
+// random label, so that needs a self-addressed endpoint reclaimed inside one
+// second.
+//
+// Adding a field to Settings means deciding whether it belongs here; the
+// field-count guard in the tests is what forces that decision.
+func (s *Settings) ETag() string {
+	h := sha256.New()
+	fmt.Fprintf(h, "%s\x00%s\x00%t\x00%t\x00%t\x00%d\x00%d",
+		s.Domain,
+		s.ProxyAddress,
+		s.EnableLogCollection,
+		s.EnablePromptCollection,
+		s.RedactPii,
+		s.AccessLogRetentionDays,
+		s.CreatedAt.Unix(),
+	)
+	return hex.EncodeToString(h.Sum(nil))[:etagLength]
+}
+
 // Endpoint returns the bare hostname agents reach this account at — the
 // Domain column. Empty until the row is bootstrapped.
 func (s *Settings) Endpoint() string { return s.Domain }

management/internals/modules/agentnetwork/types/settings_test.go

@@ -0,0 +1,184 @@
+package types
+
+import (
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// etagSettings is a fully populated settings row — every hashed field set to a
+// distinctive value — so a mutation test can flip exactly one thing at a time.
+// The timestamp carries sub-second precision on purpose: a whole-second value
+// would make the precision test below pass without proving anything.
+func etagSettings() *Settings {
+	created := time.Date(2026, 8, 11, 9, 30, 0, 123456789, time.UTC)
+	return &Settings{
+		AccountID:              "acc-1",
+		Domain:                 "cool-otter.eu.proxy.netbird.io",
+		ProxyAddress:           "eu.proxy.netbird.io",
+		EnableLogCollection:    true,
+		EnablePromptCollection: true,
+		RedactPii:              true,
+		AccessLogRetentionDays: 30,
+		CreatedAt:              created,
+		UpdatedAt:              created,
+	}
+}
+
+// TestSettings_ETagShape pins the wire shape of the validator: a bare
+// lowercase hex string of the documented length, with no quoting — quoting is
+// the transport layer's job, and a validator that arrived pre-quoted would be
+// double-quoted on the way out.
+func TestSettings_ETagShape(t *testing.T) {
+	etag := etagSettings().ETag()
+
+	assert.Len(t, etag, etagLength, "the validator must be exactly etagLength characters")
+	assert.NotContains(t, etag, `"`, "the derived validator must not carry its own quoting")
+	for _, r := range etag {
+		require.Truef(t, (r >= '0' && r <= '9') || (r >= 'a' && r <= 'f'),
+			"the validator must be lowercase hex, got %q in %q", r, etag)
+	}
+}
+
+// TestSettings_ETagIsStable covers the guarantee every conditional request
+// rests on: an unchanged row derives the same validator every time, including
+// across a fresh struct built from the same values. A validator that varied
+// per derivation would fail every If-Match and make the feature unusable.
+func TestSettings_ETagIsStable(t *testing.T) {
+	s := etagSettings()
+
+	first := s.ETag()
+	assert.Equal(t, first, s.ETag(), "repeated derivation from one value must agree")
+	assert.Equal(t, first, etagSettings().ETag(), "an equal row must derive an equal validator")
+}
+
+// TestSettings_ETagSensitivity is the other half of the contract: every field
+// the validator covers must actually move it. The cases are also what makes
+// the field-count guard meaningful — a new field that belongs in the tuple but
+// is missing from it has no case here, and the guard is what catches that.
+//
+// The mutations are checked to be pairwise distinct, not merely different from
+// the baseline: that is what catches an ambiguous concatenation, where moving
+// a character across a field boundary would hash identically without the
+// delimiter.
+func TestSettings_ETagSensitivity(t *testing.T) {
+	cases := []struct {
+		name   string
+		mutate func(*Settings)
+	}{
+		{"domain", func(s *Settings) { s.Domain = "brave-otter.eu.proxy.netbird.io" }},
+		{"proxy address", func(s *Settings) { s.ProxyAddress = "us.proxy.netbird.io" }},
+		{"log collection", func(s *Settings) { s.EnableLogCollection = false }},
+		{"prompt collection", func(s *Settings) { s.EnablePromptCollection = false }},
+		{"redact pii", func(s *Settings) { s.RedactPii = false }},
+		{"retention", func(s *Settings) { s.AccessLogRetentionDays = 14 }},
+		{"created at", func(s *Settings) { s.CreatedAt = s.CreatedAt.Add(time.Second) }},
+		// Moving characters across the Domain/ProxyAddress boundary leaves
+		// the two fields' concatenation byte-identical, so this case passes
+		// only because the tuple is delimited.
+		{"identity boundary shifted", func(s *Settings) {
+			joined := s.Domain + s.ProxyAddress
+			split := len(s.Domain) - 3
+			s.Domain, s.ProxyAddress = joined[:split], joined[split:]
+		}},
+	}
+
+	baseline := etagSettings().ETag()
+	seen := map[string]string{"baseline": baseline}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			s := etagSettings()
+			tc.mutate(s)
+
+			etag := s.ETag()
+			assert.NotEqual(t, baseline, etag, "changing %s must change the validator", tc.name)
+
+			if other, clash := seen[etag]; clash {
+				t.Fatalf("changing %s derives the same validator as %s (%s) — the field tuple is ambiguous", tc.name, other, etag)
+			}
+			seen[etag] = tc.name
+		})
+	}
+}
+
+// TestSettings_ETagExclusions pins the two deliberate omissions. AccountID is
+// the resource's identity rather than its representation. UpdatedAt is left
+// out so that a write which changes nothing observable does not invalidate a
+// precondition another client is holding — equal representations must always
+// derive equal validators.
+func TestSettings_ETagExclusions(t *testing.T) {
+	baseline := etagSettings().ETag()
+
+	other := etagSettings()
+	other.AccountID = "acc-2"
+	assert.Equal(t, baseline, other.ETag(), "the account id must not reach the validator")
+
+	touched := etagSettings()
+	touched.UpdatedAt = touched.UpdatedAt.Add(time.Hour)
+	assert.Equal(t, baseline, touched.ETag(), "a write that changed nothing must not move the validator")
+}
+
+// TestSettings_ETagSurvivesTimestampTruncation pins the store round-trip the
+// validator has to survive. A freshly bootstrapped row derives its validator
+// in memory, from a time.Time carrying nanoseconds; every later comparison
+// derives it from a row read back out of the store, and the engines truncate
+// on the way through — PostgreSQL to microseconds, MySQL DATETIME to whole
+// seconds without an fsp. If the hash is sensitive below its coarsest engine's
+// precision, the validator a bootstrap hands out never matches again and the
+// documented "conditional PUT without an intervening GET" is a permanent 412.
+//
+// Asserted on the type rather than through a store, so it holds without running
+// the suite against every engine. The sqlite test store preserves nanoseconds,
+// so a sqlite-only suite cannot observe the truncation at all.
+func TestSettings_ETagSurvivesTimestampTruncation(t *testing.T) {
+	inMemory := etagSettings()
+	require.NotZero(t, inMemory.CreatedAt.Nanosecond(), "the fixture must carry sub-second precision to prove anything")
+
+	for name, truncation := range map[string]time.Duration{
+		"postgres (microseconds)":  time.Microsecond,
+		"mysql (milliseconds)":     time.Millisecond,
+		"mysql datetime (seconds)": time.Second,
+	} {
+		t.Run(name, func(t *testing.T) {
+			roundTripped := etagSettings()
+			roundTripped.CreatedAt = roundTripped.CreatedAt.Truncate(truncation)
+
+			assert.Equal(t, inMemory.ETag(), roundTripped.ETag(),
+				"a validator derived before the write must still match one derived after reading the row back")
+		})
+	}
+}
+
+// TestSettings_ETagOfDefaults covers the pre-bootstrap view, which GET serves
+// as a real representation and therefore validates like one. It must derive
+// without panicking on the zero CreatedAt, and it must not collide with a
+// bootstrapped row — otherwise an If-Match taken before bootstrap would
+// authorize a write against the row that appeared since.
+func TestSettings_ETagOfDefaults(t *testing.T) {
+	defaults := DefaultSettings("acc-1").ETag()
+
+	assert.Len(t, defaults, etagLength, "the default view must derive a well-formed validator")
+	assert.NotEqual(t, etagSettings().ETag(), defaults,
+		"the unbootstrapped view must not validate as a bootstrapped row")
+}
+
+// etagFieldCount is the number of fields Settings carries. ETag hashes an
+// explicit tuple rather than the struct, so a field added here is silently
+// outside the validator until someone decides otherwise — the worst kind of
+// gap, because the mechanism looks present and works for every other field.
+//
+// If this constant needs updating, that is the decision point: either add the
+// new field to ETag and give it a case in TestSettings_ETagSensitivity, or
+// record here why it stays out.
+const etagFieldCount = 9
+
+// TestSettings_ETagFieldCountGuard fails when a field is added to or removed
+// from Settings, forcing the question of whether it belongs in the validator.
+func TestSettings_ETagFieldCountGuard(t *testing.T) {
+	assert.Equal(t, etagFieldCount, reflect.TypeFor[Settings]().NumField(),
+		"Settings gained or lost a field: decide whether it belongs in ETag(), then update etagFieldCount")
+}

management/internals/modules/reverseproxy/activity/interface.go

@@ -1,25 +0,0 @@
-// Package activity records that a principal used a reverse proxy service, so
-// that activity accounting counts people and devices which reach services
-// through the proxy but never touch the dashboard or the management API.
-package activity
-
-import (
-	"context"
-
-	"github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// Manager records reverse proxy usage against the timestamps activity
-// accounting reads. Both methods are best effort from the caller's point of
-// view: a lost record is corrected by the next request, and no authorization
-// decision reads them back.
-type Manager interface {
-	// RecordUserLogin records a completed SSO sign-in to a proxied service.
-	// Service users have no interactive login and are ignored.
-	RecordUserLogin(ctx context.Context, accountID string, user *types.User) error
-	// RecordPeerSeen records that a peer reached a private service over the
-	// mesh, which is what lets its owner count as active. Peers activity
-	// accounting excludes, and peers already seen recently, are ignored.
-	RecordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) error
-}

management/internals/modules/reverseproxy/activity/manager/manager.go

@@ -1,66 +0,0 @@
-package manager
-
-import (
-	"context"
-	"time"
-
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
-	"github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// peerSeenInterval is how stale a peer's LastSeen must be before reaching a
-// private service refreshes it. Positive tunnel validations are cached on the
-// proxy for five minutes, so without a floor a busy peer would rewrite its row
-// behind every request; an hour still sits well inside the window activity
-// accounting asks about.
-const peerSeenInterval = time.Hour
-
-type managerImpl struct {
-	store store.Store
-}
-
-// NewManager returns the activity manager backed by the management store.
-func NewManager(store store.Store) activity.Manager {
-	return &managerImpl{store: store}
-}
-
-// RecordUserLogin stamps the login the same way the dashboard and device login
-// paths do, so a person who only ever reaches proxied services still has a
-// login on record.
-func (m *managerImpl) RecordUserLogin(ctx context.Context, accountID string, user *types.User) error {
-	if user == nil || user.IsServiceUser {
-		return nil
-	}
-
-	return m.store.SaveUserLastLogin(ctx, accountID, user.Id, time.Now().UTC())
-}
-
-// RecordPeerSeen stamps LastSeen, the column a peer activates its owner
-// through. The peer the caller already holds answers the throttle without a
-// query, so a peer seen inside the interval costs nothing to skip; the same
-// cutoff goes to the store, which enforces it inside the UPDATE so concurrent
-// requests for one peer cannot each write off their own stale read.
-func (m *managerImpl) RecordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) error {
-	if peer == nil || !countsTowardActivity(peer) {
-		return nil
-	}
-
-	staleBefore := time.Now().UTC().Add(-peerSeenInterval)
-	if peer.Status != nil && peer.Status.LastSeen.After(staleBefore) {
-		return nil
-	}
-
-	_, err := m.store.RefreshPeerLastSeen(ctx, accountID, peer.ID, staleBefore)
-
-	return err
-}
-
-// countsTowardActivity reports whether the peer represents a device a person
-// actually runs. Embedded proxy peers are infrastructure and browser (WASM)
-// clients are ephemeral sessions, so activity accounting ignores both and a
-// write for them could never count.
-func countsTowardActivity(peer *peer.Peer) bool {
-	return !peer.ProxyMeta.Embedded && peer.Meta.KernelVersion != "wasm"
-}

management/internals/modules/reverseproxy/activity/manager/manager_test.go

@@ -1,149 +0,0 @@
-package manager
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/store"
-	"github.com/netbirdio/netbird/management/server/types"
-)
-
-// recordingStore captures the two writes the activity manager makes. The
-// embedded interface satisfies the rest and panics if anything else is called,
-// which keeps the manager honest about its surface.
-type recordingStore struct {
-	store.Store
-	logins []loginWrite
-	seen   []seenWrite
-}
-
-type loginWrite struct {
-	accountID string
-	userID    string
-	at        time.Time
-}
-
-type seenWrite struct {
-	accountID   string
-	peerID      string
-	staleBefore time.Time
-}
-
-func (s *recordingStore) SaveUserLastLogin(_ context.Context, accountID, userID string, lastLogin time.Time) error {
-	s.logins = append(s.logins, loginWrite{accountID: accountID, userID: userID, at: lastLogin})
-	return nil
-}
-
-func (s *recordingStore) RefreshPeerLastSeen(_ context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
-	s.seen = append(s.seen, seenWrite{accountID: accountID, peerID: peerID, staleBefore: staleBefore})
-	return true, nil
-}
-
-func TestRecordUserLogin(t *testing.T) {
-	tests := []struct {
-		name        string
-		user        *types.User
-		expectWrite bool
-	}{
-		{
-			name:        "regular user is recorded",
-			user:        &types.User{Id: "user1", AccountID: "account1"},
-			expectWrite: true,
-		},
-		{
-			// Activity accounting never counts service users, so a row for one
-			// would be noise.
-			name:        "service user is ignored",
-			user:        &types.User{Id: "svc1", AccountID: "account1", IsServiceUser: true},
-			expectWrite: false,
-		},
-		{
-			name:        "missing user is ignored",
-			user:        nil,
-			expectWrite: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			st := &recordingStore{}
-			require.NoError(t, NewManager(st).RecordUserLogin(context.Background(), "account1", tt.user))
-
-			if !tt.expectWrite {
-				assert.Empty(t, st.logins, "no login should have been recorded")
-				return
-			}
-
-			require.Len(t, st.logins, 1, "exactly one login should have been recorded")
-			assert.Equal(t, "account1", st.logins[0].accountID, "login must be recorded against the service account")
-			assert.Equal(t, tt.user.Id, st.logins[0].userID, "login must be recorded against the signing-in user")
-			assert.Equal(t, time.UTC, st.logins[0].at.Location(), "timestamps are written in UTC")
-			assert.WithinDuration(t, time.Now().UTC(), st.logins[0].at, time.Minute, "login should be stamped now")
-		})
-	}
-}
-
-func TestRecordPeerSeen(t *testing.T) {
-	tests := []struct {
-		name        string
-		peer        *peer.Peer
-		expectWrite bool
-	}{
-		{
-			name:        "peer seen long ago is recorded",
-			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
-			expectWrite: true,
-		},
-		{
-			name:        "peer never seen is recorded",
-			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{}},
-			expectWrite: true,
-		},
-		{
-			// The throttle. The caller already holds the peer, so skipping a
-			// recently seen one costs nothing.
-			name:        "peer seen inside the interval is skipped",
-			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-10 * time.Minute)}},
-			expectWrite: false,
-		},
-		{
-			name:        "embedded proxy peer is skipped",
-			peer:        &peer.Peer{ID: "peer1", ProxyMeta: peer.ProxyMeta{Embedded: true}, Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
-			expectWrite: false,
-		},
-		{
-			name:        "browser client is skipped",
-			peer:        &peer.Peer{ID: "peer1", Meta: peer.PeerSystemMeta{KernelVersion: "wasm"}, Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
-			expectWrite: false,
-		},
-		{
-			name:        "missing peer is ignored",
-			peer:        nil,
-			expectWrite: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			st := &recordingStore{}
-			require.NoError(t, NewManager(st).RecordPeerSeen(context.Background(), "account1", tt.peer))
-
-			if !tt.expectWrite {
-				assert.Empty(t, st.seen, "no activity should have been recorded")
-				return
-			}
-
-			require.Len(t, st.seen, 1, "exactly one activity write should have been recorded")
-			assert.Equal(t, "account1", st.seen[0].accountID, "activity must be recorded against the service account")
-			assert.Equal(t, tt.peer.ID, st.seen[0].peerID, "activity must be recorded against the calling peer")
-			assert.Equal(t, time.UTC, st.seen[0].staleBefore.Location(), "cutoffs are passed in UTC")
-			assert.WithinDuration(t, time.Now().UTC().Add(-peerSeenInterval), st.seen[0].staleBefore, time.Minute,
-				"the store must enforce the same interval the local check applies")
-		})
-	}
-}

management/internals/server/boot.go

@@ -27,8 +27,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	accesslogsmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs/manager"
-	proxyactivity "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
-	proxyactivitymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity/manager"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
@@ -233,7 +231,6 @@ func (s *BaseServer) ReverseProxyGRPCServer() *nbgrpc.ProxyServiceServer {
 		proxyService := nbgrpc.NewProxyServiceServer(s.AccessLogsManager(), s.ProxyTokenStore(), s.PKCEVerifierStore(), s.proxyOIDCConfig(), s.PeersManager(), s.UsersManager(), s.IdpManager(), s.ProxyManager(), s.Store())
 		s.AfterInit(func(s *BaseServer) {
 			proxyService.SetServiceManager(s.ServiceManager())
-			proxyService.SetActivityManager(s.ProxyActivityManager())
 			proxyService.SetProxyController(s.ServiceProxyController())
 			proxyService.SetAgentNetworkSynthesizer(newAgentNetworkSynthesizer(s.Store()))
 			proxyService.SetAgentNetworkLimitsService(s.AgentNetworkManager())
@@ -293,13 +290,6 @@ func (s *BaseServer) PKCEVerifierStore() *nbgrpc.PKCEVerifierStore {
 	})
 }
 
-// ProxyActivityManager records reverse proxy usage for activity accounting.
-func (s *BaseServer) ProxyActivityManager() proxyactivity.Manager {
-	return Create(s, func() proxyactivity.Manager {
-		return proxyactivitymanager.NewManager(s.Store())
-	})
-}
-
 func (s *BaseServer) AccessLogsManager() accesslogs.Manager {
 	return Create(s, func() accesslogs.Manager {
 		accessLogManager := accesslogsmanager.NewManager(s.Store(), s.PermissionsManager(), s.GeoLocationManager())

management/internals/shared/grpc/proxy.go

@@ -32,7 +32,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
@@ -129,9 +128,6 @@ type ProxyServiceServer struct {
 	// Manager for IdP-enriched user data (may be nil when no IdP is configured)
 	idpManager idp.Manager
 
-	// Manager that records reverse proxy usage for activity accounting
-	activityManager activity.Manager
-
 	// Store for one-time authentication tokens
 	tokenStore *OneTimeTokenStore
 
@@ -254,13 +250,6 @@ func (s *ProxyServiceServer) SetServiceManager(manager rpservice.Manager) {
 	s.serviceManager = manager
 }
 
-// SetActivityManager wires the manager that records reverse proxy usage.
-func (s *ProxyServiceServer) SetActivityManager(manager activity.Manager) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.activityManager = manager
-}
-
 // SetAgentNetworkSynthesizer wires the agent-network service synthesiser.
 // Optional — when nil the snapshot path skips agent-network synthesis. The
 // modules layer injects this after both the proxy server and the agent-network
@@ -1728,7 +1717,7 @@ func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, u
 
 	groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
 
-	token, err := sessionkey.SignToken(
+	return sessionkey.SignToken(
 		service.SessionPrivateKey,
 		userID,
 		user.Email,
@@ -1738,25 +1727,6 @@ func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, u
 		groupNames,
 		proxyauth.DefaultSessionExpiry,
 	)
-	if err != nil {
-		return "", err
-	}
-
-	s.recordUserLogin(ctx, service.AccountID, user)
-
-	return token, nil
-}
-
-// recordUserLogin hands the sign-in to the activity manager. The RPC must not
-// fail on it, so the error is logged and dropped here rather than returned.
-func (s *ProxyServiceServer) recordUserLogin(ctx context.Context, accountID string, user *types.User) {
-	if s.activityManager == nil {
-		return
-	}
-
-	if err := s.activityManager.RecordUserLogin(ctx, accountID, user); err != nil {
-		log.WithContext(ctx).Debugf("record proxy login for user %s: %v", user.Id, err)
-	}
 }
 
 // ValidateUserGroupAccess checks if a user has access to a service.
@@ -2106,8 +2076,6 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 		return nil, err
 	}
 
-	s.recordPeerSeen(ctx, service.AccountID, peer)
-
 	log.WithFields(log.Fields{
 		"domain":       domain,
 		"tunnel_ip":    tunnelIPStr,
@@ -2125,18 +2093,6 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 	}, nil
 }
 
-// recordPeerSeen hands the mesh request to the activity manager. The RPC must
-// not fail on it, so the error is logged and dropped here rather than returned.
-func (s *ProxyServiceServer) recordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) {
-	if s.activityManager == nil {
-		return
-	}
-
-	if err := s.activityManager.RecordPeerSeen(ctx, accountID, peer); err != nil {
-		log.WithContext(ctx).Debugf("record proxy activity for peer %s: %v", peer.ID, err)
-	}
-}
-
 // resolvePeerOwner returns the user a peer is linked to, once per request so
 // the status gate and the identity resolution below share a single lookup.
 // Unlinked peers (machine agents) have no owner. A lookup that fails returns

management/internals/shared/grpc/proxy_group_access_test.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"net"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -156,27 +155,6 @@ type mockTunnelPeersManager struct {
 	groupsErr error
 }
 
-// mockActivityManager records what the RPC handed to the activity manager. The
-// policy (throttling, exclusions) is the manager's and is tested there; these
-// tests only pin which requests reach it.
-type mockActivityManager struct {
-	seenMarks []seenMark
-}
-
-type seenMark struct {
-	accountID string
-	peerID    string
-}
-
-func (m *mockActivityManager) RecordUserLogin(_ context.Context, _ string, _ *types.User) error {
-	return nil
-}
-
-func (m *mockActivityManager) RecordPeerSeen(_ context.Context, accountID string, peer *peer.Peer) error {
-	m.seenMarks = append(m.seenMarks, seenMark{accountID: accountID, peerID: peer.ID})
-	return nil
-}
-
 func (m *mockTunnelPeersManager) GetPeerByTunnelIP(_ context.Context, _ string, _ net.IP) (*peer.Peer, error) {
 	return m.peer, m.peerErr
 }
@@ -767,78 +745,6 @@ func TestValidateTunnelPeerOwnerStatus(t *testing.T) {
 	}
 }
 
-// TestValidateTunnelPeerRecordsActivity pins that a granted mesh request is
-// handed to the activity manager. Which of those the manager then writes is its
-// own decision, covered by its tests.
-func TestValidateTunnelPeerRecordsActivity(t *testing.T) {
-	const (
-		domain    = "app.example.com"
-		accountID = "account1"
-		peerID    = "peer1"
-	)
-
-	activityManager := &mockActivityManager{}
-	server := &ProxyServiceServer{
-		activityManager: activityManager,
-		serviceManager: &mockReverseProxyManager{
-			proxiesByAccount: map[string][]*service.Service{
-				accountID: {{Domain: domain, AccountID: accountID}},
-			},
-		},
-		peersManager: &mockTunnelPeersManager{
-			peer: &peer.Peer{ID: peerID, Name: "agent", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
-		},
-		usersManager: &mockUsersManager{users: map[string]*types.User{}},
-	}
-
-	resp, err := server.ValidateTunnelPeer(context.Background(), &proto.ValidateTunnelPeerRequest{
-		Domain:   domain,
-		TunnelIp: "100.64.0.1",
-	})
-
-	require.NoError(t, err)
-	require.True(t, resp.GetValid(), "peer should be granted access")
-
-	require.Len(t, activityManager.seenMarks, 1, "a granted peer should reach the activity manager once")
-	assert.Equal(t, accountID, activityManager.seenMarks[0].accountID, "activity must be attributed to the service account")
-	assert.Equal(t, peerID, activityManager.seenMarks[0].peerID, "activity must be attributed to the calling peer")
-}
-
-// TestValidateTunnelPeerDeniedRecordsNoActivity keeps the write on the granted
-// path only: a refused peer is not evidence its owner was active.
-func TestValidateTunnelPeerDeniedRecordsNoActivity(t *testing.T) {
-	const (
-		domain    = "app.example.com"
-		accountID = "account1"
-	)
-
-	activityManager := &mockActivityManager{}
-	server := &ProxyServiceServer{
-		activityManager: activityManager,
-		serviceManager: &mockReverseProxyManager{
-			proxiesByAccount: map[string][]*service.Service{
-				accountID: {{Domain: domain, AccountID: accountID}},
-			},
-		},
-		peersManager: &mockTunnelPeersManager{
-			peer: &peer.Peer{ID: "peer1", Name: "agent", UserID: "user1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
-		},
-		// The owner is blocked, so the tunnel gate denies before the mint.
-		usersManager: &mockUsersManager{users: map[string]*types.User{
-			"user1": {Id: "user1", AccountID: accountID, Blocked: true},
-		}},
-	}
-
-	resp, err := server.ValidateTunnelPeer(context.Background(), &proto.ValidateTunnelPeerRequest{
-		Domain:   domain,
-		TunnelIp: "100.64.0.1",
-	})
-
-	require.NoError(t, err)
-	require.False(t, resp.GetValid(), "blocked owner should be denied")
-	assert.Empty(t, activityManager.seenMarks, "a denied peer must not be marked seen")
-}
-
 func TestGetAccountProxyByDomain(t *testing.T) {
 	tests := []struct {
 		name             string

management/server/agentnetwork_budgetrule_realstack_test.go

@@ -117,7 +117,7 @@ func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *t
 		EnablePromptCollection: true,
 		RedactPii:              true,
 		AccessLogRetentionDays: before.AccessLogRetentionDays,
-	})
+	}, nil)
 	require.NoError(t, err, "UpdateSettings must succeed")
 	assert.Equal(t, before.Domain, updated.Domain, "domain is immutable and must be preserved")
 	assert.Equal(t, before.ProxyAddress, updated.ProxyAddress, "proxy address is immutable and must be preserved")
@@ -147,7 +147,7 @@ func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *t
 				EnablePromptCollection: false,
 				RedactPii:              false,
 				AccessLogRetentionDays: before.AccessLogRetentionDays,
-			})
+			}, nil)
 			assert.Error(t, err, "a mismatched identity echo must be rejected")
 			assert.ErrorContains(t, err, "immutable", "the rejection must name the immutability rule")
 		})

management/server/http/handler.go

@@ -98,7 +98,7 @@ func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager accou
 		isValidChildAccount,
 	)
 
-	corsMiddleware := cors.AllowAll()
+	corsMiddleware := newCORSMiddleware()
 
 	metricsMiddleware := appMetrics.HTTPMiddleware()
 
@@ -145,3 +145,32 @@ func NewAPIHandler(ctx context.Context, router *mux.Router, accountManager accou
 
 	return router, nil
 }
+
+// newCORSMiddleware builds the API's CORS policy: cors.AllowAll() plus ETag in
+// ExposedHeaders.
+//
+// The addition is what makes conditional requests usable from a browser. A
+// response header that is not CORS-safelisted is invisible to JavaScript
+// unless it is named in Access-Control-Expose-Headers, and ETag is not on that
+// list — so without this the server can hand a browser client a validator it
+// has no way to read, leaving conditional requests to non-browser clients
+// only. If-Match needs nothing further, since AllowedHeaders is already "*".
+//
+// Everything else mirrors cors.AllowAll() exactly. It is spelled out rather
+// than called because the library offers no way to extend it.
+func newCORSMiddleware() *cors.Cors {
+	return cors.New(cors.Options{
+		AllowedOrigins: []string{"*"},
+		AllowedMethods: []string{
+			http.MethodHead,
+			http.MethodGet,
+			http.MethodPost,
+			http.MethodPut,
+			http.MethodPatch,
+			http.MethodDelete,
+		},
+		AllowedHeaders:   []string{"*"},
+		ExposedHeaders:   []string{"ETag"},
+		AllowCredentials: false,
+	})
+}

management/server/http/handler_test.go

@@ -0,0 +1,88 @@
+package http
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestCORSExposesETag pins the reason this policy is spelled out instead of
+// being cors.AllowAll(). ETag is not a CORS-safelisted response header, so
+// without it named in Access-Control-Expose-Headers a browser client is handed
+// a validator it cannot read — conditional requests would work for the CLI,
+// the REST client and Terraform, and silently not for the dashboard.
+//
+// Collapsing this back to cors.AllowAll() is exactly the simplification that
+// would reintroduce that, which is what this test is here to catch.
+func TestCORSExposesETag(t *testing.T) {
+	handler := newCORSMiddleware().Handler(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("ETag", `"9f86d081884c7d65"`)
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodGet, "/api/agent-network/settings", nil)
+	req.Header.Set("Origin", "https://app.netbird.io")
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	require.Equal(t, http.StatusOK, rec.Code)
+
+	// Compared canonicalized: the library normalizes the name it echoes, so
+	// this reads "Etag" rather than "ETag". Browsers match the exposed-header
+	// list case-insensitively, so the spelling does not matter — but asserting
+	// it byte-exactly would fail for a reason that has nothing to do with the
+	// behaviour being pinned.
+	assert.Equal(t, http.CanonicalHeaderKey("ETag"),
+		http.CanonicalHeaderKey(rec.Header().Get("Access-Control-Expose-Headers")),
+		"browser clients must be allowed to read the validator they are sent")
+}
+
+// TestCORSAllowsIfMatchPreflight covers the request half. It needs nothing
+// beyond the wildcard AllowedHeaders that was already there, so this is a
+// regression guard rather than a new grant: narrowing AllowedHeaders to a list
+// later must not drop If-Match and leave writes readable but not conditional.
+func TestCORSAllowsIfMatchPreflight(t *testing.T) {
+	handler := newCORSMiddleware().Handler(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodOptions, "/api/agent-network/settings", nil)
+	req.Header.Set("Origin", "https://app.netbird.io")
+	req.Header.Set("Access-Control-Request-Method", http.MethodPut)
+	req.Header.Set("Access-Control-Request-Headers", "If-Match")
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	assert.Contains(t, rec.Header().Get("Access-Control-Allow-Headers"), "If-Match",
+		"a conditional write must survive preflight")
+	assert.Contains(t, rec.Header().Get("Access-Control-Allow-Methods"), http.MethodPut,
+		"the conditional write's method must survive preflight")
+}
+
+// TestCORSMatchesAllowAllOtherwise pins the rest of the policy, which is a
+// verbatim copy of cors.AllowAll(). Spelling the options out is what let ETag
+// be added; it also means a change to the library's defaults no longer reaches
+// this API, so the settings that matter are asserted here rather than assumed.
+func TestCORSMatchesAllowAllOtherwise(t *testing.T) {
+	handler := newCORSMiddleware().Handler(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	req := httptest.NewRequest(http.MethodOptions, "/api/peers", nil)
+	req.Header.Set("Origin", "https://anywhere.example.com")
+	req.Header.Set("Access-Control-Request-Method", http.MethodDelete)
+
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+
+	assert.Equal(t, "*", rec.Header().Get("Access-Control-Allow-Origin"), "any origin must still be allowed")
+	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Credentials"),
+		"credentials must stay disallowed — allowing them alongside a wildcard origin would be a real weakening")
+	assert.Contains(t, rec.Header().Get("Access-Control-Allow-Methods"), http.MethodDelete,
+		"the full method set must still be allowed")
+}

management/server/http/handlers/proxy/auth_callback_integration_test.go

@@ -19,7 +19,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
-	activitymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity/manager"
 	nbproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
@@ -222,7 +221,6 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	)
 
 	proxyService.SetServiceManager(&testServiceManager{store: testStore})
-	proxyService.SetActivityManager(activitymanager.NewManager(testStore))
 
 	handler := NewAuthCallbackHandler(proxyService, nil)
 
@@ -540,55 +538,6 @@ func TestAuthCallback_UserAllowedToLogin(t *testing.T) {
 // TestAuthCallback_UserDeniedByAccountStatus asserts that a user whose account
 // is pending approval or blocked never receives a session token from the OIDC
 // callback, and that the redirect carries a description the proxy can render.
-// TestAuthCallback_RecordsUserLogin drives the real OIDC callback and asserts
-// the login lands on the user row. That timestamp is what activity accounting
-// reads, and it is the only signal that can ever count someone who reaches
-// proxy-protected services from a browser and never opens the dashboard.
-func TestAuthCallback_RecordsUserLogin(t *testing.T) {
-	setup := setupAuthCallbackTest(t)
-	defer setup.cleanup()
-
-	ctx := context.Background()
-
-	before, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
-	require.NoError(t, err)
-	require.Nil(t, before.LastLogin, "fixture user starts with no login on record")
-
-	setup.oidcServer.tokenSubject = "allowedUserId"
-	state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
-
-	req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
-	rec := httptest.NewRecorder()
-	setup.router.ServeHTTP(rec, req)
-	require.Equal(t, http.StatusFound, rec.Code)
-
-	after, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
-	require.NoError(t, err)
-	require.NotNil(t, after.LastLogin, "a completed proxy SSO login must be recorded on the user")
-	require.WithinDuration(t, time.Now().UTC(), after.LastLogin.UTC(), time.Minute, "login should be stamped at sign-in time")
-}
-
-// TestAuthCallback_DeniedUserLoginNotRecorded keeps the write on the granted
-// path: a refused sign-in is not a login.
-func TestAuthCallback_DeniedUserLoginNotRecorded(t *testing.T) {
-	setup := setupAuthCallbackTest(t)
-	defer setup.cleanup()
-
-	ctx := context.Background()
-
-	setup.oidcServer.tokenSubject = "blockedUserId"
-	state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
-
-	req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
-	rec := httptest.NewRecorder()
-	setup.router.ServeHTTP(rec, req)
-	require.Equal(t, http.StatusFound, rec.Code)
-
-	after, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "blockedUserId")
-	require.NoError(t, err)
-	require.Nil(t, after.LastLogin, "a denied user must not be recorded as having logged in")
-}
-
 func TestAuthCallback_UserDeniedByAccountStatus(t *testing.T) {
 	tests := []struct {
 		name            string