Run Rosenpass in permissive mode on the embedded proxy

.github/workflows/pr-title-check.yml

@@ -16,8 +16,6 @@ jobs:
             const allowedTags = [
               'management',
               'client',
-              'android',
-              'ios',
               'signal',
               'proxy',
               'relay',

.github/workflows/release.yml

@@ -475,132 +475,6 @@ jobs:
           path: dist/
           retention-days: 3
 
-  release_ui_gtk3:
-    # Legacy GTK3/WebKit2GTK 4.1 UI build for distros without WebKitGTK 6.0
-    # (Ubuntu 22.04, Debian 12, RHEL 9, Fedora <=39). Runs on ubuntu-22.04 so
-    # the binary links against the oldest supported glibc.
-    runs-on: ubuntu-22.04
-    outputs:
-      release_ui_gtk3_artifact_url: ${{ steps.upload_release_ui_gtk3.outputs.artifact-url }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 0 # It is required for GoReleaser to work properly
-          persist-credentials: false
-
-      - name: Parse semver string
-        id: semver_parser
-        uses: netbirdio/shared-actions/actions/parse-semver@be5df6047383da2236e02243cceb857d8567c27e # v0.0.2
-
-      - name: Set snapshot flag
-        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
-        run: |
-          echo "flags=--snapshot" >> $GITHUB_ENV
-
-      - name: Set build vars
-        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
-        run: |
-          if [[ "x-${{ steps.semver_parser.outputs.prerelease }}" == "x-" && "x-${{ github.repository }}" == "x-netbirdio/netbird" ]]; then
-            echo "x-${{ github.repository }}"
-            echo "x-${{ steps.semver_parser.outputs.prerelease }}"
-            echo "SKIP_PUBLISH=false" >> $GITHUB_ENV
-          else
-            echo "x-${{ github.repository }}"
-            echo "x-${{ steps.semver_parser.outputs.prerelease }}"
-          fi
-
-      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version-file: "go.mod"
-          cache: false
-      - name: Cache Go modules
-        # Restore-only from the release_ui cache written by trusted runs; the
-        # module cache is identical (same go.sum) and stale build-cache
-        # entries just miss.
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-ui-go-releaser-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-ui-go-releaser-
-
-      - name: Install modules
-        run: go mod tidy
-
-      - name: check git status
-        run: git --no-pager diff --exit-code
-
-      - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '22'
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
-        with:
-          version: 11
-
-      - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libwebkit2gtk-4.1-dev
-
-      - name: Decode GPG signing key
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        env:
-          GPG_RPM_PRIVATE_KEY: ${{ secrets.GPG_RPM_PRIVATE_KEY }}
-        run: |
-          echo "$GPG_RPM_PRIVATE_KEY" | base64 -d > /tmp/gpg-rpm-signing-key.asc
-          echo "GPG_RPM_KEY_FILE=/tmp/gpg-rpm-signing-key.asc" >> $GITHUB_ENV
-
-      - name: Install wails3 CLI
-        # Version derived from go.mod so the binding generator always matches
-        # the wails runtime the binary links against.
-        # -tags gtk3: the CLI links the wails runtime's cgo packages, and the
-        # default tags request gtk4/webkitgtk-6.0 pkg-config entries that do
-        # not exist on ubuntu-22.04.
-        run: |
-          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
-          go install -tags gtk3 github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
-
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
-        with:
-          version: ${{ env.GORELEASER_VER }}
-          args: release --config .goreleaser_ui_gtk3.yaml --clean ${{ env.flags }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          UPLOAD_DEBIAN_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
-          UPLOAD_YUM_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
-          GPG_RPM_KEY_FILE: ${{ env.GPG_RPM_KEY_FILE }}
-          NFPM_NETBIRD_UI_RPM_GTK3_PASSPHRASE: ${{ secrets.GPG_RPM_PASSPHRASE }}
-          SKIP_PUBLISH: ${{ env.SKIP_PUBLISH }}
-      - name: Verify RPM signatures
-        run: |
-          docker run --rm -v $(pwd)/dist:/dist fedora:41 bash -c '
-            dnf install -y -q rpm-sign curl >/dev/null 2>&1
-            curl -sSL https://pkgs.netbird.io/yum/repodata/repomd.xml.key -o /tmp/rpm-pub.key
-            rpm --import /tmp/rpm-pub.key
-            echo "=== Verifying RPM signatures ==="
-            for rpm_file in /dist/*.rpm; do
-              [ -f "$rpm_file" ] || continue
-              echo "--- $(basename $rpm_file) ---"
-              rpm -K "$rpm_file"
-            done
-          '
-      - name: Clean up GPG key
-        if: always()
-        run: rm -f /tmp/gpg-rpm-signing-key.asc
-      - name: upload non tags for debug purposes
-        id: upload_release_ui_gtk3
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
-        with:
-          name: release-ui-gtk3
-          path: dist/
-          retention-days: 3
-
   release_ui_darwin:
     runs-on: macos-latest
     outputs:
@@ -814,7 +688,7 @@ jobs:
   comment_release_artifacts:
     name: Comment release artifacts
     runs-on: ubuntu-latest
-    needs: [release, release_ui, release_ui_gtk3, release_ui_darwin]
+    needs: [release, release_ui, release_ui_darwin]
     if: ${{ always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
     permissions:
       contents: read
@@ -826,14 +700,12 @@ jobs:
         env:
           RELEASE_RESULT: ${{ needs.release.result }}
           RELEASE_UI_RESULT: ${{ needs.release_ui.result }}
-          RELEASE_UI_GTK3_RESULT: ${{ needs.release_ui_gtk3.result }}
           RELEASE_UI_DARWIN_RESULT: ${{ needs.release_ui_darwin.result }}
           RELEASE_ARTIFACT_URL: ${{ needs.release.outputs.release_artifact_url }}
           LINUX_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.linux_packages_artifact_url }}
           WINDOWS_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.windows_packages_artifact_url }}
           MACOS_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.macos_packages_artifact_url }}
           RELEASE_UI_ARTIFACT_URL: ${{ needs.release_ui.outputs.release_ui_artifact_url }}
-          RELEASE_UI_GTK3_ARTIFACT_URL: ${{ needs.release_ui_gtk3.outputs.release_ui_gtk3_artifact_url }}
           RELEASE_UI_DARWIN_ARTIFACT_URL: ${{ needs.release_ui_darwin.outputs.release_ui_darwin_artifact_url }}
           GHCR_IMAGES_MARKDOWN: ${{ needs.release.outputs.ghcr_images }}
         with:
@@ -856,7 +728,6 @@ jobs:
               ['Windows packages', process.env.WINDOWS_PACKAGES_ARTIFACT_URL, process.env.RELEASE_RESULT],
               ['macOS packages', process.env.MACOS_PACKAGES_ARTIFACT_URL, process.env.RELEASE_RESULT],
               ['UI artifacts', process.env.RELEASE_UI_ARTIFACT_URL, process.env.RELEASE_UI_RESULT],
-              ['UI GTK3 artifacts', process.env.RELEASE_UI_GTK3_ARTIFACT_URL, process.env.RELEASE_UI_GTK3_RESULT],
               ['UI macOS artifacts', process.env.RELEASE_UI_DARWIN_ARTIFACT_URL, process.env.RELEASE_UI_DARWIN_RESULT],
             ];
 
@@ -913,7 +784,7 @@ jobs:
 
   trigger_signer:
     runs-on: ubuntu-latest
-    needs: [release, release_ui, release_ui_gtk3, release_ui_darwin, test_windows_installer]
+    needs: [release, release_ui, release_ui_darwin, test_windows_installer]
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Trigger binaries sign pipelines

.github/workflows/test-infrastructure-files.yml

@@ -257,15 +257,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Verify fresh-install session cookie key hardening
-        run: |
-          grep -Fxq '  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)' infrastructure_files/getting-started.sh
-          grep -Fxq '    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"' infrastructure_files/getting-started.sh
-          grep -Fxq '  install -m 600 /dev/null config.yaml' infrastructure_files/getting-started.sh
-          grep -Fxq '  openssl rand -base64 32' infrastructure_files/getting-started-enterprise.sh
-          grep -Fxq '  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)' infrastructure_files/getting-started-enterprise.sh
-          grep -Fxq '    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"' infrastructure_files/getting-started-enterprise.sh
-
       - name: Verify Dex retirement notice
         run: |
           if infrastructure_files/getting-started-with-dex.sh >stdout.txt 2>stderr.txt; then

.goreleaser_ui.yaml

@@ -93,10 +93,7 @@ nfpms:
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
     dependencies:
-      - netbird (>= 0.75.0)
-      - libgtk-4-1 (>= 4.14)
-      - libwebkitgtk-6.0-4
-      - xdg-utils
+      - netbird
 
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
@@ -117,10 +114,7 @@ nfpms:
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
     dependencies:
-      - netbird >= 0.75.0
-      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
-      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
-      - xdg-utils
+      - netbird
 
     rpm:
       signature:

.goreleaser_ui_gtk3.yaml

@@ -1,142 +0,0 @@
-version: 2
-env:
-  - SKIP_PUBLISH={{ if index .Env "SKIP_PUBLISH" }}{{ .Env.SKIP_PUBLISH }}{{ else }}true{{ end }}
-project_name: netbird-ui
-
-before:
-  hooks:
-    # Bindings are gitignored; regenerate before the frontend build so
-    # the @wailsio/runtime Vite plugin can resolve them (vite refuses to
-    # build without them).
-    # -f '-tags gtk3': the generator type-checks client/ui, whose cgo imports
-    # would otherwise resolve gtk4/webkitgtk-6.0 pkg-config entries that do
-    # not exist on ubuntu-22.04.
-    - sh -c 'cd client/ui && wails3 generate bindings -clean=true -ts -f "-tags gtk3"'
-    - sh -c 'cd client/ui/frontend && pnpm install --frozen-lockfile && pnpm build'
-
-builds:
-  # Legacy GTK3 / WebKit2GTK 4.1 build for distros without WebKitGTK 6.0
-  # (Ubuntu 22.04, Debian 12, RHEL 9, Fedora <=39). The gtk3 tag flips the
-  # Wails Linux backend to the GTK3 stack and swaps our GTK4-only XEmbed
-  # tray host for the pure-Go stub (client/ui/xembed_host_gtk3_linux.go).
-  # Must be built on the oldest supported glibc (ubuntu-22.04 runner).
-  - id: netbird-ui-gtk3
-    dir: client/ui
-    binary: netbird-ui
-    env:
-      - CGO_ENABLED=1
-    goos:
-      - linux
-    goarch:
-      - amd64
-    ldflags:
-      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
-    mod_timestamp: "{{ .CommitTimestamp }}"
-    tags:
-      - production
-      - gtk3
-
-archives:
-  - id: linux-gtk3-arch
-    name_template: "{{ .ProjectName }}-linux-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
-    builds:
-      - netbird-ui-gtk3
-
-nfpms:
-  # Same package_name as the GTK4 packages -- the two are mutually-exclusive
-  # alternatives served from separate repo paths (see uploads below); a given
-  # distro points at exactly one of them. The file names must still differ:
-  # the Debian pool is shared storage keyed by file name, so a default-named
-  # gtk3 .deb would overwrite the stable one.
-  - maintainer: Netbird <dev@netbird.io>
-    description: Netbird client UI.
-    homepage: https://netbird.io/
-    license: BSD-3-Clause
-    vendor: NetBird
-    id: netbird_ui_deb_gtk3
-    package_name: netbird-ui
-    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
-    builds:
-      - netbird-ui-gtk3
-    formats:
-      - deb
-    scripts:
-      postinstall: "release_files/ui-post-install.sh"
-    contents:
-      - src: client/ui/build/linux/netbird.desktop
-        dst: /usr/share/applications/org.wails.netbird.desktop
-      - src: client/ui/build/appicon.png
-        dst: /usr/share/pixmaps/netbird.png
-    dependencies:
-      - netbird (>= 0.75.0)
-      - libgtk-3-0
-      - libwebkit2gtk-4.1-0
-      - xdg-utils
-
-  - maintainer: Netbird <dev@netbird.io>
-    description: Netbird client UI.
-    homepage: https://netbird.io/
-    license: BSD-3-Clause
-    vendor: NetBird
-    id: netbird_ui_rpm_gtk3
-    package_name: netbird-ui
-    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
-    builds:
-      - netbird-ui-gtk3
-    formats:
-      - rpm
-    scripts:
-      postinstall: "release_files/ui-post-install.sh"
-    contents:
-      - src: client/ui/build/linux/netbird.desktop
-        dst: /usr/share/applications/org.wails.netbird.desktop
-      - src: client/ui/build/appicon.png
-        dst: /usr/share/pixmaps/netbird.png
-    dependencies:
-      - netbird >= 0.75.0
-      - (gtk3 or libgtk-3-0)
-      - (webkit2gtk4.1 or libwebkit2gtk-4_1-0)
-      - xdg-utils
-
-    rpm:
-      signature:
-        key_file: '{{ if index .Env "GPG_RPM_KEY_FILE" }}{{ .Env.GPG_RPM_KEY_FILE }}{{ end }}'
-
-# The GTK4 UI job shares project_name, so the default checksum file name would
-# collide with it on the shared GitHub release.
-checksum:
-  name_template: "{{ .ProjectName }}_gtk3_checksums.txt"
-
-changelog:
-  disable: true
-
-uploads:
-  # The gtk3 packages reuse the netbird-ui package name, so they live in
-  # dedicated repo paths (deb distribution `gtk3`, yum path `yum-gtk3`) that
-  # legacy distros point their repo config at.
-  #
-  # GoReleaser derives the credential env var from the upload name, so these
-  # would look for UPLOAD_DEBIAN-GTK3_SECRET / UPLOAD_YUM-GTK3_SECRET. The
-  # release workflow only exports UPLOAD_DEBIAN_SECRET / UPLOAD_YUM_SECRET, and
-  # a missing secret is a silent skip rather than a failure -- the packages
-  # reached the GitHub release but never the package repositories. Point
-  # `password` at the exported vars so both uploads authenticate.
-  - name: debian-gtk3
-    skip: "{{ .Env.SKIP_PUBLISH }}"
-    ids:
-      - netbird_ui_deb_gtk3
-    mode: archive
-    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=gtk3;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
-    username: dev@wiretrustee.com
-    password: "{{ .Env.UPLOAD_DEBIAN_SECRET }}"
-    method: PUT
-
-  - name: yum-gtk3
-    skip: "{{ .Env.SKIP_PUBLISH }}"
-    ids:
-      - netbird_ui_rpm_gtk3
-    mode: archive
-    target: https://pkgs.wiretrustee.com/yum-gtk3/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
-    username: dev@wiretrustee.com
-    password: "{{ .Env.UPLOAD_YUM_SECRET }}"
-    method: PUT

AGENTS.md

@@ -1,783 +0,0 @@
-# NetBird Agent Guidelines
-
-**NetBird** is an open-source connectivity platform: a WireGuard®-based overlay
-network with a control plane. The **agent** (`client/`) runs on user machines as
-a privileged daemon and manages the WireGuard interface, routing, firewall, and
-DNS. **Management** (`management/`) is the control plane and REST/gRPC API,
-**Signal** (`signal/`) brokers peer handshakes, **Relay** (`relay/`) carries
-traffic when a direct tunnel is impossible, and **Proxy** (`proxy/`) is the
-identity-aware proxy behind Agent Network.
-
-This file applies to the whole repository, and is the single source of truth for
-agent guidance here. `CLAUDE.md` is a one-line pointer to it — keep the guidance
-in this file, not duplicated there.
-
-## Contents
-
-- [STOP and ask the user before](#stop-and-ask-the-user-before)
-- [Quick reference](#quick-reference)
-- [Structure](#structure)
-- [Where to look](#where-to-look)
-- [Security](#security)
-- [Agent conventions](#agent-conventions)
-- [Repo-wide principles](#repo-wide-principles)
-- [Type safety](#type-safety)
-- [Concurrency and lifecycle](#concurrency-and-lifecycle)
-- [Error handling](#error-handling)
-- [Comments](#comments)
-- [Testing](#testing)
-- [Pitfalls](#pitfalls)
-- [Commits, PRs, releases](#commits-prs-releases)
-- [After you push: CI and review bots](#after-you-push-ci-and-review-bots)
-- [Discussion and support](#discussion-and-support)
-
-## STOP and ask the user before
-
-- **Opening a pull request for anything beyond a trivial fix, without an agreed
-  ticket.** Ask the user directly: *"Is there a discussion or issue for this
-  change?"* NetBird is discussion-first — community reports start in
-  [Discussions](https://github.com/netbirdio/netbird/discussions), DevRel
-  validates them, and only validated discussions become issues. A PR that
-  changes behavior with no linked issue may be closed on arrival. If there is no
-  ticket, offer to draft the discussion post **instead of** the PR, and wait for
-  the user's call. Only typos, broken links, documentation corrections, and
-  one-line fixes that already have an issue can skip this.
-- **Designing in any high-risk area** (see
-  [CONTRIBUTING.md](CONTRIBUTING.md#high-risk-areas)): public API and OpenAPI
-  schema, gRPC protos, behavior existing deployments would notice after an
-  upgrade, peer connectivity (ICE, NAT traversal, relay selection, WireGuard® or
-  Rosenpass key handling), client system integration (routing, firewall, DNS,
-  interface), authentication and authorization, CLI or service flags, config
-  file format, daemon IPC, store schema and migrations, or a new feature. The
-  design gets agreed in the ticket before code is written.
-- **Writing a store migration or changing a persisted model.** Migrations are
-  one-way in the field and both the GORM and pgx paths may need the change.
-- **Hand-editing generated code.** `*.pb.go`, `*.gen.go`, and mocks are outputs.
-  Edit the source (`.proto`, `openapi.yml`) and rerun the matching
-  `generate.sh`.
-- **Adding, removing, or bumping a dependency**, and never vendor a fork.
-- **Weakening a security control** — authentication, authorization, certificate
-  verification, privilege dropping, or peer identity checks — even when it is
-  the fastest way to make a test pass.
-- **Force-pushing to `main`**, force-pushing any branch that is already under
-  review, amending pushed commits, or bypassing hooks with `--no-verify`.
-
-## Quick reference
-
-```bash
-# Build
-go build ./...
-cd client && CGO_ENABLED=0 go build .        # agent
-cd management && go build .                  # management service
-cd signal && go build .                      # signal service
-
-# Verify (run before every push)
-go fmt ./...
-make lint            # golangci-lint on files changed vs origin/main (also the pre-push hook)
-make lint-all        # full-repository lint, matches CI
-make test-unit       # host-safe unit tests, -tags devcert, no sudo
-make test-privileged # privileged-tagged suite in a Docker container with NET_ADMIN
-make setup-hooks     # wire make lint into .githooks/pre-push
-
-# Narrow runs
-go test ./client/internal/dns/...
-go test -race -run TestPeerConn ./client/internal/peer/...
-PRIV_RUN=TestNftablesManager PRIV_PKGS=./client/firewall/nftables/... make test-privileged
-
-# Code generation (never hand-edit the output)
-./shared/management/http/api/generate.sh   # REST types from openapi.yml
-./shared/management/proto/generate.sh
-./shared/signal/proto/generate.sh
-./client/proto/generate.sh
-./flow/proto/generate.sh
-
-# Run locally (lab only, never on a machine you rely on)
-sudo ./client/netbird up --log-level debug --log-file console
-sudo ./client/netbird down                   # teardown: restores routing, firewall, DNS
-./signal/signal run --log-level debug --log-file console
-./management/management management --log-level debug --log-file console --config ./management.json
-```
-
-`netbird up` needs root and rewrites the host's routing table, firewall rules,
-DNS configuration, and WireGuard® interface. Run it only in a disposable test
-environment (a VM, container, or throwaway host) that you can rebuild, never on
-a workstation or server whose connectivity matters. Run `sudo netbird down`
-before you stop working, before rebuilding the binary, and on every failure
-path, so the host's networking state is restored instead of left half-applied.
-See [Pitfalls](#pitfalls) for why cleanup on every exit path matters.
-
-## Structure
-
-```text
-netbird/
-├── client/              NetBird agent
-│   ├── cmd/             agent CLI
-│   ├── internal/        agent business logic (engine, peer, dns, routemanager, ...)
-│   ├── server/          daemon for background execution
-│   ├── proto/           daemon gRPC protos
-│   ├── iface/           WireGuard® interface management
-│   ├── firewall/        nftables, iptables, pf, WFP, userspace backends
-│   ├── ssh/             built-in SSH server and client
-│   ├── ui/              desktop UI (Wails v3 + React)
-│   ├── android/, ios/   mobile bindings
-│   ├── wasm/            WebAssembly build
-│   └── mdm/, system/    MDM policy, host information
-├── management/          control plane
-│   └── server/          account, peer, groups, networks, posture, permissions,
-│                        settings, store, http (REST), idp, integrations, migration
-├── signal/              handshake broker (peer/, server/)
-├── relay/               relay service (protocol/, server/, healthcheck/)
-├── proxy/               identity-aware proxy (llm/, acme/, accesslog/, middleware/, tcp/, udp/)
-├── agent-network/       Agent Network overview
-├── shared/              imported by both agent and services
-│   ├── management/      proto/, client/, http/api (OpenAPI + generated types)
-│   ├── signal/          proto/, client/
-│   └── relay/, auth/, sshauth/, metrics/
-├── e2e/                 end-to-end suites and harness
-├── encryption/, dns/, route/, stun/, sharedsock/, util/, flow/
-├── infrastructure_files/  docker compose and getting-started templates
-└── release_files/       files packaged into releases
-```
-
-## Where to look
-
-| Task                        | Location                                                     |
-| --------------------------- | ------------------------------------------------------------ |
-| REST API / OpenAPI          | `shared/management/http/api/` + `management/server/http/`    |
-| Management gRPC protocol    | `shared/management/proto/`                                   |
-| Signal protocol             | `shared/signal/proto/`                                       |
-| Daemon IPC protocol         | `client/proto/`                                              |
-| Peer connection and NAT     | `client/internal/peer/`                                      |
-| Network map handling        | `client/internal/engine.go`, `shared/management/networkmap/` |
-| Routing                     | `client/internal/routemanager/`, `route/`                    |
-| Firewall backends           | `client/firewall/`                                           |
-| DNS                         | `client/internal/dns/`, `dns/`                               |
-| WireGuard® interface        | `client/iface/`                                              |
-| Persistence and migrations  | `management/server/store/`, `management/server/migration/`   |
-| IdP integrations            | `management/server/idp/`                                     |
-| Permissions model           | `management/server/permissions/`                             |
-| LLM routing / Agent Network | `proxy/internal/llm/`, `agent-network/`                      |
-| End-to-end tests            | `e2e/`                                                       |
-
-## Security
-
-### Never fail open
-
-When a security check — access control, an IP restriction, an auth decision —
-hits an error such as an unparseable value, an unavailable lookup, or a state it
-does not recognize, it must **deny**. Never skip the check or allow the request
-through because the check itself failed, and make the `default` and unknown cases
-of a security-related `switch` deny rather than fall through.
-
-### Daemon RPC input is untrusted
-
-The agent runs as root (LocalSystem on Windows), so a daemon RPC crosses a
-privilege boundary: treat every field as untrusted input rather than as something
-the UI or CLI validated on the way in.
-
-When you add or change an RPC, ask what the handler does with caller input while
-running as root. If the answer touches a filesystem path, a URL or host, or a
-privileged state change, it needs a gate **in the handler** — a check in the client
-that normally calls it is not a check at all.
-
-- **A caller-supplied path the daemon opens.** Never `os.Open` it as root.
-  Constrain it, then open it *as the caller* with `ipcauth.OpenOwnedFile`, which
-  opens `O_NOFOLLOW`, requires a regular file, and refuses a file the caller does
-  not own — so a symlink or hardlink aimed at a root-only file is rejected.
-- **A caller-supplied URL or host the daemon fetches.** Restrict the scheme and
-  allow only known hosts for unprivileged callers. Prefer a lexical host
-  allowlist plus TLS verification over "resolve the host, then reject private
-  IPs": the resolve-then-trust pattern has a DNS-rebinding race (public IP at
-  check time, attacker IP at connect time), while a name allowlist has no IP
-  check to race. Never accept `http://` where `https://` is expected.
-- **A privileged state change** (SSH root login, management URL, deregistration)
-  gates on the caller identity from `ipcauth.CallerIdentity(ctx)`.
-
-Caller identity comes from the kernel — `SO_PEERCRED`, `LOCAL_PEERCRED`, or the
-named-pipe client token — and never from an RPC field. When
-`ipcauth.CallerIdentity` reports that it could not determine an identity, **deny**;
-do not fall back to treating the caller as the transport peer.
-
-## Agent conventions
-
-### Three networking modes
-
-Where packets actually flow depends on the mode the agent is running in. The
-three are not interchangeable, so establish which one a change applies to — and
-what it should do in the other two — before you write it.
-
-- **kernel mode** (Linux only): in-kernel WireGuard®. The kernel handles both
-  peer-to-peer and routed traffic, and ACLs are iptables or nftables rules. The
-  client programs kernel facilities but never sees the traffic itself.
-- **userspace mode** (wireguard-go with a TUN): wireguard-go runs in-process. The
-  kernel handles peer-to-peer traffic once it leaves the TUN, while routed traffic
-  — exit nodes and network routes — goes through the userspace forwarder, which
-  terminates the connection and re-establishes it over OS sockets. Used on
-  platforms without kernel WireGuard® or when the user opts out.
-- **netstack mode**: wireguard-go in-process with no TUN and no kernel
-  networking. The forwarder does all routing by stitching userspace sockets, and
-  listeners such as the embedded SSH and DNS servers bind on a gVisor netstack.
-  Used where the process cannot create a TUN device, such as the embedded client
-  (`client/embed/`) and the WASM build.
-
-### The overlay interface is not "WireGuard"
-
-Do not put "WireGuard" in identifiers or comments unless the code is genuinely
-coupled to WireGuard® specifically — a wireguard-go call, a handshake field, a
-kernel WireGuard® netlink attribute. For the interface, the host, peers, or
-traffic in general, say "the NetBird interface", "the interface", or "the overlay".
-Most firewall, routing, and DNS code is transport-agnostic, so a WireGuard®
-reference there is simply inaccurate and rots as the transports change.
-
-### IPv6 is a soft feature
-
-The IPv6 overlay is opt-in dual-stack, and capability can change at runtime. Treat
-it as soft rather than a requirement:
-
-- Gate local v6 paths on the interface accessor (`wgIface.Address().HasIPv6()`),
-  not on raw state fields, and skip the v6 path when the host has no v6 rather
-  than returning an error.
-- Treat an empty or unparseable peer v6 address as "no v6 for that peer" and skip
-  it, keeping the v4 path working.
-- Never let a missing v6 break v4. Fail-closed is for security checks; a
-  capability mismatch skips the v6 work and carries on.
-
-### Environment variables
-
-Name the variable in a constant and parse booleans with `strconv.ParseBool` rather
-than comparing strings inline, so an unexpected value is logged instead of
-silently meaning false:
-
-```go
-const EnvDisableFeature = "NB_DISABLE_FEATURE"
-
-func isDisabledByEnv() bool {
-    val := os.Getenv(EnvDisableFeature)
-    if val == "" {
-        return false
-    }
-    disabled, err := strconv.ParseBool(val)
-    if err != nil {
-        log.Warnf("failed to parse %s: %v", EnvDisableFeature, err)
-        return false
-    }
-    return disabled
-}
-```
-
-### Validating against protocol specs
-
-When a change depends on what a protocol actually mandates, read the specification
-text from the [IETF datatracker](https://datatracker.ietf.org/) rather than a
-summary, and check that you have the current RFC — the widely cited one for a
-protocol is often superseded. Cite the section, not just the document, so a
-reviewer can jump straight to the rule.
-
-## Repo-wide principles
-
-1. **Run `go fmt` on every modified Go file.** Formatting is not optional.
-2. **Zero unaddressed linter warnings.** Fix what `golangci-lint` reports on code
-   you touch, and delete imports, helpers, and parameters your refactor orphaned.
-   Exception: unused parameters in shared code may be consumed by builds outside
-   this repository — do not remove them, ask instead.
-3. **Function comments are mandatory for exported functions**, written as full
-   sentences with a period, starting with the identifier name.
-4. **Prefer private functions and constants.** Export only what a caller outside
-   the package genuinely needs.
-5. **Early returns and guard clauses.** Handle errors and edge cases first
-   instead of nesting `if`/`else` chains.
-6. **Split complex functions.** If a function trips a complexity warning, break
-   it into named helpers rather than silencing the warning.
-7. **Avoid LLM-slop tells:** em dashes, hedging narration, restating the diff in
-   prose, trailing summaries. Defaults, not absolute bans. Applies to code,
-   comments, commit messages, and PR descriptions alike.
-8. **Concurrency: do a two-pass race analysis after every change** that touches
-   shared state, including reads of existing maps and slices. Guard them with a
-   mutex (or an atomic or channel where that fits better), keep critical
-   sections short, and run `go test -race` on the touched packages. See
-   [Concurrency and lifecycle](#concurrency-and-lifecycle) for the failure modes
-   to check for.
-9. **Cross-platform builds must keep working.** The agent targets Linux, macOS,
-   Windows, FreeBSD, Android, and iOS. When you add a platform-specific file,
-   add the counterpart or a build-tagged fallback for the others.
-10. **Never hand-edit generated files.** Change the source and regenerate.
-11. **Never log secrets** — private keys, setup keys, tokens, PAT values — and
-    keep peer IPs and hostnames out of logs above debug level.
-
-## Type safety
-
-**No bare primitives for domain concepts.** A `string` parameter for an account
-ID next to a `string` parameter for a peer ID is two bugs waiting to happen,
-because the compiler cannot catch the swap. Declare the type once and use it
-throughout, converting only at the boundaries where data enters or leaves —
-protobuf, gRPC, HTTP, an external library.
-
-```go
-type ServiceID string
-type AccountID string
-
-// Internal: typed all the way through
-func (r *Router) RemoveRoute(host SNIHost, svcID ServiceID) { ... }
-
-// Proto boundary: convert once, on the way in and on the way out
-svcID := ServiceID(mapping.GetId())
-req.ServiceId = string(svcID)
-```
-
-- **IP addresses are `netip.Addr`**, not `string` and not `net.IP`. Parse at the
-  boundary and pass the typed value inward.
-- **Always `Unmap()`** after parsing an address, after converting from `net.IP`,
-  and after extracting one from `RemoteAddr()`. This normalizes a v4-mapped v6
-  address (`::ffff:10.1.2.3`) to plain v4 so IPv4 rules match it. A stored or
-  compared mapped address silently fails to match those rules.
-- **Ports are `uint16`** internally; use `int` only where a library forces it and
-  convert immediately.
-- **Enums are a typed string with constants**, so the valid set is discoverable
-  and a typo fails to compile.
-- **Map keys follow the same rule**, and must be a real type (`type ServiceID
-  string`) rather than an alias (`type serviceID = string`) — an alias silently
-  accepts bare strings.
-
-## Concurrency and lifecycle
-
-Beyond the mutex hygiene in the principles above, check for these failure
-modes.
-
-- **Never read a struct field inside a goroutine** when another goroutine may nil
-  or reassign it. Pass the value as a parameter, or capture it into a local before
-  launching. This matters most when `Stop()` nils a field without waiting for the
-  goroutine to finish.
-
-  ```go
-  go func(ifaceName string) {   // good: passed in, cannot be nilled underneath
-      m.Start(ctx, ifaceName)
-  }(iface.Name())
-  ```
-
-- **Never wait on a channel while holding a lock the sender needs.** Copy what you
-  need out from under the lock, release it, then wait.
-
-  ```go
-  func (m *Manager) Stop() {
-      m.mu.Lock()
-      cancel, done := m.cancel, m.done
-      m.mu.Unlock()
-      if cancel != nil {
-          cancel()
-          <-done
-      }
-  }
-  ```
-
-- **`Stop`/`Close` must be idempotent** — guard on an already-stopped flag or a
-  nil cancel — and must release the state they guarded. Clear maps and caches;
-  a cancelled goroutine holding a live map still pins that memory. Note that a
-  nil map only panics on writes; reads and iteration behave like an empty map,
-  so where post-close use must be rejected, check the stopped flag explicitly.
-- **Publish coupled state only after every fallible step succeeds.** When several
-  fields form an invariant, build them into locals and assign them to the receiver
-  at the end. Assigning as you go leaves the object half-initialized when a later
-  step fails, so a readiness predicate reports ready while a coupled field is nil.
-  If an earlier step already had an external side effect — a created chain, an
-  opened handle, an inserted rule — roll it back before returning the error.
-- **Clean up what you own on constructor error paths.** Once a constructor has
-  started something, every later error path must undo it: cancel a goroutine and
-  wait for it to exit, stop a ticker, close a watcher. The object is never
-  returned, so its `Close` will never run.
-- **A failed `Start` must undo everything it started.** When a component brings up
-  several subsystems in sequence — connection manager, watchers, routing, DNS,
-  flow, persisted state — a failure partway through has to tear down the ones
-  already running, not just close the handle the error came from. Put the
-  already-started guard *before* that teardown path, so a rejected second `Start`
-  cannot dismantle the one that is running.
-
-## Error handling
-
-Use single-assignment form when the error is only needed inside the `if`:
-
-```go
-// Good
-if err := someCall(); err != nil {
-    return fmt.Errorf("context: %w", err)
-}
-
-// Bad - unnecessary split
-err := someCall()
-if err != nil {
-    return fmt.Errorf("context: %w", err)
-}
-```
-
-Use multiple assignment when the value is needed after the block:
-
-```go
-result, err := someCall()
-if err != nil {
-    return fmt.Errorf("context: %w", err)
-}
-```
-
-Add short, meaningful context, and **do not** start `fmt.Errorf` messages with
-obvious words like "failed to" or "error":
-
-```go
-// Good
-return fmt.Errorf("parse remote address: %w", err)
-return fmt.Errorf("listen on %s: %w", addr, err)
-
-// Bad
-return fmt.Errorf("failed to parse remote address: %w", err)
-return fmt.Errorf("error listening on %s: %w", addr, err)
-
-// "failed" is fine in log messages
-log.Debugf("failed to parse remote address: %v", err)
-```
-
-Skip the wrapping when a function only extracts or delegates and the wrap would
-add nothing:
-
-```go
-func parseAddr(addr string) (string, int, error) {
-    host, portStr, err := net.SplitHostPort(addr)
-    if err != nil {
-        return "", 0, err
-    }
-    // ...
-}
-```
-
-Log the errors you choose not to act on:
-
-- `log.Debugf()` for errors that do not affect program flow but help debugging.
-- `log.Tracef()` for very verbose errors that would otherwise spam logs.
-- **Never ignore** errors from writes, network sends, or critical cleanup.
-- Close errors may be ignored for read-only operations; log them at debug for
-  writes.
-
-**Do not log and return the same error.** It gets reported twice, from two places,
-and the second reader cannot tell whether it happened once or twice. Return it and
-let the caller decide. The exception is an API handler that has already written a
-response. Internal helpers return errors rather than logging and swallowing them.
-
-**Never return a typed nil as an error.** A nil `*MyError` stored in an `error`
-interface is not nil, so `err != nil` is true and callers take the failure path on
-success. Return the error only where it is actually set:
-
-```go
-if _, err := conn.Write(buf); err != nil {   // good
-    return err
-}
-return nil
-```
-
-**Accumulate with `multierror` when an operation should continue past individual
-failures** — teardown, cleanup, or setup where partial success is acceptable.
-`client/errors.FormatErrorOrNil` returns nil for an empty accumulator, so callers
-still see a plain nil on full success:
-
-```go
-func (m *Manager) Cleanup() error {
-    var merr *multierror.Error
-    for _, r := range m.resources {
-        if err := r.Close(); err != nil {
-            merr = multierror.Append(merr, fmt.Errorf("close %s: %w", r.Name, err))
-        }
-    }
-    return nberrors.FormatErrorOrNil(merr)
-}
-```
-
-| Scenario              | Approach              | Why                                       |
-| --------------------- | --------------------- | ----------------------------------------- |
-| Cleanup / teardown    | Accumulate            | Clean up as much as possible              |
-| Setup with rollback   | Abort on first error  | Partial state is invalid; undo what stuck |
-| Setup with partial OK | Accumulate            | Degraded operation is still useful        |
-
-## Comments
-
-Comment the **why**, never the **what**. Default to no comment, and add one only
-when a hidden constraint or workaround would surprise a future reader. Never
-reference the current task, PR, or your own changes in a comment.
-
-```go
-// Bad - trailing comments explaining the obvious
-defer localConn.Close() // Close the connection
-if err != nil {         // Check if error occurred
-
-// Good
-defer localConn.Close()
-
-// Good - explains a non-obvious constraint
-// Use incremental checksum update per RFC 1624 for performance.
-checksum = updateChecksum(checksum, oldPort, newPort)
-```
-
-### Length budget
-
-Neither of these is linter-enforced, so they are conventions the surrounding code
-mostly follows rather than hard limits:
-
-- **Around 90 characters per line.** Wrap the comment rather than running well past
-  it.
-- **Roughly 250 characters per comment**, about three wrapped lines. Doc comments
-  on exported identifiers may exceed it when the API genuinely needs the
-  explanation; inline comments inside a function body rarely should.
-
-The budget is a smell detector, not a rule to game. Do not compress a needed
-explanation into cryptic shorthand to fit — if a block of code needs more than
-250 characters of prose, the code is doing too much. Fix the code:
-
-- **Extract a named function.** A well-named function replaces the comment: the
-  name says *what*, the body shows *how*, and the comment you no longer write
-  was the *what* anyway. Clean Code calls this "explain yourself in code".
-- **Extract a named constant or predicate.** `if isExpiredSetupKey(key)` needs
-  no comment; `if key.ExpiresAt.Before(now) && !key.Revoked && key.UsageLimit > 0`
-  does.
-- **Keep the surviving comment for the why** — the RFC, the kernel quirk, the
-  ordering constraint. That part is usually one or two lines.
-
-### Long switch and if/else chains
-
-A `switch` whose cases carry multi-line explanations is the usual place this
-budget is breached, and the comment is a symptom. In order of preference:
-
-1. **Extract each case body into a named function.** The case becomes one line,
-   the name carries the meaning, and the switch reads as a table of contents.
-2. **Replace the switch with a lookup table** — `map[Kind]handlerFunc` — when the
-   branches are uniform. Adding a case stops meaning editing a growing function.
-3. **Replace conditional with polymorphism** when branches vary by type and the
-   same switch shape starts appearing in more than one place. Clean Code's rule
-   of thumb: tolerate a switch statement if it appears **once**, is buried in a
-   factory that returns an interface, and no other switch dispatches on the same
-   type. A second switch over the same enum is the signal to introduce the
-   interface.
-
-Do not restructure a switch purely to satisfy the budget when the cases are one
-line each and self-evident — a flat, boring `switch` over an enum is fine and
-needs no comments at all.
-
-Explanatory comments in tests are welcome — they document the scenario being set
-up, and the 250-character budget does not apply to them.
-
-## Testing
-
-- **Unit tests** live beside the code as `_test.go`. `make test-unit` runs the
-  host-safe set with `-tags devcert` and no sudo.
-- **Privileged tests** carry the `privileged` build tag and mutate host
-  networking. They run through `make test-privileged`, inside a Docker container
-  with `NET_ADMIN`. Never bypass that harness by running them directly on the
-  host.
-- **End-to-end suites** live in `e2e/` with a shared harness.
-- **Test real behavior, not API existence.** Assert on the observable end state
-  a consumer would see — bytes that arrived, the packet after translation, the
-  row after the write — not merely that a method exists or returns an error.
-- **Avoid mocks for code we own.** Exercise the real store, manager, or
-  controller and assert what the caller actually receives.
-- **`require` for setup and preconditions, `assert` for the conditions under
-  test.** Use `require` whenever a later line would panic or be meaningless
-  otherwise.
-- **Message guidance:** optional for `NoError`/`Error`; always give context for
-  comparison, boolean, and collection assertions.
-- **Reproduce a bug before fixing it.** Write the test, watch it fail *for the
-  reason you expect* — a test that fails for an unrelated reason proves nothing —
-  then apply the fix and confirm it passes. Add the thin surrounding cases while
-  you are there.
-- **Use `t.Setenv`** rather than `os.Setenv` so the previous value is restored on
-  cleanup. To test the unset case, call `t.Setenv` first to register the restore,
-  then `os.Unsetenv`.
-- **Prefer `t.Cleanup` over `defer`** in any test with parallel subtests: the
-  parent function returns, running its `defer`s, while parallel subtests are
-  still suspended. Sequential subtests finish inside `t.Run`, so `defer` is safe
-  there, but `t.Cleanup` works in both cases.
-- **Explanatory comments in tests are welcome.** Describe the scenario being set
-  up; the comment budget below does not apply to them.
-
-```go
-server, err := StartTestServer()
-require.NoError(t, err, "Test server setup must succeed")
-defer server.Close()
-
-result, err := client.DoOperation()
-assert.NoError(t, err)
-assert.Equal(t, expectedResult, result, "Result should match expected")
-```
-
-## Pitfalls
-
-- **The agent runs as root.** Anything touching routing, firewall, DNS, or the
-  interface can take a user's machine off the network. Prefer a reversible
-  change and make sure cleanup runs on every exit path.
-- **Management has two account loaders** (GORM and pgx). Adding a relation to an
-  account often means updating both, or it silently comes back empty in
-  production.
-- **`go test ./...` without `-tags devcert` skips tests** that need the
-  development certificate. Use `make test-unit`.
-- **`make lint` only checks the diff against `origin/main`.** CI runs
-  `make lint-all`; run it too before pushing a large change.
-- **Protos are consumed by released clients.** An old agent must keep working
-  against a new Management, so fields are added, never renumbered or removed.
-- **Windows requires the wintun driver**, and the daemon serves a named pipe
-  (`npipe://netbird`) rather than loopback TCP. Loopback TCP carries no caller
-  identity, so privileged operations are refused over it.
-
-## Commits, PRs, releases
-
-- **PR titles must start with a bracketed tag.** Before you propose a title,
-  **read [`.github/workflows/pr-title-check.yml`](.github/workflows/pr-title-check.yml)
-  and take the allowed tags from the `allowedTags` array in that file.** It is
-  the only source of truth, it changes as components are added, and the check
-  runs on every title edit — a tag that is not in that array is a red build. Do
-  not rely on a list memorized from anywhere else, including this file.
-
-  ```text
-  [client] Authorize daemon IPC callers by their local identity
-  [management,client] Add MDM policy support
-  ```
-
-  Multiple tags are comma-separated inside one pair of brackets. Match the tag
-  to the component you actually changed, not to the one you read the most.
-
-- **Use the repository's PR template.** Fill in
-  [`.github/pull_request_template.md`](.github/pull_request_template.md) rather
-  than replacing it with your own summary: describe the change, link the issue,
-  tick the checklist honestly (including "ran locally" and "single purpose"),
-  and complete the documentation section. Do not tick a box you have not
-  verified, and do not delete rows that do not apply — the docs gate in CI reads
-  that section and fails when it is missing.
-
-- **Keep the PR description short.** Under 1000 words on top of the template's
-  own text, and usually far less — a few paragraphs. Reviewers read the diff;
-  the description exists to explain what the diff cannot say for itself. This is
-  well below what an agent will produce by default, so cut before you post.
-
-- **Body: why before what.** Lead with the problem and the reason for this
-  approach, then the shape of the change. No bullet list of files changed, no
-  per-function walkthrough, no restating the diff in prose, no trailing summary
-  section, no self-congratulatory closing line.
-
-- **No `Co-Authored-By` or tool-attribution trailers in the PR description**,
-  and none in commits either. Contributors own their contributions. Whatever
-  tooling produced the diff, the person opening the PR is its author: they have
-  read every line, they can explain why it works, they can answer review
-  questions without going back to a model, and they are accountable for the
-  consequences of merging it. Do not add a trailer, footer, or description line
-  that spreads that ownership onto a tool.
-
-- **Commit subjects follow the same `[scope] Subject` convention.** Keep the
-  subject short, and use the body for why before what. No bullet lists of files
-  changed.
-
-- **Push review fixes as separate commits.** The PR is squashed on merge, so
-  there is no reason to rewrite history mid-review; many small commits make the
-  re-review readable.
-
-- **Do not force-push a branch that is under review.** A force-push detaches
-  existing review comments from the lines they were written against, destroys
-  the "changes since your last review" diff a reviewer relies on, and discards
-  the CI history that showed which commit broke what. Add commits instead —
-  including for fixups and reverts. Force-push only when there is no
-  alternative: a rebase to clear a genuine conflict, or removing a secret or a
-  large binary that was committed by mistake. When you must, ask the user first,
-  then say so in a PR comment so reviewers know their anchors moved. Never
-  force-push `main`, and never force-push a branch you do not own.
-
-- **One PR, one purpose.** Split refactors out of fixes and fixes out of
-  features.
-
-- **Keep the PR small.** Size is the single strongest predictor of how long a PR
-  waits. Aim for **under ~400 changed lines across under ~20 files**; past
-  roughly **1000 lines or 50 files** a community PR is likely to be sent back to
-  be split, or left unreviewed until it is. Large PRs from outside the core team
-  may be blocked outright when the size was never agreed in the ticket —
-  reviewing a sprawling change against a privileged networking daemon is a
-  security risk in itself, not just a time cost.
-
-  Judge the size by hand-written code: exclude generated output, `go.sum`,
-  vendored files, and test fixtures from the estimate, but do not use their
-  presence to argue a 3000-line PR is small.
-
-  When a change genuinely cannot be small — a protocol migration, a
-  cross-component rename — agree the split in the ticket **before** writing
-  code, and land it as a sequence of PRs that each build, test, and make sense
-  on their own. Propose that split to the user rather than opening one large PR
-  and hoping.
-
-  Prefer GitHub's stacked pull requests for such a sequence, rather than
-  hand-managing base branches: open each PR against the branch below it instead of
-  `main`, so every PR's diff shows only its own change. Merging a layer retargets
-  the PRs above it, and branch protections and required checks on the base branch
-  still apply to each one.
-
-- **User-facing changes need a docs PR** in
-  [netbirdio/docs](https://github.com/netbirdio/docs), linked from the PR
-  description.
-
-## After you push: CI and review bots
-
-Opening the PR is not the end of the task. Watch the run, read what the bots
-say, and drive the PR to green before you report the work as done.
-
-```bash
-gh pr checks <pr>            --watch    # all checks, live
-gh run view <run-id> --log-failed       # only the failing steps
-gh pr view <pr> --comments              # bot and human review comments
-```
-
-**Never report a change as finished while checks are pending or red**, and never
-describe a red PR as passing. If you ran out of turn before CI finished, say
-which checks were still running.
-
-### The checks
-
-- **Go tests** — `golang-test-{linux,darwin,windows,freebsd}.yml`, sharded per
-  component. A failure in a component you did not touch is usually a real
-  interaction, not noise; read the log before assuming flake.
-- **golangci-lint** — `golangci-lint.yml` runs the full repository, while
-  `make lint` only checks your diff. A clean local lint does not guarantee green
-  CI on a large change.
-- **PR Title Check** — `pr-title-check.yml`, see above.
-- **Codecov** — uploaded from the Linux test workflow with per-component flags
-  (`unit,client`, `unit,management`, `unit,relay`, `unit,proxy`, `unit,signal`,
-  `integration,management`). Coverage on new code should not go backwards. Add
-  tests for the paths you introduced; do not adjust thresholds or exclude files
-  to clear the report.
-- **CodeRabbit** — configured in [`.coderabbit.yaml`](.coderabbit.yaml): `chill`
-  profile, auto-review on every non-draft PR, TypeScript/JavaScript/SVG paths
-  filtered out. Chat auto-reply is on, so `@coderabbitai` in a comment reaches
-  it.
-- **SonarCloud** — project `netbirdio_netbird`, quality gate on new code (bugs,
-  vulnerabilities, code smells, duplication, coverage).
-- **Snyk** — dependency and code scanning.
-
-Sonar and Snyk report as GitHub App checks rather than workflows in this
-repository, so their detail lives on the PR check, not in the Actions logs.
-
-### Handling bot findings
-
-- **Read every comment and act on it.** Either fix it, or reply with the reason
-  it does not apply. Do not bulk-resolve threads to clear the count, and do not
-  silently ignore a finding because the check is advisory.
-- **Bots are frequently wrong here.** NetBird has privileged, platform-specific,
-  and concurrency-heavy code that static analysis reads poorly. A confident
-  CodeRabbit or Sonar comment can still be nonsense. Verify the claim against
-  the code before you change anything — never edit correct code just to silence
-  a bot.
-- **Security findings get the opposite default.** For a Snyk or Sonar
-  vulnerability, or a CodeRabbit comment about authentication, authorization,
-  certificate verification, or key handling, assume it is real until you have
-  disproved it. Surface it to the user rather than dismissing it yourself.
-- **A new vulnerable dependency is a stop.** Bumping or replacing dependencies
-  needs the user's decision, as above.
-- **Never change a workflow, threshold, lint exclusion, or bot config to make a
-  check pass.** If a check is genuinely wrong, say so and let the user decide.
-- **Do not paper over flakes with blind re-runs.** Identify the failure first. If
-  it is a known flake, name it; if you cannot tell, report it as unresolved
-  rather than re-running until it goes green.
-
-## Discussion and support
-
-- Discussions: <https://github.com/netbirdio/netbird/discussions>
-- Slack: <https://docs.netbird.io/slack-url>
-- Docs: <https://docs.netbird.io>
-- Security: <https://github.com/netbirdio/netbird/security/policy> — never in public
-- Contribution process: [CONTRIBUTING.md](CONTRIBUTING.md)

CLAUDE.md

@@ -1 +0,0 @@
-See [AGENTS.md](AGENTS.md) for the agent guidelines in this repository.

CONTRIBUTING.md

@@ -66,41 +66,11 @@ Typical bug fixes, internal refactors, documentation updates, and tests do not
 need a design discussion, but should still be tied to an issue so the work is
 visible and nobody duplicates it.
 
-### Using AI coding agents
-
-We have no policy for or against using an AI agent to write NetBird code. That
-choice is yours, and we are not going to interrogate anyone about their tools.
-
-What we do have is a lot of incoming contributions that were plainly drafted with
-one, and enough experience reviewing them to see the same avoidable problems
-again and again: no ticket behind the change, a diff far too large to review, a
-description longer than the code it describes, an approach that was never going
-to be accepted, and an author who cannot answer questions about their own PR.
-None of that is caused by the tooling — it is what happens when a tool is pointed
-at a repository whose expectations it has never been told.
-
-So rather than a rule, there is a guide. [AGENTS.md](AGENTS.md) restates the
-expectations from this document in the form agents read automatically
-(`CLAUDE.md` points to it), so pointing your tool at the repository is usually
-enough. Among other things it tells the agent to ask you for the
-discussion or issue before drafting a PR, to keep the change small and
-single-purpose, to run the tests locally, to use this repository's PR template
-and title tags, and to write a description a reviewer can get through.
-
-The guardrails are the point, and they are the same ones we apply to everyone: an
-agreed ticket, a change you have actually run, a diff small enough to review with
-care, and an author who can explain it. Whatever wrote the diff, you are its
-author — you own every line you submit and the consequences of opening a PR with it.
-
-We may assess whether a contribution is maintainable and whether its merged code
-aligns with our security standards and design expectations.
-
 ## Contents
 
 - [Contributing to NetBird](#contributing-to-netbird)
     - [Ticket first, PR second](#ticket-first-pr-second)
         - [High-risk areas](#high-risk-areas)
-        - [Using AI coding agents](#using-ai-coding-agents)
     - [Contents](#contents)
     - [Code of conduct](#code-of-conduct)
     - [Directory structure](#directory-structure)

client/android/client.go

@@ -15,7 +15,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	nbAnonymize "github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/debug"
@@ -33,13 +32,6 @@ import (
 	types "github.com/netbirdio/netbird/upload-server/types"
 )
 
-// AnonymizeLevelDefault and AnonymizeLevelStrict are the accepted
-// anonymizeLevel values for DebugBundle.
-const (
-	AnonymizeLevelDefault = nbAnonymize.LevelDefaultString
-	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
-)
-
 // ConnectionListener export internal Listener for mobile
 type ConnectionListener interface {
 	peer.Listener
@@ -65,12 +57,6 @@ type DnsReadyListener interface {
 	dns.ReadyListener
 }
 
-// TunSettings is a snapshot of the settings the TUN device is rebuilt with
-type TunSettings struct {
-	Routes        string
-	SearchDomains string
-}
-
 func init() {
 	formatter.SetLogcatFormatter(log.StandardLogger())
 }
@@ -90,8 +76,6 @@ type Client struct {
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
 	cacheDir      string
-	// Identifies the running profile for the SSO login hint; see profile_state.go.
-	cfgPath string
 
 	stateChangeMu    sync.Mutex
 	stateChangeSubID string
@@ -112,12 +96,11 @@ type Client struct {
 	extendCancel context.CancelFunc
 }
 
-func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cfgPath string, cc *internal.ConnectClient) {
+func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cc *internal.ConnectClient) {
 	c.stateMu.Lock()
 	defer c.stateMu.Unlock()
 	c.config = cfg
 	c.cacheDir = cacheDir
-	c.cfgPath = cfgPath
 	c.connectClient = cc
 }
 
@@ -127,16 +110,6 @@ func (c *Client) stateSnapshot() (*profilemanager.Config, string, *internal.Conn
 	return c.config, c.cacheDir, c.connectClient
 }
 
-// authSnapshot returns the config together with the path it was loaded from, in
-// one lock: the path identifies the profile whose account email backs the login
-// hint, so reading it separately could pair one profile's config with another's
-// hint when a profile switch lands in between.
-func (c *Client) authSnapshot() (*profilemanager.Config, string, *internal.ConnectClient) {
-	c.stateMu.RLock()
-	defer c.stateMu.RUnlock()
-	return c.config, c.cfgPath, c.connectClient
-}
-
 func (c *Client) getConnectClient() *internal.ConnectClient {
 	c.stateMu.RLock()
 	defer c.stateMu.RUnlock()
@@ -189,7 +162,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	defer c.ctxCancel()
 	c.ctxCancelLock.Unlock()
 
-	auth := NewAuthWithConfig(ctx, cfg, cfgFile)
+	auth := NewAuthWithConfig(ctx, cfg)
 	err = auth.login(urlOpener, isAndroidTV)
 	if err != nil {
 		return err
@@ -197,7 +170,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, cfgFile, connectClient)
+	c.setState(cfg, cacheDir, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
 	// only once the fresh connect client is installed: until then Status()
@@ -238,7 +211,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, cfgFile, connectClient)
+	c.setState(cfg, cacheDir, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
 
@@ -267,29 +240,9 @@ func (c *Client) RenewTun(fd int) error {
 	return e.RenewTun(fd)
 }
 
-func (c *Client) GetTunSettings() (*TunSettings, error) {
-	cc := c.getConnectClient()
-	if cc == nil {
-		return nil, fmt.Errorf("engine not running")
-	}
-
-	e := cc.Engine()
-	if e == nil {
-		return nil, fmt.Errorf("engine not initialized")
-	}
-
-	routes, searchDomains := e.TunSettings()
-	return &TunSettings{
-		Routes:        strings.Join(routes, ";"),
-		SearchDomains: strings.Join(searchDomains, ";"),
-	}, nil
-}
-
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.
-// It works both with and without a running engine. anonymizeLevel is "default"
-// or "strict"; strict also anonymizes internal IP ranges, peer names, and
-// WireGuard public keys, and implies anonymize.
-func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool, anonymizeLevel string) (string, error) {
+// It works both with and without a running engine.
+func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (string, error) {
 	cfg, cacheDir, cc := c.stateSnapshot()
 
 	// If the engine hasn't been started, load config from disk
@@ -308,7 +261,6 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool, anonym
 		InternalConfig: cfg,
 		StatusRecorder: c.recorder,
 		TempDir:        cacheDir,
-		StatePath:      platformFiles.StateFilePath(),
 	}
 
 	if cc != nil {
@@ -332,7 +284,6 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool, anonym
 		deps,
 		debug.BundleConfig{
 			Anonymize:         anonymize,
-			AnonymizeLevel:    nbAnonymize.ParseLevel(anonymizeLevel),
 			IncludeSystemInfo: true,
 		},
 	)

client/android/login.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"fmt"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/system"
@@ -38,20 +36,12 @@ type Auth struct {
 }
 
 // NewAuth instantiate Auth struct and validate the management URL
-//
-// The configuration at cfgPath is reused when one is already there, and only created when it is
-// not. Building a fresh in-memory config unconditionally gives the client a new WireGuard key on
-// every call: the peer registers under that key, the key is written out, and any peer registered by
-// an earlier call is orphaned on the server. It also breaks a client that enrols and then runs from
-// the persisted config, because the identity it registered is not the one it runs with — the
-// management stream rejects it with "no peer auth method provided".
 func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	inputCfg := profilemanager.ConfigInput{
-		ConfigPath:    cfgPath,
 		ManagementURL: mgmURL,
 	}
 
-	cfg, err := profilemanager.UpdateOrCreateConfig(inputCfg)
+	cfg, err := profilemanager.CreateInMemoryConfig(inputCfg)
 	if err != nil {
 		return nil, err
 	}
@@ -63,14 +53,11 @@ func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	}, nil
 }
 
-// NewAuthWithConfig instantiate Auth based on existing config. cfgPath is the
-// file the config was loaded from; it identifies the profile whose account email
-// backs the login_hint.
-func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config, cfgPath string) *Auth {
+// NewAuthWithConfig instantiate Auth based on existing config
+func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config) *Auth {
 	return &Auth{
-		ctx:     ctx,
-		config:  config,
-		cfgPath: cfgPath,
+		ctx:    ctx,
+		config: config,
 	}
 }
 
@@ -163,14 +150,12 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 	}
 
 	jwtToken := ""
-	email := ""
 	if needsLogin {
 		tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 		if err != nil {
 			return fmt.Errorf("interactive sso login failed: %v", err)
 		}
 		jwtToken = tokenInfo.GetTokenToUse()
-		email = tokenInfo.Email
 	}
 
 	err, _ = authClient.Login(a.ctx, "", jwtToken)
@@ -178,42 +163,17 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 		return fmt.Errorf("login failed: %v", err)
 	}
 
-	// Stored after Login, not before: a rejected token must not leave a hint
-	// pointing at an account that cannot be used.
-	if email != "" && a.cfgPath != "" {
-		if err := writeProfileEmail(a.cfgPath, email); err != nil {
-			log.Warnf("failed to store profile account email: %v", err)
-		}
-	}
-
 	go urlOpener.OnLoginSuccess()
 
 	return nil
 }
 
-// loginHintSetter is implemented by both concrete flows (PKCE and device code)
-// but absent from the OAuthFlow interface, hence the assertion below — the same
-// way internal/auth wires it in authenticateWithPKCEFlow.
-type loginHintSetter interface {
-	SetLoginHint(hint string)
-}
-
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool) (*auth.TokenInfo, error) {
 	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
-	// An empty hint is deliberate, not a fallback: a fresh or logged-out profile
-	// leaves the choice to the IdP, which is how accounts get switched.
-	if a.cfgPath != "" {
-		if hint := readProfileEmail(a.cfgPath); hint != "" {
-			if setter, ok := oAuthFlow.(loginHintSetter); ok {
-				setter.SetLoginHint(hint)
-			}
-		}
-	}
-
 	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
 	if err != nil {
 		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)

client/android/login_test.go

@@ -1,51 +0,0 @@
-package android
-
-import (
-	"path/filepath"
-	"testing"
-)
-
-// NewAuth must reuse the configuration already at cfgPath rather than building a fresh one.
-//
-// Creating a new in-memory config on every call gives the client a new WireGuard private key each
-// time. The peer registers under that key and the key is written out, so a peer registered by an
-// earlier call is orphaned on the server — a client that enrols twice leaves two entries and owns
-// neither. It also breaks enrol-then-run: RunWithoutLogin reloads the configuration from disk, so
-// the identity that registered is not the identity that runs, and the management stream rejects it
-// with "no peer auth method provided, please use a setup key or interactive SSO login".
-func TestNewAuth_ReusesPersistedIdentity(t *testing.T) {
-	cfgPath := filepath.Join(t.TempDir(), "config.json")
-
-	first, err := NewAuth(cfgPath, "https://api.example.com:443")
-	if err != nil {
-		t.Fatalf("first NewAuth: %v", err)
-	}
-	if first.config.PrivateKey == "" {
-		t.Fatal("first NewAuth produced no private key")
-	}
-
-	second, err := NewAuth(cfgPath, "https://api.example.com:443")
-	if err != nil {
-		t.Fatalf("second NewAuth: %v", err)
-	}
-
-	if second.config.PrivateKey != first.config.PrivateKey {
-		t.Errorf("private key changed between calls: a second enrolment would orphan the peer registered by the first")
-	}
-}
-
-// A missing configuration is still created, so a first enrolment works unchanged.
-func TestNewAuth_CreatesConfigWhenAbsent(t *testing.T) {
-	cfgPath := filepath.Join(t.TempDir(), "config.json")
-
-	auth, err := NewAuth(cfgPath, "https://api.example.com:443")
-	if err != nil {
-		t.Fatalf("NewAuth: %v", err)
-	}
-	if auth.config == nil || auth.config.PrivateKey == "" {
-		t.Fatal("NewAuth did not create a usable configuration")
-	}
-	if auth.cfgPath != cfgPath {
-		t.Errorf("cfgPath = %q, want %q", auth.cfgPath, cfgPath)
-	}
-}

client/android/profile_manager.go

@@ -13,17 +13,18 @@ import (
 )
 
 const (
+	// Android-specific config filename (different from desktop default.json)
+	defaultConfigFilename = "netbird.cfg"
+	// Subdirectory for non-default profiles (must match Java Preferences.java)
+	profilesSubdir = "profiles"
 	// Android uses a single user context per app (non-empty username required by ServiceManager)
 	androidUsername = "android"
 )
 
 // Profile represents a profile for gomobile
 type Profile struct {
-	ID   string
-	Name string
-	// Email is the account this profile last logged in with, "" if it never
-	// completed an SSO login or was logged out. See profile_state.go.
-	Email    string
+	ID       string
+	Name     string
 	IsActive bool
 }
 
@@ -100,7 +101,6 @@ func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
 		profiles = append(profiles, &Profile{
 			ID:       p.ID.String(),
 			Name:     p.Name,
-			Email:    pm.profileEmail(p.ID.String()),
 			IsActive: p.IsActive,
 		})
 	}
@@ -123,22 +123,7 @@ func (pm *ProfileManager) GetActiveProfile() (*Profile, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to resolve active profile %q: %w", activeState.ID, err)
 	}
-	return &Profile{
-		ID:       prof.ID.String(),
-		Name:     prof.Name,
-		Email:    pm.profileEmail(prof.ID.String()),
-		IsActive: true,
-	}, nil
-}
-
-// profileEmail returns the account email recorded for a profile. Display-only, so
-// an unresolvable path degrades to "" rather than an error.
-func (pm *ProfileManager) profileEmail(id string) string {
-	configPath, err := pm.getProfileConfigPath(id)
-	if err != nil {
-		return ""
-	}
-	return readProfileEmail(configPath)
+	return &Profile{ID: prof.ID.String(), Name: prof.Name, IsActive: true}, nil
 }
 
 // SwitchProfile switches to a different profile
@@ -200,11 +185,6 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 		return fmt.Errorf("failed to save config: %w", err)
 	}
 
-	// Not fatal: a stale hint costs an account switch, not the logout itself.
-	if err := removeProfileEmail(configPath); err != nil {
-		log.Warnf("failed to clear stored account email for profile %s: %v", id, err)
-	}
-
 	log.Infof("logged out from profile: %s", id)
 	return nil
 }

client/android/profile_state.go

@@ -1,108 +0,0 @@
-package android
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/util"
-)
-
-const (
-	// Android-specific config filename (different from desktop default.json)
-	defaultConfigFilename = "netbird.cfg"
-	// Subdirectory for non-default profiles (must match Java Preferences.java)
-	profilesSubdir = "profiles"
-	// profileAccountSuffix names the file holding the profile's account email.
-	// Deliberately not ".state.json", which desktop uses for the same data:
-	// there the email and the engine's state manager live in different
-	// directories, but on Android both resolve under files/, so sharing the name
-	// would have the two overwrite each other — the state manager rewrites the
-	// whole file from its own keys (see statemanager.Manager.PersistState), and
-	// this package's writer does the same in reverse.
-	profileAccountSuffix = ".account.json"
-)
-
-// profileAccountPathFor derives the account file path from a profile's config
-// path: netbird.cfg -> netbird.account.json, <id>.json -> <id>.account.json.
-//
-// Deriving from the config path rather than resolving the active profile keeps
-// the write on the profile the login actually ran for: Auth.login runs in a
-// goroutine, so the active profile can change under a flow already in flight.
-func profileAccountPathFor(configPath string) (string, error) {
-	if configPath == "" {
-		return "", fmt.Errorf("empty config path")
-	}
-
-	base := filepath.Base(configPath)
-	stem := strings.TrimSuffix(base, filepath.Ext(base))
-	if stem == "" || stem == "." {
-		return "", fmt.Errorf("config path %q has no filename stem", configPath)
-	}
-
-	return filepath.Join(filepath.Dir(configPath), stem+profileAccountSuffix), nil
-}
-
-// readProfileEmail returns the account email stored for the profile whose config
-// lives at configPath. A missing or unreadable file yields "", which leaves the
-// account choice to the IdP.
-func readProfileEmail(configPath string) string {
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		log.Debugf("no profile account path for login hint: %v", err)
-		return ""
-	}
-
-	var state profilemanager.ProfileState
-	if _, err := util.ReadJson(accountPath, &state); err != nil {
-		if !os.IsNotExist(err) {
-			log.Debugf("failed to read profile account for login hint: %v", err)
-		}
-		return ""
-	}
-
-	return state.Email
-}
-
-// writeProfileEmail records the account email for the profile whose config lives
-// at configPath, so later logins can pass it as an OIDC login_hint. An empty
-// email is ignored rather than blanking what is already stored.
-func writeProfileEmail(configPath string, email string) error {
-	if email == "" {
-		return nil
-	}
-
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		return fmt.Errorf("resolve profile account path: %w", err)
-	}
-
-	state := profilemanager.ProfileState{Email: email}
-	if err := util.WriteJsonWithRestrictedPermission(context.Background(), accountPath, state); err != nil {
-		return fmt.Errorf("write profile account: %w", err)
-	}
-
-	return nil
-}
-
-// removeProfileEmail drops the stored account email. Called on logout: while the
-// email is on disk it goes out as a login_hint, which would steer the next login
-// straight back into the account just logged out of. Mirrors the desktop UI's
-// RemoveProfileState call.
-func removeProfileEmail(configPath string) error {
-	accountPath, err := profileAccountPathFor(configPath)
-	if err != nil {
-		return fmt.Errorf("resolve profile account path: %w", err)
-	}
-
-	if err := os.Remove(accountPath); err != nil && !os.IsNotExist(err) {
-		return fmt.Errorf("remove profile account: %w", err)
-	}
-
-	return nil
-}

client/android/profile_state_test.go

@@ -1,161 +0,0 @@
-package android
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-)
-
-func TestProfileAccountPathFor(t *testing.T) {
-	tests := []struct {
-		name       string
-		configPath string
-		want       string
-		wantErr    bool
-	}{
-		{
-			name:       "default profile",
-			configPath: "/data/data/io.netbird.client/files/netbird.cfg",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/netbird.account.json"),
-		},
-		{
-			name:       "id profile",
-			configPath: "/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.json",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.account.json"),
-		},
-		{
-			name:       "legacy name-keyed profile is handled the same way",
-			configPath: "/data/data/io.netbird.client/files/profiles/work.json",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/profiles/work.account.json"),
-		},
-		{
-			name:       "empty path is rejected",
-			configPath: "",
-			wantErr:    true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := profileAccountPathFor(tt.configPath)
-			if tt.wantErr {
-				if err == nil {
-					t.Fatalf("expected an error, got path %q", got)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("unexpected error: %v", err)
-			}
-			if got != tt.want {
-				t.Errorf("got %q, want %q", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestProfileAccountPathForDefaultDoesNotCollide(t *testing.T) {
-	root := "/data/data/io.netbird.client/files"
-
-	defaultAccount, err := profileAccountPathFor(filepath.Join(root, defaultConfigFilename))
-	if err != nil {
-		t.Fatalf("default profile: %v", err)
-	}
-
-	idAccount, err := profileAccountPathFor(filepath.Join(root, profilesSubdir, "abc123.json"))
-	if err != nil {
-		t.Fatalf("id profile: %v", err)
-	}
-
-	if defaultAccount == idAccount {
-		t.Fatalf("default and id profile share an account file: %q", defaultAccount)
-	}
-}
-
-// The account file must never land on the engine state file: on Android both
-// resolve under files/, and the state manager rewrites the whole file from its
-// own keys, so sharing a path would have the two overwrite each other. The
-// expected names here mirror ProfileManager.GetStateFilePath.
-func TestProfileAccountPathAvoidsEngineStateFile(t *testing.T) {
-	root := "/data/data/io.netbird.client/files"
-
-	cases := []struct {
-		configPath  string
-		engineState string
-	}{
-		{
-			configPath:  filepath.Join(root, defaultConfigFilename),
-			engineState: filepath.Join(root, "state.json"),
-		},
-		{
-			configPath:  filepath.Join(root, profilesSubdir, "abc123.json"),
-			engineState: filepath.Join(root, profilesSubdir, "abc123.state.json"),
-		},
-	}
-
-	for _, c := range cases {
-		account, err := profileAccountPathFor(c.configPath)
-		if err != nil {
-			t.Fatalf("%s: %v", c.configPath, err)
-		}
-		if account == c.engineState {
-			t.Errorf("account file collides with the engine state file: %q", account)
-		}
-	}
-}
-
-func TestWriteThenReadProfileEmail(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
-	if err := ensureDirFor(t, configPath); err != nil {
-		t.Fatalf("prepare dir: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email before a login, got %q", got)
-	}
-
-	const email = "user@example.com"
-	if err := writeProfileEmail(configPath, email); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != email {
-		t.Errorf("got %q, want %q", got, email)
-	}
-
-	if err := removeProfileEmail(configPath); err != nil {
-		t.Fatalf("remove: %v", err)
-	}
-	if got := readProfileEmail(configPath); got != "" {
-		t.Errorf("expected no email after logout, got %q", got)
-	}
-
-	// Logout may run on a never-logged-in profile, so a second remove must pass.
-	if err := removeProfileEmail(configPath); err != nil {
-		t.Fatalf("second remove should be a no-op: %v", err)
-	}
-}
-
-func TestWriteProfileEmailIgnoresEmpty(t *testing.T) {
-	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
-	if err := ensureDirFor(t, configPath); err != nil {
-		t.Fatalf("prepare dir: %v", err)
-	}
-
-	const email = "user@example.com"
-	if err := writeProfileEmail(configPath, email); err != nil {
-		t.Fatalf("write: %v", err)
-	}
-	if err := writeProfileEmail(configPath, ""); err != nil {
-		t.Fatalf("write empty: %v", err)
-	}
-
-	if got := readProfileEmail(configPath); got != email {
-		t.Errorf("empty write clobbered the stored email: got %q, want %q", got, email)
-	}
-}
-
-func ensureDirFor(t *testing.T, path string) error {
-	t.Helper()
-	return os.MkdirAll(filepath.Dir(path), 0o700)
-}

client/android/session.go

@@ -278,7 +278,7 @@ func (c *Client) endExtend() {
 }
 
 func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isAndroidTV bool) error {
-	cfg, cfgPath, cc := c.authSnapshot()
+	cfg, _, cc := c.stateSnapshot()
 	if cfg == nil || cc == nil {
 		return fmt.Errorf("engine is not running")
 	}
@@ -293,10 +293,7 @@ func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isA
 	}
 	defer authClient.Close()
 
-	// Passing the config path makes the flow pick up the login_hint: an extend
-	// renews the session of the account already signed in, so it must not stop to
-	// offer a choice.
-	a := NewAuthWithConfig(ctx, cfg, cfgPath)
+	a := &Auth{ctx: ctx, config: cfg}
 	tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 	if err != nil {
 		return fmt.Errorf("interactive sso login failed: %v", err)

client/anonymize/anonymize.go

@@ -2,7 +2,6 @@ package anonymize
 
 import (
 	"crypto/rand"
-	"encoding/base64"
 	"fmt"
 	"math/big"
 	"net"
@@ -16,88 +15,13 @@ import (
 
 const anonTLD = ".domain"
 
-// Level selects how much the anonymizer redacts. Levels are ordered: a higher
-// level redacts strictly more. On the wire (protos, flags) levels travel as
-// their string form.
-type Level int
-
-const (
-	// LevelDefault anonymizes public IP addresses, IPv6 ULA, domains, and MAC
-	// addresses. Internal IPv4 ranges (RFC 1918, CGNAT, link-local) are
-	// preserved so support can reason about the real topology.
-	LevelDefault Level = iota
-	// LevelStrict additionally anonymizes internal IP ranges, peer names, and
-	// WireGuard public keys.
-	LevelStrict
-)
-
-// LevelDefaultString and LevelStrictString are the wire forms of the levels,
-// for boundaries that pass levels as strings (flags, protos, mobile bindings).
-const (
-	LevelDefaultString = "default"
-	LevelStrictString  = "strict"
-)
-
-// ParseLevel maps s to a Level. Empty means LevelDefault; anything
-// unrecognized maps to LevelStrict so an unknown request never yields less
-// anonymization than intended.
-func ParseLevel(s string) Level {
-	switch strings.ToLower(s) {
-	case "", LevelDefaultString:
-		return LevelDefault
-	default:
-		return LevelStrict
-	}
-}
-
-// String returns the wire form of the level: "default" or "strict".
-func (l Level) String() string {
-	if l >= LevelStrict {
-		return LevelStrictString
-	}
-	return LevelDefaultString
-}
-
-// protectedDomains are NetBird-operated suffixes that stay recognizable in an
-// anonymized bundle. At LevelStrict the labels in front of them (the peer
-// name) are still replaced, except under netbird.io, which only hosts
-// NetBird infrastructure (api, signal, flow), never peer names.
-var protectedDomains = []string{"netbird.io", "netbird.selfhosted", "netbird.cloud", "netbird.stage"}
-
-const infraDomain = "netbird.io"
-
-var (
-	macColonRegex = regexp.MustCompile(`\b[0-9a-fA-F]{2}(?::[0-9a-fA-F]{2}){5}\b`)
-	macDashRegex  = regexp.MustCompile(`\b[0-9a-fA-F]{2}(?:-[0-9a-fA-F]{2}){5}\b`)
-	wgKeyRegex    = regexp.MustCompile(`\b[A-Za-z0-9+/]{43}=`)
-)
-
 type Anonymizer struct {
 	ipAnonymizer     map[netip.Addr]netip.Addr
 	domainAnonymizer map[string]string
-	// domainOrder caches the keys of domainAnonymizer sorted longest-first
-	// for AnonymizeString; it is rebuilt when the map gains entries.
-	domainOrder     []string
-	labelAnonymizer map[string]string
-	labelAnonymized map[string]struct{}
-	labelCounter    uint32
-	macAnonymizer   map[string]string
-	macCounter      uint32
-	wgKeyAnonymizer map[string]string
-	wgKeyAnonymized map[string]struct{}
-	currentAnonIPv4 netip.Addr
-	currentAnonIPv6 netip.Addr
-	startAnonIPv4   netip.Addr
-	startAnonIPv6   netip.Addr
-
-	// LevelStrict also anonymizes internal ranges (RFC 1918, CGNAT,
-	// link-local), replacing them from the dedicated internal pools below so
-	// a reader can still tell an internal address from a public one.
-	level                   Level
-	currentAnonInternalIPv4 netip.Addr
-	currentAnonInternalIPv6 netip.Addr
-	startAnonInternalIPv4   netip.Addr
-	startAnonInternalIPv6   netip.Addr
+	currentAnonIPv4  netip.Addr
+	currentAnonIPv6  netip.Addr
+	startAnonIPv4    netip.Addr
+	startAnonIPv6    netip.Addr
 
 	domainKeyRegex *regexp.Regexp
 }
@@ -108,50 +32,25 @@ func DefaultAddresses() (netip.Addr, netip.Addr) {
 	return netip.AddrFrom4([4]byte{198, 51, 100, 0}), netip.MustParseAddr("2001:db8:ffff::")
 }
 
-// InternalAddresses returns the pool starts used in strict mode for internal
-// ranges. Both are reserved ranges that cannot collide with real addressing:
-// 198.18.0.0 (RFC 2544 benchmarking), 2001:db8:1:: (RFC 3849 documentation).
-func InternalAddresses() (netip.Addr, netip.Addr) {
-	return netip.AddrFrom4([4]byte{198, 18, 0, 0}), netip.MustParseAddr("2001:db8:1::")
-}
-
 func NewAnonymizer(startIPv4, startIPv6 netip.Addr) *Anonymizer {
-	internalIPv4, internalIPv6 := InternalAddresses()
 	return &Anonymizer{
 		ipAnonymizer:     map[netip.Addr]netip.Addr{},
 		domainAnonymizer: map[string]string{},
-		labelAnonymizer:  map[string]string{},
-		labelAnonymized:  map[string]struct{}{},
-		macAnonymizer:    map[string]string{},
-		wgKeyAnonymizer:  map[string]string{},
-		wgKeyAnonymized:  map[string]struct{}{},
 		currentAnonIPv4:  startIPv4,
 		currentAnonIPv6:  startIPv6,
 		startAnonIPv4:    startIPv4,
 		startAnonIPv6:    startIPv6,
 
-		level:                   LevelDefault,
-		currentAnonInternalIPv4: internalIPv4,
-		currentAnonInternalIPv6: internalIPv6,
-		startAnonInternalIPv4:   internalIPv4,
-		startAnonInternalIPv6:   internalIPv6,
-
 		domainKeyRegex: regexp.MustCompile(`\bdomain=([^\s,:"]+)`),
 	}
 }
 
-// SetLevel selects the anonymization level. The zero value of a new
-// Anonymizer is LevelDefault.
-func (a *Anonymizer) SetLevel(level Level) {
-	a.level = level
-}
-
 func (a *Anonymizer) AnonymizeIP(ip netip.Addr) netip.Addr {
-	// Normalize 4-in-6 addresses so ::ffff:192.168.1.1 classifies and maps
-	// like 192.168.1.1.
-	ip = ip.Unmap()
-
 	if ip.IsLoopback() ||
+		ip.IsLinkLocalUnicast() ||
+		ip.IsLinkLocalMulticast() ||
+		ip.IsInterfaceLocalMulticast() ||
+		(ip.Is4() && ip.IsPrivate()) ||
 		ip.IsUnspecified() ||
 		ip.IsMulticast() ||
 		isWellKnown(ip) ||
@@ -160,100 +59,18 @@ func (a *Anonymizer) AnonymizeIP(ip netip.Addr) netip.Addr {
 		return ip
 	}
 
-	if isInternal(ip) && a.level < LevelStrict {
-		return ip
-	}
-
 	if _, ok := a.ipAnonymizer[ip]; !ok {
-		a.ipAnonymizer[ip] = a.nextAnonIP(ip)
+		if ip.Is4() {
+			a.ipAnonymizer[ip] = a.currentAnonIPv4
+			a.currentAnonIPv4 = a.currentAnonIPv4.Next()
+		} else {
+			a.ipAnonymizer[ip] = a.currentAnonIPv6
+			a.currentAnonIPv6 = a.currentAnonIPv6.Next()
+		}
 	}
 	return a.ipAnonymizer[ip]
 }
 
-func (a *Anonymizer) nextAnonIP(ip netip.Addr) netip.Addr {
-	// At the strict level, internal addresses (including IPv6 ULA, matched
-	// by IsPrivate) come from the internal pools so they remain recognizable
-	// as internal without disclosing the real values.
-	if a.level >= LevelStrict && (isInternal(ip) || ip.IsPrivate()) {
-		if ip.Is4() {
-			anon := a.currentAnonInternalIPv4
-			a.currentAnonInternalIPv4 = a.currentAnonInternalIPv4.Next()
-			return anon
-		}
-		anon := a.currentAnonInternalIPv6
-		a.currentAnonInternalIPv6 = a.currentAnonInternalIPv6.Next()
-		return anon
-	}
-
-	if ip.Is4() {
-		anon := a.currentAnonIPv4
-		a.currentAnonIPv4 = a.currentAnonIPv4.Next()
-		return anon
-	}
-	anon := a.currentAnonIPv6
-	a.currentAnonIPv6 = a.currentAnonIPv6.Next()
-	return anon
-}
-
-// AnonymizeMAC replaces a MAC address with a consistent placeholder from the
-// locally administered range starting at 02:00:00:00:00:01, at every
-// anonymization level. Broadcast, multicast, all-zero, and already assigned
-// placeholder addresses are preserved. The colon and dash spellings of the
-// same address share one placeholder; the output keeps the input's separator.
-func (a *Anonymizer) AnonymizeMAC(mac string) string {
-	hw, err := net.ParseMAC(mac)
-	if err != nil || len(hw) != 6 {
-		return mac
-	}
-
-	if isWellKnownMAC(hw) || a.isAnonymizedMAC(hw) {
-		return mac
-	}
-
-	key := hw.String()
-	anon, ok := a.macAnonymizer[key]
-	if !ok {
-		a.macCounter++
-		anon = fmt.Sprintf("02:00:00:%02x:%02x:%02x", byte(a.macCounter>>16), byte(a.macCounter>>8), byte(a.macCounter))
-		a.macAnonymizer[key] = anon
-	}
-
-	if strings.Contains(mac, "-") {
-		anon = strings.ReplaceAll(anon, ":", "-")
-	}
-	return anon
-}
-
-// isAnonymizedMAC reports whether hw is a placeholder this anonymizer already
-// handed out, so a second pass over anonymized output leaves it unchanged.
-func (a *Anonymizer) isAnonymizedMAC(hw net.HardwareAddr) bool {
-	if hw[0] != 0x02 || hw[1] != 0 || hw[2] != 0 {
-		return false
-	}
-	value := uint32(hw[3])<<16 | uint32(hw[4])<<8 | uint32(hw[5])
-	return value <= a.macCounter
-}
-
-// AnonymizeWGKey replaces a WireGuard public key with a consistent random
-// placeholder of the same shape. Keys are only anonymized at LevelStrict;
-// placeholders already handed out pass through unchanged.
-func (a *Anonymizer) AnonymizeWGKey(key string) string {
-	if a.level < LevelStrict || !looksLikeWGKey(key) {
-		return key
-	}
-	if _, ok := a.wgKeyAnonymized[key]; ok {
-		return key
-	}
-
-	anon, ok := a.wgKeyAnonymizer[key]
-	if !ok {
-		anon = generateAnonymousKey()
-		a.wgKeyAnonymizer[key] = anon
-		a.wgKeyAnonymized[anon] = struct{}{}
-	}
-	return anon
-}
-
 func (a *Anonymizer) AnonymizeUDPAddr(addr net.UDPAddr) net.UDPAddr {
 	// Convert IP to netip.Addr
 	ip, ok := netip.AddrFromSlice(addr.IP)
@@ -272,12 +89,12 @@ func (a *Anonymizer) AnonymizeUDPAddr(addr net.UDPAddr) net.UDPAddr {
 
 // isInAnonymizedRange checks if an IP is within the range of already assigned anonymized IPs
 func (a *Anonymizer) isInAnonymizedRange(ip netip.Addr) bool {
-	if ip.Is4() {
-		return inPoolRange(ip, a.startAnonIPv4, a.currentAnonIPv4) ||
-			inPoolRange(ip, a.startAnonInternalIPv4, a.currentAnonInternalIPv4)
+	if ip.Is4() && ip.Compare(a.startAnonIPv4) >= 0 && ip.Compare(a.currentAnonIPv4) <= 0 {
+		return true
+	} else if !ip.Is4() && ip.Compare(a.startAnonIPv6) >= 0 && ip.Compare(a.currentAnonIPv6) <= 0 {
+		return true
 	}
-	return inPoolRange(ip, a.startAnonIPv6, a.currentAnonIPv6) ||
-		inPoolRange(ip, a.startAnonInternalIPv6, a.currentAnonInternalIPv6)
+	return false
 }
 
 func (a *Anonymizer) AnonymizeIPString(ip string) string {
@@ -301,17 +118,14 @@ func (a *Anonymizer) AnonymizeDomain(domain string) string {
 		baseDomain = domain[:len(domain)-1]
 	}
 
-	if strings.HasSuffix(baseDomain, anonTLD) {
+	if strings.HasSuffix(baseDomain, "netbird.io") ||
+		strings.HasSuffix(baseDomain, "netbird.selfhosted") ||
+		strings.HasSuffix(baseDomain, "netbird.cloud") ||
+		strings.HasSuffix(baseDomain, "netbird.stage") ||
+		strings.HasSuffix(baseDomain, anonTLD) {
 		return domain
 	}
 
-	if suffix := protectedSuffix(baseDomain); suffix != "" {
-		if a.level < LevelStrict || baseDomain == suffix || suffix == infraDomain {
-			return domain
-		}
-		return withTrailingDot(a.anonymizePeerName(baseDomain, suffix), hasDot)
-	}
-
 	parts := strings.Split(baseDomain, ".")
 	if len(parts) < 2 {
 		return domain
@@ -327,53 +141,12 @@ func (a *Anonymizer) AnonymizeDomain(domain string) string {
 	}
 
 	result := strings.Replace(baseDomain, baseForLookup, anonymized, 1)
-	if a.level >= LevelStrict && len(parts) > 2 {
-		prefix := strings.TrimSuffix(baseDomain, "."+baseForLookup)
-		result = a.anonymizeLabels(prefix, "host") + "." + anonymized
-		// The full mapping feeds AnonymizeString so seeded FQDNs are caught
-		// in log lines as a whole, labels included.
-		a.domainAnonymizer[baseDomain] = result
-	}
-	return withTrailingDot(result, hasDot)
-}
-
-// anonymizePeerName replaces the labels in front of a protected suffix with
-// numbered peer placeholders, keeping the suffix, and records the full
-// mapping for string replacement in logs. The numbering keeps a peer
-// recognizable across the whole bundle without disclosing its name.
-func (a *Anonymizer) anonymizePeerName(baseDomain, suffix string) string {
-	prefix := strings.TrimSuffix(baseDomain, "."+suffix)
-	result := a.anonymizeLabels(prefix, "peer") + "." + suffix
-	if result != baseDomain {
-		a.domainAnonymizer[baseDomain] = result
+	if hasDot {
+		result += "."
 	}
 	return result
 }
 
-// anonymizeLabels replaces each dot-separated label with a consistent
-// numbered placeholder ("<placeholder>-<n>"). Wildcard labels and
-// placeholders already handed out pass through unchanged.
-func (a *Anonymizer) anonymizeLabels(prefix, placeholder string) string {
-	labels := strings.Split(prefix, ".")
-	for i, label := range labels {
-		if label == "*" {
-			continue
-		}
-		if _, ok := a.labelAnonymized[label]; ok {
-			continue
-		}
-		anon, ok := a.labelAnonymizer[label]
-		if !ok {
-			a.labelCounter++
-			anon = fmt.Sprintf("%s-%d", placeholder, a.labelCounter)
-			a.labelAnonymizer[label] = anon
-			a.labelAnonymized[anon] = struct{}{}
-		}
-		labels[i] = anon
-	}
-	return strings.Join(labels, ".")
-}
-
 func (a *Anonymizer) AnonymizeURI(uri string) string {
 	u, err := url.Parse(uri)
 	if err != nil {
@@ -408,70 +181,16 @@ func (a *Anonymizer) AnonymizeString(str string) string {
 	str = ipv4Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 	str = ipv6Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 
-	for _, domain := range a.sortedDomains() {
-		str = strings.ReplaceAll(str, domain, a.domainAnonymizer[domain])
+	for domain, anonDomain := range a.domainAnonymizer {
+		str = strings.ReplaceAll(str, domain, anonDomain)
 	}
 
 	str = a.AnonymizeSchemeURI(str)
 	str = a.AnonymizeDNSLogLine(str)
 
-	// MAC handling runs after the IP passes so preserved IPv6 addresses are
-	// already out of the way; the separator guard skips matches embedded in a
-	// longer colon- or dash-separated sequence (such as an IPv6 tail).
-	str = a.anonymizeMACsInString(str, macColonRegex, ':')
-	str = a.anonymizeMACsInString(str, macDashRegex, '-')
-
-	if a.level >= LevelStrict {
-		str = wgKeyRegex.ReplaceAllStringFunc(str, a.AnonymizeWGKey)
-	}
-
 	return str
 }
 
-// sortedDomains returns the domain mappings longest-first, so a full-FQDN
-// mapping (strict level) is applied before the base-domain mapping it
-// contains. The order is rebuilt only when domainAnonymizer has grown.
-func (a *Anonymizer) sortedDomains() []string {
-	if len(a.domainOrder) == len(a.domainAnonymizer) {
-		return a.domainOrder
-	}
-
-	a.domainOrder = a.domainOrder[:0]
-	for domain := range a.domainAnonymizer {
-		a.domainOrder = append(a.domainOrder, domain)
-	}
-	slices.SortFunc(a.domainOrder, func(x, y string) int {
-		if d := len(y) - len(x); d != 0 {
-			return d
-		}
-		return strings.Compare(x, y)
-	})
-	return a.domainOrder
-}
-
-// anonymizeMACsInString replaces MAC addresses matched by re, skipping
-// matches that directly adjoin another sep so a six-group run inside a longer
-// separated sequence is left alone.
-func (a *Anonymizer) anonymizeMACsInString(str string, re *regexp.Regexp, sep byte) string {
-	matches := re.FindAllStringIndex(str, -1)
-	if len(matches) == 0 {
-		return str
-	}
-
-	var b strings.Builder
-	last := 0
-	for _, m := range matches {
-		if (m[0] > 0 && str[m[0]-1] == sep) || (m[1] < len(str) && str[m[1]] == sep) {
-			continue
-		}
-		b.WriteString(str[last:m[0]])
-		b.WriteString(a.AnonymizeMAC(str[m[0]:m[1]]))
-		last = m[1]
-	}
-	b.WriteString(str[last:])
-	return b.String()
-}
-
 // AnonymizeSchemeURI finds and anonymizes URIs with ws, wss, rel, rels, stun, stuns, turn, and turns schemes.
 func (a *Anonymizer) AnonymizeSchemeURI(text string) string {
 	re := regexp.MustCompile(`(?i)\b(wss?://|rels?://|stuns?:|turns?:|https?://)\S+\b`)
@@ -520,79 +239,10 @@ func isWellKnown(addr netip.Addr) bool {
 		"128.0.0.0", "8000::", // 2nd split subnet for default routes
 	}
 
-	return slices.Contains(wellKnown, addr.String())
-}
-
-// isInternal reports whether ip identifies a host only within the local
-// network: IPv4 private (RFC 1918), CGNAT (RFC 6598), and link-local (v4 and
-// v6). These are preserved at the default level so support can reason about
-// the real topology, and replaced from the internal pools at the strict
-// level. IPv6 ULA is deliberately not internal: its random global ID uniquely
-// fingerprints the network, so it is anonymized at every level.
-func isInternal(ip netip.Addr) bool {
-	return (ip.Is4() && ip.IsPrivate()) ||
-		ip.IsLinkLocalUnicast() ||
-		isCGNAT(ip)
-}
-
-func inPoolRange(ip, start, current netip.Addr) bool {
-	return ip.Compare(start) >= 0 && ip.Compare(current) <= 0
-}
-
-// isWellKnownMAC reports whether hw carries no stable host identity: all-zero
-// or a group address (broadcast and multicast).
-func isWellKnownMAC(hw net.HardwareAddr) bool {
-	if hw[0]&1 == 1 {
+	if slices.Contains(wellKnown, addr.String()) {
 		return true
 	}
-	for _, b := range hw {
-		if b != 0 {
-			return false
-		}
-	}
-	return true
-}
 
-// looksLikeWGKey reports whether s has the shape of a WireGuard key:
-// 44 base64 characters decoding to 32 bytes.
-func looksLikeWGKey(s string) bool {
-	if len(s) != 44 || s[43] != '=' {
-		return false
-	}
-	decoded, err := base64.StdEncoding.DecodeString(s)
-	return err == nil && len(decoded) == 32
-}
-
-func generateAnonymousKey() string {
-	buf := make([]byte, 32)
-	if _, err := rand.Read(buf); err != nil {
-		return strings.Repeat("A", 43) + "="
-	}
-	return base64.StdEncoding.EncodeToString(buf)
-}
-
-// protectedSuffix returns the protected NetBird suffix baseDomain ends with,
-// or empty. The match is label-anchored so an unrelated domain that merely
-// ends in the same characters is not preserved.
-func protectedSuffix(baseDomain string) string {
-	for _, d := range protectedDomains {
-		if baseDomain == d || strings.HasSuffix(baseDomain, "."+d) {
-			return d
-		}
-	}
-	return ""
-}
-
-func withTrailingDot(domain string, hasDot bool) string {
-	if hasDot {
-		return domain + "."
-	}
-	return domain
-}
-
-// isCGNAT reports whether addr is in 100.64.0.0/10 (RFC 6598), the range
-// NetBird assigns overlay peer addresses from.
-func isCGNAT(addr netip.Addr) bool {
 	cgnatRangeStart := netip.AddrFrom4([4]byte{100, 64, 0, 0})
 	cgnatRange := netip.PrefixFrom(cgnatRangeStart, 10)
 

client/anonymize/anonymize_test.go

@@ -1,11 +1,8 @@
 package anonymize_test
 
 import (
-	"bytes"
-	"encoding/base64"
 	"net/netip"
 	"regexp"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -47,301 +44,6 @@ func TestAnonymizeIP(t *testing.T) {
 	}
 }
 
-func TestParseLevel(t *testing.T) {
-	tests := []struct {
-		input  string
-		expect anonymize.Level
-	}{
-		{"", anonymize.LevelDefault},
-		{"default", anonymize.LevelDefault},
-		{"DEFAULT", anonymize.LevelDefault},
-		{"strict", anonymize.LevelStrict},
-		{"STRICT", anonymize.LevelStrict},
-		// Unknown values must never yield less anonymization than requested.
-		{"garbage", anonymize.LevelStrict},
-	}
-
-	for _, tc := range tests {
-		t.Run("input="+tc.input, func(t *testing.T) {
-			assert.Equal(t, tc.expect, anonymize.ParseLevel(tc.input), "parsed level should match")
-		})
-	}
-}
-
-func TestAnonymizeIP_DefaultLevelInternalRanges(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	tests := []struct {
-		name   string
-		ip     string
-		expect string
-	}{
-		{"RFC1918 10/8", "10.1.2.3", "10.1.2.3"},
-		{"RFC1918 172.16/12", "172.16.5.5", "172.16.5.5"},
-		{"RFC1918 192.168/16", "192.168.1.1", "192.168.1.1"},
-		{"CGNAT", "100.64.0.5", "100.64.0.5"},
-		{"IPv4 link-local", "169.254.1.1", "169.254.1.1"},
-		{"IPv6 link-local", "fe80::1", "fe80::1"},
-		// ULA is anonymized even at the default level: its random global ID
-		// uniquely fingerprints the network, unlike shared RFC 1918 space.
-		{"IPv6 ULA", "fd12:3456:789a::1", "2001:db8:ffff::"},
-		// 4-in-6 addresses classify like their unmapped IPv4 form.
-		{"4-in-6 RFC1918", "::ffff:192.168.1.1", "192.168.1.1"},
-		{"4-in-6 CGNAT", "::ffff:100.64.0.5", "100.64.0.5"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			result := anonymizer.AnonymizeIP(netip.MustParseAddr(tc.ip))
-			assert.Equal(t, tc.expect, result.String(), "default level should preserve internal ranges except ULA")
-		})
-	}
-}
-
-func TestAnonymizeIP_StrictLevel(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(anonymize.LevelStrict)
-
-	// Order matters: internal pool addresses are assigned sequentially.
-	tests := []struct {
-		name   string
-		ip     string
-		expect string
-	}{
-		{"RFC1918 192.168/16", "192.168.1.1", "198.18.0.0"},
-		{"Second RFC1918", "192.168.1.2", "198.18.0.1"},
-		{"Repeated RFC1918", "192.168.1.1", "198.18.0.0"},
-		{"RFC1918 10/8", "10.1.2.3", "198.18.0.2"},
-		{"RFC1918 172.16/12", "172.16.5.5", "198.18.0.3"},
-		{"CGNAT", "100.64.0.5", "198.18.0.4"},
-		{"IPv4 link-local", "169.254.1.1", "198.18.0.5"},
-		{"Public IPv4 uses public pool", "1.2.3.4", "198.51.100.0"},
-		{"IPv6 link-local", "fe80::1", "2001:db8:1::"},
-		{"IPv6 ULA", "fd12:3456:789a::1", "2001:db8:1::1"},
-		{"Public IPv6 uses public pool", "2607:f8b0:4005:805::200e", "2001:db8:ffff::"},
-		{"Loopback IPv4", "127.0.0.1", "127.0.0.1"},
-		{"Loopback IPv6", "::1", "::1"},
-		{"Unspecified", "0.0.0.0", "0.0.0.0"},
-		{"Multicast", "224.0.0.251", "224.0.0.251"},
-		{"Well known resolver", "8.8.8.8", "8.8.8.8"},
-		{"Well known split marker", "128.0.0.0", "128.0.0.0"},
-		{"In internal pool range", "198.18.0.3", "198.18.0.3"},
-		{"In public pool range", "198.51.100.0", "198.51.100.0"},
-		{"4-in-6 repeated RFC1918", "::ffff:192.168.1.1", "198.18.0.0"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			result := anonymizer.AnonymizeIP(netip.MustParseAddr(tc.ip))
-			assert.Equal(t, tc.expect, result.String(), "strict level should replace internal ranges from the internal pools")
-		})
-	}
-}
-
-func TestAnonymizeString_StrictInternalIPs(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(anonymize.LevelStrict)
-
-	input := "route 10.20.30.0/24 via 192.168.1.1 dev eth0 src 100.64.0.7"
-	firstPass := anonymizer.AnonymizeString(input)
-	secondPass := anonymizer.AnonymizeString(firstPass)
-
-	assert.NotContains(t, firstPass, "10.20.30.0", "private network address should be anonymized")
-	assert.NotContains(t, firstPass, "192.168.1.1", "private gateway should be anonymized")
-	assert.NotContains(t, firstPass, "100.64.0.7", "CGNAT address should be anonymized")
-	assert.Contains(t, firstPass, "/24", "prefix length should be preserved")
-	assert.Equal(t, firstPass, secondPass, "second pass should not further anonymize the string")
-}
-
-func TestAnonymizeMAC(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	first := anonymizer.AnonymizeMAC("aa:bb:cc:dd:ee:0f")
-	assert.Equal(t, "02:00:00:00:00:01", first, "first MAC should get the first placeholder")
-	assert.Equal(t, first, anonymizer.AnonymizeMAC("aa:bb:cc:dd:ee:0f"), "repeated MAC should map to the same placeholder")
-	assert.Equal(t, first, anonymizer.AnonymizeMAC("AA:BB:CC:DD:EE:0F"), "case should not affect the mapping")
-	assert.Equal(t, "02-00-00-00-00-01", anonymizer.AnonymizeMAC("AA-BB-CC-DD-EE-0F"), "dash form should keep its separator but share the mapping")
-
-	second := anonymizer.AnonymizeMAC("10:22:33:44:55:66")
-	assert.Equal(t, "02:00:00:00:00:02", second, "second distinct MAC should get the next placeholder")
-
-	tests := []struct {
-		name string
-		mac  string
-	}{
-		{"Broadcast", "ff:ff:ff:ff:ff:ff"},
-		{"IPv4 multicast", "01:00:5e:00:00:fb"},
-		{"IPv6 multicast", "33:33:00:00:00:01"},
-		{"All zero", "00:00:00:00:00:00"},
-		{"Assigned placeholder", "02:00:00:00:00:01"},
-		{"Invalid", "not-a-mac"},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.mac, anonymizer.AnonymizeMAC(tc.mac), "should be preserved")
-		})
-	}
-}
-
-func TestAnonymizeString_MACAddresses(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	tests := []struct {
-		name   string
-		input  string
-		expect string
-	}{
-		{
-			name:   "nftables ether rule",
-			input:  "ether saddr aa:bb:cc:dd:ee:ff drop",
-			expect: "ether saddr 02:00:00:00:00:01 drop",
-		},
-		{
-			name:   "Windows dash form",
-			input:  "Physical Address : AA-BB-CC-DD-EE-FF",
-			expect: "Physical Address : 02-00-00-00-00-01",
-		},
-		{
-			name:   "IPv6 address tail is not treated as MAC",
-			input:  "addr fe80:0:11:22:33:44:55:66 scope link",
-			expect: "addr fe80:0:11:22:33:44:55:66 scope link",
-		},
-		{
-			name:   "broadcast MAC preserved",
-			input:  "dst ff:ff:ff:ff:ff:ff type ARP",
-			expect: "dst ff:ff:ff:ff:ff:ff type ARP",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			result := anonymizer.AnonymizeString(tc.input)
-			assert.Equal(t, tc.expect, result, "MAC addresses should be anonymized at every level")
-			assert.Equal(t, result, anonymizer.AnonymizeString(result), "second pass should not change the result")
-		})
-	}
-}
-
-func TestAnonymizeWGKey(t *testing.T) {
-	key := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{0x42}, 32))
-
-	t.Run("default level preserves keys", func(t *testing.T) {
-		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		assert.Equal(t, key, anonymizer.AnonymizeWGKey(key), "default level should not touch WireGuard keys")
-	})
-
-	t.Run("strict level replaces keys", func(t *testing.T) {
-		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		anonymizer.SetLevel(anonymize.LevelStrict)
-
-		anon := anonymizer.AnonymizeWGKey(key)
-		assert.NotEqual(t, key, anon, "strict level should replace the key")
-		assert.Regexp(t, `^[A-Za-z0-9+/]{43}=$`, anon, "placeholder should keep the WireGuard key shape")
-		assert.Equal(t, anon, anonymizer.AnonymizeWGKey(key), "repeated key should map to the same placeholder")
-		assert.Equal(t, anon, anonymizer.AnonymizeWGKey(anon), "an assigned placeholder should pass through unchanged")
-
-		assert.Equal(t, "not-a-key", anonymizer.AnonymizeWGKey("not-a-key"), "non-key values should be preserved")
-	})
-}
-
-func TestAnonymizeString_WGKeys(t *testing.T) {
-	key := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{0x42}, 32))
-	input := "peer " + key + " handshake completed"
-
-	t.Run("default level preserves keys", func(t *testing.T) {
-		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		assert.Equal(t, input, anonymizer.AnonymizeString(input), "default level should not touch WireGuard keys in strings")
-	})
-
-	t.Run("strict level replaces keys", func(t *testing.T) {
-		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		anonymizer.SetLevel(anonymize.LevelStrict)
-
-		firstPass := anonymizer.AnonymizeString(input)
-		assert.NotContains(t, firstPass, key, "the key should not survive strict anonymization")
-		assert.Equal(t, anonymizer.AnonymizeWGKey(key), extractKey(t, firstPass), "string replacement should be consistent with AnonymizeWGKey")
-		assert.Equal(t, firstPass, anonymizer.AnonymizeString(firstPass), "second pass should not change the result")
-	})
-}
-
-func extractKey(t *testing.T, logLine string) string {
-	t.Helper()
-	fields := strings.Fields(logLine)
-	require.Len(t, fields, 4, "log line should keep its structure")
-	return fields[1]
-}
-
-func TestAnonymizeDomain_StrictLevel(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(anonymize.LevelStrict)
-
-	t.Run("netbird peer name", func(t *testing.T) {
-		result := anonymizer.AnonymizeDomain("my-laptop.netbird.cloud")
-		assert.Regexp(t, `^peer-\d+\.netbird\.cloud$`, result, "peer name should be anonymized, suffix kept")
-		assert.NotContains(t, result, "my-laptop", "the peer name should not survive")
-		assert.Equal(t, result, anonymizer.AnonymizeDomain("my-laptop.netbird.cloud"), "repeated domain should map consistently")
-		assert.Equal(t, result, anonymizer.AnonymizeDomain(result), "an anonymized domain should pass through unchanged")
-	})
-
-	t.Run("bare netbird domain", func(t *testing.T) {
-		assert.Equal(t, "netbird.cloud", anonymizer.AnonymizeDomain("netbird.cloud"), "the bare protected suffix should be preserved")
-	})
-
-	t.Run("netbird infrastructure preserved", func(t *testing.T) {
-		assert.Equal(t, "api.netbird.io", anonymizer.AnonymizeDomain("api.netbird.io"),
-			"netbird.io hosts infrastructure, not peer names, and should stay readable")
-	})
-
-	t.Run("leading labels of other domains", func(t *testing.T) {
-		result := anonymizer.AnonymizeDomain("host1.corp.example.com")
-		assert.Regexp(t, `^host-\d+\.host-\d+\.anon-[a-zA-Z0-9]+\.domain$`, result, "every label should be anonymized")
-		for _, label := range []string{"host1", "corp", "example"} {
-			assert.NotContains(t, result, label, "no original label should survive")
-		}
-		assert.Equal(t, result, anonymizer.AnonymizeDomain("host1.corp.example.com"), "repeated domain should map consistently")
-	})
-
-	t.Run("same label maps consistently across domains", func(t *testing.T) {
-		first := anonymizer.AnonymizeDomain("shared.one.com")
-		second := anonymizer.AnonymizeDomain("shared.two.com")
-		assert.Equal(t, strings.Split(first, ".")[0], strings.Split(second, ".")[0], "the shared host label should get one placeholder")
-	})
-
-	t.Run("wildcard label preserved", func(t *testing.T) {
-		result := anonymizer.AnonymizeDomain("*.example.com")
-		assert.Regexp(t, `^\*\.anon-[a-zA-Z0-9]+\.domain$`, result, "the wildcard label should stay a wildcard")
-	})
-}
-
-func TestAnonymizeDomain_DefaultLevelKeepsPeerNames(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	assert.Equal(t, "my-laptop.netbird.cloud", anonymizer.AnonymizeDomain("my-laptop.netbird.cloud"),
-		"default level should preserve netbird FQDNs including the peer name")
-	assert.Regexp(t, `^sub\.anon-[a-zA-Z0-9]+\.domain$`, anonymizer.AnonymizeDomain("sub.example.com"),
-		"default level should keep subdomain labels")
-}
-
-func TestAnonymizeString_StrictPeerNames(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(anonymize.LevelStrict)
-
-	// Seed like the bundle generator does from the status: base first, then
-	// the full FQDN, so replacement must prefer the longer mapping.
-	anonBase := anonymizer.AnonymizeDomain("example.com")
-	anonPeer := anonymizer.AnonymizeDomain("peer1.netbird.cloud")
-	anonHost := anonymizer.AnonymizeDomain("host1.example.com")
-
-	logLine := "connected to peer1.netbird.cloud via host1.example.com endpoint"
-	firstPass := anonymizer.AnonymizeString(logLine)
-	assert.NotContains(t, firstPass, "peer1", "the peer name should not survive in logs")
-	assert.NotContains(t, firstPass, "host1", "the host label should not survive in logs")
-	assert.Contains(t, firstPass, anonPeer, "the seeded peer mapping should be applied")
-	assert.Contains(t, firstPass, anonHost, "the seeded host mapping should be applied, not just the base mapping")
-	assert.NotContains(t, firstPass, "host1."+anonBase, "the base mapping must not preempt the longer FQDN mapping")
-	assert.Equal(t, firstPass, anonymizer.AnonymizeString(firstPass), "second pass should not change the result")
-}
-
 func TestAnonymizeDNSLogLine(t *testing.T) {
 	anonymizer := anonymize.NewAnonymizer(netip.Addr{}, netip.Addr{})
 	tests := []struct {

client/cmd/debug.go

@@ -27,8 +27,8 @@ import (
 const errCloseConnection = "Failed to close connection: %v"
 
 var (
-	logFileCount             uint32
-	systemInfoFlag           bool
+	logFileCount        uint32
+	systemInfoFlag      bool
 	uploadBundleFlag         bool
 	uploadBundleURLFlag      string
 	uploadBundleInsecureFlag bool
@@ -156,11 +156,6 @@ func debugConfigDump(cmd *cobra.Command, _ []string) error {
 // request. Returns an error if the RPC fails or if the daemon reports
 // an upload failure reason.
 func debugBundle(cmd *cobra.Command, _ []string) error {
-	anonymizeEnabled, anonymizeLevel, err := effectiveAnonymize()
-	if err != nil {
-		return err
-	}
-
 	conn, err := getClient(cmd)
 	if err != nil {
 		return err
@@ -173,11 +168,10 @@ func debugBundle(cmd *cobra.Command, _ []string) error {
 
 	client := proto.NewDaemonServiceClient(conn)
 	request := &proto.DebugBundleRequest{
-		Anonymize:      anonymizeEnabled,
-		AnonymizeLevel: anonymizeLevel.String(),
-		SystemInfo:     systemInfoFlag,
-		LogFileCount:   logFileCount,
-		CliVersion:     version.NetbirdVersion(),
+		Anonymize:    anonymizeFlag,
+		SystemInfo:   systemInfoFlag,
+		LogFileCount: logFileCount,
+		CliVersion:   version.NetbirdVersion(),
 	}
 	if uploadBundleFlag {
 		request.UploadURL = uploadBundleURLFlag
@@ -235,11 +229,6 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("invalid duration format: %v", err)
 	}
 
-	anonymizeEnabled, anonymizeLevel, err := effectiveAnonymize()
-	if err != nil {
-		return err
-	}
-
 	conn, err := getClient(cmd)
 	if err != nil {
 		return err
@@ -379,11 +368,10 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 	cmd.Println("Creating debug bundle...")
 
 	request := &proto.DebugBundleRequest{
-		Anonymize:      anonymizeEnabled,
-		AnonymizeLevel: anonymizeLevel.String(),
-		SystemInfo:     systemInfoFlag,
-		LogFileCount:   logFileCount,
-		CliVersion:     version.NetbirdVersion(),
+		Anonymize:    anonymizeFlag,
+		SystemInfo:   systemInfoFlag,
+		LogFileCount: logFileCount,
+		CliVersion:   version.NetbirdVersion(),
 	}
 	if uploadBundleFlag {
 		request.UploadURL = uploadBundleURLFlag

client/cmd/root.go

@@ -21,7 +21,6 @@ import (
 	"github.com/spf13/pflag"
 	"google.golang.org/grpc"
 
-	"github.com/netbirdio/netbird/client/anonymize"
 	daddr "github.com/netbirdio/netbird/client/internal/daemonaddr"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 )
@@ -70,7 +69,6 @@ var (
 	autoConnectDisabled     bool
 	extraIFaceBlackList     []string
 	anonymizeFlag           bool
-	anonymizeLevelFlag      string
 	dnsRouteInterval        time.Duration
 	// lazyConnEnabled is the parse target for the deprecated --enable-lazy-connection
 	// flag. The flag is inert; the value is no longer read (use NB_LAZY_CONN instead).
@@ -158,8 +156,7 @@ func init() {
 	rootCmd.MarkFlagsMutuallyExclusive("setup-key", "setup-key-file")
 	rootCmd.PersistentFlags().StringVar(&preSharedKey, preSharedKeyFlag, "", "Sets WireGuard PreSharedKey property. If set, then only peers that have the same key can communicate.")
 	rootCmd.PersistentFlags().StringVarP(&hostName, "hostname", "n", "", "Sets a custom hostname for the device")
-	rootCmd.PersistentFlags().BoolVarP(&anonymizeFlag, "anonymize", "A", false, "anonymize public IP addresses, MAC addresses, and non-netbird.io domains in logs and status output; private, CGNAT, and link-local IP ranges are kept (see --anonymize-level strict)")
-	rootCmd.PersistentFlags().StringVar(&anonymizeLevelFlag, "anonymize-level", "", "anonymization level: \"default\" or \"strict\"; strict also anonymizes private, CGNAT, and link-local IP ranges, peer names, and WireGuard public keys. Setting this flag implies --anonymize")
+	rootCmd.PersistentFlags().BoolVarP(&anonymizeFlag, "anonymize", "A", false, "anonymize IP addresses and non-netbird.io domains in logs and status output")
 	rootCmd.PersistentFlags().StringVarP(&configPath, "config", "c", profilemanager.DefaultConfigPath, "Overrides the default profile file location")
 
 	rootCmd.AddCommand(upCmd)
@@ -296,19 +293,6 @@ var CLIBackOffSettings = &backoff.ExponentialBackOff{
 	Clock:               backoff.SystemClock,
 }
 
-// effectiveAnonymize resolves the --anonymize and --anonymize-level flags:
-// setting a level implies anonymization, and an invalid level is rejected.
-func effectiveAnonymize() (bool, anonymize.Level, error) {
-	if anonymizeLevelFlag == "" {
-		return anonymizeFlag, anonymize.LevelDefault, nil
-	}
-	level := anonymize.ParseLevel(anonymizeLevelFlag)
-	if !strings.EqualFold(anonymizeLevelFlag, level.String()) {
-		return false, anonymize.LevelDefault, fmt.Errorf("invalid anonymize level %q: use %q or %q", anonymizeLevelFlag, anonymize.LevelDefault.String(), anonymize.LevelStrict.String())
-	}
-	return true, level, nil
-}
-
 func getSetupKey() (string, error) {
 	if setupKeyPath != "" && setupKey == "" {
 		return getSetupKeyFromFile(setupKeyPath)

client/cmd/status.go

@@ -121,14 +121,8 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 		sessionExpiresAt = ts.AsTime().UTC()
 	}
 
-	anonymizeEnabled, anonymizeLevel, err := effectiveAnonymize()
-	if err != nil {
-		return err
-	}
-
 	var outputInformationHolder = nbstatus.ConvertToStatusOutputOverview(resp.GetFullStatus(), nbstatus.ConvertOptions{
-		Anonymize:            anonymizeEnabled,
-		AnonymizeLevel:       anonymizeLevel,
+		Anonymize:            anonymizeFlag,
 		DaemonVersion:        resp.GetDaemonVersion(),
 		DaemonStatus:         nbstatus.ParseDaemonStatus(status),
 		StatusFilter:         statusFilter,

client/embed/embed.go

@@ -85,6 +85,11 @@ type Options struct {
 	DisableIPv6 bool
 	// BlockInbound blocks all inbound connections from peers
 	BlockInbound bool
+	// EnableRosenpass enables the Rosenpass post-quantum key exchange.
+	EnableRosenpass bool
+	// RosenpassPermissive lets a Rosenpass-enabled peer still connect to peers
+	// that do not run Rosenpass (falling back to the plain WireGuard PSK).
+	RosenpassPermissive bool
 	// BlockLANAccess blocks the embedded peer from reaching the host's
 	// LAN (RFC 1918, link-local, loopback) when it's used as a routing
 	// peer. Mirrors profilemanager.ConfigInput.BlockLANAccess. Useful
@@ -203,6 +208,8 @@ func New(opts Options) (*Client, error) {
 		DisableIPv6:         &opts.DisableIPv6,
 		BlockInbound:        &opts.BlockInbound,
 		BlockLANAccess:      &opts.BlockLANAccess,
+		RosenpassEnabled:    &opts.EnableRosenpass,
+		RosenpassPermissive: &opts.RosenpassPermissive,
 		WireguardPort:       opts.WireguardPort,
 		MTU:                 opts.MTU,
 		DNSLabels:           parsedLabels,

client/firewall/firewalld/firewalld.go

@@ -2,8 +2,8 @@
 // its wg interface into firewalld's "trusted" zone. This is required because
 // firewalld's nftables chains are created with NFT_CHAIN_OWNER on recent
 // versions, which returns EPERM to any other process that tries to insert
-// rules into them. Trusting the interface makes firewalld itself add the
-// accept rules to its own chains instead.
+// rules into them. The workaround mirrors what Tailscale does: let firewalld
+// itself add the accept rules to its own chains by trusting the interface.
 package firewalld
 
 // TrustedZone is the firewalld zone name used for interfaces whose traffic

client/iface/bind/ice_bind.go

@@ -22,16 +22,6 @@ import (
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
-const (
-	// wgMsgTypeHandshakeInitiation is the lowest WireGuard message type.
-	wgMsgTypeHandshakeInitiation uint32 = 1
-	// wgMsgTypeTransport is the highest WireGuard message type.
-	wgMsgTypeTransport uint32 = 4
-	// wgMinMsgSize is the smallest WireGuard message: transport data with an empty
-	// payload, which is what a keepalive is.
-	wgMinMsgSize = 32
-)
-
 type receiverCreator struct {
 	iceBind *ICEBind
 }
@@ -226,15 +216,8 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 		for i := 0; i < numMsgs; i++ {
 			msg := &(*msgs)[i]
 
-			if ok, err := s.filterOutStunMessages(msg.Buffers, msg.N, msg.Addr); ok {
-				if err != nil {
-					log.Debugf("failed to handle STUN packet from %s: %v", msg.Addr, err)
-				}
-				// WireGuard reuses sizes and eps across reads and only skips a slot
-				// whose size is below the minimum message size. Leaving a consumed
-				// slot untouched makes it process this buffer again under the
-				// previous packet's length and endpoint.
-				sizes[i] = 0
+			// todo: handle err
+			if ok, _ := s.filterOutStunMessages(msg.Buffers, msg.N, msg.Addr); ok {
 				continue
 			}
 			sizes[i] = msg.N
@@ -288,16 +271,11 @@ func (s *ICEBind) createOrUpdateMux() {
 
 func (s *ICEBind) filterOutStunMessages(buffers [][]byte, n int, addr net.Addr) (bool, error) {
 	for i := range buffers {
-		if n > len(buffers[i]) {
-			continue
-		}
-		pkt := buffers[i][:n]
-
-		if isWireGuardMsg(pkt) || !stun.IsMessage(pkt) {
+		if !stun.IsMessage(buffers[i]) {
 			continue
 		}
 
-		msg, err := s.parseSTUNMessage(pkt)
+		msg, err := s.parseSTUNMessage(buffers[i][:n])
 		if err != nil {
 			buffers[i] = []byte{}
 			return true, err
@@ -369,34 +347,18 @@ func putMessages(msgs *[]ipv6.Message, msgsPool *sync.Pool) {
 	msgsPool.Put(msgs)
 }
 
-// isWireGuardMsg reports whether the packet carries a WireGuard message header: a
-// little-endian uint32 message type in the range 1..4, which leaves the three bytes
-// after the type byte zero, in a packet long enough to hold any WireGuard message.
-//
-// A well formed STUN message cannot take that shape. Its length field sits in the two
-// bytes the type must leave zero, and for a message of at least wgMinMsgSize bytes that
-// field holds at least 12, so the two framings do not overlap. The test has to be this
-// tight because stun.IsMessage only looks at the magic cookie, which in a WireGuard
-// message overlaps the receiver index: a session whose index happens to equal the cookie
-// would otherwise have all of its inbound data misrouted to the STUN handler until the
-// next rekey.
-func isWireGuardMsg(pkt []byte) bool {
-	if len(pkt) < wgMinMsgSize {
-		return false
-	}
-
-	msgType := binary.LittleEndian.Uint32(pkt[:4])
-	return msgType >= wgMsgTypeHandshakeInitiation && msgType <= wgMsgTypeTransport
-}
-
-// isTransportPkg reports whether the packet is WireGuard transport data carrying a
-// payload, which is what counts as peer activity. A keepalive holds no payload and is
-// exactly wgMinMsgSize bytes.
 func isTransportPkg(buffers [][]byte, n int) bool {
-	if n < 4 || n > len(buffers[0]) {
-		return false
+	// The first buffer should contain at least 4 bytes for type
+	if len(buffers[0]) < 4 {
+		return true
 	}
 
-	msgType := binary.LittleEndian.Uint32(buffers[0][:4])
-	return msgType == wgMsgTypeTransport && n > wgMinMsgSize
+	// WireGuard packet type is a little-endian uint32 at start
+	packetType := binary.LittleEndian.Uint32(buffers[0][:4])
+
+	// Check if packetType matches known WireGuard message types
+	if packetType == 4 && n > 32 {
+		return true
+	}
+	return false
 }

client/iface/bind/stun_filter_test.go

@@ -1,215 +0,0 @@
-//go:build !js
-
-package bind
-
-import (
-	"encoding/binary"
-	"net"
-	"testing"
-	"time"
-
-	"github.com/pion/stun/v3"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/net/ipv4"
-	wgConn "golang.zx2c4.com/wireguard/conn"
-)
-
-// magicCookieBytes is the STUN magic cookie as it appears on the wire. In a
-// WireGuard message the same offset holds the receiver (or sender) index, which is
-// a random uint32, so a session can draw exactly this value.
-var magicCookieBytes = []byte{0x21, 0x12, 0xA4, 0x42}
-
-const testBufSize = 1500
-
-// wgMsg builds a WireGuard message of the given type and size, with the index field
-// at bytes 4:8 set to index.
-func wgMsg(msgType uint32, size int, index []byte) []byte {
-	pkt := make([]byte, size)
-	binary.LittleEndian.PutUint32(pkt[:4], msgType)
-	copy(pkt[4:8], index)
-	return pkt
-}
-
-// intoBuffer copies pkt into a full-size receive buffer, the way the kernel read
-// does, so tests see the same buffer/length split as the hot path.
-func intoBuffer(pkt []byte) [][]byte {
-	buf := make([]byte, testBufSize)
-	copy(buf, pkt)
-	return [][]byte{buf}
-}
-
-func TestFilterOutStunMessages_PassesWireGuardWithCookieShapedIndex(t *testing.T) {
-	tests := []struct {
-		name    string
-		msgType uint32
-		size    int
-	}{
-		{"transport data", wgMsgTypeTransport, 128},
-		{"keepalive", wgMsgTypeTransport, wgMinMsgSize},
-		{"handshake initiation", wgMsgTypeHandshakeInitiation, 148},
-		{"handshake response", 2, 92},
-		{"cookie reply", 3, 64},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			pkt := wgMsg(tc.msgType, tc.size, magicCookieBytes)
-			require.True(t, stun.IsMessage(pkt), "precondition: pion sees this as STUN")
-
-			buffers := intoBuffer(pkt)
-			bind := &ICEBind{}
-
-			filtered, err := bind.filterOutStunMessages(buffers, tc.size, &net.UDPAddr{})
-			assert.NoError(t, err)
-			assert.False(t, filtered, "WireGuard message must be handed to WireGuard, not the STUN handler")
-			assert.Len(t, buffers[0], testBufSize, "buffer must be left intact for WireGuard")
-		})
-	}
-}
-
-func TestFilterOutStunMessages_FiltersRealSTUNMessage(t *testing.T) {
-	msg, err := stun.Build(stun.BindingRequest, stun.TransactionID, stun.Fingerprint)
-	require.NoError(t, err)
-
-	buffers := intoBuffer(msg.Raw)
-	bind := &ICEBind{}
-
-	filtered, err := bind.filterOutStunMessages(buffers, len(msg.Raw), &net.UDPAddr{})
-	assert.NoError(t, err)
-	assert.True(t, filtered, "STUN message must be consumed by the STUN handler")
-	assert.Empty(t, buffers[0], "consumed buffer must be emptied so WireGuard does not see it")
-}
-
-// TestIsWireGuardMsg_DisjointFromSTUN locks the invariant the filter relies on: a
-// well formed STUN message long enough to be a WireGuard message always has a
-// non-zero length field, so it cannot be mistaken for a WireGuard header.
-func TestIsWireGuardMsg_DisjointFromSTUN(t *testing.T) {
-	types := []stun.MessageType{
-		stun.BindingRequest,
-		stun.BindingSuccess,
-		stun.BindingError,
-		{Method: stun.MethodBinding, Class: stun.ClassIndication},
-	}
-
-	for _, msgType := range types {
-		// Long enough that the length guard is not what makes this pass.
-		msg, err := stun.Build(msgType, stun.TransactionID,
-			stun.NewUsername("remoteUfrag:localUfrag"), stun.Fingerprint)
-		require.NoError(t, err)
-		require.GreaterOrEqual(t, len(msg.Raw), wgMinMsgSize, "precondition: %s", msgType)
-		assert.False(t, isWireGuardMsg(msg.Raw),
-			"%s must not look like a WireGuard message", msgType)
-	}
-}
-
-func TestIsWireGuardMsg(t *testing.T) {
-	tests := []struct {
-		name string
-		pkt  []byte
-		want bool
-	}{
-		{"transport data", wgMsg(wgMsgTypeTransport, 128, nil), true},
-		{"handshake initiation", wgMsg(wgMsgTypeHandshakeInitiation, 148, nil), true},
-		{"unknown type 5", wgMsg(5, 128, nil), false},
-		{"type 0", wgMsg(0, 128, nil), false},
-		{"non-zero reserved byte", []byte{0x04, 0x00, 0x01, 0x00}, false},
-		{"too short", []byte{0x04, 0x00, 0x00}, false},
-		{"empty", nil, false},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.want, isWireGuardMsg(tc.pkt), "wrong classification for %s", tc.name)
-		})
-	}
-}
-
-// TestFilterOutStunMessages_IgnoresBytesBeyondPacket guards against classifying on
-// buffer contents left over from an earlier, longer packet.
-func TestFilterOutStunMessages_IgnoresBytesBeyondPacket(t *testing.T) {
-	buf := make([]byte, testBufSize)
-	copy(buf[4:8], magicCookieBytes)
-	buffers := [][]byte{buf}
-	bind := &ICEBind{}
-
-	filtered, err := bind.filterOutStunMessages(buffers, 2, &net.UDPAddr{})
-	assert.NoError(t, err)
-	assert.False(t, filtered, "a 2 byte packet must not be classified from stale buffer bytes")
-}
-
-// TestReceiveFn_ClearsSizeOfConsumedPacket covers the accounting WireGuard relies
-// on: sizes is reused across reads, so a slot whose packet was consumed as STUN must
-// be reported as empty. Otherwise WireGuard reprocesses the same buffer under the
-// previous packet's length, which for a WireGuard-shaped packet means it is handled
-// twice.
-func TestReceiveFn_ClearsSizeOfConsumedPacket(t *testing.T) {
-	conn := listenUDP(t, "udp4", "127.0.0.1:0")
-	defer conn.Close()
-
-	recvFn := receiverCreator{setupICEBind(t)}.CreateReceiverFn(
-		ipv4.NewPacketConn(conn), conn, false, createMsgPool(),
-	)
-
-	msg, err := stun.Build(stun.BindingRequest, stun.TransactionID, stun.Fingerprint)
-	require.NoError(t, err)
-
-	sender := listenUDP(t, "udp4", "127.0.0.1:0")
-	defer sender.Close()
-	_, err = sender.WriteTo(msg.Raw, conn.LocalAddr())
-	require.NoError(t, err)
-
-	require.NoError(t, conn.SetReadDeadline(time.Now().Add(3*time.Second)))
-
-	bufs := [][]byte{make([]byte, 1500)}
-	// A leftover size from an earlier read, which is what makes the missing reset
-	// observable.
-	sizes := []int{148}
-	eps := make([]wgConn.Endpoint, 1)
-
-	n, err := recvFn(bufs, sizes, eps)
-	require.NoError(t, err)
-	require.Equal(t, 1, n)
-	assert.Zero(t, sizes[0], "consumed STUN packet must not leave a size behind for WireGuard")
-}
-
-func TestIsTransportPkg(t *testing.T) {
-	tests := []struct {
-		name string
-		pkt  []byte
-		n    int
-		want bool
-	}{
-		{"transport data with payload", wgMsg(wgMsgTypeTransport, 128, nil), 128, true},
-		{"keepalive", wgMsg(wgMsgTypeTransport, wgMinMsgSize, nil), wgMinMsgSize, false},
-		{"handshake initiation", wgMsg(wgMsgTypeHandshakeInitiation, 148, nil), 148, false},
-		{"stale type bytes beyond packet", wgMsg(wgMsgTypeTransport, 128, nil), 2, false},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.want, isTransportPkg(intoBuffer(tc.pkt), tc.n),
-				"wrong activity classification for %s", tc.name)
-		})
-	}
-}
-
-// TestFilterOutStunMessages_ConsumesSTUNWithWireGuardShapedType covers the one STUN
-// encoding whose leading bytes collide with a WireGuard message type: method 0x080 as a
-// request encodes to 0x0200, so the type byte reads as a handshake response and the byte
-// after it is zero. Only the length check keeps such a message out of WireGuard's hands.
-// pion implements no method in that range, so this is a synthetic worst case rather than
-// traffic ICE produces.
-func TestFilterOutStunMessages_ConsumesSTUNWithWireGuardShapedType(t *testing.T) {
-	msg, err := stun.Build(stun.NewType(stun.Method(0x080), stun.ClassRequest), stun.TransactionID)
-	require.NoError(t, err)
-	require.Equal(t, []byte{0x02, 0x00, 0x00, 0x00}, msg.Raw[:4],
-		"precondition: the leading bytes read as a WireGuard message type")
-
-	buffers := intoBuffer(msg.Raw)
-	bind := &ICEBind{}
-
-	filtered, err := bind.filterOutStunMessages(buffers, len(msg.Raw), &net.UDPAddr{})
-	assert.NoError(t, err)
-	assert.True(t, filtered, "STUN message must be consumed despite its WireGuard-shaped type")
-}

client/internal/conn_mgr.go

@@ -2,6 +2,7 @@ package internal
 
 import (
 	"context"
+	"maps"
 	"os"
 	"strconv"
 	"sync"
@@ -14,6 +15,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/route"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 )
 
 // lazyForce is the resolved local decision for lazy connections, layered above the
@@ -37,11 +39,13 @@ const (
 // The only exception is ActivatePeer, which is safe for concurrent use so the
 // DNS warm-up path can call it without contending on the engine mutex.
 type ConnMgr struct {
-	peerStore        *peerstore.Store
-	statusRecorder   *peer.Status
-	iface            lazyconn.WGIface
-	force            lazyForce
-	rosenpassEnabled bool
+	peerStore      *peerstore.Store
+	statusRecorder *peer.Status
+	iface          lazyconn.WGIface
+	force          lazyForce
+	// remoteLazyEnabled caches the account-wide lazy feature flag from management.
+	// It is the default for peers that do not carry a per-peer lazy hint.
+	remoteLazyEnabled bool
 
 	lazyConnMgr *manager.Manager
 	// lazyConnMgrMu guards the lazyConnMgr pointer for readers outside the
@@ -53,6 +57,10 @@ type ConnMgr struct {
 	// (re)armed (Mode A at arm time). Injected by the engine; nil disables the reconcile.
 	reconcileRoutedIPs func(peerKey string) error
 
+	// appliedExcludeList is the exclude set last handed to the lazy manager, kept so an
+	// unchanged set on the next sync skips the O(n) reconciliation.
+	appliedExcludeList map[string]bool
+
 	wg            sync.WaitGroup
 	lazyCtx       context.Context
 	lazyCtxCancel context.CancelFunc
@@ -66,78 +74,59 @@ func (e *ConnMgr) SetRoutedIPsReconciler(fn func(peerKey string) error) {
 
 func NewConnMgr(engineConfig *EngineConfig, statusRecorder *peer.Status, peerStore *peerstore.Store, iface lazyconn.WGIface) *ConnMgr {
 	e := &ConnMgr{
-		peerStore:        peerStore,
-		statusRecorder:   statusRecorder,
-		iface:            iface,
-		force:            resolveLazyForce(engineConfig.LazyConnection),
-		rosenpassEnabled: engineConfig.RosenpassEnabled,
+		peerStore:      peerStore,
+		statusRecorder: statusRecorder,
+		iface:          iface,
+		force:          resolveLazyForce(engineConfig.LazyConnection),
 	}
 	return e
 }
 
-// Start initializes the connection manager. It starts the lazy connection manager when a
-// local override forces it on; with no local override it waits for the management feature flag.
+// Start initializes the connection manager. The lazy connection manager always runs so that
+// per-peer lazy defaults (e.g. proxy peers) work even when the account flag is off; the
+// account flag and the local override decide the default lazy state per peer (see
+// PeerLazyDefault). Rosenpass peers stay lazy-capable too: their connections just never idle
+// on their own, since rosenpass rekey traffic keeps them active.
 func (e *ConnMgr) Start(ctx context.Context) {
 	if e.lazyConnMgr != nil {
 		log.Errorf("lazy connection manager is already started")
 		return
 	}
 
-	switch e.force {
-	case lazyForceOff:
-		log.Infof("lazy connection manager is disabled by local override (%s or MDM policy)", lazyconn.EnvLazyConn)
-		e.statusRecorder.UpdateLazyConnection(false)
-		return
-	case lazyForceNone:
-		log.Infof("lazy connection manager is managed by the management feature flag")
-		e.statusRecorder.UpdateLazyConnection(false)
-		return
-	}
-
-	if e.rosenpassEnabled {
-		log.Warnf("rosenpass connection manager is enabled, lazy connection manager will not be started")
-		e.statusRecorder.UpdateLazyConnection(false)
-		return
-	}
-
 	e.initLazyManager(ctx)
-	e.statusRecorder.UpdateLazyConnection(true)
+	e.statusRecorder.UpdateLazyConnection(e.PeerLazyDefault(mgmProto.LazyState_LazyStateDefault))
 }
 
-// UpdatedRemoteFeatureFlag is called when the remote feature flag is updated.
-// If enabled, it initializes the lazy connection manager and start it. Do not need to call Start() again.
-// If disabled, then it closes the lazy connection manager and open the connections to all peers.
-func (e *ConnMgr) UpdatedRemoteFeatureFlag(ctx context.Context, enabled bool) error {
-	// a local override (NB_LAZY_CONN or local config) takes precedence over management
-	if e.force != lazyForceNone {
-		return nil
+// UpdatedRemoteFeatureFlag caches the account-wide lazy feature flag. The manager itself is
+// not started or stopped here; the per-sync exclude-list reconciliation moves normal peers
+// between the lazy and always-active sets when the flag flips.
+func (e *ConnMgr) UpdatedRemoteFeatureFlag(_ context.Context, enabled bool) error {
+	e.remoteLazyEnabled = enabled
+	if e.isStartedWithLazyMgr() {
+		e.statusRecorder.UpdateLazyConnection(e.PeerLazyDefault(mgmProto.LazyState_LazyStateDefault))
+	}
+	return nil
+}
+
+// PeerLazyDefault reports whether a peer should be lazy. The local override
+// (NB_LAZY_CONN/MDM) wins over everything; without a local override the
+// management per-peer state applies (LazyStateLazy/Eager force the decision),
+// and LazyStateDefault follows the account-wide flag.
+func (e *ConnMgr) PeerLazyDefault(state mgmProto.LazyState) bool {
+	switch e.force {
+	case lazyForceOn:
+		return true
+	case lazyForceOff:
+		return false
 	}
 
-	if enabled {
-		// if the lazy connection manager is already started, do not start it again
-		if e.lazyConnMgr != nil {
-			return nil
-		}
-
-		if e.rosenpassEnabled {
-			log.Infof("rosenpass connection manager is enabled, lazy connection manager will not be started")
-			e.statusRecorder.UpdateLazyConnection(false)
-			return nil
-		}
-
-		log.Infof("lazy connection manager is enabled by the management feature flag")
-		e.initLazyManager(ctx)
-		e.statusRecorder.UpdateLazyConnection(true)
-		return e.addPeersToLazyConnManager()
-	} else {
-		if e.lazyConnMgr == nil {
-			e.statusRecorder.UpdateLazyConnection(false)
-			return nil
-		}
-		log.Infof("lazy connection manager is disabled by management feature flag")
-		e.closeManager(ctx)
-		e.statusRecorder.UpdateLazyConnection(false)
-		return nil
+	switch state {
+	case mgmProto.LazyState_LazyStateLazy:
+		return true
+	case mgmProto.LazyState_LazyStateEager:
+		return false
+	default:
+		return e.remoteLazyEnabled
 	}
 }
 
@@ -157,6 +146,13 @@ func (e *ConnMgr) SetExcludeList(ctx context.Context, peerIDs map[string]bool) {
 		return
 	}
 
+	// The exclude set is recomputed every sync but rarely changes; skip the O(n)
+	// store lookups and reconciliation when it matches what was already applied.
+	if maps.Equal(peerIDs, e.appliedExcludeList) {
+		return
+	}
+	e.appliedExcludeList = maps.Clone(peerIDs)
+
 	excludedPeers := make([]lazyconn.PeerConfig, 0, len(peerIDs))
 
 	for peerID := range peerIDs {
@@ -192,12 +188,16 @@ func (e *ConnMgr) SetExcludeList(ctx context.Context, peerIDs map[string]bool) {
 	}
 }
 
-func (e *ConnMgr) AddPeerConn(ctx context.Context, peerKey string, conn *peer.Conn) (exists bool) {
+// AddPeerConn registers a peer connection. permanent requests an always-active connection
+// (the peer belongs to the exclude set: a forwarder, or a peer that is not lazy by policy).
+// Non-permanent peers are handed to the lazy manager. The subsequent SetExcludeList call
+// reconciles membership for existing peers across flag flips.
+func (e *ConnMgr) AddPeerConn(ctx context.Context, peerKey string, conn *peer.Conn, permanent bool) (exists bool) {
 	if success := e.peerStore.AddPeerConn(peerKey, conn); !success {
 		return true
 	}
 
-	if !e.isStartedWithLazyMgr() {
+	if !e.isStartedWithLazyMgr() || permanent {
 		if err := conn.Open(ctx); err != nil {
 			conn.Log.Errorf("failed to open connection: %v", err)
 		}
@@ -296,6 +296,8 @@ func (e *ConnMgr) Close() {
 	e.lazyConnMgrMu.Lock()
 	e.lazyConnMgr = nil
 	e.lazyConnMgrMu.Unlock()
+
+	e.appliedExcludeList = nil
 }
 
 func (e *ConnMgr) initLazyManager(engineCtx context.Context) {
@@ -309,6 +311,8 @@ func (e *ConnMgr) initLazyManager(engineCtx context.Context) {
 	e.lazyCtx, e.lazyCtxCancel = context.WithCancel(engineCtx)
 	e.lazyConnMgrMu.Unlock()
 
+	e.appliedExcludeList = nil
+
 	e.wg.Add(1)
 	go func() {
 		defer e.wg.Done()
@@ -316,46 +320,6 @@ func (e *ConnMgr) initLazyManager(engineCtx context.Context) {
 	}()
 }
 
-func (e *ConnMgr) addPeersToLazyConnManager() error {
-	peers := e.peerStore.PeersPubKey()
-	lazyPeerCfgs := make([]lazyconn.PeerConfig, 0, len(peers))
-	for _, peerID := range peers {
-		var peerConn *peer.Conn
-		var exists bool
-		if peerConn, exists = e.peerStore.PeerConn(peerID); !exists {
-			log.Warnf("failed to find peer conn for peerID: %s", peerID)
-			continue
-		}
-
-		lazyPeerCfg := lazyconn.PeerConfig{
-			PublicKey:  peerID,
-			AllowedIPs: peerConn.WgConfig().AllowedIps,
-			PeerConnID: peerConn.ConnID(),
-			Log:        peerConn.Log,
-		}
-		lazyPeerCfgs = append(lazyPeerCfgs, lazyPeerCfg)
-	}
-
-	return e.lazyConnMgr.AddActivePeers(lazyPeerCfgs)
-}
-
-func (e *ConnMgr) closeManager(ctx context.Context) {
-	if e.lazyConnMgr == nil {
-		return
-	}
-
-	e.lazyCtxCancel()
-	e.wg.Wait()
-
-	e.lazyConnMgrMu.Lock()
-	e.lazyConnMgr = nil
-	e.lazyConnMgrMu.Unlock()
-
-	for _, peerID := range e.peerStore.PeersPubKey() {
-		e.peerStore.PeerConnOpen(ctx, peerID)
-	}
-}
-
 func (e *ConnMgr) isStartedWithLazyMgr() bool {
 	return e.lazyConnMgr != nil && e.lazyCtxCancel != nil
 }

client/internal/conn_mgr_test.go

@@ -16,6 +16,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/monotime"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
 )
 
 func TestResolveLazyForce(t *testing.T) {
@@ -138,4 +139,91 @@ func TestInactivityThresholdEnv(t *testing.T) {
 	}
 }
 
+func TestPeerLazyDefault(t *testing.T) {
+	tests := []struct {
+		name          string
+		force         lazyForce
+		remoteEnabled bool
+		state         mgmProto.LazyState
+		want          bool
+	}{
+		{name: "force on wins over eager state", force: lazyForceOn, state: mgmProto.LazyState_LazyStateEager, want: true},
+		{name: "force off wins over lazy state", force: lazyForceOff, remoteEnabled: true, state: mgmProto.LazyState_LazyStateLazy, want: false},
+		{name: "none, default, account off -> active", force: lazyForceNone, state: mgmProto.LazyState_LazyStateDefault, want: false},
+		{name: "none, default, account on -> lazy", force: lazyForceNone, remoteEnabled: true, state: mgmProto.LazyState_LazyStateDefault, want: true},
+		{name: "none, lazy state, account off -> lazy", force: lazyForceNone, state: mgmProto.LazyState_LazyStateLazy, want: true},
+		{name: "none, eager state, account on -> active", force: lazyForceNone, remoteEnabled: true, state: mgmProto.LazyState_LazyStateEager, want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			e := &ConnMgr{force: tt.force, remoteLazyEnabled: tt.remoteEnabled}
+			if got := e.PeerLazyDefault(tt.state); got != tt.want {
+				t.Fatalf("PeerLazyDefault(%v) = %v, want %v", tt.state, got, tt.want)
+			}
+		})
+	}
+}
+
 func durPtr(d time.Duration) *time.Duration { return &d }
+
+// TestToExcludedLazyPeers covers the per-peer lazy classification (proxy vs
+// normal, across the force/account-flag matrix). Forwarder-target exclusion is
+// covered by TestToExcludedLazyPeers_ForwardTarget.
+func TestToExcludedLazyPeers(t *testing.T) {
+	const (
+		normalKey = "normal"
+		lazyKey   = "lazy-state"
+		eagerKey  = "eager-state"
+	)
+
+	peers := []*mgmProto.RemotePeerConfig{
+		{WgPubKey: normalKey, AllowedIps: []string{"100.64.0.1/32"}},
+		{WgPubKey: lazyKey, AllowedIps: []string{"100.64.0.2/32"}, LazyState: mgmProto.LazyState_LazyStateLazy},
+		{WgPubKey: eagerKey, AllowedIps: []string{"100.64.0.3/32"}, LazyState: mgmProto.LazyState_LazyStateEager},
+	}
+
+	tests := []struct {
+		name          string
+		force         lazyForce
+		remoteEnabled bool
+		want          map[string]bool
+	}{
+		{
+			name:  "account off: lazy-state peer lazy, normal + eager active",
+			force: lazyForceNone, remoteEnabled: false,
+			want: map[string]bool{normalKey: true, eagerKey: true},
+		},
+		{
+			name:  "account on: only eager-state peer active",
+			force: lazyForceNone, remoteEnabled: true,
+			want: map[string]bool{eagerKey: true},
+		},
+		{
+			name:  "force off: everything active",
+			force: lazyForceOff, remoteEnabled: true,
+			want: map[string]bool{normalKey: true, lazyKey: true, eagerKey: true},
+		},
+		{
+			name:  "force on: nothing active",
+			force: lazyForceOn, remoteEnabled: false,
+			want: map[string]bool{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			e := &Engine{connMgr: &ConnMgr{force: tt.force, remoteLazyEnabled: tt.remoteEnabled}}
+			got := e.toExcludedLazyPeers(peers)
+
+			if len(got) != len(tt.want) {
+				t.Fatalf("toExcludedLazyPeers() = %v, want %v", got, tt.want)
+			}
+			for k := range tt.want {
+				if !got[k] {
+					t.Fatalf("expected peer %s excluded, got %v", k, got)
+				}
+			}
+		})
+	}
+}

client/internal/connect.go

@@ -113,14 +113,11 @@ func (c *ConnectClient) RunOnAndroid(
 	stateFilePath string,
 	cacheDir string,
 ) error {
-	notifier := tunnelnotifier.New(networkChangeListener, nil)
-	defer notifier.Close()
-
 	// in case of non Android os these variables will be nil
 	mobileDependency := MobileDependency{
 		TunAdapter:            tunAdapter,
 		IFaceDiscover:         iFaceDiscover,
-		NetworkChangeListener: notifier,
+		NetworkChangeListener: networkChangeListener,
 		HostDNSAddresses:      dnsAddresses,
 		DnsReadyListener:      dnsReadyListener,
 		StateFilePath:         stateFilePath,

client/internal/debug/debug.go

@@ -34,8 +34,9 @@ import (
 	"github.com/netbirdio/netbird/shared/netiputil"
 )
 
-const readmeContent = `This debug bundle contains the following files.
-If anonymization is enabled (--anonymize / --anonymize-level), the files are anonymized to protect sensitive information.
+const readmeContent = `Netbird debug bundle
+This debug bundle contains the following files.
+If the --anonymize flag is set, the files are anonymized to protect sensitive information.
 
 status.txt: Anonymized status information of the NetBird client.
 client.log: Most recent, anonymized client log file of the NetBird client.
@@ -69,34 +70,21 @@ capture.pcap: Packet capture in pcap format. Only present when capture was runni
 
 
 Anonymization Process
-The files in this bundle have been anonymized to protect sensitive information. The level applied to this bundle is recorded at the top of this file. Here's how the anonymization was applied:
+The files in this bundle have been anonymized to protect sensitive information. Here's how the anonymization was applied:
 
 IP Addresses
 
-Default level:
-- Public IPv4 addresses are replaced with addresses starting from 198.51.100.0
-- Public IPv6 addresses are replaced with addresses starting from 2001:db8:ffff::
-- IPv6 unique local addresses (fc00::/7) are anonymized as well: their random global ID uniquely identifies the network.
-- IP addresses from internal IPv4 ranges and well-known addresses are not anonymized (e.g. 8.8.8.8, 100.64.0.0/10, addresses starting with 192.168., 172.16., 10., 169.254., fe80::).
-
-Strict level (--anonymize-level strict), in addition to the default level:
-- Private (RFC 1918), CGNAT (100.64.0.0/10), and link-local (169.254.0.0/16, fe80::/10) addresses are anonymized too.
-- Internal IPv4 addresses are replaced with addresses starting from 198.18.0.0 and internal IPv6 addresses with addresses starting from 2001:db8:1::, so internal addresses remain distinguishable from public ones.
-- Addresses are mapped in order of first appearance: subnet structure, allocation scheme, and gateway conventions are not preserved. Prefix lengths of networks are preserved.
-- Peer names in front of NetBird domains are replaced with numbered placeholders (e.g. peer-1.netbird.cloud), and subdomain labels of other domains with host-N placeholders.
-- WireGuard public keys are replaced with consistent placeholder keys.
+IPv4 addresses are replaced with addresses starting from 198.51.100.0
+IPv6 addresses are replaced with addresses starting from 100::
 
+IP addresses from non public ranges and well known addresses are not anonymized (e.g. 8.8.8.8, 100.64.0.0/10, addresses starting with 192.168., 172.16., 10., etc.).
 Reoccuring IP addresses are replaced with the same anonymized address.
 
 Note: The anonymized IP addresses in the status file do not match those in the log and routes files. However, the anonymized IP addresses are consistent within the status file and across the routes and log files.
 
-MAC Addresses
-MAC addresses are replaced at every anonymization level with consistent placeholders counting up from 02:00:00:00:00:01. Broadcast, multicast, and all-zero addresses are kept. At the default level a preserved IPv6 link-local address may still embed a MAC address (EUI-64); the strict level anonymizes those addresses.
-
 Domains
 All domain names (except for the netbird domains) are replaced with randomly generated strings ending in ".domain". Anonymized domains are consistent across all files in the bundle.
 Reoccuring domain names are replaced with the same anonymized domain.
-At the strict level, the peer name labels in front of netbird domains are anonymized as well.
 
 Sync Response
 The network_map.json file contains the following anonymized information:
@@ -293,7 +281,6 @@ type BundleGenerator struct {
 	cliVersion     string
 
 	anonymize         bool
-	anonymizeLevel    anonymize.Level
 	includeSystemInfo bool
 	logFileCount      uint32
 
@@ -301,10 +288,7 @@ type BundleGenerator struct {
 }
 
 type BundleConfig struct {
-	Anonymize bool
-	// AnonymizeLevel selects how much the anonymizer redacts.
-	// anonymize.LevelStrict implies Anonymize.
-	AnonymizeLevel    anonymize.Level
+	Anonymize         bool
 	IncludeSystemInfo bool
 	LogFileCount      uint32
 }
@@ -343,11 +327,8 @@ func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGen
 		uiLogOpener = openLogFile
 	}
 
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(cfg.AnonymizeLevel)
-
 	return &BundleGenerator{
-		anonymizer: anonymizer,
+		anonymizer: anonymize.NewAnonymizer(anonymize.DefaultAddresses()),
 
 		internalConfig: deps.InternalConfig,
 		statusRecorder: deps.StatusRecorder,
@@ -364,8 +345,7 @@ func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGen
 		daemonVersion:  deps.DaemonVersion,
 		cliVersion:     deps.CliVersion,
 
-		anonymize:         cfg.Anonymize || cfg.AnonymizeLevel >= anonymize.LevelStrict,
-		anonymizeLevel:    cfg.AnonymizeLevel,
+		anonymize:         cfg.Anonymize,
 		includeSystemInfo: cfg.IncludeSystemInfo,
 		logFileCount:      logFileCount,
 	}
@@ -505,13 +485,7 @@ func (g *BundleGenerator) addSystemInfo() {
 }
 
 func (g *BundleGenerator) addReadme() error {
-	level := "none (anonymization disabled)"
-	if g.anonymize {
-		level = g.anonymizeLevel.String()
-	}
-	header := fmt.Sprintf("Netbird debug bundle\nAnonymization level applied to this bundle: %s\n", level)
-
-	readmeReader := strings.NewReader(header + readmeContent)
+	readmeReader := strings.NewReader(readmeContent)
 	if err := g.addFileToZip(readmeReader, "README.txt"); err != nil {
 		return fmt.Errorf("add README file to zip: %w", err)
 	}
@@ -533,10 +507,9 @@ func (g *BundleGenerator) addStatus() error {
 		fullStatus := g.statusRecorder.GetFullStatus()
 		protoFullStatus := nbstatus.ToProtoFullStatus(fullStatus)
 		overview := nbstatus.ConvertToStatusOutputOverview(protoFullStatus, nbstatus.ConvertOptions{
-			Anonymize:      g.anonymize,
-			AnonymizeLevel: g.anonymizeLevel,
-			ProfileName:    profName,
-			DaemonVersion:  g.daemonVersion,
+			Anonymize:     g.anonymize,
+			ProfileName:   profName,
+			DaemonVersion: g.daemonVersion,
 		})
 		overview.CliVersion = g.cliVersion
 		statusOutput := overview.FullDetailSummary()
@@ -689,7 +662,7 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 	configContent.WriteString("NetBird Client Configuration:\n\n")
 
 	if key, err := wgtypes.ParseKey(g.internalConfig.PrivateKey); err == nil {
-		configContent.WriteString(fmt.Sprintf("PublicKey: %s\n", g.anonymizer.AnonymizeWGKey(key.PublicKey().String())))
+		configContent.WriteString(fmt.Sprintf("PublicKey: %s\n", key.PublicKey().String()))
 	}
 	configContent.WriteString(fmt.Sprintf("WgIface: %s\n", g.internalConfig.WgIface))
 	configContent.WriteString(fmt.Sprintf("WgPort: %d\n", g.internalConfig.WgPort))
@@ -979,11 +952,6 @@ func (g *BundleGenerator) addUpdateLogs() error {
 		}
 
 		baseName := filepath.Base(logFile)
-		data, err = g.anonymizeBytes(data)
-		if err != nil {
-			log.Warnf("skipping update log file %s: %v", baseName, err)
-			continue
-		}
 		if err := g.addFileToZip(bytes.NewReader(data), filepath.Join("update-logs", baseName)); err != nil {
 			return fmt.Errorf("add update log file %s to zip: %w", baseName, err)
 		}
@@ -1011,13 +979,6 @@ func (g *BundleGenerator) addCorruptedStateFiles() error {
 		}
 
 		fileName := filepath.Base(match)
-		// Corrupted state files usually fail structured JSON anonymization,
-		// so run them through the string anonymizer instead.
-		data, err = g.anonymizeBytes(data)
-		if err != nil {
-			log.Warnf("skipping corrupted state file %s: %v", fileName, err)
-			continue
-		}
 		if err := g.addFileToZip(bytes.NewReader(data), "corrupted_states/"+fileName); err != nil {
 			log.Warnf("Failed to add corrupted state file %s to zip: %v", fileName, err)
 			continue
@@ -1029,27 +990,6 @@ func (g *BundleGenerator) addCorruptedStateFiles() error {
 	return nil
 }
 
-// anonymizeBytes runs raw file content through the string anonymizer line by
-// line when anonymization is enabled. It errors instead of returning partial
-// content, so a caller never adds an unanonymized fallback to the bundle.
-func (g *BundleGenerator) anonymizeBytes(data []byte) ([]byte, error) {
-	if !g.anonymize {
-		return data, nil
-	}
-
-	var buf bytes.Buffer
-	scanner := bufio.NewScanner(bytes.NewReader(data))
-	scanner.Buffer(make([]byte, 1024*1024), 1024*1024)
-	for scanner.Scan() {
-		buf.WriteString(g.anonymizer.AnonymizeString(scanner.Text()))
-		buf.WriteByte('\n')
-	}
-	if err := scanner.Err(); err != nil {
-		return nil, fmt.Errorf("anonymize content: %w", err)
-	}
-	return buf.Bytes(), nil
-}
-
 func (g *BundleGenerator) addMetrics() error {
 	if g.clientMetrics == nil {
 		log.Debugf("skipping metrics in debug bundle: no metrics collector")
@@ -1522,7 +1462,6 @@ func anonymizeRemotePeer(peer *mgmProto.RemotePeerConfig, anonymizer *anonymize.
 	}
 
 	peer.Fqdn = anonymizer.AnonymizeDomain(peer.Fqdn)
-	peer.WgPubKey = anonymizer.AnonymizeWGKey(peer.WgPubKey)
 
 	anonymizeSSHConfig(peer.SshConfig)
 }

client/internal/debug/wgshow.go

@@ -35,14 +35,14 @@ func (g *BundleGenerator) toWGShowFormat(s *configurer.Stats) string {
 	var sb strings.Builder
 
 	sb.WriteString(fmt.Sprintf("interface: %s\n", s.DeviceName))
-	sb.WriteString(fmt.Sprintf("  public key: %s\n", g.anonymizer.AnonymizeWGKey(s.PublicKey)))
+	sb.WriteString(fmt.Sprintf("  public key: %s\n", s.PublicKey))
 	sb.WriteString(fmt.Sprintf("  listen port: %d\n", s.ListenPort))
 	if s.FWMark != 0 {
 		sb.WriteString(fmt.Sprintf("  fwmark: %#x\n", s.FWMark))
 	}
 
 	for _, peer := range s.Peers {
-		sb.WriteString(fmt.Sprintf("\npeer: %s\n", g.anonymizer.AnonymizeWGKey(peer.PublicKey)))
+		sb.WriteString(fmt.Sprintf("\npeer: %s\n", peer.PublicKey))
 		if peer.Endpoint.IP != nil {
 			if g.anonymize {
 				anonEndpoint := g.anonymizer.AnonymizeUDPAddr(peer.Endpoint)
@@ -54,11 +54,7 @@ func (g *BundleGenerator) toWGShowFormat(s *configurer.Stats) string {
 		if len(peer.AllowedIPs) > 0 {
 			var ipStrings []string
 			for _, ipnet := range peer.AllowedIPs {
-				ipStr := ipnet.String()
-				if g.anonymize {
-					ipStr = g.anonymizer.AnonymizeIPString(ipStr)
-				}
-				ipStrings = append(ipStrings, ipStr)
+				ipStrings = append(ipStrings, ipnet.String())
 			}
 			sb.WriteString(fmt.Sprintf("  allowed ips: %s\n", strings.Join(ipStrings, ", ")))
 		}

client/internal/dns/interface_index.go

@@ -1,15 +0,0 @@
-package dns
-
-import (
-	"fmt"
-	"net"
-)
-
-func getInterfaceIndex(interfaceName string) (int, error) {
-	iface, err := net.InterfaceByName(interfaceName)
-	if err != nil {
-		return 0, fmt.Errorf("lookup interface %q: %w", interfaceName, err)
-	}
-
-	return iface.Index, nil
-}

client/internal/dns/interface_index_test.go

@@ -1,35 +0,0 @@
-package dns
-
-import (
-	"net"
-	"testing"
-)
-
-func TestGetInterfaceIndexExisting(t *testing.T) {
-	interfaces, err := net.Interfaces()
-	if err != nil {
-		t.Fatalf("list network interfaces: %v", err)
-	}
-	if len(interfaces) == 0 {
-		t.Fatal("expected at least one network interface")
-	}
-
-	iface := interfaces[0]
-	index, err := getInterfaceIndex(iface.Name)
-	if err != nil {
-		t.Fatalf("look up existing interface %q: %v", iface.Name, err)
-	}
-	if index != iface.Index {
-		t.Fatalf("expected interface index %d, got %d", iface.Index, index)
-	}
-}
-
-func TestGetInterfaceIndexMissing(t *testing.T) {
-	index, err := getInterfaceIndex("netbird-interface-that-does-not-exist")
-	if index != 0 {
-		t.Fatalf("expected missing interface index to be 0, got %d", index)
-	}
-	if err == nil {
-		t.Fatal("expected missing interface lookup to return an error")
-	}
-}

client/internal/dns/notifier.go

@@ -51,5 +51,7 @@ func (n *notifier) notify() {
 		return
 	}
 
-	n.listener.OnNetworkChanged("")
+	go func(l listener.NetworkChangeListener) {
+		l.OnNetworkChanged("")
+	}(n.listener)
 }

client/internal/dns/server.go

@@ -252,7 +252,7 @@ func NewDefaultServerPermanentUpstream(
 	ds.hostsDNSHolder.set(hostsDnsList)
 	ds.permanent = true
 	ds.currentConfig = dnsConfigToHostDNSConfig(config, ds.service.RuntimeIP(), ds.service.RuntimePort())
-	ds.searchDomainNotifier = newNotifier(ds.searchDomains())
+	ds.searchDomainNotifier = newNotifier(ds.SearchDomains())
 	ds.searchDomainNotifier.setListener(listener)
 	setServerDns(ds)
 	return ds
@@ -602,12 +602,6 @@ func (s *DefaultServer) UpdateDNSServer(serial uint64, update nbdns.Config) erro
 }
 
 func (s *DefaultServer) SearchDomains() []string {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	return s.searchDomains()
-}
-
-func (s *DefaultServer) searchDomains() []string {
 	var searchDomains []string
 
 	for _, dConf := range s.currentConfig.Domains {
@@ -692,7 +686,7 @@ func (s *DefaultServer) applyConfiguration(update nbdns.Config) error {
 	}()
 
 	if s.searchDomainNotifier != nil {
-		s.searchDomainNotifier.onNewSearchDomains(s.searchDomains())
+		s.searchDomainNotifier.onNewSearchDomains(s.SearchDomains())
 	}
 
 	s.updateNSGroupStates(update.NameServerGroups)

client/internal/dns/upstream_ios.go

@@ -130,3 +130,8 @@ func GetClientPrivate(iface privateClientIface, upstreamIP netip.Addr, dialTimeo
 	}
 	return client, nil
 }
+
+func getInterfaceIndex(interfaceName string) (int, error) {
+	iface, err := net.InterfaceByName(interfaceName)
+	return iface.Index, err
+}

client/internal/engine.go

@@ -23,7 +23,6 @@ import (
 	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
-	"github.com/netbirdio/netbird/client/anonymize"
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/firewall"
 	"github.com/netbirdio/netbird/client/firewall/firewalld"
@@ -573,7 +572,12 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	}
 	e.stateManager.Start()
 
-	dnsServer, err := e.newDnsServer()
+	initialRoutes, dnsConfig, dnsFeatureFlag, err := e.readInitialSettings()
+	if err != nil {
+		return fmt.Errorf("read initial settings: %w", err)
+	}
+
+	dnsServer, err := e.newDnsServer(dnsConfig)
 	if err != nil {
 		return fmt.Errorf("create dns server: %w", err)
 	}
@@ -591,8 +595,10 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		WGInterface:         e.wgInterface,
 		StatusRecorder:      e.statusRecorder,
 		RelayManager:        e.relayManager,
+		InitialRoutes:       initialRoutes,
 		StateManager:        e.stateManager,
 		DNSServer:           dnsServer,
+		DNSFeatureFlag:      dnsFeatureFlag,
 		PeerStore:           e.peerStore,
 		DisableClientRoutes: e.config.DisableClientRoutes,
 		DisableServerRoutes: e.config.DisableServerRoutes,
@@ -863,8 +869,7 @@ func (e *Engine) modifyPeers(peersUpdate []*mgmProto.RemotePeerConfig) error {
 	}
 	// third, add the peer connections again
 	for _, p := range modified {
-		err := e.addNewPeer(p)
-		if err != nil {
+		if err := e.addNewPeer(p); err != nil {
 			return err
 		}
 	}
@@ -1386,7 +1391,6 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR
 
 	bundleJobParams := debug.BundleConfig{
 		Anonymize:         params.Anonymize,
-		AnonymizeLevel:    anonymize.ParseLevel(params.AnonymizeLevel),
 		IncludeSystemInfo: true,
 		LogFileCount:      uint32(params.LogFileCount),
 	}
@@ -1486,8 +1490,12 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 		return nil
 	}
 
-	if err := e.connMgr.UpdatedRemoteFeatureFlag(e.ctx, networkMap.GetPeerConfig().GetLazyConnectionEnabled()); err != nil {
-		log.Errorf("failed to update lazy connection feature flag: %v", err)
+	// Only update the flag when the sync carries a peer config; a nil peer config
+	// (e.g. a partial update) must not reset the cached flag to false.
+	if peerConfig := networkMap.GetPeerConfig(); peerConfig != nil {
+		if err := e.connMgr.UpdatedRemoteFeatureFlag(e.ctx, peerConfig.GetLazyConnectionEnabled()); err != nil {
+			log.Errorf("failed to update lazy connection feature flag: %v", err)
+		}
 	}
 
 	if e.firewall != nil {
@@ -1553,8 +1561,7 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 
 	// Ingress forward rules
 	done = e.phase("forward_rules")
-	forwardingRules, err := e.updateForwardRules(networkMap.GetForwardingRules())
-	if err != nil {
+	if _, err := e.updateForwardRules(networkMap.GetForwardingRules()); err != nil {
 		log.Errorf("failed to update forward rules, err: %v", err)
 	}
 	done()
@@ -1572,8 +1579,7 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 
 	// must set the exclude list after the peers are added. Without it the manager can not figure out the peers parameters from the store
 	done = e.phase("lazy_exclude")
-	excludedLazyPeers := e.toExcludedLazyPeers(forwardingRules, remotePeers)
-	e.connMgr.SetExcludeList(e.ctx, excludedLazyPeers)
+	e.connMgr.SetExcludeList(e.ctx, e.toExcludedLazyPeers(remotePeers))
 	done()
 
 	e.networkSerial = serial
@@ -1817,15 +1823,15 @@ func addrToString(addr netip.Addr) string {
 // addNewPeers adds peers that were not know before but arrived from the Management service with the update
 func (e *Engine) addNewPeers(peersUpdate []*mgmProto.RemotePeerConfig) error {
 	for _, p := range peersUpdate {
-		err := e.addNewPeer(p)
-		if err != nil {
+		if err := e.addNewPeer(p); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
-// addNewPeer add peer if connection doesn't exist
+// addNewPeer add peer if connection doesn't exist. A peer that is not lazy by
+// policy gets an always-active connection instead.
 func (e *Engine) addNewPeer(peerConfig *mgmProto.RemotePeerConfig) error {
 	peerKey := peerConfig.GetWgPubKey()
 	peerIPs := make([]netip.Prefix, 0, len(peerConfig.GetAllowedIps()))
@@ -1860,7 +1866,8 @@ func (e *Engine) addNewPeer(peerConfig *mgmProto.RemotePeerConfig) error {
 		log.Warnf("error adding peer %s to status recorder, got error: %v", peerKey, err)
 	}
 
-	if exists := e.connMgr.AddPeerConn(e.ctx, peerKey, conn); exists {
+	permanent := !e.connMgr.PeerLazyDefault(peerConfig.GetLazyState())
+	if exists := e.connMgr.AddPeerConn(e.ctx, peerKey, conn, permanent); exists {
 		conn.Close(false)
 		return fmt.Errorf("peer already exists: %s", peerKey)
 	}
@@ -2097,6 +2104,42 @@ func (e *Engine) close() {
 	}
 }
 
+func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, error) {
+	if runtime.GOOS != "android" {
+		// nolint:nilnil
+		return nil, nil, false, nil
+	}
+
+	info := system.GetInfo(e.ctx)
+	info.SetFlags(
+		e.config.RosenpassEnabled,
+		e.config.RosenpassPermissive,
+		&e.config.ServerSSHAllowed,
+		e.config.DisableClientRoutes,
+		e.config.DisableServerRoutes,
+		e.config.DisableDNS,
+		e.config.DisableFirewall,
+		e.config.BlockLANAccess,
+		e.config.BlockInbound,
+		e.config.DisableIPv6,
+		e.config.SyncMessageVersion,
+		e.config.EnableSSHRoot,
+		e.config.EnableSSHSFTP,
+		e.config.EnableSSHLocalPortForwarding,
+		e.config.EnableSSHRemotePortForwarding,
+		e.config.DisableSSHAuth,
+	)
+
+	netMap, err := e.mgmClient.GetNetworkMap(info)
+	if err != nil {
+		return nil, nil, false, err
+	}
+	routes := toRoutes(netMap.GetRoutes())
+	dnsCfg := toDNSConfig(netMap.GetDNSConfig(), e.wgInterface.Address())
+	dnsFeatureFlag := toDNSFeatureFlag(netMap)
+	return routes, &dnsCfg, dnsFeatureFlag, nil
+}
+
 func (e *Engine) newWgIface() (*iface.WGIface, error) {
 	transportNet, err := e.newStdNet()
 	if err != nil {
@@ -2131,7 +2174,7 @@ func (e *Engine) newWgIface() (*iface.WGIface, error) {
 func (e *Engine) wgInterfaceCreate() (err error) {
 	switch runtime.GOOS {
 	case "android":
-		err = e.wgInterface.CreateOnAndroid(e.routeManager.CurrentRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
+		err = e.wgInterface.CreateOnAndroid(e.routeManager.InitialRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
 	case "ios":
 		e.mobileDep.NetworkChangeListener.SetInterfaceIP(e.config.WgAddr.String())
 		if e.config.WgAddr.HasIPv6() {
@@ -2144,7 +2187,7 @@ func (e *Engine) wgInterfaceCreate() (err error) {
 	return err
 }
 
-func (e *Engine) newDnsServer() (dns.Server, error) {
+func (e *Engine) newDnsServer(dnsConfig *nbdns.Config) (dns.Server, error) {
 	// due to tests where we are using a mocked version of the DNS server
 	if e.dnsServer != nil {
 		return e.dnsServer, nil
@@ -2156,7 +2199,7 @@ func (e *Engine) newDnsServer() (dns.Server, error) {
 			e.ctx,
 			e.wgInterface,
 			e.mobileDep.HostDNSAddresses,
-			nbdns.Config{},
+			*dnsConfig,
 			e.mobileDep.NetworkChangeListener,
 			e.statusRecorder,
 			e.config.DisableDNS,
@@ -2651,46 +2694,19 @@ func (e *Engine) updateForwardRules(rules []*mgmProto.ForwardingRule) ([]firewal
 	return forwardingRules, nberrors.FormatErrorOrNil(merr)
 }
 
-func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers []*mgmProto.RemotePeerConfig) map[string]bool {
+// toExcludedLazyPeers returns the peers that must have an always-active
+// connection: those that are not lazy by policy (the per-peer lazy state or the
+// account flag, subject to the local override).
+func (e *Engine) toExcludedLazyPeers(peers []*mgmProto.RemotePeerConfig) map[string]bool {
 	excludedPeers := make(map[string]bool)
-
-	// Ingress forward targets: inbound forwarded traffic is initiated remotely and
-	// cannot wake a lazy connection, so the peer routing the target must stay
-	// permanently connected. AllowedIPs are already parsed on the peer conn, so
-	// reuse those typed prefixes instead of re-parsing the network map strings.
-	for _, r := range rules {
-		for _, p := range peers {
-			if e.peerRoutesAddr(p, r.TranslatedAddress) {
-				log.Infof("exclude forwarder peer from lazy connection: %s", p.GetWgPubKey())
-				excludedPeers[p.GetWgPubKey()] = true
-			}
+	for _, p := range peers {
+		if !e.connMgr.PeerLazyDefault(p.GetLazyState()) {
+			excludedPeers[p.GetWgPubKey()] = true
 		}
 	}
-
 	return excludedPeers
 }
 
-// peerRoutesAddr reports whether the peer is a router for addr, matched against
-// the peer's already-parsed AllowedIPs from the store (the same typed value the
-// lazy manager consumes) rather than re-parsing the network map strings.
-func (e *Engine) peerRoutesAddr(p *mgmProto.RemotePeerConfig, addr netip.Addr) bool {
-	prefixes, ok := e.peerStore.AllowedIPs(p.GetWgPubKey())
-	if !ok {
-		return false
-	}
-	return prefixesContain(prefixes, addr)
-}
-
-// prefixesContain reports whether addr falls within any of the prefixes.
-func prefixesContain(prefixes []netip.Prefix, addr netip.Addr) bool {
-	for _, prefix := range prefixes {
-		if prefix.Contains(addr) {
-			return true
-		}
-	}
-	return false
-}
-
 // isChecksEqual checks if two slices of checks are equal.
 func isChecksEqual(checks1, checks2 []*mgmProto.Checks) bool {
 	normalize := func(checks []*mgmProto.Checks) []string {

client/internal/engine_lazy_exclude_test.go

@@ -1,87 +0,0 @@
-package internal
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/client/internal/peerstore"
-	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-)
-
-func TestPrefixesContain(t *testing.T) {
-	tests := []struct {
-		name     string
-		prefixes []string
-		addr     string
-		want     bool
-	}{
-		{name: "own overlay /32 matches", prefixes: []string{"100.110.8.145/32"}, addr: "100.110.8.145", want: true},
-		{name: "addr inside routed subnet", prefixes: []string{"10.121.0.0/16"}, addr: "10.121.208.4", want: true},
-		{name: "addr outside subnet", prefixes: []string{"10.121.0.0/16"}, addr: "10.122.0.1", want: false},
-		{name: "different /32", prefixes: []string{"100.110.8.145/32"}, addr: "100.110.8.146", want: false},
-		{name: "ipv6 /128 matches", prefixes: []string{"fd00::1/128"}, addr: "fd00::1", want: true},
-		{name: "no prefixes", prefixes: nil, addr: "10.121.208.4", want: false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			prefixes := make([]netip.Prefix, 0, len(tt.prefixes))
-			for _, p := range tt.prefixes {
-				prefixes = append(prefixes, netip.MustParsePrefix(p))
-			}
-			require.Equal(t, tt.want, prefixesContain(prefixes, netip.MustParseAddr(tt.addr)))
-		})
-	}
-}
-
-// TestToExcludedLazyPeers_ForwardTarget guards a regression: the forward-target
-// peer (the peer routing a ForwardRule.TranslatedAddress) must be excluded from
-// lazy connections, matched via the peer's already-parsed AllowedIPs.
-func TestToExcludedLazyPeers_ForwardTarget(t *testing.T) {
-	const targetPeerKey = "cccccccccccccccccccccccccccccccccccccccccc0="
-	const otherPeerKey = "dddddddddddddddddddddddddddddddddddddddddd0="
-
-	store := peerstore.NewConnStore()
-	store.AddPeerConn(targetPeerKey, newTestConn(t, targetPeerKey, "100.110.8.145/32"))
-	store.AddPeerConn(otherPeerKey, newTestConn(t, otherPeerKey, "100.110.9.10/32"))
-
-	e := &Engine{peerStore: store}
-
-	peers := []*mgmProto.RemotePeerConfig{
-		{WgPubKey: targetPeerKey, AllowedIps: []string{"100.110.8.145/32"}},
-		{WgPubKey: otherPeerKey, AllowedIps: []string{"100.110.9.10/32"}},
-	}
-	rules := []firewallManager.ForwardRule{
-		{TranslatedAddress: netip.MustParseAddr("100.110.8.145")},
-	}
-
-	excluded := e.toExcludedLazyPeers(rules, peers)
-
-	require.True(t, excluded[targetPeerKey], "forward-target peer must be excluded from lazy connections")
-	require.False(t, excluded[otherPeerKey], "non-target peer must not be excluded")
-	require.Len(t, excluded, 1)
-}
-
-func TestToExcludedLazyPeers_NoRules(t *testing.T) {
-	e := &Engine{peerStore: peerstore.NewConnStore()}
-
-	peers := []*mgmProto.RemotePeerConfig{
-		{WgPubKey: "peer-a", AllowedIps: []string{"100.110.8.145/32"}},
-	}
-
-	require.Empty(t, e.toExcludedLazyPeers(nil, peers))
-}
-
-func newTestConn(t *testing.T, key, allowedIP string) *peer.Conn {
-	t.Helper()
-	conn, err := peer.NewConn(peer.ConnConfig{
-		Key:      key,
-		WgConfig: peer.WgConfig{AllowedIps: []netip.Prefix{netip.MustParsePrefix(allowedIP)}},
-	}, peer.ServiceDependencies{})
-	require.NoError(t, err)
-	return conn
-}

client/internal/engine_test.go

@@ -279,7 +279,8 @@ func TestEngine_UpdateNetworkMap(t *testing.T) {
 	}, MobileDependency{})
 
 	wgIface := &MockWGIface{
-		NameFunc: func() string { return "utun102" },
+		NameFunc:            func() string { return "utun102" },
+		IsUserspaceBindFunc: func() bool { return true },
 		RemovePeerFunc: func(peerKey string) error {
 			return nil
 		},

client/internal/engine_tunsettings.go

@@ -1,20 +0,0 @@
-package internal
-
-func (e *Engine) TunSettings() ([]string, []string) {
-	e.syncMsgMux.Lock()
-	routeManager := e.routeManager
-	dnsServer := e.dnsServer
-	e.syncMsgMux.Unlock()
-
-	var routes []string
-	if routeManager != nil {
-		routes = routeManager.CurrentRouteRange()
-	}
-
-	var searchDomains []string
-	if dnsServer != nil {
-		searchDomains = dnsServer.SearchDomains()
-	}
-
-	return routes, searchDomains
-}

client/internal/metrics/connection_type.go

@@ -4,17 +4,11 @@ package metrics
 type ConnectionType string
 
 const (
-	// ConnectionTypeICEP2P represents a direct peer-to-peer connection using ICE
-	ConnectionTypeICEP2P ConnectionType = "ice_p2p"
-
-	// ConnectionTypeICETurn represents an ICE connection through a TURN server
-	ConnectionTypeICETurn ConnectionType = "ice_turn"
+	// ConnectionTypeICE represents a direct peer-to-peer connection using ICE
+	ConnectionTypeICE ConnectionType = "ice"
 
 	// ConnectionTypeRelay represents a relayed connection
 	ConnectionTypeRelay ConnectionType = "relay"
-
-	// ConnectionTypeUnknown represents a connection with no active transport. It is not pushed.
-	ConnectionTypeUnknown ConnectionType = "unknown"
 )
 
 // String returns the string representation of the connection type

client/internal/metrics/influxdb_test.go

@@ -28,7 +28,7 @@ func TestInfluxDBMetrics_RecordAndExport(t *testing.T) {
 		WgHandshakeSuccess: time.Now().Add(-1 * time.Second),
 	}
 
-	m.RecordConnectionStages(context.Background(), agentInfo, "pair123", ConnectionTypeICEP2P, false, ts)
+	m.RecordConnectionStages(context.Background(), agentInfo, "pair123", ConnectionTypeICE, false, ts)
 
 	var buf bytes.Buffer
 	err := m.Export(&buf)
@@ -60,7 +60,7 @@ func TestInfluxDBMetrics_ExportDeterministicFieldOrder(t *testing.T) {
 
 	// Record multiple times and verify consistent field order
 	for i := 0; i < 10; i++ {
-		m.RecordConnectionStages(context.Background(), agentInfo, "pair123", ConnectionTypeICEP2P, false, ts)
+		m.RecordConnectionStages(context.Background(), agentInfo, "pair123", ConnectionTypeICE, false, ts)
 	}
 
 	var buf bytes.Buffer

client/internal/metrics/infra/README.md

@@ -56,33 +56,14 @@ Measurement: `netbird_peer_connection`
 
 Tags:
 - `deployment_type`: "cloud" | "selfhosted" | "unknown"
-- `connection_type`: "ice_p2p" | "ice_turn" | "relay" (see below)
+- `connection_type`: "ice" | "relay"
 - `attempt_type`: "initial" | "reconnection"
 - `version`: NetBird version string
 - `os`: Operating system (linux, darwin, windows, android, ios, etc.)
 - `arch`: CPU architecture (amd64, arm64, etc.)
-- `peer_id`: anonymised peer identifier (truncated SHA-256 of the WireGuard public key)
-- `connection_pair_id`: deterministic identifier for the peer pair, identical on both sides
 
 **Note:** `SignalingReceived` is set when the first offer or answer arrives from the remote peer (in both initial and reconnection paths). It excludes the potentially unbounded wait for the remote peer to come online.
 
-#### `connection_type` values
-
-Derived from the connection priority (`conntype.ConnPriority`) by `metricsConnType` in `client/internal/peer/conn.go`:
-
-| Value | Priority | Traffic is |
-|-------|----------|------------|
-| `ice_p2p` | `ICEP2P` | direct peer-to-peer |
-| `ice_turn` | `ICETurn` | relayed, through a TURN server |
-| `relay` | `Relay` | relayed, through a NetBird relay |
-| `unknown` | `None` or unrecognised | no active transport — **the sample is not pushed** |
-
-**Direct traffic is `ice_p2p` only.** `ice_turn` is relayed despite being negotiated by ICE, matching `Conn.isRelayed`.
-
-`None` means no transport is active: not established yet, or reset after a relay drop or a peer-state reset. Such a sample cannot be attributed to a transport, so `recordConnectionMetrics` drops it instead of pushing it — `unknown` therefore never appears in the bucket. Connection counts are counts of connections whose transport was known at sampling time.
-
-**Samples recorded before 0.77 used a single `ice` value** which covered `ICEP2P`, `ICETurn` *and* `None`, so historical `ice` samples overstate direct connections by an unknown amount and must not be compared with `ice_p2p`.
-
 ### Sync Duration
 
 Measurement: `netbird_sync`

client/internal/peer/conn.go

@@ -307,8 +307,6 @@ func (conn *Conn) Close(signalToRemote bool) {
 
 	if conn.wgWatcherCancel != nil {
 		conn.wgWatcherCancel()
-		conn.wgWatcher = nil
-		conn.wgWatcherCancel = nil
 	}
 	conn.workerRelay.CloseConn()
 	if conn.workerICE != nil {
@@ -961,9 +959,12 @@ func (conn *Conn) recordConnectionMetrics() {
 	priority := conn.currentConnPriority
 	conn.mu.Unlock()
 
-	connType := metricsConnType(priority)
-	if connType == metrics.ConnectionTypeUnknown {
-		return
+	var connType metrics.ConnectionType
+	switch priority {
+	case conntype.Relay:
+		connType = metrics.ConnectionTypeRelay
+	default:
+		connType = metrics.ConnectionTypeICE
 	}
 
 	// Record metrics with timestamps - duration calculation happens in metrics package
@@ -1064,16 +1065,3 @@ func boolToConnStatus(connected bool) guard.ConnStatus {
 	}
 	return guard.ConnStatusDisconnected
 }
-
-func metricsConnType(priority conntype.ConnPriority) metrics.ConnectionType {
-	switch priority {
-	case conntype.Relay:
-		return metrics.ConnectionTypeRelay
-	case conntype.ICETurn:
-		return metrics.ConnectionTypeICETurn
-	case conntype.ICEP2P:
-		return metrics.ConnectionTypeICEP2P
-	default:
-		return metrics.ConnectionTypeUnknown
-	}
-}

client/internal/peer/conn_test.go

@@ -11,8 +11,6 @@ import (
 	"github.com/stretchr/testify/assert"
 
 	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/internal/metrics"
-	"github.com/netbirdio/netbird/client/internal/peer/conntype"
 	"github.com/netbirdio/netbird/client/internal/peer/dispatcher"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	"github.com/netbirdio/netbird/client/internal/peer/ice"
@@ -388,33 +386,3 @@ func TestConn_onWGDisconnected_NoEscalationWithoutRosenpass(t *testing.T) {
 	}
 	assert.Empty(t, disconnected, "escalation must be limited to rosenpass connections")
 }
-
-func TestMetricsConnType(t *testing.T) {
-	tests := []struct {
-		name     string
-		priority conntype.ConnPriority
-		expected metrics.ConnectionType
-	}{
-		{"relay", conntype.Relay, metrics.ConnectionTypeRelay},
-		{"ice over turn is relayed, not p2p", conntype.ICETurn, metrics.ConnectionTypeICETurn},
-		{"direct p2p", conntype.ICEP2P, metrics.ConnectionTypeICEP2P},
-		{"unset priority is unknown, not p2p", conntype.None, metrics.ConnectionTypeUnknown},
-		{"unrecognised priority is unknown", conntype.ConnPriority(99), metrics.ConnectionTypeUnknown},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.expected, metricsConnType(tc.priority))
-		})
-	}
-}
-
-func TestMetricsConnType_RelayedMatchesIsRelayed(t *testing.T) {
-	for _, priority := range []conntype.ConnPriority{conntype.None, conntype.Relay, conntype.ICETurn, conntype.ICEP2P} {
-		conn := &Conn{currentConnPriority: priority}
-		tag := metricsConnType(priority)
-		relayedTag := tag == metrics.ConnectionTypeRelay || tag == metrics.ConnectionTypeICETurn
-		assert.Equal(t, conn.isRelayed(), relayedTag,
-			"priority %s: isRelayed and the %q metric tag must agree", priority, tag)
-	}
-}

client/internal/profilemanager/state.go

@@ -45,35 +45,12 @@ func (pm *ProfileManager) GetProfileState(id ID) (*ProfileState, error) {
 	return &state, nil
 }
 
-// SetProfileState writes the state file of the profile identified by id. Prefer
-// it over SetActiveProfileState whenever the caller knows which profile the data
-// belongs to: an SSO login spans seconds of user interaction, and the active
-// profile can change during it, which would file the account email under
-// whichever profile happened to be active when the flow returned.
-func (pm *ProfileManager) SetProfileState(id ID, state *ProfileState) error {
+func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 	configDir, err := getConfigDir()
 	if err != nil {
 		return fmt.Errorf("get config directory: %w", err)
 	}
 
-	if id == "" {
-		return fmt.Errorf("empty profile ID")
-	}
-	if id != defaultProfileName && !IsValidProfileFilenameStem(id) {
-		return fmt.Errorf("invalid profile ID: %q", id)
-	}
-
-	stateFile := filepath.Join(configDir, id.String()+".state.json")
-	if err := util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state); err != nil {
-		return fmt.Errorf("write profile state: %w", err)
-	}
-
-	return nil
-}
-
-// SetActiveProfileState writes the state file of whichever profile is active at
-// call time. Use SetProfileState when the target profile is known.
-func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 	activeProf, err := pm.GetActiveProfile()
 	if err != nil {
 		if errors.Is(err, ErrNoActiveProfile) {
@@ -82,7 +59,18 @@ func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 		return fmt.Errorf("get active profile: %w", err)
 	}
 
-	return pm.SetProfileState(activeProf.ID, state)
+	id := activeProf.ID
+	if id != defaultProfileName && !IsValidProfileFilenameStem(id) {
+		return fmt.Errorf("invalid active profile ID: %q", id)
+	}
+
+	stateFile := filepath.Join(configDir, id.String()+".state.json")
+	err = util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state)
+	if err != nil {
+		return fmt.Errorf("write profile state: %w", err)
+	}
+
+	return nil
 }
 
 // RemoveProfileState deletes the per-profile state file (which holds the

client/internal/routemanager/dnsinterceptor/handler.go

@@ -479,7 +479,7 @@ func (d *DnsInterceptor) removeDNATMappings(realPrefixes []netip.Prefix, logger
 
 // internalDnatFw checks if the firewall supports internal DNAT
 func (d *DnsInterceptor) internalDnatFw() (internalDNATer, bool) {
-	if d.firewall == nil || d.fakeIPManager == nil || runtime.GOOS != "android" {
+	if d.firewall == nil || runtime.GOOS != "android" {
 		return nil, false
 	}
 	fw, ok := d.firewall.(internalDNATer)

client/internal/routemanager/manager.go

@@ -8,13 +8,14 @@ import (
 	"net/netip"
 	"net/url"
 	"runtime"
-	"sort"
+	"slices"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"syscall"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/maps"
@@ -61,7 +62,7 @@ type Manager interface {
 	GetActiveClientRoutes() route.HAMap
 	GetClientRoutesWithNetID() map[route.NetID][]*route.Route
 	SetRouteChangeListener(listener listener.NetworkChangeListener)
-	CurrentRouteRange() []string
+	InitialRouteRange() []string
 	SetFirewall(firewall.Manager) error
 	SetDNSForwarderPort(port uint16)
 	ReconcilePeerAllowedIPs(peerKey string) error
@@ -75,8 +76,10 @@ type ManagerConfig struct {
 	WGInterface         iface.WGIface
 	StatusRecorder      *peer.Status
 	RelayManager        *relayClient.Manager
+	InitialRoutes       []*route.Route
 	StateManager        *statemanager.Manager
 	DNSServer           dns.Server
+	DNSFeatureFlag      bool
 	PeerStore           *peerstore.Store
 	DisableClientRoutes bool
 	DisableServerRoutes bool
@@ -146,12 +149,45 @@ func NewManager(config ManagerConfig) *DefaultManager {
 	useNoop := netstack.IsEnabled() || config.DisableClientRoutes
 	dm.setupRefCounters(useNoop)
 
+	// don't proceed with client routes if it is disabled
+	if config.DisableClientRoutes {
+		return dm
+	}
+
+	if runtime.GOOS == "android" {
+		dm.setupAndroidRoutes(config)
+	}
 	return dm
 }
+func (m *DefaultManager) setupAndroidRoutes(config ManagerConfig) {
+	cr := m.initialClientRoutes(config.InitialRoutes)
 
-func (m *DefaultManager) enableFakeIPRoutes() {
-	m.fakeIPManager = fakeip.NewManager()
-	m.notifier.NotifyRouteChange()
+	routesForComparison := slices.Clone(cr)
+
+	if config.DNSFeatureFlag {
+		m.fakeIPManager = fakeip.NewManager()
+
+		v4ID := uuid.NewString()
+		fakeIPRoute := &route.Route{
+			ID:          route.ID(v4ID),
+			Network:     m.fakeIPManager.GetFakeIPBlock(),
+			NetID:       route.NetID(v4ID),
+			Peer:        m.pubKey,
+			NetworkType: route.IPv4Network,
+		}
+		v6ID := uuid.NewString()
+		fakeIPv6Route := &route.Route{
+			ID:          route.ID(v6ID),
+			Network:     m.fakeIPManager.GetFakeIPv6Block(),
+			NetID:       route.NetID(v6ID),
+			Peer:        m.pubKey,
+			NetworkType: route.IPv6Network,
+		}
+		cr = append(cr, fakeIPRoute, fakeIPv6Route)
+		m.notifier.SetFakeIPRoutes([]*route.Route{fakeIPRoute, fakeIPv6Route})
+	}
+
+	m.notifier.SetInitialClientRoutes(cr, routesForComparison)
 }
 
 func (m *DefaultManager) setupRefCounters(useNoop bool) {
@@ -428,9 +464,6 @@ func (m *DefaultManager) UpdateRoutes(
 
 	var merr *multierror.Error
 	if !m.disableClientRoutes {
-		if runtime.GOOS == "android" && useNewDNSRoute && m.fakeIPManager == nil {
-			m.enableFakeIPRoutes()
-		}
 
 		// Update route selector based on management server's isSelected status
 		m.updateRouteSelectorFromManagement(clientRoutes)
@@ -467,32 +500,9 @@ func (m *DefaultManager) SetRouteChangeListener(listener listener.NetworkChangeL
 	m.notifier.SetListener(listener)
 }
 
-// CurrentRouteRange returns the current TUN route list. It is used by mobile systems
-func (m *DefaultManager) CurrentRouteRange() []string {
-	m.mux.Lock()
-	defer m.mux.Unlock()
-
-	if m.disableClientRoutes {
-		return nil
-	}
-
-	filtered := m.routeSelector.FilterSelectedExitNodes(m.clientRoutes)
-	var nets []string
-	for _, routes := range filtered {
-		for _, r := range routes {
-			if r.IsDynamic() {
-				continue
-			}
-			nets = append(nets, r.NetString())
-		}
-	}
-
-	if m.fakeIPManager != nil {
-		nets = append(nets, m.fakeIPManager.GetFakeIPBlock().String(), m.fakeIPManager.GetFakeIPv6Block().String())
-	}
-
-	sort.Strings(nets)
-	return nets
+// InitialRouteRange return the list of initial routes. It used by mobile systems
+func (m *DefaultManager) InitialRouteRange() []string {
+	return m.notifier.GetInitialRouteRanges()
 }
 
 // GetRouteSelector returns the route selector
@@ -690,6 +700,16 @@ func (m *DefaultManager) ClassifyRoutes(newRoutes []*route.Route) (map[route.ID]
 	return newServerRoutesMap, newClientRoutesIDMap
 }
 
+func (m *DefaultManager) initialClientRoutes(initialRoutes []*route.Route) []*route.Route {
+	_, crMap := m.ClassifyRoutes(initialRoutes)
+	rs := make([]*route.Route, 0, len(crMap))
+	for _, routes := range crMap {
+		rs = append(rs, routes...)
+	}
+
+	return rs
+}
+
 func isRouteSupported(route *route.Route) bool {
 	if netstack.IsEnabled() || !nbnet.CustomRoutingDisabled() || route.IsDynamic() {
 		return true

client/internal/routemanager/mock.go

@@ -30,8 +30,8 @@ func (m *MockManager) Init() error {
 	return nil
 }
 
-// CurrentRouteRange mock implementation of CurrentRouteRange from Manager interface
-func (m *MockManager) CurrentRouteRange() []string {
+// InitialRouteRange mock implementation of InitialRouteRange from Manager interface
+func (m *MockManager) InitialRouteRange() []string {
 	return nil
 }
 

client/internal/routemanager/notifier/notifier_android.go

@@ -6,6 +6,7 @@ import (
 	"net/netip"
 	"slices"
 	"sort"
+	"strings"
 	"sync"
 
 	"github.com/netbirdio/netbird/client/internal/listener"
@@ -13,15 +14,12 @@ import (
 )
 
 type Notifier struct {
-	mu sync.Mutex
-
-	// currentRoutes is the last announced route set. It exists only to
-	// suppress noise: without it every network map sync would trigger the
-	// Java side, even when the routes did not change. The actual TUN route
-	// state is owned by the route manager and pulled from there.
+	initialRoutes []*route.Route
 	currentRoutes []*route.Route
+	fakeIPRoutes  []*route.Route
 
-	listener listener.NetworkChangeListener
+	listener    listener.NetworkChangeListener
+	listenerMux sync.Mutex
 }
 
 func NewNotifier() *Notifier {
@@ -29,15 +27,20 @@ func NewNotifier() *Notifier {
 }
 
 func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
+	n.listenerMux.Lock()
+	defer n.listenerMux.Unlock()
 	n.listener = listener
 }
 
-func (n *Notifier) NotifyRouteChange() {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	n.notifyLocked()
+// SetInitialClientRoutes stores the initial route sets for TUN configuration.
+func (n *Notifier) SetInitialClientRoutes(initialRoutes []*route.Route, routesForComparison []*route.Route) {
+	n.initialRoutes = filterStatic(initialRoutes)
+	n.currentRoutes = filterStatic(routesForComparison)
+}
+
+// SetFakeIPRoutes stores the fake IP routes to be included in every TUN rebuild.
+func (n *Notifier) SetFakeIPRoutes(routes []*route.Route) {
+	n.fakeIPRoutes = routes
 }
 
 func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
@@ -51,32 +54,46 @@ func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
 		}
 	}
 
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	if !hasRouteDiff(n.currentRoutes, newRoutes) {
+	if !n.hasRouteDiff(n.currentRoutes, newRoutes) {
 		return
 	}
 
 	n.currentRoutes = newRoutes
-	n.notifyLocked()
+	n.notify()
 }
 
 func (n *Notifier) OnNewPrefixes([]netip.Prefix) {
 	// Not used on Android
 }
 
-func (n *Notifier) notifyLocked() {
+func (n *Notifier) notify() {
+	n.listenerMux.Lock()
+	defer n.listenerMux.Unlock()
 	if n.listener == nil {
 		return
 	}
-	n.listener.OnNetworkChanged("")
+
+	allRoutes := slices.Clone(n.currentRoutes)
+	allRoutes = append(allRoutes, n.fakeIPRoutes...)
+
+	routeStrings := n.routesToStrings(allRoutes)
+	sort.Strings(routeStrings)
+	go func(l listener.NetworkChangeListener) {
+		l.OnNetworkChanged(strings.Join(routeStrings, ","))
+	}(n.listener)
 }
 
-func (n *Notifier) Close() {
-	// unused
+func filterStatic(routes []*route.Route) []*route.Route {
+	out := make([]*route.Route, 0, len(routes))
+	for _, r := range routes {
+		if !r.IsDynamic() {
+			out = append(out, r)
+		}
+	}
+	return out
 }
 
-func routesToStrings(routes []*route.Route) []string {
+func (n *Notifier) routesToStrings(routes []*route.Route) []string {
 	nets := make([]string, 0, len(routes))
 	for _, r := range routes {
 		nets = append(nets, r.NetString())
@@ -84,10 +101,25 @@ func routesToStrings(routes []*route.Route) []string {
 	return nets
 }
 
-func hasRouteDiff(a []*route.Route, b []*route.Route) bool {
-	as := routesToStrings(a)
-	bs := routesToStrings(b)
-	sort.Strings(as)
-	sort.Strings(bs)
-	return !slices.Equal(as, bs)
+func (n *Notifier) hasRouteDiff(a []*route.Route, b []*route.Route) bool {
+	slices.SortFunc(a, func(x, y *route.Route) int {
+		return strings.Compare(x.NetString(), y.NetString())
+	})
+	slices.SortFunc(b, func(x, y *route.Route) int {
+		return strings.Compare(x.NetString(), y.NetString())
+	})
+
+	return !slices.EqualFunc(a, b, func(x, y *route.Route) bool {
+		return x.NetString() == y.NetString()
+	})
+}
+
+func (n *Notifier) GetInitialRouteRanges() []string {
+	initialStrings := n.routesToStrings(n.initialRoutes)
+	sort.Strings(initialStrings)
+	return initialStrings
+}
+
+func (n *Notifier) Close() {
+	// unused
 }

client/internal/routemanager/notifier/notifier_ios.go

@@ -29,7 +29,11 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	n.listener = listener
 }
 
-func (n *Notifier) NotifyRouteChange() {
+func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
+	// iOS doesn't care about initial routes
+}
+
+func (n *Notifier) SetFakeIPRoutes([]*route.Route) {
 	// Not used on iOS
 }
 

client/internal/routemanager/notifier/notifier_other.go

@@ -19,7 +19,11 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	// Not used on non-mobile platforms
 }
 
-func (n *Notifier) NotifyRouteChange() {
+func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
+	// Not used on non-mobile platforms
+}
+
+func (n *Notifier) SetFakeIPRoutes([]*route.Route) {
 	// Not used on non-mobile platforms
 }
 
@@ -31,6 +35,10 @@ func (n *Notifier) OnNewPrefixes(prefixes []netip.Prefix) {
 	// Not used on non-mobile platforms
 }
 
+func (n *Notifier) GetInitialRouteRanges() []string {
+	return []string{}
+}
+
 func (n *Notifier) Close() {
 	// unused
 }

client/internal/updater/installer/installer_run_darwin.go

@@ -98,44 +98,47 @@ func (u *Installer) startDaemon(daemonFolder string) error {
 func (u *Installer) startUIAsUser() error {
 	log.Infof("starting netbird-ui: %s", uiBinary)
 
-	username, err := consoleUser()
+	// Get the current console user
+	cmd := exec.Command("stat", "-f", "%Su", "/dev/console")
+	output, err := cmd.Output()
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to get console user: %w", err)
 	}
 
+	username := strings.TrimSpace(string(output))
+	if username == "" || username == "root" {
+		return fmt.Errorf("no active user session found")
+	}
+
+	log.Infof("starting UI for user: %s", username)
+
+	// Get user's UID
 	userInfo, err := user.Lookup(username)
 	if err != nil {
-		return fmt.Errorf("lookup user %s: %w", username, err)
+		return fmt.Errorf("failed to lookup user %s: %w", username, err)
 	}
 
-	log.Infof("starting UI for user: %s (uid %s)", username, userInfo.Uid)
-
-	launchCmd := exec.Command("launchctl", "asuser", userInfo.Uid, "sudo", "-u", username, "-H", "open", "-a", uiBinary)
+	// Start the UI process as the console user using launchctl
+	// This ensures the app runs in the user's context with proper GUI access
+	launchCmd := exec.Command("launchctl", "asuser", userInfo.Uid, "open", "-a", uiBinary)
 	log.Infof("launchCmd: %s", launchCmd.String())
+	// Set the user's home directory for proper macOS app behavior
+	launchCmd.Env = append(os.Environ(), "HOME="+userInfo.HomeDir)
+	log.Infof("set HOME environment variable: %s", userInfo.HomeDir)
 
-	if err := launchCmd.Run(); err != nil {
-		return fmt.Errorf("run UI launch: %w", err)
+	if err := launchCmd.Start(); err != nil {
+		return fmt.Errorf("failed to start UI process: %w", err)
+	}
+
+	// Release the process so it can run independently
+	if err := launchCmd.Process.Release(); err != nil {
+		log.Warnf("failed to release UI process: %v", err)
 	}
 
 	log.Infof("netbird-ui started successfully for user %s", username)
 	return nil
 }
 
-func consoleUser() (string, error) {
-	output, err := exec.Command("stat", "-f", "%Su", "/dev/console").Output()
-	if err != nil {
-		return "", fmt.Errorf("get console user: %w", err)
-	}
-
-	username := strings.TrimSpace(string(output))
-	switch username {
-	case "", "root", "loginwindow", "_mbsetupuser":
-		return "", fmt.Errorf("no active GUI user session, console user: %q", username)
-	}
-
-	return username, nil
-}
-
 func (u *Installer) installPkgFile(ctx context.Context, path string) error {
 	log.Infof("installing pkg file: %s", path)
 

client/ios/NetBirdSDK/client.go

@@ -14,7 +14,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	nbAnonymize "github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/debug"
@@ -29,13 +28,6 @@ import (
 	types "github.com/netbirdio/netbird/upload-server/types"
 )
 
-// AnonymizeLevelDefault and AnonymizeLevelStrict are the accepted
-// anonymizeLevel values for DebugBundle.
-const (
-	AnonymizeLevelDefault = nbAnonymize.LevelDefaultString
-	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
-)
-
 // ConnectionListener export internal Listener for mobile
 type ConnectionListener interface {
 	peer.Listener
@@ -166,19 +158,13 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	defer c.ctxCancel()
 	c.ctxCancelLock.Unlock()
 
-	// No login pre-flight here. The engine's own loginToManagement (connect.go) performs
-	// the authoritative Login immediately before the first Sync, so a LoginSync() call at
-	// this point only duplicated it — costing two extra Login RPCs (IsLoginRequired +
-	// Login) on every engine start, since IsLoginRequired is itself a full Login RPC.
-	//
-	// Auth failures still reach the caller through the engine path: loginToManagement
-	// returns PermissionDenied, which marks the shared status recorder
-	// (MarkManagementDisconnected) and fires ClientStop → onDisconnected, where
-	// IsLoginRequiredCached() reports login-required. The error is also returned out of Run().
-	//
-	// A pre-flight was also actively harmful when the server is unreachable: its 2-minute
-	// backoff blocked the start and then reported "login required" for what was really a
-	// timeout. The engine instead keeps retrying and recovers when the server returns.
+	auth := NewAuthWithConfig(ctx, cfg)
+	err = auth.LoginSync()
+	if err != nil {
+		return err
+	}
+
+	log.Infof("Auth successful")
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	c.onHostDnsFn = func([]string) {}
@@ -208,10 +194,8 @@ func (c *Client) Stop() {
 // DebugBundle generates a debug bundle, uploads it and returns the upload key.
 // It works with or without a running engine: when the engine is up it reuses
 // the live config, sync response and client metrics; otherwise it loads the
-// config from disk (or the preloaded tvOS config). anonymizeLevel is "default"
-// or "strict"; strict also anonymizes internal IP ranges, peer names, and
-// WireGuard public keys, and implies anonymize.
-func (c *Client) DebugBundle(anonymize bool, anonymizeLevel string) (string, error) {
+// config from disk (or the preloaded tvOS config).
+func (c *Client) DebugBundle(anonymize bool) (string, error) {
 	cfg, cc := c.stateSnapshot()
 
 	// If the engine hasn't been started, load config so we can reach management.
@@ -261,7 +245,6 @@ func (c *Client) DebugBundle(anonymize bool, anonymizeLevel string) (string, err
 		deps,
 		debug.BundleConfig{
 			Anonymize:         anonymize,
-			AnonymizeLevel:    nbAnonymize.ParseLevel(anonymizeLevel),
 			IncludeSystemInfo: true,
 		},
 	)

client/ios/NetBirdSDK/login.go

@@ -222,36 +222,17 @@ func (a *Auth) Login(resultListener ErrListener, urlOpener URLOpener, forceDevic
 // LoginWithDeviceName performs interactive login with device authentication support
 // The deviceName parameter allows specifying a custom device name (required for tvOS)
 func (a *Auth) LoginWithDeviceName(resultListener ErrListener, urlOpener URLOpener, forceDeviceAuth bool, deviceName string) {
-	a.startLogin(resultListener, urlOpener, forceDeviceAuth, deviceName, false)
-}
-
-// LoginInteractive performs the same interactive login as LoginWithDeviceName but skips the
-// IsLoginRequired() pre-flight and goes straight to the browser / device-code flow.
-//
-// IsLoginRequired() is itself a full Login RPC against the management server, so when the
-// caller has ALREADY established that login is required it is a pure duplicate. On iOS the
-// main app decides to show the browser based on its own isLoginRequired() check and then
-// calls straight into this method, so re-asking the server would add another Login RPC to
-// every interactive login.
-//
-// Use LoginWithDeviceName when the auth state is unknown and a silent (browser-less) login
-// must still be possible; use this when the browser is going to be shown regardless.
-func (a *Auth) LoginInteractive(resultListener ErrListener, urlOpener URLOpener, forceDeviceAuth bool, deviceName string) {
-	a.startLogin(resultListener, urlOpener, forceDeviceAuth, deviceName, true)
-}
-
-func (a *Auth) startLogin(resultListener ErrListener, urlOpener URLOpener, forceDeviceAuth bool, deviceName string, skipLoginCheck bool) {
 	if resultListener == nil {
-		log.Errorf("startLogin: resultListener is nil")
+		log.Errorf("LoginWithDeviceName: resultListener is nil")
 		return
 	}
 	if urlOpener == nil {
-		log.Errorf("startLogin: urlOpener is nil")
+		log.Errorf("LoginWithDeviceName: urlOpener is nil")
 		resultListener.OnError(fmt.Errorf("urlOpener is nil"))
 		return
 	}
 	go func() {
-		err := a.login(urlOpener, forceDeviceAuth, deviceName, skipLoginCheck)
+		err := a.login(urlOpener, forceDeviceAuth, deviceName)
 		if err != nil {
 			resultListener.OnError(err)
 		} else {
@@ -260,7 +241,7 @@ func (a *Auth) startLogin(resultListener ErrListener, urlOpener URLOpener, force
 	}()
 }
 
-func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName string, skipLoginCheck bool) error {
+func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName string) error {
 	// Create context with device name if provided
 	ctx := a.ctx
 	if deviceName != "" {
@@ -274,13 +255,10 @@ func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName strin
 	}
 	defer authClient.Close()
 
-	// check if we need to generate JWT token (skipped when the caller already knows)
-	needsLogin := true
-	if !skipLoginCheck {
-		needsLogin, err = authClient.IsLoginRequired(ctx)
-		if err != nil {
-			return fmt.Errorf("failed to check login requirement: %v", err)
-		}
+	// check if we need to generate JWT token
+	needsLogin, err := authClient.IsLoginRequired(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to check login requirement: %v", err)
 	}
 
 	jwtToken := ""

client/proto/daemon.pb.go

@@ -2781,11 +2781,6 @@ type DebugBundleRequest struct {
 	// untrusted TLS certificate. Restricted to privileged callers; for
 	// self-hosted upload servers.
 	UploadInsecure bool `protobuf:"varint,7,opt,name=uploadInsecure,proto3" json:"uploadInsecure,omitempty"`
-	// anonymizeLevel selects how much the anonymizer redacts: "default"
-	// (or empty) keeps internal IP ranges, "strict" also anonymizes them.
-	// Unknown values are treated as "strict". Only meaningful with anonymize;
-	// "strict" implies it.
-	AnonymizeLevel string `protobuf:"bytes,8,opt,name=anonymizeLevel,proto3" json:"anonymizeLevel,omitempty"`
 	unknownFields  protoimpl.UnknownFields
 	sizeCache      protoimpl.SizeCache
 }
@@ -2862,13 +2857,6 @@ func (x *DebugBundleRequest) GetUploadInsecure() bool {
 	return false
 }
 
-func (x *DebugBundleRequest) GetAnonymizeLevel() string {
-	if x != nil {
-		return x.AnonymizeLevel
-	}
-	return ""
-}
-
 type DebugBundleResponse struct {
 	state               protoimpl.MessageState `protogen:"open.v1"`
 	Path                string                 `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
@@ -7265,7 +7253,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x12translatedHostname\x18\x04 \x01(\tR\x12translatedHostname\x128\n" +
 	"\x0etranslatedPort\x18\x05 \x01(\v2\x10.daemon.PortInfoR\x0etranslatedPort\"G\n" +
 	"\x17ForwardingRulesResponse\x12,\n" +
-	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules\"\x84\x02\n" +
+	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules\"\xdc\x01\n" +
 	"\x12DebugBundleRequest\x12\x1c\n" +
 	"\tanonymize\x18\x01 \x01(\bR\tanonymize\x12\x1e\n" +
 	"\n" +
@@ -7276,8 +7264,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\n" +
 	"cliVersion\x18\x06 \x01(\tR\n" +
 	"cliVersion\x12&\n" +
-	"\x0euploadInsecure\x18\a \x01(\bR\x0euploadInsecure\x12&\n" +
-	"\x0eanonymizeLevel\x18\b \x01(\tR\x0eanonymizeLevel\"}\n" +
+	"\x0euploadInsecure\x18\a \x01(\bR\x0euploadInsecure\"}\n" +
 	"\x13DebugBundleResponse\x12\x12\n" +
 	"\x04path\x18\x01 \x01(\tR\x04path\x12 \n" +
 	"\vuploadedKey\x18\x02 \x01(\tR\vuploadedKey\x120\n" +

client/proto/daemon.proto

@@ -540,11 +540,6 @@ message DebugBundleRequest {
   // untrusted TLS certificate. Restricted to privileged callers; for
   // self-hosted upload servers.
   bool uploadInsecure = 7;
-  // anonymizeLevel selects how much the anonymizer redacts: "default"
-  // (or empty) keeps internal IP ranges, "strict" also anonymizes them.
-  // Unknown values are treated as "strict". Only meaningful with anonymize;
-  // "strict" implies it.
-  string anonymizeLevel = 8;
 }
 
 message DebugBundleResponse {

client/server/debug.go

@@ -16,7 +16,6 @@ import (
 	"google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"
 
-	"github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/internal/debug"
 	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
@@ -123,7 +122,6 @@ func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener deb
 		},
 		debug.BundleConfig{
 			Anonymize:         req.GetAnonymize(),
-			AnonymizeLevel:    anonymize.ParseLevel(req.GetAnonymizeLevel()),
 			IncludeSystemInfo: req.GetSystemInfo(),
 			LogFileCount:      req.GetLogFileCount(),
 		},

client/server/login_outcome_test.go

@@ -1,110 +0,0 @@
-package server
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// A login that never reached Management is not a decision about the peer's
-// credentials, so it must come back as a retryable error rather than an SSO
-// prompt: the user cannot finish a browser login while Management is down, and
-// the CLI's own backoff resolves the outage on its own once the daemon reports
-// the failure. Reproduces `netbird down; netbird up` printing a device-code URL
-// because Management happened to be restarting when the daemon dialed it.
-func TestLogin_ManagementUnreachableIsReturnedInsteadOfDemandingSSO(t *testing.T) {
-	s, _, _, username, _ := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-
-	unreachable := errors.New("create connection: dial context: context deadline exceeded")
-	attempts := 0
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
-		attempts++
-		return false, unreachable
-	}
-
-	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
-	require.Error(t, err)
-	require.ErrorIs(t, err, unreachable, "the transport failure was replaced by something else")
-	require.Nil(t, resp, "a failed login must not answer with a login response")
-	require.Equal(t, 1, attempts)
-	require.Nil(t, s.oauthAuthFlow.flow, "the daemon started an SSO flow for a peer whose login was never decided")
-
-	status, err := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, err)
-	require.Equal(t, internal.StatusLoginFailed, status,
-		"a peer that could not reach Management is not waiting on a login")
-}
-
-// The counterpart: Management refusing the peer's credentials is a decision, and
-// the SSO flow still has to start for it. The profile carries an unusable
-// private key so the flow setup fails immediately instead of dialing, which is
-// enough to show the branch was entered — the refusal itself is never what comes
-// back out.
-func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
-	s, _, _, username, cfgPath := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-	breakProfilePrivateKey(t, cfgPath)
-
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
-		return true, nil
-	}
-
-	_, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
-	require.Error(t, err)
-
-	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, stateErr)
-	require.Equal(t, internal.StatusLoginFailed, status,
-		"the SSO flow setup was never reached with the broken key")
-}
-
-func TestLogin_SetupKeyStillRunsWhenPeerNeedsLogin(t *testing.T) {
-	s, _, _, username, _ := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
-		return true, nil
-	}
-
-	var keysTried []string
-	s.loginAttemptFn = func(_ context.Context, setupKey, _ string) (internal.StatusType, error) {
-		keysTried = append(keysTried, setupKey)
-		return "", nil
-	}
-
-	setupKey := "A2C8E32F-AEB2-4B45-8FD3-8A0C1B2D3E4F"
-	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username, SetupKey: setupKey})
-	require.NoError(t, err, "the probe's outcome leaked out as the login result")
-	require.NotNil(t, resp)
-	require.Equal(t, []string{setupKey}, keysTried, "the setup key never reached the login attempt")
-	require.Nil(t, s.oauthAuthFlow.flow, "a setup-key login started an SSO flow")
-
-	status, err := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, err)
-	require.Equal(t, internal.StatusIdle, status)
-}
-
-// breakProfilePrivateKey replaces the profile's private key with an unparseable
-// one, which makes any attempt to build a Management client fail on the spot.
-func breakProfilePrivateKey(t *testing.T, cfgPath string) {
-	t.Helper()
-
-	raw, err := os.ReadFile(cfgPath)
-	require.NoError(t, err)
-
-	var cfg map[string]any
-	require.NoError(t, json.Unmarshal(raw, &cfg))
-	cfg["PrivateKey"] = "not-a-key"
-
-	patched, err := json.Marshal(cfg)
-	require.NoError(t, err)
-	require.NoError(t, os.WriteFile(cfgPath, patched, 0o600))
-}

client/server/server.go

@@ -135,13 +135,6 @@ type Server struct {
 	updateManager *updater.Manager
 
 	jwtCache *jwtCache
-
-	// loginAttemptFn stands in for the Management login round trip. Tests set
-	// it to drive the login outcomes that need a server on the other end;
-	// production leaves it nil, and every login goes through loginAttempt.
-	loginAttemptFn func(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error)
-
-	isLoginRequiredFn func(ctx context.Context) (bool, error)
 }
 
 type oauthAuthFlow struct {
@@ -377,34 +370,7 @@ func (s *Server) connectionGoroutineRunning() bool {
 	}
 }
 
-// attemptLogin runs a login round trip against Management, or the stand-in a
-// test installed in place of it.
-func (s *Server) attemptLogin(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
-	if s.loginAttemptFn != nil {
-		return s.loginAttemptFn(ctx, setupKey, jwtToken)
-	}
-	return s.loginAttempt(ctx, setupKey, jwtToken)
-}
-
-func (s *Server) isLoginRequired(ctx context.Context) (bool, error) {
-	if s.isLoginRequiredFn != nil {
-		return s.isLoginRequiredFn(ctx)
-	}
-
-	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
-	if err != nil {
-		log.Errorf("failed to create auth client: %v", err)
-		return false, err
-	}
-	defer authClient.Close()
-
-	return authClient.IsLoginRequired(ctx)
-}
-
-// loginAttempt attempts to login using the provided information. It returns
-// StatusNeedsLogin when Management refused the peer's credentials and
-// StatusLoginFailed for every other failure, so callers can tell an
-// authentication decision apart from a login that never got made.
+// loginAttempt attempts to login using the provided information. it returns a status in case something fails
 func (s *Server) loginAttempt(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
 	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
 	if err != nil {
@@ -657,19 +623,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.config = config
 	s.mutex.Unlock()
 
-	// A probe that errors leaves the login undecided: Management unreachable, a
-	// restart mid-request, an internal error. Those are returned for the caller
-	// to retry, because turning them into an SSO prompt asks the user to solve
-	// something that is not theirs to solve, and a browser login cannot succeed
-	// while Management is unreachable anyway. Only Management refusing the
-	// peer's key is a decision, and IsLoginRequired reports that as
-	// needsLogin=true rather than an error.
-	needsLogin, err := s.isLoginRequired(ctx)
-	if err != nil {
-		state.Set(internal.StatusLoginFailed)
-		return nil, err
-	}
-	if !needsLogin {
+	if _, err := s.loginAttempt(ctx, "", ""); err == nil {
 		state.Set(internal.StatusIdle)
 		return &proto.LoginResponse{}, nil
 	}
@@ -730,7 +684,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	// which returns NeedsLogin and parks on the browser leg.
 	state.Set(internal.StatusConnecting)
 
-	if loginStatus, err := s.attemptLogin(ctx, msg.SetupKey, ""); err != nil {
+	if loginStatus, err := s.loginAttempt(ctx, msg.SetupKey, ""); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -885,7 +839,7 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 	s.oauthAuthFlow.expiresAt = time.Now()
 	s.mutex.Unlock()
 
-	if loginStatus, err := s.attemptLogin(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
+	if loginStatus, err := s.loginAttempt(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -1815,9 +1769,6 @@ func (s *Server) RequestExtendAuthSession(
 	if connectClient == nil {
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running")
 	}
-	if connectClient.Engine() == nil {
-		return nil, gstatus.Errorf(codes.FailedPrecondition, "session can no longer be extended, log in again to reconnect")
-	}
 
 	hint := ""
 	if msg.Hint != nil {

client/status/status.go

@@ -46,10 +46,7 @@ func ParseDaemonStatus(s string) DaemonStatus {
 
 // ConvertOptions holds parameters for ConvertToStatusOutputOverview.
 type ConvertOptions struct {
-	Anonymize bool
-	// AnonymizeLevel selects how much the anonymizer redacts. Only
-	// meaningful when Anonymize is set.
-	AnonymizeLevel       anonymize.Level
+	Anonymize            bool
 	DaemonVersion        string
 	DaemonStatus         DaemonStatus
 	StatusFilter         string
@@ -220,7 +217,6 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 
 	if opts.Anonymize {
 		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		anonymizer.SetLevel(opts.AnonymizeLevel)
 		anonymizeOverview(anonymizer, &overview)
 	}
 
@@ -980,7 +976,6 @@ func timeAgo(t time.Time) string {
 
 func anonymizePeerDetail(a *anonymize.Anonymizer, peer *PeerStateDetailOutput) {
 	peer.FQDN = a.AnonymizeDomain(peer.FQDN)
-	peer.PubKey = a.AnonymizeWGKey(peer.PubKey)
 	if localIP, port, err := net.SplitHostPort(peer.IceCandidateEndpoint.Local); err == nil {
 		peer.IceCandidateEndpoint.Local = fmt.Sprintf("%s:%s", a.AnonymizeIPString(localIP), port)
 	}
@@ -1012,7 +1007,6 @@ func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 	overview.SignalState.URL = a.AnonymizeURI(overview.SignalState.URL)
 	overview.SignalState.Error = a.AnonymizeString(overview.SignalState.Error)
 
-	overview.PubKey = a.AnonymizeWGKey(overview.PubKey)
 	overview.IP = a.AnonymizeIPString(overview.IP)
 	overview.IPv6 = a.AnonymizeIPString(overview.IPv6)
 	for i, detail := range overview.Relays.Details {

client/ui/build/linux/nfpm/nfpm.yaml

@@ -26,17 +26,17 @@ contents:
 
 # Default dependencies for the GTK4 + WebKitGTK 6.0 stack (Ubuntu 24.04+ / Debian 13+)
 depends:
-  - libgtk-4-1 (>= 4.14)
+  - libgtk-4-1
   - libwebkitgtk-6.0-4
   - xdg-utils
 
 # Distribution-specific overrides for different package formats
 overrides:
-  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux / openSUSE
+  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux
   rpm:
     depends:
-      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
-      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
+      - gtk4
+      - webkitgtk6.0
       - xdg-utils
 
   # Arch Linux packages

client/ui/frontend/src/contexts/DebugBundleContext.tsx

@@ -71,12 +71,10 @@ type BundleOptions = {
     hasWindow: boolean;
     totalSec: number;
     uploadUrl: string;
-    anonymizeLevel: AnonymizeLevel;
+    anonymize: boolean;
     systemInfo: boolean;
 };
 
-export type AnonymizeLevel = "none" | "default" | "strict";
-
 const startCaptureBestEffort = async (totalSec: number, pcap: CaptureState) => {
     try {
         // Mirror the CLI's safety margin: window + 30s, server caps at 10m.
@@ -189,10 +187,7 @@ const runBundleFlow = async (
 
     if (opts.uploadUrl) setStage({ kind: "uploading" });
     const result = await DebugSvc.Bundle({
-        anonymize: opts.anonymizeLevel !== "none",
-        // The daemon only knows "default" and "strict"; "none" is expressed
-        // through the anonymize flag being off.
-        anonymizeLevel: opts.anonymizeLevel === "strict" ? "strict" : "default",
+        anonymize: opts.anonymize,
         systemInfo: opts.systemInfo,
         uploadUrl: opts.uploadUrl,
         logFileCount,
@@ -203,7 +198,7 @@ const runBundleFlow = async (
 };
 
 const useDebugBundle = () => {
-    const [anonymizeLevel, setAnonymizeLevel] = useState<AnonymizeLevel>("none");
+    const [anonymize, setAnonymize] = useState(false);
     const [systemInfo, setSystemInfo] = useState(true);
     const [upload, setUpload] = useState(true);
     const [trace, setTrace] = useState(true);
@@ -245,7 +240,7 @@ const useDebugBundle = () => {
             hasWindow: capture && totalSec > 0,
             totalSec,
             uploadUrl: upload ? NETBIRD_UPLOAD_URL : "",
-            anonymizeLevel,
+            anonymize,
             systemInfo,
         };
 
@@ -277,8 +272,8 @@ const useDebugBundle = () => {
     };
 
     return {
-        anonymizeLevel,
-        setAnonymizeLevel,
+        anonymize,
+        setAnonymize,
         systemInfo,
         setSystemInfo,
         upload,

client/ui/frontend/src/hooks/useKeepConnectedOnQuit.ts

@@ -1,35 +0,0 @@
-import { useCallback, useEffect, useState } from "react";
-import { Preferences } from "@bindings/services";
-
-export const useKeepConnectedOnQuit = () => {
-    const [keepConnected, setKeepConnected] = useState<boolean | null>(null);
-
-    useEffect(() => {
-        let cancelled = false;
-        Preferences.Get()
-            .then((prefs) => {
-                if (cancelled) return;
-                setKeepConnected(prefs?.keepConnectedOnQuit ?? false);
-            })
-            .catch((err: unknown) => {
-                if (cancelled) return;
-                console.warn("[useKeepConnectedOnQuit] load preferences failed", err);
-                setKeepConnected(false);
-            });
-        return () => {
-            cancelled = true;
-        };
-    }, []);
-
-    const setKeepConnectedOnQuit = useCallback(async (keep: boolean) => {
-        setKeepConnected(keep);
-        try {
-            await Preferences.SetKeepConnectedOnQuit(keep);
-        } catch (err: unknown) {
-            setKeepConnected(!keep);
-            console.error("[useKeepConnectedOnQuit] SetKeepConnectedOnQuit failed", err);
-        }
-    }, []);
-
-    return { keepConnected, setKeepConnectedOnQuit };
-};

client/ui/frontend/src/lib/connection.ts

@@ -43,12 +43,7 @@ function buildSsoCancelPromise(state: SsoState, signal?: AbortSignal): Promise<v
 }
 
 async function runSsoLogin(
-    result: {
-        verificationUri: string;
-        verificationUriComplete: string;
-        userCode: string;
-        profileId: string;
-    },
+    result: { verificationUri: string; verificationUriComplete: string; userCode: string },
     state: SsoState,
     signal?: AbortSignal,
 ): Promise<void> {
@@ -61,7 +56,7 @@ async function runSsoLogin(
     // suspended, so a frontend-driven Up (a promise continuation) would not
     // fire until the user woke the window (e.g. hovering the tray icon).
     const waitPromise = Connection.WaitSSOLoginAndUp(
-        { userCode: result.userCode, hostname: "", profileId: result.profileId },
+        { userCode: result.userCode, hostname: "" },
         { profileName: "", username: "" },
     );
 

client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx

@@ -11,7 +11,7 @@ import { DialogHeading } from "@/components/dialog/DialogHeading";
 import { SquareIcon } from "@/components/SquareIcon";
 import { Connection, Profiles as ProfilesSvc, Session, WindowManager } from "@bindings/services";
 import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
-import { EVENT_BROWSER_LOGIN_CANCEL, EVENT_TRIGGER_LOGIN } from "@/lib/connection";
+import { EVENT_BROWSER_LOGIN_CANCEL } from "@/lib/connection";
 import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
 import { formatRemaining } from "@/lib/formatters";
 
@@ -131,21 +131,6 @@ export default function SessionExpirationDialog() {
         }
     }, [busy, t]);
 
-    const authenticate = useCallback(async () => {
-        if (busy) return;
-        setBusy(true);
-        try {
-            await Events.Emit(EVENT_TRIGGER_LOGIN);
-            await WindowManager.CloseSessionExpiration();
-        } catch (e) {
-            setBusy(false);
-            await errorDialog({
-                Title: t("connect.error.loginTitle"),
-                Message: formatErrorMessage(e),
-            });
-        }
-    }, [busy, t]);
-
     const logout = useCallback(async () => {
         if (busy) return;
         setBusy(true);
@@ -200,7 +185,7 @@ export default function SessionExpirationDialog() {
                     variant={"primary"}
                     size={"md"}
                     className={"w-full"}
-                    onClick={expired ? authenticate : stay}
+                    onClick={stay}
                     disabled={busy}
                 >
                     {expired ? t("sessionExpiration.authenticate") : t("sessionExpiration.stay")}

client/ui/frontend/src/modules/settings/SettingsGeneral.tsx

@@ -11,7 +11,6 @@ import { ManagementServerSwitch } from "@/components/ManagementServerSwitch.tsx"
 import { ManagementMode, useManagementUrl } from "@/hooks/useManagementUrl.ts";
 import { LanguagePicker } from "@/components/LanguagePicker.tsx";
 import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
-import { useKeepConnectedOnQuit } from "@/hooks/useKeepConnectedOnQuit.ts";
 
 export function SettingsGeneral() {
     const { t } = useTranslation();
@@ -20,7 +19,6 @@ export function SettingsGeneral() {
     const { mode, setMode, setUrl, displayUrl, showError, canSave, save, checking, unreachable } =
         useManagementUrl();
     const { mdm, features } = useRestrictions();
-    const { keepConnected, setKeepConnectedOnQuit } = useKeepConnectedOnQuit();
 
     const inputRef = useRef<HTMLInputElement>(null);
     const managementUrlId = useId();
@@ -59,15 +57,6 @@ export function SettingsGeneral() {
                         helpText={t("settings.general.autostart.help")}
                     />
                 )}
-                <FancyToggleSwitch
-                    value={keepConnected ?? false}
-                    onChange={(v) => {
-                        void setKeepConnectedOnQuit(v);
-                    }}
-                    loading={keepConnected === null}
-                    label={t("settings.general.keepConnectedOnQuit.label")}
-                    helpText={t("settings.general.keepConnectedOnQuit.help")}
-                />
             </SectionGroup>
 
             {!mdm.managementURL && !features.disableUpdateSettings && (

client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx

@@ -1,6 +1,6 @@
 import { useId, type ReactNode } from "react";
 import { Trans, useTranslation } from "react-i18next";
-import { ChevronDown, CircleCheckBig, FolderOpen, Info, Loader2 } from "lucide-react";
+import { CircleCheckBig, FolderOpen, Loader2 } from "lucide-react";
 import { Browser } from "@wailsio/runtime";
 import { Debug as DebugSvc } from "@bindings/services";
 import type { DebugBundleResult } from "@bindings/services/models.js";
@@ -8,22 +8,13 @@ import { Button } from "@/components/buttons/Button";
 import { DialogActions } from "@/components/dialog/DialogActions";
 import { DialogDescription } from "@/components/dialog/DialogDescription";
 import { DialogHeading } from "@/components/dialog/DialogHeading";
-import {
-    DropdownMenu,
-    DropdownMenuContent,
-    DropdownMenuRadioGroup,
-    DropdownMenuRadioItem,
-    DropdownMenuTrigger,
-} from "@/components/DropdownMenu";
 import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
 import HelpText from "@/components/typography/HelpText.tsx";
 import { Input } from "@/components/inputs/Input";
 import { Label } from "@/components/typography/Label";
 import { SquareIcon } from "@/components/SquareIcon";
-import { Tooltip } from "@/components/Tooltip";
-import { cn } from "@/lib/cn";
 import { formatRemaining } from "@/lib/formatters";
-import type { AnonymizeLevel, DebugStage } from "@/contexts/DebugBundleContext";
+import type { DebugStage } from "@/contexts/DebugBundleContext";
 import { useDebugBundleContext } from "@/contexts/DebugBundleContext";
 import { SectionGroup, SettingsBottomBar } from "@/modules/settings/SettingsSection.tsx";
 
@@ -33,8 +24,8 @@ export function SettingsTroubleshooting() {
     const { t } = useTranslation();
     const durationId = useId();
     const {
-        anonymizeLevel,
-        setAnonymizeLevel,
+        anonymize,
+        setAnonymize,
         systemInfo,
         setSystemInfo,
         upload,
@@ -64,71 +55,12 @@ export function SettingsTroubleshooting() {
 
     return (
         <SectionGroup title={t("settings.troubleshooting.section.title")}>
-            <div className={"flex items-center justify-between gap-6"}>
-                <div className={"max-w-md flex-1"}>
-                    <Label as={"div"}>
-                        <span className={"inline-flex items-center gap-1.5"}>
-                            {t("settings.troubleshooting.anonymize.label")}
-                            <Tooltip
-                                content={
-                                    <div className={"max-w-xs whitespace-normal leading-relaxed"}>
-                                        {t("settings.troubleshooting.anonymize.info")}
-                                    </div>
-                                }
-                            >
-                                <Info
-                                    size={14}
-                                    aria-label={t("settings.troubleshooting.anonymize.label")}
-                                    className={"shrink-0 cursor-default text-nb-gray-400"}
-                                />
-                            </Tooltip>
-                        </span>
-                    </Label>
-                    <HelpText margin={false}>
-                        {t("settings.troubleshooting.anonymize.help")}
-                    </HelpText>
-                </div>
-                <div className={"shrink-0"}>
-                    <DropdownMenu>
-                        <DropdownMenuTrigger asChild>
-                            <button
-                                type={"button"}
-                                aria-label={t("settings.troubleshooting.anonymize.label")}
-                                className={cn(
-                                    "inline-flex h-[40px] min-w-[160px] items-center justify-between gap-2 px-3",
-                                    "rounded-md border bg-white dark:bg-nb-gray-900",
-                                    "border-neutral-200 dark:border-nb-gray-700",
-                                    "cursor-default text-xs font-semibold text-nb-gray-100 outline-none",
-                                    "hover:border-nb-gray-600 data-[state=open]:border-nb-gray-600",
-                                )}
-                            >
-                                {t(`settings.troubleshooting.anonymize.${anonymizeLevel}`)}
-                                <ChevronDown
-                                    size={16}
-                                    aria-hidden={"true"}
-                                    className={"shrink-0 text-nb-gray-200"}
-                                />
-                            </button>
-                        </DropdownMenuTrigger>
-                        <DropdownMenuContent align={"end"} className={"min-w-[160px]"}>
-                            <DropdownMenuRadioGroup
-                                value={anonymizeLevel}
-                                onValueChange={(v) => setAnonymizeLevel(v as AnonymizeLevel)}
-                            >
-                                <DropdownMenuRadioItem value={"none"}>
-                                    {t("settings.troubleshooting.anonymize.none")}
-                                </DropdownMenuRadioItem>
-                                <DropdownMenuRadioItem value={"default"}>
-                                    {t("settings.troubleshooting.anonymize.default")}
-                                </DropdownMenuRadioItem>
-                                <DropdownMenuRadioItem value={"strict"}>
-                                    {t("settings.troubleshooting.anonymize.strict")}
-                                </DropdownMenuRadioItem>
-                            </DropdownMenuRadioGroup>
-                        </DropdownMenuContent>
-                    </DropdownMenu>
-                </div>
-            </div>
+            <FancyToggleSwitch
+                value={anonymize}
+                onChange={setAnonymize}
+                label={t("settings.troubleshooting.anonymize.label")}
+                helpText={t("settings.troubleshooting.anonymize.help")}
+            />
             <FancyToggleSwitch
                 value={systemInfo}
                 onChange={setSystemInfo}

client/ui/i18n/locales/de/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Ändern des Autostarts fehlgeschlagen"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Nach dem Beenden verbunden bleiben",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "Die Verbindung bleibt im Hintergrund bestehen, nachdem Sie NetBird schließen. Sie endet erst, wenn Sie sie selbst trennen.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Anzeigesprache"
     },

client/ui/i18n/locales/en/common.json

@@ -735,14 +735,6 @@
         "message": "Autostart Change Failed",
         "description": "Error-dialog title when changing the autostart setting fails."
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Stay Connected After Quitting",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "The connection stays up in the background after you close NetBird. It only stops when you disconnect it yourself.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Display Language",
         "description": "Label for the display-language picker."
@@ -1013,27 +1005,11 @@
     },
     "settings.troubleshooting.anonymize.label": {
         "message": "Anonymize Sensitive Information",
-        "description": "Label for the anonymization level dropdown (None, Default, Strict)."
+        "description": "Toggle label: anonymize sensitive information in the bundle."
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Hides IP addresses, domains, and other sensitive values.",
-        "description": "Helper text under the anonymization dropdown. The level details live in the info tooltip."
-    },
-    "settings.troubleshooting.anonymize.info": {
-        "message": "Default keeps internal IPv4 addresses and peer names readable for support. Strict additionally anonymizes private (RFC 1918), CGNAT, and link-local IP addresses, peer names, and WireGuard public keys. Recurring values map to the same placeholder, so peers stay distinguishable. Use Strict when sharing the bundle outside your organization.",
-        "description": "Info tooltip explaining the anonymization levels. 'RFC 1918', 'CGNAT', 'link-local', and 'WireGuard' are technical terms — keep them."
-    },
-    "settings.troubleshooting.anonymize.none": {
-        "message": "None",
-        "description": "Dropdown option: no anonymization."
-    },
-    "settings.troubleshooting.anonymize.default": {
-        "message": "Default",
-        "description": "Dropdown option: default anonymization level."
-    },
-    "settings.troubleshooting.anonymize.strict": {
-        "message": "Strict",
-        "description": "Dropdown option: strict anonymization level."
+        "message": "Hides public IP addresses and non-NetBird domains from logs.",
+        "description": "Helper text for anonymizing logs (hides public IPs and non-NetBird domains)."
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Include System Information",

client/ui/i18n/locales/es/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Error al cambiar el inicio automático"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Permanecer conectado al salir",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La conexión sigue activa en segundo plano después de cerrar NetBird. Solo se detiene cuando la desconectas tú.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Idioma de la interfaz"
     },

client/ui/i18n/locales/fr/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Échec de la modification du démarrage automatique"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Rester connecté après la fermeture",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La connexion reste active en arrière-plan après la fermeture de NetBird. Elle ne s'arrête que si vous la coupez vous-même.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Langue d’affichage"
     },

client/ui/i18n/locales/hu/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Az automatikus indítás módosítása sikertelen"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Kapcsolat megtartása kilépéskor",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "A kapcsolat a háttérben megmarad, miután bezárod a NetBirdöt. Csak akkor szakad meg, ha te magad bontod.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Megjelenítési nyelv"
     },

client/ui/i18n/locales/it/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Modifica avvio automatico non riuscita"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Resta connesso dopo la chiusura",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La connessione resta attiva in background dopo la chiusura di NetBird. Si interrompe solo quando la disconnetti tu.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Lingua dell'interfaccia"
     },

client/ui/i18n/locales/ja/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "自動起動の変更に失敗しました"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "終了後も接続を維持",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "NetBird を閉じたあとも接続はバックグラウンドで維持されます。自分で切断したときにだけ停止します。",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "表示言語"
     },

client/ui/i18n/locales/pt/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Falha ao alterar o início automático"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Permanecer conectado ao sair",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "A conexão continua ativa em segundo plano depois de fechar o NetBird. Ela só para quando você mesmo a desconecta.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Idioma de exibição"
     },

client/ui/i18n/locales/ru/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Не удалось изменить автозапуск"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Оставаться подключённым после выхода",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "Соединение остаётся активным в фоне после закрытия NetBird. Оно прервётся, только когда вы отключите его сами.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Язык интерфейса"
     },

client/ui/i18n/locales/zh-CN/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "更改自启动设置失败"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "退出后保持连接",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "关闭 NetBird 后，连接会在后台保持。只有你自己断开时才会停止。",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "显示语言"
     },

client/ui/main.go

@@ -14,6 +14,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/application"
 	"github.com/wailsapp/wails/v3/pkg/events"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
@@ -62,7 +63,7 @@ type registeredServices struct {
 	profiles        *services.Profiles
 	update          *services.Update
 	daemonFeed      *services.DaemonFeed
-	notifier        *Notifier
+	notifier        *notifications.NotificationService
 	compat          *services.Compat
 	profileSwitcher *services.ProfileSwitcher
 	bundle          *i18n.Bundle
@@ -101,7 +102,7 @@ func main() {
 	updaterHolder := updater.NewHolder(app.Event)
 	update := services.NewUpdate(conn, updaterHolder)
 	daemonFeed := services.NewDaemonFeed(conn, app.Event, updaterHolder, debugLog)
-	notifier := newNotifier()
+	notifier := notifications.New()
 	compat := services.NewCompat(conn)
 	// macOS shows no toast until permission is requested. Run it after
 	// ApplicationStarted so the notifier's Startup has initialised the
@@ -180,7 +181,6 @@ func main() {
 		WindowManager:   windowManager,
 		Session:         authSession,
 		Localizer:       localizer,
-		Preferences:     prefStore,
 	})
 	listenForShowSignal(context.Background(), tray)
 
@@ -210,7 +210,7 @@ func main() {
 // requestNotificationAuthorization prompts for macOS notification permission.
 // The request blocks until the user responds (up to 3 minutes), so callers run
 // it in a goroutine. No-op on Linux/Windows.
-func requestNotificationAuthorization(notifier *Notifier) {
+func requestNotificationAuthorization(notifier *notifications.NotificationService) {
 	authorized, err := notifier.CheckNotificationAuthorization()
 	if err != nil {
 		logrus.Debugf("check notification authorization: %v", err)

client/ui/notifier.go

@@ -1,101 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"context"
-	"errors"
-	"sync/atomic"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/wailsapp/wails/v3/pkg/application"
-	"github.com/wailsapp/wails/v3/pkg/services/notifications"
-)
-
-var errNotificationsUnavailable = errors.New("notifications unavailable")
-
-// Notifier wraps the Wails notification service so an unavailable backend
-// disables notifications instead of aborting the app. Startup fails for
-// environment reasons (a bare unbundled binary on macOS has no bundle
-// identifier, a headless Linux session has no D-Bus session bus), and Wails
-// treats a service startup error as fatal. After a failed startup every call
-// is a no-op: on macOS, touching UNUserNotificationCenter without a bundle
-// identifier raises an Objective-C exception that recover() cannot catch.
-type Notifier struct {
-	inner     *notifications.NotificationService
-	available atomic.Bool
-}
-
-func newNotifier() *Notifier {
-	return &Notifier{inner: notifications.New()}
-}
-
-// ServiceName implements the Wails service-name hook for startup logs.
-func (n *Notifier) ServiceName() string {
-	return n.inner.ServiceName()
-}
-
-// ServiceStartup starts the platform notifier, downgrading failure to a
-// warning so the app keeps running without notifications.
-func (n *Notifier) ServiceStartup(ctx context.Context, options application.ServiceOptions) error {
-	if err := n.inner.ServiceStartup(ctx, options); err != nil {
-		log.Warnf("notifications disabled: %v", err)
-		return nil
-	}
-	n.available.Store(true)
-	return nil
-}
-
-func (n *Notifier) ServiceShutdown() error {
-	if !n.available.Load() {
-		return nil
-	}
-	return n.inner.ServiceShutdown()
-}
-
-func (n *Notifier) CheckNotificationAuthorization() (bool, error) {
-	if !n.available.Load() {
-		return false, errNotificationsUnavailable
-	}
-	return n.inner.CheckNotificationAuthorization()
-}
-
-func (n *Notifier) RequestNotificationAuthorization() (bool, error) {
-	if !n.available.Load() {
-		return false, errNotificationsUnavailable
-	}
-	return n.inner.RequestNotificationAuthorization()
-}
-
-// SendNotification delivers a notification, silently dropping it when the
-// backend never started (notifications are best-effort everywhere).
-func (n *Notifier) SendNotification(options notifications.NotificationOptions) error {
-	if !n.available.Load() {
-		log.Debugf("notifications disabled, dropping %q", options.ID)
-		return nil
-	}
-	return n.inner.SendNotification(options)
-}
-
-func (n *Notifier) SendNotificationWithActions(options notifications.NotificationOptions) error {
-	if !n.available.Load() {
-		log.Debugf("notifications disabled, dropping %q", options.ID)
-		return nil
-	}
-	return n.inner.SendNotificationWithActions(options)
-}
-
-func (n *Notifier) RegisterNotificationCategory(category notifications.NotificationCategory) error {
-	if !n.available.Load() {
-		return nil
-	}
-	return n.inner.RegisterNotificationCategory(category)
-}
-
-// OnNotificationResponse registers the response callback. Pure Go state, so
-// it is safe (and simply inert) when the backend never started.
-//
-//wails:ignore
-func (n *Notifier) OnNotificationResponse(callback func(result notifications.NotificationResult)) {
-	n.inner.OnNotificationResponse(callback)
-}

client/ui/preferences/store.go

@@ -58,10 +58,6 @@ type UIPreferences struct {
 	// decision has run for this OS user. It only ever transitions to true
 	// and is never reset, so the default-on flow runs at most once, ever.
 	AutostartInitialized bool `json:"autostartInitialized"`
-	// KeepConnectedOnQuit leaves the daemon connected when the GUI quits.
-	// Its false zero value preserves the historical disconnect-on-quit
-	// behaviour for preference files written before the field existed.
-	KeepConnectedOnQuit bool `json:"keepConnectedOnQuit"`
 }
 
 // LanguageValidator rejects SetLanguage inputs with no shipped bundle.
@@ -187,26 +183,6 @@ func (s *Store) SetAutostartInitialized(done bool) error {
 	return nil
 }
 
-// SetKeepConnectedOnQuit persists the disconnect-on-quit opt-out. No-op if unchanged.
-func (s *Store) SetKeepConnectedOnQuit(keep bool) error {
-	s.mu.Lock()
-	if s.current.KeepConnectedOnQuit == keep {
-		s.mu.Unlock()
-		return nil
-	}
-	next := s.current
-	next.KeepConnectedOnQuit = keep
-	if err := s.persistLocked(next); err != nil {
-		s.mu.Unlock()
-		return fmt.Errorf("persist preferences: %w", err)
-	}
-	s.current = next
-	s.mu.Unlock()
-
-	s.broadcast(next)
-	return nil
-}
-
 // SetLanguage validates, persists, and broadcasts. No-op if unchanged.
 func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
 	if lang == "" {
@@ -270,7 +246,6 @@ func (s *Store) ExistedAtLoad() bool {
 func (s *Store) load() error {
 	if _, err := os.Stat(s.path); err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			log.Infof("no ui preferences file at %s; using defaults", s.path)
 			return nil
 		}
 		return fmt.Errorf("stat preferences: %w", err)

client/ui/preferences/store_test.go

@@ -238,42 +238,6 @@ func TestStore_SetAutostartInitializedPersistsAcrossReload(t *testing.T) {
 	assert.True(t, reloaded.Get().AutostartInitialized, "marker must survive a reload from disk")
 }
 
-func TestStore_SetKeepConnectedOnQuitPersistsAcrossReload(t *testing.T) {
-	withTempConfigDir(t)
-	emitter := &recordingEmitter{}
-	s, err := NewStore(nil, emitter)
-	require.NoError(t, err)
-
-	assert.False(t, s.Get().KeepConnectedOnQuit, "quitting must disconnect by default")
-
-	require.NoError(t, s.SetKeepConnectedOnQuit(true))
-	assert.True(t, s.Get().KeepConnectedOnQuit, "Get should reflect the persisted opt-out")
-	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first write should broadcast")
-
-	require.NoError(t, s.SetKeepConnectedOnQuit(true))
-	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent write should not broadcast again")
-
-	reloaded, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.True(t, reloaded.Get().KeepConnectedOnQuit, "opt-out must survive a reload from disk")
-}
-
-func TestStore_KeepConnectedOnQuitDefaultsFalseForPreExistingFile(t *testing.T) {
-	withTempConfigDir(t)
-
-	// A preferences file written before the field existed must keep the
-	// historical disconnect-on-quit behaviour rather than silently opting out.
-	path, err := preferencesPath()
-	require.NoError(t, err)
-	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
-	require.NoError(t, os.WriteFile(path, []byte(`{"language":"en","viewMode":"default"}`), 0o600))
-
-	s, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.False(t, s.Get().KeepConnectedOnQuit, "a file predating the field must not opt out of disconnect-on-quit")
-	assert.True(t, s.ExistedAtLoad(), "the pre-existing file must be seen on disk")
-}
-
 func TestStore_ExistedAtLoad(t *testing.T) {
 	withTempConfigDir(t)
 

client/ui/services/connection.go

@@ -33,21 +33,12 @@ type LoginResult struct {
 	UserCode                string `json:"userCode"`
 	VerificationURI         string `json:"verificationUri"`
 	VerificationURIComplete string `json:"verificationUriComplete"`
-	// ProfileID is the ID of the profile this login ran against, or "" when the
-	// caller named the profile itself and no ID was resolved. Pass it back in
-	// WaitSSOParams so the account email lands on this profile even if the
-	// active one changes during SSO.
-	ProfileID string `json:"profileId"`
 }
 
 // WaitSSOParams are the inputs to waitSSOLogin.
 type WaitSSOParams struct {
 	UserCode string `json:"userCode"`
 	Hostname string `json:"hostname"`
-	// ProfileID is the profile the login was started for, used to file the
-	// account email against it rather than against whichever profile is active
-	// when the flow returns. Optional: empty falls back to the active profile.
-	ProfileID string `json:"profileId"`
 }
 
 // UpParams selects the profile to bring up.
@@ -86,16 +77,11 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	// Fall back to the daemon's active profile and the current OS user.
 	profileName := p.ProfileName
 	username := p.Username
-	// Only set when the daemon told us the ID. A caller-supplied ProfileName is
-	// a handle — a display name or an ID prefix resolve too — and the state file
-	// is named after the ID, so passing a handle on would name the wrong file.
-	profileID := ""
 	if profileName == "" {
 		if active, aerr := cli.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{}); aerr == nil {
 			// Address the active profile by ID (the daemon resolves it as a
 			// handle); names can collide, the ID cannot.
 			profileName = active.GetId()
-			profileID = profileName
 			if username == "" {
 				username = active.GetUsername()
 			}
@@ -136,7 +122,6 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 		UserCode:                resp.GetUserCode(),
 		VerificationURI:         resp.GetVerificationURI(),
 		VerificationURIComplete: resp.GetVerificationURIComplete(),
-		ProfileID:               profileID,
 	}, nil
 }
 
@@ -257,31 +242,6 @@ func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string,
 		return "", s.classifyDaemonError(err)
 	}
 	log.Infof("SSO login completed, daemon reported success")
-
-	// Persist the account email the same way the CLI does after its own
-	// WaitSSOLogin: the daemon returns it but cannot store it, since it runs as
-	// root and the per-profile state file is user-owned (see Logout below).
-	// Without this the profile has no email, so Profiles.List shows no account
-	// and later logins and session extends go out without a login_hint —
-	// leaving the IdP to guess which account was meant.
-	if email := resp.GetEmail(); email != "" {
-		state := &profilemanager.ProfileState{Email: email}
-		pm := profilemanager.NewProfileManager()
-
-		// Against the profile the login was started for: SSO spans seconds of
-		// user interaction, and a profile switch in that window would otherwise
-		// file the email under the wrong profile.
-		if p.ProfileID != "" {
-			err = pm.SetProfileState(profilemanager.ID(p.ProfileID), state)
-		} else {
-			err = pm.SetActiveProfileState(state)
-		}
-		if err != nil {
-			// Non-fatal: the login itself succeeded.
-			log.Warnf("failed to store account email: %v", err)
-		}
-	}
-
 	return resp.GetEmail(), nil
 }
 

client/ui/services/cursor_linux.go

@@ -49,11 +49,5 @@ func getCursorPosition(app *application.App) (application.Point, bool) {
 	if app == nil || app.Screen == nil {
 		return p, true
 	}
-	// The wails GTK3 backend caches screens from the active window; a tray app
-	// has none at startup, so the cache is empty and PhysicalToDipPoint would
-	// dereference a nil nearest screen. Raw pixels are correct there anyway.
-	if app.Screen.ScreenNearestPhysicalPoint(p) == nil {
-		return p, true
-	}
 	return app.Screen.PhysicalToDipPoint(p), true
 }

client/ui/services/debug.go

@@ -15,13 +15,10 @@ import (
 )
 
 type DebugBundleParams struct {
-	Anonymize bool `json:"anonymize"`
-	// AnonymizeLevel is "default" or "strict"; strict also anonymizes
-	// private IP ranges, peer names, and WireGuard public keys.
-	AnonymizeLevel string `json:"anonymizeLevel"`
-	SystemInfo     bool   `json:"systemInfo"`
-	UploadURL      string `json:"uploadUrl"`
-	LogFileCount   uint32 `json:"logFileCount"`
+	Anonymize    bool   `json:"anonymize"`
+	SystemInfo   bool   `json:"systemInfo"`
+	UploadURL    string `json:"uploadUrl"`
+	LogFileCount uint32 `json:"logFileCount"`
 }
 
 // DebugBundleResult: Path is set for local-only bundles, UploadedKey on upload
@@ -51,12 +48,11 @@ func (s *Debug) Bundle(ctx context.Context, p DebugBundleParams) (DebugBundleRes
 		return DebugBundleResult{}, err
 	}
 	resp, err := cli.DebugBundle(ctx, &proto.DebugBundleRequest{
-		Anonymize:      p.Anonymize,
-		AnonymizeLevel: p.AnonymizeLevel,
-		SystemInfo:     p.SystemInfo,
-		UploadURL:      p.UploadURL,
-		LogFileCount:   p.LogFileCount,
-		CliVersion:     version.NetbirdVersion(),
+		Anonymize:    p.Anonymize,
+		SystemInfo:   p.SystemInfo,
+		UploadURL:    p.UploadURL,
+		LogFileCount: p.LogFileCount,
+		CliVersion:   version.NetbirdVersion(),
 	})
 	if err != nil {
 		return DebugBundleResult{}, err

client/ui/services/preferences.go

@@ -34,7 +34,3 @@ func (s *Preferences) SetViewMode(_ context.Context, mode preferences.ViewMode)
 func (s *Preferences) SetOnboardingCompleted(_ context.Context, done bool) error {
 	return s.store.SetOnboardingCompleted(done)
 }
-
-func (s *Preferences) SetKeepConnectedOnQuit(_ context.Context, keep bool) error {
-	return s.store.SetKeepConnectedOnQuit(keep)
-}

client/ui/services/profile.go

@@ -6,8 +6,6 @@ import (
 	"context"
 	"os/user"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 )
@@ -153,31 +151,11 @@ func (s *Profiles) Remove(ctx context.Context, p ProfileRef) error {
 	if err != nil {
 		return err
 	}
-	resp, err := cli.RemoveProfile(ctx, &proto.RemoveProfileRequest{
+	_, err = cli.RemoveProfile(ctx, &proto.RemoveProfileRequest{
 		ProfileName: p.ProfileName,
 		Username:    p.Username,
 	})
-	if err != nil {
-		return err
-	}
-
-	// The daemon deletes what it owns but runs as root, so it leaves the
-	// user-owned state file holding the account email behind (same split as
-	// Connection.Logout). Legacy profiles are keyed by name rather than by a
-	// generated ID, so a recreated profile of the same name would inherit the
-	// deleted one's email and offer it as the login_hint.
-	//
-	// Keyed on the ID the daemon resolved, not on the request handle: that may
-	// have been a display name or an ID prefix, which would name a different
-	// file (or none).
-	if id := resp.GetId(); id != "" {
-		if err := profilemanager.NewProfileManager().RemoveProfileState(id); err != nil {
-			// Non-fatal: the profile itself is gone.
-			log.Warnf("failed to remove profile state for %s: %v", id, err)
-		}
-	}
-
-	return nil
+	return err
 }
 
 // Rename changes a profile's display name. The on-disk ID is unaffected, so

client/ui/tray.go

@@ -16,7 +16,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
-	"github.com/netbirdio/netbird/client/ui/preferences"
 	"github.com/netbirdio/netbird/client/ui/services"
 	"github.com/netbirdio/netbird/version"
 )
@@ -45,15 +44,14 @@ type TrayServices struct {
 	Profiles        *services.Profiles
 	Networks        *services.Networks
 	DaemonFeed      *services.DaemonFeed
-	Notifier        *Notifier
+	Notifier        *notifications.NotificationService
 	Update          *services.Update
 	ProfileSwitcher *services.ProfileSwitcher
 	WindowManager   *services.WindowManager
 	// Session is bound to authsession directly because the services wrapper
 	// only re-exposes the React subset.
-	Session     *authsession.Session
-	Localizer   *Localizer
-	Preferences *preferences.Store
+	Session   *authsession.Session
+	Localizer *Localizer
 }
 
 type Tray struct {
@@ -463,12 +461,10 @@ func (t *Tray) handleQuit() {
 	t.profileMu.Unlock()
 	t.svc.DaemonFeed.CancelProfileSwitch()
 
-	if t.svc.Preferences == nil || !t.svc.Preferences.Get().KeepConnectedOnQuit {
-		ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
-		defer cancel()
-		if err := t.svc.Connection.Down(ctx); err != nil {
-			log.Errorf("disconnect on quit: %v", err)
-		}
+	ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
+	defer cancel()
+	if err := t.svc.Connection.Down(ctx); err != nil {
+		log.Errorf("disconnect on quit: %v", err)
 	}
 	t.app.Quit()
 }

client/ui/tray_click_linux.go

@@ -4,26 +4,17 @@ package main
 
 // bindTrayClick wires the tray icon's left-click handler on Linux.
 //
-// Expected behaviour per tray host:
-//
-//	Host                           Left click              Right click
-//	KDE Plasma, Waybar             main window (Activate)  menu (host-rendered)
-//	GNOME Shell + AppIndicator     menu only               menu only
-//	Minimal WMs via XEmbed host    main window (Activate)  XEmbed GTK popup
-//
-// OnClick fires only on org.kde.StatusNotifierItem.Activate — a real left
-// click. KDE/Waybar send it over D-Bus; the in-process XEmbed host
-// (xembed_host_linux.go) maps a Button1 press to the same Activate call.
-//
-// GNOME Shell + AppIndicator never sends Activate: it renders the dbusmenu
-// on ANY click and only reports the menu opening via dbusmenu
-// Event("opened"). Upstream Wails treated that event as a click, so on GNOME
-// both buttons raised the main window on top of the menu, and on KDE/Waybar
-// a right click raised it over the freshly opened menu. The netbirdio/wails
-// fork (go.mod replace) drops that heuristic: a menu open never fires
-// OnClick. On GNOME the main window is reached via the "Open NetBird" menu
-// entry; left-click-opens-window is not achievable there anyway, since the
-// host always opens the menu itself.
+// Both Linux click paths converge on Wails' linuxSystemTray.Activate, which
+// fires the registered clickHandler:
+//   - Real SNI hosts (KDE Plasma, Waybar, GNOME Shell + AppIndicator) invoke
+//     org.kde.StatusNotifierItem.Activate over D-Bus on left-click.
+//   - The in-process StatusNotifierWatcher + XEmbed host used on minimal WMs
+//     (Fluxbox, i3, dwm, OpenBox) maps a Button1 press to that same Activate
+//     call itself (xembed_host_linux.go), so it routes through the same hook.
+// Registering OnClick here therefore covers both paths with one handler — no
+// changes to the watcher or XEmbed C code are needed. Left-click now opens the
+// main window; right-click still opens the menu via Wails' default
+// SecondaryActivate→OpenMenu handler (and the XEmbed GTK popup on minimal WMs).
 //
 // We do NOT register OnDoubleClick: Wails' Linux SNI backend never fires it
 // (unlike Windows). And we deliberately skip AttachWindow — it plus Wails3's

client/ui/tray_notify.go

@@ -44,7 +44,7 @@ func safeSendNotification(send sendFn, what string, opts notifications.Notificat
 // notifyIfDaemonOutdated probes the daemon once and fires an OS toast when it
 // is reachable but too old for this UI. A probe error means the daemon isn't
 // reachable (not outdated), so it is left to the normal connection flow.
-func notifyIfDaemonOutdated(compat *services.Compat, notifier *Notifier, loc *Localizer) {
+func notifyIfDaemonOutdated(compat *services.Compat, notifier *notifications.NotificationService, loc *Localizer) {
 	ready, err := compat.DaemonReady(context.Background())
 	if err != nil {
 		log.Debugf("daemon compatibility probe: %v", err)

client/ui/tray_session.go

@@ -27,10 +27,11 @@ const (
 	finalWarningCountdownSeconds = 120
 )
 
-// handleSessionExpired notifies and brings the window forward so the user can reconnect.
+// handleSessionExpired notifies and brings the window forward so the frontend's /login route drives renewal.
 func (t *Tray) handleSessionExpired() {
 	t.notify(t.loc.T("notify.sessionExpired.title"), t.loc.T("notify.sessionExpired.body"), notifyIDSessionExpired)
 	if t.window != nil {
+		t.window.SetURL("/#/login")
 		t.window.Show()
 		t.window.Focus()
 	}
@@ -307,7 +308,11 @@ func (t *Tray) openSessionExtendFlow() {
 	}
 	seconds := int(time.Until(deadline).Seconds())
 	if seconds <= 0 {
-		t.app.Event.Emit(services.EventTriggerLogin)
+		if t.window != nil {
+			t.window.SetURL("/#/login")
+			t.window.Show()
+			t.window.Focus()
+		}
 		return
 	}
 	if t.svc.WindowManager == nil {

client/ui/tray_update.go

@@ -21,7 +21,7 @@ type trayUpdater struct {
 	app          *application.App
 	window       *application.WebviewWindow
 	update       *services.Update
-	notifier     *Notifier
+	notifier     *notifications.NotificationService
 	loc          *Localizer
 	onIconChange func()
 	// onMenuChange drives a full tray relayout: the update row lives in the
@@ -36,7 +36,7 @@ type trayUpdater struct {
 	progressWindowOpen bool
 }
 
-func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
+func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *notifications.NotificationService, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
 	u := &trayUpdater{
 		app:          app,
 		window:       window,

client/ui/xembed_host_gtk3_linux.go

@@ -1,40 +0,0 @@
-//go:build linux && gtk3 && !(linux && 386)
-
-package main
-
-import (
-	"errors"
-
-	"github.com/godbus/dbus/v5"
-)
-
-// The legacy GTK3 / WebKit2GTK 4.1 build (-tags gtk3) drops the in-process
-// XEmbed StatusNotifierWatcher entirely. The real implementation
-// (xembed_host_linux.go + xembed_tray_linux.c) links GTK4 and uses GTK4-only
-// popup-menu APIs that have no drop-in GTK3 equivalent, so rather than port the
-// C layer we stub the host out on gtk3 builds. The tray still works on every
-// desktop that ships its own StatusNotifierWatcher (KDE, GNOME+AppIndicator,
-// Cinnamon/xapp, XFCE, …); only the minimal-WM fallback (Fluxbox/OpenBox/i3/
-// dwm/vanilla GNOME) is unavailable on gtk3 packages. See LINUX-TRAY.md.
-
-// xembedHost is a placeholder so the package compiles on gtk3 builds; the real
-// type (with X11/GTK4 state) lives in xembed_host_linux.go. It is never
-// instantiated here because xembedTrayAvailable always reports false.
-type xembedHost struct{}
-
-// run satisfies the call in tray_watcher_linux.go; unreachable on gtk3 because
-// newXembedHost never returns a non-nil host.
-func (*xembedHost) run() {}
-
-// xembedTrayAvailable always reports false on gtk3 builds, so the watcher probe
-// loop in startStatusNotifierWatcher exits immediately and newXembedHost is
-// never reached. recenter_linux.go's predicate becomes a harmless no-op too.
-func xembedTrayAvailable() bool {
-	return false
-}
-
-// newXembedHost exists only to satisfy the reference in tray_watcher_linux.go;
-// it is unreachable because xembedTrayAvailable returns false on gtk3.
-func newXembedHost(conn *dbus.Conn, busName string, objPath dbus.ObjectPath) (*xembedHost, error) {
-	return nil, errors.New("xembed host unsupported on gtk3 build")
-}

client/ui/xembed_host_linux.go

@@ -1,4 +1,4 @@
-//go:build linux && !gtk3 && !(linux && 386)
+//go:build linux && !(linux && 386)
 
 package main
 

client/ui/xembed_tray_linux.c

@@ -1,5 +1,3 @@
-//go:build linux && !gtk3 && !(linux && 386)
-
 #include "xembed_tray_linux.h"
 
 #include <X11/Xatom.h>

e2e/agentnetwork/management_test.go

@@ -160,19 +160,8 @@ func TestSettingsRoundTrip(t *testing.T) {
 	assert.Equal(t, before.Cluster, flipped.Cluster, "cluster must be immutable across updates")
 	assert.Equal(t, before.Subdomain, flipped.Subdomain, "subdomain must be immutable across updates")
 
-	// A cluster different from the pinned one must be rejected; echoing the
-	// pinned one back is valid.
-	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:                ptr("attacker.cluster.invalid"),
-		EnableLogCollection:    before.EnableLogCollection,
-		EnablePromptCollection: before.EnablePromptCollection,
-		RedactPii:              before.RedactPii,
-	})
-	requireClientError(t, err)
-
 	// Restore the original toggles.
 	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:                ptr(before.Cluster),
 		EnableLogCollection:    before.EnableLogCollection,
 		EnablePromptCollection: before.EnablePromptCollection,
 		RedactPii:              before.RedactPii,

e2e/agentnetwork/settings_bootstrap_test.go

@@ -1,114 +0,0 @@
-//go:build e2e
-
-package agentnetwork
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/e2e/harness"
-	"github.com/netbirdio/netbird/shared/management/http/api"
-)
-
-// harnessStartFresh boots a dedicated combined server with its own fresh
-// account and registers its teardown on t.
-func harnessStartFresh(ctx context.Context, t *testing.T) (*harness.Combined, error) {
-	t.Helper()
-	fresh, err := harness.StartCombined(ctx)
-	if err != nil {
-		return nil, err
-	}
-	t.Cleanup(func() { _ = fresh.Terminate(context.Background()) })
-	if _, err := fresh.Bootstrap(ctx); err != nil {
-		return nil, err
-	}
-	return fresh, nil
-}
-
-// TestSettingsBootstrapViaPut covers the settings-first bootstrap path on an
-// account that has never been bootstrapped: the GET reads as the defaults
-// with an empty cluster/subdomain/endpoint, a PUT without a cluster has
-// nothing to pin and fails, and a PUT carrying a cluster creates the row and
-// pins it immutably. The shared srv cannot provide that starting state (any
-// provider-creating test bootstraps it, and test order is deliberately not
-// relied on), so this boots a dedicated combined server — the image is
-// already built and cached by TestMain's StartCombined, so the extra cost is
-// one container start.
-func TestSettingsBootstrapViaPut(t *testing.T) {
-	ctx := context.Background()
-
-	fresh, err := harnessStartFresh(ctx, t)
-	require.NoError(t, err, "start dedicated combined server")
-
-	// Before agent-network bootstrap the settings read as the defaults, not
-	// as an error and not as a null body.
-	before, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings on a fresh account must succeed")
-	assert.Empty(t, before.Cluster, "cluster must be empty before bootstrap")
-	assert.Empty(t, before.Subdomain, "subdomain must be empty before bootstrap")
-	assert.Empty(t, before.Endpoint, "endpoint must be empty before bootstrap, not a bare dot")
-	assert.True(t, before.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
-	assert.False(t, before.EnablePromptCollection, "defaults must show prompt collection off")
-
-	// A PUT without a cluster has nothing to pin the account to.
-	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		EnableLogCollection: true,
-	})
-	requireClientError(t, err)
-
-	// A PUT carrying a cluster bootstraps the account and applies the
-	// mutable fields from the same request. Every toggle is set away from
-	// its bootstrap default so each assertion can actually fail.
-	const cluster = "e2e.bootstrap.netbird.selfhosted"
-	bootstrapped, err := fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:                ptr(cluster),
-		EnableLogCollection:    false,
-		EnablePromptCollection: true,
-		RedactPii:              true,
-	})
-	require.NoError(t, err, "bootstrap settings via PUT must succeed")
-	assert.Equal(t, cluster, bootstrapped.Cluster, "cluster must be pinned from the request")
-	require.NotEmpty(t, bootstrapped.Subdomain, "subdomain must be assigned at bootstrap")
-	assert.Equal(t, bootstrapped.Subdomain+"."+cluster, bootstrapped.Endpoint, "endpoint must combine subdomain and cluster")
-	assert.False(t, bootstrapped.EnableLogCollection, "log collection from the bootstrap request must override the default")
-	assert.True(t, bootstrapped.EnablePromptCollection, "prompt collection from the bootstrap request must apply")
-	assert.True(t, bootstrapped.RedactPii, "redact toggle from the bootstrap request must apply")
-
-	// The row is persisted: an independent read agrees on every field.
-	after, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings after bootstrap must succeed")
-	assert.Equal(t, bootstrapped.Endpoint, after.Endpoint, "bootstrap must persist across reads")
-	assert.Equal(t, bootstrapped.EnableLogCollection, after.EnableLogCollection, "log collection must persist")
-	assert.Equal(t, bootstrapped.EnablePromptCollection, after.EnablePromptCollection, "prompt collection must persist")
-	assert.Equal(t, bootstrapped.RedactPii, after.RedactPii, "redact toggle must persist")
-
-	// Once bootstrapped, later updates may omit the cluster entirely.
-	persisted, err := fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		EnableLogCollection:    true,
-		EnablePromptCollection: false,
-		RedactPii:              true,
-	})
-	require.NoError(t, err, "post-bootstrap update without cluster must succeed")
-	assert.Equal(t, cluster, persisted.Cluster, "omitted cluster must keep the pinned value")
-	assert.True(t, persisted.EnableLogCollection, "post-bootstrap toggle must apply")
-	assert.False(t, persisted.EnablePromptCollection, "post-bootstrap toggle must apply")
-
-	// The cluster is immutable: a different value is rejected rather than
-	// silently ignored, and the rejected update must not disturb anything.
-	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
-		Cluster:             ptr("other.cluster.invalid"),
-		EnableLogCollection: false,
-	})
-	requireClientError(t, err)
-
-	final, err := fresh.GetSettings(ctx)
-	require.NoError(t, err, "get settings after the rejected cluster change must succeed")
-	assert.Equal(t, persisted.Cluster, final.Cluster, "rejected update must not change the cluster")
-	assert.Equal(t, persisted.Endpoint, final.Endpoint, "rejected update must not change the endpoint")
-	assert.Equal(t, persisted.EnableLogCollection, final.EnableLogCollection, "rejected update must not apply its toggles")
-	assert.Equal(t, persisted.EnablePromptCollection, final.EnablePromptCollection, "rejected update must not apply its toggles")
-	assert.Equal(t, persisted.RedactPii, final.RedactPii, "rejected update must not apply its toggles")
-}

go.mod

@@ -114,7 +114,7 @@ require (
 	github.com/ti-mo/conntrack v0.5.1
 	github.com/ti-mo/netfilter v0.5.2
 	github.com/vmihailenco/msgpack/v5 v5.4.1
-	github.com/wailsapp/wails/v3 v3.0.0-beta.3
+	github.com/wailsapp/wails/v3 v3.0.0-alpha2.117
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
@@ -339,5 +339,3 @@ replace github.com/dexidp/dex => github.com/netbirdio/dex v0.244.1-0.20260716205
 replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-20260512110716-8d70ad8647c1
 
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
-
-replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701

go.sum

@@ -490,8 +490,6 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701 h1:QL9nupfRom0L9jcY7N9l/Bc6QK2PtC6pHzC+ftpTqpw=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
@@ -662,6 +660,8 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.117 h1:udyjqPG3AIgkod5QDR/WblCkpV8R86BFPSrsWxSyt5Y=
+github.com/wailsapp/wails/v3 v3.0.0-alpha2.117/go.mod h1:74WH2FScMsgucZvHHvv7eOefDXCm/CjuIxqhhZgPhKg=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=

infrastructure_files/getting-started-enterprise.sh

@@ -11,10 +11,6 @@ SED_STRIP_PADDING='s/=//g'
 
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
-# Static IP for Traefik inside the compose bridge network. The management
-# server trusts X-Forwarded-* headers from this address only.
-TRAEFIK_IP="172.30.0.10"
-
 check_docker_compose() {
   if command -v docker-compose &> /dev/null; then
     echo "docker-compose"
@@ -84,7 +80,7 @@ read_nb_domain() {
   if ! check_domain_resolves "$value"; then
     echo "" > /dev/stderr
     echo "Warning: '$value' does not resolve via DNS from this host." > /dev/stderr
-    echo "Traefik will not be able to issue TLS certificates until it does." > /dev/stderr
+    echo "Caddy will not be able to issue TLS certificates until it does." > /dev/stderr
     local confirm=""
     echo -n "Continue anyway? [y/N]: " > /dev/stderr
     read -r confirm < /dev/tty
@@ -96,23 +92,6 @@ read_nb_domain() {
   echo "$value"
 }
 
-read_letsencrypt_email() {
-  if [[ -n "${NETBIRD_LETSENCRYPT_EMAIL:-}" ]]; then
-    echo "$NETBIRD_LETSENCRYPT_EMAIL"
-    return
-  fi
-  local value=""
-  echo "Enter your email for Let's Encrypt certificate notifications." > /dev/stderr
-  echo -n "Email address: " > /dev/stderr
-  read -r value < /dev/tty
-  if [[ -z "$value" ]]; then
-    echo "Email is required for Let's Encrypt." > /dev/stderr
-    read_letsencrypt_email
-    return
-  fi
-  echo "$value"
-}
-
 read_required() {
   local prompt="$1"
   local value=""
@@ -225,11 +204,11 @@ init_environment() {
   check_openssl
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
 
-  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]]; then
+  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]] || [[ -f Caddyfile ]]; then
     echo "Generated files already exist in $(pwd)."
     echo "If you want to reinitialize the environment, please remove them first:"
     echo "  $DOCKER_COMPOSE_COMMAND down --volumes # removes all containers and volumes"
-    echo "  rm -f .env docker-compose.yml config.yaml"
+    echo "  rm -f .env docker-compose.yml Caddyfile config.yaml"
     echo "Be aware this will remove all data from the database."
     exit 1
   fi
@@ -251,9 +230,6 @@ init_environment() {
   echo ""
   NETBIRD_DOMAIN=$(read_nb_domain)
 
-  echo ""
-  NETBIRD_LETSENCRYPT_EMAIL=$(read_letsencrypt_email)
-
   echo ""
 
   NETBIRD_LICENSE_KEY=$(read_secret "Enter license key (input hidden)")
@@ -262,7 +238,6 @@ init_environment() {
   POSTGRES_DB="netbird"
   POSTGRES_PASSWORD=$(rand_secret)
   NETBIRD_ENCRYPTION_KEY=$(rand_b64_key)
-  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)
   NETBIRD_RELAY_AUTH_SECRET=$(rand_secret)
 
   POSTGRES_DSN="host=postgres user=${POSTGRES_USER} password=${POSTGRES_PASSWORD} dbname=${POSTGRES_DB} port=5432 sslmode=disable TimeZone=UTC"
@@ -272,7 +247,6 @@ init_environment() {
   echo "Selected:"
   echo "  Traffic flow: ${NETBIRD_TRAFFIC_FLOW}"
   echo "  Domain:       ${NETBIRD_DOMAIN}"
-  echo "  ACME email:   ${NETBIRD_LETSENCRYPT_EMAIL}"
   echo ""
   echo "Rendering files into $(pwd) ..."
   install -m 600 /dev/null .env
@@ -282,6 +256,7 @@ init_environment() {
   if [[ -z "${NETBIRD_LICENSE_SERVER_BASE_URL:-}" ]]; then
     sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' docker-compose.yml && rm -f docker-compose.yml.bak
   fi
+  render_caddyfile > Caddyfile
   install -m 600 /dev/null config.yaml
   render_config_yaml >> config.yaml
 
@@ -308,7 +283,7 @@ init_environment() {
   echo "All configuration and secrets are stored (mode 600) in $(pwd)/.env"
   echo ""
   echo "Tail logs:"
-  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server traefik"
+  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server caddy"
 }
 
 # ------------------------------------------------------------------
@@ -331,11 +306,6 @@ NETBIRD_TRAFFIC_FLOW_ENABLED=${NETBIRD_TRAFFIC_FLOW}
 # Domain
 NETBIRD_DOMAIN=${NETBIRD_DOMAIN}
 
-# Reverse proxy (Traefik)
-NETBIRD_LETSENCRYPT_EMAIL=${NETBIRD_LETSENCRYPT_EMAIL}
-NETBIRD_TRAEFIK_TAG=${NETBIRD_TRAEFIK_TAG:-v3.6}
-NETBIRD_TRAEFIK_IP=${TRAEFIK_IP}
-
 # Image tags. Default to "latest"
 NETBIRD_DASHBOARD_TAG=${NETBIRD_DASHBOARD_TAG:-latest}
 NETBIRD_SERVER_TAG=${NETBIRD_SERVER_TAG:-latest}
@@ -408,78 +378,26 @@ EOF
 
 render_compose_common() {
   cat <<'EOF'
-  # Reverse proxy with automatic TLS via Let's Encrypt. Routes are declared as
-  # labels on the services below and picked up through the Docker provider.
-  traefik:
+  caddy:
     <<: *default
-    image: traefik:${NETBIRD_TRAEFIK_TAG}
-    container_name: netbird-traefik
-    networks:
-      netbird:
-        ipv4_address: ${NETBIRD_TRAEFIK_IP}
-    command:
-      # Logging
-      - "--log.level=INFO"
-      - "--accesslog=true"
-      # Docker provider
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=netbird"
-      # Entrypoints
-      - "--entrypoints.web.address=:80"
-      - "--entrypoints.websecure.address=:443"
-      - "--entrypoints.websecure.allowACMEByPass=true"
-      # readTimeout bounds the whole request, and gRPC streams / relay WebSockets
-      # never end one; idleTimeout would close the keep-alive connection they
-      # are reused over. Entrypoint-wide is the only scope Traefik offers here.
-      # writeTimeout is left alone: it already defaults to 0.
-      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
-      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0"
-      # HTTP to HTTPS redirect
-      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
-      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
-      # Let's Encrypt ACME
-      - "--certificatesresolvers.letsencrypt.acme.email=${NETBIRD_LETSENCRYPT_EMAIL}"
-      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
+    image: caddy:2
+    container_name: netbird-caddy
+    networks: [netbird]
+    environment:
+      - CADDY_SECURE_DOMAIN=${NETBIRD_DOMAIN}
     ports:
       - '443:443'
+      - '443:443/udp'
       - '80:80'
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - netbird_traefik_letsencrypt:/letsencrypt
-    labels:
-      - traefik.enable=true
-      # Shared security headers, referenced by every NetBird router below. A
-      # label-declared middleware only exists while its container runs, so this
-      # lives on Traefik itself: declaring it on an app container would drop
-      # every router referencing it whenever that container restarts.
-      - traefik.http.middlewares.nb-security.headers.stsSeconds=3600
-      - traefik.http.middlewares.nb-security.headers.stsIncludeSubdomains=true
-      - traefik.http.middlewares.nb-security.headers.contentTypeNosniff=true
-      - traefik.http.middlewares.nb-security.headers.browserXssFilter=true
-      - traefik.http.middlewares.nb-security.headers.referrerPolicy=strict-origin-when-cross-origin
-      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN
-      # Empty value strips the header. Only the dashboard's nginx sets one; the
-      # server emits none. Do not quote it — "" would send a literal Server: "".
-      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.Server=
+      - netbird_caddy_data:/data
+      - ./Caddyfile:/etc/caddy/Caddyfile
 
   dashboard:
     <<: *default
     image: ghcr.io/netbirdio/dashboard-cloud:${NETBIRD_DASHBOARD_TAG}
     container_name: netbird-dashboard
     networks: [netbird]
-    labels:
-      - traefik.enable=true
-      # Dashboard catch-all: lowest priority so every route below wins
-      - traefik.http.routers.netbird-dashboard.rule=Host(`${NETBIRD_DOMAIN}`)
-      - traefik.http.routers.netbird-dashboard.entrypoints=websecure
-      - traefik.http.routers.netbird-dashboard.tls=true
-      - traefik.http.routers.netbird-dashboard.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-dashboard.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-dashboard.service=dashboard
-      - traefik.http.routers.netbird-dashboard.priority=1
-      - traefik.http.services.dashboard.loadbalancer.server.port=80
     environment:
       - NETBIRD_MGMT_API_ENDPOINT=https://${NETBIRD_DOMAIN}
       - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://${NETBIRD_DOMAIN}
@@ -517,28 +435,6 @@ render_compose_server() {
       - netbird_data:/var/lib/netbird
       - ./config.yaml:/etc/netbird/config.yaml
     command: ["--config", "/etc/netbird/config.yaml"]
-    labels:
-      - traefik.enable=true
-      # Signal + Management gRPC (needs an h2c backend for HTTP/2 cleartext)
-      - traefik.http.routers.netbird-grpc.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
-      - traefik.http.routers.netbird-grpc.entrypoints=websecure
-      - traefik.http.routers.netbird-grpc.tls=true
-      - traefik.http.routers.netbird-grpc.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-grpc.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-grpc.service=netbird-server-h2c
-      - traefik.http.routers.netbird-grpc.priority=100
-      # Relay WebSocket, management API, and the embedded IdP
-      - traefik.http.routers.netbird-backend.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
-      - traefik.http.routers.netbird-backend.entrypoints=websecure
-      - traefik.http.routers.netbird-backend.tls=true
-      - traefik.http.routers.netbird-backend.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-backend.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-backend.service=netbird-server
-      - traefik.http.routers.netbird-backend.priority=100
-      # Services
-      - traefik.http.services.netbird-server.loadbalancer.server.port=80
-      - traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80
-      - traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c
     environment:
       - NB_LICENSE_KEY=${NETBIRD_LICENSE_KEY}
       - NETBIRD_LICENSE_SERVER_BASE_URL=${NETBIRD_LICENSE_SERVER_BASE_URL}
@@ -601,18 +497,6 @@ render_compose_flow() {
       - NB_FLOW_NATS_ENDPOINTS=nats://nats:4222
       - NB_FLOW_NATS_STREAM=traffic-events
       - NB_FLOW_AUTH_SECRET=${NETBIRD_RELAY_AUTH_SECRET}
-    labels:
-      - traefik.enable=true
-      # Flow receiver gRPC (h2c backend)
-      - traefik.http.routers.netbird-flow.rule=Host(`${NETBIRD_DOMAIN}`) && PathPrefix(`/flow.FlowService/`)
-      - traefik.http.routers.netbird-flow.entrypoints=websecure
-      - traefik.http.routers.netbird-flow.tls=true
-      - traefik.http.routers.netbird-flow.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-flow.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-flow.service=netbird-flow-h2c
-      - traefik.http.routers.netbird-flow.priority=100
-      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.port=80
-      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.scheme=h2c
 
 EOF
 }
@@ -652,16 +536,61 @@ EOF
   fi
   cat <<'EOF'
   netbird_postgres:
-  netbird_traefik_letsencrypt:
+  netbird_caddy_data:
 
 networks:
   netbird:
-    name: netbird
-    driver: bridge
-    ipam:
-      config:
-        - subnet: 172.30.0.0/24
-          gateway: 172.30.0.1
+EOF
+}
+
+render_caddyfile() {
+  cat <<'EOF'
+{
+  servers :80,:443 {
+    protocols h1 h2c h2 h3
+  }
+}
+
+(security_headers) {
+    header * {
+        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "SAMEORIGIN"
+        X-XSS-Protection "1; mode=block"
+        -Server
+        Referrer-Policy strict-origin-when-cross-origin
+    }
+}
+
+:80 {
+    redir https://{$CADDY_SECURE_DOMAIN}{uri} permanent
+}
+
+{$CADDY_SECURE_DOMAIN}:443 {
+    import security_headers
+    # Signal (gRPC over h2c)
+    reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-server:80
+    # Management (gRPC over h2c + HTTP)
+    reverse_proxy /management.ManagementService/* h2c://netbird-server:80
+    reverse_proxy /api/* netbird-server:80
+    reverse_proxy /ws-proxy/* netbird-server:80
+    # Embedded IdP (OAuth2 endpoints served by netbird server)
+    reverse_proxy /oauth2/* netbird-server:80
+    # Relay (WebSocket multiplexed on the same port)
+    reverse_proxy /relay* netbird-server:80
+EOF
+
+  if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
+    cat <<'EOF'
+    # Flow receiver (gRPC over h2c)
+    reverse_proxy /flow.FlowService/* h2c://receiver:80
+EOF
+  fi
+
+  cat <<'EOF'
+    # Dashboard
+    reverse_proxy /* dashboard:80
+}
 EOF
 }
 
@@ -680,7 +609,7 @@ server:
   logLevel: "info"
   logFile: "console"
 
-  # TLS is terminated by Traefik in front; leave this block empty.
+  # TLS is terminated by Caddy in front; leave this block empty.
   tls:
     certFile: ""
     keyFile: ""
@@ -697,23 +626,12 @@ server:
     issuer: "https://${NETBIRD_DOMAIN}/oauth2"
     localAuthDisabled: false
     signKeyRefreshEnabled: false
-    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"
     dashboardRedirectURIs:
       - "https://${NETBIRD_DOMAIN}/nb-auth"
       - "https://${NETBIRD_DOMAIN}/nb-silent-auth"
     cliRedirectURIs:
       - "http://localhost:53000/"
 
-  # Trust X-Forwarded-* only from the Traefik container's static address. Both
-  # keys must stay in step with the ipv4_address pinned in docker-compose.yml:
-  # trustedPeers decides whether forwarded headers are read at all, and leaving
-  # it unset falls back to 0.0.0.0/0.
-  reverseProxy:
-    trustedPeers:
-      - "${TRAEFIK_IP}/32"
-    trustedHTTPProxies:
-      - "${TRAEFIK_IP}/32"
-
   store:
     engine: "postgres"
     dsn: "${POSTGRES_DSN}"

infrastructure_files/getting-started.sh

@@ -348,7 +348,6 @@ initialize_default_values() {
   NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
   # Note: DataStoreEncryptionKey must keep base64 padding (=) for Go's base64.StdEncoding
   DATASTORE_ENCRYPTION_KEY=$(openssl rand -base64 32)
-  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)
   NETBIRD_STUN_PORT=3478
 
   # Docker images
@@ -528,8 +527,7 @@ generate_configuration_files() {
 
   # Common files for all configurations
   render_dashboard_env > dashboard.env
-  install -m 600 /dev/null config.yaml
-  render_combined_yaml >> config.yaml
+  render_combined_yaml > config.yaml
   return 0
 }
 
@@ -913,7 +911,6 @@ server:
   auth:
     issuer: "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/oauth2"
     signKeyRefreshEnabled: true
-    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"
     dashboardRedirectURIs:
       - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-auth"
       - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-silent-auth"

infrastructure_files/migrate-to-enterprise.sh

@@ -15,11 +15,7 @@ set -o pipefail
 #   2. Postgres migration — add Postgres, migrate SQLite data via migrate-store.
 #   3. Traffic flow       — add NATS + flow-enricher + flow-receiver.
 #
-# If any step fails once the stack has been touched, the script rolls itself
-# back automatically: generated files are removed, the Postgres volume this run
-# created is dropped, and the original deployment is started again.
-#
-# To revert a successful migration:
+# To revert:
 #   docker compose down
 #   rm -f docker-compose.override.yml config.yaml.enterprise
 #   # If Postgres migration was done, also restore the SQLite backup printed
@@ -29,15 +25,6 @@ set -o pipefail
 OVERRIDE_FILE="docker-compose.override.yml"
 ENTERPRISE_CONFIG_FILE="config.yaml.enterprise"
 
-# Rollback bookkeeping. ROLLBACK_STATE flips to "armed" the moment the script
-# starts mutating the deployment, and back to "disarmed" once the migration has
-# completed successfully.
-ROLLBACK_STATE="disarmed"
-ENV_EXISTED="unknown"
-ENV_BACKUP=""
-PG_VOLUME_NAME=""
-BACKUP_DIR=""
-
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
 check_docker_compose() {
@@ -173,11 +160,11 @@ EOF
 # ---------------------------------------------------------------------------
 
 detect_combined_service() {
-  yq eval '.services | to_entries | map(select(.value.image | test("^(ghcr\\.io/)?netbirdio/netbird-server([:@]|$)"))) | .[0].key // ""' "$COMPOSE_FILE"
+  yq eval '.services | to_entries | map(select(.value.image | test("^netbirdio/netbird-server"))) | .[0].key // ""' "$COMPOSE_FILE"
 }
 
 detect_dashboard_service() {
-  yq eval '.services | to_entries | map(select(.value.image | test("^(ghcr\\.io/)?netbirdio/dashboard([:@]|$)"))) | .[0].key // ""' "$COMPOSE_FILE"
+  yq eval '.services | to_entries | map(select(.value.image | test("^netbirdio/dashboard"))) | .[0].key // ""' "$COMPOSE_FILE"
 }
 
 detect_config_yaml_host_path() {
@@ -374,77 +361,7 @@ render_enterprise_config() {
 # Execution steps
 # ---------------------------------------------------------------------------
 
-combined_container_id() {
-  $DOCKER_COMPOSE_COMMAND ps -aq "$COMBINED_SERVICE" 2>/dev/null | head -1
-}
-
-container_data_mount() {
-  local container="$1"
-  [[ -n "$container" ]] || return 0
-  docker inspect "$container" --format \
-    '{{range .Mounts}}{{if eq .Destination "/var/lib/netbird"}}{{if .Name}}{{.Name}}{{else}}{{.Source}}{{end}}{{end}}{{end}}' 2>/dev/null
-}
-
-# The name comes from the container, so `-v` cannot invent an empty volume here.
-# 0 = empty, 1 = holds data, 2 = could not determine. A failed listing must not
-# be reported as empty: that would abort a healthy migration over a pull error
-# or an unreadable bind mount.
-data_dir_state() {
-  local src="$1" out
-  if [[ "$src" == /* ]]; then
-    [[ -d "$src" ]] || return 2
-    out=$(ls -A "$src" 2>/dev/null) || return 2
-  else
-    docker volume inspect "$src" &> /dev/null || return 0
-    out=$(docker run --rm -v "${src}:/d:ro" busybox sh -c 'ls -A /d' 2>/dev/null) || return 2
-  fi
-  [[ -z "$out" ]] && return 0
-  return 1
-}
-
-check_data_directory() {
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
-
-  local container
-  container=$(combined_container_id)
-  if [[ -z "$container" ]]; then
-    echo "" > /dev/stderr
-    echo "No container found for service '$COMBINED_SERVICE'." > /dev/stderr
-    echo "The migration backs up the store by copying it out of that container," > /dev/stderr
-    echo "so it has to exist. Start the deployment and re-run:" > /dev/stderr
-    echo "  $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
-    exit 1
-  fi
-
-  local src
-  src=$(container_data_mount "$container")
-  if [[ -z "$src" ]]; then
-    echo "" > /dev/stderr
-    echo "The '$COMBINED_SERVICE' container has nothing mounted at /var/lib/netbird." > /dev/stderr
-    echo "Cannot locate the NetBird store to back it up." > /dev/stderr
-    exit 1
-  fi
-
-  local state=0
-  data_dir_state "$src" || state=$?
-  if [[ $state -eq 0 ]]; then
-    echo "" > /dev/stderr
-    echo "The NetBird data directory is empty:" > /dev/stderr
-    echo "  $src" > /dev/stderr
-    echo "There is nothing to migrate. Check that you are running this from the" > /dev/stderr
-    echo "deployment directory of the NetBird install you mean to migrate." > /dev/stderr
-    exit 1
-  fi
-  if [[ $state -eq 2 ]]; then
-    echo "  ⚠ Could not read $src to confirm it holds data — continuing." > /dev/stderr
-    echo "    The backup step still fails loudly if it turns out to be empty." > /dev/stderr
-  fi
-
-  echo "  Data directory:   $src"
-}
-
-# Only for the Postgres volume, which has no container to read it off yet.
-resolve_compose_volume() {
+resolve_data_volume() {
   local short="$1"
   local actual
   # Resolve project-prefixed volume name from Docker Compose config first.
@@ -474,21 +391,18 @@ resolve_compose_volume() {
 backup_sqlite() {
   BACKUP_DIR="$(pwd)/backups/sqlite-pre-enterprise-$(date +%Y%m%d-%H%M%S)"
   mkdir -p "$BACKUP_DIR"
-
-  local container
-  container=$(combined_container_id)
-  if [[ -z "$container" ]]; then
-    echo "  ⚠ No container found for '$COMBINED_SERVICE' — cannot back up the store." > /dev/stderr
-    exit 1
-  fi
-
-  echo "Backing up the NetBird store to $BACKUP_DIR ..."
-  docker cp "${container}:/var/lib/netbird/." "$BACKUP_DIR/"
-
+  local data_volume_actual
+  data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
+  echo "Backing up SQLite store from volume '$data_volume_actual' to $BACKUP_DIR ..."
+  docker run --rm \
+    -v "${data_volume_actual}:/var/lib/netbird:ro" \
+    -v "${BACKUP_DIR}:/backup" \
+    busybox \
+    sh -c 'cp -a /var/lib/netbird/. /backup/ 2>/dev/null || true'
   local copied
   copied=$(find "$BACKUP_DIR" -mindepth 1 | head -1)
   if [[ -z "$copied" ]]; then
-    echo "  ⚠ Backup directory is empty — /var/lib/netbird held no data. Aborting." > /dev/stderr
+    echo "  ⚠ Backup directory is empty — the volume '$data_volume_actual' didn't contain data. Aborting." > /dev/stderr
     exit 1
   fi
   echo "  done"
@@ -500,135 +414,6 @@ run_migrate_store() {
   echo "  done"
 }
 
-# ---------------------------------------------------------------------------
-# Rollback — a failed run must not leave the operator with a stopped stack and
-# half-written artifacts.
-# ---------------------------------------------------------------------------
-
-# Resolve the name Compose would give the Postgres volume before the override
-# exists, so a leftover volume can be spotted up front.
-compose_project_name() {
-  local container project
-  container=$($DOCKER_COMPOSE_COMMAND ps -aq 2>/dev/null | head -1)
-  if [[ -n "$container" ]]; then
-    project=$(docker inspect "$container" \
-      --format '{{index .Config.Labels "com.docker.compose.project"}}' 2>/dev/null)
-    if [[ -n "$project" ]]; then
-      echo "$project"
-      return 0
-    fi
-  fi
-  project=$($DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval '.name // ""' - 2>/dev/null)
-  if [[ -n "$project" ]] && [[ "$project" != "null" ]]; then
-    echo "$project"
-  fi
-  return 0
-}
-
-postgres_volume_name() {
-  local project
-  project=$(compose_project_name)
-  if [[ -n "$project" ]]; then
-    echo "${project}_netbird_postgres"
-  fi
-  return 0
-}
-
-# Postgres skips initdb when its data directory is non-empty, so a volume left
-# behind by an interrupted run would keep the old password and old contents,
-# and migrate-store would fail against it.
-check_stale_postgres_volume() {
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
-
-  PG_VOLUME_NAME=$(postgres_volume_name)
-  if [[ -z "$PG_VOLUME_NAME" ]]; then
-    echo ""
-    echo "  ⚠ Could not determine the Compose project name, so a Postgres volume"
-    echo "    left over from an earlier attempt cannot be checked for. If a"
-    echo "    previous run failed, remove it before continuing:"
-    echo "      docker volume ls | grep netbird_postgres"
-    return 0
-  fi
-  docker volume inspect "$PG_VOLUME_NAME" &> /dev/null || return 0
-
-  echo ""
-  echo "  ⚠  A Postgres volume from an earlier attempt already exists:"
-  echo "       $PG_VOLUME_NAME"
-  echo "     Postgres does not re-initialise a non-empty data directory, so the"
-  echo "     migration would run against stale credentials and stale data."
-  local remove
-  remove=$(read_yes_no "  Remove it and continue?" "y")
-  if [[ "$remove" != "yes" ]]; then
-    echo "" > /dev/stderr
-    echo "Aborted. Remove it manually with: docker volume rm $PG_VOLUME_NAME" > /dev/stderr
-    exit 1
-  fi
-  docker volume rm "$PG_VOLUME_NAME" > /dev/null
-  echo "  Removed."
-}
-
-# Undo whatever this run changed and start the previous deployment again.
-rollback() {
-  ROLLBACK_STATE="done"
-
-  echo ""
-  echo "──────────────────────────────────────────────────────────────────────"
-  echo " Migration failed — restoring the previous deployment"
-  echo "──────────────────────────────────────────────────────────────────────"
-
-  # Resolve while the override is still present; without it Compose no longer
-  # knows about the Postgres volume.
-  local pg_volume="$PG_VOLUME_NAME"
-  if [[ -z "$pg_volume" ]] && [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    pg_volume=$(postgres_volume_name)
-  fi
-
-  echo ""
-  echo "Stopping services ..."
-  $DOCKER_COMPOSE_COMMAND down || true
-
-  echo "Removing generated files ..."
-  rm -f "$OVERRIDE_FILE" "$ENTERPRISE_CONFIG_FILE"
-
-  # Restore .env to exactly what it was, or remove it if this run created it.
-  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
-    mv -f "$ENV_BACKUP" .env || echo "  ⚠ Could not restore .env from $ENV_BACKUP." > /dev/stderr
-  elif [[ "$ENV_EXISTED" == "no" ]]; then
-    rm -f .env || true
-  fi
-
-  # Only ever the volume this run created — never the NetBird data volume.
-  if [[ -n "$pg_volume" ]] && [[ "$pg_volume" != "null" ]]; then
-    echo "Removing Postgres volume $pg_volume ..."
-    docker volume rm "$pg_volume" &> /dev/null || true
-  fi
-
-  echo "Starting the previous deployment ..."
-  if ! $DOCKER_COMPOSE_COMMAND up -d; then
-    echo ""
-    echo "  ⚠ Could not start the previous deployment automatically." > /dev/stderr
-    echo "    Run: $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
-  fi
-
-  echo ""
-  echo "Rolled back. Your docker-compose.yml, config.yaml and the NetBird data"
-  echo "volume were never modified."
-  if [[ -n "$BACKUP_DIR" ]] && [[ -d "$BACKUP_DIR" ]]; then
-    echo "The SQLite backup taken during this run is kept at:"
-    echo "  $BACKUP_DIR"
-  fi
-  echo "──────────────────────────────────────────────────────────────────────"
-}
-
-on_exit() {
-  local code=$?
-  trap - EXIT
-  if [[ $code -ne 0 ]] && [[ "$ROLLBACK_STATE" == "armed" ]]; then
-    rollback
-  fi
-  exit $code
-}
-
 # ---------------------------------------------------------------------------
 # Main
 # ---------------------------------------------------------------------------
@@ -661,12 +446,12 @@ init_migration() {
   COMPOSE_NETWORK=$(detect_compose_network)
 
   if [[ -z "$COMBINED_SERVICE" ]]; then
-    echo "Could not find a service running netbirdio/netbird-server or ghcr.io/netbirdio/netbird-server in $COMPOSE_FILE." > /dev/stderr
+    echo "Could not find a service running netbirdio/netbird-server* in $COMPOSE_FILE." > /dev/stderr
     echo "This script targets the community combined-server deployment." > /dev/stderr
     exit 1
   fi
   if [[ -z "$DASHBOARD_SERVICE" ]]; then
-    echo "Could not find a service running netbirdio/dashboard or ghcr.io/netbirdio/dashboard in $COMPOSE_FILE." > /dev/stderr
+    echo "Could not find a service running netbirdio/dashboard* in $COMPOSE_FILE." > /dev/stderr
     exit 1
   fi
   if [[ -z "$CONFIG_YAML_HOST" ]]; then
@@ -756,15 +541,9 @@ init_migration() {
     ENABLE_FLOW="no"
     echo "Step 3 (traffic flow) skipped — requires Postgres."
   fi
-
-  check_data_directory
-  check_stale_postgres_volume
 }
 
 apply_changes() {
-  # From here on a failure must roll the deployment back.
-  ROLLBACK_STATE="armed"
-
   echo ""
   echo "Writing $OVERRIDE_FILE ..."
   install -m 644 /dev/null "$OVERRIDE_FILE"
@@ -785,14 +564,6 @@ apply_changes() {
   # picks it up automatically.
   echo "Writing .env additions (mode 600) ..."
   local ENV_FILE=".env"
-  # Snapshot the operator's .env so a rollback can restore it byte for byte.
-  if [[ -f "$ENV_FILE" ]]; then
-    ENV_EXISTED="yes"
-    ENV_BACKUP="${ENV_FILE}.pre-enterprise-$(date +%Y%m%d-%H%M%S)"
-    cp -p "$ENV_FILE" "$ENV_BACKUP"
-  else
-    ENV_EXISTED="no"
-  fi
   touch "$ENV_FILE"
   chmod 600 "$ENV_FILE"
   {
@@ -821,16 +592,11 @@ apply_changes() {
 
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     echo ""
-    # Stop, but keep the containers: the backup reads the store out of one.
-    echo "Stopping services so the store is quiescent ..."
-    $DOCKER_COMPOSE_COMMAND stop
+    echo "Stopping existing services (volumes preserved) ..."
+    $DOCKER_COMPOSE_COMMAND down
 
     backup_sqlite
 
-    echo ""
-    echo "Removing stopped containers (volumes preserved) ..."
-    $DOCKER_COMPOSE_COMMAND down
-
     echo ""
     echo "Starting Postgres ..."
     $DOCKER_COMPOSE_COMMAND up -d postgres
@@ -860,9 +626,6 @@ apply_changes() {
 
   echo ""
   echo "Migration complete."
-
-  # Nothing left to undo.
-  ROLLBACK_STATE="disarmed"
 }
 
 print_summary() {
@@ -880,7 +643,6 @@ print_summary() {
   echo "    $OVERRIDE_FILE"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
   echo "    .env  (license key + secrets, mode 600)"
-  [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]] && echo "    $ENV_BACKUP  (.env as it was before this run)"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    backups/sqlite-pre-enterprise-*/  (SQLite backup)"
   echo ""
   echo " Tail logs:"
@@ -889,27 +651,19 @@ print_summary() {
   echo "──────────────────────────────────────────────────────────────────────"
   echo " To revert"
   echo "──────────────────────────────────────────────────────────────────────"
+  echo "  $DOCKER_COMPOSE_COMMAND down"
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    # Resolve the project-prefixed volume name now, before the override is gone.
-    local pg_volume
-    pg_volume=$(resolve_compose_volume "netbird_postgres")
-    echo "  # Stop, but keep the containers so the store can be copied back in:"
-    echo "  $DOCKER_COMPOSE_COMMAND stop"
-    echo "  # Restore SQLite from the backup created during this run:"
-    echo "  docker cp ${BACKUP_DIR}/. \$($DOCKER_COMPOSE_COMMAND ps -aq $COMBINED_SERVICE):/var/lib/netbird/"
-    echo "  $DOCKER_COMPOSE_COMMAND down"
+    # Resolve project-prefixed volume names now (before override is removed).
+    local pg_volume data_volume_actual
+    pg_volume=$(resolve_data_volume "netbird_postgres")
+    data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
+    echo "  # Remove the Postgres volume FIRST, before deleting the override file:"
     echo "  docker volume rm $pg_volume"
-  else
-    echo "  $DOCKER_COMPOSE_COMMAND down"
+    echo "  # Restore SQLite from the backup created during this run:"
+    echo "  docker run --rm -v ${data_volume_actual}:/var/lib/netbird -v ${BACKUP_DIR}:/backup busybox sh -c 'cp -a /backup/. /var/lib/netbird/'"
   fi
   echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
-  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
-    echo "  mv $ENV_BACKUP .env   # restores .env as it was before this run"
-  elif [[ "$ENV_EXISTED" == "no" ]]; then
-    echo "  rm -f .env   # created by this run"
-  else
-    echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
-  fi
+  echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
   echo "  $DOCKER_COMPOSE_COMMAND up -d"
   echo "──────────────────────────────────────────────────────────────────────"
 }
@@ -918,10 +672,6 @@ print_summary() {
 # Run
 # ---------------------------------------------------------------------------
 
-trap on_exit EXIT
-# Turn signals into a normal exit so the EXIT trap can roll back.
-trap 'exit 130' INT TERM
-
 init_migration
 apply_changes
 print_summary