Add CrowdSec AppSec request inspection to the reverse proxy

client/android/client.go

@@ -26,7 +26,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal/routemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netevents"
+	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -81,10 +82,13 @@ type Client struct {
 	deviceName            string
 	uiVersion             string
 	networkChangeListener listener.NetworkChangeListener
-	// netMgr outlives engine restarts: it mirrors the OS connectivity, not
-	// the engine lifecycle. Run and RunWithoutLogin inject its state and
-	// sweeper into each new ConnectClient.
-	netMgr *netevents.Manager
+	// netState outlives engine restarts: it mirrors the OS connectivity, not
+	// the engine lifecycle. Run and RunWithoutLogin inject it into each new
+	// ConnectClient, which distributes it to every reconnection loop.
+	netState *netstate.State
+
+	// sweeper also outlives engine restarts; NotifyNetworkChange sweeps it.
+	sweeper *netsweep.Sweeper
 
 	stateMu       sync.RWMutex
 	connectClient *internal.ConnectClient
@@ -148,17 +152,16 @@ func NewClient(androidSDKVersion int, deviceName string, uiVersion string, tunAd
 	execWorkaround(androidSDKVersion)
 
 	net.SetAndroidProtectSocketFn(tunAdapter.ProtectSocket)
-	system.SetIFaceDiscover(iFaceDiscover)
-	recorder := peer.NewRecorder("")
 	return &Client{
 		deviceName:            deviceName,
 		uiVersion:             uiVersion,
 		tunAdapter:            tunAdapter,
 		iFaceDiscover:         iFaceDiscover,
-		recorder:              recorder,
+		recorder:              peer.NewRecorder(""),
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
-		netMgr:                netevents.NewManager(recorder),
+		netState:              netstate.New(),
+		sweeper:               netsweep.New(),
 	}
 }
 
@@ -199,9 +202,8 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	}
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
-
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
-		internal.WithNetEvents(c.netMgr))
+		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
 	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
@@ -243,7 +245,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
-		internal.WithNetEvents(c.netMgr))
+		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
 	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
@@ -295,12 +297,9 @@ func (c *Client) GetTunSettings() (*TunSettings, error) {
 // While unavailable, the internal reconnect loops suspend their attempts and
 // the connection listener reports NoNetwork instead of Connecting; when
 // availability returns, the loops resume immediately with a fresh backoff.
-// Losing the last network also sweeps the registered connections: nothing can
-// redial while offline, so the stale sockets would otherwise stay silently
-// "connected" until their own timeouts and the client would keep reporting
-// Connected with no network at all.
 func (c *Client) SetNetworkAvailable(available bool) {
-	c.netMgr.SetNetworkAvailable(available)
+	c.netState.Set(available)
+	c.recorder.SetNetworkAvailable(available)
 }
 
 // NotifyNetworkChange marks the management, signal and relay connections
@@ -308,7 +307,8 @@ func (c *Client) SetNetworkAvailable(available bool) {
 // whatever has not redialed on the new network by then. The engine and the
 // TUN device stay untouched.
 func (c *Client) NotifyNetworkChange() {
-	c.netMgr.NotifyNetworkChange()
+	c.sweeper.MarkNetworkChange()
+	log.Infof("network change: connections marked stale")
 }
 
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.

client/grpc/dialer_generic.go

@@ -16,14 +16,9 @@ import (
 	"google.golang.org/grpc"
 
 	nbnet "github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netevents/sweep"
+	"github.com/netbirdio/netbird/client/netsweep"
 )
 
-// Sweeper registers in-flight dials for the network change sweep.
-type Sweeper interface {
-	StartDial(ctx context.Context) *sweep.Dial
-}
-
 func WithCustomDialer(_ bool, _ string) grpc.DialOption {
 	return grpc.WithContextDialer(dialContext)
 }
@@ -31,7 +26,7 @@ func WithCustomDialer(_ bool, _ string) grpc.DialOption {
 // WithSweeper dials like WithCustomDialer but registers connections and
 // dials with the sweeper. Append it after WithCustomDialer: gRPC applies
 // dial options in order, so the later context dialer wins.
-func WithSweeper(sweeper Sweeper) grpc.DialOption {
+func WithSweeper(sweeper *netsweep.Sweeper) grpc.DialOption {
 	return grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) {
 		dial := sweeper.StartDial(ctx)
 		defer dial.Release()

client/grpc/dialer_js.go

@@ -1,19 +1,12 @@
 package grpc
 
 import (
-	"context"
-
 	"google.golang.org/grpc"
 
-	"github.com/netbirdio/netbird/client/netevents/sweep"
+	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/util/wsproxy/client"
 )
 
-// Sweeper registers in-flight dials for the network change sweep.
-type Sweeper interface {
-	StartDial(ctx context.Context) *sweep.Dial
-}
-
 // WithCustomDialer returns a gRPC dial option that uses WebSocket transport for WASM/JS environments.
 // The component parameter specifies the WebSocket proxy component path (e.g., "/management", "/signal").
 func WithCustomDialer(tlsEnabled bool, component string) grpc.DialOption {
@@ -21,6 +14,6 @@ func WithCustomDialer(tlsEnabled bool, component string) grpc.DialOption {
 }
 
 // WithSweeper is a no-op on WASM/JS: there is no network change signal.
-func WithSweeper(_ Sweeper) grpc.DialOption {
+func WithSweeper(_ *netsweep.Sweeper) grpc.DialOption {
 	return grpc.EmptyDialOption{}
 }

client/grpc/retry.go

@@ -6,19 +6,16 @@ import (
 	"time"
 
 	"github.com/cenkalti/backoff/v4"
-)
 
-// ChangeWatcher exposes OS network availability transitions.
-type ChangeWatcher interface {
-	Changed() <-chan struct{}
-}
+	"github.com/netbirdio/netbird/client/netstate"
+)
 
 // Retry mirrors backoff.Retry, but the sleep between attempts also wakes on
 // OS network availability transitions: an operation cut down by a network
 // change retries the moment the network settles instead of sleeping through
-// the recovery. A nil watcher never fires, leaving plain backoff.Retry
+// the recovery. A nil netState never fires, leaving plain backoff.Retry
 // behavior.
-func Retry(ctx context.Context, operation backoff.Operation, bo backoff.BackOff, watcher ChangeWatcher) error {
+func Retry(ctx context.Context, operation backoff.Operation, bo backoff.BackOff, netState *netstate.State) error {
 	bo.Reset()
 	for {
 		err := operation()
@@ -39,14 +36,10 @@ func Retry(ctx context.Context, operation backoff.Operation, bo backoff.BackOff,
 			return err
 		}
 
-		var changed <-chan struct{}
-		if watcher != nil {
-			changed = watcher.Changed()
-		}
 		timer := time.NewTimer(next)
 		select {
 		case <-timer.C:
-		case <-changed:
+		case <-netState.Changed():
 			timer.Stop()
 		case <-ctx.Done():
 			timer.Stop()

client/grpc/retry_test.go

@@ -10,7 +10,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/netbirdio/netbird/client/netevents/netstate"
+	"github.com/netbirdio/netbird/client/netstate"
 )
 
 func TestRetryWakesOnNetworkChange(t *testing.T) {

client/internal/connect.go

@@ -38,7 +38,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/internal/updater/installer"
 	nbnet "github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/netevents"
+	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netsweep"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/ssh"
 	sshconfig "github.com/netbirdio/netbird/client/ssh/config"
@@ -72,17 +73,28 @@ type ConnectClient struct {
 
 	persistSyncResponse bool
 
-	// netEvents gates every reconnection loop on OS-reported network
-	// availability and sweeps connections on network change.
-	netEvents *netevents.Manager
+	// netState gates every reconnection loop on OS-reported network
+	// availability. Nil (the default) disables gating; mobile platforms
+	// inject it via WithNetworkState.
+	netState *netstate.State
+
+	// sweeper cuts the management, signal and relay connections on network
+	// change; nil disables it.
+	sweeper *netsweep.Sweeper
 }
 
 // ConnectClientOption configures optional ConnectClient behavior.
 type ConnectClientOption func(*ConnectClient)
 
-// WithNetEvents injects the OS network event handling.
-func WithNetEvents(events *netevents.Manager) ConnectClientOption {
-	return func(c *ConnectClient) { c.netEvents = events }
+// WithNetworkState injects the OS network availability state that gates every
+// reconnection loop; without it gating is disabled.
+func WithNetworkState(netState *netstate.State) ConnectClientOption {
+	return func(c *ConnectClient) { c.netState = netState }
+}
+
+// WithSweeper injects the network change sweeper.
+func WithSweeper(sweeper *netsweep.Sweeper) ConnectClientOption {
+	return func(c *ConnectClient) { c.sweeper = sweeper }
 }
 
 func NewConnectClient(
@@ -293,7 +305,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}
 
 		// suspend connection attempts while the OS reports no usable network
-		if waited, err := c.netEvents.Wait(c.ctx); err != nil {
+		if waited, err := c.netState.Wait(c.ctx); err != nil {
 			return nil
 		} else if waited {
 			backOff.Reset()
@@ -311,7 +323,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 
 		log.Debugf("connecting to the Management service %s", c.config.ManagementURL.Host)
 		mgmClient, err := mgm.NewClient(engineCtx, c.config.ManagementURL.Host, myPrivateKey, mgmTlsEnabled,
-			mgm.WithNetEvents(c.netEvents))
+			mgm.WithNetworkState(c.netState), mgm.WithSweeper(c.sweeper))
 		if err != nil {
 			// On daemon shutdown / Down() the parent context is cancelled
 			// and the dial fails with "context canceled". Wrapping that
@@ -386,7 +398,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}()
 
 		// with the global Netbird config in hand connect (just a connection, no stream yet) Signal
-		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey, c.netEvents)
+		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey, c.netState, c.sweeper)
 		if err != nil {
 			log.Error(err)
 			return wrapErr(err)
@@ -423,7 +435,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}
 
 		relayManager := relayClient.NewManager(engineCtx, relayURLs, myPrivateKey.PublicKey().String(), engineConfig.MTU,
-			relayClient.WithNetEvents(c.netEvents))
+			relayClient.WithNetworkState(c.netState), relayClient.WithSweeper(c.sweeper))
 		c.statusRecorder.SetRelayMgr(relayManager)
 		if len(relayURLs) > 0 {
 			if token != nil {
@@ -451,7 +463,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			UpdateManager:  c.updateManager,
 			ClientMetrics:  c.clientMetrics,
 			MetricsCtx:     c.ctx,
-			NetState:       c.netEvents,
+			NetState:       c.netState,
 		}, mobileDependency)
 		engine.SetSyncResponsePersistence(c.persistSyncResponse)
 		c.engine = engine
@@ -711,7 +723,7 @@ func selectMTU(localMTU uint16, peerMTU int32) uint16 {
 }
 
 // connectToSignal creates Signal Service client and established a connection
-func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key, netEvents *netevents.Manager) (*signal.GrpcClient, error) {
+func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key, netState *netstate.State, sweeper *netsweep.Sweeper) (*signal.GrpcClient, error) {
 	var sigTLSEnabled bool
 	if wtConfig.Signal.Protocol == mgmProto.HostConfig_HTTPS {
 		sigTLSEnabled = true
@@ -720,7 +732,7 @@ func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourP
 	}
 
 	signalClient, err := signal.NewClient(ctx, wtConfig.Signal.Uri, ourPrivateKey, sigTLSEnabled,
-		signal.WithNetEvents(netEvents))
+		signal.WithNetworkState(netState), signal.WithSweeper(sweeper))
 	if err != nil {
 		log.Errorf("error while connecting to the Signal Exchange Service %s: %s", wtConfig.Signal.Uri, err)
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "failed connecting to Signal Service : %s", err)

client/internal/engine.go

@@ -59,7 +59,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/syncstore"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/jobexec"
-	"github.com/netbirdio/netbird/client/netevents"
+	"github.com/netbirdio/netbird/client/netstate"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/system"
 	nbdns "github.com/netbirdio/netbird/dns"
@@ -184,7 +184,7 @@ type EngineServices struct {
 	MetricsCtx     context.Context
 	// NetState gates the reconnection loops on OS-reported network
 	// availability; nil disables gating.
-	NetState *netevents.Manager
+	NetState *netstate.State
 }
 
 // Engine is a mechanism responsible for reacting on Signal and Management stream events and managing connections to the remote peers.
@@ -210,7 +210,7 @@ type Engine struct {
 
 	// netState gates the peer reconnection guards on OS-reported network
 	// availability; nil disables gating.
-	netState *netevents.Manager
+	netState *netstate.State
 
 	// STUNs is a list of STUN servers used by ICE
 	STUNs []*stun.URI

client/internal/peer/conn.go

@@ -26,7 +26,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	"github.com/netbirdio/netbird/client/netevents"
+	"github.com/netbirdio/netbird/client/netstate"
 	"github.com/netbirdio/netbird/route"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
@@ -97,7 +97,7 @@ type ConnConfig struct {
 
 	// NetworkState gates the reconnection guard on OS-reported network
 	// availability; nil disables gating.
-	NetworkState *netevents.Manager
+	NetworkState *netstate.State
 }
 
 type Conn struct {

client/internal/peer/guard/guard.go

@@ -6,6 +6,8 @@ import (
 
 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/netstate"
 )
 
 // ConnStatus represents the connection state as seen by the guard.
@@ -22,12 +24,6 @@ const (
 
 type connStatusFunc func() ConnStatus
 
-// NetworkWatcher is the availability view the guard gates reconnects on.
-type NetworkWatcher interface {
-	IsOnline() bool
-	Changed() <-chan struct{}
-}
-
 // Guard is responsible for the reconnection logic.
 // It will trigger to send an offer to the peer then has connection issues.
 // Watch these events:
@@ -43,14 +39,14 @@ type Guard struct {
 	srWatcher           *SRWatcher
 	// netState gates reconnect attempts on OS-reported network availability;
 	// nil disables gating.
-	netState                NetworkWatcher
+	netState                *netstate.State
 	relayedConnDisconnected chan struct{}
 	iCEConnDisconnected     chan struct{}
 }
 
 // NewGuard creates a reconnection guard for a peer connection. A nil netState
 // disables network availability gating.
-func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher, netState NetworkWatcher) *Guard {
+func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher, netState *netstate.State) *Guard {
 	return &Guard{
 		log:                     log,
 		isConnectedOnAllWay:     isConnectedFn,
@@ -108,17 +104,14 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 	iceState := &iceRetryState{log: g.log}
 	defer iceState.reset()
 
-	var netChanged <-chan struct{}
-	if g.netState != nil {
-		netChanged = g.netState.Changed()
-	}
+	netChanged := g.netState.Changed()
 
 	for {
 		select {
 		case <-tickerChannel:
 			// skip attempts while the OS reports no usable network; the
 			// netChanged case below resumes the loop once it returns
-			if g.netState != nil && !g.netState.IsOnline() {
+			if !g.netState.IsOnline() {
 				continue
 			}
 			switch g.isConnectedOnAllWay() {

client/internal/peer/guard/guard_netstate_test.go

@@ -9,7 +9,7 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/netevents/netstate"
+	"github.com/netbirdio/netbird/client/netstate"
 )
 
 // newTestGuardWithNetState builds a guard with a realistic MaxInterval: the

client/internal/updater/installer/doc.go

@@ -37,32 +37,23 @@
 // Updater Process (Setup):
 //
 //  1. Receives parameters from service via command-line arguments
-//  2. Terminates the UI so the installer does not have to replace a locked image
-//     file, which would otherwise leave the install needing a reboot
-//  3. Runs installer with appropriate silent/quiet flags:
+//  2. Runs installer with appropriate silent/quiet flags:
 //     - Windows EXE: installer.exe /S
-//     - Windows MSI: msiexec.exe /i installer.msi /qn /norestart REBOOT=ReallySuppress /l*v msi.log
+//     - Windows MSI: msiexec.exe /i installer.msi /quiet /qn /l*v msi.log
 //     - macOS PKG: installer -pkg installer.pkg -target /
 //     - macOS Homebrew: brew upgrade netbirdio/tap/netbird
-//  4. Installer terminates the daemon
-//  5. Installer replaces binaries with new version
-//  6. Updater waits for installer to complete. On Windows, MSI exit codes 3010
-//     (ERROR_SUCCESS_REBOOT_REQUIRED) and 1641 (ERROR_SUCCESS_REBOOT_INITIATED)
-//     are a pending-reboot outcome, not a failure: the install succeeded, but
-//     some files are only replaced on the next restart (the reboot itself is
-//     suppressed via /norestart and REBOOT=ReallySuppress), and the flow
-//     continues as on success
-//  7. Updater restarts daemon:
+//  3. Installer terminates daemon and UI processes
+//  4. Installer replaces binaries with new version
+//  5. Updater waits for installer to complete
+//  6. Updater restarts daemon:
 //     - Windows: netbird.exe service start
 //     - macOS/Linux: netbird service start
-//  8. Updater restarts UI:
-//     - Windows: Launches netbird-ui.exe using CreateProcessAsUser in every
-//     session it was terminated in, falling back to the active console session
+//  7. Updater restarts UI:
+//     - Windows: Launches netbird-ui.exe as active console user using CreateProcessAsUser
 //     - macOS: Uses launchctl asuser to launch NetBird.app for console user
 //     - Linux: Not implemented (UI typically auto-starts)
-//  9. Updater writes result.json with success/error status (a pending reboot is
-//     recorded as success)
-//  10. Updater process exits
+//  8. Updater writes result.json with success/error status
+//  9. Updater process exits
 //
 // # Result Communication
 //

client/internal/updater/installer/installer_run_windows.go

@@ -2,7 +2,6 @@ package installer
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"os"
 	"os/exec"
@@ -23,12 +22,6 @@ const (
 
 	msiLogFile = "msi.log"
 
-	// ERROR_SUCCESS_REBOOT_REQUIRED and ERROR_SUCCESS_REBOOT_INITIATED
-	msiRebootRequired  = 3010
-	msiRebootInitiated = 1641
-
-	processExitWait = 10 * time.Second
-
 	msiDownloadURL = "https://github.com/netbirdio/netbird/releases/download/v%version/netbird_installer_%version_windows_%arch.msi"
 	exeDownloadURL = "https://github.com/netbirdio/netbird/releases/download/v%version/netbird_installer_%version_windows_%arch.exe"
 )
@@ -45,8 +38,6 @@ var (
 func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string, daemonFolder string) (resultErr error) {
 	resultHandler := NewResultHandler(u.tempDir)
 
-	var uiSessions []uint32
-
 	// Always ensure daemon and UI are restarted after setup
 	defer func() {
 		log.Infof("starting daemon back")
@@ -55,7 +46,7 @@ func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string
 		}
 
 		log.Infof("starting UI back")
-		if err := u.startUI(daemonFolder, uiSessions); err != nil {
+		if err := u.startUIAsUser(daemonFolder); err != nil {
 			log.Errorf("failed to start UI: %v", err)
 		}
 
@@ -84,14 +75,6 @@ func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string
 		return
 	}
 
-	// The UI holds an open handle on its own image. Left running, Restart Manager
-	// cannot shut it down (msiexec runs as LocalSystem here, the UI as the
-	// interactive user), so the MSI falls back to replacing the file on reboot and
-	// marks the install as restart-required. The deferred close-application action
-	// in the package runs too late to prevent that, it happens after
-	// InstallValidate has already registered the file as in use.
-	uiSessions = killUI()
-
 	var cmd *exec.Cmd
 	switch installerType {
 	case TypeExe:
@@ -101,9 +84,7 @@ func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string
 		installerDir := filepath.Dir(installerFile)
 		logPath := filepath.Join(installerDir, msiLogFile)
 		log.Infof("run msi installer: %s", installerFile)
-		// REBOOT=ReallySuppress: a silent install has no way to ask, so without it
-		// msiexec reboots the machine on its own if it decides one is needed.
-		cmd = exec.CommandContext(ctx, "msiexec.exe", "/i", filepath.Base(installerFile), "/qn", "/norestart", "REBOOT=ReallySuppress", "/l*v", logPath)
+		cmd = exec.CommandContext(ctx, "msiexec.exe", "/i", filepath.Base(installerFile), "/quiet", "/qn", "/l*v", logPath)
 	}
 
 	cmd.Dir = filepath.Dir(installerFile)
@@ -114,13 +95,9 @@ func (u *Installer) Setup(ctx context.Context, dryRun bool, installerFile string
 	}
 
 	log.Infof("installer started with PID %d", cmd.Process.Pid)
-	if err := cmd.Wait(); err != nil {
-		if !isRebootPending(err) {
-			resultErr = err
-			log.Errorf("installer process finished with error: %v", err)
-			return
-		}
-		log.Warnf("installer completed but reported a pending reboot, some files will be replaced on the next restart")
+	if resultErr = cmd.Wait(); resultErr != nil {
+		log.Errorf("installer process finished with error: %v", resultErr)
+		return
 	}
 
 	return nil
@@ -140,142 +117,16 @@ func (u *Installer) startDaemon(daemonFolder string) error {
 	return nil
 }
 
-func (u *Installer) startUI(daemonFolder string, sessionIDs []uint32) error {
+func (u *Installer) startUIAsUser(daemonFolder string) error {
 	uiPath := filepath.Join(daemonFolder, uiName)
 	log.Infof("starting netbird-ui: %s", uiPath)
 
-	if len(sessionIDs) == 0 {
-		sessionID := windows.WTSGetActiveConsoleSessionId()
-		if sessionID == 0xFFFFFFFF {
-			return fmt.Errorf("no active user session found")
-		}
-		sessionIDs = []uint32{sessionID}
+	// Get the active console session ID
+	sessionID := windows.WTSGetActiveConsoleSessionId()
+	if sessionID == 0xFFFFFFFF {
+		return fmt.Errorf("no active user session found")
 	}
 
-	var errs []error
-	for _, sessionID := range sessionIDs {
-		if err := startUIInSession(uiPath, sessionID); err != nil {
-			errs = append(errs, fmt.Errorf("session %d: %w", sessionID, err))
-			continue
-		}
-		log.Infof("netbird-ui started successfully in session %d", sessionID)
-	}
-	return errors.Join(errs...)
-}
-
-// isRebootPending reports whether the installer exit code means it succeeded but
-// left work for the next restart. The reboot itself is suppressed, so this is not
-// a failure.
-func isRebootPending(err error) bool {
-	var exitErr *exec.ExitError
-	if !errors.As(err, &exitErr) {
-		return false
-	}
-
-	switch exitErr.ExitCode() {
-	case msiRebootRequired, msiRebootInitiated:
-		return true
-	default:
-		return false
-	}
-}
-
-// killUI terminates any running netbird-ui process and returns the IDs of the
-// interactive sessions the terminated processes belonged to. Setup starts the
-// UI again in those sessions once the installer is done.
-func killUI() []uint32 {
-	pids, err := processIDsByName(uiName)
-	if err != nil {
-		log.Warnf("failed to look up %s processes: %v", uiName, err)
-		return nil
-	}
-
-	sessions := make(map[uint32]struct{})
-	for _, pid := range pids {
-		var sessionID uint32
-		if err := windows.ProcessIdToSessionId(pid, &sessionID); err != nil {
-			log.Warnf("failed to look up session of %s (PID %d): %v", uiName, pid, err)
-		}
-
-		if err := terminateProcess(pid); err != nil {
-			log.Warnf("failed to terminate %s (PID %d): %v", uiName, pid, err)
-			continue
-		}
-		log.Infof("terminated %s (PID %d) in session %d", uiName, pid, sessionID)
-
-		if sessionID != 0 {
-			sessions[sessionID] = struct{}{}
-		}
-	}
-
-	sessionIDs := make([]uint32, 0, len(sessions))
-	for sessionID := range sessions {
-		sessionIDs = append(sessionIDs, sessionID)
-	}
-	return sessionIDs
-}
-
-func processIDsByName(name string) ([]uint32, error) {
-	snapshot, err := windows.CreateToolhelp32Snapshot(windows.TH32CS_SNAPPROCESS, 0)
-	if err != nil {
-		return nil, fmt.Errorf("create process snapshot: %w", err)
-	}
-	defer func() {
-		if err := windows.CloseHandle(snapshot); err != nil {
-			log.Warnf("failed to close process snapshot: %v", err)
-		}
-	}()
-
-	var entry windows.ProcessEntry32
-	entry.Size = uint32(unsafe.Sizeof(entry))
-
-	var pids []uint32
-	for err = windows.Process32First(snapshot, &entry); err == nil; err = windows.Process32Next(snapshot, &entry) {
-		if strings.EqualFold(windows.UTF16ToString(entry.ExeFile[:]), name) {
-			pids = append(pids, entry.ProcessID)
-		}
-	}
-	if !errors.Is(err, windows.ERROR_NO_MORE_FILES) {
-		return nil, fmt.Errorf("enumerate processes: %w", err)
-	}
-
-	return pids, nil
-}
-
-func terminateProcess(pid uint32) error {
-	handle, err := windows.OpenProcess(windows.PROCESS_TERMINATE|windows.SYNCHRONIZE, false, pid)
-	if err != nil {
-		// The process may have exited between enumeration and now.
-		if errors.Is(err, windows.ERROR_INVALID_PARAMETER) {
-			return nil
-		}
-		return fmt.Errorf("open process: %w", err)
-	}
-	defer func() {
-		if err := windows.CloseHandle(handle); err != nil {
-			log.Warnf("failed to close process handle: %v", err)
-		}
-	}()
-
-	if err := windows.TerminateProcess(handle, 0); err != nil {
-		return fmt.Errorf("terminate process: %w", err)
-	}
-
-	// Wait for the handle to signal so the image file is released before the
-	// installer tries to overwrite it. A timeout is reported through the returned
-	// event, not through err, which stays nil unless the wait itself failed.
-	event, err := windows.WaitForSingleObject(handle, uint32(processExitWait.Milliseconds()))
-	if err != nil {
-		return fmt.Errorf("wait for process exit: %w", err)
-	}
-	if event != windows.WAIT_OBJECT_0 {
-		return fmt.Errorf("wait for process exit: unexpected wait result %#x", event)
-	}
-
-	return nil
-}
-
-func startUIInSession(uiPath string, sessionID uint32) error {
 	// Get the user token for that session
 	var userToken windows.Token
 	err := windows.WTSQueryUserToken(sessionID, &userToken)
@@ -346,6 +197,7 @@ func startUIInSession(uiPath string, sessionID uint32) error {
 		log.Warnf("failed to close thread handle: %v", err)
 	}
 
+	log.Infof("netbird-ui started successfully in session %d", sessionID)
 	return nil
 }
 

client/internal/updater/installer/installer_run_windows_test.go

@@ -1,108 +0,0 @@
-package installer
-
-import (
-	"errors"
-	"os/exec"
-	"slices"
-	"strconv"
-	"testing"
-)
-
-// exitErrorWithCode returns a real *exec.ExitError carrying the given exit code.
-func exitErrorWithCode(t *testing.T, code int) error {
-	t.Helper()
-
-	err := exec.Command("cmd.exe", "/c", "exit "+strconv.Itoa(code)).Run()
-	if err == nil {
-		t.Fatalf("expected a non-zero exit for code %d", code)
-	}
-	return err
-}
-
-func TestIsRebootPending(t *testing.T) {
-	tests := []struct {
-		name string
-		code int
-		want bool
-	}{
-		{name: "reboot required", code: msiRebootRequired, want: true},
-		{name: "reboot initiated", code: msiRebootInitiated, want: true},
-		{name: "generic failure", code: 1603, want: false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := isRebootPending(exitErrorWithCode(t, tt.code)); got != tt.want {
-				t.Errorf("isRebootPending(exit %d) = %v, want %v", tt.code, got, tt.want)
-			}
-		})
-	}
-}
-
-// TestProcessIDsByNameAndTerminate spawns a long-running system process, finds it
-// by name and terminates it, covering the path the updater uses to release the UI
-// image file before the installer replaces it.
-func TestProcessIDsByNameAndTerminate(t *testing.T) {
-	cmd := exec.Command("ping.exe", "-n", "60", "127.0.0.1")
-	if err := cmd.Start(); err != nil {
-		t.Fatalf("start ping: %v", err)
-	}
-
-	pid := uint32(cmd.Process.Pid)
-	killed := false
-	t.Cleanup(func() {
-		if !killed {
-			_ = cmd.Process.Kill()
-		}
-		_ = cmd.Wait()
-	})
-
-	// Name matching must be case-insensitive: the snapshot reports PING.EXE.
-	pids, err := processIDsByName("ping.exe")
-	if err != nil {
-		t.Fatalf("processIDsByName: %v", err)
-	}
-
-	if !slices.Contains(pids, pid) {
-		t.Fatalf("PID %d not among the ping.exe processes found: %v", pid, pids)
-	}
-
-	if err := terminateProcess(pid); err != nil {
-		t.Fatalf("terminateProcess: %v", err)
-	}
-	killed = true
-
-	// terminateProcess only returns once the handle has signalled, so the process
-	// is already gone and Wait must not block. It exits with the code passed to
-	// TerminateProcess, which is 0, so Wait reports no error.
-	if err := cmd.Wait(); err != nil {
-		t.Fatalf("wait for terminated ping: %v", err)
-	}
-	if !cmd.ProcessState.Exited() {
-		t.Error("process did not exit after terminateProcess")
-	}
-
-	remaining, err := processIDsByName("ping.exe")
-	if err != nil {
-		t.Fatalf("processIDsByName after terminate: %v", err)
-	}
-	if slices.Contains(remaining, pid) {
-		t.Errorf("PID %d still listed after terminateProcess", pid)
-	}
-}
-
-func TestProcessIDsByNameNoMatch(t *testing.T) {
-	pids, err := processIDsByName("netbird-nonexistent-process.exe")
-	if err != nil {
-		t.Fatalf("processIDsByName: %v", err)
-	}
-	if len(pids) != 0 {
-		t.Errorf("expected no matches, got %v", pids)
-	}
-}
-
-func TestIsRebootPendingNonExitError(t *testing.T) {
-	if isRebootPending(errors.New("start installer: file not found")) {
-		t.Error("a non-exit error must not be treated as a pending reboot")
-	}
-}

client/ios/NetBirdSDK/client.go

@@ -22,7 +22,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/netevents"
+	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -83,10 +84,12 @@ type Client struct {
 	onHostDnsFn           func([]string)
 	dnsManager            dns.IosDnsManager
 	loginComplete         bool
-	// netMgr outlives engine restarts: it mirrors the OS connectivity, not
-	// the engine lifecycle. Run injects its state and sweeper into each new
-	// ConnectClient.
-	netMgr *netevents.Manager
+	// netState outlives engine restarts: it mirrors the OS connectivity, not
+	// the engine lifecycle. Run injects it into each new ConnectClient, which
+	// distributes it to every reconnection loop.
+	netState *netstate.State
+	// sweeper also outlives engine restarts; NotifyNetworkChange sweeps it.
+	sweeper *netsweep.Sweeper
 	// preloadedConfig holds config loaded from JSON (used on tvOS where file writes are blocked)
 	preloadedConfig *profilemanager.Config
 
@@ -97,7 +100,6 @@ type Client struct {
 
 // NewClient instantiate a new Client
 func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osVersion string, osName string, networkChangeListener NetworkChangeListener, dnsManager DnsManager) *Client {
-	recorder := peer.NewRecorder("")
 	return &Client{
 		cfgFile:               cfgFile,
 		stateFile:             stateFile,
@@ -106,11 +108,12 @@ func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osV
 		deviceName:            deviceName,
 		osName:                osName,
 		osVersion:             osVersion,
-		recorder:              recorder,
+		recorder:              peer.NewRecorder(""),
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
 		dnsManager:            dnsManager,
-		netMgr:                netevents.NewManager(recorder),
+		netState:              netstate.New(),
+		sweeper:               netsweep.New(),
 	}
 }
 
@@ -187,7 +190,7 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	cfg.WgIface = interfaceName
 
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
-		internal.WithNetEvents(c.netMgr))
+		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
 	c.setState(cfg, connectClient)
 	// Persist the latest sync response so DebugBundle can include the network
 	// map. On iOS this is backed by disk to keep it out of the constrained
@@ -200,11 +203,10 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 // (e.g. from NWPathMonitor). While unavailable, the internal reconnect loops
 // suspend their attempts and the connection listener reports NoNetwork
 // instead of Connecting; when availability returns, the loops resume
-// immediately with a fresh backoff. Losing the last network also sweeps the
-// registered connections, so the client does not keep reporting Connected
-// over stale sockets with no network at all.
+// immediately with a fresh backoff.
 func (c *Client) SetNetworkAvailable(available bool) {
-	c.netMgr.SetNetworkAvailable(available)
+	c.netState.Set(available)
+	c.recorder.SetNetworkAvailable(available)
 }
 
 // NotifyNetworkChange marks the management, signal and relay connections
@@ -212,7 +214,8 @@ func (c *Client) SetNetworkAvailable(available bool) {
 // whatever has not redialed on the new network by then. The engine and the
 // TUN device stay untouched.
 func (c *Client) NotifyNetworkChange() {
-	c.netMgr.NotifyNetworkChange()
+	c.sweeper.MarkNetworkChange()
+	log.Infof("network change: connections marked stale")
 }
 
 // Stop the internal client and free the resources

client/netevents/netevents.go

@@ -1,158 +0,0 @@
-// Package netevents owns the OS network event handling shared by the mobile
-// bindings: availability changes park or wake the reconnection loops and drive
-// the NoNetwork listener state, and both losing the last network and switching
-// networks sweep the stale connections so their owners redial immediately.
-package netevents
-
-import (
-	"context"
-	"time"
-
-	"github.com/cenkalti/backoff/v4"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/netevents/netstate"
-	"github.com/netbirdio/netbird/client/netevents/sweep"
-)
-
-// Recorder receives the availability changes for listener state reporting.
-type Recorder interface {
-	SetNetworkAvailable(available bool)
-}
-
-// Manager ties the network availability state, the connection sweeper and the
-// status recorder together; it outlives engine restarts. A nil *Manager is
-// the valid no-events value: the read methods report always-online and never
-// sweep.
-type Manager struct {
-	netState *netstate.State
-	sweeper  *sweep.Sweeper
-	recorder Recorder
-}
-
-// NewManager creates a Manager reporting into recorder, starting online.
-func NewManager(recorder Recorder) *Manager {
-	return &Manager{
-		netState: netstate.New(),
-		sweeper:  sweep.New(),
-		recorder: recorder,
-	}
-}
-
-// SetNetworkAvailable records OS-reported network availability. While
-// unavailable, the reconnection loops suspend their attempts and the
-// connection listener reports NoNetwork instead of Connecting; when
-// availability returns, the loops resume immediately with a fresh backoff.
-// Losing the last network also sweeps the registered connections: nothing can
-// redial while offline, so the stale sockets would otherwise stay silently
-// "connected" until their own timeouts and the client would keep reporting
-// Connected with no network at all.
-func (m *Manager) SetNetworkAvailable(available bool) {
-	if !available && m.netState.IsOnline() {
-		m.sweeper.MarkNetworkChange()
-	}
-	m.netState.Set(available)
-	m.recorder.SetNetworkAvailable(available)
-}
-
-// NotifyNetworkChange marks the management, signal and relay connections
-// stale after the OS switched networks and schedules a sweep that cuts
-// whatever has not redialed on the new network by then. The engine and the
-// TUN device stay untouched.
-func (m *Manager) NotifyNetworkChange() {
-	m.sweeper.MarkNetworkChange()
-	log.Infof("network change: connections marked stale")
-}
-
-// IsOnline reports whether the OS reports at least one usable network.
-func (m *Manager) IsOnline() bool {
-	if m == nil {
-		return true
-	}
-	return m.netState.IsOnline()
-}
-
-// Changed returns a channel closed on the next availability transition.
-func (m *Manager) Changed() <-chan struct{} {
-	if m == nil {
-		return nil
-	}
-	return m.netState.Changed()
-}
-
-// Wait blocks while the network is offline; see netstate.State.Wait.
-func (m *Manager) Wait(ctx context.Context) (bool, error) {
-	if m == nil {
-		return false, nil
-	}
-	return m.netState.Wait(ctx)
-}
-
-// WaitSettled waits until an online verdict holds for a full settleWindow, or
-// while offline until the budget runs out. Returns false when ctx is
-// cancelled. The settle window exists because a disconnect often precedes the
-// OS offline flag by a few milliseconds, so a fresh online verdict cannot be
-// trusted immediately. A nil Manager has no events to watch: it degrades to a
-// fixed budget-long sleep.
-func (m *Manager) WaitSettled(ctx context.Context, budget, settleWindow time.Duration) bool {
-	if m == nil {
-		select {
-		case <-time.After(budget):
-			return true
-		case <-ctx.Done():
-			return false
-		}
-	}
-
-	budgetTimer := time.NewTimer(budget)
-	defer budgetTimer.Stop()
-
-	settle := time.NewTimer(settleWindow)
-	defer settle.Stop()
-
-	for {
-		// Channel first, flag second: a flip in between still fires the channel.
-		changedCh := m.netState.Changed()
-		if m.netState.IsOnline() {
-			select {
-			case <-settle.C:
-				return true
-			case <-changedCh:
-			case <-ctx.Done():
-				return false
-			}
-		} else {
-			select {
-			case <-budgetTimer.C:
-				return true
-			case <-changedCh:
-			case <-ctx.Done():
-				return false
-			}
-		}
-		if !settle.Stop() {
-			select {
-			case <-settle.C:
-			default:
-			}
-		}
-		settle.Reset(settleWindow)
-	}
-}
-
-// StartDial registers an in-flight dial with the sweeper; see sweep.Sweeper.StartDial.
-func (m *Manager) StartDial(ctx context.Context) *sweep.Dial {
-	if m == nil {
-		return (*sweep.Sweeper)(nil).StartDial(ctx)
-	}
-	return m.sweeper.StartDial(ctx)
-}
-
-// QuickRetryBackoff wraps bo for a quick retry after a network change; see
-// sweep.Sweeper.QuickRetryBackoff.
-func (m *Manager) QuickRetryBackoff(ctx context.Context, bo backoff.BackOff) backoff.BackOff {
-	if m == nil {
-		return bo
-	}
-	return m.sweeper.QuickRetryBackoff(ctx, bo, m.netState)
-}

client/netevents/netevents_test.go

@@ -1,34 +0,0 @@
-package netevents
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-)
-
-type recorderStub struct{}
-
-func (recorderStub) SetNetworkAvailable(bool) {}
-
-func TestWaitSettledAfterOutage(t *testing.T) {
-	const budget = 1500 * time.Millisecond
-	const settleWindow = 200 * time.Millisecond
-	const outage = 2 * settleWindow
-
-	m := NewManager(recorderStub{})
-	m.SetNetworkAvailable(false)
-
-	start := time.Now()
-	go func() {
-		time.Sleep(outage)
-		m.SetNetworkAvailable(true)
-	}()
-
-	ok := m.WaitSettled(context.Background(), budget, settleWindow)
-	elapsed := time.Since(start)
-
-	assert.True(t, ok, "recovered network must let the caller proceed")
-	assert.GreaterOrEqual(t, elapsed, outage+settleWindow, "an online verdict must hold a full settle window before it is trusted")
-}

client/netsweep/netsweep.go

@@ -1,10 +1,10 @@
-// Package sweep cuts network-bound activity when the OS switches networks:
+// Package netsweep cuts network-bound activity when the OS switches networks:
 // a sweep closes the registered connections and aborts the in-flight dials, so
 // their owners redial immediately instead of waiting for the old sockets to
 // time out.
 //
 // A nil *Sweeper disables everything: all methods are nil-safe no-ops.
-package sweep
+package netsweep
 
 import (
 	"context"
@@ -16,7 +16,7 @@ import (
 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/netevents/netstate"
+	"github.com/netbirdio/netbird/client/netstate"
 )
 
 // DefaultSweepDelay absorbs network flapping while the OS settles on a
@@ -34,7 +34,7 @@ type Config struct {
 // ErrSwept reports that a dial finished after a network change swept its
 // registration. The connection is already closed; the caller must treat it
 // as a failed dial and redial on the new network.
-var ErrSwept = errors.New("sweep: connection swept by network change")
+var ErrSwept = errors.New("netsweep: connection swept by network change")
 
 // sweepID identifies one registration in a sweeper. Connections and dials
 // draw from the same counter, so an id is unique across both registries.

client/netsweep/netsweep_test.go

@@ -1,4 +1,4 @@
-package sweep
+package netsweep
 
 import (
 	"context"

client/netsweep/quick_retry.go

@@ -1,11 +1,11 @@
-package sweep
+package netsweep
 
 import (
 	"time"
 
 	"github.com/cenkalti/backoff/v4"
 
-	"github.com/netbirdio/netbird/client/netevents/netstate"
+	"github.com/netbirdio/netbird/client/netstate"
 )
 
 const quickRetryDelay = 200 * time.Millisecond

client/netsweep/quick_retry_test.go

@@ -1,4 +1,4 @@
-package sweep
+package netsweep
 
 import (
 	"context"

client/system/info_android.go

@@ -30,11 +30,6 @@ func GetInfo(ctx context.Context) *Info {
 		kernelVersion = osInfo[2]
 	}
 
-	addrs, err := networkAddresses()
-	if err != nil {
-		log.Warnf("discover network addresses: %s", err)
-	}
-
 	gio := &Info{
 		GoOS:               runtime.GOOS,
 		Kernel:             kernel,
@@ -46,7 +41,6 @@ func GetInfo(ctx context.Context) *Info {
 		NetbirdVersion:     version.NetbirdVersion(),
 		UIVersion:          extractUIVersion(ctx),
 		KernelVersion:      kernelVersion,
-		NetworkAddresses:   addrs,
 		SystemSerialNumber: serial(),
 		SystemProductName:  productModel(),
 		SystemManufacturer: productManufacturer(),

client/system/network_addr.go

@@ -1,4 +1,4 @@
-//go:build !ios && !android
+//go:build !ios
 
 package system
 

client/system/network_addr_android.go

@@ -1,89 +0,0 @@
-package system
-
-import (
-	"net/netip"
-	"strings"
-)
-
-var iFaceDiscover IFaceDiscover
-
-type IFaceDiscover interface {
-	IFaces() (string, error)
-}
-
-// SetIFaceDiscover configures the Android interface discovery provider.
-func SetIFaceDiscover(discover IFaceDiscover) {
-	iFaceDiscover = discover
-}
-
-func networkAddresses() ([]NetworkAddress, error) {
-	if iFaceDiscover == nil {
-		return nil, nil
-	}
-	ifaces, err := iFaceDiscover.IFaces()
-	if err != nil {
-		return nil, err
-	}
-
-	var netAddresses []NetworkAddress
-	for _, line := range strings.Split(ifaces, "\n") {
-		addresses, ok := interfaceAddresses(line)
-		if !ok {
-			continue
-		}
-		for _, address := range addresses {
-			netAddr, ok := toNetworkAddress(address)
-			if !ok {
-				continue
-			}
-			if isDuplicated(netAddresses, netAddr) {
-				continue
-			}
-			netAddresses = append(netAddresses, netAddr)
-		}
-	}
-	return netAddresses, nil
-}
-
-func interfaceAddresses(line string) ([]string, bool) {
-	parts := strings.Split(line, "|")
-	if len(parts) != 2 {
-		return nil, false
-	}
-	flags := strings.Fields(parts[0])
-	if len(flags) != 8 {
-		return nil, false
-	}
-	up, loopback := flags[3], flags[5]
-	if up != "true" || loopback == "true" {
-		return nil, false
-	}
-	return strings.Fields(parts[1]), true
-}
-
-func toNetworkAddress(address string) (NetworkAddress, bool) {
-	prefix, err := netip.ParsePrefix(address)
-	if err != nil {
-		return NetworkAddress{}, false
-	}
-	if prefix.Addr().Is4In6() {
-		if prefix.Bits() < 96 {
-			return NetworkAddress{}, false
-		}
-		prefix = netip.PrefixFrom(prefix.Addr().Unmap(), prefix.Bits()-96)
-	}
-	ip := prefix.Addr()
-	if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsMulticast() {
-		return NetworkAddress{}, false
-	}
-	return NetworkAddress{NetIP: prefix}, true
-}
-
-func isDuplicated(addresses []NetworkAddress, addr NetworkAddress) bool {
-	for _, duplicated := range addresses {
-		if duplicated.NetIP == addr.NetIP {
-			return true
-		}
-	}
-	return false
-}

client/system/network_addr_test.go

@@ -1,4 +1,4 @@
-//go:build !ios && !android
+//go:build !ios
 
 package system
 

infrastructure_files/getting-started.sh

@@ -281,6 +281,8 @@ read_enable_crowdsec() {
   echo "CrowdSec checks client IPs against a community threat intelligence database" > /dev/stderr
   echo "and blocks known malicious sources before they reach your services." > /dev/stderr
   echo "A local CrowdSec LAPI container will be added to your deployment." > /dev/stderr
+  echo "It also enables the AppSec (WAF) endpoint, so services can inspect HTTP" > /dev/stderr
+  echo "requests for exploits. Both stay off per service until you enable them." > /dev/stderr
   echo -n "Enable CrowdSec? [y/N]: " > /dev/stderr
   read -r CHOICE < /dev/tty
 
@@ -554,7 +556,8 @@ generate_configuration_files() {
         # TCP ServersTransport for PROXY protocol v2 to the proxy backend
         render_traefik_dynamic > traefik-dynamic.yaml
         if [[ "$ENABLE_CROWDSEC" == "true" ]]; then
-          mkdir -p crowdsec
+          mkdir -p crowdsec/acquis.d
+          render_crowdsec_appsec_acquis > crowdsec/acquis.d/appsec.yaml
         fi
       fi
       ;;
@@ -589,6 +592,23 @@ generate_configuration_files() {
   return 0
 }
 
+# The AppSec (WAF) listener only exists if an appsec acquisition datasource is
+# configured. One datasource is one listener carrying one merged rule set: the
+# protocol has no rule-set selector, so per-service rule variation would need
+# either a second datasource on another port or pre_eval hooks filtering on
+# req.Host.
+render_crowdsec_appsec_acquis() {
+  cat <<EOF
+source: appsec
+listen_addr: 0.0.0.0:7422
+appsec_configs:
+  - crowdsecurity/appsec-default
+labels:
+  type: appsec
+EOF
+  return 0
+}
+
 start_services_and_show_instructions() {
   # For built-in Traefik, start containers immediately
   # For NPM, start containers first (NPM needs services running to create proxy)
@@ -805,7 +825,11 @@ render_docker_compose_traefik_builtin() {
     restart: unless-stopped
     networks: [netbird]
     environment:
-      COLLECTIONS: crowdsecurity/linux
+      # appsec-generic-rules is required alongside appsec-virtual-patching:
+      # the appsec-default config references crowdsecurity/generic-* and
+      # crowdsecurity/experimental-*, which only that collection provides, and
+      # the engine exits at startup if they are missing.
+      COLLECTIONS: crowdsecurity/linux crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules
     volumes:
       - ./crowdsec:/etc/crowdsec
       - crowdsec_db:/var/lib/crowdsec/data
@@ -1071,6 +1095,11 @@ EOF
     cat <<EOF
 NB_PROXY_CROWDSEC_API_URL=http://crowdsec:8080
 NB_PROXY_CROWDSEC_API_KEY=$CROWDSEC_BOUNCER_KEY
+# AppSec (WAF) request inspection. Separate endpoint from the LAPI above and
+# validated with the same bouncer key. Setting it makes the proxy advertise the
+# AppSec capability, which is what lets a service select appsec_mode; nothing is
+# inspected until a service opts in.
+NB_PROXY_CROWDSEC_APPSEC_URL=http://crowdsec:7422/
 EOF
   fi
 

management/internals/modules/reverseproxy/domain/domain.go

@@ -23,6 +23,9 @@ type Domain struct {
 	// SupportsCrowdSec is populated at query time from proxy cluster capabilities.
 	// Not persisted.
 	SupportsCrowdSec *bool `gorm:"-"`
+	// SupportsAppSec is populated at query time from proxy cluster capabilities.
+	// Not persisted.
+	SupportsAppSec *bool `gorm:"-"`
 	// SupportsPrivate is populated at query time from proxy cluster capabilities. Not persisted.
 	SupportsPrivate *bool `gorm:"-"`
 }

management/internals/modules/reverseproxy/domain/manager/api.go

@@ -49,6 +49,7 @@ func domainToApi(d *domain.Domain) api.ReverseProxyDomain {
 		SupportsCustomPorts: d.SupportsCustomPorts,
 		RequireSubdomain:    d.RequireSubdomain,
 		SupportsCrowdsec:    d.SupportsCrowdSec,
+		SupportsAppsec:      d.SupportsAppSec,
 		SupportsPrivate:     d.SupportsPrivate,
 	}
 	if d.TargetCluster != "" {

management/internals/modules/reverseproxy/domain/manager/manager.go

@@ -39,6 +39,7 @@ type proxyManager interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 }
 
@@ -98,6 +99,7 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 		d.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, cluster)
 		d.RequireSubdomain = m.proxyManager.ClusterRequireSubdomain(ctx, cluster)
 		d.SupportsCrowdSec = m.proxyManager.ClusterSupportsCrowdSec(ctx, cluster)
+		d.SupportsAppSec = m.proxyManager.ClusterSupportsAppSec(ctx, cluster)
 		d.SupportsPrivate = m.proxyManager.ClusterSupportsPrivate(ctx, cluster)
 		ret = append(ret, d)
 	}
@@ -115,6 +117,7 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 		if d.TargetCluster != "" {
 			cd.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, d.TargetCluster)
 			cd.SupportsCrowdSec = m.proxyManager.ClusterSupportsCrowdSec(ctx, d.TargetCluster)
+			cd.SupportsAppSec = m.proxyManager.ClusterSupportsAppSec(ctx, d.TargetCluster)
 			cd.SupportsPrivate = m.proxyManager.ClusterSupportsPrivate(ctx, d.TargetCluster)
 		}
 		// Custom domains never require a subdomain by default since

management/internals/modules/reverseproxy/domain/manager/manager_test.go

@@ -46,6 +46,10 @@ func (m *mockProxyManager) ClusterSupportsCrowdSec(_ context.Context, _ string)
 	return nil
 }
 
+func (m *mockProxyManager) ClusterSupportsAppSec(_ context.Context, _ string) *bool {
+	return nil
+}
+
 func (m *mockProxyManager) ClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }

management/internals/modules/reverseproxy/proxy/manager.go

@@ -19,6 +19,7 @@ type Manager interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStale(ctx context.Context, inactivityDuration time.Duration) error
 	GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error)

management/internals/modules/reverseproxy/proxy/manager/manager.go

@@ -21,6 +21,7 @@ type store interface {
 	GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetProxyByAccountID(ctx context.Context, accountID string) (*proxy.Proxy, error)
@@ -138,6 +139,13 @@ func (m Manager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string
 	return m.store.GetClusterSupportsCrowdSec(ctx, clusterAddr)
 }
 
+// ClusterSupportsAppSec returns whether all active proxies in the cluster have
+// a CrowdSec AppSec endpoint configured (unanimous). Returns nil when no proxy
+// has reported capabilities.
+func (m Manager) ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	return m.store.GetClusterSupportsAppSec(ctx, clusterAddr)
+}
+
 // ClusterSupportsPrivate reports whether any active proxy claims the private capability (nil = unreported).
 func (m Manager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
 	return m.store.GetClusterSupportsPrivate(ctx, clusterAddr)

management/internals/modules/reverseproxy/proxy/manager/manager_test.go

@@ -99,6 +99,9 @@ func (m *mockStore) GetClusterRequireSubdomain(_ context.Context, _ string) *boo
 func (m *mockStore) GetClusterSupportsCrowdSec(_ context.Context, _ string) *bool {
 	return nil
 }
+func (m *mockStore) GetClusterSupportsAppSec(_ context.Context, _ string) *bool {
+	return nil
+}
 func (m *mockStore) GetClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }

management/internals/modules/reverseproxy/proxy/manager_mock.go

@@ -50,20 +50,6 @@ func (mr *MockManagerMockRecorder) CleanupStale(ctx, inactivityDuration interfac
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupStale", reflect.TypeOf((*MockManager)(nil).CleanupStale), ctx, inactivityDuration)
 }
 
-// ClusterSupportsCustomPorts mocks base method.
-func (m *MockManager) ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ClusterSupportsCustomPorts", ctx, clusterAddr)
-	ret0, _ := ret[0].(*bool)
-	return ret0
-}
-
-// ClusterSupportsCustomPorts indicates an expected call of ClusterSupportsCustomPorts.
-func (mr *MockManagerMockRecorder) ClusterSupportsCustomPorts(ctx, clusterAddr interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCustomPorts", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCustomPorts), ctx, clusterAddr)
-}
-
 // ClusterRequireSubdomain mocks base method.
 func (m *MockManager) ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -78,6 +64,20 @@ func (mr *MockManagerMockRecorder) ClusterRequireSubdomain(ctx, clusterAddr inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterRequireSubdomain", reflect.TypeOf((*MockManager)(nil).ClusterRequireSubdomain), ctx, clusterAddr)
 }
 
+// ClusterSupportsAppSec mocks base method.
+func (m *MockManager) ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ClusterSupportsAppSec", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// ClusterSupportsAppSec indicates an expected call of ClusterSupportsAppSec.
+func (mr *MockManagerMockRecorder) ClusterSupportsAppSec(ctx, clusterAddr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsAppSec", reflect.TypeOf((*MockManager)(nil).ClusterSupportsAppSec), ctx, clusterAddr)
+}
+
 // ClusterSupportsCrowdSec mocks base method.
 func (m *MockManager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -92,6 +92,20 @@ func (mr *MockManagerMockRecorder) ClusterSupportsCrowdSec(ctx, clusterAddr inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCrowdSec", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCrowdSec), ctx, clusterAddr)
 }
 
+// ClusterSupportsCustomPorts mocks base method.
+func (m *MockManager) ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ClusterSupportsCustomPorts", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// ClusterSupportsCustomPorts indicates an expected call of ClusterSupportsCustomPorts.
+func (mr *MockManagerMockRecorder) ClusterSupportsCustomPorts(ctx, clusterAddr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCustomPorts", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCustomPorts), ctx, clusterAddr)
+}
+
 // ClusterSupportsPrivate mocks base method.
 func (m *MockManager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -121,6 +135,35 @@ func (mr *MockManagerMockRecorder) Connect(ctx, proxyID, sessionID, clusterAddre
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Connect", reflect.TypeOf((*MockManager)(nil).Connect), ctx, proxyID, sessionID, clusterAddress, ipAddress, accountID, capabilities)
 }
 
+// CountAccountProxies mocks base method.
+func (m *MockManager) CountAccountProxies(ctx context.Context, accountID string) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CountAccountProxies", ctx, accountID)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CountAccountProxies indicates an expected call of CountAccountProxies.
+func (mr *MockManagerMockRecorder) CountAccountProxies(ctx, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountProxies", reflect.TypeOf((*MockManager)(nil).CountAccountProxies), ctx, accountID)
+}
+
+// DeleteAccountCluster mocks base method.
+func (m *MockManager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAccountCluster", ctx, clusterAddress, accountID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
+func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
+}
+
 // Disconnect mocks base method.
 func (m *MockManager) Disconnect(ctx context.Context, proxyID, sessionID string) error {
 	m.ctrl.T.Helper()
@@ -135,6 +178,21 @@ func (mr *MockManagerMockRecorder) Disconnect(ctx, proxyID, sessionID interface{
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Disconnect", reflect.TypeOf((*MockManager)(nil).Disconnect), ctx, proxyID, sessionID)
 }
 
+// GetAccountProxy mocks base method.
+func (m *MockManager) GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountProxy", ctx, accountID)
+	ret0, _ := ret[0].(*Proxy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountProxy indicates an expected call of GetAccountProxy.
+func (mr *MockManagerMockRecorder) GetAccountProxy(ctx, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountProxy", reflect.TypeOf((*MockManager)(nil).GetAccountProxy), ctx, accountID)
+}
+
 // GetActiveClusterAddresses mocks base method.
 func (m *MockManager) GetActiveClusterAddresses(ctx context.Context) ([]string, error) {
 	m.ctrl.T.Helper()
@@ -150,6 +208,7 @@ func (mr *MockManagerMockRecorder) GetActiveClusterAddresses(ctx interface{}) *g
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveClusterAddresses", reflect.TypeOf((*MockManager)(nil).GetActiveClusterAddresses), ctx)
 }
 
+// GetActiveClusterAddressesForAccount mocks base method.
 func (m *MockManager) GetActiveClusterAddressesForAccount(ctx context.Context, accountID string) ([]string, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetActiveClusterAddressesForAccount", ctx, accountID)
@@ -158,6 +217,7 @@ func (m *MockManager) GetActiveClusterAddressesForAccount(ctx context.Context, a
 	return ret0, ret1
 }
 
+// GetActiveClusterAddressesForAccount indicates an expected call of GetActiveClusterAddressesForAccount.
 func (mr *MockManagerMockRecorder) GetActiveClusterAddressesForAccount(ctx, accountID interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveClusterAddressesForAccount", reflect.TypeOf((*MockManager)(nil).GetActiveClusterAddressesForAccount), ctx, accountID)
@@ -177,36 +237,6 @@ func (mr *MockManagerMockRecorder) Heartbeat(ctx, p interface{}) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Heartbeat", reflect.TypeOf((*MockManager)(nil).Heartbeat), ctx, p)
 }
 
-// GetAccountProxy mocks base method.
-func (m *MockManager) GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountProxy", ctx, accountID)
-	ret0, _ := ret[0].(*Proxy)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountProxy indicates an expected call of GetAccountProxy.
-func (mr *MockManagerMockRecorder) GetAccountProxy(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountProxy", reflect.TypeOf((*MockManager)(nil).GetAccountProxy), ctx, accountID)
-}
-
-// CountAccountProxies mocks base method.
-func (m *MockManager) CountAccountProxies(ctx context.Context, accountID string) (int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CountAccountProxies", ctx, accountID)
-	ret0, _ := ret[0].(int64)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// CountAccountProxies indicates an expected call of CountAccountProxies.
-func (mr *MockManagerMockRecorder) CountAccountProxies(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountProxies", reflect.TypeOf((*MockManager)(nil).CountAccountProxies), ctx, accountID)
-}
-
 // IsClusterAddressAvailable mocks base method.
 func (m *MockManager) IsClusterAddressAvailable(ctx context.Context, clusterAddress, accountID string) (bool, error) {
 	m.ctrl.T.Helper()
@@ -222,20 +252,6 @@ func (mr *MockManagerMockRecorder) IsClusterAddressAvailable(ctx, clusterAddress
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsClusterAddressAvailable", reflect.TypeOf((*MockManager)(nil).IsClusterAddressAvailable), ctx, clusterAddress, accountID)
 }
 
-// DeleteAccountCluster mocks base method.
-func (m *MockManager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAccountCluster", ctx, clusterAddress, accountID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
-func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
-}
-
 // MockController is a mock of Controller interface.
 type MockController struct {
 	ctrl     *gomock.Controller

management/internals/modules/reverseproxy/proxy/proxy.go

@@ -20,6 +20,9 @@ type Capabilities struct {
 	RequireSubdomain *bool
 	// SupportsCrowdsec indicates whether this proxy has CrowdSec configured.
 	SupportsCrowdsec *bool
+	// SupportsAppsec indicates whether this proxy has a CrowdSec AppSec (WAF)
+	// endpoint configured.
+	SupportsAppsec *bool
 	// Private indicates whether this proxy supports inbound access via Wireguard
 	// tunnel and netbird-only authentication policies
 	Private *bool
@@ -74,5 +77,6 @@ type Cluster struct {
 	SupportsCustomPorts *bool
 	RequireSubdomain    *bool
 	SupportsCrowdSec    *bool
+	SupportsAppSec      *bool
 	Private             *bool
 }

management/internals/modules/reverseproxy/service/manager/api.go

@@ -204,6 +204,7 @@ func (h *handler) getClusters(w http.ResponseWriter, r *http.Request) {
 			SupportsCustomPorts: c.SupportsCustomPorts,
 			RequireSubdomain:    c.RequireSubdomain,
 			SupportsCrowdsec:    c.SupportsCrowdSec,
+			SupportsAppsec:      c.SupportsAppSec,
 			Private:             c.Private,
 		})
 	}

management/internals/modules/reverseproxy/service/manager/manager.go

@@ -82,6 +82,7 @@ type CapabilityProvider interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 }
 
@@ -137,6 +138,7 @@ func (m *Manager) GetClusters(ctx context.Context, accountID, userID string) ([]
 		clusters[i].SupportsCustomPorts = m.capabilities.ClusterSupportsCustomPorts(ctx, clusters[i].Address)
 		clusters[i].RequireSubdomain = m.capabilities.ClusterRequireSubdomain(ctx, clusters[i].Address)
 		clusters[i].SupportsCrowdSec = m.capabilities.ClusterSupportsCrowdSec(ctx, clusters[i].Address)
+		clusters[i].SupportsAppSec = m.capabilities.ClusterSupportsAppSec(ctx, clusters[i].Address)
 		clusters[i].Private = m.capabilities.ClusterSupportsPrivate(ctx, clusters[i].Address)
 	}
 

management/internals/modules/reverseproxy/service/service.go

@@ -165,6 +165,22 @@ type AccessRestrictions struct {
 	AllowedCountries []string `json:"allowed_countries,omitempty" gorm:"serializer:json"`
 	BlockedCountries []string `json:"blocked_countries,omitempty" gorm:"serializer:json"`
 	CrowdSecMode     string   `json:"crowdsec_mode,omitempty" gorm:"serializer:json"`
+	// AllowMatch controls how the allowlists combine: "" or "all" require
+	// matching every allowlist (AND), "any" requires matching at least one (OR).
+	// Empty is treated as "all" for backward compatibility with existing records.
+	AllowMatch string `json:"allow_match,omitempty" gorm:"serializer:json"`
+	// AppSecMode is the CrowdSec AppSec (WAF) request inspection mode: "",
+	// "off", "enforce", or "observe". HTTP services only.
+	AppSecMode string `json:"appsec_mode,omitempty" gorm:"serializer:json"`
+}
+
+// isEmpty reports whether no restriction is configured. Both conversions drop
+// the object entirely in that case, so a field missing from this check is
+// silently discarded on the way to the API and the proxy.
+func (r AccessRestrictions) isEmpty() bool {
+	return len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
+		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
+		r.CrowdSecMode == "" && r.AllowMatch == "" && r.AppSecMode == ""
 }
 
 // Copy returns a deep copy of the AccessRestrictions.
@@ -175,6 +191,8 @@ func (r AccessRestrictions) Copy() AccessRestrictions {
 		AllowedCountries: slices.Clone(r.AllowedCountries),
 		BlockedCountries: slices.Clone(r.BlockedCountries),
 		CrowdSecMode:     r.CrowdSecMode,
+		AllowMatch:       r.AllowMatch,
+		AppSecMode:       r.AppSecMode,
 	}
 }
 
@@ -808,13 +826,23 @@ func restrictionsFromAPI(r *api.AccessRestrictions) (AccessRestrictions, error)
 		}
 		res.CrowdSecMode = string(*r.CrowdsecMode)
 	}
+	if r.AllowMatch != nil {
+		if !r.AllowMatch.Valid() {
+			return AccessRestrictions{}, fmt.Errorf("invalid allow_match %q", *r.AllowMatch)
+		}
+		res.AllowMatch = string(*r.AllowMatch)
+	}
+	if r.AppsecMode != nil {
+		if !r.AppsecMode.Valid() {
+			return AccessRestrictions{}, fmt.Errorf("invalid appsec_mode %q", *r.AppsecMode)
+		}
+		res.AppSecMode = string(*r.AppsecMode)
+	}
 	return res, nil
 }
 
 func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
-	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
-		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" {
+	if r.isEmpty() {
 		return nil
 	}
 	res := &api.AccessRestrictions{}
@@ -834,13 +862,19 @@ func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
 		mode := api.AccessRestrictionsCrowdsecMode(r.CrowdSecMode)
 		res.CrowdsecMode = &mode
 	}
+	if r.AllowMatch != "" {
+		match := api.AccessRestrictionsAllowMatch(r.AllowMatch)
+		res.AllowMatch = &match
+	}
+	if r.AppSecMode != "" {
+		mode := api.AccessRestrictionsAppsecMode(r.AppSecMode)
+		res.AppsecMode = &mode
+	}
 	return res
 }
 
 func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
-	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
-		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" {
+	if r.isEmpty() {
 		return nil
 	}
 	return &proto.AccessRestrictions{
@@ -849,6 +883,8 @@ func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
 		AllowedCountries: r.AllowedCountries,
 		BlockedCountries: r.BlockedCountries,
 		CrowdsecMode:     r.CrowdSecMode,
+		AllowMatch:       r.AllowMatch,
+		AppsecMode:       r.AppSecMode,
 	}
 }
 
@@ -874,6 +910,11 @@ func (s *Service) Validate() error {
 	if err := validateAccessRestrictions(&s.Restrictions); err != nil {
 		return err
 	}
+	// AppSec inspects HTTP requests, so it cannot apply to the L4 modes, which
+	// forward opaque byte streams.
+	if appSecEnabled(s.Restrictions.AppSecMode) && s.Mode != ModeHTTP {
+		return fmt.Errorf("appsec_mode is only supported for HTTP services, got mode %q", s.Mode)
+	}
 	if err := s.validatePrivateRequirements(); err != nil {
 		return err
 	}
@@ -1242,10 +1283,39 @@ func validateCrowdSecMode(mode string) error {
 	}
 }
 
+func validateAllowMatch(mode string) error {
+	switch mode {
+	case "", "all", "any":
+		return nil
+	default:
+		return fmt.Errorf("allow_match %q is invalid", mode)
+	}
+}
+
+func validateAppSecMode(mode string) error {
+	switch mode {
+	case "", "off", "enforce", "observe":
+		return nil
+	default:
+		return fmt.Errorf("appsec_mode %q is invalid", mode)
+	}
+}
+
+// appSecEnabled reports whether the mode asks for request inspection.
+func appSecEnabled(mode string) bool {
+	return mode == "enforce" || mode == "observe"
+}
+
 func validateAccessRestrictions(r *AccessRestrictions) error {
 	if err := validateCrowdSecMode(r.CrowdSecMode); err != nil {
 		return err
 	}
+	if err := validateAllowMatch(r.AllowMatch); err != nil {
+		return err
+	}
+	if err := validateAppSecMode(r.AppSecMode); err != nil {
+		return err
+	}
 
 	if len(r.AllowedCIDRs) > maxCIDREntries {
 		return fmt.Errorf("allowed_cidrs: exceeds maximum of %d entries", maxCIDREntries)

management/internals/modules/reverseproxy/service/service_test.go

@@ -26,6 +26,17 @@ func validProxy() *Service {
 	}
 }
 
+// validL4Proxy returns a service that passes validation in one of the L4 modes.
+func validL4Proxy(mode string) *Service {
+	rp := validProxy()
+	rp.Mode = mode
+	rp.ListenPort = 9000
+	rp.Targets = []*Target{
+		{TargetId: "peer-1", TargetType: TargetTypePeer, Host: "10.0.0.1", Port: 5432, Protocol: mode, Enabled: true},
+	}
+	return rp
+}
+
 func TestValidate_Valid(t *testing.T) {
 	require.NoError(t, validProxy().Validate())
 }
@@ -1302,6 +1313,65 @@ func TestValidate_Private_AcceptsClusterTargetWithAccessGroups(t *testing.T) {
 	require.NoError(t, rp.Validate())
 }
 
+func TestRestrictions_AllowMatch_RoundTrip(t *testing.T) {
+	anyMatch := api.AccessRestrictionsAllowMatchAny
+	apiIn := &api.AccessRestrictions{
+		AllowedCidrs:     &[]string{"203.0.113.0/24"},
+		AllowedCountries: &[]string{"US"},
+		AllowMatch:       &anyMatch,
+	}
+
+	model, err := restrictionsFromAPI(apiIn)
+	require.NoError(t, err)
+	assert.Equal(t, "any", model.AllowMatch)
+
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut.AllowMatch)
+	assert.Equal(t, api.AccessRestrictionsAllowMatchAny, *apiOut.AllowMatch)
+
+	protoOut := restrictionsToProto(model)
+	require.NotNil(t, protoOut)
+	assert.Equal(t, "any", protoOut.AllowMatch)
+}
+
+func TestRestrictions_AllowMatch_EmptyDefaultsToAll(t *testing.T) {
+	// A stored record with no allow_match (existing services) stays empty and
+	// must not surface a value on the API, preserving AND behavior downstream.
+	model, err := restrictionsFromAPI(&api.AccessRestrictions{
+		AllowedCidrs: &[]string{"203.0.113.0/24"},
+	})
+	require.NoError(t, err)
+	assert.Empty(t, model.AllowMatch, "unset allow_match stays empty")
+
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut)
+	assert.Nil(t, apiOut.AllowMatch, "empty allow_match is omitted from the API response")
+}
+
+func TestRestrictions_AllowMatchOnly_Preserved(t *testing.T) {
+	// allow_match set without any list must not be dropped by the emptiness
+	// guards, so it round-trips through both the API and proto conversions.
+	model := AccessRestrictions{AllowMatch: "any"}
+
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut, "allow-match-only restriction must not be omitted from the API response")
+	require.NotNil(t, apiOut.AllowMatch)
+	assert.Equal(t, api.AccessRestrictionsAllowMatchAny, *apiOut.AllowMatch)
+
+	protoOut := restrictionsToProto(model)
+	require.NotNil(t, protoOut, "allow-match-only restriction must not be omitted from the proto output")
+	assert.Equal(t, "any", protoOut.AllowMatch)
+}
+
+func TestValidate_RejectsInvalidAllowMatch(t *testing.T) {
+	rp := validProxy()
+	rp.Restrictions = AccessRestrictions{
+		AllowedCIDRs: []string{"203.0.113.0/24"},
+		AllowMatch:   "sometimes",
+	}
+	assert.ErrorContains(t, rp.Validate(), "allow_match")
+}
+
 func TestValidate_Private_RejectsNonHTTPMode(t *testing.T) {
 	rp := validProxy()
 	rp.Private = true
@@ -1315,3 +1385,68 @@ func TestValidate_Private_RejectsNonHTTPMode(t *testing.T) {
 	}}
 	assert.ErrorContains(t, rp.Validate(), "HTTP")
 }
+
+func TestRestrictions_AppSecMode_RoundTrip(t *testing.T) {
+	mode := api.AccessRestrictionsAppsecModeEnforce
+	apiIn := &api.AccessRestrictions{AppsecMode: &mode}
+
+	model, err := restrictionsFromAPI(apiIn)
+	require.NoError(t, err)
+	assert.Equal(t, "enforce", model.AppSecMode)
+
+	// appsec_mode alone must keep the restrictions object alive on both the API
+	// and proto legs: it is meaningful without any CIDR or country entry.
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut, "appsec_mode alone must not collapse the restrictions to nil")
+	require.NotNil(t, apiOut.AppsecMode)
+	assert.Equal(t, api.AccessRestrictionsAppsecModeEnforce, *apiOut.AppsecMode)
+
+	protoOut := restrictionsToProto(model)
+	require.NotNil(t, protoOut, "appsec_mode alone must reach the proxy")
+	assert.Equal(t, "enforce", protoOut.AppsecMode)
+}
+
+func TestRestrictions_AppSecMode_EmptyIsOmitted(t *testing.T) {
+	model, err := restrictionsFromAPI(&api.AccessRestrictions{
+		AllowedCidrs: &[]string{"203.0.113.0/24"},
+	})
+	require.NoError(t, err)
+	assert.Empty(t, model.AppSecMode)
+
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut)
+	assert.Nil(t, apiOut.AppsecMode, "empty appsec_mode is omitted from the API response")
+}
+
+func TestRestrictions_AppSecMode_CopyIsDeep(t *testing.T) {
+	original := AccessRestrictions{AppSecMode: "observe", CrowdSecMode: "enforce"}
+	assert.Equal(t, original, original.Copy(), "Copy must carry every mode field")
+}
+
+func TestValidate_RejectsInvalidAppSecMode(t *testing.T) {
+	rp := validProxy()
+	rp.Restrictions = AccessRestrictions{AppSecMode: "sometimes"}
+	assert.ErrorContains(t, rp.Validate(), "appsec_mode")
+}
+
+func TestValidate_RejectsAppSecOnL4Modes(t *testing.T) {
+	// AppSec inspects HTTP requests, so the L4 modes cannot honor it. Accepting
+	// the field there would report protection that never runs.
+	for _, mode := range []string{ModeTCP, ModeUDP, ModeTLS} {
+		t.Run(mode, func(t *testing.T) {
+			rp := validL4Proxy(mode)
+			rp.Restrictions = AccessRestrictions{AppSecMode: "enforce"}
+			assert.ErrorContains(t, rp.Validate(), "appsec_mode is only supported for HTTP services")
+		})
+	}
+}
+
+func TestValidate_AllowsAppSecOffOnL4Modes(t *testing.T) {
+	for _, mode := range []string{ModeTCP, ModeUDP, ModeTLS} {
+		t.Run(mode, func(t *testing.T) {
+			rp := validL4Proxy(mode)
+			rp.Restrictions = AccessRestrictions{AppSecMode: "off"}
+			require.NoError(t, rp.Validate(), "an explicit off must not be rejected on L4 services")
+		})
+	}
+}

management/internals/shared/grpc/proxy.go

@@ -562,6 +562,7 @@ func (s *ProxyServiceServer) registerProxyConnection(ctx context.Context, params
 			SupportsCustomPorts: c.SupportsCustomPorts,
 			RequireSubdomain:    c.RequireSubdomain,
 			SupportsCrowdsec:    c.SupportsCrowdsec,
+			SupportsAppsec:      c.SupportsAppsec,
 			Private:             c.Private,
 		}
 	}

management/server/store/sql_store.go

@@ -6491,6 +6491,7 @@ var validCapabilityColumns = map[string]struct{}{
 	"supports_custom_ports": {},
 	"require_subdomain":     {},
 	"supports_crowdsec":     {},
+	"supports_appsec":       {},
 	"private":               {},
 }
 
@@ -6521,6 +6522,14 @@ func (s *SqlStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr s
 	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_crowdsec")
 }
 
+// GetClusterSupportsAppSec returns whether all active proxies in the cluster
+// have a CrowdSec AppSec endpoint configured. Returns nil when no proxy
+// reported the capability. Unanimous for the same reason as CrowdSec: a single
+// proxy without AppSec would let requests through uninspected.
+func (s *SqlStore) GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_appsec")
+}
+
 // getClusterUnanimousCapability returns an aggregated boolean capability
 // requiring all active proxies in the cluster to report true.
 func (s *SqlStore) getClusterUnanimousCapability(ctx context.Context, clusterAddr, column string) *bool {

management/server/store/sql_store_proxy_capability_test.go

@@ -0,0 +1,119 @@
+package store
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"runtime"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
+)
+
+// Capabilities travel proxy → gRPC → embedded gorm columns → aggregation → API.
+// A field dropped at any of those hops reads as "capability absent", which is
+// indistinguishable from a proxy that never reported it: the dashboard simply
+// hides the feature and nothing fails. These assertions cover the persistence
+// and aggregation hops.
+func TestSqlStore_ClusterCapabilityAggregation(t *testing.T) {
+	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	yes, no := true, false
+
+	tests := []struct {
+		name          string
+		reported      []*bool // one entry per connected proxy in the cluster
+		wantAppSec    *bool
+		wantAssertion string
+	}{
+		{
+			name:          "unreported stays unknown",
+			reported:      []*bool{nil},
+			wantAppSec:    nil,
+			wantAssertion: "an unreported capability must not read as false",
+		},
+		{
+			name:          "single proxy reporting true",
+			reported:      []*bool{&yes},
+			wantAppSec:    &yes,
+			wantAssertion: "a reported capability must survive persistence",
+		},
+		{
+			name:          "one proxy without it disables the cluster",
+			reported:      []*bool{&yes, &no},
+			wantAppSec:    &no,
+			wantAssertion: "capability must be unanimous, so a rolling upgrade cannot leave traffic uninspected",
+		},
+		{
+			name:          "one proxy yet to report disables the cluster",
+			reported:      []*bool{&yes, nil},
+			wantAppSec:    &no,
+			wantAssertion: "a proxy that has not reported must not count as capable",
+		},
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		for i, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				cluster := fmt.Sprintf("cluster-%d.proxy.example", i)
+				for j, reported := range tt.reported {
+					require.NoError(t, store.SaveProxy(ctx, &proxy.Proxy{
+						ID:             fmt.Sprintf("proxy-%d-%d", i, j),
+						ClusterAddress: cluster,
+						Status:         proxy.StatusConnected,
+						LastSeen:       time.Now(),
+						Capabilities:   proxy.Capabilities{SupportsAppsec: reported},
+					}))
+				}
+
+				got := store.GetClusterSupportsAppSec(ctx, cluster)
+				if tt.wantAppSec == nil {
+					assert.Nil(t, got, tt.wantAssertion)
+					return
+				}
+				require.NotNil(t, got, tt.wantAssertion)
+				assert.Equal(t, *tt.wantAppSec, *got, tt.wantAssertion)
+			})
+		}
+	})
+}
+
+// AppSec and IP reputation are separate endpoints, so a cluster can have either
+// without the other. Gating one on the other would silently disable a feature
+// the operator configured.
+func TestSqlStore_ClusterCapabilitiesAreIndependent(t *testing.T) {
+	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		const cluster = "independent.proxy.example"
+		yes, no := true, false
+
+		require.NoError(t, store.SaveProxy(ctx, &proxy.Proxy{
+			ID:             "proxy-independent",
+			ClusterAddress: cluster,
+			Status:         proxy.StatusConnected,
+			LastSeen:       time.Now(),
+			Capabilities: proxy.Capabilities{
+				SupportsAppsec:   &yes,
+				SupportsCrowdsec: &no,
+			},
+		}))
+
+		appsec := store.GetClusterSupportsAppSec(ctx, cluster)
+		crowdsec := store.GetClusterSupportsCrowdSec(ctx, cluster)
+		require.NotNil(t, appsec)
+		require.NotNil(t, crowdsec)
+		assert.True(t, *appsec, "AppSec must not be gated on CrowdSec")
+		assert.False(t, *crowdsec, "CrowdSec must not be implied by AppSec")
+	})
+}

management/server/store/sql_store_service_test.go

@@ -133,3 +133,46 @@ func TestSqlStore_GetAccount_ServiceTargetOptionsRoundtrip(t *testing.T) {
 		assert.True(t, tg.Options.DisableAccessLog, "options disable access log")
 	})
 }
+
+func TestSqlStore_GetAccount_ServiceRestrictionsRoundtrip(t *testing.T) {
+	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		account := newAccountWithId(ctx, "account_svc_restrictions", "testuser", "")
+		require.NoError(t, store.SaveAccount(ctx, account))
+
+		svc := &rpservice.Service{
+			ID:        "svc-restrictions",
+			AccountID: account.Id,
+			Name:      "restricted-svc",
+			Domain:    "restricted.example",
+			Enabled:   true,
+			Mode:      rpservice.ModeHTTP,
+			Restrictions: rpservice.AccessRestrictions{
+				AllowedCIDRs:     []string{"203.0.113.0/24"},
+				AllowedCountries: []string{"US"},
+				AllowMatch:       "any",
+				CrowdSecMode:     "observe",
+				AppSecMode:       "enforce",
+			},
+		}
+		require.NoError(t, store.CreateService(ctx, svc))
+
+		loaded, err := store.GetAccount(ctx, account.Id)
+		require.NoError(t, err)
+		require.Len(t, loaded.Services, 1)
+
+		// Restrictions are stored as a JSON blob; confirm the whole struct,
+		// including allow_match and the CrowdSec modes, survives the read path
+		// (Postgres pgx path included via runTestForAllEngines).
+		got := loaded.Services[0].Restrictions
+		assert.Equal(t, []string{"203.0.113.0/24"}, got.AllowedCIDRs)
+		assert.Equal(t, []string{"US"}, got.AllowedCountries)
+		assert.Equal(t, "any", got.AllowMatch)
+		assert.Equal(t, "observe", got.CrowdSecMode)
+		assert.Equal(t, "enforce", got.AppSecMode)
+	})
+}

management/server/store/store.go

@@ -329,6 +329,7 @@ type Store interface {
 	GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetAllProxies(ctx context.Context) ([]*proxy.Proxy, error)

management/server/store/store_mock.go

@@ -1878,6 +1878,20 @@ func (mr *MockStoreMockRecorder) GetClusterRequireSubdomain(ctx, clusterAddr int
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterRequireSubdomain", reflect.TypeOf((*MockStore)(nil).GetClusterRequireSubdomain), ctx, clusterAddr)
 }
 
+// GetClusterSupportsAppSec mocks base method.
+func (m *MockStore) GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetClusterSupportsAppSec", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// GetClusterSupportsAppSec indicates an expected call of GetClusterSupportsAppSec.
+func (mr *MockStoreMockRecorder) GetClusterSupportsAppSec(ctx, clusterAddr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterSupportsAppSec", reflect.TypeOf((*MockStore)(nil).GetClusterSupportsAppSec), ctx, clusterAddr)
+}
+
 // GetClusterSupportsCrowdSec mocks base method.
 func (m *MockStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()

proxy/cmd/proxy/cmd/root.go

@@ -79,6 +79,11 @@ var (
 	geoDataDir            string
 	crowdsecAPIURL        string
 	crowdsecAPIKey        string
+	appsecURL             string
+	appsecTimeout         time.Duration
+	appsecMaxBodyBytes    int64
+	captureBudgetBytes    int64
+	appsecMaxConcurrent   int
 )
 
 var rootCmd = &cobra.Command{
@@ -125,6 +130,11 @@ func init() {
 	rootCmd.Flags().StringVar(&geoDataDir, "geo-data-dir", envStringOrDefault("NB_PROXY_GEO_DATA_DIR", "/var/lib/netbird/geolocation"), "Directory for the GeoLite2 MMDB file (auto-downloaded if missing)")
 	rootCmd.Flags().StringVar(&crowdsecAPIURL, "crowdsec-api-url", envStringOrDefault("NB_PROXY_CROWDSEC_API_URL", ""), "CrowdSec LAPI URL for IP reputation checks")
 	rootCmd.Flags().StringVar(&crowdsecAPIKey, "crowdsec-api-key", envStringOrDefault("NB_PROXY_CROWDSEC_API_KEY", ""), "CrowdSec bouncer API key")
+	rootCmd.Flags().StringVar(&appsecURL, "crowdsec-appsec-url", envStringOrDefault("NB_PROXY_CROWDSEC_APPSEC_URL", ""), "CrowdSec AppSec (WAF) endpoint for HTTP request inspection, e.g. http://127.0.0.1:7422/ (reuses the bouncer API key)")
+	rootCmd.Flags().DurationVar(&appsecTimeout, "crowdsec-appsec-timeout", envDurationOrDefault("NB_PROXY_CROWDSEC_APPSEC_TIMEOUT", 0), "Timeout for a single AppSec inspection call (0 = 200ms)")
+	rootCmd.Flags().IntVar(&appsecMaxConcurrent, "crowdsec-appsec-max-concurrent", int(envInt64OrDefault("NB_PROXY_CROWDSEC_APPSEC_MAX_CONCURRENT", 0)), "Cap on AppSec inspections in flight; further requests are denied in enforce mode rather than queued (0 = 256, negative = no cap)")
+	rootCmd.Flags().Int64Var(&captureBudgetBytes, "capture-budget-bytes", envInt64OrDefault("NB_PROXY_CAPTURE_BUDGET_BYTES", 0), "Total in-flight request-body buffering across the proxy, shared by AppSec inspection and agent-network capture (0 = 256MiB)")
+	rootCmd.Flags().Int64Var(&appsecMaxBodyBytes, "crowdsec-appsec-max-body-bytes", envInt64OrDefault("NB_PROXY_CROWDSEC_APPSEC_MAX_BODY_BYTES", 0), "Cap on the request body mirrored to AppSec (0 = 64KiB, negative = headers and URI only)")
 }
 
 // Execute runs the root command.
@@ -218,47 +228,59 @@ func runServer(cmd *cobra.Command, args []string) error {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
 	defer stop()
 
-	srv := proxy.New(ctx, proxy.Config{
-		ListenAddr:               addr,
-		Logger:                   logger,
-		Version:                  Version,
-		ManagementAddress:        mgmtAddr,
-		ProxyURL:                 proxyDomain,
-		ProxyToken:               proxyToken,
-		CertificateDirectory:     certDir,
-		CertificateFile:          certFile,
-		CertificateKeyFile:       certKeyFile,
-		GenerateACMECertificates: acmeCerts,
-		ACMEChallengeAddress:     acmeAddr,
-		ACMEDirectory:            acmeDir,
-		ACMEEABKID:               acmeEABKID,
-		ACMEEABHMACKey:           acmeEABHMACKey,
-		ACMEChallengeType:        acmeChallengeType,
-		DebugEndpointEnabled:     debugEndpoint,
-		DebugEndpointAddress:     debugEndpointAddr,
-		HealthAddr:               healthAddr,
-		ForwardedProto:           forwardedProto,
-		TrustedProxies:           parsedTrustedProxies,
-		CertLockMethod:           nbacme.CertLockMethod(certLockMethod),
-		WildcardCertDir:          wildcardCertDir,
-		WireguardPort:            wgPort,
-		Performance:              perf,
-		ProxyProtocol:            proxyProtocol,
-		PreSharedKey:             preSharedKey,
-		SupportsCustomPorts:      supportsCustomPorts,
-		RequireSubdomain:         requireSubdomain,
-		Private:                  private,
-		MaxDialTimeout:           maxDialTimeout,
-		MaxSessionIdleTimeout:    maxSessionIdleTimeout,
-		MappingBatchWatchdog:     envDurationOrDefault("NB_PROXY_MAPPING_BATCH_WATCHDOG", 0),
-		GeoDataDir:               geoDataDir,
-		CrowdSecAPIURL:           crowdsecAPIURL,
-		CrowdSecAPIKey:           crowdsecAPIKey,
-	})
+	srv := proxy.New(ctx, serverConfig(logger, proxyToken, parsedTrustedProxies, perf))
 
 	return srv.ListenAndServe(ctx, addr)
 }
 
+// serverConfig maps the parsed flags and environment onto the proxy config.
+// Kept separate from runServer so registering a new flag does not grow the
+// startup path.
+func serverConfig(logger *log.Logger, proxyToken string, trustedProxyList *trustedproxy.List, perf embed.Performance) proxy.Config {
+	return proxy.Config{
+		ListenAddr:                   addr,
+		Logger:                       logger,
+		Version:                      Version,
+		ManagementAddress:            mgmtAddr,
+		ProxyURL:                     proxyDomain,
+		ProxyToken:                   proxyToken,
+		CertificateDirectory:         certDir,
+		CertificateFile:              certFile,
+		CertificateKeyFile:           certKeyFile,
+		GenerateACMECertificates:     acmeCerts,
+		ACMEChallengeAddress:         acmeAddr,
+		ACMEDirectory:                acmeDir,
+		ACMEEABKID:                   acmeEABKID,
+		ACMEEABHMACKey:               acmeEABHMACKey,
+		ACMEChallengeType:            acmeChallengeType,
+		DebugEndpointEnabled:         debugEndpoint,
+		DebugEndpointAddress:         debugEndpointAddr,
+		HealthAddr:                   healthAddr,
+		ForwardedProto:               forwardedProto,
+		TrustedProxies:               trustedProxyList,
+		CertLockMethod:               nbacme.CertLockMethod(certLockMethod),
+		WildcardCertDir:              wildcardCertDir,
+		WireguardPort:                wgPort,
+		Performance:                  perf,
+		ProxyProtocol:                proxyProtocol,
+		PreSharedKey:                 preSharedKey,
+		SupportsCustomPorts:          supportsCustomPorts,
+		RequireSubdomain:             requireSubdomain,
+		Private:                      private,
+		MaxDialTimeout:               maxDialTimeout,
+		MaxSessionIdleTimeout:        maxSessionIdleTimeout,
+		MappingBatchWatchdog:         envDurationOrDefault("NB_PROXY_MAPPING_BATCH_WATCHDOG", 0),
+		GeoDataDir:                   geoDataDir,
+		CrowdSecAPIURL:               crowdsecAPIURL,
+		CrowdSecAPIKey:               crowdsecAPIKey,
+		CrowdSecAppSecURL:            appsecURL,
+		CrowdSecAppSecTimeout:        appsecTimeout,
+		CrowdSecAppSecMaxBodyBytes:   appsecMaxBodyBytes,
+		CrowdSecAppSecMaxConcurrent:  appsecMaxConcurrent,
+		MiddlewareCaptureBudgetBytes: captureBudgetBytes,
+	}
+}
+
 func envBoolOrDefault(key string, def bool) bool {
 	v, exists := os.LookupEnv(key)
 	if !exists {
@@ -293,6 +315,19 @@ func envUint16OrDefault(key string, def uint16) uint16 {
 	return uint16(parsed)
 }
 
+func envInt64OrDefault(key string, def int64) int64 {
+	v, exists := os.LookupEnv(key)
+	if !exists {
+		return def
+	}
+	parsed, err := strconv.ParseInt(v, 10, 64)
+	if err != nil {
+		log.Warnf("parse %s=%q: %v, using default %d", key, v, err, def)
+		return def
+	}
+	return parsed
+}
+
 func envDurationOrDefault(key string, def time.Duration) time.Duration {
 	v, exists := os.LookupEnv(key)
 	if !exists {

proxy/internal/appsec/body.go

@@ -0,0 +1,163 @@
+package appsec
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"mime"
+	"net/http"
+	"net/url"
+	"slices"
+	"strings"
+)
+
+// bufferBody reads up to limit+1 bytes from r.Body and always restores r.Body so
+// the request stays forwardable. oversize reports that the body exceeded limit, in
+// which case the returned prefix must not be used for inspection: the bytes are
+// only read so they can be replayed to the backend.
+func bufferBody(r *http.Request, limit int64) (body []byte, oversize bool, err error) {
+	original := r.Body
+	buf, readErr := io.ReadAll(io.LimitReader(original, limit+1))
+	if readErr != nil && !errors.Is(readErr, io.EOF) {
+		// Restore what was read so a downstream retry sees a consistent stream,
+		// then surface the failure.
+		r.Body = replay(buf, original)
+		return nil, false, readErr
+	}
+
+	if int64(len(buf)) > limit {
+		r.Body = replay(buf, original)
+		return nil, true, nil
+	}
+
+	// The whole body is buffered, so the original is drained and can be closed.
+	// A close error on a drained read-only body does not invalidate the bytes.
+	_ = original.Close()
+	r.Body = io.NopCloser(bytes.NewReader(buf))
+	// Framing is deliberately left as the client sent it. Rewriting a chunked
+	// request to a fixed Content-Length here would be invisible to the client
+	// but not to the rest of the chain: a later body capture with a smaller cap
+	// sees a known length over its cap and skips capture entirely, where an
+	// unknown length would have given it a truncated prefix. Inspecting a
+	// request must not change what any other layer gets to inspect.
+	return buf, false, nil
+}
+
+// replay returns a ReadCloser that yields the already-read prefix followed by
+// the remainder of the original stream, and closes the original.
+func replay(prefix []byte, rest io.ReadCloser) io.ReadCloser {
+	return struct {
+		io.Reader
+		io.Closer
+	}{
+		Reader: io.MultiReader(bytes.NewReader(prefix), rest),
+		Closer: rest,
+	}
+}
+
+// redactedPlaceholder replaces a credential value in the mirrored body. It is
+// inert for rule matching, and its fixed length leaks nothing about the secret.
+const redactedPlaceholder = "redacted"
+
+// redactFormFields returns the body to mirror for a URL-encoded form, with the
+// values of the named fields replaced. The proxy's own password / PIN login
+// form posts to the service path itself, so without this the plaintext
+// credential would reach the Security Engine.
+//
+// Only the credential values are removed, never the whole body: dropping the
+// body outright would let a caller exempt any payload from inspection just by
+// appending a field named "password". Everything else in the form stays
+// inspectable, which is the point.
+//
+// Returns body unchanged when it is not a URL-encoded form or carries none of
+// the fields.
+//
+// Substitution happens on the raw bytes rather than by re-encoding parsed
+// values. Re-encoding would drop pairs that url.ParseQuery rejects, so a
+// payload hidden in a malformed pair alongside a credential-named field would
+// never be inspected while a tolerant backend parser still acted on it. Working
+// byte-wise also avoids reordering keys and normalizing escapes, so the engine
+// sees the same bytes the backend will.
+//
+// Field names match case-sensitively, on purpose: the caller passes the exact
+// names the login handler reads via r.FormValue, and that lookup is itself
+// case-sensitive. A "Password" field is therefore never a credential as far as
+// the proxy is concerned, and redacting it would only blind the WAF to a value
+// the proxy does not own.
+func redactFormFields(contentType string, body []byte, fields []string) []byte {
+	if len(fields) == 0 || len(body) == 0 {
+		return body
+	}
+	media, _, err := mime.ParseMediaType(contentType)
+	if err != nil || media != "application/x-www-form-urlencoded" {
+		return body
+	}
+	return redactURLEncoded(body, fields)
+}
+
+// redactURLEncoded replaces the values of the named keys in a URL-encoded
+// key/value sequence, the shared syntax of a query string and a form body.
+func redactURLEncoded(raw []byte, fields []string) []byte {
+	// Split on "&" only, matching how Go's form parser delimits pairs.
+	segments := bytes.Split(raw, []byte("&"))
+	redacted := false
+	for i, segment := range segments {
+		rawKey, _, hasValue := bytes.Cut(segment, []byte("="))
+		if !hasValue {
+			continue
+		}
+		// Compare the decoded name, so an escaped spelling of the field
+		// ("pass%77ord") is redacted too: the reader decodes before looking it
+		// up. A key that fails to decode never reaches that reader either,
+		// since the parser drops the pair.
+		name, err := url.QueryUnescape(string(rawKey))
+		if err != nil || !slices.Contains(fields, name) {
+			continue
+		}
+		// Keep the key bytes as sent and replace only the value. Assigning a
+		// fresh slice leaves raw untouched, which matters: the caller restored
+		// the request body from the same buffer.
+		segments[i] = []byte(string(rawKey) + "=" + redactedPlaceholder)
+		redacted = true
+	}
+	if !redacted {
+		return raw
+	}
+	return bytes.Join(segments, []byte("&"))
+}
+
+// redactQuery replaces the values of the named query parameters in a raw query
+// string, leaving every other byte as sent.
+func redactQuery(rawQuery string, params []string) string {
+	if len(params) == 0 || rawQuery == "" {
+		return rawQuery
+	}
+	return string(redactURLEncoded([]byte(rawQuery), params))
+}
+
+// redactCookieHeader replaces the values of the named cookies in a Cookie
+// header, keeping the others intact: cookies are a zone WAF rules match on, so
+// dropping the whole header would cost real coverage.
+func redactCookieHeader(value string, names []string) string {
+	if len(names) == 0 || value == "" {
+		return value
+	}
+	parts := strings.Split(value, ";")
+	redacted := false
+	for i, part := range parts {
+		name, _, hasValue := strings.Cut(part, "=")
+		if !hasValue {
+			continue
+		}
+		// Cookie names are case-sensitive and are not percent-decoded.
+		if !slices.Contains(names, strings.TrimSpace(name)) {
+			continue
+		}
+		parts[i] = name + "=" + redactedPlaceholder
+		redacted = true
+	}
+	if !redacted {
+		return value
+	}
+	return strings.Join(parts, ";")
+}

proxy/internal/appsec/client.go

@@ -0,0 +1,571 @@
+// Package appsec implements the CrowdSec AppSec (WAF) side of the remediation
+// component protocol: each inspected HTTP request is mirrored to the Security
+// Engine's AppSec endpoint, which replies with an allow / ban / captcha verdict
+// for that request.
+//
+// This is a separate endpoint from the LAPI decision stream used by the
+// crowdsec package: LAPI answers "is this IP known bad", AppSec answers "is
+// this request an attack". The two are configured and enabled independently.
+package appsec
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"strings"
+	"sync"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/proxy/internal/netutil"
+	"github.com/netbirdio/netbird/proxy/internal/restrict"
+)
+
+// Header names the AppSec component reads off the mirrored request. IP, URI and
+// Verb are mandatory: the engine answers 500 when any of them is missing.
+const (
+	headerAPIKey        = "X-Crowdsec-Appsec-Api-Key" //nolint:gosec // G101: a header name, not a credential
+	headerIP            = "X-Crowdsec-Appsec-Ip"
+	headerURI           = "X-Crowdsec-Appsec-Uri"
+	headerVerb          = "X-Crowdsec-Appsec-Verb"
+	headerHost          = "X-Crowdsec-Appsec-Host"
+	headerUserAgent     = "X-Crowdsec-Appsec-User-Agent"
+	headerHTTPVersion   = "X-Crowdsec-Appsec-Http-Version"
+	headerTransactionID = "X-Crowdsec-Appsec-Transaction-Id"
+)
+
+// headerPrefix covers every protocol header. Any client-supplied header in this
+// namespace is dropped before forwarding so a caller cannot influence the
+// engine's view of its own address, or replay an API key.
+const headerPrefix = "X-Crowdsec-Appsec-"
+
+// Remediation actions the engine can return.
+const (
+	actionAllow   = "allow"
+	actionBan     = "ban"
+	actionCaptcha = "captcha"
+)
+
+const (
+	// DefaultTimeout matches the 200ms budget CrowdSec's remediation component
+	// spec sets for the blocking AppSec call.
+	DefaultTimeout = 200 * time.Millisecond
+	// MinTimeout and MaxTimeout bound the configured inspection timeout.
+	// Inspection is synchronous, so the upper bound is what keeps a
+	// mis-set value from parking every request to an inspected service on a
+	// slow engine; the lower bound keeps the call from timing out before the
+	// engine can realistically answer. Mirrors the per-middleware bounds the
+	// proxy already applies to in-path calls.
+	MinTimeout = 10 * time.Millisecond
+	MaxTimeout = 5 * time.Second
+	// DefaultMaxBodyBytes caps the request body mirrored to the engine.
+	// Requests with a larger body are inspected on headers and URI only.
+	DefaultMaxBodyBytes int64 = 64 << 10
+	// DefaultMaxConcurrent bounds inspections in flight toward the engine. The
+	// point is to fail fast instead of parking a goroutine per request for the
+	// whole timeout once the engine is saturated: a slow engine otherwise turns
+	// a traffic burst into a pile of waiters that all time out anyway. Sized so
+	// a healthy engine (single-digit milliseconds per call) never reaches it.
+	DefaultMaxConcurrent = 256
+	// MaxConcurrentLimit is the ceiling for that bound.
+	MaxConcurrentLimit = 4096
+	// MaxBodyBytesLimit is the ceiling for that cap. A single request can hold
+	// this much in memory; the shared Budget is what bounds the total across
+	// concurrent requests. Matches the proxy-wide body-capture ceiling.
+	MaxBodyBytesLimit int64 = 8 << 20
+	// maxResponseBytes bounds how much of a verdict response is read. The
+	// engine answers with a two-field JSON object, so anything beyond this is
+	// not a response we can act on.
+	maxResponseBytes int64 = 4 << 10
+)
+
+// Reasons the request body was not mirrored. Reported so an access-log reader
+// can distinguish "inspected and clean" from "never inspected", and so an
+// oversize opt-out is visible rather than silent.
+const (
+	BypassOversize = "oversize"
+	BypassUpgrade  = "upgrade"
+	BypassDisabled = "disabled"
+	BypassBudget   = "budget_exhausted"
+)
+
+// ErrUnavailable reports that the engine could not produce a verdict: the call
+// failed, timed out, or the engine rejected it (401 bad key, 500 malformed).
+// Distinguished from a block verdict so the caller can apply the per-service
+// mode: enforce fails closed, observe allows.
+var ErrUnavailable = errors.New("appsec engine unavailable")
+
+// Config configures a Client.
+type Config struct {
+	// URL is the AppSec endpoint, e.g. http://127.0.0.1:7422/.
+	URL string
+	// APIKey is the CrowdSec bouncer API key. The AppSec component validates it
+	// against LAPI, so the same key used for the decision stream works here.
+	APIKey string
+	// Timeout bounds a single inspection call. Zero means DefaultTimeout.
+	Timeout time.Duration
+	// MaxBodyBytes caps the mirrored request body. Zero means
+	// DefaultMaxBodyBytes; negative disables body forwarding entirely.
+	MaxBodyBytes int64
+	// MaxConcurrent bounds inspections in flight toward the engine. Zero means
+	// DefaultMaxConcurrent; negative disables the bound.
+	MaxConcurrent int
+	// Budget bounds the total body buffering in flight across all inspected
+	// requests. Nil disables that ceiling, which leaves the worst case at
+	// MaxBodyBytes times the concurrent request count; callers serving
+	// untrusted traffic should share the proxy-wide capture budget here.
+	Budget Budget
+	Logger *log.Entry
+}
+
+// Budget is the shared allowance for in-flight body buffering. Acquire reports
+// whether n bytes could be reserved; every successful Acquire is matched by a
+// Release of the same n. Satisfied by the proxy's capture budget, so AppSec and
+// the middleware body tap draw down one pool rather than two independent ones.
+type Budget interface {
+	Acquire(n int64) bool
+	Release(n int64)
+}
+
+// Client mirrors HTTP requests to a CrowdSec AppSec endpoint. It holds no
+// per-service state and is safe for concurrent use.
+type Client struct {
+	url          string
+	apiKey       string
+	maxBodyBytes int64
+	// sem bounds in-flight inspections. Nil when the bound is disabled.
+	sem    chan struct{}
+	budget Budget
+	http   *http.Client
+	logger *log.Entry
+}
+
+// New validates the config and returns a Client. The endpoint is not contacted
+// here: the engine may come up after the proxy.
+func New(cfg Config) (*Client, error) {
+	if cfg.URL == "" {
+		return nil, errors.New("appsec url is empty")
+	}
+	if cfg.APIKey == "" {
+		return nil, errors.New("appsec api key is empty")
+	}
+	parsed, err := url.Parse(cfg.URL)
+	if err != nil {
+		return nil, fmt.Errorf("parse appsec url: %w", err)
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return nil, fmt.Errorf("appsec url scheme %q is not http(s)", parsed.Scheme)
+	}
+	if parsed.Host == "" {
+		return nil, errors.New("appsec url has no host")
+	}
+
+	logger := cfg.Logger
+	if logger == nil {
+		logger = log.NewEntry(log.StandardLogger())
+	}
+
+	timeout := cfg.Timeout
+	switch {
+	case timeout <= 0:
+		timeout = DefaultTimeout
+	case timeout < MinTimeout:
+		logger.Warnf("appsec timeout %s is below the minimum, using %s", timeout, MinTimeout)
+		timeout = MinTimeout
+	case timeout > MaxTimeout:
+		logger.Warnf("appsec timeout %s exceeds the maximum, using %s", timeout, MaxTimeout)
+		timeout = MaxTimeout
+	}
+
+	// A negative cap is meaningful: forward no body at all.
+	maxBody := cfg.MaxBodyBytes
+	switch {
+	case maxBody == 0:
+		maxBody = DefaultMaxBodyBytes
+	case maxBody > MaxBodyBytesLimit:
+		logger.Warnf("appsec max body %d exceeds the maximum, using %d", maxBody, MaxBodyBytesLimit)
+		maxBody = MaxBodyBytesLimit
+	}
+
+	maxConcurrent := cfg.MaxConcurrent
+	switch {
+	case maxConcurrent == 0:
+		maxConcurrent = DefaultMaxConcurrent
+	case maxConcurrent > MaxConcurrentLimit:
+		logger.Warnf("appsec max concurrent %d exceeds the maximum, using %d", maxConcurrent, MaxConcurrentLimit)
+		maxConcurrent = MaxConcurrentLimit
+	}
+	var sem chan struct{}
+	if maxConcurrent > 0 {
+		sem = make(chan struct{}, maxConcurrent)
+	}
+
+	return &Client{
+		url:          cfg.URL,
+		apiKey:       cfg.APIKey,
+		maxBodyBytes: maxBody,
+		sem:          sem,
+		budget:       cfg.Budget,
+		logger:       logger,
+		http: &http.Client{
+			Timeout: timeout,
+			Transport: &http.Transport{
+				MaxIdleConns:        100,
+				MaxIdleConnsPerHost: 32,
+				IdleConnTimeout:     90 * time.Second,
+			},
+		},
+	}, nil
+}
+
+// Request is one inspection request.
+type Request struct {
+	// HTTP is the in-flight client request. Inspect buffers and restores its
+	// body, so the request stays forwardable afterwards.
+	HTTP *http.Request
+	// ClientIP is the resolved client address (after trusted-proxy handling).
+	ClientIP netip.Addr
+	// TransactionID correlates the engine's alert with the proxy's access log
+	// entry. Empty lets the engine generate its own UUID.
+	TransactionID string
+	// RedactBodyFields lists form fields whose values are replaced before the
+	// body is mirrored. Used to keep credentials submitted to the proxy's own
+	// login form out of the engine while still inspecting the rest.
+	RedactBodyFields []string
+	// RedactHeaders, RedactCookies and RedactQueryParams name the credentials
+	// the proxy already withholds from backends: the header-auth values, its
+	// session cookie, and the OIDC session token. The engine logs and alerts on
+	// what it inspects, so mirroring them there would reintroduce the leak the
+	// upstream strippers exist to prevent. Only the values are replaced, so the
+	// surrounding headers, cookies and query stay inspectable.
+	RedactHeaders     []string
+	RedactCookies     []string
+	RedactQueryParams []string
+}
+
+// Result is the outcome of an inspection.
+type Result struct {
+	Verdict restrict.Verdict
+	// BodyBypass names why the request body was not mirrored, empty when it
+	// was (or when the request had none). The engine still saw the headers and
+	// URI, so this is a coverage note, not a failure.
+	BodyBypass string
+	// Release returns the buffered body's budget reservation. Never nil, so it
+	// is always safe to defer. It must run only once the request has been
+	// served, not when Inspect returns: the buffer stays alive as r.Body for
+	// the backend to read, so releasing earlier would let the budget admit
+	// buffering that is still resident.
+	Release func()
+}
+
+// noopRelease is the Release for inspections that reserved no budget.
+func noopRelease() {}
+
+// Inspect mirrors r to the AppSec engine and returns its verdict. A nil error
+// with restrict.Allow means the request passed. On failure it returns
+// DenyAppSecUnavailable wrapped with ErrUnavailable; the caller decides whether
+// that blocks, based on the per-service mode.
+func (c *Client) Inspect(ctx context.Context, req Request) (Result, error) {
+	if c == nil {
+		return Result{Verdict: restrict.DenyAppSecUnavailable, Release: noopRelease}, ErrUnavailable
+	}
+	if req.HTTP == nil {
+		return Result{Verdict: restrict.DenyAppSecUnavailable, Release: noopRelease}, fmt.Errorf("%w: nil request", ErrUnavailable)
+	}
+
+	// release is carried out to the caller rather than deferred here: the
+	// buffered body outlives this call as r.Body.
+	if !c.acquireSlot() {
+		// Deny rather than wave through: a flood must not be a way to switch
+		// inspection off. Enforce blocks, observe logs and allows, exactly as
+		// for an unreachable engine.
+		return Result{Verdict: restrict.DenyAppSecUnavailable, Release: noopRelease},
+			fmt.Errorf("%w: %d inspections already in flight", ErrUnavailable, cap(c.sem))
+	}
+	defer c.releaseSlot()
+
+	body, bypass, release, err := c.readBody(req)
+	if err != nil {
+		return Result{Verdict: restrict.DenyAppSecUnavailable, Release: release}, fmt.Errorf("%w: read body: %w", ErrUnavailable, err)
+	}
+
+	outbound, err := c.buildRequest(ctx, req, body)
+	if err != nil {
+		return Result{Verdict: restrict.DenyAppSecUnavailable, BodyBypass: bypass, Release: release}, fmt.Errorf("%w: %w", ErrUnavailable, err)
+	}
+
+	resp, err := c.http.Do(outbound)
+	if err != nil {
+		return Result{Verdict: restrict.DenyAppSecUnavailable, BodyBypass: bypass, Release: release}, fmt.Errorf("%w: %w", ErrUnavailable, err)
+	}
+	defer func() {
+		// Drain before closing. net/http only returns a connection to the idle
+		// pool once its body is read to EOF; closing with bytes outstanding
+		// discards it. Every verdict carries a JSON body, so skipping this
+		// would cost a fresh handshake per inspected request, inside the
+		// timeout budget.
+		if _, err := io.Copy(io.Discard, io.LimitReader(resp.Body, maxResponseBytes)); err != nil {
+			c.logger.Tracef("drain appsec response body: %v", err)
+		}
+		if err := resp.Body.Close(); err != nil {
+			c.logger.Tracef("close appsec response body: %v", err)
+		}
+	}()
+
+	verdict, err := c.verdict(resp)
+	return Result{Verdict: verdict, BodyBypass: bypass, Release: release}, err
+}
+
+// acquireSlot takes an in-flight slot without blocking, reporting false when
+// the engine is already at capacity.
+func (c *Client) acquireSlot() bool {
+	if c.sem == nil {
+		return true
+	}
+	select {
+	case c.sem <- struct{}{}:
+		return true
+	default:
+		return false
+	}
+}
+
+// releaseSlot returns the slot. Scoped to the engine call, not the request: the
+// buffered body outlives the call but the engine's attention does not.
+func (c *Client) releaseSlot() {
+	if c.sem == nil {
+		return
+	}
+	select {
+	case <-c.sem:
+	default:
+	}
+}
+
+// readBody buffers the body so it can be mirrored, always restoring it on the
+// original request. Returns nil when there is no body to forward: no body at
+// all, an upgrade request, or a body over the cap. A login form is forwarded
+// with its credential values redacted rather than suppressed.
+// release is never nil; the caller invokes it once the request has been served.
+func (c *Client) readBody(req Request) (body []byte, bypass string, release func(), err error) {
+	r := req.HTTP
+	if r.Body == nil || r.Body == http.NoBody {
+		return nil, "", noopRelease, nil
+	}
+	if c.maxBodyBytes < 0 {
+		return nil, BypassDisabled, noopRelease, nil
+	}
+	// A genuine upgrade request carries no body to inspect (net/http hands us
+	// http.NoBody, caught above); the hijacked stream is reached through
+	// Hijacker, never r.Body. The test has to be the forwarder's own, because a
+	// looser one would skip inspection for requests the forwarder still
+	// delivers to the backend with their body intact.
+	if netutil.IsUpgradeRequest(r.Header) {
+		return nil, BypassUpgrade, noopRelease, nil
+	}
+	// A Content-Length over the cap is known to be too large before reading.
+	if r.ContentLength > c.maxBodyBytes {
+		return nil, BypassOversize, noopRelease, nil
+	}
+
+	// Reserve the whole cap rather than the eventual length: the reservation
+	// has to be made before the body is read, and until then the only bound
+	// known is the cap. Skipping inspection when the pool is drained keeps a
+	// burst of large bodies from being an out-of-memory lever; the bypass is
+	// recorded so the gap in coverage is visible.
+	release = noopRelease
+	if c.budget != nil {
+		if !c.budget.Acquire(c.maxBodyBytes) {
+			c.logger.Debugf("appsec buffer budget exhausted, inspecting headers and URI only")
+			return nil, BypassBudget, noopRelease, nil
+		}
+		var once sync.Once
+		release = func() { once.Do(func() { c.budget.Release(c.maxBodyBytes) }) }
+	}
+
+	buffered, oversize, err := bufferBody(r, c.maxBodyBytes)
+	if err != nil {
+		// bufferBody restored r.Body from the bytes it did read, so the
+		// reservation stays held until the caller releases it.
+		return nil, "", release, err
+	}
+	// An oversize body was only partially read: a truncated prefix changes the
+	// engine's verdict in both directions, so inspect headers and URI only.
+	if oversize {
+		return nil, BypassOversize, release, nil
+	}
+	return redactFormFields(r.Header.Get("Content-Type"), buffered, req.RedactBodyFields), "", release, nil
+}
+
+// buildRequest assembles the mirrored request. Per the protocol it is a GET
+// when there is no body and a POST otherwise; bytes.Reader gives the outbound
+// request an accurate Content-Length, which the engine relies on to read the
+// body at all.
+func (c *Client) buildRequest(ctx context.Context, req Request, body []byte) (*http.Request, error) {
+	method := http.MethodGet
+	var payload io.Reader
+	if len(body) > 0 {
+		method = http.MethodPost
+		payload = bytes.NewReader(body)
+	}
+
+	outbound, err := http.NewRequestWithContext(ctx, method, c.url, payload)
+	if err != nil {
+		return nil, fmt.Errorf("build appsec request: %w", err)
+	}
+
+	r := req.HTTP
+	copyInspectableHeaders(outbound.Header, r.Header)
+	redactSecrets(outbound.Header, req)
+
+	outbound.Header.Set(headerAPIKey, c.apiKey)
+	outbound.Header.Set(headerIP, req.ClientIP.Unmap().String())
+	outbound.Header.Set(headerURI, mirroredURI(r.URL, req.RedactQueryParams))
+	outbound.Header.Set(headerVerb, r.Method)
+	outbound.Header.Set(headerHost, r.Host)
+	if ua := r.UserAgent(); ua != "" {
+		outbound.Header.Set(headerUserAgent, ua)
+	}
+	outbound.Header.Set(headerHTTPVersion, httpVersion(r))
+	if req.TransactionID != "" {
+		outbound.Header.Set(headerTransactionID, req.TransactionID)
+	}
+	return outbound, nil
+}
+
+// verdict maps the engine's response to a restrict.Verdict. 200 is a pass and
+// 401/500 are engine-side failures; every other status carries a remediation in
+// the body. The blocked status code is operator-configurable
+// (blocked_http_code), so the action field decides, not the status.
+func (c *Client) verdict(resp *http.Response) (restrict.Verdict, error) {
+	switch resp.StatusCode {
+	case http.StatusUnauthorized:
+		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: rejected api key", ErrUnavailable)
+	case http.StatusInternalServerError:
+		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: engine error", ErrUnavailable)
+	}
+
+	// Every status, 200 included, has to carry a decodable remediation. Taking a
+	// bare 200 as a pass would mean a URL pointing at anything that answers 200
+	// (a health endpoint, a load balancer's default page) silently allows every
+	// request while the service reports itself as enforcing.
+
+	var decoded struct {
+		Action string `json:"action"`
+	}
+	if err := json.NewDecoder(io.LimitReader(resp.Body, maxResponseBytes)).Decode(&decoded); err != nil {
+		// Every remediation carries a decodable action, so a response without
+		// one is not a verdict: most often the URL points at something that is
+		// not the AppSec endpoint, which answers 404 with HTML. Reported as
+		// unavailable rather than a ban so the access log names the real fault
+		// instead of sending an operator hunting for a rule that never fired.
+		// Enforce still blocks either way; only the recorded reason differs.
+		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: undecodable response (status %d): %w", ErrUnavailable, resp.StatusCode, err)
+	}
+
+	switch decoded.Action {
+	case actionAllow:
+		return restrict.Allow, nil
+	case actionCaptcha:
+		return restrict.DenyAppSecCaptcha, nil
+	case actionBan:
+		return restrict.DenyAppSecBan, nil
+	case "":
+		// Decodable JSON without a remediation is not a verdict either: the
+		// endpoint answered, but not as the engine. Same reasoning as an
+		// undecodable body, and the same reason to point at configuration.
+		return restrict.DenyAppSecUnavailable,
+			fmt.Errorf("%w: response carried no remediation (status %d)", ErrUnavailable, resp.StatusCode)
+	default:
+		// A remediation we do not implement still means the engine flagged the
+		// request, so deny.
+		c.logger.Debugf("unknown appsec action %q (status %d), treating as ban", decoded.Action, resp.StatusCode)
+		return restrict.DenyAppSecBan, nil
+	}
+}
+
+// copyInspectableHeaders copies the client's headers, which are what the WAF
+// rules actually match on, dropping hop-by-hop headers that describe the
+// proxy-to-engine connection rather than the client request, and any header in
+// the AppSec protocol namespace.
+func copyInspectableHeaders(dst, src http.Header) {
+	for name, values := range src {
+		if hopByHopHeaders[http.CanonicalHeaderKey(name)] {
+			continue
+		}
+		if strings.HasPrefix(http.CanonicalHeaderKey(name), headerPrefix) {
+			continue
+		}
+		dst[http.CanonicalHeaderKey(name)] = append([]string(nil), values...)
+	}
+	// Content-Length describes the mirrored payload, not the client's: net/http
+	// sets it from the body we actually attach. Content-Type is kept either way
+	// so rules matching on it still fire when the body was not forwarded.
+	dst.Del("Content-Length")
+}
+
+// redactSecrets replaces the credential values the proxy withholds from
+// backends, so the mirrored copy does not carry them either.
+func redactSecrets(dst http.Header, req Request) {
+	for _, name := range req.RedactHeaders {
+		// Presence, not Get: a header whose first value is empty still carries
+		// its later values to the engine, while the upstream strip deletes the
+		// name outright. Set collapses every value into the placeholder.
+		if len(dst.Values(name)) > 0 {
+			dst.Set(name, redactedPlaceholder)
+		}
+	}
+	// Every Cookie line, not just the first: a client may send several, and Get
+	// would leave the session cookie in any later one mirrored in the clear.
+	if cookies := dst.Values("Cookie"); len(cookies) > 0 {
+		redacted := make([]string, len(cookies))
+		for i, cookie := range cookies {
+			redacted[i] = redactCookieHeader(cookie, req.RedactCookies)
+		}
+		dst["Cookie"] = redacted
+	}
+}
+
+// mirroredURI renders the request target for the URI header, with the named
+// query parameter values replaced.
+func mirroredURI(u *url.URL, redactParams []string) string {
+	uri := u.RequestURI()
+	if u.RawQuery == "" || len(redactParams) == 0 {
+		return uri
+	}
+	redacted := redactQuery(u.RawQuery, redactParams)
+	if redacted == u.RawQuery {
+		return uri
+	}
+	// RequestURI is path + "?" + RawQuery; swap only the query part so the
+	// path keeps its original encoding.
+	return strings.TrimSuffix(uri, u.RawQuery) + redacted
+}
+
+var hopByHopHeaders = map[string]bool{
+	"Connection":          true,
+	"Keep-Alive":          true,
+	"Proxy-Authenticate":  true,
+	"Proxy-Authorization": true,
+	"Proxy-Connection":    true,
+	"Te":                  true,
+	"Trailer":             true,
+	"Transfer-Encoding":   true,
+	"Upgrade":             true,
+}
+
+// httpVersion renders the two-digit form the engine parses ("11", "20").
+func httpVersion(r *http.Request) string {
+	major, minor := r.ProtoMajor, r.ProtoMinor
+	if major < 0 || major > 9 || minor < 0 || minor > 9 {
+		return ""
+	}
+	return fmt.Sprintf("%d%d", major, minor)
+}

proxy/internal/auth/appsec_test.go

@@ -0,0 +1,306 @@
+package auth
+
+import (
+	"crypto/ed25519"
+	"encoding/base64"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/appsec"
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/proxy/internal/restrict"
+	"github.com/netbirdio/netbird/proxy/internal/types"
+)
+
+// appsecEngine is a stub AppSec component returning a fixed remediation.
+func appsecEngine(t *testing.T, status int, body string) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(status)
+		if body != "" {
+			_, _ = w.Write([]byte(body))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+// serveWithAppSec runs a request through the middleware for a domain configured
+// with the given AppSec mode, returning the response and the captured metadata.
+func serveWithAppSec(t *testing.T, mode restrict.AppSecMode, client *appsec.Client, r *http.Request) (*httptest.ResponseRecorder, map[string]string, bool) {
+	t.Helper()
+
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	mw.SetAppSec(client)
+	require.NoError(t, mw.AddDomain("svc.example.com", DomainSettings{
+		AccountID:  types.AccountID("acct-1"),
+		ServiceID:  types.ServiceID("svc-1"),
+		AppSecMode: mode,
+	}))
+
+	reached := false
+	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	cd := proxy.NewCapturedData("req-1")
+	r = r.WithContext(proxy.WithCapturedData(r.Context(), cd))
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, r)
+
+	return rec, cd.GetMetadata(), reached
+}
+
+func appsecRequest() *http.Request {
+	r := httptest.NewRequest(http.MethodGet, "http://svc.example.com/?x=/etc/passwd", nil)
+	r.Host = "svc.example.com"
+	r.RemoteAddr = "203.0.113.7:44444"
+	return r
+}
+
+func TestCheckAppSec_EnforceBlocksBannedRequest(t *testing.T) {
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban","http_status":403}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
+
+	assert.Equal(t, http.StatusForbidden, rec.Code)
+	assert.False(t, reached, "a banned request must not reach the backend")
+	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
+	assert.NotContains(t, meta, "appsec_mode", "enforce is the default, only observe is annotated")
+}
+
+func TestCheckAppSec_ObserveAllowsAndRecordsVerdict(t *testing.T) {
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban","http_status":403}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecObserve, client, appsecRequest())
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.True(t, reached, "observe mode must not block")
+	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
+	assert.Equal(t, "observe", meta["appsec_mode"])
+}
+
+func TestCheckAppSec_AllowedRequestPasses(t *testing.T) {
+	srv := appsecEngine(t, http.StatusOK, `{"action":"allow","http_status":200}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.True(t, reached)
+	assert.NotContains(t, meta, "appsec_verdict", "a clean request records no verdict")
+}
+
+func TestCheckAppSec_OffSkipsInspection(t *testing.T) {
+	// An engine that would ban everything; the mode must keep us away from it.
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecOff, client, appsecRequest())
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.True(t, reached)
+	assert.Empty(t, meta)
+}
+
+func TestCheckAppSec_EnforceFailsClosedWithoutClient(t *testing.T) {
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, nil, appsecRequest())
+
+	assert.Equal(t, http.StatusForbidden, rec.Code,
+		"enforce with no configured endpoint must deny rather than pass traffic uninspected")
+	assert.False(t, reached)
+	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
+}
+
+func TestCheckAppSec_ObserveAllowsWithoutClient(t *testing.T) {
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecObserve, nil, appsecRequest())
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.True(t, reached)
+	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
+	assert.Equal(t, "observe", meta["appsec_mode"])
+}
+
+func TestCheckAppSec_EnforceFailsClosedWhenEngineUnreachable(t *testing.T) {
+	client, err := appsec.New(appsec.Config{URL: "http://127.0.0.1:1/", APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
+
+	assert.Equal(t, http.StatusForbidden, rec.Code)
+	assert.False(t, reached)
+	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
+}
+
+func TestCheckAppSec_InspectsOverlayTraffic(t *testing.T) {
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	// Requests arriving over the WireGuard overlay skip the geo and IP-reputation
+	// checks, but request content is just as inspectable.
+	r := appsecRequest()
+	r = r.WithContext(types.WithOverlayOrigin(r.Context()))
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
+
+	assert.Equal(t, http.StatusForbidden, rec.Code, "overlay traffic must still be inspected")
+	assert.False(t, reached)
+	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
+}
+
+func TestCheckAppSec_UnresolvableClientIPFailsClosed(t *testing.T) {
+	srv := appsecEngine(t, http.StatusOK, `{"action":"allow"}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	r := appsecRequest()
+	r.RemoteAddr = "not-an-address"
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
+
+	assert.Equal(t, http.StatusForbidden, rec.Code,
+		"the engine requires a client address; a request we cannot attribute must not pass")
+	assert.False(t, reached)
+	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
+}
+
+// The redaction sets are resolved from the domain's schemes at registration, so
+// what AppSec withholds cannot drift from what those schemes actually accept.
+func TestAddDomain_ResolvesRedactionSetsFromSchemes(t *testing.T) {
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	require.NoError(t, mw.AddDomain("svc.example.com", DomainSettings{
+		Schemes: []Scheme{
+			NewPassword(nil, "svc-1", "acct-1"),
+			NewHeader(nil, "svc-1", "acct-1", "X-Api-Key"),
+		},
+		SessionPublicKey:  base64.StdEncoding.EncodeToString(make([]byte, ed25519.PublicKeySize)),
+		SessionExpiration: time.Hour,
+		AppSecMode:        restrict.AppSecEnforce,
+	}))
+
+	mw.domainsMux.RLock()
+	config := mw.domains["svc.example.com"]
+	mw.domainsMux.RUnlock()
+
+	assert.Equal(t, []string{"password"}, config.redactBodyFields)
+	assert.Equal(t, []string{"X-Api-Key"}, config.redactHeaders)
+	// r.FormValue merges the query into the form, so a credential passed there
+	// authenticates and must be redacted alongside the OIDC session token.
+	assert.Equal(t, []string{"session_token", "password"}, config.redactQueryParams)
+}
+
+// countingBudget records reservations so a test can observe when the
+// middleware hands them back.
+type countingBudget struct {
+	mu        sync.Mutex
+	total     int64
+	used      int64
+	maxAtOnce int64
+}
+
+func (b *countingBudget) Acquire(n int64) bool {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	if b.used+n > b.total {
+		return false
+	}
+	b.used += n
+	if b.used > b.maxAtOnce {
+		b.maxAtOnce = b.used
+	}
+	return true
+}
+
+func (b *countingBudget) Release(n int64) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.used -= n
+}
+
+func (b *countingBudget) inUse() int64 {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.used
+}
+
+// The buffered body stays alive as r.Body until the backend has read it, so
+// Protect must hold the reservation for the whole request and return it only
+// once the handler chain has unwound. Releasing inside Inspect would let the
+// budget admit buffering that is still resident.
+func TestProtect_AppSecBudgetHeldForRequestAndReleasedAfter(t *testing.T) {
+	srv := appsecEngine(t, http.StatusOK, `{"action":"allow"}`)
+	budget := &countingBudget{total: 1 << 20}
+	client, err := appsec.New(appsec.Config{
+		URL:          srv.URL,
+		APIKey:       "k",
+		MaxBodyBytes: 4096,
+		Budget:       budget,
+	})
+	require.NoError(t, err)
+
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	mw.SetAppSec(client)
+	require.NoError(t, mw.AddDomain("svc.example.com", DomainSettings{
+		AccountID:  types.AccountID("acct-1"),
+		ServiceID:  types.ServiceID("svc-1"),
+		AppSecMode: restrict.AppSecEnforce,
+	}))
+
+	var inHandler int64
+	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// The backend reads the buffered body here, so the reservation must
+		// still be held at this point.
+		inHandler = budget.inUse()
+		_, _ = io.ReadAll(r.Body)
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	r := httptest.NewRequest(http.MethodPost, "http://svc.example.com/", strings.NewReader("payload"))
+	r.Host = "svc.example.com"
+	cd := proxy.NewCapturedData("req-1")
+	r = r.WithContext(proxy.WithCapturedData(r.Context(), cd))
+
+	handler.ServeHTTP(httptest.NewRecorder(), r)
+
+	assert.Equal(t, int64(4096), inHandler, "the reservation must be held while the backend reads the body")
+	assert.Equal(t, int64(0), budget.inUse(), "Protect must release the reservation once the request is served")
+}
+
+// A denied request never reaches the backend, but Protect still has to hand the
+// reservation back or the pool leaks one cap per blocked request.
+func TestProtect_AppSecBudgetReleasedOnDeny(t *testing.T) {
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
+	budget := &countingBudget{total: 1 << 20}
+	client, err := appsec.New(appsec.Config{
+		URL:          srv.URL,
+		APIKey:       "k",
+		MaxBodyBytes: 4096,
+		Budget:       budget,
+	})
+	require.NoError(t, err)
+
+	r := httptest.NewRequest(http.MethodPost, "http://svc.example.com/", strings.NewReader("payload"))
+	r.Host = "svc.example.com"
+	rec, _, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
+
+	assert.False(t, reached, "a banned request must not reach the backend")
+	assert.Equal(t, http.StatusForbidden, rec.Code)
+	assert.Equal(t, int64(0), budget.inUse(), "a blocked request must not leak its reservation")
+}

proxy/internal/auth/header.go

@@ -39,6 +39,11 @@ func (Header) Type() auth.Method {
 	return auth.MethodHeader
 }
 
+// HeaderName returns the request header this scheme reads its credential from.
+func (h Header) HeaderName() string {
+	return h.headerName
+}
+
 // Authenticate checks for the configured header in the request. If absent,
 // returns empty (unauthenticated). If present, validates via gRPC.
 func (h Header) Authenticate(r *http.Request) (string, string, error) {

proxy/internal/auth/middleware.go

@@ -18,6 +18,7 @@ import (
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/proxy/internal/appsec"
 	"github.com/netbirdio/netbird/proxy/internal/proxy"
 	"github.com/netbirdio/netbird/proxy/internal/restrict"
 	"github.com/netbirdio/netbird/proxy/internal/types"
@@ -25,6 +26,11 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
+// sessionCookieNames is the cookie set AppSec redacts before mirroring: the
+// proxy's session cookie is a bearer credential for the service, and the
+// reverse proxy already strips it before forwarding upstream.
+var sessionCookieNames = []string{auth.SessionCookieName}
+
 // errValidationUnavailable indicates that session validation failed due to
 // an infrastructure error (e.g. gRPC unavailable), not an invalid token.
 var errValidationUnavailable = errors.New("session validation unavailable")
@@ -59,6 +65,14 @@ type DomainConfig struct {
 	IPRestrictions    *restrict.Filter
 	// Private routes the domain through ValidateTunnelPeer; failure → 403.
 	Private bool
+	// AppSecMode enables CrowdSec AppSec request inspection for this domain.
+	AppSecMode restrict.AppSecMode
+	// redact* name the credentials this domain's schemes accept, resolved once
+	// at registration. AppSec replaces their values before mirroring a request,
+	// matching what the reverse proxy strips before forwarding upstream.
+	redactBodyFields  []string
+	redactHeaders     []string
+	redactQueryParams []string
 }
 
 type validationResult struct {
@@ -82,6 +96,9 @@ type Middleware struct {
 	sessionValidator SessionValidator
 	geo              restrict.GeoResolver
 	tunnelCache      *tunnelValidationCache
+	// appsec is the shared CrowdSec AppSec client, nil when the proxy has no
+	// AppSec endpoint configured. Set once during startup, before serving.
+	appsec *appsec.Client
 }
 
 // NewMiddleware creates a new authentication middleware. The sessionValidator is
@@ -99,6 +116,12 @@ func NewMiddleware(logger *log.Logger, sessionValidator SessionValidator, geo re
 	}
 }
 
+// SetAppSec installs the shared CrowdSec AppSec client. Must be called during
+// startup, before the middleware serves any request.
+func (mw *Middleware) SetAppSec(client *appsec.Client) {
+	mw.appsec = client
+}
+
 // Protect wraps next with per-domain authentication and IP restriction checks.
 // Requests whose Host is not registered pass through unchanged.
 func (mw *Middleware) Protect(next http.Handler) http.Handler {
@@ -123,6 +146,14 @@ func (mw *Middleware) Protect(next http.Handler) http.Handler {
 			return
 		}
 
+		// Deferred, not released here: the inspected body stays alive as r.Body
+		// until the backend has read it, which happens inside next.ServeHTTP.
+		appSecAllowed, releaseAppSec := mw.checkAppSec(w, r, config)
+		defer releaseAppSec()
+		if !appSecAllowed {
+			return
+		}
+
 		// Private services bypass operator schemes and gate on tunnel peer.
 		if config.Private {
 			if mw.forwardWithTunnelPeer(w, r, host, config, next) {
@@ -262,6 +293,134 @@ func (mw *Middleware) checkIPRestrictions(w http.ResponseWriter, r *http.Request
 	return false
 }
 
+// checkAppSec mirrors the request to the CrowdSec AppSec engine when the domain
+// enables inspection. Returns false when the request was blocked and a response
+// has been written.
+//
+// The returned release frees the body-buffering budget the inspection reserved
+// and is never nil. It must run only after the request has been served, since
+// the buffered body stays alive as r.Body for the backend to read.
+//
+// Every non-allow remediation blocks with 403, captcha included: the proxy has
+// no challenge flow to serve. The distinct verdict is still recorded so the
+// access log shows which remediation the engine actually chose.
+//
+// Unlike the geo and IP-reputation checks, this runs for overlay traffic too:
+// AppSec inspects request content, which is just as meaningful when the caller
+// reached the proxy through the WireGuard tunnel.
+func (mw *Middleware) checkAppSec(w http.ResponseWriter, r *http.Request, config DomainConfig) (bool, func()) {
+	if !config.AppSecMode.Enabled() {
+		return true, func() {}
+	}
+
+	verdict, release := mw.inspectAppSec(r, config)
+	if verdict == restrict.Allow {
+		return true, release
+	}
+
+	observe := config.AppSecMode == restrict.AppSecObserve
+	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+		cd.SetMetadata("appsec_verdict", verdict.String())
+		if observe {
+			cd.SetMetadata("appsec_mode", "observe")
+		}
+	}
+
+	if observe {
+		mw.logger.Debugf("AppSec observe: would block %s for %s (%s)", r.RemoteAddr, r.Host, verdict)
+		return true, release
+	}
+
+	mw.markDenied(r, verdict.String())
+	mw.logger.Debugf("AppSec: %s for %s %s", verdict, r.Host, r.RemoteAddr)
+	http.Error(w, "Forbidden", http.StatusForbidden)
+	return false, release
+}
+
+// inspectAppSec runs the AppSec call and returns its verdict. Failures come
+// back as DenyAppSecUnavailable regardless of mode so observe mode still
+// records that inspection did not happen; the caller decides what blocks. The
+// returned release is never nil.
+func (mw *Middleware) inspectAppSec(r *http.Request, config DomainConfig) (restrict.Verdict, func()) {
+	// Mode requested but the proxy has no AppSec endpoint configured. Management
+	// gates this on the cluster capability; a stale mapping can still arrive.
+	if mw.appsec == nil {
+		mw.logger.Debugf("AppSec mode %q requested for %s but no AppSec endpoint is configured", config.AppSecMode, r.Host)
+		return restrict.DenyAppSecUnavailable, func() {}
+	}
+
+	clientIP := mw.resolveClientIP(r)
+	if !clientIP.IsValid() {
+		// The engine requires a client address, and a request whose source we
+		// cannot establish is exactly the kind we must not wave through.
+		mw.logger.Debugf("AppSec: cannot resolve client address for %q", r.RemoteAddr)
+		return restrict.DenyAppSecUnavailable, func() {}
+	}
+
+	req := appsec.Request{
+		HTTP:              r,
+		ClientIP:          clientIP,
+		RedactBodyFields:  config.redactBodyFields,
+		RedactHeaders:     config.redactHeaders,
+		RedactCookies:     sessionCookieNames,
+		RedactQueryParams: config.redactQueryParams,
+	}
+	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+		req.TransactionID = cd.GetRequestID()
+	}
+
+	result, err := mw.appsec.Inspect(r.Context(), req)
+	if err != nil {
+		mw.logger.Debugf("AppSec inspection failed for %s: %v", r.Host, err)
+	}
+	// Record when the body went uninspected: headers and URI were still
+	// checked, but an operator reading the log should not read a clean verdict
+	// as "the payload was examined". Oversize is reachable by padding, so its
+	// absence from the log would hide a deliberate opt-out.
+	if result.BodyBypass != "" {
+		if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+			cd.SetMetadata("appsec_body_bypass", result.BodyBypass)
+		}
+	}
+	return result.Verdict, result.Release
+}
+
+// credentialFormFields lists the login form fields whose values are redacted
+// from the mirrored body, so a password or PIN submitted to the proxy's own
+// login form never reaches the Security Engine.
+func credentialFormFields(schemes []Scheme) []string {
+	var fields []string
+	for _, s := range schemes {
+		switch s.Type() {
+		case auth.MethodPassword:
+			fields = append(fields, passwordFormId)
+		case auth.MethodPIN:
+			fields = append(fields, pinFormId)
+		}
+	}
+	return fields
+}
+
+// credentialHeaders lists the request headers whose values are redacted from
+// the mirrored request. A header-auth scheme carries a session token the proxy
+// validates and never forwards upstream, so the engine must not see it either.
+func credentialHeaders(schemes []Scheme) []string {
+	var names []string
+	for _, s := range schemes {
+		// Structural, not a concrete Header assertion: if the scheme is ever
+		// registered as a pointer, a type assertion would quietly stop matching
+		// and the header would start reaching the engine again.
+		named, ok := s.(interface{ HeaderName() string })
+		if !ok {
+			continue
+		}
+		if name := named.HeaderName(); name != "" {
+			names = append(names, name)
+		}
+	}
+	return names
+}
+
 // resolveClientIP extracts the real client IP from CapturedData, falling back to r.RemoteAddr.
 func (mw *Middleware) resolveClientIP(r *http.Request) netip.Addr {
 	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
@@ -281,12 +440,18 @@ func (mw *Middleware) resolveClientIP(r *http.Request) netip.Addr {
 	return addr.Unmap()
 }
 
-// blockIPRestriction sets captured data fields for an IP-restriction block event.
-func (mw *Middleware) blockIPRestriction(r *http.Request, reason string) {
+// markDenied records the deny reason on the captured data so the access log
+// attributes the response to the proxy rather than the backend.
+func (mw *Middleware) markDenied(r *http.Request, reason string) {
 	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
 		cd.SetOrigin(proxy.OriginAuth)
 		cd.SetAuthMethod(reason)
 	}
+}
+
+// blockIPRestriction sets captured data fields for an IP-restriction block event.
+func (mw *Middleware) blockIPRestriction(r *http.Request, reason string) {
+	mw.markDenied(r, reason)
 	mw.logger.Debugf("IP restriction: %s for %s", reason, r.RemoteAddr)
 }
 
@@ -637,45 +802,61 @@ func wasCredentialSubmitted(r *http.Request, method auth.Method) bool {
 	case auth.MethodPassword:
 		return r.FormValue("password") != ""
 	case auth.MethodOIDC:
-		return r.URL.Query().Get("session_token") != ""
+		return r.URL.Query().Get(sessionTokenParam) != ""
 	}
 	return false
 }
 
-// AddDomain registers authentication schemes for the given domain. With schemes a valid session public key is required.
-// private=true forces ValidateTunnelPeer enforcement (403 on failure) regardless of the schemes list.
-func (mw *Middleware) AddDomain(domain string, schemes []Scheme, publicKeyB64 string, expiration time.Duration, accountID types.AccountID, serviceID types.ServiceID, ipRestrictions *restrict.Filter, private bool) error {
-	if len(schemes) == 0 {
-		mw.domainsMux.Lock()
-		defer mw.domainsMux.Unlock()
-		mw.domains[domain] = DomainConfig{
-			AccountID:      accountID,
-			ServiceID:      serviceID,
-			IPRestrictions: ipRestrictions,
-			Private:        private,
-		}
-		return nil
+// DomainSettings is the per-domain configuration AddDomain applies.
+type DomainSettings struct {
+	Schemes []Scheme
+	// SessionPublicKey is the base64-encoded ed25519 key used to verify session
+	// cookies. Required when Schemes is non-empty.
+	SessionPublicKey  string
+	SessionExpiration time.Duration
+	AccountID         types.AccountID
+	ServiceID         types.ServiceID
+	IPRestrictions    *restrict.Filter
+	// Private forces ValidateTunnelPeer enforcement (403 on failure) regardless
+	// of the schemes list.
+	Private    bool
+	AppSecMode restrict.AppSecMode
+}
+
+// AddDomain registers authentication schemes for the given domain. With schemes
+// a valid session public key is required.
+func (mw *Middleware) AddDomain(domain string, settings DomainSettings) error {
+	credentialFields := credentialFormFields(settings.Schemes)
+	config := DomainConfig{
+		AccountID:        settings.AccountID,
+		ServiceID:        settings.ServiceID,
+		IPRestrictions:   settings.IPRestrictions,
+		Private:          settings.Private,
+		AppSecMode:       settings.AppSecMode,
+		redactBodyFields: credentialFields,
+		redactHeaders:    credentialHeaders(settings.Schemes),
+		// A credential can arrive in the query too: r.FormValue merges the URL
+		// query into the form, so "?password=..." authenticates just as a form
+		// post does and must not be mirrored in the clear either.
+		redactQueryParams: append([]string{sessionTokenParam}, credentialFields...),
 	}
 
-	pubKeyBytes, err := base64.StdEncoding.DecodeString(publicKeyB64)
-	if err != nil {
-		return fmt.Errorf("decode session public key for domain %s: %w", domain, err)
-	}
-	if len(pubKeyBytes) != ed25519.PublicKeySize {
-		return fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
+	if len(settings.Schemes) > 0 {
+		pubKeyBytes, err := base64.StdEncoding.DecodeString(settings.SessionPublicKey)
+		if err != nil {
+			return fmt.Errorf("decode session public key for domain %s: %w", domain, err)
+		}
+		if len(pubKeyBytes) != ed25519.PublicKeySize {
+			return fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
+		}
+		config.Schemes = settings.Schemes
+		config.SessionPublicKey = pubKeyBytes
+		config.SessionExpiration = settings.SessionExpiration
 	}
 
 	mw.domainsMux.Lock()
 	defer mw.domainsMux.Unlock()
-	mw.domains[domain] = DomainConfig{
-		Schemes:           schemes,
-		SessionPublicKey:  pubKeyBytes,
-		SessionExpiration: expiration,
-		AccountID:         accountID,
-		ServiceID:         serviceID,
-		IPRestrictions:    ipRestrictions,
-		Private:           private,
-	}
+	mw.domains[domain] = config
 	return nil
 }
 
@@ -730,10 +911,10 @@ func (mw *Middleware) validateSessionToken(ctx context.Context, host, token stri
 // parameter removed so it doesn't linger in the browser's address bar or history.
 func stripSessionTokenParam(u *url.URL) string {
 	q := u.Query()
-	if !q.Has("session_token") {
+	if !q.Has(sessionTokenParam) {
 		return u.RequestURI()
 	}
-	q.Del("session_token")
+	q.Del(sessionTokenParam)
 	clean := *u
 	clean.RawQuery = q.Encode()
 	return clean.RequestURI()

proxy/internal/auth/middleware_test.go

@@ -64,7 +64,7 @@ func TestAddDomain_ValidKey(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour})
 	require.NoError(t, err)
 
 	mw.domainsMux.RLock()
@@ -81,7 +81,7 @@ func TestAddDomain_EmptyKey(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, "", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionExpiration: time.Hour})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid session public key size")
 
@@ -95,7 +95,7 @@ func TestAddDomain_InvalidBase64(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, "not-valid-base64!!!", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: "not-valid-base64!!!", SessionExpiration: time.Hour})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "decode session public key")
 
@@ -110,7 +110,7 @@ func TestAddDomain_WrongKeySize(t *testing.T) {
 
 	shortKey := base64.StdEncoding.EncodeToString([]byte("tooshort"))
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, shortKey, time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: shortKey, SessionExpiration: time.Hour})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid session public key size")
 
@@ -123,7 +123,7 @@ func TestAddDomain_WrongKeySize(t *testing.T) {
 func TestAddDomain_NoSchemes_NoKeyRequired(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{SessionExpiration: time.Hour})
 	require.NoError(t, err, "domains with no auth schemes should not require a key")
 
 	mw.domainsMux.RLock()
@@ -139,8 +139,8 @@ func TestAddDomain_OverwritesPreviousConfig(t *testing.T) {
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
 
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false))
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp2.PublicKey, 2*time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp1.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp2.PublicKey, SessionExpiration: 2 * time.Hour}))
 
 	mw.domainsMux.RLock()
 	config := mw.domains["example.com"]
@@ -156,7 +156,7 @@ func TestRemoveDomain(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	mw.RemoveDomain("example.com")
 
@@ -180,7 +180,7 @@ func TestProtect_UnknownDomainPassesThrough(t *testing.T) {
 
 func TestProtect_DomainWithNoSchemesPassesThrough(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
-	require.NoError(t, mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -197,7 +197,7 @@ func TestProtect_UnauthenticatedRequestIsBlocked(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -218,7 +218,7 @@ func TestProtect_HostWithPortIsMatched(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -239,7 +239,7 @@ func TestProtect_ValidSessionCookiePassesThrough(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
 	require.NoError(t, err)
@@ -272,7 +272,7 @@ func TestProtect_SessionCookieGroupsPropagate(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	groups := []string{"engineering", "sre"}
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, groups, nil, time.Hour)
@@ -337,7 +337,7 @@ func TestProtect_PrivateService_TunnelPeerGroupsPropagate(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	// Private service: no operator schemes — auth gates solely on the tunnel peer.
-	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("agent.example.com", DomainSettings{SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
 
 	cd := proxy.NewCapturedData("")
 	cd.SetClientIP(netip.MustParseAddr("100.90.1.14")) // CGNAT tunnel source
@@ -377,7 +377,7 @@ func TestProtect_PrivateService_TunnelPeerDenied(t *testing.T) {
 	}}
 	mw := NewMiddleware(log.StandardLogger(), validator, nil)
 	kp := generateTestKeyPair(t)
-	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("agent.example.com", DomainSettings{SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
 
 	cd := proxy.NewCapturedData("")
 	cd.SetClientIP(netip.MustParseAddr("100.90.1.14"))
@@ -405,7 +405,7 @@ func TestProtect_ExpiredSessionCookieIsRejected(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	// Sign a token that expired 1 second ago.
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, -time.Second)
@@ -431,7 +431,7 @@ func TestProtect_WrongDomainCookieIsRejected(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	// Token signed for a different domain audience.
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "other.com", auth.MethodPIN, nil, nil, time.Hour)
@@ -458,7 +458,7 @@ func TestProtect_WrongKeyCookieIsRejected(t *testing.T) {
 	kp2 := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp1.PublicKey, SessionExpiration: time.Hour}))
 
 	// Token signed with a different private key.
 	token, err := sessionkey.SignToken(kp2.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
@@ -495,7 +495,7 @@ func TestProtect_SchemeAuthRedirectsWithCookie(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -548,7 +548,7 @@ func TestProtect_FailedAuthDoesNotSetCookie(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -584,7 +584,7 @@ func TestProtect_MultipleSchemes(t *testing.T) {
 			return "", "password", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{pinScheme, passwordScheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{pinScheme, passwordScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -614,7 +614,7 @@ func TestProtect_InvalidTokenFromSchemeReturns400(t *testing.T) {
 			return "invalid-jwt-token", "", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -638,7 +638,7 @@ func TestAddDomain_RandomBytes32NotEd25519(t *testing.T) {
 	key := base64.StdEncoding.EncodeToString(randomBytes)
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
 
-	err = mw.AddDomain("example.com", []Scheme{scheme}, key, time.Hour, "", "", nil, false)
+	err = mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: key, SessionExpiration: time.Hour})
 	require.NoError(t, err, "any 32-byte key should be accepted at registration time")
 }
 
@@ -647,10 +647,10 @@ func TestAddDomain_InvalidKeyDoesNotCorruptExistingConfig(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	// Attempt to overwrite with an invalid key.
-	err := mw.AddDomain("example.com", []Scheme{scheme}, "bad", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: "bad", SessionExpiration: time.Hour})
 	require.Error(t, err)
 
 	// The original valid config should still be intact.
@@ -674,7 +674,7 @@ func TestProtect_FailedPinAuthCapturesAuthMethod(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -701,7 +701,7 @@ func TestProtect_FailedPasswordAuthCapturesAuthMethod(t *testing.T) {
 			return "", "password", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -728,7 +728,7 @@ func TestProtect_NoCredentialsDoesNotCaptureAuthMethod(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -815,8 +815,7 @@ func TestWasCredentialSubmitted(t *testing.T) {
 func TestCheckIPRestrictions_UnparseableAddress(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -851,8 +850,7 @@ func TestCheckIPRestrictions_UsesCapturedDataClientIP(t *testing.T) {
 	// trusted proxies), checkIPRestrictions should use that IP, not RemoteAddr.
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"203.0.113.0/24"}}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"203.0.113.0/24"}})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -892,8 +890,7 @@ func TestCheckIPRestrictions_NilGeoWithCountryRules(t *testing.T) {
 	// Geo is nil, country restrictions are configured: must deny (fail-close).
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCountries: []string{"US"}}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCountries: []string{"US"}})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -916,11 +913,10 @@ func TestCheckIPRestrictions_NilGeoWithCountryRules(t *testing.T) {
 func TestCheckIPRestrictions_OverlayOriginSkipsCountryRules(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{
-			AllowedCIDRs:     []string{"100.64.0.0/10"},
-			AllowedCountries: []string{"US"},
-		}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{
+		AllowedCIDRs:     []string{"100.64.0.0/10"},
+		AllowedCountries: []string{"US"},
+	})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -953,8 +949,7 @@ func TestCheckIPRestrictions_OverlayOriginSkipsCountryRules(t *testing.T) {
 func TestCheckIPRestrictions_OverlayOriginRespectsCIDR(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -982,7 +977,7 @@ func TestProtect_OIDCOnlyRedirectsDirectly(t *testing.T) {
 			return "", oidcURL, nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1011,7 +1006,7 @@ func TestProtect_OIDCWithOtherMethodShowsLoginPage(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{oidcScheme, pinScheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{oidcScheme, pinScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1055,7 +1050,7 @@ func TestProtect_HeaderAuth_ForwardsOnSuccess(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	var backendCalled bool
 	capturedData := proxy.NewCapturedData("")
@@ -1098,7 +1093,7 @@ func TestProtect_HeaderAuth_MissingHeaderFallsThrough(t *testing.T) {
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
 	// Also add a PIN scheme so we can verify fallthrough behavior.
 	pinScheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr, pinScheme}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr, pinScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1118,7 +1113,7 @@ func TestProtect_HeaderAuth_WrongValueReturns401(t *testing.T) {
 		return &proto.AuthenticateResponse{Success: false}, nil
 	}}
 	hdr := NewHeader(mock, "svc1", "acc1", "X-API-Key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -1141,7 +1136,7 @@ func TestProtect_HeaderAuth_InfraErrorReturns502(t *testing.T) {
 		return nil, errors.New("gRPC unavailable")
 	}}
 	hdr := NewHeader(mock, "svc1", "acc1", "X-API-Key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1158,7 +1153,7 @@ func TestProtect_HeaderAuth_SubsequentRequestUsesSessionCookie(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
@@ -1218,7 +1213,7 @@ func TestProtect_HeaderAuth_MultipleValuesSameHeader(t *testing.T) {
 
 	// Single Header scheme (as if one entry existed), but the mock checks both values.
 	hdr := NewHeader(mock, "svc1", "acc1", "Authorization")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	var backendCalled bool
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -1276,7 +1271,7 @@ func TestProtect_OIDCOnPlainHTTP_BlockedWith400(t *testing.T) {
 			return "", "https://idp.example.com/authorize", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1300,7 +1295,7 @@ func TestProtect_OIDCOverTLS_NotBlocked(t *testing.T) {
 			return "", "https://idp.example.com/authorize", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1320,7 +1315,7 @@ func TestProtect_NonOIDCSchemes_PlainHTTP_NotBlocked(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1350,7 +1345,7 @@ func TestProtect_TunnelPeerFastPath_RequiresInboundMarker(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1385,7 +1380,7 @@ func TestProtect_TunnelPeerFastPath_TakesPathWithInboundMarker(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 

proxy/internal/auth/oidc.go

@@ -13,6 +13,10 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
+// sessionTokenParam is the query parameter the management server uses to hand
+// the minted session token back to the proxy after an OIDC login.
+const sessionTokenParam = "session_token"
+
 type urlGenerator interface {
 	GetOIDCURL(context.Context, *proto.GetOIDCURLRequest, ...grpc.CallOption) (*proto.GetOIDCURLResponse, error)
 }
@@ -43,7 +47,7 @@ func (o OIDC) Authenticate(r *http.Request) (string, string, error) {
 	// Check for the session_token query param (from OIDC redirects).
 	// The management server passes the token in the URL because it cannot set
 	// cookies for the proxy's domain (cookies are domain-scoped per RFC 6265).
-	if token := r.URL.Query().Get("session_token"); token != "" {
+	if token := r.URL.Query().Get(sessionTokenParam); token != "" {
 		return token, "", nil
 	}
 

proxy/internal/auth/tunnel_lookup_test.go

@@ -44,7 +44,7 @@ func (s *stubSessionValidator) ValidateTunnelPeer(_ context.Context, in *proto.V
 func newTunnelMiddleware(t *testing.T, validator SessionValidator) *Middleware {
 	t.Helper()
 	mw := NewMiddleware(log.New(), validator, nil)
-	require.NoError(t, mw.AddDomain("svc.example", nil, "", 0, "acct-1", "svc-1", nil, false))
+	require.NoError(t, mw.AddDomain("svc.example", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1"}))
 	return mw
 }
 
@@ -235,8 +235,8 @@ func TestForwardWithTunnelPeer_RoutesAccountIDIntoCacheKey(t *testing.T) {
 	}
 	mw := NewMiddleware(log.New(), validator, nil)
 
-	require.NoError(t, mw.AddDomain("svc-a.example", nil, "", 0, "acct-a", "svc-a", nil, false))
-	require.NoError(t, mw.AddDomain("svc-b.example", nil, "", 0, "acct-b", "svc-b", nil, false))
+	require.NoError(t, mw.AddDomain("svc-a.example", DomainSettings{AccountID: "acct-a", ServiceID: "svc-a"}))
+	require.NoError(t, mw.AddDomain("svc-b.example", DomainSettings{AccountID: "acct-b", ServiceID: "svc-b"}))
 
 	// The fast-path requires the inbound-listener marker on the context.
 	// The peerstore lookup itself is account-agnostic at this level
@@ -299,7 +299,7 @@ func TestForwardWithTunnelPeer_LocalLookupShortCircuitDoesNotPopulateCache(t *te
 
 func TestPrivateService_FailsClosedOnTunnelPeerFailure(t *testing.T) {
 	mw := NewMiddleware(log.New(), nil, nil)
-	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("private.svc", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
 
 	called := false
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -328,7 +328,7 @@ func TestPrivateService_ForwardsOnTunnelPeerSuccess(t *testing.T) {
 		},
 	}
 	mw := NewMiddleware(log.New(), validator, nil)
-	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("private.svc", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
 
 	called := false
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {

proxy/internal/middleware/bodytap/request.go

@@ -21,6 +21,8 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+
+	"github.com/netbirdio/netbird/proxy/internal/netutil"
 )
 
 // MaxRoutingScanBytes bounds how far ScanRoutingFields will read into a
@@ -34,7 +36,6 @@ const MaxRoutingScanBytes int64 = 32 << 20
 // metadata key by the chain when a request body is not surfaced.
 const (
 	BypassUpgradeHeader    = "upgrade_header"
-	BypassConnectionUpgrd  = "connection_upgrade"
 	BypassContentType      = "content_type_not_allowed"
 	BypassBudget           = "capture_budget_exhausted"
 	BypassNoConfig         = "no_capture_config"
@@ -125,12 +126,13 @@ func CaptureRequest(r *http.Request, cfg *Config, b Budget) (body []byte, trunca
 	if cfg.MaxRequestBytes <= 0 {
 		return nil, false, 0, BypassCapZero, release, nil
 	}
-	if r.Header.Get("Upgrade") != "" {
+	// The predicate has to be the forwarder's own: a looser one (either header
+	// on its own) skips capture for requests the forwarder still delivers to
+	// the upstream with their body intact, which hides them from every
+	// deny-capable middleware in the chain.
+	if netutil.IsUpgradeRequest(r.Header) {
 		return nil, false, 0, BypassUpgradeHeader, release, nil
 	}
-	if strings.EqualFold(r.Header.Get("Connection"), "upgrade") {
-		return nil, false, 0, BypassConnectionUpgrd, release, nil
-	}
 	if !contentTypeAllowed(r.Header.Get("Content-Type"), cfg.ContentTypes) {
 		return nil, false, 0, BypassContentType, release, nil
 	}

proxy/internal/netutil/upgrade.go

@@ -0,0 +1,23 @@
+package netutil
+
+import (
+	"net/http"
+
+	"golang.org/x/net/http/httpguts"
+)
+
+// IsUpgradeRequest reports whether r is a protocol-upgrade request, using the
+// same predicate httputil.ReverseProxy applies when it decides to hand the
+// connection over instead of proxying normally.
+//
+// Matching the forwarder exactly matters for anything that inspects a request
+// before it is proxied: a looser test (an Upgrade header on its own, say) marks
+// a request as an upgrade and skips inspection, while the forwarder still
+// delivers it to the backend as an ordinary request with its body intact. That
+// gap is a body-inspection bypass reachable by adding one header.
+func IsUpgradeRequest(h http.Header) bool {
+	if !httpguts.HeaderValuesContainsToken(h["Connection"], "Upgrade") {
+		return false
+	}
+	return h.Get("Upgrade") != ""
+}

proxy/internal/restrict/restrict.go

@@ -50,6 +50,59 @@ const (
 	CrowdSecObserve CrowdSecMode = "observe"
 )
 
+// AllowMatch controls how the configured allowlists (CIDR, country) combine.
+// Blocklists are always a separate hard-deny gate and are unaffected by it.
+type AllowMatch string
+
+const (
+	// AllowMatchAll requires the address to match every configured allowlist
+	// (AND). This is the default and preserves the historical behavior.
+	AllowMatchAll AllowMatch = "all"
+	// AllowMatchAny requires the address to match at least one configured
+	// allowlist (OR), e.g. "allowed country OR allowed CIDR".
+	AllowMatchAny AllowMatch = "any"
+)
+
+// normalizeAllowMatch maps unknown or empty values to the restrictive default
+// (AllowMatchAll) so an unrecognized mode never loosens access.
+func normalizeAllowMatch(m AllowMatch) AllowMatch {
+	if m == AllowMatchAny {
+		return AllowMatchAny
+	}
+	return AllowMatchAll
+}
+
+// AppSecMode is the per-service CrowdSec AppSec (WAF) enforcement mode.
+type AppSecMode string
+
+const (
+	// AppSecOff disables request inspection.
+	AppSecOff AppSecMode = ""
+	// AppSecEnforce blocks requests the engine flags, and fails closed when the
+	// engine is unreachable.
+	AppSecEnforce AppSecMode = "enforce"
+	// AppSecObserve records the verdict without blocking.
+	AppSecObserve AppSecMode = "observe"
+)
+
+// ParseAppSecMode maps a wire value to an AppSecMode. Unrecognized values map
+// to AppSecOff so a typo never turns inspection into an unintended block.
+func ParseAppSecMode(s string) AppSecMode {
+	switch AppSecMode(s) {
+	case AppSecEnforce:
+		return AppSecEnforce
+	case AppSecObserve:
+		return AppSecObserve
+	default:
+		return AppSecOff
+	}
+}
+
+// Enabled reports whether the mode asks for request inspection.
+func (m AppSecMode) Enabled() bool {
+	return m == AppSecEnforce || m == AppSecObserve
+}
+
 // Filter evaluates IP restrictions. CIDR checks are performed first
 // (cheap), followed by country lookups (more expensive) only when needed.
 type Filter struct {
@@ -59,6 +112,9 @@ type Filter struct {
 	BlockedCountries []string
 	CrowdSec         CrowdSecChecker
 	CrowdSecMode     CrowdSecMode
+	// AllowMatch controls how the allowlists combine (AND vs OR). Empty means
+	// AllowMatchAll.
+	AllowMatch AllowMatch
 }
 
 // FilterConfig holds the raw configuration for building a Filter.
@@ -69,6 +125,7 @@ type FilterConfig struct {
 	BlockedCountries []string
 	CrowdSec         CrowdSecChecker
 	CrowdSecMode     CrowdSecMode
+	AllowMatch       AllowMatch
 	Logger           *log.Entry
 }
 
@@ -89,6 +146,7 @@ func ParseFilter(cfg FilterConfig) *Filter {
 	f := &Filter{
 		AllowedCountries: normalizeCountryCodes(cfg.AllowedCountries),
 		BlockedCountries: normalizeCountryCodes(cfg.BlockedCountries),
+		AllowMatch:       normalizeAllowMatch(cfg.AllowMatch),
 	}
 	if hasCS {
 		f.CrowdSec = cfg.CrowdSec
@@ -146,6 +204,13 @@ const (
 	// DenyCrowdSecUnavailable indicates enforce mode but the bouncer has not
 	// completed its initial sync.
 	DenyCrowdSecUnavailable
+	// DenyAppSecBan indicates a CrowdSec AppSec "ban" remediation.
+	DenyAppSecBan
+	// DenyAppSecCaptcha indicates a CrowdSec AppSec "captcha" remediation.
+	DenyAppSecCaptcha
+	// DenyAppSecUnavailable indicates enforce mode but the AppSec engine could
+	// not produce a verdict (unreachable, timed out, or it rejected the call).
+	DenyAppSecUnavailable
 )
 
 // String returns the deny reason string matching the HTTP auth mechanism names.
@@ -167,6 +232,12 @@ func (v Verdict) String() string {
 		return "crowdsec_throttle"
 	case DenyCrowdSecUnavailable:
 		return "crowdsec_unavailable"
+	case DenyAppSecBan:
+		return "appsec_ban"
+	case DenyAppSecCaptcha:
+		return "appsec_captcha"
+	case DenyAppSecUnavailable:
+		return "appsec_unavailable"
 	default:
 		return "unknown"
 	}
@@ -182,6 +253,16 @@ func (v Verdict) IsCrowdSec() bool {
 	}
 }
 
+// IsAppSec returns true when the verdict originates from an AppSec inspection.
+func (v Verdict) IsAppSec() bool {
+	switch v {
+	case DenyAppSecBan, DenyAppSecCaptcha, DenyAppSecUnavailable:
+		return true
+	default:
+		return false
+	}
+}
+
 // IsObserveOnly returns true when v is a CrowdSec verdict and the filter is in
 // observe mode. Callers should log the verdict but not block the request.
 func (f *Filter) IsObserveOnly(v Verdict) bool {
@@ -216,6 +297,10 @@ func (f *Filter) Check(addr netip.Addr, geo GeoResolver) Verdict {
 	// IPv4 CIDR rules match regardless of how the address was received.
 	addr = addr.Unmap()
 
+	if f.AllowMatch == AllowMatchAny {
+		return f.checkAny(addr, geo)
+	}
+
 	if v := f.checkCIDR(addr); v != Allow {
 		return v
 	}
@@ -225,6 +310,68 @@ func (f *Filter) Check(addr netip.Addr, geo GeoResolver) Verdict {
 	return f.checkCrowdSec(addr)
 }
 
+// checkAny evaluates the filter with OR semantics across allowlists: the
+// address is admitted if it matches any configured allowlist (CIDR or country).
+// Blocklists remain a hard-deny gate evaluated first and are independent of the
+// allow-combine mode, so a blocklist match (or unverifiable country block) still
+// denies. CrowdSec runs last, as in the default path.
+//
+// The country is resolved at most once and shared by both the blocklist and the
+// allowlist, matching what the all-mode path does. Splitting the two checks into
+// separate helpers cost a second geo lookup per connection whenever both country
+// lists were configured.
+func (f *Filter) checkAny(addr netip.Addr, geo GeoResolver) Verdict {
+	for _, prefix := range f.BlockedCIDRs {
+		if prefix.Contains(addr) {
+			return DenyCIDR
+		}
+	}
+
+	cidrActive := len(f.AllowedCIDRs) > 0
+	cidrAllowed := false
+	if cidrActive {
+		for _, prefix := range f.AllowedCIDRs {
+			if prefix.Contains(addr) {
+				cidrAllowed = true
+				break
+			}
+		}
+	}
+
+	countryActive := len(f.AllowedCountries) > 0
+	// The blocklist is a hard gate, so it needs the country even when a CIDR
+	// allowlist already admitted the address. The allowlist needs it only when
+	// the CIDR list did not admit it, which is why a matching allowed CIDR
+	// still skips the lookup when no country blocklist is configured.
+	needCountry := len(f.BlockedCountries) > 0 || (countryActive && !cidrAllowed)
+
+	country := ""
+	if needCountry {
+		if geo == nil || !geo.Available() {
+			return DenyGeoUnavailable
+		}
+		country = geo.LookupAddr(addr).CountryCode
+	}
+
+	if country != "" && slices.Contains(f.BlockedCountries, country) {
+		return DenyCountry
+	}
+
+	allowed := (!cidrActive && !countryActive) ||
+		cidrAllowed ||
+		(countryActive && country != "" && slices.Contains(f.AllowedCountries, country))
+	if !allowed {
+		// Both allowlists missing is reported against the CIDR list, the one
+		// checked first, so the reason stays stable for existing access logs.
+		if cidrActive {
+			return DenyCIDR
+		}
+		return DenyCountry
+	}
+
+	return f.checkCrowdSec(addr)
+}
+
 func (f *Filter) checkCIDR(addr netip.Addr) Verdict {
 	if len(f.AllowedCIDRs) > 0 {
 		allowed := false

proxy/internal/restrict/restrict_test.go

@@ -5,6 +5,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/proxy/internal/geolocation"
 )
@@ -150,6 +151,187 @@ func TestFilter_Check_CIDRAllowThenCountryBlock(t *testing.T) {
 	assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr("192.168.1.1"), geo), "CIDR denied before country check")
 }
 
+// TestFilter_Check_CrossCategoryAllowlistsAreAND documents the current
+// behavior: when both a CIDR allowlist and a country allowlist are set, a
+// request must satisfy BOTH to be allowed (AND across categories). There is no
+// way today to express "allow if in allowed country OR in allowed CIDR", e.g.
+// "allow all US traffic plus our office IP abroad". This is the gap an
+// any/all allow-combine mode would close; the cases marked "GAP" are the ones
+// that would flip to Allow under an "any" mode.
+func TestFilter_Check_CrossCategoryAllowlistsAreAND(t *testing.T) {
+	officeAbroad := "203.0.113.7" // in allowed CIDR, but country not in allowlist
+	usOutsideOffice := "1.1.1.1"  // allowed country, but not in allowed CIDR
+	usOffice := "203.0.113.8"     // both
+	neither := "198.51.100.1"     // neither
+
+	geo := newMockGeo(map[string]string{
+		officeAbroad:    "DE",
+		usOutsideOffice: "US",
+		usOffice:        "US",
+		neither:         "CN",
+	})
+	f := ParseFilter(FilterConfig{
+		AllowedCIDRs:     []string{"203.0.113.0/24"},
+		AllowedCountries: []string{"US"},
+	})
+
+	assert.Equal(t, Allow, f.Check(netip.MustParseAddr(usOffice), geo), "in allowed CIDR and allowed country")
+	assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr(officeAbroad), geo), "GAP: in allowed CIDR but country not allowed; any-mode should Allow")
+	assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr(usOutsideOffice), geo), "GAP: allowed country but not in allowed CIDR; any-mode should Allow")
+	assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr(neither), geo), "neither: denied under both modes")
+}
+
+// TestFilter_Check_CrossCategoryBlockAndAllow locks the current (all/AND)
+// cross-category semantics that the evaluator must preserve: a blocklist match
+// in any category denies regardless of allowlists, and blocklists across
+// categories are effectively OR (a match in either denies).
+func TestFilter_Check_CrossCategoryBlockAndAllow(t *testing.T) {
+	geo := newMockGeo(map[string]string{
+		"1.1.1.1":  "US",
+		"10.1.2.3": "US",
+		"2.2.2.2":  "CN",
+		"3.3.3.3":  "US",
+	})
+
+	t.Run("country allowlist with CIDR blocklist", func(t *testing.T) {
+		f := ParseFilter(FilterConfig{
+			AllowedCountries: []string{"US"},
+			BlockedCIDRs:     []string{"10.1.0.0/16"},
+		})
+		assert.Equal(t, Allow, f.Check(netip.MustParseAddr("1.1.1.1"), geo), "US and not in blocked CIDR")
+		assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr("10.1.2.3"), geo), "US but in blocked CIDR, block wins")
+		assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("2.2.2.2"), geo), "not in allowed country")
+	})
+
+	t.Run("blocklists across categories are OR", func(t *testing.T) {
+		f := ParseFilter(FilterConfig{
+			BlockedCIDRs:     []string{"10.1.0.0/16"},
+			BlockedCountries: []string{"CN"},
+		})
+		assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr("10.1.2.3"), geo), "in blocked CIDR")
+		assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("2.2.2.2"), geo), "in blocked country")
+		assert.Equal(t, Allow, f.Check(netip.MustParseAddr("3.3.3.3"), geo), "in neither blocklist")
+	})
+}
+
+// TestFilter_Check_AllowCIDRPlusAllowCountryDeniesGeolessLAN documents a trap
+// with all/AND mode: pairing an allowed CIDR (a private LAN) with an allowed
+// country denies the LAN source, because a private IP has no country in the
+// geo DB and an active country allowlist denies unknown countries. Under an
+// "any" mode the CIDR match alone would admit it. This is the strongest reason
+// allow-CIDR + allow-country usually wants OR, not AND.
+func TestFilter_Check_AllowCIDRPlusAllowCountryDeniesGeolessLAN(t *testing.T) {
+	geo := newMockGeo(map[string]string{}) // no entries: every lookup is unknown country
+	f := ParseFilter(FilterConfig{
+		AllowedCIDRs:     []string{"192.168.50.0/24"},
+		AllowedCountries: []string{"US"},
+	})
+
+	got := f.Check(netip.MustParseAddr("192.168.50.5"), geo)
+	assert.Equal(t, DenyCountry, got, "GAP: LAN source in allowed CIDR is denied by the country allowlist; any-mode should Allow")
+}
+
+func TestFilter_Check_AllowMatchAny(t *testing.T) {
+	bannedIP := "203.0.113.9"
+	geo := newMockGeo(map[string]string{
+		"1.1.1.1":      "US", // allowed country, outside allowed CIDR
+		"203.0.113.7":  "DE", // allowed CIDR, non-allowed country
+		"203.0.113.8":  "US", // both
+		bannedIP:       "US", // allowed CIDR, but CrowdSec-banned
+		"198.51.100.1": "CN", // neither
+		"2.2.2.2":      "CN", // blocked country, but in allowed CIDR
+	})
+
+	tests := []struct {
+		name   string
+		config FilterConfig
+		addr   string
+		geo    GeoResolver
+		want   Verdict
+	}{
+		{
+			name:   "in allowed CIDR only",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "203.0.113.7", geo: geo, want: Allow,
+		},
+		{
+			name:   "in allowed country only",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "1.1.1.1", geo: geo, want: Allow,
+		},
+		{
+			name:   "in both",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "203.0.113.8", geo: geo, want: Allow,
+		},
+		{
+			name:   "in neither",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "198.51.100.1", geo: geo, want: DenyCIDR,
+		},
+		{
+			name:   "geoless LAN admitted via CIDR (the #597 trap, fixed)",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"192.168.50.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "192.168.50.5", geo: newMockGeo(map[string]string{}), want: Allow,
+		},
+		{
+			name:   "CIDR match short-circuits geo when geo unavailable",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "203.0.113.7", geo: &unavailableGeo{}, want: Allow,
+		},
+		{
+			name:   "geo unavailable fails closed when CIDR does not match",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "1.1.1.1", geo: &unavailableGeo{}, want: DenyGeoUnavailable,
+		},
+		{
+			name:   "block gate wins over allowed CIDR (blocked country)",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"0.0.0.0/0"}, BlockedCountries: []string{"CN"}},
+			addr:   "2.2.2.2", geo: geo, want: DenyCountry,
+		},
+		{
+			name:   "block gate wins over allowed country (blocked CIDR)",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCountries: []string{"US"}, BlockedCIDRs: []string{"203.0.113.0/24"}},
+			addr:   "203.0.113.8", geo: geo, want: DenyCIDR,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			f := ParseFilter(tc.config)
+			assert.Equal(t, tc.want, f.Check(netip.MustParseAddr(tc.addr), tc.geo))
+		})
+	}
+}
+
+func TestFilter_Check_AllowMatchAny_CrowdSecStillRuns(t *testing.T) {
+	bannedIP := "203.0.113.9"
+	cs := &mockCrowdSec{decisions: map[string]*CrowdSecDecision{bannedIP: {Type: DecisionBan}}, ready: true}
+	geo := newMockGeo(map[string]string{bannedIP: "US", "203.0.113.7": "US"})
+
+	f := ParseFilter(FilterConfig{
+		AllowMatch:   AllowMatchAny,
+		AllowedCIDRs: []string{"203.0.113.0/24"},
+		CrowdSec:     cs,
+		CrowdSecMode: CrowdSecEnforce,
+	})
+	assert.Equal(t, DenyCrowdSecBan, f.Check(netip.MustParseAddr(bannedIP), geo), "CrowdSec ban denies even when allowlist admits")
+	assert.Equal(t, Allow, f.Check(netip.MustParseAddr("203.0.113.7"), geo), "clean IP in allowed CIDR is allowed")
+}
+
+func TestFilter_Check_UnknownAllowMatchDefaultsToAll(t *testing.T) {
+	// An unrecognized allow-combine mode must fall back to the restrictive
+	// AND default, never loosen access.
+	geo := newMockGeo(map[string]string{"203.0.113.7": "DE"})
+	f := ParseFilter(FilterConfig{
+		AllowMatch:       AllowMatch("bogus"),
+		AllowedCIDRs:     []string{"203.0.113.0/24"},
+		AllowedCountries: []string{"US"},
+	})
+	assert.Equal(t, AllowMatchAll, f.AllowMatch, "unknown mode normalizes to all")
+	assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("203.0.113.7"), geo), "AND semantics: in CIDR but wrong country denied")
+}
+
 func TestParseFilter_Empty(t *testing.T) {
 	f := ParseFilter(FilterConfig{})
 	assert.Nil(t, f)
@@ -552,3 +734,81 @@ func TestFilter_HasRestrictions_CrowdSec(t *testing.T) {
 	f2 := ParseFilter(FilterConfig{CrowdSec: nil, CrowdSecMode: CrowdSecEnforce})
 	assert.True(t, f2.HasRestrictions())
 }
+
+// countingGeo records how many times an address was resolved.
+type countingGeo struct {
+	countries map[string]string
+	lookups   int
+}
+
+func (c *countingGeo) LookupAddr(addr netip.Addr) geolocation.Result {
+	c.lookups++
+	return geolocation.Result{CountryCode: c.countries[addr.String()]}
+}
+
+func (c *countingGeo) Available() bool { return true }
+
+// The geo lookup is the expensive part of the check and runs per connection, so
+// "any" mode must resolve the country once and share it between the blocklist
+// and the allowlist, the way "all" mode does.
+func TestCheck_AnyResolvesCountryOnce(t *testing.T) {
+	tests := []struct {
+		name        string
+		ip          string
+		want        Verdict
+		wantLookups int
+	}{
+		{"blocked and allowed lists both active", "203.0.113.1", Allow, 1},
+		{"blocked country denies", "198.51.100.1", DenyCountry, 1},
+		{"neither allowlist matches", "192.0.2.1", DenyCIDR, 1},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			geo := &countingGeo{countries: map[string]string{
+				"203.0.113.1":  "US",
+				"198.51.100.1": "CN",
+				"192.0.2.1":    "FR",
+			}}
+			f := ParseFilter(FilterConfig{
+				AllowedCIDRs:     []string{"10.0.0.0/8"},
+				AllowedCountries: []string{"US"},
+				BlockedCountries: []string{"CN"},
+				AllowMatch:       AllowMatchAny,
+			})
+			require.NotNil(t, f)
+
+			assert.Equal(t, tt.want, f.Check(netip.MustParseAddr(tt.ip), geo))
+			assert.Equal(t, tt.wantLookups, geo.lookups, "the country must be resolved at most once per check")
+		})
+	}
+}
+
+// A matching allowed CIDR short-circuits the allowlist, so with no country
+// blocklist configured there is nothing left to resolve.
+func TestCheck_AnySkipsLookupWhenCIDRAdmits(t *testing.T) {
+	geo := &countingGeo{countries: map[string]string{"10.1.2.3": "US"}}
+	f := ParseFilter(FilterConfig{
+		AllowedCIDRs:     []string{"10.0.0.0/8"},
+		AllowedCountries: []string{"DE"},
+		AllowMatch:       AllowMatchAny,
+	})
+	require.NotNil(t, f)
+
+	assert.Equal(t, Allow, f.Check(netip.MustParseAddr("10.1.2.3"), geo))
+	assert.Zero(t, geo.lookups, "an admitted CIDR needs no geo lookup")
+}
+
+// The blocklist is a hard gate, so it is consulted even when a CIDR allowlist
+// already admitted the address.
+func TestCheck_AnyBlocklistOutranksAllowedCIDR(t *testing.T) {
+	geo := &countingGeo{countries: map[string]string{"10.1.2.3": "CN"}}
+	f := ParseFilter(FilterConfig{
+		AllowedCIDRs:     []string{"10.0.0.0/8"},
+		BlockedCountries: []string{"CN"},
+		AllowMatch:       AllowMatchAny,
+	})
+	require.NotNil(t, f)
+
+	assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("10.1.2.3"), geo))
+	assert.Equal(t, 1, geo.lookups)
+}

proxy/lifecycle.go

@@ -126,6 +126,23 @@ type Config struct {
 	// CrowdSecAPIKey is the CrowdSec bouncer API key. Empty disables
 	// CrowdSec.
 	CrowdSecAPIKey string
+	// CrowdSecAppSecURL is the CrowdSec AppSec (WAF) endpoint. Empty disables
+	// HTTP request inspection.
+	CrowdSecAppSecURL string
+	// CrowdSecAppSecTimeout bounds a single AppSec inspection call. Zero falls
+	// back to the internal default.
+	CrowdSecAppSecTimeout time.Duration
+	// CrowdSecAppSecMaxBodyBytes caps the request body mirrored to AppSec.
+	// Zero falls back to the internal default; negative forwards no body.
+	CrowdSecAppSecMaxBodyBytes int64
+	// CrowdSecAppSecMaxConcurrent bounds AppSec inspections in flight toward
+	// the engine. Zero falls back to the internal default; negative removes
+	// the bound.
+	CrowdSecAppSecMaxConcurrent int
+	// MiddlewareCaptureBudgetBytes bounds the total request-body buffering in
+	// flight across the proxy, shared by AppSec inspection and the
+	// agent-network capture. Zero falls back to the internal default.
+	MiddlewareCaptureBudgetBytes int64
 }
 
 // New builds a Server from cfg without performing any I/O. No goroutines
@@ -135,42 +152,47 @@ type Config struct {
 // directly) byte-for-byte equivalent.
 func New(ctx context.Context, cfg Config) *Server {
 	return &Server{
-		ctx:                      ctx,
-		ListenAddr:               cfg.ListenAddr,
-		ID:                       cfg.ID,
-		Logger:                   cfg.Logger,
-		Version:                  cfg.Version,
-		ProxyURL:                 cfg.ProxyURL,
-		ManagementAddress:        cfg.ManagementAddress,
-		ProxyToken:               cfg.ProxyToken,
-		CertificateDirectory:     cfg.CertificateDirectory,
-		CertificateFile:          cfg.CertificateFile,
-		CertificateKeyFile:       cfg.CertificateKeyFile,
-		GenerateACMECertificates: cfg.GenerateACMECertificates,
-		ACMEChallengeAddress:     cfg.ACMEChallengeAddress,
-		ACMEDirectory:            cfg.ACMEDirectory,
-		ACMEEABKID:               cfg.ACMEEABKID,
-		ACMEEABHMACKey:           cfg.ACMEEABHMACKey,
-		ACMEChallengeType:        cfg.ACMEChallengeType,
-		CertLockMethod:           cfg.CertLockMethod,
-		WildcardCertDir:          cfg.WildcardCertDir,
-		DebugEndpointEnabled:     cfg.DebugEndpointEnabled,
-		DebugEndpointAddress:     cfg.DebugEndpointAddress,
-		HealthAddress:            cfg.HealthAddr,
-		ForwardedProto:           cfg.ForwardedProto,
-		TrustedProxies:           cfg.TrustedProxies,
-		WireguardPort:            cfg.WireguardPort,
-		ProxyProtocol:            cfg.ProxyProtocol,
-		PreSharedKey:             cfg.PreSharedKey,
-		Performance:              cfg.Performance,
-		SupportsCustomPorts:      cfg.SupportsCustomPorts,
-		RequireSubdomain:         cfg.RequireSubdomain,
-		Private:                  cfg.Private,
-		MaxDialTimeout:           cfg.MaxDialTimeout,
-		MaxSessionIdleTimeout:    cfg.MaxSessionIdleTimeout,
-		MappingBatchWatchdog:     cfg.MappingBatchWatchdog,
-		GeoDataDir:               cfg.GeoDataDir,
-		CrowdSecAPIURL:           cfg.CrowdSecAPIURL,
-		CrowdSecAPIKey:           cfg.CrowdSecAPIKey,
+		ctx:                          ctx,
+		ListenAddr:                   cfg.ListenAddr,
+		ID:                           cfg.ID,
+		Logger:                       cfg.Logger,
+		Version:                      cfg.Version,
+		ProxyURL:                     cfg.ProxyURL,
+		ManagementAddress:            cfg.ManagementAddress,
+		ProxyToken:                   cfg.ProxyToken,
+		CertificateDirectory:         cfg.CertificateDirectory,
+		CertificateFile:              cfg.CertificateFile,
+		CertificateKeyFile:           cfg.CertificateKeyFile,
+		GenerateACMECertificates:     cfg.GenerateACMECertificates,
+		ACMEChallengeAddress:         cfg.ACMEChallengeAddress,
+		ACMEDirectory:                cfg.ACMEDirectory,
+		ACMEEABKID:                   cfg.ACMEEABKID,
+		ACMEEABHMACKey:               cfg.ACMEEABHMACKey,
+		ACMEChallengeType:            cfg.ACMEChallengeType,
+		CertLockMethod:               cfg.CertLockMethod,
+		WildcardCertDir:              cfg.WildcardCertDir,
+		DebugEndpointEnabled:         cfg.DebugEndpointEnabled,
+		DebugEndpointAddress:         cfg.DebugEndpointAddress,
+		HealthAddress:                cfg.HealthAddr,
+		ForwardedProto:               cfg.ForwardedProto,
+		TrustedProxies:               cfg.TrustedProxies,
+		WireguardPort:                cfg.WireguardPort,
+		ProxyProtocol:                cfg.ProxyProtocol,
+		PreSharedKey:                 cfg.PreSharedKey,
+		Performance:                  cfg.Performance,
+		SupportsCustomPorts:          cfg.SupportsCustomPorts,
+		RequireSubdomain:             cfg.RequireSubdomain,
+		Private:                      cfg.Private,
+		MaxDialTimeout:               cfg.MaxDialTimeout,
+		MaxSessionIdleTimeout:        cfg.MaxSessionIdleTimeout,
+		MappingBatchWatchdog:         cfg.MappingBatchWatchdog,
+		GeoDataDir:                   cfg.GeoDataDir,
+		CrowdSecAPIURL:               cfg.CrowdSecAPIURL,
+		CrowdSecAPIKey:               cfg.CrowdSecAPIKey,
+		CrowdSecAppSecURL:            cfg.CrowdSecAppSecURL,
+		CrowdSecAppSecTimeout:        cfg.CrowdSecAppSecTimeout,
+		CrowdSecAppSecMaxBodyBytes:   cfg.CrowdSecAppSecMaxBodyBytes,
+		CrowdSecAppSecMaxConcurrent:  cfg.CrowdSecAppSecMaxConcurrent,
+		MiddlewareCaptureBudgetBytes: cfg.MiddlewareCaptureBudgetBytes,
 	}
 }

proxy/lifecycle_test.go

@@ -0,0 +1,45 @@
+package proxy
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// New maps Config onto Server field by field, and a field left out of that
+// literal still compiles: the knob is simply parsed and then dropped, so an
+// operator setting it sees the default with no error anywhere. These assertions
+// are the only thing standing between a new setting and that silent no-op.
+func TestNew_ForwardsOperatorTuning(t *testing.T) {
+	cfg := Config{
+		ManagementAddress:            "http://localhost:8080",
+		ProxyToken:                   "token",
+		CrowdSecAPIURL:               "http://crowdsec:8080/",
+		CrowdSecAPIKey:               "key",
+		CrowdSecAppSecURL:            "http://crowdsec:7422/",
+		CrowdSecAppSecTimeout:        321 * time.Millisecond,
+		CrowdSecAppSecMaxBodyBytes:   4321,
+		CrowdSecAppSecMaxConcurrent:  17,
+		MiddlewareCaptureBudgetBytes: 5 << 20,
+		MaxDialTimeout:               7 * time.Second,
+		MaxSessionIdleTimeout:        11 * time.Second,
+		GeoDataDir:                   "/var/lib/geo",
+	}
+
+	srv := New(context.Background(), cfg)
+	require.NotNil(t, srv)
+
+	assert.Equal(t, cfg.CrowdSecAPIURL, srv.CrowdSecAPIURL)
+	assert.Equal(t, cfg.CrowdSecAPIKey, srv.CrowdSecAPIKey)
+	assert.Equal(t, cfg.CrowdSecAppSecURL, srv.CrowdSecAppSecURL)
+	assert.Equal(t, cfg.CrowdSecAppSecTimeout, srv.CrowdSecAppSecTimeout)
+	assert.Equal(t, cfg.CrowdSecAppSecMaxBodyBytes, srv.CrowdSecAppSecMaxBodyBytes)
+	assert.Equal(t, cfg.CrowdSecAppSecMaxConcurrent, srv.CrowdSecAppSecMaxConcurrent)
+	assert.Equal(t, cfg.MiddlewareCaptureBudgetBytes, srv.MiddlewareCaptureBudgetBytes)
+	assert.Equal(t, cfg.MaxDialTimeout, srv.MaxDialTimeout)
+	assert.Equal(t, cfg.MaxSessionIdleTimeout, srv.MaxSessionIdleTimeout)
+	assert.Equal(t, cfg.GeoDataDir, srv.GeoDataDir)
+}

proxy/management_integration_test.go

@@ -240,6 +240,10 @@ func (m *testProxyManager) ClusterSupportsCrowdSec(_ context.Context, _ string)
 	return nil
 }
 
+func (m *testProxyManager) ClusterSupportsAppSec(_ context.Context, _ string) *bool {
+	return nil
+}
+
 func (m *testProxyManager) ClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }
@@ -562,16 +566,11 @@ func TestIntegration_ProxyConnection_ReconnectDoesNotDuplicateState(t *testing.T
 				addMappingCalls.Add(1)
 
 				// Apply to real auth middleware (idempotent)
-				err := authMw.AddDomain(
-					mapping.GetDomain(),
-					nil,
-					"",
-					0,
-					proxytypes.AccountID(mapping.GetAccountId()),
-					proxytypes.ServiceID(mapping.GetId()),
-					nil,
-					mapping.GetPrivate(),
-				)
+				err := authMw.AddDomain(mapping.GetDomain(), auth.DomainSettings{
+					AccountID: proxytypes.AccountID(mapping.GetAccountId()),
+					ServiceID: proxytypes.ServiceID(mapping.GetId()),
+					Private:   mapping.GetPrivate(),
+				})
 				require.NoError(t, err)
 
 				// Apply to real proxy (idempotent)

proxy/server.go

@@ -45,6 +45,7 @@ import (
 	"github.com/netbirdio/netbird/client/embed"
 	"github.com/netbirdio/netbird/proxy/internal/accesslog"
 	"github.com/netbirdio/netbird/proxy/internal/acme"
+	"github.com/netbirdio/netbird/proxy/internal/appsec"
 	"github.com/netbirdio/netbird/proxy/internal/auth"
 	"github.com/netbirdio/netbird/proxy/internal/certwatch"
 	"github.com/netbirdio/netbird/proxy/internal/conntrack"
@@ -126,6 +127,10 @@ type Server struct {
 	crowdsecMu       sync.Mutex
 	crowdsecServices map[types.ServiceID]bool
 
+	// appsecClient is the shared CrowdSec AppSec client, nil when no AppSec
+	// endpoint is configured. Stateless, so it needs no per-service lifecycle.
+	appsecClient *appsec.Client
+
 	// routerReady is closed once mainRouter is fully initialized.
 	// The mapping worker waits on this before processing updates.
 	routerReady chan struct{}
@@ -238,6 +243,20 @@ type Server struct {
 	CrowdSecAPIURL string
 	// CrowdSecAPIKey is the CrowdSec bouncer API key. Empty disables CrowdSec.
 	CrowdSecAPIKey string
+	// CrowdSecAppSecURL is the CrowdSec AppSec (WAF) endpoint, e.g.
+	// http://127.0.0.1:7422/. Empty disables request inspection. Requires
+	// CrowdSecAPIKey, which the AppSec component validates against LAPI.
+	CrowdSecAppSecURL string
+	// CrowdSecAppSecTimeout bounds a single AppSec inspection call.
+	// Zero means appsec.DefaultTimeout.
+	CrowdSecAppSecTimeout time.Duration
+	// CrowdSecAppSecMaxBodyBytes caps the request body mirrored to the AppSec
+	// engine. Zero means appsec.DefaultMaxBodyBytes; negative disables body
+	// forwarding, leaving header and URI inspection.
+	CrowdSecAppSecMaxBodyBytes int64
+	// CrowdSecAppSecMaxConcurrent bounds AppSec inspections in flight. Zero
+	// means appsec.DefaultMaxConcurrent; negative removes the bound.
+	CrowdSecAppSecMaxConcurrent int
 	// MaxSessionIdleTimeout caps the per-service session idle timeout.
 	// Zero means no cap (the proxy honors whatever management sends).
 	// Set via NB_PROXY_MAX_SESSION_IDLE_TIMEOUT for shared deployments.
@@ -380,6 +399,13 @@ func (s *Server) Start(ctx context.Context) error {
 
 	s.crowdsecRegistry = crowdsec.NewRegistry(s.CrowdSecAPIURL, s.CrowdSecAPIKey, log.NewEntry(s.Logger))
 	s.crowdsecServices = make(map[types.ServiceID]bool)
+	// Must precede the mapping worker: the worker opens the management stream
+	// and reports proxyCapabilities, which reads appsecClient. Building it
+	// afterwards would both race the read and, when the worker won, advertise
+	// the proxy as AppSec-incapable for the lifetime of that stream.
+	if err := s.initAppSec(); err != nil {
+		return err
+	}
 
 	go s.newManagementMappingWorker(runCtx, s.mgmtClient)
 
@@ -407,6 +433,7 @@ func (s *Server) Start(ctx context.Context) error {
 	}()
 
 	s.auth = auth.NewMiddleware(s.Logger, s.mgmtClient, s.geo)
+	s.auth.SetAppSec(s.appsecClient)
 	s.accessLog = accesslog.NewLogger(s.mgmtClient, s.Logger, s.TrustedProxies)
 
 	s.startDebugEndpoint()
@@ -1270,6 +1297,7 @@ func (s *Server) newManagementMappingWorker(ctx context.Context, client proto.Pr
 
 func (s *Server) proxyCapabilities() *proto.ProxyCapabilities {
 	supportsCrowdSec := s.crowdsecRegistry.Available()
+	supportsAppSec := s.appsecClient != nil
 	privateCapability := s.Private
 	// Always true: this build enforces ProxyMapping.private via the auth middleware.
 	supportsPrivateService := true
@@ -1277,6 +1305,7 @@ func (s *Server) proxyCapabilities() *proto.ProxyCapabilities {
 		SupportsCustomPorts:    &s.SupportsCustomPorts,
 		RequireSubdomain:       &s.RequireSubdomain,
 		SupportsCrowdsec:       &supportsCrowdSec,
+		SupportsAppsec:         &supportsAppSec,
 		Private:                &privateCapability,
 		SupportsPrivateService: &supportsPrivateService,
 	}
@@ -1900,10 +1929,72 @@ func (s *Server) parseRestrictions(mapping *proto.ProxyMapping) *restrict.Filter
 		BlockedCountries: r.GetBlockedCountries(),
 		CrowdSec:         checker,
 		CrowdSecMode:     csMode,
+		AllowMatch:       restrict.AllowMatch(r.GetAllowMatch()),
 		Logger:           log.NewEntry(s.Logger),
 	})
 }
 
+// initAppSec builds the shared AppSec client when an endpoint is configured.
+// A configured-but-invalid endpoint is a startup error rather than a silent
+// downgrade: services asking for enforce would otherwise fail closed on every
+// request with no indication why.
+//
+// Runs before the management stream opens so the reported capability is stable;
+// the auth middleware picks the client up separately once it exists.
+func (s *Server) initAppSec() error {
+	if s.CrowdSecAppSecURL == "" {
+		return nil
+	}
+	if s.CrowdSecAPIKey == "" {
+		return errors.New("crowdsec appsec url is set but the crowdsec api key is empty")
+	}
+
+	// Share the middleware capture budget rather than opening a second pool:
+	// AppSec buffers before authentication, so its ceiling has to count against
+	// the same proxy-wide allowance the body tap draws from.
+	var budget appsec.Budget
+	if s.middlewareManager != nil {
+		budget = s.middlewareManager.Budget()
+	}
+
+	client, err := appsec.New(appsec.Config{
+		URL:           s.CrowdSecAppSecURL,
+		APIKey:        s.CrowdSecAPIKey,
+		Timeout:       s.CrowdSecAppSecTimeout,
+		MaxBodyBytes:  s.CrowdSecAppSecMaxBodyBytes,
+		MaxConcurrent: s.CrowdSecAppSecMaxConcurrent,
+		Budget:        budget,
+		Logger:        log.NewEntry(s.Logger),
+	})
+	if err != nil {
+		return fmt.Errorf("init crowdsec appsec: %w", err)
+	}
+
+	s.appsecClient = client
+	s.Logger.Infof("CrowdSec AppSec inspection available at %s", s.CrowdSecAppSecURL)
+	return nil
+}
+
+// appSecMode resolves the per-service AppSec mode. A service asking for
+// inspection on a proxy with no AppSec endpoint keeps its mode so the auth
+// middleware fails closed for enforce, mirroring the CrowdSec behavior.
+func (s *Server) appSecMode(mapping *proto.ProxyMapping) restrict.AppSecMode {
+	raw := mapping.GetAccessRestrictions().GetAppsecMode()
+	mode := restrict.ParseAppSecMode(raw)
+	// An unrecognized value disables inspection, which is the safe default but a
+	// silent one: with a newer management and an older proxy, a mode this build
+	// does not know would look identical to "off" on a service the operator set
+	// to enforce. Say so rather than leaving it to be discovered.
+	if mode == restrict.AppSecOff && raw != "" && raw != "off" {
+		s.Logger.Warnf("service %s requests unrecognized AppSec mode %q; this build supports %q and %q, so inspection is disabled",
+			mapping.GetId(), raw, restrict.AppSecEnforce, restrict.AppSecObserve)
+	}
+	if mode.Enabled() && s.appsecClient == nil {
+		s.Logger.Warnf("service %s requests AppSec mode %q but proxy has no AppSec endpoint configured", mapping.GetId(), mode)
+	}
+	return mode
+}
+
 // releaseCrowdSec releases the CrowdSec bouncer reference for the given
 // service if it had one.
 func (s *Server) releaseCrowdSec(svcID types.ServiceID) {
@@ -2070,7 +2161,17 @@ func (s *Server) updateMapping(ctx context.Context, mapping *proto.ProxyMapping)
 	s.warnIfGeoUnavailable(mapping.GetDomain(), mapping.GetAccessRestrictions())
 
 	maxSessionAge := time.Duration(mapping.GetAuth().GetMaxSessionAgeSeconds()) * time.Second
-	if err := s.auth.AddDomain(mapping.GetDomain(), schemes, mapping.GetAuth().GetSessionKey(), maxSessionAge, accountID, svcID, ipRestrictions, mapping.GetPrivate()); err != nil {
+	settings := auth.DomainSettings{
+		Schemes:           schemes,
+		SessionPublicKey:  mapping.GetAuth().GetSessionKey(),
+		SessionExpiration: maxSessionAge,
+		AccountID:         accountID,
+		ServiceID:         svcID,
+		IPRestrictions:    ipRestrictions,
+		Private:           mapping.GetPrivate(),
+		AppSecMode:        s.appSecMode(mapping),
+	}
+	if err := s.auth.AddDomain(mapping.GetDomain(), settings); err != nil {
 		return fmt.Errorf("auth setup for domain %s: %w", mapping.GetDomain(), err)
 	}
 	m := s.protoToMapping(ctx, mapping)

shared/management/client/grpc.go

@@ -21,7 +21,8 @@ import (
 	"google.golang.org/grpc/connectivity"
 
 	nbgrpc "github.com/netbirdio/netbird/client/grpc"
-	"github.com/netbirdio/netbird/client/netevents"
+	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -63,9 +64,12 @@ type GrpcClient struct {
 	connStateCallbackLock sync.RWMutex
 	serverURL             string
 
-	// netEvents gates the stream retry loop on OS-reported network
-	// availability and sweeps the transport on network change.
-	netEvents *netevents.Manager
+	// netState gates the stream retry loop on OS-reported network
+	// availability; nil (the default) disables gating.
+	netState *netstate.State
+
+	// sweeper cuts the transport connections on network change; nil disables it.
+	sweeper *netsweep.Sweeper
 
 	// syncStreamErr holds the last Sync stream error, or nil while the stream
 	// is established and healthy. GetServerKey succeeds even when the peer
@@ -119,9 +123,15 @@ func MaxRecvMsgSize() int {
 // Option configures optional GrpcClient behavior.
 type Option func(*GrpcClient)
 
-// WithNetEvents injects the OS network event handling.
-func WithNetEvents(events *netevents.Manager) Option {
-	return func(c *GrpcClient) { c.netEvents = events }
+// WithNetworkState injects the OS network availability state that gates the
+// stream retry loop; without it gating is disabled.
+func WithNetworkState(netState *netstate.State) Option {
+	return func(c *GrpcClient) { c.netState = netState }
+}
+
+// WithSweeper injects the network change sweeper.
+func WithSweeper(sweeper *netsweep.Sweeper) Option {
+	return func(c *GrpcClient) { c.sweeper = sweeper }
 }
 
 // NewClient creates a new client to Management service
@@ -142,7 +152,9 @@ func NewClient(ctx context.Context, addr string, ourPrivateKey wgtypes.Key, tlsE
 		extraOpts = append(extraOpts, grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(maxSize)))
 		log.Infof("management gRPC max receive message size set to %d bytes", maxSize)
 	}
-	extraOpts = append(extraOpts, nbgrpc.WithSweeper(c.netEvents))
+	if c.sweeper != nil {
+		extraOpts = append(extraOpts, nbgrpc.WithSweeper(c.sweeper))
+	}
 
 	var conn *grpc.ClientConn
 	operation := func() error {
@@ -223,19 +235,16 @@ func (c *GrpcClient) withMgmtStream(
 	ctx context.Context,
 	handler func(ctx context.Context, serverPubKey wgtypes.Key, backOff backoff.BackOff) error,
 ) error {
-	backOff := c.netEvents.QuickRetryBackoff(ctx, defaultBackoff(ctx))
+	backOff := c.sweeper.QuickRetryBackoff(ctx, defaultBackoff(ctx), c.netState)
 	operation := func() error {
 		// suspend reconnect attempts while the OS reports no usable network.
 		// Wait only errors on a cancelled context, which means shutdown, so
 		// stop the loop without reporting a failure.
-		if waited, err := c.netEvents.Wait(ctx); err != nil {
+		if waited, err := c.netState.Wait(ctx); err != nil {
 			log.Debugf("management connection context has been canceled while offline, this usually indicates shutdown")
 			return nil //nolint:nilerr // a cancelled context means shutdown, not a retryable failure
 		} else if waited {
 			backOff.Reset()
-			// dials attempted while offline grew the channel's internal backoff;
-			// reset it too, or the reconnect waits out that timer first
-			c.conn.ResetConnectBackoff()
 		}
 
 		connState := c.conn.GetState()
@@ -264,7 +273,7 @@ func (c *GrpcClient) withMgmtStream(
 		return handler(ctx, *serverPubKey, backOff)
 	}
 
-	err := nbgrpc.Retry(ctx, operation, backOff, c.netEvents)
+	err := nbgrpc.Retry(ctx, operation, backOff, c.netState)
 	if err != nil {
 		log.Warnf("exiting the Management service connection retry loop due to the unrecoverable error: %s", err)
 	}

shared/management/http/api/openapi.yml

@@ -3380,6 +3380,30 @@ components:
             - "observe"
           default: "off"
           description: CrowdSec IP reputation mode. Only available when the proxy cluster supports CrowdSec.
+        allow_match:
+          type: string
+          enum:
+            - "all"
+            - "any"
+          default: "all"
+          description: >-
+            How the allowlists (allowed_cidrs, allowed_countries) combine.
+            "all" (default) requires a connection to match every configured
+            allowlist (AND); "any" requires it to match at least one (OR), e.g.
+            an allowed country OR an allowed CIDR. Blocklists always reject on
+            match regardless of this setting.
+        appsec_mode:
+          type: string
+          enum:
+            - "off"
+            - "enforce"
+            - "observe"
+          default: "off"
+          description: >-
+            CrowdSec AppSec (WAF) request inspection mode. Only available when
+            the proxy cluster supports AppSec, and only applied to HTTP
+            services. "enforce" blocks requests the WAF flags; "observe" records
+            the verdict in the access log without blocking.
     PasswordAuthConfig:
       type: object
       properties:
@@ -3516,6 +3540,10 @@ components:
           type: boolean
           description: Whether all active proxies in the cluster have CrowdSec configured
           example: false
+        supports_appsec:
+          type: boolean
+          description: Whether all active proxies in the cluster have a CrowdSec AppSec (WAF) endpoint configured
+          example: false
         private:
           type: boolean
           description: True when at least one connected proxy in this cluster is running embedded in a netbird client (`netbird proxy`) and serving over a WireGuard tunnel. Lets the dashboard distinguish per-peer / private clusters from centralised ones.
@@ -3575,6 +3603,10 @@ components:
           type: boolean
           description: Whether the proxy cluster has CrowdSec configured
           example: false
+        supports_appsec:
+          type: boolean
+          description: Whether the proxy cluster has a CrowdSec AppSec (WAF) endpoint configured
+          example: false
         supports_private:
           type: boolean
           description: Whether the proxy cluster supports private (NetBird-only) services. True when at least one connected proxy in the cluster runs embedded in a netbird client.

shared/management/http/api/types.gen.go

@@ -17,6 +17,45 @@ const (
 	TokenAuthScopes  tokenAuthContextKey  = "TokenAuth.Scopes"
 )
 
+// Defines values for AccessRestrictionsAllowMatch.
+const (
+	AccessRestrictionsAllowMatchAll AccessRestrictionsAllowMatch = "all"
+	AccessRestrictionsAllowMatchAny AccessRestrictionsAllowMatch = "any"
+)
+
+// Valid indicates whether the value is a known member of the AccessRestrictionsAllowMatch enum.
+func (e AccessRestrictionsAllowMatch) Valid() bool {
+	switch e {
+	case AccessRestrictionsAllowMatchAll:
+		return true
+	case AccessRestrictionsAllowMatchAny:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for AccessRestrictionsAppsecMode.
+const (
+	AccessRestrictionsAppsecModeEnforce AccessRestrictionsAppsecMode = "enforce"
+	AccessRestrictionsAppsecModeObserve AccessRestrictionsAppsecMode = "observe"
+	AccessRestrictionsAppsecModeOff     AccessRestrictionsAppsecMode = "off"
+)
+
+// Valid indicates whether the value is a known member of the AccessRestrictionsAppsecMode enum.
+func (e AccessRestrictionsAppsecMode) Valid() bool {
+	switch e {
+	case AccessRestrictionsAppsecModeEnforce:
+		return true
+	case AccessRestrictionsAppsecModeObserve:
+		return true
+	case AccessRestrictionsAppsecModeOff:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for AccessRestrictionsCrowdsecMode.
 const (
 	AccessRestrictionsCrowdsecModeEnforce AccessRestrictionsCrowdsecMode = "enforce"
@@ -1534,12 +1573,18 @@ func (e PutApiIntegrationsMspTenantsIdInviteJSONBodyValue) Valid() bool {
 
 // AccessRestrictions Connection-level access restrictions based on IP address or geography. Applies to both HTTP and L4 services.
 type AccessRestrictions struct {
+	// AllowMatch How the allowlists (allowed_cidrs, allowed_countries) combine. "all" (default) requires a connection to match every configured allowlist (AND); "any" requires it to match at least one (OR), e.g. an allowed country OR an allowed CIDR. Blocklists always reject on match regardless of this setting.
+	AllowMatch *AccessRestrictionsAllowMatch `json:"allow_match,omitempty"`
+
 	// AllowedCidrs CIDR allowlist. If non-empty, only IPs matching these CIDRs are allowed.
 	AllowedCidrs *[]string `json:"allowed_cidrs,omitempty"`
 
 	// AllowedCountries ISO 3166-1 alpha-2 country codes to allow. If non-empty, only these countries are permitted.
 	AllowedCountries *[]string `json:"allowed_countries,omitempty"`
 
+	// AppsecMode CrowdSec AppSec (WAF) request inspection mode. Only available when the proxy cluster supports AppSec, and only applied to HTTP services. "enforce" blocks requests the WAF flags; "observe" records the verdict in the access log without blocking.
+	AppsecMode *AccessRestrictionsAppsecMode `json:"appsec_mode,omitempty"`
+
 	// BlockedCidrs CIDR blocklist. Connections from these CIDRs are rejected. Evaluated after allowed_cidrs.
 	BlockedCidrs *[]string `json:"blocked_cidrs,omitempty"`
 
@@ -1550,6 +1595,12 @@ type AccessRestrictions struct {
 	CrowdsecMode *AccessRestrictionsCrowdsecMode `json:"crowdsec_mode,omitempty"`
 }
 
+// AccessRestrictionsAllowMatch How the allowlists (allowed_cidrs, allowed_countries) combine. "all" (default) requires a connection to match every configured allowlist (AND); "any" requires it to match at least one (OR), e.g. an allowed country OR an allowed CIDR. Blocklists always reject on match regardless of this setting.
+type AccessRestrictionsAllowMatch string
+
+// AccessRestrictionsAppsecMode CrowdSec AppSec (WAF) request inspection mode. Only available when the proxy cluster supports AppSec, and only applied to HTTP services. "enforce" blocks requests the WAF flags; "observe" records the verdict in the access log without blocking.
+type AccessRestrictionsAppsecMode string
+
 // AccessRestrictionsCrowdsecMode CrowdSec IP reputation mode. Only available when the proxy cluster supports CrowdSec.
 type AccessRestrictionsCrowdsecMode string
 
@@ -4773,6 +4824,9 @@ type ProxyCluster struct {
 	// RequireSubdomain Whether services on this cluster must include a subdomain label
 	RequireSubdomain *bool `json:"require_subdomain,omitempty"`
 
+	// SupportsAppsec Whether all active proxies in the cluster have a CrowdSec AppSec (WAF) endpoint configured
+	SupportsAppsec *bool `json:"supports_appsec,omitempty"`
+
 	// SupportsCrowdsec Whether all active proxies in the cluster have CrowdSec configured
 	SupportsCrowdsec *bool `json:"supports_crowdsec,omitempty"`
 
@@ -4841,6 +4895,9 @@ type ReverseProxyDomain struct {
 	// RequireSubdomain Whether a subdomain label is required in front of this domain. When true, the domain cannot be used bare.
 	RequireSubdomain *bool `json:"require_subdomain,omitempty"`
 
+	// SupportsAppsec Whether the proxy cluster has a CrowdSec AppSec (WAF) endpoint configured
+	SupportsAppsec *bool `json:"supports_appsec,omitempty"`
+
 	// SupportsCrowdsec Whether the proxy cluster has CrowdSec configured
 	SupportsCrowdsec *bool `json:"supports_crowdsec,omitempty"`
 

shared/management/proto/proxy_service.proto

@@ -73,6 +73,10 @@ message ProxyCapabilities {
   optional bool private = 4;
   // Whether the proxy enforces ProxyMapping.private (fails closed on ValidateTunnelPeer failure). Management MUST NOT stream private mappings to proxies that don't claim this.
   optional bool supports_private_service = 5;
+  // Whether the proxy has a CrowdSec AppSec (WAF) endpoint configured and can
+  // inspect HTTP requests. Independent of supports_crowdsec: AppSec is a
+  // separate endpoint on the Security Engine and applies to HTTP services only.
+  optional bool supports_appsec = 6;
 }
 
 // GetMappingUpdateRequest is sent to initialise a mapping stream.
@@ -203,6 +207,14 @@ message AccessRestrictions {
   repeated string blocked_countries = 4;
   // CrowdSec IP reputation mode: "", "off", "enforce", or "observe".
   string crowdsec_mode = 5;
+  // How the allowlists (CIDR, country) combine: "" or "all" require matching
+  // every allowlist (AND); "any" requires matching at least one (OR).
+  // Blocklists are always a hard-deny gate, independent of this mode.
+  string allow_match = 6;
+  // CrowdSec AppSec (WAF) request inspection mode: "", "off", "enforce", or
+  // "observe". HTTP services only: "enforce" and "observe" are rejected at
+  // validation for TCP/UDP/TLS services, which carry no requests to inspect.
+  string appsec_mode = 7;
 }
 
 message ProxyMapping {

shared/relay/client/client.go

@@ -14,7 +14,7 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/netevents/sweep"
+	"github.com/netbirdio/netbird/client/netsweep"
 	auth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	"github.com/netbirdio/netbird/shared/relay/client/dialer"
 	netErr "github.com/netbirdio/netbird/shared/relay/client/dialer/net"
@@ -151,14 +151,6 @@ type transportConn interface {
 	Protocol() string
 }
 
-// NetEvents is the OS network event view the relay consumes: availability
-// gating for the reconnect guard and dial registration for the network change
-// sweep.
-type NetEvents interface {
-	NetworkWatcher
-	StartDial(ctx context.Context) *sweep.Dial
-}
-
 // Client is a client for the relay server. It is responsible for establishing a connection to the relay server and
 // managing connections to other peers. All exported functions are safe to call concurrently. After close the connection,
 // the client can be reused by calling Connect again. When the client is closed, all connections are closed too.
@@ -194,10 +186,9 @@ type Client struct {
 	// the manager.
 	transportFallback *transportFallback
 
-	// netEvents registers the relay dial for the network change sweep; the
-	// read loop reports the disconnect and the guard reconnects. Shared via
-	// the manager.
-	netEvents NetEvents
+	// sweeper cuts the relay connection on network change; the read loop
+	// reports the disconnect and the guard reconnects. Shared via the manager.
+	sweeper *netsweep.Sweeper
 	// datagramFallbackTriggered guards a single fallback per connection so a
 	// burst of oversized datagrams triggers one reconnect, not many.
 	datagramFallbackTriggered atomic.Bool
@@ -409,12 +400,7 @@ func (c *Client) Close() error {
 func (c *Client) connect(ctx context.Context) (*RelayAddr, error) {
 	// A sweep cancels this context, so a dial started on the old network
 	// aborts instead of waiting out its handshake timeout.
-	var dial *sweep.Dial
-	if c.netEvents != nil {
-		dial = c.netEvents.StartDial(ctx)
-	} else {
-		dial = (*sweep.Sweeper)(nil).StartDial(ctx)
-	}
+	dial := c.sweeper.StartDial(ctx)
 	defer dial.Release()
 	ctx = dial.Ctx()
 

shared/relay/client/guard.go

@@ -7,6 +7,8 @@ import (
 
 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/netstate"
 )
 
 const (
@@ -22,13 +24,6 @@ const (
 	verdictSettleWindow = 200 * time.Millisecond
 )
 
-// NetworkWatcher is the availability view the guard gates reconnects on.
-type NetworkWatcher interface {
-	Wait(ctx context.Context) (bool, error)
-	IsOnline() bool
-	WaitSettled(ctx context.Context, budget, settleWindow time.Duration) bool
-}
-
 // Guard manage the reconnection tries to the Relay server in case of disconnection event.
 type Guard struct {
 	// OnNewRelayClient is a channel that is used to notify the relay manager about a new relay client instance.
@@ -40,8 +35,9 @@ type Guard struct {
 	// attempts.
 	maxBackoffInterval time.Duration
 
-	// netState gates reconnect attempts on OS-reported network availability.
-	netState NetworkWatcher
+	// netState gates reconnect attempts on OS-reported network availability;
+	// nil disables gating.
+	netState *netstate.State
 
 	// lastErr is the error from the most recent failed reconnect attempt,
 	// surfaced as the home relay status while disconnected.
@@ -49,8 +45,9 @@ type Guard struct {
 }
 
 // NewGuard creates a new guard for the relay client. A non-positive
-// maxBackoffInterval falls back to defaultMaxBackoffInterval.
-func NewGuard(sp *ServerPicker, maxBackoffInterval time.Duration, netState NetworkWatcher) *Guard {
+// maxBackoffInterval falls back to defaultMaxBackoffInterval. A nil netState
+// disables network availability gating.
+func NewGuard(sp *ServerPicker, maxBackoffInterval time.Duration, netState *netstate.State) *Guard {
 	if maxBackoffInterval <= 0 {
 		maxBackoffInterval = defaultMaxBackoffInterval
 	}
@@ -100,14 +97,12 @@ func (g *Guard) StartReconnectTrys(ctx context.Context, relayClient *Client) {
 		select {
 		case <-ticker.C:
 			// suspend reconnect attempts while the OS reports no usable network
-			if g.netState != nil {
-				if waited, err := g.netState.Wait(ctx); err != nil {
-					return
-				} else if waited {
-					ticker.Stop()
-					ticker = g.exponentTicker(ctx)
-					continue
-				}
+			if waited, err := g.netState.Wait(ctx); err != nil {
+				return
+			} else if waited {
+				ticker.Stop()
+				ticker = g.exponentTicker(ctx)
+				continue
 			}
 			if err := g.retry(ctx); err != nil {
 				log.Errorf("failed to pick new Relay server: %s", err)
@@ -134,18 +129,13 @@ func (g *Guard) tryToQuickReconnect(parentCtx context.Context, rc *Client) bool
 		return false
 	}
 
-	if g.netState != nil {
-		if ok := g.netState.WaitSettled(parentCtx, quickReconnectBudget, verdictSettleWindow); !ok {
-			return false
-		}
-		// Still offline after the budget: leave the retry to the ticker.
-		if !g.netState.IsOnline() {
-			return false
-		}
-	} else {
-		if cancelled := waiteBeforeRetry(parentCtx); !cancelled {
-			return false
-		}
+	if ok := g.waitForNetwork(parentCtx); !ok {
+		return false
+	}
+
+	// Still offline after the budget: leave the retry to the ticker.
+	if !g.netState.IsOnline() {
+		return false
 	}
 
 	log.Infof("try to reconnect to Relay server: %s", rc.connectionURL)
@@ -210,14 +200,47 @@ func (g *Guard) exponentTicker(ctx context.Context) *backoff.Ticker {
 	return backoff.NewTicker(bo)
 }
 
-func waiteBeforeRetry(ctx context.Context) bool {
-	timer := time.NewTimer(quickReconnectBudget)
-	defer timer.Stop()
+// waitForNetwork waits out the settle window while online, or waits for the
+// network to return while offline, within the budget. Returns false when ctx
+// is cancelled. Without an injected netState it degrades to a fixed
+// budget-long sleep, the pre-netstate behavior.
+func (g *Guard) waitForNetwork(ctx context.Context) bool {
+	budget := time.NewTimer(quickReconnectBudget)
+	defer budget.Stop()
 
-	select {
-	case <-timer.C:
-		return true
-	case <-ctx.Done():
-		return false
+	settleWindow := verdictSettleWindow
+	if g.netState == nil {
+		settleWindow = quickReconnectBudget
+	}
+	settle := time.NewTimer(settleWindow)
+	defer settle.Stop()
+
+	for {
+		// Channel first, flag second: a flip in between still fires the channel.
+		changedCh := g.netState.Changed()
+		if g.netState.IsOnline() {
+			select {
+			case <-settle.C:
+				return true
+			case <-changedCh:
+			case <-ctx.Done():
+				return false
+			}
+		} else {
+			select {
+			case <-budget.C:
+				return true
+			case <-changedCh:
+			case <-ctx.Done():
+				return false
+			}
+		}
+		if !settle.Stop() {
+			select {
+			case <-settle.C:
+			default:
+			}
+		}
+		settle.Reset(settleWindow)
 	}
 }

shared/relay/client/guard_test.go

@@ -0,0 +1,30 @@
+package client
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/client/netstate"
+)
+
+func TestWaitForNetworkSettlesAfterOutage(t *testing.T) {
+	ns := netstate.New()
+	ns.Set(false)
+	g := NewGuard(nil, 0, ns)
+
+	const outage = 2 * verdictSettleWindow
+	start := time.Now()
+	go func() {
+		time.Sleep(outage)
+		ns.Set(true)
+	}()
+
+	ok := g.waitForNetwork(context.Background())
+	elapsed := time.Since(start)
+
+	assert.True(t, ok, "recovered network must let the quick reconnect proceed")
+	assert.GreaterOrEqual(t, elapsed, outage+verdictSettleWindow, "reconnect must wait a full settle window after the network returns")
+}

shared/relay/client/manager.go

@@ -12,6 +12,8 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netsweep"
 	relayAuth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 )
 
@@ -65,9 +67,15 @@ func WithMaxBackoffInterval(d time.Duration) ManagerOption {
 	return func(m *Manager) { m.maxBackoffInterval = d }
 }
 
-// WithNetEvents injects the OS network event handling.
-func WithNetEvents(events NetEvents) ManagerOption {
-	return func(m *Manager) { m.netEvents = events }
+// WithNetworkState injects the OS network availability state that gates the
+// reconnect guard; without it reconnect attempts are not gated.
+func WithNetworkState(netState *netstate.State) ManagerOption {
+	return func(m *Manager) { m.netState = netState }
+}
+
+// WithSweeper injects the network change sweeper.
+func WithSweeper(sweeper *netsweep.Sweeper) ManagerOption {
+	return func(m *Manager) { m.sweeper = sweeper }
 }
 
 // Manager is a manager for the relay client instances. It establishes one persistent connection to the given relay URL
@@ -97,7 +105,8 @@ type Manager struct {
 
 	mtu                uint16
 	maxBackoffInterval time.Duration
-	netEvents          NetEvents
+	netState           *netstate.State
+	sweeper            *netsweep.Sweeper
 
 	cleanupInterval      time.Duration
 	keepUnusedServerTime time.Duration
@@ -134,9 +143,9 @@ func NewManager(ctx context.Context, serverURLs []string, peerID string, mtu uin
 	for _, opt := range opts {
 		opt(m)
 	}
-	m.serverPicker.NetEvents = m.netEvents
+	m.serverPicker.Sweeper = m.sweeper
 	m.serverPicker.ServerURLs.Store(serverURLs)
-	m.reconnectGuard = NewGuard(m.serverPicker, m.maxBackoffInterval, m.netEvents)
+	m.reconnectGuard = NewGuard(m.serverPicker, m.maxBackoffInterval, m.netState)
 	return m
 }
 
@@ -361,7 +370,7 @@ func (m *Manager) openConnVia(ctx context.Context, serverAddress, peerKey string
 
 	relayClient := NewClientWithServerIP(serverAddress, serverIP, m.tokenStore, m.peerID, m.mtu)
 	relayClient.SetTransportFallback(m.transportFallback)
-	relayClient.netEvents = m.netEvents
+	relayClient.sweeper = m.sweeper
 	err := relayClient.Connect(m.ctx)
 	if err != nil {
 		rt.Lock()

shared/relay/client/picker.go

@@ -9,6 +9,7 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/client/netsweep"
 	auth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 )
 
@@ -30,7 +31,7 @@ type ServerPicker struct {
 	MTU               uint16
 	ConnectionTimeout time.Duration
 	TransportFallback *transportFallback
-	NetEvents         NetEvents
+	Sweeper           *netsweep.Sweeper
 }
 
 func (sp *ServerPicker) PickServer(parentCtx context.Context) (*Client, error) {
@@ -74,7 +75,7 @@ func (sp *ServerPicker) startConnection(ctx context.Context, resultChan chan con
 	log.Infof("try to connecting to relay server: %s", url)
 	relayClient := NewClient(url, sp.TokenStore, sp.PeerID, sp.MTU)
 	relayClient.SetTransportFallback(sp.TransportFallback)
-	relayClient.netEvents = sp.NetEvents
+	relayClient.sweeper = sp.Sweeper
 	err := relayClient.Connect(ctx)
 	resultChan <- connResult{
 		RelayClient: relayClient,

shared/signal/client/grpc.go

@@ -19,7 +19,8 @@ import (
 	"google.golang.org/grpc/status"
 
 	nbgrpc "github.com/netbirdio/netbird/client/grpc"
-	"github.com/netbirdio/netbird/client/netevents"
+	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/shared/management/client"
 	"github.com/netbirdio/netbird/shared/signal/proto"
@@ -66,9 +67,12 @@ type GrpcClient struct {
 	connStateCallback     ConnStateNotifier
 	connStateCallbackLock sync.RWMutex
 
-	// netEvents gates the Receive retry loop on OS-reported network
-	// availability and sweeps the transport on network change.
-	netEvents *netevents.Manager
+	// netState gates the Receive retry loop on OS-reported network
+	// availability; nil (the default) disables gating.
+	netState *netstate.State
+
+	// sweeper cuts the transport connections on network change; nil disables it.
+	sweeper *netsweep.Sweeper
 
 	onReconnectedListenerFn func()
 
@@ -96,9 +100,15 @@ type GrpcClient struct {
 // Option configures optional GrpcClient behavior.
 type Option func(*GrpcClient)
 
-// WithNetEvents injects the OS network event handling.
-func WithNetEvents(events *netevents.Manager) Option {
-	return func(c *GrpcClient) { c.netEvents = events }
+// WithNetworkState injects the OS network availability state that gates the
+// Receive retry loop; without it gating is disabled.
+func WithNetworkState(netState *netstate.State) Option {
+	return func(c *GrpcClient) { c.netState = netState }
+}
+
+// WithSweeper injects the network change sweeper.
+func WithSweeper(sweeper *netsweep.Sweeper) Option {
+	return func(c *GrpcClient) { c.sweeper = sweeper }
 }
 
 // NewClient creates a new Signal client
@@ -116,7 +126,9 @@ func NewClient(ctx context.Context, addr string, key wgtypes.Key, tlsEnabled boo
 	}
 
 	var extraOpts []grpc.DialOption
-	extraOpts = append(extraOpts, nbgrpc.WithSweeper(c.netEvents))
+	if c.sweeper != nil {
+		extraOpts = append(extraOpts, nbgrpc.WithSweeper(c.sweeper))
+	}
 
 	var conn *grpc.ClientConn
 	operation := func() error {
@@ -186,20 +198,17 @@ func defaultBackoff(ctx context.Context) backoff.BackOff {
 // The connection retry logic will try to reconnect for 30 min and if wasn't successful will propagate the error to the function caller.
 func (c *GrpcClient) Receive(ctx context.Context, msgHandler func(msg *proto.Message) error) error {
 
-	backOff := c.netEvents.QuickRetryBackoff(ctx, defaultBackoff(ctx))
+	backOff := c.sweeper.QuickRetryBackoff(ctx, defaultBackoff(ctx), c.netState)
 
 	operation := func() error {
 		// suspend reconnect attempts while the OS reports no usable network.
 		// Wait only errors on a cancelled context, which means shutdown, so
 		// stop the loop without reporting a failure.
-		if waited, err := c.netEvents.Wait(ctx); err != nil {
+		if waited, err := c.netState.Wait(ctx); err != nil {
 			log.Debugf("signal connection context has been canceled while offline, this usually indicates shutdown")
 			return nil
 		} else if waited {
 			backOff.Reset()
-			// dials attempted while offline grew the channel's internal backoff;
-			// reset it too, or the reconnect waits out that timer first
-			c.signalConn.ResetConnectBackoff()
 		}
 
 		c.notifyStreamDisconnected()
@@ -272,7 +281,7 @@ func (c *GrpcClient) Receive(ctx context.Context, msgHandler func(msg *proto.Mes
 		return nil
 	}
 
-	err := nbgrpc.Retry(ctx, operation, backOff, c.netEvents)
+	err := nbgrpc.Retry(ctx, operation, backOff, c.netState)
 	if err != nil {
 		log.Errorf("exiting the Signal service connection retry loop due to the unrecoverable error: %v", err)
 		return err