Merge remote-tracking branch 'origin/main' into android/gui-integration

# Conflicts: # client/android/profile_state_test.go
[client] Read the extend flow's config and hint path in one lock
2026-08-07 00:01:28 +02:00 · 2026-08-04 21:53:44 +02:00 · 2026-07-30 21:00:44 +02:00 · 2026-07-30 20:51:40 +02:00 · 2026-07-30 20:46:32 +02:00 · 2026-07-30 20:34:08 +02:00
4 changed files with 95 additions and 638 deletions
--- a/infrastructure_files/getting-started-enterprise.sh
+++ b/infrastructure_files/getting-started-enterprise.sh
@@ -11,13 +11,6 @@ SED_STRIP_PADDING='s/=//g'

 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"

-# Static IP for Traefik inside the compose bridge network. The management
-# server trusts X-Forwarded-* headers from this address only, so all three
-# values derive from the same /24. Override with NETBIRD_DOCKER_SUBNET.
-DOCKER_SUBNET="172.30.0.0/24"
-DOCKER_GATEWAY="172.30.0.1"
-TRAEFIK_IP="172.30.0.10"
-
 check_docker_compose() {
  if command -v docker-compose &> /dev/null; then
    echo "docker-compose"
@@ -46,90 +39,6 @@ rand_b64_key() {
  openssl rand -base64 32
 }

-# ------------------------------------------------------------------
-# Docker network subnet override and conflict check
-# (kept in sync with getting-started.sh; only the compose network
-# name differs)
-# ------------------------------------------------------------------
-
-ip_to_int() {
-  local a b c d
-  IFS=. read -r a b c d <<< "$1"
-  echo $(( (10#$a << 24) + (10#$b << 16) + (10#$c << 8) + 10#$d ))
-}
-
-# cidrs_overlap <cidr> <cidr> — succeeds if the networks overlap
-cidrs_overlap() {
-  local net1="${1%/*}" len1="${1#*/}" net2="${2%/*}" len2="${2#*/}"
-  local min_len=$(( len1 < len2 ? len1 : len2 ))
-  local mask=0
-  if [[ "$min_len" -gt 0 ]]; then
-    mask=$(( (0xFFFFFFFF << (32 - min_len)) & 0xFFFFFFFF ))
-  fi
-  [[ $(( $(ip_to_int "$net1") & mask )) -eq $(( $(ip_to_int "$net2") & mask )) ]]
-}
-
-# valid_ipv4_slash24 <cidr> — accepts a unicast IPv4 /24 like 10.123.45.0/24
-valid_ipv4_slash24() {
-  local octet='(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])'
-  local re="^${octet}\.${octet}\.${octet}\.0/24$"
-  [[ "$1" =~ $re ]] || return 1
-  # Reject non-unicast/reserved ranges: 0/8, loopback, link-local, 224+
-  case "$1" in
-    0.*|127.*|169.254.*|22[4-9].*|2[34][0-9].*|25[0-5].*) return 1 ;;
-  esac
-  return 0
-}
-
-# Apply NETBIRD_DOCKER_SUBNET and derive the gateway (.1) and Traefik IP (.10)
-apply_docker_subnet_override() {
-  if [[ -n "${NETBIRD_DOCKER_SUBNET:-}" ]]; then
-    if ! valid_ipv4_slash24 "$NETBIRD_DOCKER_SUBNET"; then
-      echo "NETBIRD_DOCKER_SUBNET must be a unicast IPv4 /24 network like 10.123.45.0/24 (0/8, 127/8, 169.254/16, and 224+ are not allowed), got: $NETBIRD_DOCKER_SUBNET" > /dev/stderr
-      exit 1
-    fi
-    DOCKER_SUBNET="$NETBIRD_DOCKER_SUBNET"
-  fi
-  local base="${DOCKER_SUBNET%.0/24}"
-  DOCKER_GATEWAY="${base}.1"
-  TRAEFIK_IP="${base}.10"
-  return 0
-}
-
-# check_docker_subnet_conflicts <compose network name>
-# Fail early if an existing Docker network overlaps DOCKER_SUBNET, instead
-# of letting "docker compose up" fail later. Host routes are not checked;
-# NETBIRD_DOCKER_SUBNET covers those cases.
-check_docker_subnet_conflicts() {
-  local expected_network="$1"
-  command -v docker &> /dev/null || return 0
-
-  local name subnets subnet
-  while IFS='|' read -r name subnets; do
-    for subnet in $subnets; do
-      [[ "$subnet" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/[0-9]+$ ]] || continue
-      if [[ "$name" == "$expected_network" ]]; then
-        # Our own leftover network: compose reuses it as-is, so its subnet
-        # must match the one we render
-        if [[ "$subnet" != "$DOCKER_SUBNET" ]]; then
-          echo "ERROR: the Docker network '$name', left over from a previous NetBird install, uses $subnet instead of $DOCKER_SUBNET." > /dev/stderr
-          echo "docker compose would reuse it as-is, and the generated configuration would not match it." > /dev/stderr
-          echo "Remove it and run this script again:" > /dev/stderr
-          echo "  docker network rm $name" > /dev/stderr
-          exit 1
-        fi
-      elif cidrs_overlap "$DOCKER_SUBNET" "$subnet"; then
-        echo "ERROR: the existing Docker network '$name' ($subnet) overlaps $DOCKER_SUBNET, the subnet NetBird would use." > /dev/stderr
-        echo "That network is not managed by this script and is left untouched." > /dev/stderr
-        echo "Pick a free /24 for NetBird instead and run this script again:" > /dev/stderr
-        echo "  NETBIRD_DOCKER_SUBNET=10.123.45.0/24 ./getting-started-enterprise.sh" > /dev/stderr
-        exit 1
-      fi
-    done
-  done < <(docker network inspect --format '{{.Name}}|{{range .IPAM.Config}}{{.Subnet}} {{end}}' $(docker network ls -q 2>/dev/null) 2>/dev/null || true)
-  return 0
-}
-
 check_nb_domain() {
  local domain="$1"
  if [[ -z "$domain" ]]; then
@@ -171,7 +80,7 @@ read_nb_domain() {
  if ! check_domain_resolves "$value"; then
    echo "" > /dev/stderr
    echo "Warning: '$value' does not resolve via DNS from this host." > /dev/stderr
-    echo "Traefik will not be able to issue TLS certificates until it does." > /dev/stderr
+    echo "Caddy will not be able to issue TLS certificates until it does." > /dev/stderr
    local confirm=""
    echo -n "Continue anyway? [y/N]: " > /dev/stderr
    read -r confirm < /dev/tty
@@ -183,23 +92,6 @@ read_nb_domain() {
  echo "$value"
 }

-read_letsencrypt_email() {
-  if [[ -n "${NETBIRD_LETSENCRYPT_EMAIL:-}" ]]; then
-    echo "$NETBIRD_LETSENCRYPT_EMAIL"
-    return
-  fi
-  local value=""
-  echo "Enter your email for Let's Encrypt certificate notifications." > /dev/stderr
-  echo -n "Email address: " > /dev/stderr
-  read -r value < /dev/tty
-  if [[ -z "$value" ]]; then
-    echo "Email is required for Let's Encrypt." > /dev/stderr
-    read_letsencrypt_email
-    return
-  fi
-  echo "$value"
-}
-
 read_required() {
  local prompt="$1"
  local value=""
@@ -311,15 +203,12 @@ wait_postgres() {
 init_environment() {
  check_openssl
  DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
-  # Settle the subnet (and fail on conflicts) before the EULA and prompts
-  apply_docker_subnet_override
-  check_docker_subnet_conflicts "netbird"

-  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]]; then
+  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]] || [[ -f Caddyfile ]]; then
    echo "Generated files already exist in $(pwd)."
    echo "If you want to reinitialize the environment, please remove them first:"
    echo "  $DOCKER_COMPOSE_COMMAND down --volumes # removes all containers and volumes"
-    echo "  rm -f .env docker-compose.yml config.yaml"
+    echo "  rm -f .env docker-compose.yml Caddyfile config.yaml"
    echo "Be aware this will remove all data from the database."
    exit 1
  fi
@@ -341,9 +230,6 @@ init_environment() {
  echo ""
  NETBIRD_DOMAIN=$(read_nb_domain)

-  echo ""
-  NETBIRD_LETSENCRYPT_EMAIL=$(read_letsencrypt_email)
-
  echo ""

  NETBIRD_LICENSE_KEY=$(read_secret "Enter license key (input hidden)")
@@ -361,8 +247,6 @@ init_environment() {
  echo "Selected:"
  echo "  Traffic flow: ${NETBIRD_TRAFFIC_FLOW}"
  echo "  Domain:       ${NETBIRD_DOMAIN}"
-  echo "  ACME email:   ${NETBIRD_LETSENCRYPT_EMAIL}"
-  echo "  Subnet:       ${DOCKER_SUBNET} (Traefik at ${TRAEFIK_IP})"
  echo ""
  echo "Rendering files into $(pwd) ..."
  install -m 600 /dev/null .env
@@ -372,6 +256,7 @@ init_environment() {
  if [[ -z "${NETBIRD_LICENSE_SERVER_BASE_URL:-}" ]]; then
    sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' docker-compose.yml && rm -f docker-compose.yml.bak
  fi
+  render_caddyfile > Caddyfile
  install -m 600 /dev/null config.yaml
  render_config_yaml >> config.yaml

@@ -398,7 +283,7 @@ init_environment() {
  echo "All configuration and secrets are stored (mode 600) in $(pwd)/.env"
  echo ""
  echo "Tail logs:"
-  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server traefik"
+  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server caddy"
 }

 # ------------------------------------------------------------------
@@ -421,16 +306,6 @@ NETBIRD_TRAFFIC_FLOW_ENABLED=${NETBIRD_TRAFFIC_FLOW}
 # Domain
 NETBIRD_DOMAIN=${NETBIRD_DOMAIN}

-# Reverse proxy (Traefik)
-NETBIRD_LETSENCRYPT_EMAIL=${NETBIRD_LETSENCRYPT_EMAIL}
-NETBIRD_TRAEFIK_TAG=${NETBIRD_TRAEFIK_TAG:-v3.6}
-# These three must stay in step with the /32 trust pins in config.yaml
-# (reverseProxy.trustedPeers/trustedHTTPProxies). Shell env vars override
-# this file at compose time.
-NETBIRD_TRAEFIK_IP=${TRAEFIK_IP}
-NETBIRD_NETWORK_SUBNET=${DOCKER_SUBNET}
-NETBIRD_NETWORK_GATEWAY=${DOCKER_GATEWAY}
-
 # Image tags. Default to "latest"
 NETBIRD_DASHBOARD_TAG=${NETBIRD_DASHBOARD_TAG:-latest}
 NETBIRD_SERVER_TAG=${NETBIRD_SERVER_TAG:-latest}
@@ -503,81 +378,26 @@ EOF

 render_compose_common() {
  cat <<'EOF'
-  # Reverse proxy with automatic TLS via Let's Encrypt. Routes are declared as
-  # labels on the services below and picked up through the Docker provider.
-  traefik:
+  caddy:
    <<: *default
-    image: traefik:${NETBIRD_TRAEFIK_TAG}
-    container_name: netbird-traefik
-    networks:
-      netbird:
-        ipv4_address: ${NETBIRD_TRAEFIK_IP}
-        # Resolve the public domain inside this network (avoids hairpin NAT)
-        aliases:
-          - "${NETBIRD_DOMAIN}"
-    command:
-      # Logging
-      - "--log.level=INFO"
-      - "--accesslog=true"
-      # Docker provider
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=netbird"
-      # Entrypoints
-      - "--entrypoints.web.address=:80"
-      - "--entrypoints.websecure.address=:443"
-      - "--entrypoints.websecure.allowACMEByPass=true"
-      # readTimeout bounds the whole request, and gRPC streams / relay WebSockets
-      # never end one; idleTimeout would close the keep-alive connection they
-      # are reused over. Entrypoint-wide is the only scope Traefik offers here.
-      # writeTimeout is left alone: it already defaults to 0.
-      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
-      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0"
-      # HTTP to HTTPS redirect
-      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
-      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
-      # Let's Encrypt ACME
-      - "--certificatesresolvers.letsencrypt.acme.email=${NETBIRD_LETSENCRYPT_EMAIL}"
-      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
+    image: caddy:2
+    container_name: netbird-caddy
+    networks: [netbird]
+    environment:
+      - CADDY_SECURE_DOMAIN=${NETBIRD_DOMAIN}
    ports:
      - '443:443'
+      - '443:443/udp'
      - '80:80'
    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - netbird_traefik_letsencrypt:/letsencrypt
-    labels:
-      - traefik.enable=true
-      # Shared security headers, referenced by every NetBird router below. A
-      # label-declared middleware only exists while its container runs, so this
-      # lives on Traefik itself: declaring it on an app container would drop
-      # every router referencing it whenever that container restarts.
-      - traefik.http.middlewares.nb-security.headers.stsSeconds=3600
-      - traefik.http.middlewares.nb-security.headers.stsIncludeSubdomains=true
-      - traefik.http.middlewares.nb-security.headers.contentTypeNosniff=true
-      - traefik.http.middlewares.nb-security.headers.browserXssFilter=true
-      - traefik.http.middlewares.nb-security.headers.referrerPolicy=strict-origin-when-cross-origin
-      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN
-      # Empty value strips the header. Only the dashboard's nginx sets one; the
-      # server emits none. Do not quote it — "" would send a literal Server: "".
-      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.Server=
+      - netbird_caddy_data:/data
+      - ./Caddyfile:/etc/caddy/Caddyfile

  dashboard:
    <<: *default
    image: ghcr.io/netbirdio/dashboard-cloud:${NETBIRD_DASHBOARD_TAG}
    container_name: netbird-dashboard
    networks: [netbird]
-    labels:
-      - traefik.enable=true
-      # Dashboard catch-all: lowest priority so every route below wins
-      - traefik.http.routers.netbird-dashboard.rule=Host(`${NETBIRD_DOMAIN}`)
-      - traefik.http.routers.netbird-dashboard.entrypoints=websecure
-      - traefik.http.routers.netbird-dashboard.tls=true
-      - traefik.http.routers.netbird-dashboard.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-dashboard.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-dashboard.service=dashboard
-      - traefik.http.routers.netbird-dashboard.priority=1
-      - traefik.http.services.dashboard.loadbalancer.server.port=80
    environment:
      - NETBIRD_MGMT_API_ENDPOINT=https://${NETBIRD_DOMAIN}
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://${NETBIRD_DOMAIN}
@@ -615,28 +435,6 @@ render_compose_server() {
      - netbird_data:/var/lib/netbird
      - ./config.yaml:/etc/netbird/config.yaml
    command: ["--config", "/etc/netbird/config.yaml"]
-    labels:
-      - traefik.enable=true
-      # Signal + Management gRPC (needs an h2c backend for HTTP/2 cleartext)
-      - traefik.http.routers.netbird-grpc.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
-      - traefik.http.routers.netbird-grpc.entrypoints=websecure
-      - traefik.http.routers.netbird-grpc.tls=true
-      - traefik.http.routers.netbird-grpc.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-grpc.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-grpc.service=netbird-server-h2c
-      - traefik.http.routers.netbird-grpc.priority=100
-      # Relay WebSocket, management API, and the embedded IdP
-      - traefik.http.routers.netbird-backend.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
-      - traefik.http.routers.netbird-backend.entrypoints=websecure
-      - traefik.http.routers.netbird-backend.tls=true
-      - traefik.http.routers.netbird-backend.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-backend.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-backend.service=netbird-server
-      - traefik.http.routers.netbird-backend.priority=100
-      # Services
-      - traefik.http.services.netbird-server.loadbalancer.server.port=80
-      - traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80
-      - traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c
    environment:
      - NB_LICENSE_KEY=${NETBIRD_LICENSE_KEY}
      - NETBIRD_LICENSE_SERVER_BASE_URL=${NETBIRD_LICENSE_SERVER_BASE_URL}
@@ -699,18 +497,6 @@ render_compose_flow() {
      - NB_FLOW_NATS_ENDPOINTS=nats://nats:4222
      - NB_FLOW_NATS_STREAM=traffic-events
      - NB_FLOW_AUTH_SECRET=${NETBIRD_RELAY_AUTH_SECRET}
-    labels:
-      - traefik.enable=true
-      # Flow receiver gRPC (h2c backend)
-      - traefik.http.routers.netbird-flow.rule=Host(`${NETBIRD_DOMAIN}`) && PathPrefix(`/flow.FlowService/`)
-      - traefik.http.routers.netbird-flow.entrypoints=websecure
-      - traefik.http.routers.netbird-flow.tls=true
-      - traefik.http.routers.netbird-flow.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-flow.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-flow.service=netbird-flow-h2c
-      - traefik.http.routers.netbird-flow.priority=100
-      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.port=80
-      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.scheme=h2c

 EOF
 }
@@ -750,16 +536,61 @@ EOF
  fi
  cat <<'EOF'
  netbird_postgres:
-  netbird_traefik_letsencrypt:
+  netbird_caddy_data:

 networks:
  netbird:
-    name: netbird
-    driver: bridge
-    ipam:
-      config:
-        - subnet: ${NETBIRD_NETWORK_SUBNET}
-          gateway: ${NETBIRD_NETWORK_GATEWAY}
+EOF
+}
+
+render_caddyfile() {
+  cat <<'EOF'
+{
+  servers :80,:443 {
+    protocols h1 h2c h2 h3
+  }
+}
+
+(security_headers) {
+    header * {
+        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "SAMEORIGIN"
+        X-XSS-Protection "1; mode=block"
+        -Server
+        Referrer-Policy strict-origin-when-cross-origin
+    }
+}
+
+:80 {
+    redir https://{$CADDY_SECURE_DOMAIN}{uri} permanent
+}
+
+{$CADDY_SECURE_DOMAIN}:443 {
+    import security_headers
+    # Signal (gRPC over h2c)
+    reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-server:80
+    # Management (gRPC over h2c + HTTP)
+    reverse_proxy /management.ManagementService/* h2c://netbird-server:80
+    reverse_proxy /api/* netbird-server:80
+    reverse_proxy /ws-proxy/* netbird-server:80
+    # Embedded IdP (OAuth2 endpoints served by netbird server)
+    reverse_proxy /oauth2/* netbird-server:80
+    # Relay (WebSocket multiplexed on the same port)
+    reverse_proxy /relay* netbird-server:80
+EOF
+
+  if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
+    cat <<'EOF'
+    # Flow receiver (gRPC over h2c)
+    reverse_proxy /flow.FlowService/* h2c://receiver:80
+EOF
+  fi
+
+  cat <<'EOF'
+    # Dashboard
+    reverse_proxy /* dashboard:80
+}
 EOF
 }

@@ -778,7 +609,7 @@ server:
  logLevel: "info"
  logFile: "console"

-  # TLS is terminated by Traefik in front; leave this block empty.
+  # TLS is terminated by Caddy in front; leave this block empty.
  tls:
    certFile: ""
    keyFile: ""
@@ -801,16 +632,6 @@ server:
    cliRedirectURIs:
      - "http://localhost:53000/"

-  # Trust X-Forwarded-* only from the Traefik container's static address. Both
-  # keys must stay in step with the ipv4_address pinned in docker-compose.yml:
-  # trustedPeers decides whether forwarded headers are read at all, and leaving
-  # it unset falls back to 0.0.0.0/0.
-  reverseProxy:
-    trustedPeers:
-      - "${TRAEFIK_IP}/32"
-    trustedHTTPProxies:
-      - "${TRAEFIK_IP}/32"
-
  store:
    engine: "postgres"
    dsn: "${POSTGRES_DSN}"
--- a/infrastructure_files/getting-started.sh
+++ b/infrastructure_files/getting-started.sh
@@ -108,14 +108,6 @@ check_nb_domain() {
    echo "The NETBIRD_DOMAIN cannot be netbird.example.com" > /dev/stderr
    return 1
  fi
-
-  # Letters, digits, dots, and hyphens only; the domain is embedded in
-  # generated YAML and env files
-  local re='^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$'
-  if [[ "$DOMAIN" != "use-ip" ]] && [[ ! "$DOMAIN" =~ $re ]]; then
-    echo "The NETBIRD_DOMAIN may only contain letters, digits, dots, and hyphens." > /dev/stderr
-    return 1
-  fi
  return 0
 }

@@ -345,103 +337,6 @@ wait_management_direct() {
  return 0
 }

-############################################
-# Docker Network Subnet Override and Conflict Check
-############################################
-
-ip_to_int() {
-  local a b c d
-  IFS=. read -r a b c d <<< "$1"
-  echo $(( (10#$a << 24) + (10#$b << 16) + (10#$c << 8) + 10#$d ))
-}
-
-# cidrs_overlap <cidr> <cidr> — succeeds if the networks overlap
-cidrs_overlap() {
-  local net1="${1%/*}" len1="${1#*/}" net2="${2%/*}" len2="${2#*/}"
-  local min_len=$(( len1 < len2 ? len1 : len2 ))
-  local mask=0
-  if [[ "$min_len" -gt 0 ]]; then
-    mask=$(( (0xFFFFFFFF << (32 - min_len)) & 0xFFFFFFFF ))
-  fi
-  [[ $(( $(ip_to_int "$net1") & mask )) -eq $(( $(ip_to_int "$net2") & mask )) ]]
-}
-
-# valid_ipv4_slash24 <cidr> — accepts a unicast IPv4 /24 like 10.123.45.0/24
-valid_ipv4_slash24() {
-  local octet='(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])'
-  local re="^${octet}\.${octet}\.${octet}\.0/24$"
-  [[ "$1" =~ $re ]] || return 1
-  # Reject non-unicast/reserved ranges: 0/8, loopback, link-local, 224+
-  case "$1" in
-    0.*|127.*|169.254.*|22[4-9].*|2[34][0-9].*|25[0-5].*) return 1 ;;
-  esac
-  return 0
-}
-
-# Apply NETBIRD_DOCKER_SUBNET and derive the gateway (.1) and Traefik IP (.10)
-apply_docker_subnet_override() {
-  if [[ -n "${NETBIRD_DOCKER_SUBNET:-}" ]]; then
-    if ! valid_ipv4_slash24 "$NETBIRD_DOCKER_SUBNET"; then
-      echo "NETBIRD_DOCKER_SUBNET must be a unicast IPv4 /24 network like 10.123.45.0/24 (0/8, 127/8, 169.254/16, and 224+ are not allowed), got: $NETBIRD_DOCKER_SUBNET" > /dev/stderr
-      exit 1
-    fi
-    DOCKER_SUBNET="$NETBIRD_DOCKER_SUBNET"
-  fi
-  local base="${DOCKER_SUBNET%.0/24}"
-  DOCKER_GATEWAY="${base}.1"
-  TRAEFIK_IP="${base}.10"
-  return 0
-}
-
-# check_docker_subnet_conflicts <compose network name>
-# Fail early if an existing Docker network overlaps DOCKER_SUBNET, instead
-# of letting "docker compose up" fail later. Host routes are not checked;
-# NETBIRD_DOCKER_SUBNET covers those cases.
-check_docker_subnet_conflicts() {
-  local expected_network="$1"
-  command -v docker &> /dev/null || return 0
-
-  local name subnets subnet
-  while IFS='|' read -r name subnets; do
-    for subnet in $subnets; do
-      [[ "$subnet" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/[0-9]+$ ]] || continue
-      if [[ "$name" == "$expected_network" ]]; then
-        # Our own leftover network: compose reuses it as-is, so its subnet
-        # must match the one we render
-        if [[ "$subnet" != "$DOCKER_SUBNET" ]]; then
-          echo "ERROR: the Docker network '$name', left over from a previous NetBird install, uses $subnet instead of $DOCKER_SUBNET." > /dev/stderr
-          echo "docker compose would reuse it as-is, and the generated configuration would not match it." > /dev/stderr
-          echo "Remove it and run this script again:" > /dev/stderr
-          echo "  docker network rm $name" > /dev/stderr
-          exit 1
-        fi
-      elif cidrs_overlap "$DOCKER_SUBNET" "$subnet"; then
-        echo "ERROR: the existing Docker network '$name' ($subnet) overlaps $DOCKER_SUBNET, the subnet NetBird would use." > /dev/stderr
-        echo "That network is not managed by this script and is left untouched." > /dev/stderr
-        echo "Pick a free /24 for NetBird instead and run this script again:" > /dev/stderr
-        echo "  NETBIRD_DOCKER_SUBNET=10.123.45.0/24 ./getting-started.sh" > /dev/stderr
-        exit 1
-      fi
-    done
-  done < <(docker network inspect --format '{{.Name}}|{{range .IPAM.Config}}{{.Subnet}} {{end}}' $(docker network ls -q 2>/dev/null) 2>/dev/null || true)
-  return 0
-}
-
-configure_docker_subnet() {
-  # Only the built-in Traefik mode pins a subnet; other modes let Docker pick
-  if [[ "$REVERSE_PROXY_TYPE" != "0" ]]; then
-    return 0
-  fi
-
-  # Skip our own network (<project>_netbird) in the conflict check;
-  # normalization matches compose-go's NormalizeProjectName
-  local project
-  project="${COMPOSE_PROJECT_NAME:-$(basename "$PWD")}"
-  project=$(echo "$project" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9_-]//g; s/^[_-]*//')
-  check_docker_subnet_conflicts "${project}_netbird"
-  return 0
-}
-
 ############################################
 # Initialization and Configuration
 ############################################
@@ -473,11 +368,7 @@ initialize_default_values() {
  BIND_LOCALHOST_ONLY="true"
  EXTERNAL_PROXY_NETWORK=""

-  # Internal bridge network. Management and proxy trust forwarded headers
-  # from TRAEFIK_IP only, so all three values derive from the same /24.
-  # Override with NETBIRD_DOCKER_SUBNET.
-  DOCKER_SUBNET="172.30.0.0/24"
-  DOCKER_GATEWAY="172.30.0.1"
+  # Traefik static IP within the internal bridge network
  TRAEFIK_IP="172.30.0.10"

  # NetBird Proxy configuration
@@ -772,10 +663,8 @@ init_environment() {
  check_docker_sock_perms

  initialize_default_values
-  apply_docker_subnet_override
  configure_domain
  configure_reverse_proxy
-  configure_docker_subnet

  check_jq

@@ -797,7 +686,6 @@ render_docker_compose_traefik_builtin() {
  local crowdsec_volumes=""
  local traefik_file_provider=""
  local traefik_dynamic_volume=""
-
  if [[ "$ENABLE_PROXY" == "true" ]]; then
    traefik_file_provider='      - "--providers.file.filename=/etc/traefik/dynamic.yaml"'
    traefik_dynamic_volume="      - ./traefik-dynamic.yaml:/etc/traefik/dynamic.yaml:ro"
@@ -996,8 +884,8 @@ networks:
    driver: bridge
    ipam:
      config:
-        - subnet: $DOCKER_SUBNET
-          gateway: $DOCKER_GATEWAY
+        - subnet: 172.30.0.0/24
+          gateway: 172.30.0.1
 EOF
  return 0
 }
--- a/infrastructure_files/migrate-to-enterprise.sh
+++ b/infrastructure_files/migrate-to-enterprise.sh
@@ -15,11 +15,7 @@ set -o pipefail
 #   2. Postgres migration — add Postgres, migrate SQLite data via migrate-store.
 #   3. Traffic flow       — add NATS + flow-enricher + flow-receiver.
 #
-# If any step fails once the stack has been touched, the script rolls itself
-# back automatically: generated files are removed, the Postgres volume this run
-# created is dropped, and the original deployment is started again.
-#
-# To revert a successful migration:
+# To revert:
 #   docker compose down
 #   rm -f docker-compose.override.yml config.yaml.enterprise
 #   # If Postgres migration was done, also restore the SQLite backup printed
@@ -29,15 +25,6 @@ set -o pipefail
 OVERRIDE_FILE="docker-compose.override.yml"
 ENTERPRISE_CONFIG_FILE="config.yaml.enterprise"

-# Rollback bookkeeping. ROLLBACK_STATE flips to "armed" the moment the script
-# starts mutating the deployment, and back to "disarmed" once the migration has
-# completed successfully.
-ROLLBACK_STATE="disarmed"
-ENV_EXISTED="unknown"
-ENV_BACKUP=""
-PG_VOLUME_NAME=""
-BACKUP_DIR=""
-
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"

 check_docker_compose() {
@@ -374,77 +361,7 @@ render_enterprise_config() {
 # Execution steps
 # ---------------------------------------------------------------------------

-combined_container_id() {
-  $DOCKER_COMPOSE_COMMAND ps -aq "$COMBINED_SERVICE" 2>/dev/null | head -1
-}
-
-container_data_mount() {
-  local container="$1"
-  [[ -n "$container" ]] || return 0
-  docker inspect "$container" --format \
-    '{{range .Mounts}}{{if eq .Destination "/var/lib/netbird"}}{{if .Name}}{{.Name}}{{else}}{{.Source}}{{end}}{{end}}{{end}}' 2>/dev/null
-}
-
-# The name comes from the container, so `-v` cannot invent an empty volume here.
-# 0 = empty, 1 = holds data, 2 = could not determine. A failed listing must not
-# be reported as empty: that would abort a healthy migration over a pull error
-# or an unreadable bind mount.
-data_dir_state() {
-  local src="$1" out
-  if [[ "$src" == /* ]]; then
-    [[ -d "$src" ]] || return 2
-    out=$(ls -A "$src" 2>/dev/null) || return 2
-  else
-    docker volume inspect "$src" &> /dev/null || return 0
-    out=$(docker run --rm -v "${src}:/d:ro" busybox sh -c 'ls -A /d' 2>/dev/null) || return 2
-  fi
-  [[ -z "$out" ]] && return 0
-  return 1
-}
-
-check_data_directory() {
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
-
-  local container
-  container=$(combined_container_id)
-  if [[ -z "$container" ]]; then
-    echo "" > /dev/stderr
-    echo "No container found for service '$COMBINED_SERVICE'." > /dev/stderr
-    echo "The migration backs up the store by copying it out of that container," > /dev/stderr
-    echo "so it has to exist. Start the deployment and re-run:" > /dev/stderr
-    echo "  $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
-    exit 1
-  fi
-
-  local src
-  src=$(container_data_mount "$container")
-  if [[ -z "$src" ]]; then
-    echo "" > /dev/stderr
-    echo "The '$COMBINED_SERVICE' container has nothing mounted at /var/lib/netbird." > /dev/stderr
-    echo "Cannot locate the NetBird store to back it up." > /dev/stderr
-    exit 1
-  fi
-
-  local state=0
-  data_dir_state "$src" || state=$?
-  if [[ $state -eq 0 ]]; then
-    echo "" > /dev/stderr
-    echo "The NetBird data directory is empty:" > /dev/stderr
-    echo "  $src" > /dev/stderr
-    echo "There is nothing to migrate. Check that you are running this from the" > /dev/stderr
-    echo "deployment directory of the NetBird install you mean to migrate." > /dev/stderr
-    exit 1
-  fi
-  if [[ $state -eq 2 ]]; then
-    echo "  ⚠ Could not read $src to confirm it holds data — continuing." > /dev/stderr
-    echo "    The backup step still fails loudly if it turns out to be empty." > /dev/stderr
-  fi
-
-  echo "  Data directory:   $src"
-}
-
-# Only for the Postgres volume, which has no container to read it off yet.
-resolve_compose_volume() {
+resolve_data_volume() {
  local short="$1"
  local actual
  # Resolve project-prefixed volume name from Docker Compose config first.
@@ -474,21 +391,18 @@ resolve_compose_volume() {
 backup_sqlite() {
  BACKUP_DIR="$(pwd)/backups/sqlite-pre-enterprise-$(date +%Y%m%d-%H%M%S)"
  mkdir -p "$BACKUP_DIR"
-
-  local container
-  container=$(combined_container_id)
-  if [[ -z "$container" ]]; then
-    echo "  ⚠ No container found for '$COMBINED_SERVICE' — cannot back up the store." > /dev/stderr
-    exit 1
-  fi
-
-  echo "Backing up the NetBird store to $BACKUP_DIR ..."
-  docker cp "${container}:/var/lib/netbird/." "$BACKUP_DIR/"
-
+  local data_volume_actual
+  data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
+  echo "Backing up SQLite store from volume '$data_volume_actual' to $BACKUP_DIR ..."
+  docker run --rm \
+    -v "${data_volume_actual}:/var/lib/netbird:ro" \
+    -v "${BACKUP_DIR}:/backup" \
+    busybox \
+    sh -c 'cp -a /var/lib/netbird/. /backup/ 2>/dev/null || true'
  local copied
  copied=$(find "$BACKUP_DIR" -mindepth 1 | head -1)
  if [[ -z "$copied" ]]; then
-    echo "  ⚠ Backup directory is empty — /var/lib/netbird held no data. Aborting." > /dev/stderr
+    echo "  ⚠ Backup directory is empty — the volume '$data_volume_actual' didn't contain data. Aborting." > /dev/stderr
    exit 1
  fi
  echo "  done"
@@ -500,135 +414,6 @@ run_migrate_store() {
  echo "  done"
 }

-# ---------------------------------------------------------------------------
-# Rollback — a failed run must not leave the operator with a stopped stack and
-# half-written artifacts.
-# ---------------------------------------------------------------------------
-
-# Resolve the name Compose would give the Postgres volume before the override
-# exists, so a leftover volume can be spotted up front.
-compose_project_name() {
-  local container project
-  container=$($DOCKER_COMPOSE_COMMAND ps -aq 2>/dev/null | head -1)
-  if [[ -n "$container" ]]; then
-    project=$(docker inspect "$container" \
-      --format '{{index .Config.Labels "com.docker.compose.project"}}' 2>/dev/null)
-    if [[ -n "$project" ]]; then
-      echo "$project"
-      return 0
-    fi
-  fi
-  project=$($DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval '.name // ""' - 2>/dev/null)
-  if [[ -n "$project" ]] && [[ "$project" != "null" ]]; then
-    echo "$project"
-  fi
-  return 0
-}
-
-postgres_volume_name() {
-  local project
-  project=$(compose_project_name)
-  if [[ -n "$project" ]]; then
-    echo "${project}_netbird_postgres"
-  fi
-  return 0
-}
-
-# Postgres skips initdb when its data directory is non-empty, so a volume left
-# behind by an interrupted run would keep the old password and old contents,
-# and migrate-store would fail against it.
-check_stale_postgres_volume() {
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
-
-  PG_VOLUME_NAME=$(postgres_volume_name)
-  if [[ -z "$PG_VOLUME_NAME" ]]; then
-    echo ""
-    echo "  ⚠ Could not determine the Compose project name, so a Postgres volume"
-    echo "    left over from an earlier attempt cannot be checked for. If a"
-    echo "    previous run failed, remove it before continuing:"
-    echo "      docker volume ls | grep netbird_postgres"
-    return 0
-  fi
-  docker volume inspect "$PG_VOLUME_NAME" &> /dev/null || return 0
-
-  echo ""
-  echo "  ⚠  A Postgres volume from an earlier attempt already exists:"
-  echo "       $PG_VOLUME_NAME"
-  echo "     Postgres does not re-initialise a non-empty data directory, so the"
-  echo "     migration would run against stale credentials and stale data."
-  local remove
-  remove=$(read_yes_no "  Remove it and continue?" "y")
-  if [[ "$remove" != "yes" ]]; then
-    echo "" > /dev/stderr
-    echo "Aborted. Remove it manually with: docker volume rm $PG_VOLUME_NAME" > /dev/stderr
-    exit 1
-  fi
-  docker volume rm "$PG_VOLUME_NAME" > /dev/null
-  echo "  Removed."
-}
-
-# Undo whatever this run changed and start the previous deployment again.
-rollback() {
-  ROLLBACK_STATE="done"
-
-  echo ""
-  echo "──────────────────────────────────────────────────────────────────────"
-  echo " Migration failed — restoring the previous deployment"
-  echo "──────────────────────────────────────────────────────────────────────"
-
-  # Resolve while the override is still present; without it Compose no longer
-  # knows about the Postgres volume.
-  local pg_volume="$PG_VOLUME_NAME"
-  if [[ -z "$pg_volume" ]] && [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    pg_volume=$(postgres_volume_name)
-  fi
-
-  echo ""
-  echo "Stopping services ..."
-  $DOCKER_COMPOSE_COMMAND down || true
-
-  echo "Removing generated files ..."
-  rm -f "$OVERRIDE_FILE" "$ENTERPRISE_CONFIG_FILE"
-
-  # Restore .env to exactly what it was, or remove it if this run created it.
-  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
-    mv -f "$ENV_BACKUP" .env || echo "  ⚠ Could not restore .env from $ENV_BACKUP." > /dev/stderr
-  elif [[ "$ENV_EXISTED" == "no" ]]; then
-    rm -f .env || true
-  fi
-
-  # Only ever the volume this run created — never the NetBird data volume.
-  if [[ -n "$pg_volume" ]] && [[ "$pg_volume" != "null" ]]; then
-    echo "Removing Postgres volume $pg_volume ..."
-    docker volume rm "$pg_volume" &> /dev/null || true
-  fi
-
-  echo "Starting the previous deployment ..."
-  if ! $DOCKER_COMPOSE_COMMAND up -d; then
-    echo ""
-    echo "  ⚠ Could not start the previous deployment automatically." > /dev/stderr
-    echo "    Run: $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
-  fi
-
-  echo ""
-  echo "Rolled back. Your docker-compose.yml, config.yaml and the NetBird data"
-  echo "volume were never modified."
-  if [[ -n "$BACKUP_DIR" ]] && [[ -d "$BACKUP_DIR" ]]; then
-    echo "The SQLite backup taken during this run is kept at:"
-    echo "  $BACKUP_DIR"
-  fi
-  echo "──────────────────────────────────────────────────────────────────────"
-}
-
-on_exit() {
-  local code=$?
-  trap - EXIT
-  if [[ $code -ne 0 ]] && [[ "$ROLLBACK_STATE" == "armed" ]]; then
-    rollback
-  fi
-  exit $code
-}
-
 # ---------------------------------------------------------------------------
 # Main
 # ---------------------------------------------------------------------------
@@ -756,15 +541,9 @@ init_migration() {
    ENABLE_FLOW="no"
    echo "Step 3 (traffic flow) skipped — requires Postgres."
  fi
-
-  check_data_directory
-  check_stale_postgres_volume
 }

 apply_changes() {
-  # From here on a failure must roll the deployment back.
-  ROLLBACK_STATE="armed"
-
  echo ""
  echo "Writing $OVERRIDE_FILE ..."
  install -m 644 /dev/null "$OVERRIDE_FILE"
@@ -785,14 +564,6 @@ apply_changes() {
  # picks it up automatically.
  echo "Writing .env additions (mode 600) ..."
  local ENV_FILE=".env"
-  # Snapshot the operator's .env so a rollback can restore it byte for byte.
-  if [[ -f "$ENV_FILE" ]]; then
-    ENV_EXISTED="yes"
-    ENV_BACKUP="${ENV_FILE}.pre-enterprise-$(date +%Y%m%d-%H%M%S)"
-    cp -p "$ENV_FILE" "$ENV_BACKUP"
-  else
-    ENV_EXISTED="no"
-  fi
  touch "$ENV_FILE"
  chmod 600 "$ENV_FILE"
  {
@@ -821,16 +592,11 @@ apply_changes() {

  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
    echo ""
-    # Stop, but keep the containers: the backup reads the store out of one.
-    echo "Stopping services so the store is quiescent ..."
-    $DOCKER_COMPOSE_COMMAND stop
+    echo "Stopping existing services (volumes preserved) ..."
+    $DOCKER_COMPOSE_COMMAND down

    backup_sqlite

-    echo ""
-    echo "Removing stopped containers (volumes preserved) ..."
-    $DOCKER_COMPOSE_COMMAND down
-
    echo ""
    echo "Starting Postgres ..."
    $DOCKER_COMPOSE_COMMAND up -d postgres
@@ -860,9 +626,6 @@ apply_changes() {

  echo ""
  echo "Migration complete."
-
-  # Nothing left to undo.
-  ROLLBACK_STATE="disarmed"
 }

 print_summary() {
@@ -880,7 +643,6 @@ print_summary() {
  echo "    $OVERRIDE_FILE"
  [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
  echo "    .env  (license key + secrets, mode 600)"
-  [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]] && echo "    $ENV_BACKUP  (.env as it was before this run)"
  [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    backups/sqlite-pre-enterprise-*/  (SQLite backup)"
  echo ""
  echo " Tail logs:"
@@ -889,27 +651,19 @@ print_summary() {
  echo "──────────────────────────────────────────────────────────────────────"
  echo " To revert"
  echo "──────────────────────────────────────────────────────────────────────"
+  echo "  $DOCKER_COMPOSE_COMMAND down"
  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    # Resolve the project-prefixed volume name now, before the override is gone.
-    local pg_volume
-    pg_volume=$(resolve_compose_volume "netbird_postgres")
-    echo "  # Stop, but keep the containers so the store can be copied back in:"
-    echo "  $DOCKER_COMPOSE_COMMAND stop"
-    echo "  # Restore SQLite from the backup created during this run:"
-    echo "  docker cp ${BACKUP_DIR}/. \$($DOCKER_COMPOSE_COMMAND ps -aq $COMBINED_SERVICE):/var/lib/netbird/"
-    echo "  $DOCKER_COMPOSE_COMMAND down"
+    # Resolve project-prefixed volume names now (before override is removed).
+    local pg_volume data_volume_actual
+    pg_volume=$(resolve_data_volume "netbird_postgres")
+    data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
+    echo "  # Remove the Postgres volume FIRST, before deleting the override file:"
    echo "  docker volume rm $pg_volume"
-  else
-    echo "  $DOCKER_COMPOSE_COMMAND down"
+    echo "  # Restore SQLite from the backup created during this run:"
+    echo "  docker run --rm -v ${data_volume_actual}:/var/lib/netbird -v ${BACKUP_DIR}:/backup busybox sh -c 'cp -a /backup/. /var/lib/netbird/'"
  fi
  echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
-  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
-    echo "  mv $ENV_BACKUP .env   # restores .env as it was before this run"
-  elif [[ "$ENV_EXISTED" == "no" ]]; then
-    echo "  rm -f .env   # created by this run"
-  else
-    echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
-  fi
+  echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
  echo "  $DOCKER_COMPOSE_COMMAND up -d"
  echo "──────────────────────────────────────────────────────────────────────"
 }
@@ -918,10 +672,6 @@ print_summary() {
 # Run
 # ---------------------------------------------------------------------------

-trap on_exit EXIT
-# Turn signals into a normal exit so the EXIT trap can roll back.
-trap 'exit 130' INT TERM
-
 init_migration
 apply_changes
 print_summary
--- a/shared/relay/client/guard.go
+++ b/shared/relay/client/guard.go
@@ -156,11 +156,9 @@ func (g *Guard) notifyReconnected() {
 func (g *Guard) exponentTicker(ctx context.Context) *backoff.Ticker {
 	bo := backoff.WithContext(&backoff.ExponentialBackOff{
 		InitialInterval: 2 * time.Second,
-		// Spreads the reconnects of every client that lost the same relay server.
-		RandomizationFactor: backoff.DefaultRandomizationFactor,
-		Multiplier:          2,
-		MaxInterval:         g.maxBackoffInterval,
-		Clock:               backoff.SystemClock,
+		Multiplier:      2,
+		MaxInterval:     g.maxBackoffInterval,
+		Clock:           backoff.SystemClock,
 	}, ctx)

 	return backoff.NewTicker(bo)
Author	SHA1	Message	Date
Zoltán Papp	906fdf4bb5	Merge remote-tracking branch 'origin/main' into android/gui-integration # Conflicts: # client/android/profile_state_test.go	2026-08-04 21:53:44 +02:00
Zoltán Papp	4263315527	[client] Read the extend flow's config and hint path in one lock extendAuthSession took the config from stateSnapshot and the config path from a second call, each acquiring the lock on its own. A profile switch landing between the two swaps every field, which would authenticate with one profile's config while reading the login hint from another profile's account file. Replace configPathSnapshot with authSnapshot, which returns both from a single critical section.	2026-07-30 21:00:44 +02:00
Zoltán Papp	56ff5237dd	[client] Report the login's profile ID only when it is one LoginResult.ProfileID was filled from the request's ProfileName, which is a handle: a display name or an ID prefix resolve just as well. waitSSOLogin names the state file after it, so a handle would have written the account email to a file no reader looks for — the email silently lost, plus a stray file. Fill it only on the branch where the daemon supplied the ID, and leave it empty otherwise; waitSSOLogin then falls back to the active profile, as it did before the field existed.	2026-07-30 20:51:40 +02:00
Zoltán Papp	3a17d0381c	[client] Clear the removed profile's email by its resolved ID RemoveProfile takes a handle — a display name or an ID prefix resolve just as well as a full ID — but the state file holding the account email is named after the ID. Passing the request handle straight through therefore named a different file, or none, leaving the email behind for a recreated profile to inherit. The daemon already echoes back the ID it resolved for exactly this purpose; use it.	2026-07-30 20:46:32 +02:00
Zoltán Papp	6155c94b05	[client] Reuse the profile's account for Android SSO logins The Android binding never recorded which account a profile belongs to, so every interactive login and every session extend went to the IdP with no login_hint. With nothing to go on the IdP picks an account itself, which on a session extend means re-authenticating an account the profile is already signed in with. Store the email the PKCE flow already parses out of the ID token, and pass it back as the hint on later flows. An empty hint stays meaningful: a fresh profile, or one that was logged out, deliberately leaves the choice to the IdP, which is how a profile changes accounts. Logout clears the stored email for that reason — while it is on disk it would steer the next login straight back into the account just logged out of. The email is keyed off the profile's config path rather than the active profile: Auth.login runs in a goroutine, so the active profile can change under a flow already in flight. It lands in <profile>.account.json, not the <profile>.state.json desktop uses for the same data — there the email and the engine's state manager sit in different directories, but on Android both resolve under files/, and the state manager rewrites the whole file from its own keys.	2026-07-30 20:34:08 +02:00
Zoltán Papp	09f7fb6510	[client] Drop the initial GetNetworkMap fetch on Android startup Android startup opened a throwaway Sync stream to management before creating the TUN device, only to learn the initial routes, DNS config and the DNS feature flag. Server side this computed a full network map and broadcast a false connect/disconnect pair to every peer in the account on every Android start; client side it put a blocking network round trip on the critical startup path and failed the whole engine start when management was unreachable. None of its outputs are needed upfront anymore: the TUN is created empty and the first sync triggers a rebuild that pulls the fresh route and search domain state, the permanent DNS server starts with an empty config that the first sync populates, and the fake IP manager is created lazily when the DNS feature flag turns on. Remove readInitialSettings and its plumbing: the InitialRoutes and DNSFeatureFlag manager config fields, the android construction-time route setup, the initial-route bookkeeping in the notifiers and the now-unused GetNetworkMap client method.	2026-07-30 20:19:41 +02:00
Zoltán Papp	4475819f38	[client] Pull fresh TUN settings on Android rebuild instead of pushing state The Android TUN rebuild consumed state pushed through notifications and a Java-side snapshot, and both sources were unreliable. The DNS search-domain notifier fired OnNetworkChanged with an empty string, which the rebuild handler treated as the new route list, so any search domain change rebuilt the TUN with zero routes and cut all tunnel traffic. The rebuild also reused the search domains cached at the last establish, so search domain updates never reached the TUN at runtime. Make the notification a pure trigger and let the Java side pull a fresh snapshot instead. Expose GetTunSettings on the Android SDK client: it returns the current TUN route ranges, derived on demand by the route manager from the client routes, the exit-node selection and the fake IP blocks, together with the DNS search domains. The route notifier keeps only its last-announced baseline to suppress triggers for unchanged syncs; the TUN route state is owned by the route manager. SearchDomains now locks the DNS server mutex since the pull arrives from a Java thread. Requires the matching android-client change that switches recreateTUN to the pull API.	2026-07-30 20:19:41 +02:00
Zoltán Papp	c8adaa45da	[client] Serialize Android tunnel reconfiguration callbacks The Android route notifier and the DNS search-domain notifier both delivered OnNetworkChanged from a fire-and-forget goroutine per update. Two updates in quick succession could reach the Java side reordered: the TUN rebuild handler applies them in arrival order and compares against the last applied parameters, so a stale route set delivered last won as the final TUN state. This is the same reordering hazard fixed for iOS in #6454. Wrap the Android network change listener into the shared tunnelnotifier FIFO introduced in #6870, the same way RunOniOS does, and deliver both notifiers synchronously into it. Enqueueing is non-blocking, a single delivery goroutine preserves order, and calls into Java never overlap. Also stop hasRouteDiff from sorting the notifier's shared route slices in place; compare sorted copies instead.	2026-07-30 20:19:41 +02:00
Zoltán Papp	e970daaf5f	[client] Create the Android fake IP manager lazily on DNS flag enable The fake IP manager was only created at route manager construction, from the DNS feature flag fetched by the initial GetNetworkMap call. When the flag flipped to true mid-session, UpdateRoutes set useNewDNSRoute but never created the manager, so domain routes added after the flip got a DNS interceptor with a nil fake IP manager. internalDnatFw only checked for a firewall and GOOS, so the interceptor took the DNAT path and called GetFakeIP/AllocateFakeIP on the nil *fakeip.Manager. These methods lock m.mu first, which is a nil pointer dereference: the first DNS answer for such a route panicked and crashed the VPN service. The fake IP blocks (240.0.0.0/8 and its v6 pair) also never reached the TUN, since only the constructor registered them. Create the manager and its TUN routes from UpdateRoutes when the flag turns on, notify so the fake IP blocks get into the TUN without a client route change, and treat a nil manager as no internal DNAT. This is groundwork for removing the initial GetNetworkMap fetch, after which every startup goes through the flag-off-to-on transition.	2026-07-30 20:19:41 +02:00
Zoltán Papp	5ae323a555	[client] Delete the account email when a profile is removed Removing a profile left its state file behind: the daemon deletes what it owns, but the file holding the account email is user-owned and out of reach for a root daemon, which is why Connection.Logout already clears it from the UI side. Beyond the stray file, legacy profiles are keyed by name rather than by a generated ID, so recreating a profile under a removed one's name inherited its email — shown as the account in the profile list and sent as the login_hint on the next login.	2026-07-30 20:19:41 +02:00
Zoltán Papp	19337dc056	[client] File the account email against the profile the login ran for SetActiveProfileState resolves the target itself, so it writes to whichever profile is active when it is called. A GUI SSO login spans seconds of user interaction in the browser, and the tray stays clickable throughout: switching profiles in that window left the email filed under the profile that happened to be active when the flow returned. The wrong profile then advertised an account it does not own, and offered it as the login_hint next time. Add SetProfileState(id, state), the write-side counterpart of the existing GetProfileState(id), and keep SetActiveProfileState as a wrapper for callers with no particular profile in mind. Login now reports the profile it resolved so the frontend can hand it back with the SSO wait, which closes the window.	2026-07-30 20:19:41 +02:00
Zoltán Papp	fd06d9a3d5	[client] Store the account email after a GUI SSO login The daemon returns the authenticated user's email from WaitSSOLogin but cannot persist it: it runs as root while the per-profile state file is user-owned. The CLI's handleSSOLogin writes it after its own WaitSSOLogin; the GUI path read the value and dropped it. The profile was therefore left with no email, so Profiles.List showed no account for it, and later logins and session extends went out with no login_hint — leaving the IdP to pick an account instead of reusing the one the profile belongs to. Mirror the CLI and store it, next to the Logout path that already clears the same file for the same reason.	2026-07-30 20:19:41 +02:00