Merge branch 'main' into feat/migrate-detect-postgres

client/cmd/debug.go

@@ -3,6 +3,7 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"os/user"
 	"strings"
 	"time"
 
@@ -113,7 +114,7 @@ func debugConfigDump(cmd *cobra.Command, _ []string) error {
 	if err != nil {
 		return fmt.Errorf("get active profile: %v", err)
 	}
-	currUser, err := profilemanager.InvokingUser()
+	currUser, err := user.Current()
 	if err != nil {
 		return fmt.Errorf("get current user: %v", err)
 	}

client/cmd/login.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"os"
+	"os/user"
 	"strings"
 
 	log "github.com/sirupsen/logrus"
@@ -52,7 +53,7 @@ var loginCmd = &cobra.Command{
 			// nolint
 			ctx = context.WithValue(ctx, system.DeviceNameCtxKey, hostName)
 		}
-		username, err := profilemanager.InvokingUser()
+		username, err := user.Current()
 		if err != nil {
 			return fmt.Errorf("get current user: %v", err)
 		}

client/cmd/logout.go

@@ -3,11 +3,11 @@ package cmd
 import (
 	"context"
 	"fmt"
+	"os/user"
 	"time"
 
 	"github.com/spf13/cobra"
 
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
@@ -37,7 +37,7 @@ var logoutCmd = &cobra.Command{
 		if profileName != "" {
 			req.ProfileName = &profileName
 
-			currUser, err := profilemanager.InvokingUser()
+			currUser, err := user.Current()
 			if err != nil {
 				return fmt.Errorf("get current user: %v", err)
 			}

client/cmd/profile.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"os/user"
 	"strings"
 	"text/tabwriter"
 	"time"
@@ -96,7 +97,7 @@ func listProfilesFunc(cmd *cobra.Command, _ []string) error {
 	}
 	defer conn.Close()
 
-	currUser, err := profilemanager.InvokingUser()
+	currUser, err := user.Current()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
@@ -137,7 +138,7 @@ func addProfileFunc(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	currUser, err := profilemanager.InvokingUser()
+	currUser, err := user.Current()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
@@ -178,7 +179,7 @@ func renameProfileFunc(cmd *cobra.Command, args []string) error {
 	}
 	defer conn.Close()
 
-	currUser, err := profilemanager.InvokingUser()
+	currUser, err := user.Current()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
@@ -232,7 +233,7 @@ func removeProfileFunc(cmd *cobra.Command, args []string) error {
 	}
 	defer conn.Close()
 
-	currUser, err := profilemanager.InvokingUser()
+	currUser, err := user.Current()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}
@@ -260,7 +261,7 @@ func selectProfileFunc(cmd *cobra.Command, args []string) error {
 	profileManager := profilemanager.NewProfileManager()
 	handle := args[0]
 
-	currUser, err := profilemanager.InvokingUser()
+	currUser, err := user.Current()
 	if err != nil {
 		return fmt.Errorf("get current user: %w", err)
 	}

client/cmd/up.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
+	"os/user"
 	"runtime"
 	"strings"
 	"time"
@@ -121,7 +122,7 @@ func upFunc(cmd *cobra.Command, args []string) error {
 
 	pm := profilemanager.NewProfileManager()
 
-	username, err := profilemanager.InvokingUser()
+	username, err := user.Current()
 	if err != nil {
 		return fmt.Errorf("get current user: %v", err)
 	}
@@ -294,21 +295,6 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager
 
 	client := proto.NewDaemonServiceClient(conn)
 
-	// Plain root has no invoking user to resolve profiles for, so the local
-	// state falls back to root's own — the default profile. Acting on that
-	// while the daemon runs another user's profile would silently switch the
-	// daemon away from it (and a later browser login would register the
-	// default profile's peer under whichever account the IdP returns). Refuse
-	// the ambiguity instead of guessing.
-	if profilemanager.IsPlainRoot() && profileName == "" {
-		if active, err := client.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{}); err == nil &&
-			active.GetId() != "" && active.GetId() != activeProf.ID.String() {
-			return fmt.Errorf(
-				"running as root: the daemon's active profile is %q (user %q), but this invocation resolves to %q; pass --profile to choose one explicitly, or run via sudo from your own user",
-				active.GetProfileName(), active.GetUsername(), activeProf.ID)
-		}
-	}
-
 	status, err := client.Status(ctx, &proto.StatusRequest{
 		WaitForReady: func() *bool { b := true; return &b }(),
 	})
@@ -328,7 +314,7 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager
 		}
 	}
 
-	username, err := profilemanager.InvokingUser()
+	username, err := user.Current()
 	if err != nil {
 		return fmt.Errorf("get current user: %v", err)
 	}

client/internal/dns/host_windows.go

@@ -35,8 +35,6 @@ var (
 // exported so a diagnostic reader reports the same locations that are written.
 const (
 	// NRPTKeyPrefix starts the name of every NRPT rule key this client creates.
-	// Older versions used different layouts under the same prefix: a single
-	// unsuffixed key, then one key per domain, now one key per batch of domains.
 	NRPTKeyPrefix = "NetBird-Match"
 
 	// DNSPolicyConfigRoot holds the NRPT rules of the local policy store.
@@ -91,6 +89,7 @@ type registryConfigurator struct {
 	guid            string
 	routingAll      bool
 	gpo             bool
+	nrptEntryCount  int
 	origNameservers []netip.Addr
 }
 
@@ -323,9 +322,14 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 	}
 
 	if len(matchDomains) != 0 {
-		if err := r.addDNSMatchPolicy(matchDomains, config.ServerIP); err != nil {
+		count, err := r.addDNSMatchPolicy(matchDomains, config.ServerIP)
+		// Update count even on error to ensure cleanup covers partially created rules
+		r.nrptEntryCount = count
+		if err != nil {
 			return fmt.Errorf("add dns match policy: %w", err)
 		}
+	} else {
+		r.nrptEntryCount = 0
 	}
 
 	r.updateState(stateManager)
@@ -341,8 +345,9 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 
 func (r *registryConfigurator) updateState(stateManager *statemanager.Manager) {
 	if err := stateManager.UpdateState(&ShutdownState{
-		Guid: r.guid,
-		GPO:  r.gpo,
+		Guid:           r.guid,
+		GPO:            r.gpo,
+		NRPTEntryCount: r.nrptEntryCount,
 	}); err != nil {
 		log.Errorf("failed to update shutdown state: %s", err)
 	}
@@ -357,7 +362,7 @@ func (r *registryConfigurator) addDNSSetupForAll(ip netip.Addr) error {
 	return nil
 }
 
-func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr) error {
+func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr) (int, error) {
 	// if the gpo key is present, we need to put our DNS settings there, otherwise our config might be ignored
 	// see https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpnrpt/8cc31cb9-20cb-4140-9e85-3e08703b4745
 
@@ -374,17 +379,19 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, ruleIndex)
 
 		if err := r.configureDNSPolicy(localPath, batchDomains, ip); err != nil {
-			return fmt.Errorf("configure DNS Local policy for rule %d: %w", ruleIndex, err)
+			return ruleIndex, fmt.Errorf("configure DNS Local policy for rule %d: %w", ruleIndex, err)
 		}
 
+		// Increment immediately so the caller's cleanup path knows about this rule
+		ruleIndex++
+
 		if r.gpo {
 			if err := r.configureDNSPolicy(gpoPath, batchDomains, ip); err != nil {
-				return fmt.Errorf("configure gpo DNS policy for rule %d: %w", ruleIndex, err)
+				return ruleIndex, fmt.Errorf("configure gpo DNS policy for rule %d: %w", ruleIndex-1, err)
 			}
 		}
 
-		log.Debugf("added NRPT rule %d with %d domains", ruleIndex, len(batchDomains))
-		ruleIndex++
+		log.Debugf("added NRPT rule %d with %d domains", ruleIndex-1, len(batchDomains))
 	}
 
 	if r.gpo {
@@ -394,7 +401,7 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 	}
 
 	log.Infof("added %d NRPT rules for %d domains", ruleIndex, len(domains))
-	return nil
+	return ruleIndex, nil
 }
 
 func (r *registryConfigurator) configureDNSPolicy(policyPath string, domains []string, ip netip.Addr) error {
@@ -527,28 +534,28 @@ func (r *registryConfigurator) restoreHostDNS() error {
 	return nil
 }
 
-// removeDNSMatchPolicies deletes every NRPT rule this client may have created,
-// from the local and the GPO policy store. The rules are found by enumerating
-// the registry, the only authoritative record of what was written. Cleanup must
-// not depend on a rule count: the in-memory one is scoped to a single
-// registryConfigurator and the persisted one is deleted on every clean
-// disconnect, and a rule left behind keeps resolving names over an interface
-// that is gone, until reboot discards the volatile key.
 func (r *registryConfigurator) removeDNSMatchPolicies() error {
 	var merr *multierror.Error
 
-	for _, root := range []string{DNSPolicyConfigRoot, GPODNSPolicyConfigRoot} {
-		names, err := listNRPTRuleKeys(root)
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("list rule keys under %s: %w", root, err))
-			continue
+	// Try to remove the base entries (for backward compatibility)
+	if err := removeRegistryKeyFromDNSPolicyConfig(dnsPolicyConfigMatchPath); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove local base entry: %w", err))
+	}
+
+	if err := removeRegistryKeyFromDNSPolicyConfig(gpoDnsPolicyConfigMatchPath); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove GPO base entry: %w", err))
+	}
+
+	for i := 0; i < r.nrptEntryCount; i++ {
+		localPath := fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i)
+		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, i)
+
+		if err := removeRegistryKeyFromDNSPolicyConfig(localPath); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove local entry %d: %w", i, err))
 		}
 
-		for _, name := range names {
-			path := root + `\` + name
-			if err := removeRegistryKeyFromDNSPolicyConfig(path); err != nil {
-				merr = multierror.Append(merr, fmt.Errorf("remove entry %s: %w", path, err))
-			}
+		if err := removeRegistryKeyFromDNSPolicyConfig(gpoPath); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("remove GPO entry %d: %w", i, err))
 		}
 	}
 
@@ -563,39 +570,6 @@ func (r *registryConfigurator) restoreUncleanShutdownDNS() error {
 	return r.restoreHostDNS()
 }
 
-// listNRPTRuleKeys returns the names of our NRPT rule keys under a policy store
-// root. An absent root holds nothing to clean up, which is the normal state of
-// the GPO store on a machine without DNS Client policy.
-func listNRPTRuleKeys(root string) ([]string, error) {
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, root, registry.ENUMERATE_SUB_KEYS)
-	switch {
-	case errors.Is(err, registry.ErrNotExist), errors.Is(err, syscall.ERROR_PATH_NOT_FOUND):
-		// the GPO store is absent on a machine without DNS client policy
-		log.Debugf("HKEY_LOCAL_MACHINE\\%s does not exist", root)
-		return nil, nil
-	case err != nil:
-		// any other failure has to reach the caller: reporting no rules would
-		// report a successful cleanup while leaving the rules in place
-		return nil, fmt.Errorf("open HKEY_LOCAL_MACHINE\\%s: %w", root, err)
-	}
-	defer closer(k)
-
-	names, err := k.ReadSubKeyNames(-1)
-	if err != nil {
-		return nil, fmt.Errorf("read subkey names: %w", err)
-	}
-
-	var ruleKeys []string
-	for _, name := range names {
-		// registry key names are case insensitive
-		if strings.HasPrefix(strings.ToLower(name), strings.ToLower(NRPTKeyPrefix)) {
-			ruleKeys = append(ruleKeys, name)
-		}
-	}
-
-	return ruleKeys, nil
-}
-
 func removeRegistryKeyFromDNSPolicyConfig(regKeyPath string) error {
 	k, err := registry.OpenKey(registry.LOCAL_MACHINE, regKeyPath, registry.QUERY_VALUE)
 	if err != nil {

client/internal/dns/host_windows_test.go

@@ -25,7 +25,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 
 	// Create a test interface registry key so updateSearchDomains doesn't fail
 	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := InterfaceConfigPath + `\` + testGUID
+	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
 	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
 	require.NoError(t, err, "Should create test interface registry key")
 	testKey.Close()
@@ -56,7 +56,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify 3 NRPT rules exist
-	assert.Equal(t, 3, countNRPTRuleKeys(t), "Should create 3 NRPT rules for 125 domains")
+	assert.Equal(t, 3, cfg.nrptEntryCount, "Should create 3 NRPT rules for 125 domains")
 	for i := 0; i < 3; i++ {
 		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
 		require.NoError(t, err)
@@ -81,7 +81,7 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	require.NoError(t, err)
 
 	// Verify first 2 NRPT rules exist
-	assert.Equal(t, 2, countNRPTRuleKeys(t), "Should create 2 NRPT rules for 75 domains")
+	assert.Equal(t, 2, cfg.nrptEntryCount, "Should create 2 NRPT rules for 75 domains")
 	for i := 0; i < 2; i++ {
 		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
 		require.NoError(t, err)
@@ -106,65 +106,9 @@ func registryKeyExists(path string) (bool, error) {
 	return true, nil
 }
 
-// TestNRPTCleanupWithoutRuleCount verifies that rules written by a previous run
-// are removed by a configurator that has no record of how many there are: an
-// unclean exit loses the in-memory count and a clean disconnect deletes the
-// persisted one, so cleanup cannot depend on either.
-func TestNRPTCleanupWithoutRuleCount(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping registry integration test in short mode")
-	}
-
-	defer cleanupRegistryKeys(t)
-	cleanupRegistryKeys(t)
-
-	testIP := netip.MustParseAddr("100.64.0.1")
-
-	// 75 domains produce two indexed rules, as the current layout does
-	domains := make([]string, 75)
-	for i := range domains {
-		domains[i] = fmt.Sprintf(".domain%d.com", i+1)
-	}
-
-	previousRun := &registryConfigurator{}
-	require.NoError(t, previousRun.addDNSMatchPolicy(domains, testIP))
-
-	// the unsuffixed key an older version would have written
-	require.NoError(t, previousRun.configureDNSPolicy(dnsPolicyConfigMatchPath, []string{".legacy.example.com"}, testIP))
-
-	// a policy owned by someone else, which cleanup must not touch
-	foreignPath := DNSPolicyConfigRoot + `\DnsPolicyConfigTestForeign`
-	foreignKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, foreignPath, registry.SET_VALUE)
-	require.NoError(t, err, "Should create foreign policy key")
-	foreignKey.Close()
-	defer func() {
-		_ = registry.DeleteKey(registry.LOCAL_MACHINE, foreignPath)
-	}()
-
-	require.Equal(t, 3, countNRPTRuleKeys(t), "Should have two indexed rules and the legacy one")
-
-	// a configurator that never applied a DNS config, as one built after a
-	// restart or from a shutdown state without a count is
-	freshRun := &registryConfigurator{}
-	require.NoError(t, freshRun.removeDNSMatchPolicies())
-
-	assert.Equal(t, 0, countNRPTRuleKeys(t), "Should remove every rule left by the previous run")
-
-	exists, err := registryKeyExists(foreignPath)
-	require.NoError(t, err)
-	assert.True(t, exists, "Should not remove a policy that is not ours")
-}
-
-func countNRPTRuleKeys(t *testing.T) int {
-	t.Helper()
-
-	names, err := listNRPTRuleKeys(DNSPolicyConfigRoot)
-	require.NoError(t, err, "Should list NRPT rule keys")
-	return len(names)
-}
-
 func cleanupRegistryKeys(*testing.T) {
-	cfg := &registryConfigurator{}
+	// Clean up more entries to account for batching tests with many domains
+	cfg := &registryConfigurator{nrptEntryCount: 20}
 	_ = cfg.removeDNSMatchPolicies()
 }
 
@@ -181,7 +125,7 @@ func TestNRPTDomainBatching(t *testing.T) {
 
 	// Create a test interface registry key so updateSearchDomains doesn't fail
 	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := InterfaceConfigPath + `\` + testGUID
+	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
 	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
 	require.NoError(t, err, "Should create test interface registry key")
 	testKey.Close()
@@ -249,7 +193,7 @@ func TestNRPTDomainBatching(t *testing.T) {
 			require.NoError(t, err)
 
 			// Verify that exactly expectedRuleCount rules were created
-			assert.Equal(t, tc.expectedRuleCount, countNRPTRuleKeys(t),
+			assert.Equal(t, tc.expectedRuleCount, cfg.nrptEntryCount,
 				"Should create %d NRPT rules for %d domains", tc.expectedRuleCount, tc.domainCount)
 
 			// Verify all expected rules exist

client/internal/dns/unclean_shutdown_windows.go

@@ -5,8 +5,9 @@ import (
 )
 
 type ShutdownState struct {
-	Guid string
-	GPO  bool
+	Guid           string
+	GPO            bool
+	NRPTEntryCount int
 }
 
 func (s *ShutdownState) Name() string {
@@ -15,8 +16,9 @@ func (s *ShutdownState) Name() string {
 
 func (s *ShutdownState) Cleanup() error {
 	manager := &registryConfigurator{
-		guid: s.Guid,
-		gpo:  s.GPO,
+		guid:           s.Guid,
+		gpo:            s.GPO,
+		nrptEntryCount: s.NRPTEntryCount,
 	}
 
 	if err := manager.restoreUncleanShutdownDNS(); err != nil {

client/internal/ebpf/ebpf/manager_linux.go

@@ -2,21 +2,17 @@ package ebpf
 
 import (
 	_ "embed"
-	"fmt"
 	"net"
 	"sync"
 
 	"github.com/cilium/ebpf/link"
 	"github.com/cilium/ebpf/rlimit"
 	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/unix"
 
 	"github.com/netbirdio/netbird/client/internal/ebpf/manager"
 )
 
 const (
-	xdpProgName = "nb_xdp_prog"
-
 	mapKeyFeatures uint32 = 0
 
 	featureFlagWGProxy      = 0b00000001
@@ -72,50 +68,21 @@ func (tf *GeneralManager) loadXdp() error {
 		return err
 	}
 
-	// lo has no native XDP, so the program runs in generic mode. Unless it
-	// declares multi-buffer support the kernel must linearize every non-linear
-	// skb before running it. Loopback packets are up to 64 KB, so that is a
-	// contiguous GFP_ATOMIC allocation per packet, and when it fails the packet
-	// is dropped before the program runs, stalling local TCP connections.
-	// Multi-buffer XDP in generic mode requires kernel 6.3, so fall back to a
-	// plain attach when the kernel rejects it.
-	err = tf.attachXdp(iFace.Index, true)
-	if err == nil {
-		return nil
-	}
-	log.Debugf("failed to attach multi-buffer xdp program, retrying without it: %s", err)
-
-	return tf.attachXdp(iFace.Index, false)
-}
-
-func (tf *GeneralManager) attachXdp(iFaceIndex int, multiBuffer bool) error {
-	spec, err := loadBpf()
+	// load pre-compiled programs into the kernel.
+	err = loadBpfObjects(&tf.bpfObjs, nil)
 	if err != nil {
-		return fmt.Errorf("load bpf spec: %w", err)
-	}
-
-	if multiBuffer {
-		prog, ok := spec.Programs[xdpProgName]
-		if !ok {
-			return fmt.Errorf("program %s not found in bpf spec", xdpProgName)
-		}
-		prog.Flags |= unix.BPF_F_XDP_HAS_FRAGS
-	}
-
-	if err := spec.LoadAndAssign(&tf.bpfObjs, nil); err != nil {
-		return fmt.Errorf("load bpf objects: %w", err)
+		return err
 	}
 
 	tf.link, err = link.AttachXDP(link.XDPOptions{
 		Program:   tf.bpfObjs.NbXdpProg,
-		Interface: iFaceIndex,
+		Interface: iFace.Index,
 	})
+
 	if err != nil {
-		if closeErr := tf.bpfObjs.Close(); closeErr != nil {
-			log.Debugf("failed to close bpf objects after xdp attach error: %s", closeErr)
-		}
+		_ = tf.bpfObjs.Close()
 		tf.link = nil
-		return fmt.Errorf("attach xdp: %w", err)
+		return err
 	}
 	return nil
 }

client/internal/profilemanager/config.go

@@ -217,12 +217,6 @@ func getConfigDir() (string, error) {
 	}
 
 	configDir := filepath.Join(base, "netbird")
-	// Under sudo this is the invoking user's directory and strictly read-only:
-	// anything root creates in it would be root-owned and break the user's own
-	// runs. Reads of a missing directory fall through to defaults.
-	if _, sudo := sudoInvokingUser(); sudo {
-		return configDir, nil
-	}
 	if err := os.MkdirAll(configDir, 0o755); err != nil {
 		return "", err
 	}
@@ -230,9 +224,6 @@ func getConfigDir() (string, error) {
 }
 
 func baseConfigDir() (string, error) {
-	if u, ok := sudoInvokingUser(); ok {
-		return userBaseConfigDir(u)
-	}
 	if runtime.GOOS == "darwin" {
 		if u, err := user.Current(); err == nil && u.HomeDir != "" {
 			return filepath.Join(u.HomeDir, "Library", "Application Support"), nil

client/internal/profilemanager/invoking_user.go

@@ -1,69 +0,0 @@
-package profilemanager
-
-import (
-	"fmt"
-	"os"
-	"os/user"
-	"path/filepath"
-	"runtime"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// InvokingUser returns the user a CLI invocation acts for. Under sudo that is
-// the user who ran sudo, not root: privileged flags force commands through
-// sudo, and resolving profiles as root would silently switch the daemon to
-// root's (default) profile instead of the invoking user's. Privilege decisions
-// are not made here — those stay on the kernel credentials of the daemon
-// connection, which SUDO_USER (a plain environment variable) can never
-// influence; a forged value only selects a profile root could select anyway.
-func InvokingUser() (*user.User, error) {
-	if u, ok := sudoInvokingUser(); ok {
-		return u, nil
-	}
-	return user.Current()
-}
-
-// IsPlainRoot reports that the process runs as root with no usable sudo
-// context: there is no invoking user to act for, so per-user resolution falls
-// back to root's own (empty) state. Callers use it to refuse ambiguous
-// operations instead of silently acting on the wrong profile.
-func IsPlainRoot() bool {
-	if os.Geteuid() != 0 {
-		return false
-	}
-	_, ok := sudoInvokingUser()
-	return !ok
-}
-
-// sudoInvokingUser resolves SUDO_USER when the process runs as root under
-// sudo. Returns false whenever the sudo context is absent or unusable, in
-// which case callers fall back to the process user.
-func sudoInvokingUser() (*user.User, bool) {
-	if os.Geteuid() != 0 {
-		return nil, false
-	}
-	name := os.Getenv("SUDO_USER")
-	if name == "" || name == "root" {
-		return nil, false
-	}
-	u, err := user.Lookup(name)
-	if err != nil {
-		log.Warnf("failed to look up sudo invoking user %q, acting as root: %v", name, err)
-		return nil, false
-	}
-	return u, true
-}
-
-// userBaseConfigDir mirrors os.UserConfigDir for a user other than the process
-// owner. Environment overrides (XDG_CONFIG_HOME) cannot be honoured here: under
-// sudo the environment is root's, not the invoking user's.
-func userBaseConfigDir(u *user.User) (string, error) {
-	if u.HomeDir == "" {
-		return "", fmt.Errorf("user %s has no home directory", u.Username)
-	}
-	if runtime.GOOS == "darwin" {
-		return filepath.Join(u.HomeDir, "Library", "Application Support"), nil
-	}
-	return filepath.Join(u.HomeDir, ".config"), nil
-}

client/internal/profilemanager/invoking_user_test.go

@@ -1,57 +0,0 @@
-package profilemanager
-
-import (
-	"os"
-	"os/user"
-	"path/filepath"
-	"runtime"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestInvokingUserFallsBackToProcessUser(t *testing.T) {
-	t.Setenv("SUDO_USER", "")
-
-	got, err := InvokingUser()
-	require.NoError(t, err)
-
-	current, err := user.Current()
-	require.NoError(t, err)
-	assert.Equal(t, current.Username, got.Username)
-}
-
-func TestSudoInvokingUserInactiveWithoutSudoContext(t *testing.T) {
-	t.Setenv("SUDO_USER", "")
-	_, ok := sudoInvokingUser()
-	assert.False(t, ok)
-}
-
-func TestSudoInvokingUserIgnoresRoot(t *testing.T) {
-	if os.Geteuid() != 0 {
-		t.Skip("needs root to enter the sudo branch")
-	}
-	t.Setenv("SUDO_USER", "root")
-	_, ok := sudoInvokingUser()
-	assert.False(t, ok, "sudo from a root shell must not redirect anything")
-}
-
-func TestUserBaseConfigDir(t *testing.T) {
-	u := &user.User{Username: "misha", HomeDir: filepath.Join("/home", "misha")}
-	dir, err := userBaseConfigDir(u)
-	require.NoError(t, err)
-	if runtime.GOOS == "darwin" {
-		assert.Equal(t, filepath.Join(u.HomeDir, "Library", "Application Support"), dir)
-	} else {
-		assert.Equal(t, filepath.Join(u.HomeDir, ".config"), dir)
-	}
-
-	_, err = userBaseConfigDir(&user.User{Username: "nohome"})
-	require.Error(t, err)
-}
-
-func TestIsPlainRoot(t *testing.T) {
-	t.Setenv("SUDO_USER", "")
-	assert.Equal(t, os.Geteuid() == 0, IsPlainRoot())
-}

client/internal/profilemanager/profilemanager.go

@@ -3,6 +3,7 @@ package profilemanager
 import (
 	"fmt"
 	"os"
+	"os/user"
 	"path/filepath"
 	"strings"
 	"sync"
@@ -53,7 +54,7 @@ func (p *Profile) FilePath() (string, error) {
 		return "", fmt.Errorf("invalid profile ID: %q", id)
 	}
 
-	username, err := InvokingUser()
+	username, err := user.Current()
 	if err != nil {
 		return "", fmt.Errorf("failed to get current user: %w", err)
 	}
@@ -129,7 +130,7 @@ func (pm *ProfileManager) getActiveProfileState() ID {
 	if err != nil {
 		if !os.IsNotExist(err) {
 			log.Warnf("failed to read active profile state: %v", err)
-		} else if _, sudo := sudoInvokingUser(); !sudo {
+		} else {
 			if err := pm.setActiveProfileState(defaultProfileName); err != nil {
 				log.Warnf("failed to set default profile state: %v", err)
 			}
@@ -147,13 +148,6 @@ func (pm *ProfileManager) getActiveProfileState() ID {
 }
 
 func (pm *ProfileManager) setActiveProfileState(id ID) error {
-	// The invoking user's state is read-only under sudo — a root-owned file in
-	// the user's directory would break their own runs. The daemon still records
-	// the switch on its side; only the user-local bookkeeping is skipped.
-	if u, sudo := sudoInvokingUser(); sudo {
-		log.Infof("running under sudo: not persisting active profile %q for user %s", id, u.Username)
-		return nil
-	}
 
 	configDir, err := getConfigDir()
 	if err != nil {

client/internal/profilemanager/state.go

@@ -7,8 +7,6 @@ import (
 	"os"
 	"path/filepath"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -65,15 +63,6 @@ func (pm *ProfileManager) SetProfileState(id ID, state *ProfileState) error {
 		return fmt.Errorf("invalid profile ID: %q", id)
 	}
 
-	// The invoking user's state is read-only under sudo. The file only carries
-	// the account email for the login hint and display, so skipping the write
-	// costs at most one extra account prompt later — a root-owned file in the
-	// user's directory would cost every later update instead.
-	if u, sudo := sudoInvokingUser(); sudo {
-		log.Debugf("running under sudo: not persisting profile state for user %s", u.Username)
-		return nil
-	}
-
 	stateFile := filepath.Join(configDir, id.String()+".state.json")
 	if err := util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state); err != nil {
 		return fmt.Errorf("write profile state: %w", err)

go.mod

@@ -19,7 +19,7 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/vishvananda/netlink v1.3.1
-	golang.org/x/crypto v0.55.0
+	golang.org/x/crypto v0.54.0
 	golang.org/x/sys v0.47.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
@@ -127,9 +127,9 @@ require (
 	go.uber.org/zap v1.27.0
 	goauthentik.io/api/v3 v3.2023051.3
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f
-	golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733
-	golang.org/x/mod v0.39.0
-	golang.org/x/net v0.58.0
+	golang.org/x/mobile v0.0.0-20251113184115-a159579294ab
+	golang.org/x/mod v0.37.0
+	golang.org/x/net v0.56.0
 	golang.org/x/oauth2 v0.36.0
 	golang.org/x/sync v0.22.0
 	golang.org/x/term v0.45.0
@@ -313,8 +313,8 @@ require (
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/text v0.41.0 // indirect
-	golang.org/x/tools v0.49.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
 	gopkg.in/square/go-jose.v2 v2.6.0 // indirect

go.sum

@@ -728,13 +728,13 @@ golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1m
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733 h1:XKMObIaAElmkdO+4SQh1iCfzwciZHJi1OblnX9BED9k=
-golang.org/x/mobile v0.0.0-20260816165457-f98cc9b3c733/go.mod h1:jMwjxoDSx9jqhNaZqPnr6nnKzb7cs+Dy1Czk7wdX+R8=
+golang.org/x/mobile v0.0.0-20251113184115-a159579294ab h1:Iqyc+2zr7aGyLuEadIm0KRJP0Wwt+fhlXLa51Fxf1+Q=
+golang.org/x/mobile v0.0.0-20251113184115-a159579294ab/go.mod h1:Eq3Nh/5pFSWug2ohiudJ1iyU59SO78QFuh4qTTN++I0=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -744,8 +744,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
-golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
@@ -764,8 +764,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -843,8 +843,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -858,8 +858,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
-golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

infrastructure_files/migrate-to-enterprise.sh

@@ -15,6 +15,12 @@ set -o pipefail
 #   2. Postgres migration — add Postgres, migrate SQLite data via migrate-store.
 #   3. Traffic flow       — add NATS + flow-enricher + flow-receiver.
 #
+# Step 2 is skipped when the deployment already runs on Postgres
+# (server.store.engine: postgres in config.yaml). Nothing is provisioned or
+# migrated in that case and the store config is left exactly as the operator
+# wrote it — the enterprise image reads the same Postgres the community image
+# did. Such a deployment gets the image swap, and can still opt into step 3.
+#
 # If any step fails once the stack has been touched, the script rolls itself
 # back automatically: generated files are removed, the Postgres volume this run
 # created is dropped, and the original deployment is started again.
@@ -38,6 +44,18 @@ ENV_BACKUP=""
 PG_VOLUME_NAME=""
 BACKUP_DIR=""
 
+# Store state. STORE_ENGINE is what the deployment runs on today; when it is
+# already postgres, MIGRATE_POSTGRES stays "no" and nothing is provisioned.
+# POSTGRES_SERVICE is empty when Postgres lives outside this compose project.
+STORE_ENGINE=""
+EXISTING_POSTGRES="no"
+POSTGRES_DSN=""
+POSTGRES_SERVICE=""
+POSTGRES_DEPENDS_CONDITION="service_healthy"
+# Whether this run needs to generate config.yaml.enterprise at all. A pure
+# image swap does not.
+ENTERPRISE_CONFIG="no"
+
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
 check_docker_compose() {
@@ -192,6 +210,85 @@ detect_exposed_address() {
   yq eval '.server.exposedAddress // ""' "$CONFIG_YAML_HOST"
 }
 
+# The engine is a config.yaml-only setting — there is no env override for it
+# (combined/cmd/root.go reads it from YAML and derives the env vars), so
+# config.yaml is authoritative. Absent means the sqlite default.
+detect_store_engine() {
+  local engine
+  engine=$(yq eval '.server.store.engine // ""' "$CONFIG_YAML_HOST")
+  if [[ -z "$engine" ]] || [[ "$engine" == "null" ]]; then
+    engine="sqlite"
+  fi
+  echo "$engine" | tr '[:upper:]' '[:lower:]'
+}
+
+detect_store_dsn() {
+  yq eval '.server.store.dsn // ""' "$CONFIG_YAML_HOST"
+}
+
+# config.yaml is where a combined deployment carries its DSN; this only covers
+# hand-rolled installs that keep it in the environment instead.
+detect_store_dsn_from_compose() {
+  # `compose config` re-escapes a literal $ as $$ on the way out, so undo that
+  # to get the value the container actually receives.
+  $DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval "
+    .services[\"$COMBINED_SERVICE\"].environment.NB_STORE_ENGINE_POSTGRES_DSN //
+    .services[\"$COMBINED_SERVICE\"].environment.NETBIRD_STORE_ENGINE_POSTGRES_DSN // \"\"
+  " - 2>/dev/null | sed 's/\$\$/$/g'
+}
+
+# Reads either DSN form: "host=db ..." or "postgres://user:pass@db:5432/name".
+dsn_host() {
+  local dsn="$1"
+  case "$dsn" in
+    *://*) printf '%s' "$dsn" | sed -n 's,^[a-zA-Z+]*://\([^/?]*\).*,\1,p' | sed -e 's,.*@,,' -e 's,:.*,,' ;;
+    *) printf '%s' "$dsn" | sed -n 's/.*[[:space:]]*host=\([^[:space:]]*\).*/\1/p' ;;
+  esac
+}
+
+# flow-enricher is its own container, so a loopback host or a socket path would
+# reach the enricher rather than Postgres. Only flag hosts we can positively
+# identify — an unparseable DSN must not leave the operator with no way forward.
+dsn_host_reachable() {
+  local dsn="$1"
+  case "$(dsn_host "$dsn")" in
+    localhost | 127.* | ::1 | 0.0.0.0 | /*) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
+# Names the compose service running this deployment's Postgres, for depends_on.
+# Empty means external — the DSN host matched no service. A DSN with no readable
+# host falls back to matching on image.
+detect_postgres_service() {
+  local host
+  host=$(dsn_host "$POSTGRES_DSN")
+  if [[ -n "$host" ]]; then
+    if [[ "$(host="$host" yq eval '.services | has(env(host))' "$COMPOSE_FILE" 2>/dev/null)" == "true" ]]; then
+      echo "$host"
+    fi
+    return
+  fi
+  yq eval '.services | to_entries | map(select(.value.image // "" | test("(^|/)(postgres|postgis|pgvector|timescaledb)(:|@|$)"))) | .[0].key // ""' "$COMPOSE_FILE"
+}
+
+# depends_on: service_healthy is only legal if the service defines a healthcheck.
+detect_postgres_depends_condition() {
+  local tag
+  tag=$(yq eval ".services[\"$POSTGRES_SERVICE\"].healthcheck | tag" "$COMPOSE_FILE" 2>/dev/null)
+  if [[ "$tag" == "!!map" ]]; then
+    echo "service_healthy"
+  else
+    echo "service_started"
+  fi
+}
+
+env_value() {
+  local value="$1"
+  value=$(printf '%s' "$value" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' -e 's/\$/$$/g')
+  printf '"%s"' "$value"
+}
+
 detect_compose_network() {
   local tag
   tag=$(yq eval ".services[\"$COMBINED_SERVICE\"].networks | tag" "$COMPOSE_FILE" 2>/dev/null)
@@ -228,16 +325,30 @@ services:
       NETBIRD_LICENSE_SERVER_BASE_URL: \${NETBIRD_LICENSE_SERVER_BASE_URL}
 EOF
 
+  # An existing Postgres is already wired up by the operator's own compose file,
+  # so only a Postgres this run creates needs a depends_on.
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     cat <<EOF
     depends_on:
-      postgres:
-        condition: service_healthy
+      ${POSTGRES_SERVICE}:
+        condition: ${POSTGRES_DEPENDS_CONDITION}
+EOF
+  fi
+
+  # The server is only pointed at a different config file when this run
+  # generates one. A pure image swap leaves it on its original config.yaml.
+  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
+    cat <<EOF
     volumes:
       - ./${ENTERPRISE_CONFIG_FILE}:/etc/netbird/config.yaml.enterprise:ro
     command: ["--config", "/etc/netbird/config.yaml.enterprise"]
+EOF
+  fi
 
-  postgres:
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    cat <<EOF
+
+  ${POSTGRES_SERVICE}:
     image: postgres:17
     container_name: netbird-postgres
     restart: unless-stopped
@@ -257,6 +368,14 @@ EOF
   fi
 
   if [[ "$ENABLE_FLOW" == "yes" ]]; then
+    # Nothing to wait on when Postgres is managed outside this compose project.
+    local enricher_depends=""
+    if [[ -n "$POSTGRES_SERVICE" ]]; then
+      enricher_depends="
+      ${POSTGRES_SERVICE}:
+        condition: ${POSTGRES_DEPENDS_CONDITION}"
+    fi
+
     cat <<EOF
 
   nats:
@@ -273,9 +392,7 @@ EOF
     container_name: netbird-flow-enricher
     restart: unless-stopped
     networks: [${COMPOSE_NETWORK}]
-    depends_on:
-      postgres:
-        condition: service_healthy
+    depends_on:${enricher_depends}
       nats:
         condition: service_started
     environment:
@@ -283,10 +400,10 @@ EOF
       NETBIRD_LICENSE_SERVER_BASE_URL: \${NETBIRD_LICENSE_SERVER_BASE_URL}
       NB_DATADIR: /var/lib/netbird
       NB_MANAGEMENT_STORE_ENGINE: postgres
-      NB_MANAGEMENT_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
-      NB_STORE_ENGINE_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+      NB_MANAGEMENT_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
+      NB_STORE_ENGINE_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
       NB_TRAFFIC_EVENT_STORE_ENGINE: postgres
-      NB_TRAFFIC_EVENT_POSTGRES_DSN: "host=postgres user=netbird password=\${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+      NB_TRAFFIC_EVENT_POSTGRES_DSN: \${NB_ENTERPRISE_POSTGRES_DSN}
       NB_MANAGEMENT_STORE_KEY: \${NETBIRD_ENCRYPTION_KEY}
       NB_FLOW_ADAPTER_TYPE: nats
       NB_FLOW_NATS_ENDPOINTS: nats://nats:4222
@@ -343,27 +460,41 @@ EOF
   fi
 }
 
-# Build config.yaml.enterprise by yq-editing the operator's existing
-# config.yaml. We don't touch the original file.
+# Build config.yaml.enterprise from the operator's existing config.yaml. We
+# don't touch the original file. Values go through strenv() so a DSN carrying
+# quotes, backslashes or $ cannot break out of the expression.
 render_enterprise_config() {
-  local pg_dsn="host=postgres user=netbird password=${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+  {
+    echo "# Generated by migrate-to-enterprise.sh from ${CONFIG_YAML_HOST}."
+    echo "# The enterprise server is started with --config pointing at this file,"
+    echo "# so later edits to ${CONFIG_YAML_HOST} have no effect until copied here."
+    cat "$CONFIG_YAML_HOST"
+  } > "$ENTERPRISE_CONFIG_FILE"
 
-  yq eval "
-    .server.store.engine = \"postgres\" |
-    .server.store.dsn = \"$pg_dsn\" |
-    .server.activityStore.engine = \"postgres\" |
-    .server.activityStore.dsn = \"$pg_dsn\" |
-    .server.authStore.engine = \"postgres\" |
-    .server.authStore.dsn = \"$pg_dsn\"
-  " "$CONFIG_YAML_HOST" > "$ENTERPRISE_CONFIG_FILE"
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    # Fresh Postgres: point every store section at it. migrate-store carries the
+    # SQLite contents across.
+    POSTGRES_DSN="$POSTGRES_DSN" yq eval -i '
+      .server.store.engine = "postgres" |
+      .server.store.dsn = strenv(POSTGRES_DSN) |
+      .server.activityStore.engine = "postgres" |
+      .server.activityStore.dsn = strenv(POSTGRES_DSN) |
+      .server.authStore.engine = "postgres" |
+      .server.authStore.dsn = strenv(POSTGRES_DSN)
+    ' "$ENTERPRISE_CONFIG_FILE"
+  fi
+  # Otherwise the store config is the operator's and stays untouched.
+  # activityStore and authStore do not inherit from server.store — each falls
+  # back to its own SQLite file under dataDir — so repointing them at Postgres
+  # here would silently strand the existing audit log and the embedded IdP's
+  # users, with no migrate-store run to carry them over.
 
   if [[ "$ENABLE_FLOW" == "yes" ]]; then
-    local flow_addr="${NETBIRD_DOMAIN}"
-    yq eval -i "
+    NETBIRD_DOMAIN="$NETBIRD_DOMAIN" yq eval -i '
       .server.trafficFlow.enabled = true |
-      .server.trafficFlow.address = \"$flow_addr\" |
-      .server.trafficFlow.interval = \"60s\"
-    " "$ENTERPRISE_CONFIG_FILE"
+      .server.trafficFlow.address = strenv(NETBIRD_DOMAIN) |
+      .server.trafficFlow.interval = "60s"
+    ' "$ENTERPRISE_CONFIG_FILE"
   fi
 }
 
@@ -630,6 +761,91 @@ on_exit() {
 # Main
 # ---------------------------------------------------------------------------
 
+# Already on Postgres: there is nothing to provision and nothing to migrate.
+# The enterprise image reads the very same store config the community image
+# did, so step 2 collapses to a no-op and the run is a plain image swap.
+configure_existing_postgres() {
+  EXISTING_POSTGRES="yes"
+  MIGRATE_POSTGRES="no"
+
+  # DSN first — detect_postgres_service prefers the host it names.
+  POSTGRES_DSN=$(detect_store_dsn)
+  if [[ -z "$POSTGRES_DSN" ]] || [[ "$POSTGRES_DSN" == "null" ]]; then
+    POSTGRES_DSN=$(detect_store_dsn_from_compose)
+  fi
+  if [[ "$POSTGRES_DSN" == "null" ]]; then
+    POSTGRES_DSN=""
+  fi
+
+  POSTGRES_SERVICE=$(detect_postgres_service)
+  if [[ -n "$POSTGRES_SERVICE" ]]; then
+    POSTGRES_DEPENDS_CONDITION=$(detect_postgres_depends_condition)
+  fi
+
+  echo "Step 2: Postgres migration not needed — this deployment already runs on"
+  echo "        Postgres. Its store configuration is reused as-is and left"
+  echo "        untouched; no database is created and no data is moved."
+  if [[ -n "$POSTGRES_SERVICE" ]]; then
+    echo "        Postgres service: $POSTGRES_SERVICE (in $COMPOSE_FILE)"
+  else
+    echo "        Postgres service: managed outside $COMPOSE_FILE"
+  fi
+}
+
+configure_sqlite_store() {
+  MIGRATE_POSTGRES=$(read_yes_no "Step 2: Migrate storage from SQLite to Postgres? (recommended)" "n")
+  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
+
+  # The override would otherwise merge into a service of the same name and
+  # quietly rewrite its image and credentials.
+  local existing
+  existing=$(yq eval '.services | has("postgres")' "$COMPOSE_FILE")
+  if [[ "$existing" == "true" ]]; then
+    echo "" > /dev/stderr
+    echo "$COMPOSE_FILE already defines a service named 'postgres', but config.yaml" > /dev/stderr
+    echo "still has server.store.engine: sqlite. This script would add its own" > /dev/stderr
+    echo "'postgres' service and Compose would merge the two." > /dev/stderr
+    echo "" > /dev/stderr
+    echo "Point server.store.engine at that Postgres yourself, or rename the service," > /dev/stderr
+    echo "then re-run." > /dev/stderr
+    exit 1
+  fi
+
+  echo ""
+  echo "  ⚠  Data will be migrated from SQLite to Postgres. The SQLite store"
+  echo "     will be backed up automatically. To fully revert later, restore"
+  echo "     that backup and delete docker-compose.override.yml +"
+  echo "     config.yaml.enterprise."
+  local confirm
+  confirm=$(read_yes_no "  Continue?" "y")
+  if [[ "$confirm" != "yes" ]]; then
+    MIGRATE_POSTGRES="no"
+    echo "  Skipping Postgres migration."
+    return 0
+  fi
+
+  POSTGRES_PASSWORD=$(rand_password)
+  POSTGRES_SERVICE="postgres"
+  POSTGRES_DEPENDS_CONDITION="service_healthy"
+  POSTGRES_DSN="host=postgres user=netbird password=${POSTGRES_PASSWORD} dbname=netbird port=5432 sslmode=disable"
+}
+
+# mysql, or something this script has never seen. Swapping the images is still
+# valid; touching the store is not.
+configure_unsupported_store() {
+  MIGRATE_POSTGRES="no"
+  echo "  ⚠  server.store.engine is '$STORE_ENGINE'. This script only migrates"
+  echo "     SQLite to Postgres, and traffic flow requires Postgres, so both are"
+  echo "     unavailable here. The store configuration will be left untouched."
+  echo ""
+  local proceed
+  proceed=$(read_yes_no "Step 2 skipped. Continue with the image swap only?" "n")
+  if [[ "$proceed" != "yes" ]]; then
+    echo "Aborted."
+    exit 0
+  fi
+}
+
 init_migration() {
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
   check_yq
@@ -679,12 +895,15 @@ init_migration() {
     exit 1
   fi
 
+  STORE_ENGINE=$(detect_store_engine)
+
   echo "Detected existing deployment:"
   echo "  Combined service: $COMBINED_SERVICE"
   echo "  Dashboard:        $DASHBOARD_SERVICE"
   echo "  config.yaml:      $CONFIG_YAML_HOST"
   echo "  Data volume:      $DATA_VOLUME"
   echo "  Network:          $COMPOSE_NETWORK"
+  echo "  Store engine:     $STORE_ENGINE"
   echo ""
 
   require_eula_acceptance
@@ -703,28 +922,17 @@ init_migration() {
   echo "Step 1: Image swap (community → Enterprise). License key required."
   NB_LICENSE_KEY=$(read_secret "  License key")
 
-  # Step 2 — optional
+  # Step 2 — what this does depends on what the deployment already stores in.
   echo ""
-  MIGRATE_POSTGRES=$(read_yes_no "Step 2: Migrate storage from SQLite to Postgres? (recommended)" "n")
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    echo ""
-    echo "  ⚠  Data will be migrated from SQLite to Postgres. The SQLite store"
-    echo "     will be backed up automatically. To fully revert later, restore"
-    echo "     that backup and delete docker-compose.override.yml +"
-    echo "     config.yaml.enterprise."
-    local confirm
-    confirm=$(read_yes_no "  Continue?" "y")
-    if [[ "$confirm" != "yes" ]]; then
-      MIGRATE_POSTGRES="no"
-      echo "  Skipping Postgres migration."
-    else
-      POSTGRES_PASSWORD=$(rand_password)
-    fi
-  fi
+  case "$STORE_ENGINE" in
+    postgres) configure_existing_postgres ;;
+    sqlite) configure_sqlite_store ;;
+    *) configure_unsupported_store ;;
+  esac
 
   # Step 3 — optional, only if Postgres is on (flow requires Postgres)
   echo ""
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]] || [[ "$EXISTING_POSTGRES" == "yes" ]]; then
     ENABLE_FLOW=$(read_yes_no "Step 3: Enable traffic flow? (requires Postgres)" "n")
     if [[ "$ENABLE_FLOW" == "yes" ]]; then
       # Auth secret MUST match server.authSecret from config.yaml
@@ -748,12 +956,43 @@ init_migration() {
         echo "Could not read server.store.encryptionKey from $CONFIG_YAML_HOST." > /dev/stderr
         exit 1
       fi
+
+      # flow-enricher talks to Postgres directly, so this is the one place an
+      # existing deployment's DSN is actually needed — and the one place a host
+      # that only works from inside the server container shows up.
+      while :; do
+        local dsn_problem=""
+        if [[ -z "$POSTGRES_DSN" ]]; then
+          dsn_problem="No DSN could be read from $CONFIG_YAML_HOST or from the $COMBINED_SERVICE environment."
+        elif ! dsn_host_reachable "$POSTGRES_DSN"; then
+          dsn_problem="Its host '$(dsn_host "$POSTGRES_DSN")' only resolves inside the server container."
+        fi
+        [[ -n "$dsn_problem" ]] || break
+
+        echo ""
+        echo "  The flow enricher reaches Postgres from a container of its own."
+        echo "  $dsn_problem"
+        echo "  Enter a DSN reachable from other containers, or press Ctrl-C to abort."
+        POSTGRES_DSN=$(read_required "  Postgres DSN (host=… user=… password=… dbname=… port=5432 sslmode=disable)")
+      done
+
+      # A DSN entered above names a different host, which decides what to wait on.
+      POSTGRES_SERVICE=$(detect_postgres_service)
+      if [[ -n "$POSTGRES_SERVICE" ]]; then
+        POSTGRES_DEPENDS_CONDITION=$(detect_postgres_depends_condition)
+      fi
     fi
   else
     ENABLE_FLOW="no"
     echo "Step 3 (traffic flow) skipped — requires Postgres."
   fi
 
+  # config.yaml.enterprise only exists to hold changes; without any there is
+  # nothing to generate and the server keeps running on its own config.yaml.
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]] || [[ "$ENABLE_FLOW" == "yes" ]]; then
+    ENTERPRISE_CONFIG="yes"
+  fi
+
   check_data_directory
   check_stale_postgres_volume
 }
@@ -771,7 +1010,7 @@ apply_changes() {
     sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' "$OVERRIDE_FILE" && rm -f "$OVERRIDE_FILE.bak"
   fi
 
-  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
     echo "Writing $ENTERPRISE_CONFIG_FILE ..."
     install -m 600 /dev/null "$ENTERPRISE_CONFIG_FILE"
     render_enterprise_config
@@ -807,6 +1046,9 @@ apply_changes() {
       echo "POSTGRES_PASSWORD=${POSTGRES_PASSWORD}"
     fi
     if [[ "$ENABLE_FLOW" == "yes" ]]; then
+      # Own variable name rather than NB_STORE_ENGINE_POSTGRES_DSN so that a
+      # deployment already setting that one keeps its own value.
+      echo "NB_ENTERPRISE_POSTGRES_DSN=$(env_value "$POSTGRES_DSN")"
       echo "NB_FLOW_AUTH_SECRET=${NB_FLOW_AUTH_SECRET}"
       echo "NETBIRD_ENCRYPTION_KEY=${NETBIRD_ENCRYPTION_KEY}"
     fi
@@ -868,14 +1110,19 @@ print_summary() {
   echo " Summary"
   echo "──────────────────────────────────────────────────────────────────────"
   echo "  Images:           swapped to enterprise"
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "  Storage:          Postgres (data migrated from SQLite)"
-  [[ "$MIGRATE_POSTGRES" != "yes" ]] && echo "  Storage:          SQLite (unchanged)"
+  if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    echo "  Storage:          Postgres (data migrated from SQLite)"
+  elif [[ "$EXISTING_POSTGRES" == "yes" ]]; then
+    echo "  Storage:          Postgres (pre-existing, configuration unchanged)"
+  else
+    echo "  Storage:          $STORE_ENGINE (unchanged)"
+  fi
   [[ "$ENABLE_FLOW" == "yes" ]] && echo "  Traffic flow:     enabled"
   [[ "$ENABLE_FLOW" != "yes" ]] && echo "  Traffic flow:     disabled"
   echo ""
   echo "  Generated files (next to your docker-compose.yml):"
   echo "    $OVERRIDE_FILE"
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
+  [[ "$ENTERPRISE_CONFIG" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
   echo "    .env  (license key + secrets, mode 600)"
   [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]] && echo "    $ENV_BACKUP  (.env as it was before this run)"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    backups/sqlite-pre-enterprise-*/  (SQLite backup)"
@@ -899,7 +1146,11 @@ print_summary() {
   else
     echo "  $DOCKER_COMPOSE_COMMAND down"
   fi
-  echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
+  if [[ "$ENTERPRISE_CONFIG" == "yes" ]]; then
+    echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
+  else
+    echo "  rm -f $OVERRIDE_FILE"
+  fi
   if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
     echo "  mv $ENV_BACKUP .env   # restores .env as it was before this run"
   elif [[ "$ENV_EXISTED" == "no" ]]; then