Check if login failed

client/android/profile_state_test.go

@@ -16,17 +16,17 @@ func TestProfileAccountPathFor(t *testing.T) {
 		{
 			name:       "default profile",
 			configPath: "/data/data/io.netbird.client/files/netbird.cfg",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/netbird.account.json"),
+			want:       "/data/data/io.netbird.client/files/netbird.account.json",
 		},
 		{
 			name:       "id profile",
 			configPath: "/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.json",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.account.json"),
+			want:       "/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.account.json",
 		},
 		{
 			name:       "legacy name-keyed profile is handled the same way",
 			configPath: "/data/data/io.netbird.client/files/profiles/work.json",
-			want:       filepath.FromSlash("/data/data/io.netbird.client/files/profiles/work.account.json"),
+			want:       "/data/data/io.netbird.client/files/profiles/work.account.json",
 		},
 		{
 			name:       "empty path is rejected",

client/server/login_outcome_test.go

@@ -8,6 +8,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"google.golang.org/grpc/codes"
+	gstatus "google.golang.org/grpc/status"
 
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/proto"
@@ -25,9 +27,9 @@ func TestLogin_ManagementUnreachableIsReturnedInsteadOfDemandingSSO(t *testing.T
 
 	unreachable := errors.New("create connection: dial context: context deadline exceeded")
 	attempts := 0
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
 		attempts++
-		return false, unreachable
+		return internal.StatusLoginFailed, unreachable
 	}
 
 	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
@@ -53,12 +55,15 @@ func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
 	s.rootCtx = internal.CtxInitState(context.Background())
 	breakProfilePrivateKey(t, cfgPath)
 
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
-		return true, nil
+	refused := gstatus.Error(codes.PermissionDenied, "peer is not registered")
+	s.loginAttemptFn = func(context.Context, string, string) (internal.StatusType, error) {
+		return internal.StatusNeedsLogin, refused
 	}
 
 	_, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
 	require.Error(t, err)
+	require.NotErrorIs(t, err, refused,
+		"the refusal was handed back to the caller instead of starting the SSO flow")
 
 	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
 	require.NoError(t, stateErr)
@@ -66,32 +71,6 @@ func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
 		"the SSO flow setup was never reached with the broken key")
 }
 
-func TestLogin_SetupKeyStillRunsWhenPeerNeedsLogin(t *testing.T) {
-	s, _, _, username, _ := setupServerWithProfile(t)
-	s.rootCtx = internal.CtxInitState(context.Background())
-
-	s.isLoginRequiredFn = func(context.Context) (bool, error) {
-		return true, nil
-	}
-
-	var keysTried []string
-	s.loginAttemptFn = func(_ context.Context, setupKey, _ string) (internal.StatusType, error) {
-		keysTried = append(keysTried, setupKey)
-		return "", nil
-	}
-
-	setupKey := "A2C8E32F-AEB2-4B45-8FD3-8A0C1B2D3E4F"
-	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username, SetupKey: setupKey})
-	require.NoError(t, err, "the probe's outcome leaked out as the login result")
-	require.NotNil(t, resp)
-	require.Equal(t, []string{setupKey}, keysTried, "the setup key never reached the login attempt")
-	require.Nil(t, s.oauthAuthFlow.flow, "a setup-key login started an SSO flow")
-
-	status, err := internal.CtxGetState(s.rootCtx).Status()
-	require.NoError(t, err)
-	require.Equal(t, internal.StatusIdle, status)
-}
-
 // breakProfilePrivateKey replaces the profile's private key with an unparseable
 // one, which makes any attempt to build a Management client fail on the spot.
 func breakProfilePrivateKey(t *testing.T, cfgPath string) {

client/server/server.go

@@ -140,8 +140,6 @@ type Server struct {
 	// it to drive the login outcomes that need a server on the other end;
 	// production leaves it nil, and every login goes through loginAttempt.
 	loginAttemptFn func(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error)
-
-	isLoginRequiredFn func(ctx context.Context) (bool, error)
 }
 
 type oauthAuthFlow struct {
@@ -386,21 +384,6 @@ func (s *Server) attemptLogin(ctx context.Context, setupKey, jwtToken string) (i
 	return s.loginAttempt(ctx, setupKey, jwtToken)
 }
 
-func (s *Server) isLoginRequired(ctx context.Context) (bool, error) {
-	if s.isLoginRequiredFn != nil {
-		return s.isLoginRequiredFn(ctx)
-	}
-
-	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
-	if err != nil {
-		log.Errorf("failed to create auth client: %v", err)
-		return false, err
-	}
-	defer authClient.Close()
-
-	return authClient.IsLoginRequired(ctx)
-}
-
 // loginAttempt attempts to login using the provided information. It returns
 // StatusNeedsLogin when Management refused the peer's credentials and
 // StatusLoginFailed for every other failure, so callers can tell an
@@ -657,22 +640,22 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.config = config
 	s.mutex.Unlock()
 
-	// A probe that errors leaves the login undecided: Management unreachable, a
+	loginStatus, err := s.attemptLogin(ctx, "", "")
+	if err == nil {
+		state.Set(internal.StatusIdle)
+		return &proto.LoginResponse{}, nil
+	}
+
+	// Only an authentication refusal means the peer has to (re-)authenticate.
+	// Any other failure leaves the login undecided: Management unreachable, a
 	// restart mid-request, an internal error. Those are returned for the caller
 	// to retry, because turning them into an SSO prompt asks the user to solve
 	// something that is not theirs to solve, and a browser login cannot succeed
-	// while Management is unreachable anyway. Only Management refusing the
-	// peer's key is a decision, and IsLoginRequired reports that as
-	// needsLogin=true rather than an error.
-	needsLogin, err := s.isLoginRequired(ctx)
-	if err != nil {
-		state.Set(internal.StatusLoginFailed)
+	// while Management is unreachable anyway.
+	if loginStatus != internal.StatusNeedsLogin && loginStatus != internal.StatusLoginFailed {
+		state.Set(loginStatus)
 		return nil, err
 	}
-	if !needsLogin {
-		state.Set(internal.StatusIdle)
-		return &proto.LoginResponse{}, nil
-	}
 
 	if msg.SetupKey == "" {
 		hint := ""
@@ -1815,9 +1798,6 @@ func (s *Server) RequestExtendAuthSession(
 	if connectClient == nil {
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running")
 	}
-	if connectClient.Engine() == nil {
-		return nil, gstatus.Errorf(codes.FailedPrecondition, "session can no longer be extended, log in again to reconnect")
-	}
 
 	hint := ""
 	if msg.Hint != nil {

client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx

@@ -11,7 +11,7 @@ import { DialogHeading } from "@/components/dialog/DialogHeading";
 import { SquareIcon } from "@/components/SquareIcon";
 import { Connection, Profiles as ProfilesSvc, Session, WindowManager } from "@bindings/services";
 import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
-import { EVENT_BROWSER_LOGIN_CANCEL, EVENT_TRIGGER_LOGIN } from "@/lib/connection";
+import { EVENT_BROWSER_LOGIN_CANCEL } from "@/lib/connection";
 import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
 import { formatRemaining } from "@/lib/formatters";
 
@@ -131,21 +131,6 @@ export default function SessionExpirationDialog() {
         }
     }, [busy, t]);
 
-    const authenticate = useCallback(async () => {
-        if (busy) return;
-        setBusy(true);
-        try {
-            await Events.Emit(EVENT_TRIGGER_LOGIN);
-            await WindowManager.CloseSessionExpiration();
-        } catch (e) {
-            setBusy(false);
-            await errorDialog({
-                Title: t("connect.error.loginTitle"),
-                Message: formatErrorMessage(e),
-            });
-        }
-    }, [busy, t]);
-
     const logout = useCallback(async () => {
         if (busy) return;
         setBusy(true);
@@ -200,7 +185,7 @@ export default function SessionExpirationDialog() {
                     variant={"primary"}
                     size={"md"}
                     className={"w-full"}
-                    onClick={expired ? authenticate : stay}
+                    onClick={stay}
                     disabled={busy}
                 >
                     {expired ? t("sessionExpiration.authenticate") : t("sessionExpiration.stay")}

client/ui/tray_click_linux.go

@@ -4,26 +4,17 @@ package main
 
 // bindTrayClick wires the tray icon's left-click handler on Linux.
 //
-// Expected behaviour per tray host:
-//
-//	Host                           Left click              Right click
-//	KDE Plasma, Waybar             main window (Activate)  menu (host-rendered)
-//	GNOME Shell + AppIndicator     menu only               menu only
-//	Minimal WMs via XEmbed host    main window (Activate)  XEmbed GTK popup
-//
-// OnClick fires only on org.kde.StatusNotifierItem.Activate — a real left
-// click. KDE/Waybar send it over D-Bus; the in-process XEmbed host
-// (xembed_host_linux.go) maps a Button1 press to the same Activate call.
-//
-// GNOME Shell + AppIndicator never sends Activate: it renders the dbusmenu
-// on ANY click and only reports the menu opening via dbusmenu
-// Event("opened"). Upstream Wails treated that event as a click, so on GNOME
-// both buttons raised the main window on top of the menu, and on KDE/Waybar
-// a right click raised it over the freshly opened menu. The netbirdio/wails
-// fork (go.mod replace) drops that heuristic: a menu open never fires
-// OnClick. On GNOME the main window is reached via the "Open NetBird" menu
-// entry; left-click-opens-window is not achievable there anyway, since the
-// host always opens the menu itself.
+// Both Linux click paths converge on Wails' linuxSystemTray.Activate, which
+// fires the registered clickHandler:
+//   - Real SNI hosts (KDE Plasma, Waybar, GNOME Shell + AppIndicator) invoke
+//     org.kde.StatusNotifierItem.Activate over D-Bus on left-click.
+//   - The in-process StatusNotifierWatcher + XEmbed host used on minimal WMs
+//     (Fluxbox, i3, dwm, OpenBox) maps a Button1 press to that same Activate
+//     call itself (xembed_host_linux.go), so it routes through the same hook.
+// Registering OnClick here therefore covers both paths with one handler — no
+// changes to the watcher or XEmbed C code are needed. Left-click now opens the
+// main window; right-click still opens the menu via Wails' default
+// SecondaryActivate→OpenMenu handler (and the XEmbed GTK popup on minimal WMs).
 //
 // We do NOT register OnDoubleClick: Wails' Linux SNI backend never fires it
 // (unlike Windows). And we deliberately skip AttachWindow — it plus Wails3's

client/ui/tray_session.go

@@ -27,10 +27,11 @@ const (
 	finalWarningCountdownSeconds = 120
 )
 
-// handleSessionExpired notifies and brings the window forward so the user can reconnect.
+// handleSessionExpired notifies and brings the window forward so the frontend's /login route drives renewal.
 func (t *Tray) handleSessionExpired() {
 	t.notify(t.loc.T("notify.sessionExpired.title"), t.loc.T("notify.sessionExpired.body"), notifyIDSessionExpired)
 	if t.window != nil {
+		t.window.SetURL("/#/login")
 		t.window.Show()
 		t.window.Focus()
 	}
@@ -307,7 +308,11 @@ func (t *Tray) openSessionExtendFlow() {
 	}
 	seconds := int(time.Until(deadline).Seconds())
 	if seconds <= 0 {
-		t.app.Event.Emit(services.EventTriggerLogin)
+		if t.window != nil {
+			t.window.SetURL("/#/login")
+			t.window.Show()
+			t.window.Focus()
+		}
 		return
 	}
 	if t.svc.WindowManager == nil {

go.mod

@@ -339,5 +339,3 @@ replace github.com/dexidp/dex => github.com/netbirdio/dex v0.244.1-0.20260716205
 replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-20260512110716-8d70ad8647c1
 
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
-
-replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4

go.sum

@@ -490,8 +490,6 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4 h1:UKztc3QjWvzU5DZk+uYaOWN0x62NSe/pkxuPvzqZIy4=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
@@ -662,6 +660,8 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
+github.com/wailsapp/wails/v3 v3.0.0-beta.3 h1:BrcZunEBVucncRx+xgkk9TzlXU4qc0ygJuEhKAAGaeA=
+github.com/wailsapp/wails/v3 v3.0.0-beta.3/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=

infrastructure_files/getting-started-enterprise.sh

@@ -11,10 +11,6 @@ SED_STRIP_PADDING='s/=//g'
 
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
-# Static IP for Traefik inside the compose bridge network. The management
-# server trusts X-Forwarded-* headers from this address only.
-TRAEFIK_IP="172.30.0.10"
-
 check_docker_compose() {
   if command -v docker-compose &> /dev/null; then
     echo "docker-compose"
@@ -84,7 +80,7 @@ read_nb_domain() {
   if ! check_domain_resolves "$value"; then
     echo "" > /dev/stderr
     echo "Warning: '$value' does not resolve via DNS from this host." > /dev/stderr
-    echo "Traefik will not be able to issue TLS certificates until it does." > /dev/stderr
+    echo "Caddy will not be able to issue TLS certificates until it does." > /dev/stderr
     local confirm=""
     echo -n "Continue anyway? [y/N]: " > /dev/stderr
     read -r confirm < /dev/tty
@@ -96,23 +92,6 @@ read_nb_domain() {
   echo "$value"
 }
 
-read_letsencrypt_email() {
-  if [[ -n "${NETBIRD_LETSENCRYPT_EMAIL:-}" ]]; then
-    echo "$NETBIRD_LETSENCRYPT_EMAIL"
-    return
-  fi
-  local value=""
-  echo "Enter your email for Let's Encrypt certificate notifications." > /dev/stderr
-  echo -n "Email address: " > /dev/stderr
-  read -r value < /dev/tty
-  if [[ -z "$value" ]]; then
-    echo "Email is required for Let's Encrypt." > /dev/stderr
-    read_letsencrypt_email
-    return
-  fi
-  echo "$value"
-}
-
 read_required() {
   local prompt="$1"
   local value=""
@@ -225,11 +204,11 @@ init_environment() {
   check_openssl
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
 
-  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]]; then
+  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]] || [[ -f Caddyfile ]]; then
     echo "Generated files already exist in $(pwd)."
     echo "If you want to reinitialize the environment, please remove them first:"
     echo "  $DOCKER_COMPOSE_COMMAND down --volumes # removes all containers and volumes"
-    echo "  rm -f .env docker-compose.yml config.yaml"
+    echo "  rm -f .env docker-compose.yml Caddyfile config.yaml"
     echo "Be aware this will remove all data from the database."
     exit 1
   fi
@@ -251,9 +230,6 @@ init_environment() {
   echo ""
   NETBIRD_DOMAIN=$(read_nb_domain)
 
-  echo ""
-  NETBIRD_LETSENCRYPT_EMAIL=$(read_letsencrypt_email)
-
   echo ""
 
   NETBIRD_LICENSE_KEY=$(read_secret "Enter license key (input hidden)")
@@ -271,7 +247,6 @@ init_environment() {
   echo "Selected:"
   echo "  Traffic flow: ${NETBIRD_TRAFFIC_FLOW}"
   echo "  Domain:       ${NETBIRD_DOMAIN}"
-  echo "  ACME email:   ${NETBIRD_LETSENCRYPT_EMAIL}"
   echo ""
   echo "Rendering files into $(pwd) ..."
   install -m 600 /dev/null .env
@@ -281,6 +256,7 @@ init_environment() {
   if [[ -z "${NETBIRD_LICENSE_SERVER_BASE_URL:-}" ]]; then
     sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' docker-compose.yml && rm -f docker-compose.yml.bak
   fi
+  render_caddyfile > Caddyfile
   install -m 600 /dev/null config.yaml
   render_config_yaml >> config.yaml
 
@@ -307,7 +283,7 @@ init_environment() {
   echo "All configuration and secrets are stored (mode 600) in $(pwd)/.env"
   echo ""
   echo "Tail logs:"
-  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server traefik"
+  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server caddy"
 }
 
 # ------------------------------------------------------------------
@@ -330,11 +306,6 @@ NETBIRD_TRAFFIC_FLOW_ENABLED=${NETBIRD_TRAFFIC_FLOW}
 # Domain
 NETBIRD_DOMAIN=${NETBIRD_DOMAIN}
 
-# Reverse proxy (Traefik)
-NETBIRD_LETSENCRYPT_EMAIL=${NETBIRD_LETSENCRYPT_EMAIL}
-NETBIRD_TRAEFIK_TAG=${NETBIRD_TRAEFIK_TAG:-v3.6}
-NETBIRD_TRAEFIK_IP=${TRAEFIK_IP}
-
 # Image tags. Default to "latest"
 NETBIRD_DASHBOARD_TAG=${NETBIRD_DASHBOARD_TAG:-latest}
 NETBIRD_SERVER_TAG=${NETBIRD_SERVER_TAG:-latest}
@@ -407,78 +378,26 @@ EOF
 
 render_compose_common() {
   cat <<'EOF'
-  # Reverse proxy with automatic TLS via Let's Encrypt. Routes are declared as
-  # labels on the services below and picked up through the Docker provider.
-  traefik:
+  caddy:
     <<: *default
-    image: traefik:${NETBIRD_TRAEFIK_TAG}
-    container_name: netbird-traefik
-    networks:
-      netbird:
-        ipv4_address: ${NETBIRD_TRAEFIK_IP}
-    command:
-      # Logging
-      - "--log.level=INFO"
-      - "--accesslog=true"
-      # Docker provider
-      - "--providers.docker=true"
-      - "--providers.docker.exposedbydefault=false"
-      - "--providers.docker.network=netbird"
-      # Entrypoints
-      - "--entrypoints.web.address=:80"
-      - "--entrypoints.websecure.address=:443"
-      - "--entrypoints.websecure.allowACMEByPass=true"
-      # readTimeout bounds the whole request, and gRPC streams / relay WebSockets
-      # never end one; idleTimeout would close the keep-alive connection they
-      # are reused over. Entrypoint-wide is the only scope Traefik offers here.
-      # writeTimeout is left alone: it already defaults to 0.
-      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
-      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0"
-      # HTTP to HTTPS redirect
-      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
-      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
-      # Let's Encrypt ACME
-      - "--certificatesresolvers.letsencrypt.acme.email=${NETBIRD_LETSENCRYPT_EMAIL}"
-      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
-      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
+    image: caddy:2
+    container_name: netbird-caddy
+    networks: [netbird]
+    environment:
+      - CADDY_SECURE_DOMAIN=${NETBIRD_DOMAIN}
     ports:
       - '443:443'
+      - '443:443/udp'
       - '80:80'
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - netbird_traefik_letsencrypt:/letsencrypt
-    labels:
-      - traefik.enable=true
-      # Shared security headers, referenced by every NetBird router below. A
-      # label-declared middleware only exists while its container runs, so this
-      # lives on Traefik itself: declaring it on an app container would drop
-      # every router referencing it whenever that container restarts.
-      - traefik.http.middlewares.nb-security.headers.stsSeconds=3600
-      - traefik.http.middlewares.nb-security.headers.stsIncludeSubdomains=true
-      - traefik.http.middlewares.nb-security.headers.contentTypeNosniff=true
-      - traefik.http.middlewares.nb-security.headers.browserXssFilter=true
-      - traefik.http.middlewares.nb-security.headers.referrerPolicy=strict-origin-when-cross-origin
-      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN
-      # Empty value strips the header. Only the dashboard's nginx sets one; the
-      # server emits none. Do not quote it — "" would send a literal Server: "".
-      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.Server=
+      - netbird_caddy_data:/data
+      - ./Caddyfile:/etc/caddy/Caddyfile
 
   dashboard:
     <<: *default
     image: ghcr.io/netbirdio/dashboard-cloud:${NETBIRD_DASHBOARD_TAG}
     container_name: netbird-dashboard
     networks: [netbird]
-    labels:
-      - traefik.enable=true
-      # Dashboard catch-all: lowest priority so every route below wins
-      - traefik.http.routers.netbird-dashboard.rule=Host(`${NETBIRD_DOMAIN}`)
-      - traefik.http.routers.netbird-dashboard.entrypoints=websecure
-      - traefik.http.routers.netbird-dashboard.tls=true
-      - traefik.http.routers.netbird-dashboard.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-dashboard.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-dashboard.service=dashboard
-      - traefik.http.routers.netbird-dashboard.priority=1
-      - traefik.http.services.dashboard.loadbalancer.server.port=80
     environment:
       - NETBIRD_MGMT_API_ENDPOINT=https://${NETBIRD_DOMAIN}
       - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://${NETBIRD_DOMAIN}
@@ -516,28 +435,6 @@ render_compose_server() {
       - netbird_data:/var/lib/netbird
       - ./config.yaml:/etc/netbird/config.yaml
     command: ["--config", "/etc/netbird/config.yaml"]
-    labels:
-      - traefik.enable=true
-      # Signal + Management gRPC (needs an h2c backend for HTTP/2 cleartext)
-      - traefik.http.routers.netbird-grpc.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
-      - traefik.http.routers.netbird-grpc.entrypoints=websecure
-      - traefik.http.routers.netbird-grpc.tls=true
-      - traefik.http.routers.netbird-grpc.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-grpc.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-grpc.service=netbird-server-h2c
-      - traefik.http.routers.netbird-grpc.priority=100
-      # Relay WebSocket, management API, and the embedded IdP
-      - traefik.http.routers.netbird-backend.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
-      - traefik.http.routers.netbird-backend.entrypoints=websecure
-      - traefik.http.routers.netbird-backend.tls=true
-      - traefik.http.routers.netbird-backend.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-backend.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-backend.service=netbird-server
-      - traefik.http.routers.netbird-backend.priority=100
-      # Services
-      - traefik.http.services.netbird-server.loadbalancer.server.port=80
-      - traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80
-      - traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c
     environment:
       - NB_LICENSE_KEY=${NETBIRD_LICENSE_KEY}
       - NETBIRD_LICENSE_SERVER_BASE_URL=${NETBIRD_LICENSE_SERVER_BASE_URL}
@@ -600,18 +497,6 @@ render_compose_flow() {
       - NB_FLOW_NATS_ENDPOINTS=nats://nats:4222
       - NB_FLOW_NATS_STREAM=traffic-events
       - NB_FLOW_AUTH_SECRET=${NETBIRD_RELAY_AUTH_SECRET}
-    labels:
-      - traefik.enable=true
-      # Flow receiver gRPC (h2c backend)
-      - traefik.http.routers.netbird-flow.rule=Host(`${NETBIRD_DOMAIN}`) && PathPrefix(`/flow.FlowService/`)
-      - traefik.http.routers.netbird-flow.entrypoints=websecure
-      - traefik.http.routers.netbird-flow.tls=true
-      - traefik.http.routers.netbird-flow.tls.certresolver=letsencrypt
-      - traefik.http.routers.netbird-flow.middlewares=nb-security@docker
-      - traefik.http.routers.netbird-flow.service=netbird-flow-h2c
-      - traefik.http.routers.netbird-flow.priority=100
-      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.port=80
-      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.scheme=h2c
 
 EOF
 }
@@ -651,16 +536,61 @@ EOF
   fi
   cat <<'EOF'
   netbird_postgres:
-  netbird_traefik_letsencrypt:
+  netbird_caddy_data:
 
 networks:
   netbird:
-    name: netbird
-    driver: bridge
-    ipam:
-      config:
-        - subnet: 172.30.0.0/24
-          gateway: 172.30.0.1
+EOF
+}
+
+render_caddyfile() {
+  cat <<'EOF'
+{
+  servers :80,:443 {
+    protocols h1 h2c h2 h3
+  }
+}
+
+(security_headers) {
+    header * {
+        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "SAMEORIGIN"
+        X-XSS-Protection "1; mode=block"
+        -Server
+        Referrer-Policy strict-origin-when-cross-origin
+    }
+}
+
+:80 {
+    redir https://{$CADDY_SECURE_DOMAIN}{uri} permanent
+}
+
+{$CADDY_SECURE_DOMAIN}:443 {
+    import security_headers
+    # Signal (gRPC over h2c)
+    reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-server:80
+    # Management (gRPC over h2c + HTTP)
+    reverse_proxy /management.ManagementService/* h2c://netbird-server:80
+    reverse_proxy /api/* netbird-server:80
+    reverse_proxy /ws-proxy/* netbird-server:80
+    # Embedded IdP (OAuth2 endpoints served by netbird server)
+    reverse_proxy /oauth2/* netbird-server:80
+    # Relay (WebSocket multiplexed on the same port)
+    reverse_proxy /relay* netbird-server:80
+EOF
+
+  if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
+    cat <<'EOF'
+    # Flow receiver (gRPC over h2c)
+    reverse_proxy /flow.FlowService/* h2c://receiver:80
+EOF
+  fi
+
+  cat <<'EOF'
+    # Dashboard
+    reverse_proxy /* dashboard:80
+}
 EOF
 }
 
@@ -679,7 +609,7 @@ server:
   logLevel: "info"
   logFile: "console"
 
-  # TLS is terminated by Traefik in front; leave this block empty.
+  # TLS is terminated by Caddy in front; leave this block empty.
   tls:
     certFile: ""
     keyFile: ""
@@ -702,16 +632,6 @@ server:
     cliRedirectURIs:
       - "http://localhost:53000/"
 
-  # Trust X-Forwarded-* only from the Traefik container's static address. Both
-  # keys must stay in step with the ipv4_address pinned in docker-compose.yml:
-  # trustedPeers decides whether forwarded headers are read at all, and leaving
-  # it unset falls back to 0.0.0.0/0.
-  reverseProxy:
-    trustedPeers:
-      - "${TRAEFIK_IP}/32"
-    trustedHTTPProxies:
-      - "${TRAEFIK_IP}/32"
-
   store:
     engine: "postgres"
     dsn: "${POSTGRES_DSN}"

infrastructure_files/migrate-to-enterprise.sh

@@ -15,11 +15,7 @@ set -o pipefail
 #   2. Postgres migration — add Postgres, migrate SQLite data via migrate-store.
 #   3. Traffic flow       — add NATS + flow-enricher + flow-receiver.
 #
-# If any step fails once the stack has been touched, the script rolls itself
-# back automatically: generated files are removed, the Postgres volume this run
-# created is dropped, and the original deployment is started again.
-#
-# To revert a successful migration:
+# To revert:
 #   docker compose down
 #   rm -f docker-compose.override.yml config.yaml.enterprise
 #   # If Postgres migration was done, also restore the SQLite backup printed
@@ -29,15 +25,6 @@ set -o pipefail
 OVERRIDE_FILE="docker-compose.override.yml"
 ENTERPRISE_CONFIG_FILE="config.yaml.enterprise"
 
-# Rollback bookkeeping. ROLLBACK_STATE flips to "armed" the moment the script
-# starts mutating the deployment, and back to "disarmed" once the migration has
-# completed successfully.
-ROLLBACK_STATE="disarmed"
-ENV_EXISTED="unknown"
-ENV_BACKUP=""
-PG_VOLUME_NAME=""
-BACKUP_DIR=""
-
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
 check_docker_compose() {
@@ -374,77 +361,7 @@ render_enterprise_config() {
 # Execution steps
 # ---------------------------------------------------------------------------
 
-combined_container_id() {
-  $DOCKER_COMPOSE_COMMAND ps -aq "$COMBINED_SERVICE" 2>/dev/null | head -1
-}
-
-container_data_mount() {
-  local container="$1"
-  [[ -n "$container" ]] || return 0
-  docker inspect "$container" --format \
-    '{{range .Mounts}}{{if eq .Destination "/var/lib/netbird"}}{{if .Name}}{{.Name}}{{else}}{{.Source}}{{end}}{{end}}{{end}}' 2>/dev/null
-}
-
-# The name comes from the container, so `-v` cannot invent an empty volume here.
-# 0 = empty, 1 = holds data, 2 = could not determine. A failed listing must not
-# be reported as empty: that would abort a healthy migration over a pull error
-# or an unreadable bind mount.
-data_dir_state() {
-  local src="$1" out
-  if [[ "$src" == /* ]]; then
-    [[ -d "$src" ]] || return 2
-    out=$(ls -A "$src" 2>/dev/null) || return 2
-  else
-    docker volume inspect "$src" &> /dev/null || return 0
-    out=$(docker run --rm -v "${src}:/d:ro" busybox sh -c 'ls -A /d' 2>/dev/null) || return 2
-  fi
-  [[ -z "$out" ]] && return 0
-  return 1
-}
-
-check_data_directory() {
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
-
-  local container
-  container=$(combined_container_id)
-  if [[ -z "$container" ]]; then
-    echo "" > /dev/stderr
-    echo "No container found for service '$COMBINED_SERVICE'." > /dev/stderr
-    echo "The migration backs up the store by copying it out of that container," > /dev/stderr
-    echo "so it has to exist. Start the deployment and re-run:" > /dev/stderr
-    echo "  $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
-    exit 1
-  fi
-
-  local src
-  src=$(container_data_mount "$container")
-  if [[ -z "$src" ]]; then
-    echo "" > /dev/stderr
-    echo "The '$COMBINED_SERVICE' container has nothing mounted at /var/lib/netbird." > /dev/stderr
-    echo "Cannot locate the NetBird store to back it up." > /dev/stderr
-    exit 1
-  fi
-
-  local state=0
-  data_dir_state "$src" || state=$?
-  if [[ $state -eq 0 ]]; then
-    echo "" > /dev/stderr
-    echo "The NetBird data directory is empty:" > /dev/stderr
-    echo "  $src" > /dev/stderr
-    echo "There is nothing to migrate. Check that you are running this from the" > /dev/stderr
-    echo "deployment directory of the NetBird install you mean to migrate." > /dev/stderr
-    exit 1
-  fi
-  if [[ $state -eq 2 ]]; then
-    echo "  ⚠ Could not read $src to confirm it holds data — continuing." > /dev/stderr
-    echo "    The backup step still fails loudly if it turns out to be empty." > /dev/stderr
-  fi
-
-  echo "  Data directory:   $src"
-}
-
-# Only for the Postgres volume, which has no container to read it off yet.
-resolve_compose_volume() {
+resolve_data_volume() {
   local short="$1"
   local actual
   # Resolve project-prefixed volume name from Docker Compose config first.
@@ -474,21 +391,18 @@ resolve_compose_volume() {
 backup_sqlite() {
   BACKUP_DIR="$(pwd)/backups/sqlite-pre-enterprise-$(date +%Y%m%d-%H%M%S)"
   mkdir -p "$BACKUP_DIR"
-
-  local container
-  container=$(combined_container_id)
-  if [[ -z "$container" ]]; then
-    echo "  ⚠ No container found for '$COMBINED_SERVICE' — cannot back up the store." > /dev/stderr
-    exit 1
-  fi
-
-  echo "Backing up the NetBird store to $BACKUP_DIR ..."
-  docker cp "${container}:/var/lib/netbird/." "$BACKUP_DIR/"
-
+  local data_volume_actual
+  data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
+  echo "Backing up SQLite store from volume '$data_volume_actual' to $BACKUP_DIR ..."
+  docker run --rm \
+    -v "${data_volume_actual}:/var/lib/netbird:ro" \
+    -v "${BACKUP_DIR}:/backup" \
+    busybox \
+    sh -c 'cp -a /var/lib/netbird/. /backup/ 2>/dev/null || true'
   local copied
   copied=$(find "$BACKUP_DIR" -mindepth 1 | head -1)
   if [[ -z "$copied" ]]; then
-    echo "  ⚠ Backup directory is empty — /var/lib/netbird held no data. Aborting." > /dev/stderr
+    echo "  ⚠ Backup directory is empty — the volume '$data_volume_actual' didn't contain data. Aborting." > /dev/stderr
     exit 1
   fi
   echo "  done"
@@ -500,135 +414,6 @@ run_migrate_store() {
   echo "  done"
 }
 
-# ---------------------------------------------------------------------------
-# Rollback — a failed run must not leave the operator with a stopped stack and
-# half-written artifacts.
-# ---------------------------------------------------------------------------
-
-# Resolve the name Compose would give the Postgres volume before the override
-# exists, so a leftover volume can be spotted up front.
-compose_project_name() {
-  local container project
-  container=$($DOCKER_COMPOSE_COMMAND ps -aq 2>/dev/null | head -1)
-  if [[ -n "$container" ]]; then
-    project=$(docker inspect "$container" \
-      --format '{{index .Config.Labels "com.docker.compose.project"}}' 2>/dev/null)
-    if [[ -n "$project" ]]; then
-      echo "$project"
-      return 0
-    fi
-  fi
-  project=$($DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval '.name // ""' - 2>/dev/null)
-  if [[ -n "$project" ]] && [[ "$project" != "null" ]]; then
-    echo "$project"
-  fi
-  return 0
-}
-
-postgres_volume_name() {
-  local project
-  project=$(compose_project_name)
-  if [[ -n "$project" ]]; then
-    echo "${project}_netbird_postgres"
-  fi
-  return 0
-}
-
-# Postgres skips initdb when its data directory is non-empty, so a volume left
-# behind by an interrupted run would keep the old password and old contents,
-# and migrate-store would fail against it.
-check_stale_postgres_volume() {
-  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
-
-  PG_VOLUME_NAME=$(postgres_volume_name)
-  if [[ -z "$PG_VOLUME_NAME" ]]; then
-    echo ""
-    echo "  ⚠ Could not determine the Compose project name, so a Postgres volume"
-    echo "    left over from an earlier attempt cannot be checked for. If a"
-    echo "    previous run failed, remove it before continuing:"
-    echo "      docker volume ls | grep netbird_postgres"
-    return 0
-  fi
-  docker volume inspect "$PG_VOLUME_NAME" &> /dev/null || return 0
-
-  echo ""
-  echo "  ⚠  A Postgres volume from an earlier attempt already exists:"
-  echo "       $PG_VOLUME_NAME"
-  echo "     Postgres does not re-initialise a non-empty data directory, so the"
-  echo "     migration would run against stale credentials and stale data."
-  local remove
-  remove=$(read_yes_no "  Remove it and continue?" "y")
-  if [[ "$remove" != "yes" ]]; then
-    echo "" > /dev/stderr
-    echo "Aborted. Remove it manually with: docker volume rm $PG_VOLUME_NAME" > /dev/stderr
-    exit 1
-  fi
-  docker volume rm "$PG_VOLUME_NAME" > /dev/null
-  echo "  Removed."
-}
-
-# Undo whatever this run changed and start the previous deployment again.
-rollback() {
-  ROLLBACK_STATE="done"
-
-  echo ""
-  echo "──────────────────────────────────────────────────────────────────────"
-  echo " Migration failed — restoring the previous deployment"
-  echo "──────────────────────────────────────────────────────────────────────"
-
-  # Resolve while the override is still present; without it Compose no longer
-  # knows about the Postgres volume.
-  local pg_volume="$PG_VOLUME_NAME"
-  if [[ -z "$pg_volume" ]] && [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    pg_volume=$(postgres_volume_name)
-  fi
-
-  echo ""
-  echo "Stopping services ..."
-  $DOCKER_COMPOSE_COMMAND down || true
-
-  echo "Removing generated files ..."
-  rm -f "$OVERRIDE_FILE" "$ENTERPRISE_CONFIG_FILE"
-
-  # Restore .env to exactly what it was, or remove it if this run created it.
-  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
-    mv -f "$ENV_BACKUP" .env || echo "  ⚠ Could not restore .env from $ENV_BACKUP." > /dev/stderr
-  elif [[ "$ENV_EXISTED" == "no" ]]; then
-    rm -f .env || true
-  fi
-
-  # Only ever the volume this run created — never the NetBird data volume.
-  if [[ -n "$pg_volume" ]] && [[ "$pg_volume" != "null" ]]; then
-    echo "Removing Postgres volume $pg_volume ..."
-    docker volume rm "$pg_volume" &> /dev/null || true
-  fi
-
-  echo "Starting the previous deployment ..."
-  if ! $DOCKER_COMPOSE_COMMAND up -d; then
-    echo ""
-    echo "  ⚠ Could not start the previous deployment automatically." > /dev/stderr
-    echo "    Run: $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
-  fi
-
-  echo ""
-  echo "Rolled back. Your docker-compose.yml, config.yaml and the NetBird data"
-  echo "volume were never modified."
-  if [[ -n "$BACKUP_DIR" ]] && [[ -d "$BACKUP_DIR" ]]; then
-    echo "The SQLite backup taken during this run is kept at:"
-    echo "  $BACKUP_DIR"
-  fi
-  echo "──────────────────────────────────────────────────────────────────────"
-}
-
-on_exit() {
-  local code=$?
-  trap - EXIT
-  if [[ $code -ne 0 ]] && [[ "$ROLLBACK_STATE" == "armed" ]]; then
-    rollback
-  fi
-  exit $code
-}
-
 # ---------------------------------------------------------------------------
 # Main
 # ---------------------------------------------------------------------------
@@ -756,15 +541,9 @@ init_migration() {
     ENABLE_FLOW="no"
     echo "Step 3 (traffic flow) skipped — requires Postgres."
   fi
-
-  check_data_directory
-  check_stale_postgres_volume
 }
 
 apply_changes() {
-  # From here on a failure must roll the deployment back.
-  ROLLBACK_STATE="armed"
-
   echo ""
   echo "Writing $OVERRIDE_FILE ..."
   install -m 644 /dev/null "$OVERRIDE_FILE"
@@ -785,14 +564,6 @@ apply_changes() {
   # picks it up automatically.
   echo "Writing .env additions (mode 600) ..."
   local ENV_FILE=".env"
-  # Snapshot the operator's .env so a rollback can restore it byte for byte.
-  if [[ -f "$ENV_FILE" ]]; then
-    ENV_EXISTED="yes"
-    ENV_BACKUP="${ENV_FILE}.pre-enterprise-$(date +%Y%m%d-%H%M%S)"
-    cp -p "$ENV_FILE" "$ENV_BACKUP"
-  else
-    ENV_EXISTED="no"
-  fi
   touch "$ENV_FILE"
   chmod 600 "$ENV_FILE"
   {
@@ -821,16 +592,11 @@ apply_changes() {
 
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     echo ""
-    # Stop, but keep the containers: the backup reads the store out of one.
-    echo "Stopping services so the store is quiescent ..."
-    $DOCKER_COMPOSE_COMMAND stop
+    echo "Stopping existing services (volumes preserved) ..."
+    $DOCKER_COMPOSE_COMMAND down
 
     backup_sqlite
 
-    echo ""
-    echo "Removing stopped containers (volumes preserved) ..."
-    $DOCKER_COMPOSE_COMMAND down
-
     echo ""
     echo "Starting Postgres ..."
     $DOCKER_COMPOSE_COMMAND up -d postgres
@@ -860,9 +626,6 @@ apply_changes() {
 
   echo ""
   echo "Migration complete."
-
-  # Nothing left to undo.
-  ROLLBACK_STATE="disarmed"
 }
 
 print_summary() {
@@ -880,7 +643,6 @@ print_summary() {
   echo "    $OVERRIDE_FILE"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
   echo "    .env  (license key + secrets, mode 600)"
-  [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]] && echo "    $ENV_BACKUP  (.env as it was before this run)"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    backups/sqlite-pre-enterprise-*/  (SQLite backup)"
   echo ""
   echo " Tail logs:"
@@ -889,27 +651,19 @@ print_summary() {
   echo "──────────────────────────────────────────────────────────────────────"
   echo " To revert"
   echo "──────────────────────────────────────────────────────────────────────"
+  echo "  $DOCKER_COMPOSE_COMMAND down"
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    # Resolve the project-prefixed volume name now, before the override is gone.
-    local pg_volume
-    pg_volume=$(resolve_compose_volume "netbird_postgres")
-    echo "  # Stop, but keep the containers so the store can be copied back in:"
-    echo "  $DOCKER_COMPOSE_COMMAND stop"
-    echo "  # Restore SQLite from the backup created during this run:"
-    echo "  docker cp ${BACKUP_DIR}/. \$($DOCKER_COMPOSE_COMMAND ps -aq $COMBINED_SERVICE):/var/lib/netbird/"
-    echo "  $DOCKER_COMPOSE_COMMAND down"
+    # Resolve project-prefixed volume names now (before override is removed).
+    local pg_volume data_volume_actual
+    pg_volume=$(resolve_data_volume "netbird_postgres")
+    data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
+    echo "  # Remove the Postgres volume FIRST, before deleting the override file:"
     echo "  docker volume rm $pg_volume"
-  else
-    echo "  $DOCKER_COMPOSE_COMMAND down"
+    echo "  # Restore SQLite from the backup created during this run:"
+    echo "  docker run --rm -v ${data_volume_actual}:/var/lib/netbird -v ${BACKUP_DIR}:/backup busybox sh -c 'cp -a /backup/. /var/lib/netbird/'"
   fi
   echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
-  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
-    echo "  mv $ENV_BACKUP .env   # restores .env as it was before this run"
-  elif [[ "$ENV_EXISTED" == "no" ]]; then
-    echo "  rm -f .env   # created by this run"
-  else
-    echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
-  fi
+  echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
   echo "  $DOCKER_COMPOSE_COMMAND up -d"
   echo "──────────────────────────────────────────────────────────────────────"
 }
@@ -918,10 +672,6 @@ print_summary() {
 # Run
 # ---------------------------------------------------------------------------
 
-trap on_exit EXIT
-# Turn signals into a normal exit so the EXIT trap can roll back.
-trap 'exit 130' INT TERM
-
 init_migration
 apply_changes
 print_summary

management/server/group.go

@@ -6,8 +6,6 @@ import (
 	"fmt"
 	"slices"
 
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 
@@ -746,14 +744,6 @@ func validateDeleteGroup(ctx context.Context, transaction store.Store, group *ty
 		return &GroupLinkError{"network router", linkedRouter.ID}
 	}
 
-	if isLinked, linkedService := isGroupLinkedToReverseProxyService(ctx, transaction, group.AccountID, group.ID); isLinked {
-		return &GroupLinkError{"reverse proxy service", linkedService.Domain}
-	}
-
-	if isLinked, linkedPolicy := isGroupLinkedToAgentNetworkPolicy(ctx, transaction, group.AccountID, group.ID); isLinked {
-		return &GroupLinkError{"agent network policy", linkedPolicy.Name}
-	}
-
 	return checkGroupLinkedToSettings(ctx, transaction, group)
 }
 
@@ -885,46 +875,6 @@ func isGroupLinkedToNetworkRouter(ctx context.Context, transaction store.Store,
 	return false, nil
 }
 
-// isGroupLinkedToReverseProxyService checks if a group is used as an access group
-// of a private reverse proxy service or as a bearer-auth distribution group.
-func isGroupLinkedToReverseProxyService(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *service.Service) {
-	services, err := transaction.GetAccountServices(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		log.WithContext(ctx).Errorf("error retrieving reverse proxy services while checking group linkage: %v", err)
-		return false, nil
-	}
-
-	for _, svc := range services {
-		if svc.Private && slices.Contains(svc.AccessGroups, groupID) {
-			return true, svc
-		}
-		if svc.Auth.BearerAuth != nil && svc.Auth.BearerAuth.Enabled && slices.Contains(svc.Auth.BearerAuth.DistributionGroups, groupID) {
-			return true, svc
-		}
-	}
-	return false, nil
-}
-
-// isGroupLinkedToAgentNetworkPolicy checks if a group is used as a source group by any
-// agent network policy in the account.
-func isGroupLinkedToAgentNetworkPolicy(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *agentNetworkTypes.Policy) {
-	policies, err := transaction.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		log.WithContext(ctx).Errorf("error retrieving agent network policies while checking group linkage: %v", err)
-		return false, nil
-	}
-
-	for _, policy := range policies {
-		if policy == nil {
-			continue
-		}
-		if slices.Contains(policy.SourceGroups, groupID) {
-			return true, policy
-		}
-	}
-	return false, nil
-}
-
 // areGroupChangesAffectPeers checks if any changes to the specified groups will affect peers.
 // It fetches each collection once and checks all groupIDs against them in memory.
 func areGroupChangesAffectPeers(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) (bool, error) {

management/server/group_test.go

@@ -18,8 +18,6 @@ import (
 	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
@@ -127,21 +125,6 @@ func TestDefaultAccountManager_DeleteGroup(t *testing.T) {
 			"grp-for-integration",
 			"only service users with admin power can delete integration group",
 		},
-		{
-			"agent network policy",
-			"grp-for-agent-network-policy",
-			"agent network policy",
-		},
-		{
-			"reverse proxy private service access group",
-			"grp-for-rp-private",
-			"reverse proxy service",
-		},
-		{
-			"reverse proxy bearer distribution group",
-			"grp-for-rp-bearer",
-			"reverse proxy service",
-		},
 	}
 
 	for _, testCase := range testCases {
@@ -235,17 +218,6 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 			groupIDs:        []string{"grp-for-integration"},
 			expectedReasons: []string{"only service users with admin power can delete integration group"},
 		},
-		{
-			name:            "agent network policy",
-			groupIDs:        []string{"grp-for-agent-network-policy"},
-			expectedReasons: []string{"agent network policy"},
-		},
-		{
-			name:               "reverse proxy services",
-			groupIDs:           []string{"grp-for-rp-private", "grp-for-rp-bearer"},
-			expectedReasons:    []string{"reverse proxy service", "reverse proxy service"},
-			expectedNotDeleted: []string{"grp-for-rp-private", "grp-for-rp-bearer"},
-		},
 		{
 			name:            "successfully delete multiple groups",
 			groupIDs:        []string{"group-1", "group-2"},
@@ -313,65 +285,6 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 	}
 }
 
-func TestDefaultAccountManager_DeleteGroupUnlinkedFromReverseProxyService(t *testing.T) {
-	am, _, err := createManager(t)
-	require.NoError(t, err, "Failed to create account manager")
-
-	_, account, err := initTestGroupAccount(am)
-	require.NoError(t, err, "Failed to init testing account")
-
-	deletableGroups := []*types.Group{
-		{
-			ID:        "grp-rp-bearer-disabled",
-			AccountID: account.Id,
-			Name:      "Group only in a disabled bearer auth",
-			Issued:    types.GroupIssuedAPI,
-			Peers:     make([]string, 0),
-		},
-		{
-			ID:        "grp-rp-nonprivate-access",
-			AccountID: account.Id,
-			Name:      "Group only in a non-private service's access groups",
-			Issued:    types.GroupIssuedAPI,
-			Peers:     make([]string, 0),
-		},
-	}
-	for _, group := range deletableGroups {
-		require.NoError(t, am.CreateGroup(context.Background(), account.Id, groupAdminUserID, group))
-	}
-
-	// Disabled bearer auth and stale access groups on a non-private service
-	// are inert configuration and must not block group deletion.
-	services := []*rpservice.Service{
-		{
-			ID:        "rp-svc-bearer-disabled",
-			AccountID: account.Id,
-			Domain:    "bearer-disabled.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            false,
-					DistributionGroups: []string{"grp-rp-bearer-disabled"},
-				},
-			},
-		},
-		{
-			ID:           "rp-svc-nonprivate-access",
-			AccountID:    account.Id,
-			Domain:       "nonprivate.services.example.com",
-			Private:      false,
-			AccessGroups: []string{"grp-rp-nonprivate-access"},
-		},
-	}
-	for _, svc := range services {
-		require.NoError(t, am.Store.CreateService(context.Background(), svc))
-	}
-
-	for _, group := range deletableGroups {
-		err = am.DeleteGroup(context.Background(), account.Id, groupAdminUserID, group.ID)
-		assert.NoError(t, err, "group %s is not referenced by an active reverse proxy gate and should be deletable", group.ID)
-	}
-}
-
 func TestDefaultAccountManager_DeleteGroupLinkedToFlowGroup(t *testing.T) {
 	am, _, err := createManager(t)
 	require.NoError(t, err)
@@ -493,30 +406,6 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 		Peers:     make([]string, 0),
 	}
 
-	groupForAgentNetworkPolicy := &types.Group{
-		ID:        "grp-for-agent-network-policy",
-		AccountID: "account-id",
-		Name:      "Group for agent network policies",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
-	groupForRPPrivate := &types.Group{
-		ID:        "grp-for-rp-private",
-		AccountID: "account-id",
-		Name:      "Group for private reverse proxy service",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
-	groupForRPBearer := &types.Group{
-		ID:        "grp-for-rp-bearer",
-		AccountID: "account-id",
-		Name:      "Group for bearer reverse proxy service",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
 	routeResource := &route.Route{
 		ID:     "example route",
 		Groups: []string{groupForRoute.ID},
@@ -572,66 +461,6 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForSetupKeys)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForUsers)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForIntegration)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForAgentNetworkPolicy)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPPrivate)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPBearer)
-
-	agentNetworkPolicy := &agentNetworkTypes.Policy{
-		ID:           "example agent network policy",
-		AccountID:    accountID,
-		Name:         "Example agent network policy",
-		Enabled:      true,
-		SourceGroups: []string{groupForAgentNetworkPolicy.ID},
-	}
-	if err := am.Store.SaveAgentNetworkPolicy(context.Background(), agentNetworkPolicy); err != nil {
-		return nil, nil, err
-	}
-
-	// The decoy services are created first so the linkage check has to scan
-	// past services that do not reference the groups under test.
-	rpServices := []*rpservice.Service{
-		{
-			ID:           "rp-svc-private-decoy",
-			AccountID:    accountID,
-			Domain:       "private-decoy.services.example.com",
-			Private:      true,
-			AccessGroups: []string{"unrelated-group"},
-		},
-		{
-			ID:        "rp-svc-bearer-decoy",
-			AccountID: accountID,
-			Domain:    "bearer-decoy.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            true,
-					DistributionGroups: []string{"unrelated-group"},
-				},
-			},
-		},
-		{
-			ID:           "rp-svc-private",
-			AccountID:    accountID,
-			Domain:       "private.services.example.com",
-			Private:      true,
-			AccessGroups: []string{groupForRPPrivate.ID},
-		},
-		{
-			ID:        "rp-svc-bearer",
-			AccountID: accountID,
-			Domain:    "bearer.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            true,
-					DistributionGroups: []string{groupForRPBearer.ID},
-				},
-			},
-		},
-	}
-	for _, svc := range rpServices {
-		if err := am.Store.CreateService(context.Background(), svc); err != nil {
-			return nil, nil, err
-		}
-	}
 
 	acc, err := am.Store.GetAccount(context.Background(), account.Id)
 	if err != nil {

management/server/types/account.go

@@ -1707,34 +1707,14 @@ func (a *Account) injectPrivateServicePolicies(svc *service.Service, proxyPeers
 	if len(proxyPeers) == 0 {
 		return
 	}
-	// A service's AccessGroups can name groups that no longer exist — persisted
-	// services and the agent-network synthesiser both carry the ids verbatim from
-	// their own state. An unresolvable source authorises nothing, so drop it here
-	// rather than let the network-map assembly resolve it to a nil group.
-	sources := a.existingGroupIDs(svc.AccessGroups)
-	if len(sources) == 0 {
-		return
-	}
 	for _, proxyPeer := range proxyPeers {
-		a.Policies = append(a.Policies, a.createPrivateServicePolicy(svc, proxyPeer, sources))
+		a.Policies = append(a.Policies, a.createPrivateServicePolicy(svc, proxyPeer))
 	}
 }
 
-// existingGroupIDs returns the subset of groupIDs that resolve to a group in the account,
-// preserving the input order.
-func (a *Account) existingGroupIDs(groupIDs []string) []string {
-	out := make([]string, 0, len(groupIDs))
-	for _, groupID := range groupIDs {
-		if _, ok := a.Groups[groupID]; ok {
-			out = append(out, groupID)
-		}
-	}
-	return out
-}
-
-func (a *Account) createPrivateServicePolicy(svc *service.Service, proxyPeer *nbpeer.Peer, accessGroups []string) *Policy {
+func (a *Account) createPrivateServicePolicy(svc *service.Service, proxyPeer *nbpeer.Peer) *Policy {
 	policyID := fmt.Sprintf("private-access-%s-%s", svc.ID, proxyPeer.ID)
-	sources := append([]string(nil), accessGroups...)
+	sources := append([]string(nil), svc.AccessGroups...)
 	return &Policy{
 		ID:      policyID,
 		Name:    fmt.Sprintf("Private Access to %s", svc.Name),

shared/relay/client/guard.go

@@ -156,11 +156,9 @@ func (g *Guard) notifyReconnected() {
 func (g *Guard) exponentTicker(ctx context.Context) *backoff.Ticker {
 	bo := backoff.WithContext(&backoff.ExponentialBackOff{
 		InitialInterval: 2 * time.Second,
-		// Spreads the reconnects of every client that lost the same relay server.
-		RandomizationFactor: backoff.DefaultRandomizationFactor,
-		Multiplier:          2,
-		MaxInterval:         g.maxBackoffInterval,
-		Clock:               backoff.SystemClock,
+		Multiplier:      2,
+		MaxInterval:     g.maxBackoffInterval,
+		Clock:           backoff.SystemClock,
 	}, ctx)
 
 	return backoff.NewTicker(bo)