Subnet docker conflict check; enterprice domain alias.

## Describe your changes

The relay client's reconnect backoff was constructed without a
`RandomizationFactor`
([guard.go:156-165](https://github.com/netbirdio/netbird/blob/main/shared/relay/client/guard.go#L156-L165)),
so it kept the zero value: every client that lost the same relay server
retried on the identical 2/4/8/16/32/60, potentially in waves.

It was the only exponential backoff in the codebase without a
randomization factor.

Use `backoff.DefaultRandomizationFactor`, as random factor.

## Issue ticket number and link

No public issue. Found while reviewing the relay reconnect path for the
client-metrics review:
22k relay reconnection events in 24h, and the shared transport's own
retry schedule was
identical across all clients.

## Stack

<!-- branch-stack -->

### Checklist
- [x] Is it a bug fix
- [ ] Is a typo/documentation fix
- [ ] Is a feature enhancement
- [ ] It is a refactor
- [x] Created tests that fail without the change (if possible)

> By submitting this pull request, you confirm that you have read and
agree to the terms of the [Contributor License
Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md).

## Documentation
Select exactly one:

- [ ] I added/updated documentation for this change
- [x] Documentation is **not needed** for this change (explain why)

Internal retry-timing change with no user-visible surface: no CLI flag,
configuration option
or API field is added or altered, and the mean reconnect delay is
unchanged.

### Docs PR URL (required if "docs added" is checked)
Paste the PR link from https://github.com/netbirdio/docs here:

N/A


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved reconnect timing to distribute repeated connection attempts
more evenly and reduce synchronized retry spikes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

.github/workflows/pr-title-check.yml

@@ -16,6 +16,8 @@ jobs:
             const allowedTags = [
               'management',
               'client',
+              'android',
+              'ios',
               'signal',
               'proxy',
               'relay',

.goreleaser_ui.yaml

@@ -93,7 +93,9 @@ nfpms:
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
     dependencies:
-      - netbird
+      - netbird (>= 0.75.0)
+      - libgtk-4-1 (>= 4.14)
+      - libwebkitgtk-6.0-4
 
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
@@ -114,7 +116,9 @@ nfpms:
       - src: client/ui/build/appicon.png
         dst: /usr/share/pixmaps/netbird.png
     dependencies:
-      - netbird
+      - netbird >= 0.75.0
+      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
+      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
 
     rpm:
       signature:

client/android/client.go

@@ -57,6 +57,12 @@ type DnsReadyListener interface {
 	dns.ReadyListener
 }
 
+// TunSettings is a snapshot of the settings the TUN device is rebuilt with
+type TunSettings struct {
+	Routes        string
+	SearchDomains string
+}
+
 func init() {
 	formatter.SetLogcatFormatter(log.StandardLogger())
 }
@@ -76,6 +82,8 @@ type Client struct {
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
 	cacheDir      string
+	// Identifies the running profile for the SSO login hint; see profile_state.go.
+	cfgPath string
 
 	stateChangeMu    sync.Mutex
 	stateChangeSubID string
@@ -96,11 +104,12 @@ type Client struct {
 	extendCancel context.CancelFunc
 }
 
-func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cc *internal.ConnectClient) {
+func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cfgPath string, cc *internal.ConnectClient) {
 	c.stateMu.Lock()
 	defer c.stateMu.Unlock()
 	c.config = cfg
 	c.cacheDir = cacheDir
+	c.cfgPath = cfgPath
 	c.connectClient = cc
 }
 
@@ -110,6 +119,16 @@ func (c *Client) stateSnapshot() (*profilemanager.Config, string, *internal.Conn
 	return c.config, c.cacheDir, c.connectClient
 }
 
+// authSnapshot returns the config together with the path it was loaded from, in
+// one lock: the path identifies the profile whose account email backs the login
+// hint, so reading it separately could pair one profile's config with another's
+// hint when a profile switch lands in between.
+func (c *Client) authSnapshot() (*profilemanager.Config, string, *internal.ConnectClient) {
+	c.stateMu.RLock()
+	defer c.stateMu.RUnlock()
+	return c.config, c.cfgPath, c.connectClient
+}
+
 func (c *Client) getConnectClient() *internal.ConnectClient {
 	c.stateMu.RLock()
 	defer c.stateMu.RUnlock()
@@ -162,7 +181,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	defer c.ctxCancel()
 	c.ctxCancelLock.Unlock()
 
-	auth := NewAuthWithConfig(ctx, cfg)
+	auth := NewAuthWithConfig(ctx, cfg, cfgFile)
 	err = auth.login(urlOpener, isAndroidTV)
 	if err != nil {
 		return err
@@ -170,7 +189,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, connectClient)
+	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
 	// only once the fresh connect client is installed: until then Status()
@@ -211,7 +230,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
 	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
-	c.setState(cfg, cacheDir, connectClient)
+	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
 
@@ -240,6 +259,24 @@ func (c *Client) RenewTun(fd int) error {
 	return e.RenewTun(fd)
 }
 
+func (c *Client) GetTunSettings() (*TunSettings, error) {
+	cc := c.getConnectClient()
+	if cc == nil {
+		return nil, fmt.Errorf("engine not running")
+	}
+
+	e := cc.Engine()
+	if e == nil {
+		return nil, fmt.Errorf("engine not initialized")
+	}
+
+	routes, searchDomains := e.TunSettings()
+	return &TunSettings{
+		Routes:        strings.Join(routes, ";"),
+		SearchDomains: strings.Join(searchDomains, ";"),
+	}, nil
+}
+
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.
 // It works both with and without a running engine.
 func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (string, error) {

client/android/login.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"fmt"
 
+	log "github.com/sirupsen/logrus"
+
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/system"
@@ -36,12 +38,20 @@ type Auth struct {
 }
 
 // NewAuth instantiate Auth struct and validate the management URL
+//
+// The configuration at cfgPath is reused when one is already there, and only created when it is
+// not. Building a fresh in-memory config unconditionally gives the client a new WireGuard key on
+// every call: the peer registers under that key, the key is written out, and any peer registered by
+// an earlier call is orphaned on the server. It also breaks a client that enrols and then runs from
+// the persisted config, because the identity it registered is not the one it runs with — the
+// management stream rejects it with "no peer auth method provided".
 func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	inputCfg := profilemanager.ConfigInput{
+		ConfigPath:    cfgPath,
 		ManagementURL: mgmURL,
 	}
 
-	cfg, err := profilemanager.CreateInMemoryConfig(inputCfg)
+	cfg, err := profilemanager.UpdateOrCreateConfig(inputCfg)
 	if err != nil {
 		return nil, err
 	}
@@ -53,11 +63,14 @@ func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	}, nil
 }
 
-// NewAuthWithConfig instantiate Auth based on existing config
-func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config) *Auth {
+// NewAuthWithConfig instantiate Auth based on existing config. cfgPath is the
+// file the config was loaded from; it identifies the profile whose account email
+// backs the login_hint.
+func NewAuthWithConfig(ctx context.Context, config *profilemanager.Config, cfgPath string) *Auth {
 	return &Auth{
-		ctx:    ctx,
-		config: config,
+		ctx:     ctx,
+		config:  config,
+		cfgPath: cfgPath,
 	}
 }
 
@@ -150,12 +163,14 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 	}
 
 	jwtToken := ""
+	email := ""
 	if needsLogin {
 		tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 		if err != nil {
 			return fmt.Errorf("interactive sso login failed: %v", err)
 		}
 		jwtToken = tokenInfo.GetTokenToUse()
+		email = tokenInfo.Email
 	}
 
 	err, _ = authClient.Login(a.ctx, "", jwtToken)
@@ -163,17 +178,42 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 		return fmt.Errorf("login failed: %v", err)
 	}
 
+	// Stored after Login, not before: a rejected token must not leave a hint
+	// pointing at an account that cannot be used.
+	if email != "" && a.cfgPath != "" {
+		if err := writeProfileEmail(a.cfgPath, email); err != nil {
+			log.Warnf("failed to store profile account email: %v", err)
+		}
+	}
+
 	go urlOpener.OnLoginSuccess()
 
 	return nil
 }
 
+// loginHintSetter is implemented by both concrete flows (PKCE and device code)
+// but absent from the OAuthFlow interface, hence the assertion below — the same
+// way internal/auth wires it in authenticateWithPKCEFlow.
+type loginHintSetter interface {
+	SetLoginHint(hint string)
+}
+
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool) (*auth.TokenInfo, error) {
 	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
+	// An empty hint is deliberate, not a fallback: a fresh or logged-out profile
+	// leaves the choice to the IdP, which is how accounts get switched.
+	if a.cfgPath != "" {
+		if hint := readProfileEmail(a.cfgPath); hint != "" {
+			if setter, ok := oAuthFlow.(loginHintSetter); ok {
+				setter.SetLoginHint(hint)
+			}
+		}
+	}
+
 	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
 	if err != nil {
 		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)

client/android/login_test.go

@@ -0,0 +1,51 @@
+package android
+
+import (
+	"path/filepath"
+	"testing"
+)
+
+// NewAuth must reuse the configuration already at cfgPath rather than building a fresh one.
+//
+// Creating a new in-memory config on every call gives the client a new WireGuard private key each
+// time. The peer registers under that key and the key is written out, so a peer registered by an
+// earlier call is orphaned on the server — a client that enrols twice leaves two entries and owns
+// neither. It also breaks enrol-then-run: RunWithoutLogin reloads the configuration from disk, so
+// the identity that registered is not the identity that runs, and the management stream rejects it
+// with "no peer auth method provided, please use a setup key or interactive SSO login".
+func TestNewAuth_ReusesPersistedIdentity(t *testing.T) {
+	cfgPath := filepath.Join(t.TempDir(), "config.json")
+
+	first, err := NewAuth(cfgPath, "https://api.example.com:443")
+	if err != nil {
+		t.Fatalf("first NewAuth: %v", err)
+	}
+	if first.config.PrivateKey == "" {
+		t.Fatal("first NewAuth produced no private key")
+	}
+
+	second, err := NewAuth(cfgPath, "https://api.example.com:443")
+	if err != nil {
+		t.Fatalf("second NewAuth: %v", err)
+	}
+
+	if second.config.PrivateKey != first.config.PrivateKey {
+		t.Errorf("private key changed between calls: a second enrolment would orphan the peer registered by the first")
+	}
+}
+
+// A missing configuration is still created, so a first enrolment works unchanged.
+func TestNewAuth_CreatesConfigWhenAbsent(t *testing.T) {
+	cfgPath := filepath.Join(t.TempDir(), "config.json")
+
+	auth, err := NewAuth(cfgPath, "https://api.example.com:443")
+	if err != nil {
+		t.Fatalf("NewAuth: %v", err)
+	}
+	if auth.config == nil || auth.config.PrivateKey == "" {
+		t.Fatal("NewAuth did not create a usable configuration")
+	}
+	if auth.cfgPath != cfgPath {
+		t.Errorf("cfgPath = %q, want %q", auth.cfgPath, cfgPath)
+	}
+}

client/android/profile_manager.go

@@ -13,18 +13,17 @@ import (
 )
 
 const (
-	// Android-specific config filename (different from desktop default.json)
-	defaultConfigFilename = "netbird.cfg"
-	// Subdirectory for non-default profiles (must match Java Preferences.java)
-	profilesSubdir = "profiles"
 	// Android uses a single user context per app (non-empty username required by ServiceManager)
 	androidUsername = "android"
 )
 
 // Profile represents a profile for gomobile
 type Profile struct {
-	ID       string
-	Name     string
+	ID   string
+	Name string
+	// Email is the account this profile last logged in with, "" if it never
+	// completed an SSO login or was logged out. See profile_state.go.
+	Email    string
 	IsActive bool
 }
 
@@ -101,6 +100,7 @@ func (pm *ProfileManager) ListProfiles() (*ProfileArray, error) {
 		profiles = append(profiles, &Profile{
 			ID:       p.ID.String(),
 			Name:     p.Name,
+			Email:    pm.profileEmail(p.ID.String()),
 			IsActive: p.IsActive,
 		})
 	}
@@ -123,7 +123,22 @@ func (pm *ProfileManager) GetActiveProfile() (*Profile, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to resolve active profile %q: %w", activeState.ID, err)
 	}
-	return &Profile{ID: prof.ID.String(), Name: prof.Name, IsActive: true}, nil
+	return &Profile{
+		ID:       prof.ID.String(),
+		Name:     prof.Name,
+		Email:    pm.profileEmail(prof.ID.String()),
+		IsActive: true,
+	}, nil
+}
+
+// profileEmail returns the account email recorded for a profile. Display-only, so
+// an unresolvable path degrades to "" rather than an error.
+func (pm *ProfileManager) profileEmail(id string) string {
+	configPath, err := pm.getProfileConfigPath(id)
+	if err != nil {
+		return ""
+	}
+	return readProfileEmail(configPath)
 }
 
 // SwitchProfile switches to a different profile
@@ -185,6 +200,11 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 		return fmt.Errorf("failed to save config: %w", err)
 	}
 
+	// Not fatal: a stale hint costs an account switch, not the logout itself.
+	if err := removeProfileEmail(configPath); err != nil {
+		log.Warnf("failed to clear stored account email for profile %s: %v", id, err)
+	}
+
 	log.Infof("logged out from profile: %s", id)
 	return nil
 }

client/android/profile_state.go

@@ -0,0 +1,108 @@
+package android
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/util"
+)
+
+const (
+	// Android-specific config filename (different from desktop default.json)
+	defaultConfigFilename = "netbird.cfg"
+	// Subdirectory for non-default profiles (must match Java Preferences.java)
+	profilesSubdir = "profiles"
+	// profileAccountSuffix names the file holding the profile's account email.
+	// Deliberately not ".state.json", which desktop uses for the same data:
+	// there the email and the engine's state manager live in different
+	// directories, but on Android both resolve under files/, so sharing the name
+	// would have the two overwrite each other — the state manager rewrites the
+	// whole file from its own keys (see statemanager.Manager.PersistState), and
+	// this package's writer does the same in reverse.
+	profileAccountSuffix = ".account.json"
+)
+
+// profileAccountPathFor derives the account file path from a profile's config
+// path: netbird.cfg -> netbird.account.json, <id>.json -> <id>.account.json.
+//
+// Deriving from the config path rather than resolving the active profile keeps
+// the write on the profile the login actually ran for: Auth.login runs in a
+// goroutine, so the active profile can change under a flow already in flight.
+func profileAccountPathFor(configPath string) (string, error) {
+	if configPath == "" {
+		return "", fmt.Errorf("empty config path")
+	}
+
+	base := filepath.Base(configPath)
+	stem := strings.TrimSuffix(base, filepath.Ext(base))
+	if stem == "" || stem == "." {
+		return "", fmt.Errorf("config path %q has no filename stem", configPath)
+	}
+
+	return filepath.Join(filepath.Dir(configPath), stem+profileAccountSuffix), nil
+}
+
+// readProfileEmail returns the account email stored for the profile whose config
+// lives at configPath. A missing or unreadable file yields "", which leaves the
+// account choice to the IdP.
+func readProfileEmail(configPath string) string {
+	accountPath, err := profileAccountPathFor(configPath)
+	if err != nil {
+		log.Debugf("no profile account path for login hint: %v", err)
+		return ""
+	}
+
+	var state profilemanager.ProfileState
+	if _, err := util.ReadJson(accountPath, &state); err != nil {
+		if !os.IsNotExist(err) {
+			log.Debugf("failed to read profile account for login hint: %v", err)
+		}
+		return ""
+	}
+
+	return state.Email
+}
+
+// writeProfileEmail records the account email for the profile whose config lives
+// at configPath, so later logins can pass it as an OIDC login_hint. An empty
+// email is ignored rather than blanking what is already stored.
+func writeProfileEmail(configPath string, email string) error {
+	if email == "" {
+		return nil
+	}
+
+	accountPath, err := profileAccountPathFor(configPath)
+	if err != nil {
+		return fmt.Errorf("resolve profile account path: %w", err)
+	}
+
+	state := profilemanager.ProfileState{Email: email}
+	if err := util.WriteJsonWithRestrictedPermission(context.Background(), accountPath, state); err != nil {
+		return fmt.Errorf("write profile account: %w", err)
+	}
+
+	return nil
+}
+
+// removeProfileEmail drops the stored account email. Called on logout: while the
+// email is on disk it goes out as a login_hint, which would steer the next login
+// straight back into the account just logged out of. Mirrors the desktop UI's
+// RemoveProfileState call.
+func removeProfileEmail(configPath string) error {
+	accountPath, err := profileAccountPathFor(configPath)
+	if err != nil {
+		return fmt.Errorf("resolve profile account path: %w", err)
+	}
+
+	if err := os.Remove(accountPath); err != nil && !os.IsNotExist(err) {
+		return fmt.Errorf("remove profile account: %w", err)
+	}
+
+	return nil
+}

client/android/profile_state_test.go

@@ -0,0 +1,161 @@
+package android
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestProfileAccountPathFor(t *testing.T) {
+	tests := []struct {
+		name       string
+		configPath string
+		want       string
+		wantErr    bool
+	}{
+		{
+			name:       "default profile",
+			configPath: "/data/data/io.netbird.client/files/netbird.cfg",
+			want:       filepath.FromSlash("/data/data/io.netbird.client/files/netbird.account.json"),
+		},
+		{
+			name:       "id profile",
+			configPath: "/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.json",
+			want:       filepath.FromSlash("/data/data/io.netbird.client/files/profiles/4c5f5c8198c3989cffb5b5394f5a7ae0.account.json"),
+		},
+		{
+			name:       "legacy name-keyed profile is handled the same way",
+			configPath: "/data/data/io.netbird.client/files/profiles/work.json",
+			want:       filepath.FromSlash("/data/data/io.netbird.client/files/profiles/work.account.json"),
+		},
+		{
+			name:       "empty path is rejected",
+			configPath: "",
+			wantErr:    true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := profileAccountPathFor(tt.configPath)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("expected an error, got path %q", got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+			if got != tt.want {
+				t.Errorf("got %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestProfileAccountPathForDefaultDoesNotCollide(t *testing.T) {
+	root := "/data/data/io.netbird.client/files"
+
+	defaultAccount, err := profileAccountPathFor(filepath.Join(root, defaultConfigFilename))
+	if err != nil {
+		t.Fatalf("default profile: %v", err)
+	}
+
+	idAccount, err := profileAccountPathFor(filepath.Join(root, profilesSubdir, "abc123.json"))
+	if err != nil {
+		t.Fatalf("id profile: %v", err)
+	}
+
+	if defaultAccount == idAccount {
+		t.Fatalf("default and id profile share an account file: %q", defaultAccount)
+	}
+}
+
+// The account file must never land on the engine state file: on Android both
+// resolve under files/, and the state manager rewrites the whole file from its
+// own keys, so sharing a path would have the two overwrite each other. The
+// expected names here mirror ProfileManager.GetStateFilePath.
+func TestProfileAccountPathAvoidsEngineStateFile(t *testing.T) {
+	root := "/data/data/io.netbird.client/files"
+
+	cases := []struct {
+		configPath  string
+		engineState string
+	}{
+		{
+			configPath:  filepath.Join(root, defaultConfigFilename),
+			engineState: filepath.Join(root, "state.json"),
+		},
+		{
+			configPath:  filepath.Join(root, profilesSubdir, "abc123.json"),
+			engineState: filepath.Join(root, profilesSubdir, "abc123.state.json"),
+		},
+	}
+
+	for _, c := range cases {
+		account, err := profileAccountPathFor(c.configPath)
+		if err != nil {
+			t.Fatalf("%s: %v", c.configPath, err)
+		}
+		if account == c.engineState {
+			t.Errorf("account file collides with the engine state file: %q", account)
+		}
+	}
+}
+
+func TestWriteThenReadProfileEmail(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
+	if err := ensureDirFor(t, configPath); err != nil {
+		t.Fatalf("prepare dir: %v", err)
+	}
+
+	if got := readProfileEmail(configPath); got != "" {
+		t.Errorf("expected no email before a login, got %q", got)
+	}
+
+	const email = "user@example.com"
+	if err := writeProfileEmail(configPath, email); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+
+	if got := readProfileEmail(configPath); got != email {
+		t.Errorf("got %q, want %q", got, email)
+	}
+
+	if err := removeProfileEmail(configPath); err != nil {
+		t.Fatalf("remove: %v", err)
+	}
+	if got := readProfileEmail(configPath); got != "" {
+		t.Errorf("expected no email after logout, got %q", got)
+	}
+
+	// Logout may run on a never-logged-in profile, so a second remove must pass.
+	if err := removeProfileEmail(configPath); err != nil {
+		t.Fatalf("second remove should be a no-op: %v", err)
+	}
+}
+
+func TestWriteProfileEmailIgnoresEmpty(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), "profiles", "abc123.json")
+	if err := ensureDirFor(t, configPath); err != nil {
+		t.Fatalf("prepare dir: %v", err)
+	}
+
+	const email = "user@example.com"
+	if err := writeProfileEmail(configPath, email); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	if err := writeProfileEmail(configPath, ""); err != nil {
+		t.Fatalf("write empty: %v", err)
+	}
+
+	if got := readProfileEmail(configPath); got != email {
+		t.Errorf("empty write clobbered the stored email: got %q, want %q", got, email)
+	}
+}
+
+func ensureDirFor(t *testing.T, path string) error {
+	t.Helper()
+	return os.MkdirAll(filepath.Dir(path), 0o700)
+}

client/android/session.go

@@ -278,7 +278,7 @@ func (c *Client) endExtend() {
 }
 
 func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isAndroidTV bool) error {
-	cfg, _, cc := c.stateSnapshot()
+	cfg, cfgPath, cc := c.authSnapshot()
 	if cfg == nil || cc == nil {
 		return fmt.Errorf("engine is not running")
 	}
@@ -293,7 +293,10 @@ func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isA
 	}
 	defer authClient.Close()
 
-	a := &Auth{ctx: ctx, config: cfg}
+	// Passing the config path makes the flow pick up the login_hint: an extend
+	// renews the session of the account already signed in, so it must not stop to
+	// offer a choice.
+	a := NewAuthWithConfig(ctx, cfg, cfgPath)
 	tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
 	if err != nil {
 		return fmt.Errorf("interactive sso login failed: %v", err)

client/internal/auth/sessionwatch/event.go

@@ -11,11 +11,10 @@ import (
 // emits.
 
 // Metadata keys attached by the daemon to session-warning SystemEvents.
-// The notification text itself travels as a message key (see
-// proto.UserMsgSessionExpiresIn); these keys carry the structured deadline
-// the UI needs for its own countdown label, and disambiguate the
-// T-WarningLead notification from the T-FinalWarningLead fallback that
-// auto-opens the SessionAboutToExpire dialog.
+// The UI tray reads these to build a locale-aware notification without
+// relying on the daemon's locale-less UserMessage string, and to
+// disambiguate the T-WarningLead notification from the T-FinalWarningLead
+// fallback that auto-opens the SessionAboutToExpire dialog.
 const (
 	// MetaSessionWarning is set to "true" on both warning events (T-10 and
 	// T-2) so the UI can detect a session-warning SystemEvent without
@@ -37,9 +36,10 @@ const (
 	// MetaSessionDeadlineRejected is attached to the ERROR/AUTHENTICATION
 	// SystemEvent the daemon emits when it discards a deadline from the
 	// management server (pre-epoch, too far in the future, or past the
-	// clock-skew tolerance). The value is the rejection reason string,
-	// which is diagnostic only: the user-facing text travels as
-	// proto.UserMsgSessionDeadlineReject.
+	// clock-skew tolerance). The value is the rejection reason string.
+	// userMessage is left empty; the UI detects the event via this key
+	// and builds a localized notification — same pattern as the session
+	// warnings above.
 	MetaSessionDeadlineRejected = "session_deadline_rejected"
 )
 

client/internal/auth/sessionwatch/watcher.go

@@ -21,7 +21,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	cProto "github.com/netbirdio/netbird/client/proto"
-	nbstatus "github.com/netbirdio/netbird/client/status"
 )
 
 const (
@@ -81,7 +80,7 @@ type StatusRecorder interface {
 		severity cProto.SystemEvent_Severity,
 		category cProto.SystemEvent_Category,
 		message string,
-		userMessage *cProto.UserMessage,
+		userMessage string,
 		metadata map[string]string,
 	)
 }
@@ -377,22 +376,7 @@ func publishWarning(recorder StatusRecorder, deadline time.Time, final bool) {
 		cProto.SystemEvent_CRITICAL,
 		cProto.SystemEvent_AUTHENTICATION,
 		message,
-		warningUserMessage(deadline),
+		"",
 		meta,
 	)
 }
-
-// warningUserMessage builds the localizable body for a session warning. The
-// remaining time is rendered here rather than in the UI so every consumer of the
-// event agrees on it; a deadline that is already gone (a warning delivered late)
-// drops to the variant without a countdown.
-func warningUserMessage(deadline time.Time) *cProto.UserMessage {
-	remaining := time.Until(deadline)
-	if remaining <= 0 {
-		return cProto.NewUserMessage(cProto.UserMsgSessionExpiresSoon).
-			WithTitle(cProto.TitleSessionWarning)
-	}
-	return cProto.NewUserMessage(cProto.UserMsgSessionExpiresIn,
-		cProto.ArgRemaining, nbstatus.HumaniseDuration(remaining)).
-		WithTitle(cProto.TitleSessionWarning)
-}

client/internal/auth/sessionwatch/watcher_test.go

@@ -34,9 +34,6 @@ type event struct {
 	severity cProto.SystemEvent_Severity
 	category cProto.SystemEvent_Category
 	message  string
-	msgKey   cProto.UserMessageKey
-	titleKey cProto.UserMessageKey
-	msgArgs  map[string]string
 	meta     map[string]string
 }
 
@@ -65,7 +62,7 @@ func (r *fakeRecorder) PublishEvent(
 	severity cProto.SystemEvent_Severity,
 	category cProto.SystemEvent_Category,
 	message string,
-	userMessage *cProto.UserMessage,
+	_ string,
 	metadata map[string]string,
 ) {
 	r.mu.Lock()
@@ -75,9 +72,6 @@ func (r *fakeRecorder) PublishEvent(
 		severity: severity,
 		category: category,
 		message:  message,
-		msgKey:   userMessage.Key(),
-		titleKey: userMessage.TitleKey(),
-		msgArgs:  userMessage.Args(),
 		meta:     metadata,
 	})
 }
@@ -192,33 +186,6 @@ func TestWarningFiresOnceWithinLeadWindow(t *testing.T) {
 	}
 }
 
-// The UI localizes the warning body from the key rather than from the daemon's
-// English text, so a warning that ships no key would silently regress to English.
-func TestWarningCarriesLocalizableMessage(t *testing.T) {
-	r := &fakeRecorder{}
-	w := newWatcher(50*time.Millisecond, r)
-	defer w.Close()
-
-	_ = w.Update(time.Now().Add(80 * time.Millisecond))
-
-	events := waitForEvents(t, r, 2)
-	warning := events[1]
-	if !warning.isWarning() {
-		t.Fatalf("event[1] should be a warning publish, got %+v", warning)
-	}
-	if warning.msgKey != cProto.UserMsgSessionExpiresIn {
-		t.Errorf("warning message key = %q, want %q", warning.msgKey, cProto.UserMsgSessionExpiresIn)
-	}
-	if warning.titleKey != cProto.TitleSessionWarning {
-		t.Errorf("warning title key = %q, want %q", warning.titleKey, cProto.TitleSessionWarning)
-	}
-	// The remaining time is rendered at publish time so every consumer of the
-	// event agrees on it; the exact value depends on timer slack.
-	if remaining := warning.msgArgs[cProto.ArgRemaining]; remaining == "" {
-		t.Errorf("warning is missing the %q argument, args=%v", cProto.ArgRemaining, warning.msgArgs)
-	}
-}
-
 func TestWarningFiresImmediatelyWhenAlreadyInsideWindow(t *testing.T) {
 	r := &fakeRecorder{}
 	w := newWatcher(time.Hour, r) // lead > delta => fire immediately

client/internal/connect.go

@@ -113,11 +113,14 @@ func (c *ConnectClient) RunOnAndroid(
 	stateFilePath string,
 	cacheDir string,
 ) error {
+	notifier := tunnelnotifier.New(networkChangeListener, nil)
+	defer notifier.Close()
+
 	// in case of non Android os these variables will be nil
 	mobileDependency := MobileDependency{
 		TunAdapter:            tunAdapter,
 		IFaceDiscover:         iFaceDiscover,
-		NetworkChangeListener: networkChangeListener,
+		NetworkChangeListener: notifier,
 		HostDNSAddresses:      dnsAddresses,
 		DnsReadyListener:      dnsReadyListener,
 		StateFilePath:         stateFilePath,
@@ -163,7 +166,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 				rec.PublishEvent(
 					cProto.SystemEvent_CRITICAL, cProto.SystemEvent_SYSTEM,
 					"panic occurred",
-					cProto.NewUserMessage(cProto.UserMsgPanic),
+					"The Netbird service panicked. Please restart the service and submit a bug report with the client logs.",
 					nil,
 				)
 			}

client/internal/dns/notifier.go

@@ -51,7 +51,5 @@ func (n *notifier) notify() {
 		return
 	}
 
-	go func(l listener.NetworkChangeListener) {
-		l.OnNetworkChanged("")
-	}(n.listener)
+	n.listener.OnNetworkChanged("")
 }

client/internal/dns/server.go

@@ -252,7 +252,7 @@ func NewDefaultServerPermanentUpstream(
 	ds.hostsDNSHolder.set(hostsDnsList)
 	ds.permanent = true
 	ds.currentConfig = dnsConfigToHostDNSConfig(config, ds.service.RuntimeIP(), ds.service.RuntimePort())
-	ds.searchDomainNotifier = newNotifier(ds.SearchDomains())
+	ds.searchDomainNotifier = newNotifier(ds.searchDomains())
 	ds.searchDomainNotifier.setListener(listener)
 	setServerDns(ds)
 	return ds
@@ -602,6 +602,12 @@ func (s *DefaultServer) UpdateDNSServer(serial uint64, update nbdns.Config) erro
 }
 
 func (s *DefaultServer) SearchDomains() []string {
+	s.mux.Lock()
+	defer s.mux.Unlock()
+	return s.searchDomains()
+}
+
+func (s *DefaultServer) searchDomains() []string {
 	var searchDomains []string
 
 	for _, dConf := range s.currentConfig.Domains {
@@ -686,7 +692,7 @@ func (s *DefaultServer) applyConfiguration(update nbdns.Config) error {
 	}()
 
 	if s.searchDomainNotifier != nil {
-		s.searchDomainNotifier.onNewSearchDomains(s.SearchDomains())
+		s.searchDomainNotifier.onNewSearchDomains(s.searchDomains())
 	}
 
 	s.updateNSGroupStates(update.NameServerGroups)
@@ -1134,7 +1140,7 @@ func (s *DefaultServer) projectHealthy(p *nsGroupProj, servers []netip.AddrPort)
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_DNS,
 		"Nameserver group recovered",
-		proto.NewUserMessage(proto.UserMsgDNSRecovered),
+		"DNS servers are reachable again.",
 		map[string]string{"upstreams": joinAddrPorts(servers)},
 	)
 	p.warningActive = false
@@ -1157,7 +1163,7 @@ func (s *DefaultServer) projectUnhealthy(p *nsGroupProj, servers []netip.AddrPor
 			proto.SystemEvent_WARNING,
 			proto.SystemEvent_DNS,
 			"Nameserver group unreachable",
-			proto.NewUserMessage(proto.UserMsgDNSUnreachable),
+			"Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
 			map[string]string{"upstreams": joinAddrPorts(servers)},
 		)
 		p.warningActive = true

client/internal/engine.go

@@ -572,12 +572,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	}
 	e.stateManager.Start()
 
-	initialRoutes, dnsConfig, dnsFeatureFlag, err := e.readInitialSettings()
-	if err != nil {
-		return fmt.Errorf("read initial settings: %w", err)
-	}
-
-	dnsServer, err := e.newDnsServer(dnsConfig)
+	dnsServer, err := e.newDnsServer()
 	if err != nil {
 		return fmt.Errorf("create dns server: %w", err)
 	}
@@ -595,10 +590,8 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		WGInterface:         e.wgInterface,
 		StatusRecorder:      e.statusRecorder,
 		RelayManager:        e.relayManager,
-		InitialRoutes:       initialRoutes,
 		StateManager:        e.stateManager,
 		DNSServer:           dnsServer,
-		DNSFeatureFlag:      dnsFeatureFlag,
 		PeerStore:           e.peerStore,
 		DisableClientRoutes: e.config.DisableClientRoutes,
 		DisableServerRoutes: e.config.DisableServerRoutes,
@@ -1074,7 +1067,7 @@ func (e *Engine) handleSync(update *mgmProto.SyncResponse) error {
 		return err
 	}
 
-	e.statusRecorder.PublishEvent(cProto.SystemEvent_INFO, cProto.SystemEvent_SYSTEM, "Network map updated", nil, nil)
+	e.statusRecorder.PublishEvent(cProto.SystemEvent_INFO, cProto.SystemEvent_SYSTEM, "Network map updated", "", nil)
 
 	return nil
 }
@@ -2102,42 +2095,6 @@ func (e *Engine) close() {
 	}
 }
 
-func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, error) {
-	if runtime.GOOS != "android" {
-		// nolint:nilnil
-		return nil, nil, false, nil
-	}
-
-	info := system.GetInfo(e.ctx)
-	info.SetFlags(
-		e.config.RosenpassEnabled,
-		e.config.RosenpassPermissive,
-		&e.config.ServerSSHAllowed,
-		e.config.DisableClientRoutes,
-		e.config.DisableServerRoutes,
-		e.config.DisableDNS,
-		e.config.DisableFirewall,
-		e.config.BlockLANAccess,
-		e.config.BlockInbound,
-		e.config.DisableIPv6,
-		e.config.SyncMessageVersion,
-		e.config.EnableSSHRoot,
-		e.config.EnableSSHSFTP,
-		e.config.EnableSSHLocalPortForwarding,
-		e.config.EnableSSHRemotePortForwarding,
-		e.config.DisableSSHAuth,
-	)
-
-	netMap, err := e.mgmClient.GetNetworkMap(info)
-	if err != nil {
-		return nil, nil, false, err
-	}
-	routes := toRoutes(netMap.GetRoutes())
-	dnsCfg := toDNSConfig(netMap.GetDNSConfig(), e.wgInterface.Address())
-	dnsFeatureFlag := toDNSFeatureFlag(netMap)
-	return routes, &dnsCfg, dnsFeatureFlag, nil
-}
-
 func (e *Engine) newWgIface() (*iface.WGIface, error) {
 	transportNet, err := e.newStdNet()
 	if err != nil {
@@ -2172,7 +2129,7 @@ func (e *Engine) newWgIface() (*iface.WGIface, error) {
 func (e *Engine) wgInterfaceCreate() (err error) {
 	switch runtime.GOOS {
 	case "android":
-		err = e.wgInterface.CreateOnAndroid(e.routeManager.InitialRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
+		err = e.wgInterface.CreateOnAndroid(e.routeManager.CurrentRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
 	case "ios":
 		e.mobileDep.NetworkChangeListener.SetInterfaceIP(e.config.WgAddr.String())
 		if e.config.WgAddr.HasIPv6() {
@@ -2185,7 +2142,7 @@ func (e *Engine) wgInterfaceCreate() (err error) {
 	return err
 }
 
-func (e *Engine) newDnsServer(dnsConfig *nbdns.Config) (dns.Server, error) {
+func (e *Engine) newDnsServer() (dns.Server, error) {
 	// due to tests where we are using a mocked version of the DNS server
 	if e.dnsServer != nil {
 		return e.dnsServer, nil
@@ -2197,7 +2154,7 @@ func (e *Engine) newDnsServer(dnsConfig *nbdns.Config) (dns.Server, error) {
 			e.ctx,
 			e.wgInterface,
 			e.mobileDep.HostDNSAddresses,
-			*dnsConfig,
+			nbdns.Config{},
 			e.mobileDep.NetworkChangeListener,
 			e.statusRecorder,
 			e.config.DisableDNS,

client/internal/engine_authsession.go

@@ -57,8 +57,7 @@ func (e *Engine) ApplySessionDeadline(ts *timestamppb.Timestamp) {
 			cProto.SystemEvent_ERROR,
 			cProto.SystemEvent_AUTHENTICATION,
 			"session deadline rejected",
-			cProto.NewUserMessage(cProto.UserMsgSessionDeadlineReject).
-				WithTitle(cProto.TitleSessionDeadlineReject),
+			"",
 			map[string]string{sessionwatch.MetaSessionDeadlineRejected: err.Error()},
 		)
 	}

client/internal/engine_tunsettings.go

@@ -0,0 +1,20 @@
+package internal
+
+func (e *Engine) TunSettings() ([]string, []string) {
+	e.syncMsgMux.Lock()
+	routeManager := e.routeManager
+	dnsServer := e.dnsServer
+	e.syncMsgMux.Unlock()
+
+	var routes []string
+	if routeManager != nil {
+		routes = routeManager.CurrentRouteRange()
+	}
+
+	var searchDomains []string
+	if dnsServer != nil {
+		searchDomains = dnsServer.SearchDomains()
+	}
+
+	return routes, searchDomains
+}

client/internal/peer/status.go

@@ -1281,15 +1281,12 @@ func (d *Status) numOfPeers() int {
 	return len(d.peers) + len(d.offlinePeers)
 }
 
-// PublishEvent adds an event to the queue and distributes it to all subscribers.
-// msg is the English log-facing description; userMsg is the localizable
-// user-facing message, or nil for an internal control event that must not
-// surface as a notification.
+// PublishEvent adds an event to the queue and distributes it to all subscribers
 func (d *Status) PublishEvent(
 	severity proto.SystemEvent_Severity,
 	category proto.SystemEvent_Category,
 	msg string,
-	userMsg *proto.UserMessage,
+	userMsg string,
 	metadata map[string]string,
 ) {
 	event := &proto.SystemEvent{
@@ -1297,10 +1294,7 @@ func (d *Status) PublishEvent(
 		Severity:    severity,
 		Category:    category,
 		Message:     msg,
-		UserMessage: userMsg.Text(),
-		MessageKey:  string(userMsg.Key()),
-		MessageArgs: userMsg.Args(),
-		TitleKey:    string(userMsg.TitleKey()),
+		UserMessage: userMsg,
 		Metadata:    metadata,
 		Timestamp:   timestamppb.Now(),
 	}

client/internal/profilemanager/state.go

@@ -45,12 +45,35 @@ func (pm *ProfileManager) GetProfileState(id ID) (*ProfileState, error) {
 	return &state, nil
 }
 
-func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
+// SetProfileState writes the state file of the profile identified by id. Prefer
+// it over SetActiveProfileState whenever the caller knows which profile the data
+// belongs to: an SSO login spans seconds of user interaction, and the active
+// profile can change during it, which would file the account email under
+// whichever profile happened to be active when the flow returned.
+func (pm *ProfileManager) SetProfileState(id ID, state *ProfileState) error {
 	configDir, err := getConfigDir()
 	if err != nil {
 		return fmt.Errorf("get config directory: %w", err)
 	}
 
+	if id == "" {
+		return fmt.Errorf("empty profile ID")
+	}
+	if id != defaultProfileName && !IsValidProfileFilenameStem(id) {
+		return fmt.Errorf("invalid profile ID: %q", id)
+	}
+
+	stateFile := filepath.Join(configDir, id.String()+".state.json")
+	if err := util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state); err != nil {
+		return fmt.Errorf("write profile state: %w", err)
+	}
+
+	return nil
+}
+
+// SetActiveProfileState writes the state file of whichever profile is active at
+// call time. Use SetProfileState when the target profile is known.
+func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 	activeProf, err := pm.GetActiveProfile()
 	if err != nil {
 		if errors.Is(err, ErrNoActiveProfile) {
@@ -59,18 +82,7 @@ func (pm *ProfileManager) SetActiveProfileState(state *ProfileState) error {
 		return fmt.Errorf("get active profile: %w", err)
 	}
 
-	id := activeProf.ID
-	if id != defaultProfileName && !IsValidProfileFilenameStem(id) {
-		return fmt.Errorf("invalid active profile ID: %q", id)
-	}
-
-	stateFile := filepath.Join(configDir, id.String()+".state.json")
-	err = util.WriteJsonWithRestrictedPermission(context.Background(), stateFile, state)
-	if err != nil {
-		return fmt.Errorf("write profile state: %w", err)
-	}
-
-	return nil
+	return pm.SetProfileState(activeProf.ID, state)
 }
 
 // RemoveProfileState deletes the per-profile state file (which holds the

client/internal/routemanager/client/client.go

@@ -403,7 +403,7 @@ func (w *Watcher) connectEvent(route *route.Route) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_NETWORK,
 		"Default route added",
-		proto.NewUserMessage(proto.UserMsgExitNodeConnected),
+		"Exit node connected.",
 		meta,
 	)
 }
@@ -423,7 +423,7 @@ func (w *Watcher) disconnectEvent(route *route.Route, rsn reason) {
 
 	var severity proto.SystemEvent_Severity
 	var message string
-	var userMessage *proto.UserMessage
+	var userMessage string
 	meta := make(map[string]string)
 
 	if route != nil {
@@ -435,22 +435,22 @@ func (w *Watcher) disconnectEvent(route *route.Route, rsn reason) {
 	case reasonShutdown:
 		severity = proto.SystemEvent_INFO
 		message = "Default route removed"
-		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeDisconnected)
+		userMessage = "Exit node disconnected."
 	case reasonRouteUpdate:
 		severity = proto.SystemEvent_INFO
 		message = "Default route updated due to configuration change"
 	case reasonPeerUpdate:
 		severity = proto.SystemEvent_WARNING
 		message = "Default route disconnected due to peer unreachability"
-		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeConnectionLost)
+		userMessage = "Exit node connection lost. Your internet access might be affected."
 	case reasonHA:
 		severity = proto.SystemEvent_INFO
 		message = "Default route disconnected due to high availability change"
-		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeHAChange)
+		userMessage = "Exit node disconnected due to high availability change."
 	default:
 		severity = proto.SystemEvent_ERROR
 		message = "Default route disconnected for unknown reasons"
-		userMessage = proto.NewUserMessage(proto.UserMsgExitNodeDisconnectedUnknown)
+		userMessage = "Exit node disconnected for unknown reasons."
 	}
 
 	w.statusRecorder.PublishEvent(

client/internal/routemanager/dnsinterceptor/handler.go

@@ -479,7 +479,7 @@ func (d *DnsInterceptor) removeDNATMappings(realPrefixes []netip.Prefix, logger
 
 // internalDnatFw checks if the firewall supports internal DNAT
 func (d *DnsInterceptor) internalDnatFw() (internalDNATer, bool) {
-	if d.firewall == nil || runtime.GOOS != "android" {
+	if d.firewall == nil || d.fakeIPManager == nil || runtime.GOOS != "android" {
 		return nil, false
 	}
 	fw, ok := d.firewall.(internalDNATer)

client/internal/routemanager/manager.go

@@ -8,14 +8,13 @@ import (
 	"net/netip"
 	"net/url"
 	"runtime"
-	"slices"
+	"sort"
 	"strings"
 	"sync"
 	"sync/atomic"
 	"syscall"
 	"time"
 
-	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/exp/maps"
@@ -62,7 +61,7 @@ type Manager interface {
 	GetActiveClientRoutes() route.HAMap
 	GetClientRoutesWithNetID() map[route.NetID][]*route.Route
 	SetRouteChangeListener(listener listener.NetworkChangeListener)
-	InitialRouteRange() []string
+	CurrentRouteRange() []string
 	SetFirewall(firewall.Manager) error
 	SetDNSForwarderPort(port uint16)
 	ReconcilePeerAllowedIPs(peerKey string) error
@@ -76,10 +75,8 @@ type ManagerConfig struct {
 	WGInterface         iface.WGIface
 	StatusRecorder      *peer.Status
 	RelayManager        *relayClient.Manager
-	InitialRoutes       []*route.Route
 	StateManager        *statemanager.Manager
 	DNSServer           dns.Server
-	DNSFeatureFlag      bool
 	PeerStore           *peerstore.Store
 	DisableClientRoutes bool
 	DisableServerRoutes bool
@@ -149,45 +146,12 @@ func NewManager(config ManagerConfig) *DefaultManager {
 	useNoop := netstack.IsEnabled() || config.DisableClientRoutes
 	dm.setupRefCounters(useNoop)
 
-	// don't proceed with client routes if it is disabled
-	if config.DisableClientRoutes {
-		return dm
-	}
-
-	if runtime.GOOS == "android" {
-		dm.setupAndroidRoutes(config)
-	}
 	return dm
 }
-func (m *DefaultManager) setupAndroidRoutes(config ManagerConfig) {
-	cr := m.initialClientRoutes(config.InitialRoutes)
 
-	routesForComparison := slices.Clone(cr)
-
-	if config.DNSFeatureFlag {
-		m.fakeIPManager = fakeip.NewManager()
-
-		v4ID := uuid.NewString()
-		fakeIPRoute := &route.Route{
-			ID:          route.ID(v4ID),
-			Network:     m.fakeIPManager.GetFakeIPBlock(),
-			NetID:       route.NetID(v4ID),
-			Peer:        m.pubKey,
-			NetworkType: route.IPv4Network,
-		}
-		v6ID := uuid.NewString()
-		fakeIPv6Route := &route.Route{
-			ID:          route.ID(v6ID),
-			Network:     m.fakeIPManager.GetFakeIPv6Block(),
-			NetID:       route.NetID(v6ID),
-			Peer:        m.pubKey,
-			NetworkType: route.IPv6Network,
-		}
-		cr = append(cr, fakeIPRoute, fakeIPv6Route)
-		m.notifier.SetFakeIPRoutes([]*route.Route{fakeIPRoute, fakeIPv6Route})
-	}
-
-	m.notifier.SetInitialClientRoutes(cr, routesForComparison)
+func (m *DefaultManager) enableFakeIPRoutes() {
+	m.fakeIPManager = fakeip.NewManager()
+	m.notifier.NotifyRouteChange()
 }
 
 func (m *DefaultManager) setupRefCounters(useNoop bool) {
@@ -464,6 +428,9 @@ func (m *DefaultManager) UpdateRoutes(
 
 	var merr *multierror.Error
 	if !m.disableClientRoutes {
+		if runtime.GOOS == "android" && useNewDNSRoute && m.fakeIPManager == nil {
+			m.enableFakeIPRoutes()
+		}
 
 		// Update route selector based on management server's isSelected status
 		m.updateRouteSelectorFromManagement(clientRoutes)
@@ -500,9 +467,32 @@ func (m *DefaultManager) SetRouteChangeListener(listener listener.NetworkChangeL
 	m.notifier.SetListener(listener)
 }
 
-// InitialRouteRange return the list of initial routes. It used by mobile systems
-func (m *DefaultManager) InitialRouteRange() []string {
-	return m.notifier.GetInitialRouteRanges()
+// CurrentRouteRange returns the current TUN route list. It is used by mobile systems
+func (m *DefaultManager) CurrentRouteRange() []string {
+	m.mux.Lock()
+	defer m.mux.Unlock()
+
+	if m.disableClientRoutes {
+		return nil
+	}
+
+	filtered := m.routeSelector.FilterSelectedExitNodes(m.clientRoutes)
+	var nets []string
+	for _, routes := range filtered {
+		for _, r := range routes {
+			if r.IsDynamic() {
+				continue
+			}
+			nets = append(nets, r.NetString())
+		}
+	}
+
+	if m.fakeIPManager != nil {
+		nets = append(nets, m.fakeIPManager.GetFakeIPBlock().String(), m.fakeIPManager.GetFakeIPv6Block().String())
+	}
+
+	sort.Strings(nets)
+	return nets
 }
 
 // GetRouteSelector returns the route selector
@@ -700,16 +690,6 @@ func (m *DefaultManager) ClassifyRoutes(newRoutes []*route.Route) (map[route.ID]
 	return newServerRoutesMap, newClientRoutesIDMap
 }
 
-func (m *DefaultManager) initialClientRoutes(initialRoutes []*route.Route) []*route.Route {
-	_, crMap := m.ClassifyRoutes(initialRoutes)
-	rs := make([]*route.Route, 0, len(crMap))
-	for _, routes := range crMap {
-		rs = append(rs, routes...)
-	}
-
-	return rs
-}
-
 func isRouteSupported(route *route.Route) bool {
 	if netstack.IsEnabled() || !nbnet.CustomRoutingDisabled() || route.IsDynamic() {
 		return true

client/internal/routemanager/mock.go

@@ -30,8 +30,8 @@ func (m *MockManager) Init() error {
 	return nil
 }
 
-// InitialRouteRange mock implementation of InitialRouteRange from Manager interface
-func (m *MockManager) InitialRouteRange() []string {
+// CurrentRouteRange mock implementation of CurrentRouteRange from Manager interface
+func (m *MockManager) CurrentRouteRange() []string {
 	return nil
 }
 

client/internal/routemanager/notifier/notifier_android.go

@@ -6,7 +6,6 @@ import (
 	"net/netip"
 	"slices"
 	"sort"
-	"strings"
 	"sync"
 
 	"github.com/netbirdio/netbird/client/internal/listener"
@@ -14,12 +13,15 @@ import (
 )
 
 type Notifier struct {
-	initialRoutes []*route.Route
-	currentRoutes []*route.Route
-	fakeIPRoutes  []*route.Route
+	mu sync.Mutex
 
-	listener    listener.NetworkChangeListener
-	listenerMux sync.Mutex
+	// currentRoutes is the last announced route set. It exists only to
+	// suppress noise: without it every network map sync would trigger the
+	// Java side, even when the routes did not change. The actual TUN route
+	// state is owned by the route manager and pulled from there.
+	currentRoutes []*route.Route
+
+	listener listener.NetworkChangeListener
 }
 
 func NewNotifier() *Notifier {
@@ -27,20 +29,15 @@ func NewNotifier() *Notifier {
 }
 
 func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
-	n.listenerMux.Lock()
-	defer n.listenerMux.Unlock()
+	n.mu.Lock()
+	defer n.mu.Unlock()
 	n.listener = listener
 }
 
-// SetInitialClientRoutes stores the initial route sets for TUN configuration.
-func (n *Notifier) SetInitialClientRoutes(initialRoutes []*route.Route, routesForComparison []*route.Route) {
-	n.initialRoutes = filterStatic(initialRoutes)
-	n.currentRoutes = filterStatic(routesForComparison)
-}
-
-// SetFakeIPRoutes stores the fake IP routes to be included in every TUN rebuild.
-func (n *Notifier) SetFakeIPRoutes(routes []*route.Route) {
-	n.fakeIPRoutes = routes
+func (n *Notifier) NotifyRouteChange() {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	n.notifyLocked()
 }
 
 func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
@@ -54,46 +51,32 @@ func (n *Notifier) OnNewRoutes(idMap route.HAMap) {
 		}
 	}
 
-	if !n.hasRouteDiff(n.currentRoutes, newRoutes) {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	if !hasRouteDiff(n.currentRoutes, newRoutes) {
 		return
 	}
 
 	n.currentRoutes = newRoutes
-	n.notify()
+	n.notifyLocked()
 }
 
 func (n *Notifier) OnNewPrefixes([]netip.Prefix) {
 	// Not used on Android
 }
 
-func (n *Notifier) notify() {
-	n.listenerMux.Lock()
-	defer n.listenerMux.Unlock()
+func (n *Notifier) notifyLocked() {
 	if n.listener == nil {
 		return
 	}
-
-	allRoutes := slices.Clone(n.currentRoutes)
-	allRoutes = append(allRoutes, n.fakeIPRoutes...)
-
-	routeStrings := n.routesToStrings(allRoutes)
-	sort.Strings(routeStrings)
-	go func(l listener.NetworkChangeListener) {
-		l.OnNetworkChanged(strings.Join(routeStrings, ","))
-	}(n.listener)
+	n.listener.OnNetworkChanged("")
 }
 
-func filterStatic(routes []*route.Route) []*route.Route {
-	out := make([]*route.Route, 0, len(routes))
-	for _, r := range routes {
-		if !r.IsDynamic() {
-			out = append(out, r)
-		}
-	}
-	return out
+func (n *Notifier) Close() {
+	// unused
 }
 
-func (n *Notifier) routesToStrings(routes []*route.Route) []string {
+func routesToStrings(routes []*route.Route) []string {
 	nets := make([]string, 0, len(routes))
 	for _, r := range routes {
 		nets = append(nets, r.NetString())
@@ -101,25 +84,10 @@ func (n *Notifier) routesToStrings(routes []*route.Route) []string {
 	return nets
 }
 
-func (n *Notifier) hasRouteDiff(a []*route.Route, b []*route.Route) bool {
-	slices.SortFunc(a, func(x, y *route.Route) int {
-		return strings.Compare(x.NetString(), y.NetString())
-	})
-	slices.SortFunc(b, func(x, y *route.Route) int {
-		return strings.Compare(x.NetString(), y.NetString())
-	})
-
-	return !slices.EqualFunc(a, b, func(x, y *route.Route) bool {
-		return x.NetString() == y.NetString()
-	})
-}
-
-func (n *Notifier) GetInitialRouteRanges() []string {
-	initialStrings := n.routesToStrings(n.initialRoutes)
-	sort.Strings(initialStrings)
-	return initialStrings
-}
-
-func (n *Notifier) Close() {
-	// unused
+func hasRouteDiff(a []*route.Route, b []*route.Route) bool {
+	as := routesToStrings(a)
+	bs := routesToStrings(b)
+	sort.Strings(as)
+	sort.Strings(bs)
+	return !slices.Equal(as, bs)
 }

client/internal/routemanager/notifier/notifier_ios.go

@@ -29,11 +29,7 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	n.listener = listener
 }
 
-func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
-	// iOS doesn't care about initial routes
-}
-
-func (n *Notifier) SetFakeIPRoutes([]*route.Route) {
+func (n *Notifier) NotifyRouteChange() {
 	// Not used on iOS
 }
 

client/internal/routemanager/notifier/notifier_other.go

@@ -19,11 +19,7 @@ func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
 	// Not used on non-mobile platforms
 }
 
-func (n *Notifier) SetInitialClientRoutes([]*route.Route, []*route.Route) {
-	// Not used on non-mobile platforms
-}
-
-func (n *Notifier) SetFakeIPRoutes([]*route.Route) {
+func (n *Notifier) NotifyRouteChange() {
 	// Not used on non-mobile platforms
 }
 
@@ -35,10 +31,6 @@ func (n *Notifier) OnNewPrefixes(prefixes []netip.Prefix) {
 	// Not used on non-mobile platforms
 }
 
-func (n *Notifier) GetInitialRouteRanges() []string {
-	return []string{}
-}
-
 func (n *Notifier) Close() {
 	// unused
 }

client/internal/updater/installer/installer_run_darwin.go

@@ -98,47 +98,44 @@ func (u *Installer) startDaemon(daemonFolder string) error {
 func (u *Installer) startUIAsUser() error {
 	log.Infof("starting netbird-ui: %s", uiBinary)
 
-	// Get the current console user
-	cmd := exec.Command("stat", "-f", "%Su", "/dev/console")
-	output, err := cmd.Output()
+	username, err := consoleUser()
 	if err != nil {
-		return fmt.Errorf("failed to get console user: %w", err)
+		return err
 	}
 
-	username := strings.TrimSpace(string(output))
-	if username == "" || username == "root" {
-		return fmt.Errorf("no active user session found")
-	}
-
-	log.Infof("starting UI for user: %s", username)
-
-	// Get user's UID
 	userInfo, err := user.Lookup(username)
 	if err != nil {
-		return fmt.Errorf("failed to lookup user %s: %w", username, err)
+		return fmt.Errorf("lookup user %s: %w", username, err)
 	}
 
-	// Start the UI process as the console user using launchctl
-	// This ensures the app runs in the user's context with proper GUI access
-	launchCmd := exec.Command("launchctl", "asuser", userInfo.Uid, "open", "-a", uiBinary)
+	log.Infof("starting UI for user: %s (uid %s)", username, userInfo.Uid)
+
+	launchCmd := exec.Command("launchctl", "asuser", userInfo.Uid, "sudo", "-u", username, "-H", "open", "-a", uiBinary)
 	log.Infof("launchCmd: %s", launchCmd.String())
-	// Set the user's home directory for proper macOS app behavior
-	launchCmd.Env = append(os.Environ(), "HOME="+userInfo.HomeDir)
-	log.Infof("set HOME environment variable: %s", userInfo.HomeDir)
 
-	if err := launchCmd.Start(); err != nil {
-		return fmt.Errorf("failed to start UI process: %w", err)
-	}
-
-	// Release the process so it can run independently
-	if err := launchCmd.Process.Release(); err != nil {
-		log.Warnf("failed to release UI process: %v", err)
+	if err := launchCmd.Run(); err != nil {
+		return fmt.Errorf("run UI launch: %w", err)
 	}
 
 	log.Infof("netbird-ui started successfully for user %s", username)
 	return nil
 }
 
+func consoleUser() (string, error) {
+	output, err := exec.Command("stat", "-f", "%Su", "/dev/console").Output()
+	if err != nil {
+		return "", fmt.Errorf("get console user: %w", err)
+	}
+
+	username := strings.TrimSpace(string(output))
+	switch username {
+	case "", "root", "loginwindow", "_mbsetupuser":
+		return "", fmt.Errorf("no active GUI user session, console user: %q", username)
+	}
+
+	return username, nil
+}
+
 func (u *Installer) installPkgFile(ctx context.Context, path string) error {
 	log.Infof("installing pkg file: %s", path)
 

client/internal/updater/manager.go

@@ -94,7 +94,7 @@ func (m *Manager) CheckUpdateSuccess(ctx context.Context) {
 			cProto.SystemEvent_ERROR,
 			cProto.SystemEvent_SYSTEM,
 			"Auto-update failed",
-			cProto.NewUserMessage(cProto.UserMsgUpdateFailed, cProto.ArgReason, reason),
+			fmt.Sprintf("Auto-update failed: %s", reason),
 			nil,
 		)
 	}
@@ -115,7 +115,7 @@ func (m *Manager) CheckUpdateSuccess(ctx context.Context) {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"Auto-update completed",
-			cProto.NewUserMessage(cProto.UserMsgUpdateCompleted, cProto.ArgVersion, m.currentVersion),
+			fmt.Sprintf("Your NetBird Client was auto-updated to version %s", m.currentVersion),
 			nil,
 		)
 		return
@@ -272,7 +272,7 @@ func (m *Manager) NotifyUI() {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"New version available",
-			nil,
+			"",
 			map[string]string{"new_version_available": latestVersion.String()},
 		)
 		return
@@ -283,7 +283,7 @@ func (m *Manager) NotifyUI() {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"New version available",
-			nil,
+			"",
 			map[string]string{"new_version_available": pendingVersion.String(), "enforced": "true"},
 		)
 	}
@@ -384,7 +384,7 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 			cProto.SystemEvent_INFO,
 			cProto.SystemEvent_SYSTEM,
 			"New version available",
-			nil,
+			"",
 			map[string]string{"new_version_available": updateVersion.String()},
 		)
 		return
@@ -401,7 +401,7 @@ func (m *Manager) handleUpdate(ctx context.Context) {
 		cProto.SystemEvent_INFO,
 		cProto.SystemEvent_SYSTEM,
 		"New version available",
-		nil,
+		"",
 		map[string]string{"new_version_available": updateVersion.String(), "enforced": "true"},
 	)
 }
@@ -411,14 +411,14 @@ func (m *Manager) install(ctx context.Context, pendingVersion *v.Version) error
 		cProto.SystemEvent_CRITICAL,
 		cProto.SystemEvent_SYSTEM,
 		"Updating client",
-		cProto.NewUserMessage(cProto.UserMsgUpdateInstalling),
+		"Installing update now.",
 		nil,
 	)
 	m.statusRecorder.PublishEvent(
 		cProto.SystemEvent_CRITICAL,
 		cProto.SystemEvent_SYSTEM,
 		"",
-		nil,
+		"",
 		map[string]string{"progress_window": "show", "version": pendingVersion.String()},
 	)
 
@@ -441,7 +441,7 @@ func (m *Manager) install(ctx context.Context, pendingVersion *v.Version) error
 			cProto.SystemEvent_ERROR,
 			cProto.SystemEvent_SYSTEM,
 			"Auto-update failed",
-			cProto.NewUserMessage(cProto.UserMsgUpdateFailed, cProto.ArgReason, err.Error()),
+			fmt.Sprintf("Auto-update failed: %v", err),
 			nil,
 		)
 		return err

client/proto/daemon.pb.go

@@ -3909,30 +3909,14 @@ func (*SubscribeRequest) Descriptor() ([]byte, []int) {
 }
 
 type SystemEvent struct {
-	state    protoimpl.MessageState `protogen:"open.v1"`
-	Id       string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	Severity SystemEvent_Severity   `protobuf:"varint,2,opt,name=severity,proto3,enum=daemon.SystemEvent_Severity" json:"severity,omitempty"`
-	Category SystemEvent_Category   `protobuf:"varint,3,opt,name=category,proto3,enum=daemon.SystemEvent_Category" json:"category,omitempty"`
-	Message  string                 `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
-	// userMessage is the daemon's English rendering of messageKey, kept for the
-	// CLI and for UIs that predate messageKey. UIs that localise read messageKey
-	// and treat this as the fallback.
-	UserMessage string                 `protobuf:"bytes,5,opt,name=userMessage,proto3" json:"userMessage,omitempty"`
-	Timestamp   *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
-	Metadata    map[string]string      `protobuf:"bytes,7,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
-	// messageKey names a user-facing message in a stable, locale-independent
-	// form. A UI resolves it against its own translation bundle and substitutes
-	// messageArgs; an unrecognised key falls back to userMessage. Empty on events
-	// that carry no user-facing text.
-	MessageKey string `protobuf:"bytes,8,opt,name=messageKey,proto3" json:"messageKey,omitempty"`
-	// messageArgs holds the placeholder name/value pairs for messageKey, e.g.
-	// {"version": "0.60.1"} for a "{version}" template. Values are data the
-	// daemon cannot localise (versions, addresses, error text).
-	MessageArgs map[string]string `protobuf:"bytes,9,rep,name=messageArgs,proto3" json:"messageArgs,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
-	// titleKey names the notification title in the same way as messageKey. Empty
-	// when the event has no dedicated title, in which case a UI composes one from
-	// severity and category.
-	TitleKey      string `protobuf:"bytes,10,opt,name=titleKey,proto3" json:"titleKey,omitempty"`
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Severity      SystemEvent_Severity   `protobuf:"varint,2,opt,name=severity,proto3,enum=daemon.SystemEvent_Severity" json:"severity,omitempty"`
+	Category      SystemEvent_Category   `protobuf:"varint,3,opt,name=category,proto3,enum=daemon.SystemEvent_Category" json:"category,omitempty"`
+	Message       string                 `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
+	UserMessage   string                 `protobuf:"bytes,5,opt,name=userMessage,proto3" json:"userMessage,omitempty"`
+	Timestamp     *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	Metadata      map[string]string      `protobuf:"bytes,7,rep,name=metadata,proto3" json:"metadata,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -4016,27 +4000,6 @@ func (x *SystemEvent) GetMetadata() map[string]string {
 	return nil
 }
 
-func (x *SystemEvent) GetMessageKey() string {
-	if x != nil {
-		return x.MessageKey
-	}
-	return ""
-}
-
-func (x *SystemEvent) GetMessageArgs() map[string]string {
-	if x != nil {
-		return x.MessageArgs
-	}
-	return nil
-}
-
-func (x *SystemEvent) GetTitleKey() string {
-	if x != nil {
-		return x.TitleKey
-	}
-	return ""
-}
-
 type GetEventsRequest struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -7369,7 +7332,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x13TracePacketResponse\x12*\n" +
 	"\x06stages\x18\x01 \x03(\v2\x12.daemon.TraceStageR\x06stages\x12+\n" +
 	"\x11final_disposition\x18\x02 \x01(\bR\x10finalDisposition\"\x12\n" +
-	"\x10SubscribeRequest\"\xd7\x05\n" +
+	"\x10SubscribeRequest\"\x93\x04\n" +
 	"\vSystemEvent\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x128\n" +
 	"\bseverity\x18\x02 \x01(\x0e2\x1c.daemon.SystemEvent.SeverityR\bseverity\x128\n" +
@@ -7377,18 +7340,9 @@ const file_daemon_proto_rawDesc = "" +
 	"\amessage\x18\x04 \x01(\tR\amessage\x12 \n" +
 	"\vuserMessage\x18\x05 \x01(\tR\vuserMessage\x128\n" +
 	"\ttimestamp\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\ttimestamp\x12=\n" +
-	"\bmetadata\x18\a \x03(\v2!.daemon.SystemEvent.MetadataEntryR\bmetadata\x12\x1e\n" +
-	"\n" +
-	"messageKey\x18\b \x01(\tR\n" +
-	"messageKey\x12F\n" +
-	"\vmessageArgs\x18\t \x03(\v2$.daemon.SystemEvent.MessageArgsEntryR\vmessageArgs\x12\x1a\n" +
-	"\btitleKey\x18\n" +
-	" \x01(\tR\btitleKey\x1a;\n" +
+	"\bmetadata\x18\a \x03(\v2!.daemon.SystemEvent.MetadataEntryR\bmetadata\x1a;\n" +
 	"\rMetadataEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
-	"\x10MessageArgsEntry\x12\x10\n" +
-	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\":\n" +
 	"\bSeverity\x12\b\n" +
 	"\x04INFO\x10\x00\x12\v\n" +
@@ -7706,7 +7660,7 @@ func file_daemon_proto_rawDescGZIP() []byte {
 }
 
 var file_daemon_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
-var file_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 111)
+var file_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 110)
 var file_daemon_proto_goTypes = []any{
 	(LogLevel)(0),                              // 0: daemon.LogLevel
 	(ExposeProtocol)(0),                        // 1: daemon.ExposeProtocol
@@ -7822,17 +7776,16 @@ var file_daemon_proto_goTypes = []any{
 	nil,                                        // 111: daemon.Network.ResolvedIPsEntry
 	(*PortInfo_Range)(nil),                     // 112: daemon.PortInfo.Range
 	nil,                                        // 113: daemon.SystemEvent.MetadataEntry
-	nil,                                        // 114: daemon.SystemEvent.MessageArgsEntry
-	(*durationpb.Duration)(nil),                // 115: google.protobuf.Duration
-	(*timestamppb.Timestamp)(nil),              // 116: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),                // 114: google.protobuf.Duration
+	(*timestamppb.Timestamp)(nil),              // 115: google.protobuf.Timestamp
 }
 var file_daemon_proto_depIdxs = []int32{
-	115, // 0: daemon.LoginRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
+	114, // 0: daemon.LoginRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
 	25,  // 1: daemon.StatusResponse.fullStatus:type_name -> daemon.FullStatus
-	116, // 2: daemon.StatusResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	116, // 3: daemon.PeerState.connStatusUpdate:type_name -> google.protobuf.Timestamp
-	116, // 4: daemon.PeerState.lastWireguardHandshake:type_name -> google.protobuf.Timestamp
-	115, // 5: daemon.PeerState.latency:type_name -> google.protobuf.Duration
+	115, // 2: daemon.StatusResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	115, // 3: daemon.PeerState.connStatusUpdate:type_name -> google.protobuf.Timestamp
+	115, // 4: daemon.PeerState.lastWireguardHandshake:type_name -> google.protobuf.Timestamp
+	114, // 5: daemon.PeerState.latency:type_name -> google.protobuf.Duration
 	23,  // 6: daemon.SSHServerState.sessions:type_name -> daemon.SSHSessionInfo
 	20,  // 7: daemon.FullStatus.managementState:type_name -> daemon.ManagementState
 	19,  // 8: daemon.FullStatus.signalState:type_name -> daemon.SignalState
@@ -7855,115 +7808,114 @@ var file_daemon_proto_depIdxs = []int32{
 	54,  // 25: daemon.TracePacketResponse.stages:type_name -> daemon.TraceStage
 	2,   // 26: daemon.SystemEvent.severity:type_name -> daemon.SystemEvent.Severity
 	3,   // 27: daemon.SystemEvent.category:type_name -> daemon.SystemEvent.Category
-	116, // 28: daemon.SystemEvent.timestamp:type_name -> google.protobuf.Timestamp
+	115, // 28: daemon.SystemEvent.timestamp:type_name -> google.protobuf.Timestamp
 	113, // 29: daemon.SystemEvent.metadata:type_name -> daemon.SystemEvent.MetadataEntry
-	114, // 30: daemon.SystemEvent.messageArgs:type_name -> daemon.SystemEvent.MessageArgsEntry
-	57,  // 31: daemon.GetEventsResponse.events:type_name -> daemon.SystemEvent
-	115, // 32: daemon.SetConfigRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
-	72,  // 33: daemon.ListProfilesResponse.profiles:type_name -> daemon.Profile
-	116, // 34: daemon.WaitExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
-	1,   // 35: daemon.ExposeServiceRequest.protocol:type_name -> daemon.ExposeProtocol
-	104, // 36: daemon.ExposeServiceEvent.ready:type_name -> daemon.ExposeServiceReady
-	115, // 37: daemon.StartCaptureRequest.duration:type_name -> google.protobuf.Duration
-	115, // 38: daemon.StartBundleCaptureRequest.timeout:type_name -> google.protobuf.Duration
-	30,  // 39: daemon.Network.ResolvedIPsEntry.value:type_name -> daemon.IPList
-	5,   // 40: daemon.DaemonService.Login:input_type -> daemon.LoginRequest
-	7,   // 41: daemon.DaemonService.WaitSSOLogin:input_type -> daemon.WaitSSOLoginRequest
-	9,   // 42: daemon.DaemonService.Up:input_type -> daemon.UpRequest
-	11,  // 43: daemon.DaemonService.Status:input_type -> daemon.StatusRequest
-	11,  // 44: daemon.DaemonService.SubscribeStatus:input_type -> daemon.StatusRequest
-	13,  // 45: daemon.DaemonService.Down:input_type -> daemon.DownRequest
-	15,  // 46: daemon.DaemonService.GetConfig:input_type -> daemon.GetConfigRequest
-	26,  // 47: daemon.DaemonService.ListNetworks:input_type -> daemon.ListNetworksRequest
-	28,  // 48: daemon.DaemonService.SelectNetworks:input_type -> daemon.SelectNetworksRequest
-	28,  // 49: daemon.DaemonService.DeselectNetworks:input_type -> daemon.SelectNetworksRequest
-	4,   // 50: daemon.DaemonService.ForwardingRules:input_type -> daemon.EmptyRequest
-	35,  // 51: daemon.DaemonService.DebugBundle:input_type -> daemon.DebugBundleRequest
-	37,  // 52: daemon.DaemonService.GetLogLevel:input_type -> daemon.GetLogLevelRequest
-	39,  // 53: daemon.DaemonService.SetLogLevel:input_type -> daemon.SetLogLevelRequest
-	44,  // 54: daemon.DaemonService.ListStates:input_type -> daemon.ListStatesRequest
-	46,  // 55: daemon.DaemonService.CleanState:input_type -> daemon.CleanStateRequest
-	48,  // 56: daemon.DaemonService.DeleteState:input_type -> daemon.DeleteStateRequest
-	50,  // 57: daemon.DaemonService.SetSyncResponsePersistence:input_type -> daemon.SetSyncResponsePersistenceRequest
-	53,  // 58: daemon.DaemonService.TracePacket:input_type -> daemon.TracePacketRequest
-	105, // 59: daemon.DaemonService.StartCapture:input_type -> daemon.StartCaptureRequest
-	107, // 60: daemon.DaemonService.StartBundleCapture:input_type -> daemon.StartBundleCaptureRequest
-	109, // 61: daemon.DaemonService.StopBundleCapture:input_type -> daemon.StopBundleCaptureRequest
-	56,  // 62: daemon.DaemonService.SubscribeEvents:input_type -> daemon.SubscribeRequest
-	58,  // 63: daemon.DaemonService.GetEvents:input_type -> daemon.GetEventsRequest
-	41,  // 64: daemon.DaemonService.RegisterUILog:input_type -> daemon.RegisterUILogRequest
-	60,  // 65: daemon.DaemonService.SwitchProfile:input_type -> daemon.SwitchProfileRequest
-	62,  // 66: daemon.DaemonService.SetConfig:input_type -> daemon.SetConfigRequest
-	64,  // 67: daemon.DaemonService.AddProfile:input_type -> daemon.AddProfileRequest
-	66,  // 68: daemon.DaemonService.RenameProfile:input_type -> daemon.RenameProfileRequest
-	68,  // 69: daemon.DaemonService.RemoveProfile:input_type -> daemon.RemoveProfileRequest
-	70,  // 70: daemon.DaemonService.ListProfiles:input_type -> daemon.ListProfilesRequest
-	73,  // 71: daemon.DaemonService.GetActiveProfile:input_type -> daemon.GetActiveProfileRequest
-	75,  // 72: daemon.DaemonService.Logout:input_type -> daemon.LogoutRequest
-	79,  // 73: daemon.DaemonService.GetFeatures:input_type -> daemon.GetFeaturesRequest
-	82,  // 74: daemon.DaemonService.TriggerUpdate:input_type -> daemon.TriggerUpdateRequest
-	84,  // 75: daemon.DaemonService.GetPeerSSHHostKey:input_type -> daemon.GetPeerSSHHostKeyRequest
-	86,  // 76: daemon.DaemonService.RequestJWTAuth:input_type -> daemon.RequestJWTAuthRequest
-	88,  // 77: daemon.DaemonService.WaitJWTToken:input_type -> daemon.WaitJWTTokenRequest
-	90,  // 78: daemon.DaemonService.RequestExtendAuthSession:input_type -> daemon.RequestExtendAuthSessionRequest
-	92,  // 79: daemon.DaemonService.WaitExtendAuthSession:input_type -> daemon.WaitExtendAuthSessionRequest
-	94,  // 80: daemon.DaemonService.DismissSessionWarning:input_type -> daemon.DismissSessionWarningRequest
-	96,  // 81: daemon.DaemonService.StartCPUProfile:input_type -> daemon.StartCPUProfileRequest
-	98,  // 82: daemon.DaemonService.StopCPUProfile:input_type -> daemon.StopCPUProfileRequest
-	100, // 83: daemon.DaemonService.GetInstallerResult:input_type -> daemon.InstallerResultRequest
-	102, // 84: daemon.DaemonService.ExposeService:input_type -> daemon.ExposeServiceRequest
-	77,  // 85: daemon.DaemonService.WailsUIReady:input_type -> daemon.WailsUIReadyRequest
-	6,   // 86: daemon.DaemonService.Login:output_type -> daemon.LoginResponse
-	8,   // 87: daemon.DaemonService.WaitSSOLogin:output_type -> daemon.WaitSSOLoginResponse
-	10,  // 88: daemon.DaemonService.Up:output_type -> daemon.UpResponse
-	12,  // 89: daemon.DaemonService.Status:output_type -> daemon.StatusResponse
-	12,  // 90: daemon.DaemonService.SubscribeStatus:output_type -> daemon.StatusResponse
-	14,  // 91: daemon.DaemonService.Down:output_type -> daemon.DownResponse
-	16,  // 92: daemon.DaemonService.GetConfig:output_type -> daemon.GetConfigResponse
-	27,  // 93: daemon.DaemonService.ListNetworks:output_type -> daemon.ListNetworksResponse
-	29,  // 94: daemon.DaemonService.SelectNetworks:output_type -> daemon.SelectNetworksResponse
-	29,  // 95: daemon.DaemonService.DeselectNetworks:output_type -> daemon.SelectNetworksResponse
-	34,  // 96: daemon.DaemonService.ForwardingRules:output_type -> daemon.ForwardingRulesResponse
-	36,  // 97: daemon.DaemonService.DebugBundle:output_type -> daemon.DebugBundleResponse
-	38,  // 98: daemon.DaemonService.GetLogLevel:output_type -> daemon.GetLogLevelResponse
-	40,  // 99: daemon.DaemonService.SetLogLevel:output_type -> daemon.SetLogLevelResponse
-	45,  // 100: daemon.DaemonService.ListStates:output_type -> daemon.ListStatesResponse
-	47,  // 101: daemon.DaemonService.CleanState:output_type -> daemon.CleanStateResponse
-	49,  // 102: daemon.DaemonService.DeleteState:output_type -> daemon.DeleteStateResponse
-	51,  // 103: daemon.DaemonService.SetSyncResponsePersistence:output_type -> daemon.SetSyncResponsePersistenceResponse
-	55,  // 104: daemon.DaemonService.TracePacket:output_type -> daemon.TracePacketResponse
-	106, // 105: daemon.DaemonService.StartCapture:output_type -> daemon.CapturePacket
-	108, // 106: daemon.DaemonService.StartBundleCapture:output_type -> daemon.StartBundleCaptureResponse
-	110, // 107: daemon.DaemonService.StopBundleCapture:output_type -> daemon.StopBundleCaptureResponse
-	57,  // 108: daemon.DaemonService.SubscribeEvents:output_type -> daemon.SystemEvent
-	59,  // 109: daemon.DaemonService.GetEvents:output_type -> daemon.GetEventsResponse
-	42,  // 110: daemon.DaemonService.RegisterUILog:output_type -> daemon.RegisterUILogResponse
-	61,  // 111: daemon.DaemonService.SwitchProfile:output_type -> daemon.SwitchProfileResponse
-	63,  // 112: daemon.DaemonService.SetConfig:output_type -> daemon.SetConfigResponse
-	65,  // 113: daemon.DaemonService.AddProfile:output_type -> daemon.AddProfileResponse
-	67,  // 114: daemon.DaemonService.RenameProfile:output_type -> daemon.RenameProfileResponse
-	69,  // 115: daemon.DaemonService.RemoveProfile:output_type -> daemon.RemoveProfileResponse
-	71,  // 116: daemon.DaemonService.ListProfiles:output_type -> daemon.ListProfilesResponse
-	74,  // 117: daemon.DaemonService.GetActiveProfile:output_type -> daemon.GetActiveProfileResponse
-	76,  // 118: daemon.DaemonService.Logout:output_type -> daemon.LogoutResponse
-	80,  // 119: daemon.DaemonService.GetFeatures:output_type -> daemon.GetFeaturesResponse
-	83,  // 120: daemon.DaemonService.TriggerUpdate:output_type -> daemon.TriggerUpdateResponse
-	85,  // 121: daemon.DaemonService.GetPeerSSHHostKey:output_type -> daemon.GetPeerSSHHostKeyResponse
-	87,  // 122: daemon.DaemonService.RequestJWTAuth:output_type -> daemon.RequestJWTAuthResponse
-	89,  // 123: daemon.DaemonService.WaitJWTToken:output_type -> daemon.WaitJWTTokenResponse
-	91,  // 124: daemon.DaemonService.RequestExtendAuthSession:output_type -> daemon.RequestExtendAuthSessionResponse
-	93,  // 125: daemon.DaemonService.WaitExtendAuthSession:output_type -> daemon.WaitExtendAuthSessionResponse
-	95,  // 126: daemon.DaemonService.DismissSessionWarning:output_type -> daemon.DismissSessionWarningResponse
-	97,  // 127: daemon.DaemonService.StartCPUProfile:output_type -> daemon.StartCPUProfileResponse
-	99,  // 128: daemon.DaemonService.StopCPUProfile:output_type -> daemon.StopCPUProfileResponse
-	101, // 129: daemon.DaemonService.GetInstallerResult:output_type -> daemon.InstallerResultResponse
-	103, // 130: daemon.DaemonService.ExposeService:output_type -> daemon.ExposeServiceEvent
-	78,  // 131: daemon.DaemonService.WailsUIReady:output_type -> daemon.WailsUIReadyResponse
-	86,  // [86:132] is the sub-list for method output_type
-	40,  // [40:86] is the sub-list for method input_type
-	40,  // [40:40] is the sub-list for extension type_name
-	40,  // [40:40] is the sub-list for extension extendee
-	0,   // [0:40] is the sub-list for field type_name
+	57,  // 30: daemon.GetEventsResponse.events:type_name -> daemon.SystemEvent
+	114, // 31: daemon.SetConfigRequest.dnsRouteInterval:type_name -> google.protobuf.Duration
+	72,  // 32: daemon.ListProfilesResponse.profiles:type_name -> daemon.Profile
+	115, // 33: daemon.WaitExtendAuthSessionResponse.sessionExpiresAt:type_name -> google.protobuf.Timestamp
+	1,   // 34: daemon.ExposeServiceRequest.protocol:type_name -> daemon.ExposeProtocol
+	104, // 35: daemon.ExposeServiceEvent.ready:type_name -> daemon.ExposeServiceReady
+	114, // 36: daemon.StartCaptureRequest.duration:type_name -> google.protobuf.Duration
+	114, // 37: daemon.StartBundleCaptureRequest.timeout:type_name -> google.protobuf.Duration
+	30,  // 38: daemon.Network.ResolvedIPsEntry.value:type_name -> daemon.IPList
+	5,   // 39: daemon.DaemonService.Login:input_type -> daemon.LoginRequest
+	7,   // 40: daemon.DaemonService.WaitSSOLogin:input_type -> daemon.WaitSSOLoginRequest
+	9,   // 41: daemon.DaemonService.Up:input_type -> daemon.UpRequest
+	11,  // 42: daemon.DaemonService.Status:input_type -> daemon.StatusRequest
+	11,  // 43: daemon.DaemonService.SubscribeStatus:input_type -> daemon.StatusRequest
+	13,  // 44: daemon.DaemonService.Down:input_type -> daemon.DownRequest
+	15,  // 45: daemon.DaemonService.GetConfig:input_type -> daemon.GetConfigRequest
+	26,  // 46: daemon.DaemonService.ListNetworks:input_type -> daemon.ListNetworksRequest
+	28,  // 47: daemon.DaemonService.SelectNetworks:input_type -> daemon.SelectNetworksRequest
+	28,  // 48: daemon.DaemonService.DeselectNetworks:input_type -> daemon.SelectNetworksRequest
+	4,   // 49: daemon.DaemonService.ForwardingRules:input_type -> daemon.EmptyRequest
+	35,  // 50: daemon.DaemonService.DebugBundle:input_type -> daemon.DebugBundleRequest
+	37,  // 51: daemon.DaemonService.GetLogLevel:input_type -> daemon.GetLogLevelRequest
+	39,  // 52: daemon.DaemonService.SetLogLevel:input_type -> daemon.SetLogLevelRequest
+	44,  // 53: daemon.DaemonService.ListStates:input_type -> daemon.ListStatesRequest
+	46,  // 54: daemon.DaemonService.CleanState:input_type -> daemon.CleanStateRequest
+	48,  // 55: daemon.DaemonService.DeleteState:input_type -> daemon.DeleteStateRequest
+	50,  // 56: daemon.DaemonService.SetSyncResponsePersistence:input_type -> daemon.SetSyncResponsePersistenceRequest
+	53,  // 57: daemon.DaemonService.TracePacket:input_type -> daemon.TracePacketRequest
+	105, // 58: daemon.DaemonService.StartCapture:input_type -> daemon.StartCaptureRequest
+	107, // 59: daemon.DaemonService.StartBundleCapture:input_type -> daemon.StartBundleCaptureRequest
+	109, // 60: daemon.DaemonService.StopBundleCapture:input_type -> daemon.StopBundleCaptureRequest
+	56,  // 61: daemon.DaemonService.SubscribeEvents:input_type -> daemon.SubscribeRequest
+	58,  // 62: daemon.DaemonService.GetEvents:input_type -> daemon.GetEventsRequest
+	41,  // 63: daemon.DaemonService.RegisterUILog:input_type -> daemon.RegisterUILogRequest
+	60,  // 64: daemon.DaemonService.SwitchProfile:input_type -> daemon.SwitchProfileRequest
+	62,  // 65: daemon.DaemonService.SetConfig:input_type -> daemon.SetConfigRequest
+	64,  // 66: daemon.DaemonService.AddProfile:input_type -> daemon.AddProfileRequest
+	66,  // 67: daemon.DaemonService.RenameProfile:input_type -> daemon.RenameProfileRequest
+	68,  // 68: daemon.DaemonService.RemoveProfile:input_type -> daemon.RemoveProfileRequest
+	70,  // 69: daemon.DaemonService.ListProfiles:input_type -> daemon.ListProfilesRequest
+	73,  // 70: daemon.DaemonService.GetActiveProfile:input_type -> daemon.GetActiveProfileRequest
+	75,  // 71: daemon.DaemonService.Logout:input_type -> daemon.LogoutRequest
+	79,  // 72: daemon.DaemonService.GetFeatures:input_type -> daemon.GetFeaturesRequest
+	82,  // 73: daemon.DaemonService.TriggerUpdate:input_type -> daemon.TriggerUpdateRequest
+	84,  // 74: daemon.DaemonService.GetPeerSSHHostKey:input_type -> daemon.GetPeerSSHHostKeyRequest
+	86,  // 75: daemon.DaemonService.RequestJWTAuth:input_type -> daemon.RequestJWTAuthRequest
+	88,  // 76: daemon.DaemonService.WaitJWTToken:input_type -> daemon.WaitJWTTokenRequest
+	90,  // 77: daemon.DaemonService.RequestExtendAuthSession:input_type -> daemon.RequestExtendAuthSessionRequest
+	92,  // 78: daemon.DaemonService.WaitExtendAuthSession:input_type -> daemon.WaitExtendAuthSessionRequest
+	94,  // 79: daemon.DaemonService.DismissSessionWarning:input_type -> daemon.DismissSessionWarningRequest
+	96,  // 80: daemon.DaemonService.StartCPUProfile:input_type -> daemon.StartCPUProfileRequest
+	98,  // 81: daemon.DaemonService.StopCPUProfile:input_type -> daemon.StopCPUProfileRequest
+	100, // 82: daemon.DaemonService.GetInstallerResult:input_type -> daemon.InstallerResultRequest
+	102, // 83: daemon.DaemonService.ExposeService:input_type -> daemon.ExposeServiceRequest
+	77,  // 84: daemon.DaemonService.WailsUIReady:input_type -> daemon.WailsUIReadyRequest
+	6,   // 85: daemon.DaemonService.Login:output_type -> daemon.LoginResponse
+	8,   // 86: daemon.DaemonService.WaitSSOLogin:output_type -> daemon.WaitSSOLoginResponse
+	10,  // 87: daemon.DaemonService.Up:output_type -> daemon.UpResponse
+	12,  // 88: daemon.DaemonService.Status:output_type -> daemon.StatusResponse
+	12,  // 89: daemon.DaemonService.SubscribeStatus:output_type -> daemon.StatusResponse
+	14,  // 90: daemon.DaemonService.Down:output_type -> daemon.DownResponse
+	16,  // 91: daemon.DaemonService.GetConfig:output_type -> daemon.GetConfigResponse
+	27,  // 92: daemon.DaemonService.ListNetworks:output_type -> daemon.ListNetworksResponse
+	29,  // 93: daemon.DaemonService.SelectNetworks:output_type -> daemon.SelectNetworksResponse
+	29,  // 94: daemon.DaemonService.DeselectNetworks:output_type -> daemon.SelectNetworksResponse
+	34,  // 95: daemon.DaemonService.ForwardingRules:output_type -> daemon.ForwardingRulesResponse
+	36,  // 96: daemon.DaemonService.DebugBundle:output_type -> daemon.DebugBundleResponse
+	38,  // 97: daemon.DaemonService.GetLogLevel:output_type -> daemon.GetLogLevelResponse
+	40,  // 98: daemon.DaemonService.SetLogLevel:output_type -> daemon.SetLogLevelResponse
+	45,  // 99: daemon.DaemonService.ListStates:output_type -> daemon.ListStatesResponse
+	47,  // 100: daemon.DaemonService.CleanState:output_type -> daemon.CleanStateResponse
+	49,  // 101: daemon.DaemonService.DeleteState:output_type -> daemon.DeleteStateResponse
+	51,  // 102: daemon.DaemonService.SetSyncResponsePersistence:output_type -> daemon.SetSyncResponsePersistenceResponse
+	55,  // 103: daemon.DaemonService.TracePacket:output_type -> daemon.TracePacketResponse
+	106, // 104: daemon.DaemonService.StartCapture:output_type -> daemon.CapturePacket
+	108, // 105: daemon.DaemonService.StartBundleCapture:output_type -> daemon.StartBundleCaptureResponse
+	110, // 106: daemon.DaemonService.StopBundleCapture:output_type -> daemon.StopBundleCaptureResponse
+	57,  // 107: daemon.DaemonService.SubscribeEvents:output_type -> daemon.SystemEvent
+	59,  // 108: daemon.DaemonService.GetEvents:output_type -> daemon.GetEventsResponse
+	42,  // 109: daemon.DaemonService.RegisterUILog:output_type -> daemon.RegisterUILogResponse
+	61,  // 110: daemon.DaemonService.SwitchProfile:output_type -> daemon.SwitchProfileResponse
+	63,  // 111: daemon.DaemonService.SetConfig:output_type -> daemon.SetConfigResponse
+	65,  // 112: daemon.DaemonService.AddProfile:output_type -> daemon.AddProfileResponse
+	67,  // 113: daemon.DaemonService.RenameProfile:output_type -> daemon.RenameProfileResponse
+	69,  // 114: daemon.DaemonService.RemoveProfile:output_type -> daemon.RemoveProfileResponse
+	71,  // 115: daemon.DaemonService.ListProfiles:output_type -> daemon.ListProfilesResponse
+	74,  // 116: daemon.DaemonService.GetActiveProfile:output_type -> daemon.GetActiveProfileResponse
+	76,  // 117: daemon.DaemonService.Logout:output_type -> daemon.LogoutResponse
+	80,  // 118: daemon.DaemonService.GetFeatures:output_type -> daemon.GetFeaturesResponse
+	83,  // 119: daemon.DaemonService.TriggerUpdate:output_type -> daemon.TriggerUpdateResponse
+	85,  // 120: daemon.DaemonService.GetPeerSSHHostKey:output_type -> daemon.GetPeerSSHHostKeyResponse
+	87,  // 121: daemon.DaemonService.RequestJWTAuth:output_type -> daemon.RequestJWTAuthResponse
+	89,  // 122: daemon.DaemonService.WaitJWTToken:output_type -> daemon.WaitJWTTokenResponse
+	91,  // 123: daemon.DaemonService.RequestExtendAuthSession:output_type -> daemon.RequestExtendAuthSessionResponse
+	93,  // 124: daemon.DaemonService.WaitExtendAuthSession:output_type -> daemon.WaitExtendAuthSessionResponse
+	95,  // 125: daemon.DaemonService.DismissSessionWarning:output_type -> daemon.DismissSessionWarningResponse
+	97,  // 126: daemon.DaemonService.StartCPUProfile:output_type -> daemon.StartCPUProfileResponse
+	99,  // 127: daemon.DaemonService.StopCPUProfile:output_type -> daemon.StopCPUProfileResponse
+	101, // 128: daemon.DaemonService.GetInstallerResult:output_type -> daemon.InstallerResultResponse
+	103, // 129: daemon.DaemonService.ExposeService:output_type -> daemon.ExposeServiceEvent
+	78,  // 130: daemon.DaemonService.WailsUIReady:output_type -> daemon.WailsUIReadyResponse
+	85,  // [85:131] is the sub-list for method output_type
+	39,  // [39:85] is the sub-list for method input_type
+	39,  // [39:39] is the sub-list for extension type_name
+	39,  // [39:39] is the sub-list for extension extendee
+	0,   // [0:39] is the sub-list for field type_name
 }
 
 func init() { file_daemon_proto_init() }
@@ -7995,7 +7947,7 @@ func file_daemon_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_daemon_proto_rawDesc), len(file_daemon_proto_rawDesc)),
 			NumEnums:      4,
-			NumMessages:   111,
+			NumMessages:   110,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

client/proto/daemon.proto

@@ -677,25 +677,9 @@ message SystemEvent {
   Severity severity = 2;
   Category category = 3;
   string message = 4;
-  // userMessage is the daemon's English rendering of messageKey, kept for the
-  // CLI and for UIs that predate messageKey. UIs that localise read messageKey
-  // and treat this as the fallback.
   string userMessage = 5;
   google.protobuf.Timestamp timestamp = 6;
   map<string, string> metadata = 7;
-  // messageKey names a user-facing message in a stable, locale-independent
-  // form. A UI resolves it against its own translation bundle and substitutes
-  // messageArgs; an unrecognised key falls back to userMessage. Empty on events
-  // that carry no user-facing text.
-  string messageKey = 8;
-  // messageArgs holds the placeholder name/value pairs for messageKey, e.g.
-  // {"version": "0.60.1"} for a "{version}" template. Values are data the
-  // daemon cannot localise (versions, addresses, error text).
-  map<string, string> messageArgs = 9;
-  // titleKey names the notification title in the same way as messageKey. Empty
-  // when the event has no dedicated title, in which case a UI composes one from
-  // severity and category.
-  string titleKey = 10;
 }
 
 message GetEventsRequest {}

client/proto/metadata.go

@@ -43,10 +43,10 @@ const (
 	// UIs to re-fetch their cached config + features. UserMessage is empty so
 	// the change is silent; the source is carried in MetadataSourceKey.
 	MetadataTypeConfigChanged = "config_changed"
-	// MetadataTypePolicyApplied marks an MDM-policy-driven config change. It is
-	// the user-facing half of the pair: the daemon stamps it with the message
-	// and title keys a UI localises, while the paired config_changed event stays
-	// silent and only drives the cache refresh.
+	// MetadataTypePolicyApplied marks an MDM-policy-driven config change. The
+	// daemon stamps it with a (non-localised) UserMessage; the UI suppresses
+	// that and builds its own localised toast off the paired config_changed
+	// event instead.
 	MetadataTypePolicyApplied = "policy_applied"
 
 	// MetadataSourceKey is the SystemEvent.metadata key carrying what

client/proto/usermsg.go

@@ -1,183 +0,0 @@
-package proto
-
-import (
-	"strings"
-
-	log "github.com/sirupsen/logrus"
-)
-
-// UserMessageKey names a piece of user-facing SystemEvent text in a
-// locale-independent form. The daemon has no notion of the user's language, so it
-// publishes the key and lets each UI resolve it.
-//
-// The value doubles as the lookup key in the desktop UI's translation bundles
-// (client/ui/i18n/locales/<code>/common.json), so renaming a constant here means
-// renaming the key in every bundle. The tests in client/ui/i18n lock the two
-// sides together. Keys that predate this mechanism keep their original bundle
-// names so the shipped translations still apply.
-type UserMessageKey string
-
-// Message-body keys published by the daemon. Every key needs an entry in
-// UserMessageTexts below and a translation in the UI bundles.
-const (
-	// UserMsgPanic is the CRITICAL event published from the recover() guard in
-	// the connect loop.
-	UserMsgPanic UserMessageKey = "event.panic"
-
-	// UserMsgDNSRecovered and UserMsgDNSUnreachable bracket a nameserver
-	// group's health transitions.
-	UserMsgDNSRecovered   UserMessageKey = "event.dns.recovered"
-	UserMsgDNSUnreachable UserMessageKey = "event.dns.unreachable"
-
-	// Exit-node (default route) transitions.
-	UserMsgExitNodeConnected           UserMessageKey = "event.exitNode.connected"
-	UserMsgExitNodeDisconnected        UserMessageKey = "event.exitNode.disconnected"
-	UserMsgExitNodeConnectionLost      UserMessageKey = "event.exitNode.connectionLost"
-	UserMsgExitNodeHAChange            UserMessageKey = "event.exitNode.haChange"
-	UserMsgExitNodeDisconnectedUnknown UserMessageKey = "event.exitNode.disconnectedUnknown"
-
-	// Auto-update lifecycle. UserMsgUpdateFailed takes a {reason} argument and
-	// UserMsgUpdateCompleted a {version}.
-	UserMsgUpdateInstalling UserMessageKey = "event.update.installing"
-	UserMsgUpdateCompleted  UserMessageKey = "event.update.completed"
-	UserMsgUpdateFailed     UserMessageKey = "event.update.failed"
-
-	// UserMsgMDMPolicyApplied reports that an MDM policy replaced the config.
-	UserMsgMDMPolicyApplied UserMessageKey = "notify.mdm.policyApplied.body"
-
-	// Session-expiry events. UserMsgSessionExpiresIn takes a {remaining}
-	// argument; the "soon" variant is published when the deadline has already
-	// passed by the time the warning fires.
-	UserMsgSessionExpiresIn      UserMessageKey = "notify.sessionWarning.body"
-	UserMsgSessionExpiresSoon    UserMessageKey = "notify.sessionWarning.bodyGeneric"
-	UserMsgSessionDeadlineReject UserMessageKey = "notify.sessionDeadlineRejected.body"
-)
-
-// Notification-title keys. An event without one leaves titleKey empty and the UI
-// composes a title from severity and category, which is what every event did
-// before message keys existed. These carry no English fallback: a UI old enough
-// to ignore titleKey already builds its own title.
-const (
-	TitleMDMPolicyApplied      UserMessageKey = "notify.mdm.policyApplied.title"
-	TitleSessionWarning        UserMessageKey = "notify.sessionWarning.title"
-	TitleSessionDeadlineReject UserMessageKey = "notify.sessionDeadlineRejected.title"
-)
-
-// UserMessageTitleKeys lists every title key a daemon can publish. It sits next
-// to the constants above because the two must grow together: a title key missing
-// from this slice ships untranslated, and the i18n test that would have caught it
-// reads this list.
-var UserMessageTitleKeys = []UserMessageKey{
-	TitleMDMPolicyApplied,
-	TitleSessionWarning,
-	TitleSessionDeadlineReject,
-}
-
-// ArgReason, ArgVersion and ArgRemaining are the placeholder names used by the
-// templates below. Producers pass them to NewUserMessage; the UI bundles use the
-// same names inside {}.
-const (
-	ArgReason    = "reason"
-	ArgVersion   = "version"
-	ArgRemaining = "remaining"
-)
-
-// UserMessageTexts is the English rendering of every body key, and the source of
-// the SystemEvent.userMessage fallback that the CLI and pre-messageKey UIs read.
-// It must match the en bundle, which the i18n test enforces.
-var UserMessageTexts = map[UserMessageKey]string{
-	UserMsgPanic:                       "The NetBird service panicked. Please restart the service and submit a bug report with the client logs.",
-	UserMsgDNSRecovered:                "DNS servers are reachable again.",
-	UserMsgDNSUnreachable:              "Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
-	UserMsgExitNodeConnected:           "Exit node connected.",
-	UserMsgExitNodeDisconnected:        "Exit node disconnected.",
-	UserMsgExitNodeConnectionLost:      "Exit node connection lost. Your internet access might be affected.",
-	UserMsgExitNodeHAChange:            "Exit node disconnected due to high availability change.",
-	UserMsgExitNodeDisconnectedUnknown: "Exit node disconnected for unknown reasons.",
-	UserMsgUpdateInstalling:            "Installing update now.",
-	UserMsgUpdateCompleted:             "Your NetBird client was auto-updated to version {version}.",
-	UserMsgUpdateFailed:                "Auto-update failed: {reason}",
-	UserMsgMDMPolicyApplied:            "Your NetBird configuration was updated by your IT policy.",
-	UserMsgSessionExpiresIn:            "Your NetBird session expires in {remaining}. Click Extend now to renew.",
-	UserMsgSessionExpiresSoon:          "Your NetBird session is about to expire. Click Extend now to renew.",
-	UserMsgSessionDeadlineReject:       "The server sent an invalid session deadline. Please sign in again.",
-}
-
-// UserMessage is a localizable user-facing event message: a stable body key, an
-// optional title key, and the placeholder values to substitute. A nil
-// *UserMessage carries no user-facing text, which is how internal control events
-// are published.
-type UserMessage struct {
-	key   UserMessageKey
-	title UserMessageKey
-	args  map[string]string
-}
-
-// NewUserMessage builds a UserMessage from key and flat placeholder name/value
-// pairs, e.g. NewUserMessage(UserMsgUpdateCompleted, ArgVersion, "0.60.1"). An
-// unpaired trailing argument is dropped.
-func NewUserMessage(key UserMessageKey, args ...string) *UserMessage {
-	m := &UserMessage{key: key}
-	if len(args)%2 != 0 {
-		log.Debugf("user message %q: placeholder args not paired: %d items, last dropped", key, len(args))
-		args = args[:len(args)-1]
-	}
-	if len(args) > 0 {
-		m.args = make(map[string]string, len(args)/2)
-		for i := 0; i < len(args); i += 2 {
-			m.args[args[i]] = args[i+1]
-		}
-	}
-	return m
-}
-
-// WithTitle attaches a notification title key and returns m, so it chains onto
-// NewUserMessage.
-func (m *UserMessage) WithTitle(key UserMessageKey) *UserMessage {
-	m.title = key
-	return m
-}
-
-// Key returns the body key, or the empty key for a nil message.
-func (m *UserMessage) Key() UserMessageKey {
-	if m == nil {
-		return ""
-	}
-	return m.key
-}
-
-// TitleKey returns the title key, which is empty unless WithTitle was called.
-func (m *UserMessage) TitleKey() UserMessageKey {
-	if m == nil {
-		return ""
-	}
-	return m.title
-}
-
-// Args returns the placeholder values, or nil for a nil message. The map is the
-// message's own and must not be mutated by the caller; it is handed straight to
-// SystemEvent.messageArgs.
-func (m *UserMessage) Args() map[string]string {
-	if m == nil {
-		return nil
-	}
-	return m.args
-}
-
-// Text renders the English fallback for m, with placeholders substituted. A nil
-// message, or a key with no registered template, renders empty so a UI treats
-// the event as carrying no user-facing text.
-func (m *UserMessage) Text() string {
-	if m == nil {
-		return ""
-	}
-	tmpl, ok := UserMessageTexts[m.key]
-	if !ok {
-		log.Warnf("no English template for user message key %q", m.key)
-		return ""
-	}
-	for name, value := range m.args {
-		tmpl = strings.ReplaceAll(tmpl, "{"+name+"}", value)
-	}
-	return tmpl
-}

client/proto/usermsg_test.go

@@ -1,91 +0,0 @@
-package proto
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestUserMessageText(t *testing.T) {
-	tests := []struct {
-		name string
-		msg  *UserMessage
-		want string
-	}{
-		{
-			name: "no placeholders",
-			msg:  NewUserMessage(UserMsgExitNodeConnected),
-			want: "Exit node connected.",
-		},
-		{
-			name: "placeholder substituted",
-			msg:  NewUserMessage(UserMsgUpdateCompleted, ArgVersion, "0.60.1"),
-			want: "Your NetBird client was auto-updated to version 0.60.1.",
-		},
-		{
-			// A dangling arg is a caller mistake; dropping it must still yield a
-			// readable sentence rather than panicking on the wire path.
-			name: "unpaired trailing arg dropped",
-			msg:  NewUserMessage(UserMsgUpdateFailed, ArgReason, "disk full", "extra"),
-			want: "Auto-update failed: disk full",
-		},
-		{
-			name: "unknown key renders empty so the UI treats the event as silent",
-			msg:  NewUserMessage("event.notRegistered"),
-			want: "",
-		},
-		{
-			name: "nil message carries no text",
-			msg:  nil,
-			want: "",
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.want, tc.msg.Text())
-		})
-	}
-}
-
-// A nil *UserMessage is how every internal control event is published, so the
-// accessors must stay usable without a nil check at each of the ~25 call sites.
-func TestNilUserMessageAccessors(t *testing.T) {
-	var msg *UserMessage
-
-	assert.Empty(t, msg.Key(), "nil message must have no body key")
-	assert.Empty(t, msg.TitleKey(), "nil message must have no title key")
-	assert.Nil(t, msg.Args(), "nil message must have no args")
-	assert.Empty(t, msg.Text(), "nil message must render empty")
-}
-
-func TestUserMessageArgsAndTitle(t *testing.T) {
-	msg := NewUserMessage(UserMsgSessionExpiresIn, ArgRemaining, "10m").
-		WithTitle(TitleSessionWarning)
-
-	assert.Equal(t, UserMsgSessionExpiresIn, msg.Key())
-	assert.Equal(t, TitleSessionWarning, msg.TitleKey())
-	assert.Equal(t, map[string]string{ArgRemaining: "10m"}, msg.Args())
-	assert.Equal(t, "Your NetBird session expires in 10m. Click Extend now to renew.", msg.Text())
-}
-
-// Every registered template must be reachable: a key whose text is empty would
-// publish an event with a key but no fallback for the CLI and older UIs.
-func TestUserMessageTextsAreNonEmpty(t *testing.T) {
-	texts := UserMessageTexts
-	assert.NotEmpty(t, texts, "the catalog must not be empty")
-
-	for key, text := range texts {
-		assert.NotEmpty(t, text, "message key %q has an empty template", key)
-		assert.NotEmpty(t, key, "the catalog must not contain an empty key")
-	}
-}
-
-func TestUserMessageTitleKeysAreUnique(t *testing.T) {
-	seen := make(map[UserMessageKey]struct{})
-	for _, key := range UserMessageTitleKeys {
-		assert.NotEmpty(t, key, "title keys must not be empty")
-		_, dup := seen[key]
-		assert.False(t, dup, "title key %q listed twice", key)
-		seen[key] = struct{}{}
-	}
-}

client/server/login_outcome_test.go

@@ -0,0 +1,110 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/internal"
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// A login that never reached Management is not a decision about the peer's
+// credentials, so it must come back as a retryable error rather than an SSO
+// prompt: the user cannot finish a browser login while Management is down, and
+// the CLI's own backoff resolves the outage on its own once the daemon reports
+// the failure. Reproduces `netbird down; netbird up` printing a device-code URL
+// because Management happened to be restarting when the daemon dialed it.
+func TestLogin_ManagementUnreachableIsReturnedInsteadOfDemandingSSO(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	unreachable := errors.New("create connection: dial context: context deadline exceeded")
+	attempts := 0
+	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+		attempts++
+		return false, unreachable
+	}
+
+	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
+	require.Error(t, err)
+	require.ErrorIs(t, err, unreachable, "the transport failure was replaced by something else")
+	require.Nil(t, resp, "a failed login must not answer with a login response")
+	require.Equal(t, 1, attempts)
+	require.Nil(t, s.oauthAuthFlow.flow, "the daemon started an SSO flow for a peer whose login was never decided")
+
+	status, err := internal.CtxGetState(s.rootCtx).Status()
+	require.NoError(t, err)
+	require.Equal(t, internal.StatusLoginFailed, status,
+		"a peer that could not reach Management is not waiting on a login")
+}
+
+// The counterpart: Management refusing the peer's credentials is a decision, and
+// the SSO flow still has to start for it. The profile carries an unusable
+// private key so the flow setup fails immediately instead of dialing, which is
+// enough to show the branch was entered — the refusal itself is never what comes
+// back out.
+func TestLogin_AuthRefusalStartsSSOFlow(t *testing.T) {
+	s, _, _, username, cfgPath := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+	breakProfilePrivateKey(t, cfgPath)
+
+	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+		return true, nil
+	}
+
+	_, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username})
+	require.Error(t, err)
+
+	status, stateErr := internal.CtxGetState(s.rootCtx).Status()
+	require.NoError(t, stateErr)
+	require.Equal(t, internal.StatusLoginFailed, status,
+		"the SSO flow setup was never reached with the broken key")
+}
+
+func TestLogin_SetupKeyStillRunsWhenPeerNeedsLogin(t *testing.T) {
+	s, _, _, username, _ := setupServerWithProfile(t)
+	s.rootCtx = internal.CtxInitState(context.Background())
+
+	s.isLoginRequiredFn = func(context.Context) (bool, error) {
+		return true, nil
+	}
+
+	var keysTried []string
+	s.loginAttemptFn = func(_ context.Context, setupKey, _ string) (internal.StatusType, error) {
+		keysTried = append(keysTried, setupKey)
+		return "", nil
+	}
+
+	setupKey := "A2C8E32F-AEB2-4B45-8FD3-8A0C1B2D3E4F"
+	resp, err := s.Login(userCtx(), &proto.LoginRequest{Username: &username, SetupKey: setupKey})
+	require.NoError(t, err, "the probe's outcome leaked out as the login result")
+	require.NotNil(t, resp)
+	require.Equal(t, []string{setupKey}, keysTried, "the setup key never reached the login attempt")
+	require.Nil(t, s.oauthAuthFlow.flow, "a setup-key login started an SSO flow")
+
+	status, err := internal.CtxGetState(s.rootCtx).Status()
+	require.NoError(t, err)
+	require.Equal(t, internal.StatusIdle, status)
+}
+
+// breakProfilePrivateKey replaces the profile's private key with an unparseable
+// one, which makes any attempt to build a Management client fail on the spot.
+func breakProfilePrivateKey(t *testing.T, cfgPath string) {
+	t.Helper()
+
+	raw, err := os.ReadFile(cfgPath)
+	require.NoError(t, err)
+
+	var cfg map[string]any
+	require.NoError(t, json.Unmarshal(raw, &cfg))
+	cfg["PrivateKey"] = "not-a-key"
+
+	patched, err := json.Marshal(cfg)
+	require.NoError(t, err)
+	require.NoError(t, os.WriteFile(cfgPath, patched, 0o600))
+}

client/server/mdm.go

@@ -94,12 +94,12 @@ func (s *Server) onMDMPolicyChange(_, _ *mdm.Policy) error {
 	// publishConfigChangedEvent has already fired inside
 	// restartEngineForMDMLocked with source="mdm". Emit an MDM-specific
 	// user-visible toast so the operator knows their IT policy was
-	// applied; the message and title keys let the GUI localise it.
+	// applied (UserMessage != "" triggers the GUI notifier).
 	s.statusRecorder.PublishEvent(
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"MDM policy applied",
-		proto.NewUserMessage(proto.UserMsgMDMPolicyApplied).WithTitle(proto.TitleMDMPolicyApplied),
+		"NetBird configuration was updated by your IT policy.",
 		map[string]string{
 			proto.MetadataSourceKey: proto.MetadataSourceMDM,
 			proto.MetadataTypeKey:   proto.MetadataTypePolicyApplied,
@@ -126,7 +126,7 @@ func (s *Server) publishConfigChangedEvent(source string) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		fmt.Sprintf("daemon config changed (source=%s)", source),
-		nil,
+		"",
 		map[string]string{
 			proto.MetadataSourceKey: source,
 			proto.MetadataTypeKey:   proto.MetadataTypeConfigChanged,

client/server/network.go

@@ -170,7 +170,7 @@ func (s *Server) SelectNetworks(_ context.Context, req *proto.SelectNetworksRequ
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Network selection changed",
-		nil,
+		"",
 		map[string]string{
 			"networks": strings.Join(req.GetNetworkIDs(), ", "),
 			"append":   fmt.Sprint(req.GetAppend()),
@@ -214,7 +214,7 @@ func (s *Server) DeselectNetworks(_ context.Context, req *proto.SelectNetworksRe
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Network deselection changed",
-		nil,
+		"",
 		map[string]string{
 			"networks": strings.Join(req.GetNetworkIDs(), ", "),
 			"append":   fmt.Sprint(req.GetAppend()),
@@ -232,3 +232,4 @@ func toNetIDs(routes []string) []route.NetID {
 	}
 	return netIDs
 }
+

client/server/server.go

@@ -135,6 +135,13 @@ type Server struct {
 	updateManager *updater.Manager
 
 	jwtCache *jwtCache
+
+	// loginAttemptFn stands in for the Management login round trip. Tests set
+	// it to drive the login outcomes that need a server on the other end;
+	// production leaves it nil, and every login goes through loginAttempt.
+	loginAttemptFn func(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error)
+
+	isLoginRequiredFn func(ctx context.Context) (bool, error)
 }
 
 type oauthAuthFlow struct {
@@ -370,7 +377,34 @@ func (s *Server) connectionGoroutineRunning() bool {
 	}
 }
 
-// loginAttempt attempts to login using the provided information. it returns a status in case something fails
+// attemptLogin runs a login round trip against Management, or the stand-in a
+// test installed in place of it.
+func (s *Server) attemptLogin(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
+	if s.loginAttemptFn != nil {
+		return s.loginAttemptFn(ctx, setupKey, jwtToken)
+	}
+	return s.loginAttempt(ctx, setupKey, jwtToken)
+}
+
+func (s *Server) isLoginRequired(ctx context.Context) (bool, error) {
+	if s.isLoginRequiredFn != nil {
+		return s.isLoginRequiredFn(ctx)
+	}
+
+	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
+	if err != nil {
+		log.Errorf("failed to create auth client: %v", err)
+		return false, err
+	}
+	defer authClient.Close()
+
+	return authClient.IsLoginRequired(ctx)
+}
+
+// loginAttempt attempts to login using the provided information. It returns
+// StatusNeedsLogin when Management refused the peer's credentials and
+// StatusLoginFailed for every other failure, so callers can tell an
+// authentication decision apart from a login that never got made.
 func (s *Server) loginAttempt(ctx context.Context, setupKey, jwtToken string) (internal.StatusType, error) {
 	authClient, err := auth.NewAuth(ctx, s.config.PrivateKey, s.config.ManagementURL, s.config)
 	if err != nil {
@@ -623,7 +657,19 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.config = config
 	s.mutex.Unlock()
 
-	if _, err := s.loginAttempt(ctx, "", ""); err == nil {
+	// A probe that errors leaves the login undecided: Management unreachable, a
+	// restart mid-request, an internal error. Those are returned for the caller
+	// to retry, because turning them into an SSO prompt asks the user to solve
+	// something that is not theirs to solve, and a browser login cannot succeed
+	// while Management is unreachable anyway. Only Management refusing the
+	// peer's key is a decision, and IsLoginRequired reports that as
+	// needsLogin=true rather than an error.
+	needsLogin, err := s.isLoginRequired(ctx)
+	if err != nil {
+		state.Set(internal.StatusLoginFailed)
+		return nil, err
+	}
+	if !needsLogin {
 		state.Set(internal.StatusIdle)
 		return &proto.LoginResponse{}, nil
 	}
@@ -684,7 +730,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	// which returns NeedsLogin and parks on the browser leg.
 	state.Set(internal.StatusConnecting)
 
-	if loginStatus, err := s.loginAttempt(ctx, msg.SetupKey, ""); err != nil {
+	if loginStatus, err := s.attemptLogin(ctx, msg.SetupKey, ""); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -839,7 +885,7 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 	s.oauthAuthFlow.expiresAt = time.Now()
 	s.mutex.Unlock()
 
-	if loginStatus, err := s.loginAttempt(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
+	if loginStatus, err := s.attemptLogin(ctx, "", tokenInfo.GetTokenToUse()); err != nil {
 		state.Set(loginStatus)
 		return nil, err
 	}
@@ -1769,6 +1815,9 @@ func (s *Server) RequestExtendAuthSession(
 	if connectClient == nil {
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "client is not running")
 	}
+	if connectClient.Engine() == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "session can no longer be extended, log in again to reconnect")
+	}
 
 	hint := ""
 	if msg.Hint != nil {
@@ -2181,7 +2230,7 @@ func (s *Server) publishProfileListChanged(profileName string) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Profile list changed",
-		nil,
+		"",
 		map[string]string{proto.MetadataKindKey: proto.MetadataKindProfileListChanged, proto.MetadataProfileKey: profileName},
 	)
 }
@@ -2200,7 +2249,7 @@ func (s *Server) publishLogLevelChanged(level string) {
 		proto.SystemEvent_INFO,
 		proto.SystemEvent_SYSTEM,
 		"Log level changed",
-		nil,
+		"",
 		map[string]string{proto.MetadataKindKey: proto.MetadataKindLogLevelChanged, proto.MetadataLevelKey: level},
 	)
 }

client/ui/build/linux/nfpm/nfpm.yaml

@@ -26,17 +26,17 @@ contents:
 
 # Default dependencies for the GTK4 + WebKitGTK 6.0 stack (Ubuntu 24.04+ / Debian 13+)
 depends:
-  - libgtk-4-1
+  - libgtk-4-1 (>= 4.14)
   - libwebkitgtk-6.0-4
   - xdg-utils
 
 # Distribution-specific overrides for different package formats
 overrides:
-  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux
+  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux / openSUSE
   rpm:
     depends:
-      - gtk4
-      - webkitgtk6.0
+      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
+      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
       - xdg-utils
 
   # Arch Linux packages

client/ui/frontend/src/lib/connection.ts

@@ -43,7 +43,12 @@ function buildSsoCancelPromise(state: SsoState, signal?: AbortSignal): Promise<v
 }
 
 async function runSsoLogin(
-    result: { verificationUri: string; verificationUriComplete: string; userCode: string },
+    result: {
+        verificationUri: string;
+        verificationUriComplete: string;
+        userCode: string;
+        profileId: string;
+    },
     state: SsoState,
     signal?: AbortSignal,
 ): Promise<void> {
@@ -56,7 +61,7 @@ async function runSsoLogin(
     // suspended, so a frontend-driven Up (a promise continuation) would not
     // fire until the user woke the window (e.g. hovering the tray icon).
     const waitPromise = Connection.WaitSSOLoginAndUp(
-        { userCode: result.userCode, hostname: "" },
+        { userCode: result.userCode, hostname: "", profileId: result.profileId },
         { profileName: "", username: "" },
     );
 

client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx

@@ -11,7 +11,7 @@ import { DialogHeading } from "@/components/dialog/DialogHeading";
 import { SquareIcon } from "@/components/SquareIcon";
 import { Connection, Profiles as ProfilesSvc, Session, WindowManager } from "@bindings/services";
 import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
-import { EVENT_BROWSER_LOGIN_CANCEL } from "@/lib/connection";
+import { EVENT_BROWSER_LOGIN_CANCEL, EVENT_TRIGGER_LOGIN } from "@/lib/connection";
 import { errorDialog, formatErrorMessage } from "@/lib/errors.ts";
 import { formatRemaining } from "@/lib/formatters";
 
@@ -131,6 +131,21 @@ export default function SessionExpirationDialog() {
         }
     }, [busy, t]);
 
+    const authenticate = useCallback(async () => {
+        if (busy) return;
+        setBusy(true);
+        try {
+            await Events.Emit(EVENT_TRIGGER_LOGIN);
+            await WindowManager.CloseSessionExpiration();
+        } catch (e) {
+            setBusy(false);
+            await errorDialog({
+                Title: t("connect.error.loginTitle"),
+                Message: formatErrorMessage(e),
+            });
+        }
+    }, [busy, t]);
+
     const logout = useCallback(async () => {
         if (busy) return;
         setBusy(true);
@@ -185,7 +200,7 @@ export default function SessionExpirationDialog() {
                     variant={"primary"}
                     size={"md"}
                     className={"w-full"}
-                    onClick={stay}
+                    onClick={expired ? authenticate : stay}
                     disabled={busy}
                 >
                     {expired ? t("sessionExpiration.authenticate") : t("sessionExpiration.stay")}

client/ui/i18n/TRANSLATING.md

@@ -40,12 +40,6 @@ i18n/locales/<code>/common.json  a target — message only
 
 Chrome-extension JSON, each key → `{ "message", "description" }`. You translate the **`message`**.
 
-The `event.*` keys are a special group: the background service names them when it
-publishes a notification, and the app looks them up here. Their names are part of
-a Go↔JSON contract (`client/proto/usermsg.go`), so they are even less renameable
-than the rest — and a missing one shows the user English. Tests fail the build if
-any locale drops one.
-
 | ✅ Do | ❌ Don't |
 |---|---|
 | Keep **every key** from `en`, in the same order | Translate, rename, reorder, drop, or add keys (they're identifiers; the set grows over time) |

client/ui/i18n/bundle.go

@@ -126,29 +126,18 @@ func (b *Bundle) BundleFor(code LanguageCode) (map[string]string, error) {
 // pairs ("version", "1.2.3" replaces "{version}"). Unknown keys fall back to
 // the default language, then to the key itself so a miss is visible in the UI.
 func (b *Bundle) Translate(lang LanguageCode, key string, args ...string) string {
-	if v, ok := b.Lookup(lang, key, args...); ok {
-		return v
-	}
-	return key
-}
-
-// Lookup resolves key like Translate but reports whether it was found in the
-// requested or the default bundle. Callers holding a better fallback than the
-// raw key — a daemon-supplied English string for a key this build predates —
-// use this to tell a miss from a hit.
-func (b *Bundle) Lookup(lang LanguageCode, key string, args ...string) (string, bool) {
 	b.mu.RLock()
 	defer b.mu.RUnlock()
 
 	if v, ok := b.bundles[lang][key]; ok {
-		return applyPlaceholders(v, args), true
+		return applyPlaceholders(v, args)
 	}
 	if lang != DefaultLanguage {
 		if v, ok := b.bundles[DefaultLanguage][key]; ok {
-			return applyPlaceholders(v, args), true
+			return applyPlaceholders(v, args)
 		}
 	}
-	return "", false
+	return key
 }
 
 // applyPlaceholders substitutes {name} in s using args as flat name/value

client/ui/i18n/eventkeys_test.go

@@ -1,126 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package i18n
-
-import (
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// shippedBundle loads the real locale tree rather than the fstest fixture the
-// other tests use: these checks exist to catch a key the daemon publishes but no
-// bundle translates, which only the shipped files can prove.
-func shippedBundle(t *testing.T) *Bundle {
-	t.Helper()
-	b, err := NewBundle(os.DirFS("locales"))
-	require.NoError(t, err, "the shipped locale tree must load")
-	return b
-}
-
-// The daemon publishes a message key and each UI resolves it locally, so a key
-// with no en entry degrades to the daemon's English fallback and silently stops
-// being translatable. Fail the build instead.
-func TestUserMessageKeysExistInEnglishBundle(t *testing.T) {
-	b := shippedBundle(t)
-
-	for key, text := range proto.UserMessageTexts {
-		got, ok := b.Lookup(DefaultLanguage, string(key))
-		if !assert.True(t, ok, "message key %q has no en translation", key) {
-			continue
-		}
-		assert.Equal(t, text, got,
-			"en translation of %q must match the daemon's English fallback", key)
-	}
-}
-
-func TestUserMessageTitleKeysExistInEnglishBundle(t *testing.T) {
-	b := shippedBundle(t)
-
-	for _, key := range proto.UserMessageTitleKeys {
-		_, ok := b.Lookup(DefaultLanguage, string(key))
-		assert.True(t, ok, "title key %q has no en translation", key)
-	}
-}
-
-// Every shipped locale must translate the daemon's keys, not just en. A missing
-// one still renders (Lookup falls back to en) but the notification would show up
-// in English for that user, which is the bug this whole mechanism exists to fix.
-func TestUserMessageKeysTranslatedInEveryLanguage(t *testing.T) {
-	b := shippedBundle(t)
-
-	keys := make([]proto.UserMessageKey, 0, len(proto.UserMessageTexts))
-	for key := range proto.UserMessageTexts {
-		keys = append(keys, key)
-	}
-	keys = append(keys, proto.UserMessageTitleKeys...)
-
-	for _, lang := range b.Languages() {
-		bundle, err := b.BundleFor(lang.Code)
-		require.NoError(t, err, "BundleFor(%q)", lang.Code)
-
-		for _, key := range keys {
-			text, ok := bundle[string(key)]
-			if !assert.True(t, ok, "locale %q is missing key %q", lang.Code, key) {
-				continue
-			}
-			assert.NotEmpty(t, text, "locale %q has an empty message for %q", lang.Code, key)
-		}
-	}
-}
-
-// The tray composes a title from these when an event carries no title key, so a
-// gap here would render "event.severity.warning: DNS" to the user.
-func TestEventTitleKeysTranslatedInEveryLanguage(t *testing.T) {
-	b := shippedBundle(t)
-
-	keys := []string{
-		"event.title",
-		"event.severity.info", "event.severity.warning",
-		"event.severity.error", "event.severity.critical",
-		"event.category.network", "event.category.dns",
-		"event.category.authentication", "event.category.connectivity",
-		"event.category.system",
-	}
-
-	for _, lang := range b.Languages() {
-		bundle, err := b.BundleFor(lang.Code)
-		require.NoError(t, err, "BundleFor(%q)", lang.Code)
-
-		for _, key := range keys {
-			text, ok := bundle[key]
-			if !assert.True(t, ok, "locale %q is missing key %q", lang.Code, key) {
-				continue
-			}
-			assert.NotEmpty(t, text, "locale %q has an empty message for %q", lang.Code, key)
-		}
-	}
-
-	// The composed title is useless without both slots.
-	title, ok := b.Lookup(DefaultLanguage, "event.title", "severity", "Warning", "category", "DNS")
-	require.True(t, ok)
-	assert.Equal(t, "Warning: DNS", title, "event.title must substitute both placeholders")
-}
-
-func TestBundleLookupReportsMisses(t *testing.T) {
-	b, err := NewBundle(fakeLocales())
-	require.NoError(t, err)
-
-	got, ok := b.Lookup("en", "tray.menu.connect")
-	assert.True(t, ok)
-	assert.Equal(t, "Connect", got)
-
-	// An absent key must report a miss rather than echo the key, so callers can
-	// substitute their own fallback.
-	got, ok = b.Lookup("en", "tray.missing")
-	assert.False(t, ok, "unknown key must report a miss")
-	assert.Empty(t, got, "a miss must not return the key")
-
-	// Empty keys reach Lookup from events that carry no title key at all.
-	_, ok = b.Lookup("en", "")
-	assert.False(t, ok, "empty key must report a miss")
-}

client/ui/i18n/locales/de/common.json

@@ -179,69 +179,6 @@
     "notify.mdm.policyApplied.body": {
         "message": "Ihre NetBird-Konfiguration wurde durch Ihre IT-Richtlinie aktualisiert."
     },
-    "event.title": {
-        "message": "{severity}: {category}"
-    },
-    "event.severity.info": {
-        "message": "Info"
-    },
-    "event.severity.warning": {
-        "message": "Warnung"
-    },
-    "event.severity.error": {
-        "message": "Fehler"
-    },
-    "event.severity.critical": {
-        "message": "Kritisch"
-    },
-    "event.category.network": {
-        "message": "Netzwerk"
-    },
-    "event.category.dns": {
-        "message": "DNS"
-    },
-    "event.category.authentication": {
-        "message": "Authentifizierung"
-    },
-    "event.category.connectivity": {
-        "message": "Konnektivität"
-    },
-    "event.category.system": {
-        "message": "System"
-    },
-    "event.panic": {
-        "message": "Der NetBird-Dienst ist abgestürzt. Bitte starten Sie den Dienst neu und senden Sie einen Fehlerbericht mit den Client-Protokollen."
-    },
-    "event.dns.recovered": {
-        "message": "DNS-Server sind wieder erreichbar."
-    },
-    "event.dns.unreachable": {
-        "message": "Ein oder mehrere DNS-Server sind nicht erreichbar. Das kann die Verbindung zu einigen Diensten beeinträchtigen."
-    },
-    "event.exitNode.connected": {
-        "message": "Exit Node verbunden."
-    },
-    "event.exitNode.disconnected": {
-        "message": "Exit Node getrennt."
-    },
-    "event.exitNode.connectionLost": {
-        "message": "Verbindung zum Exit Node verloren. Ihr Internetzugang kann beeinträchtigt sein."
-    },
-    "event.exitNode.haChange": {
-        "message": "Exit Node aufgrund einer Änderung der Hochverfügbarkeit getrennt."
-    },
-    "event.exitNode.disconnectedUnknown": {
-        "message": "Exit Node aus unbekannten Gründen getrennt."
-    },
-    "event.update.installing": {
-        "message": "Update wird jetzt installiert."
-    },
-    "event.update.completed": {
-        "message": "Ihr NetBird-Client wurde automatisch auf Version {version} aktualisiert."
-    },
-    "event.update.failed": {
-        "message": "Automatisches Update fehlgeschlagen: {reason}"
-    },
     "common.cancel": {
         "message": "Abbrechen"
     },

client/ui/i18n/locales/en/common.json

@@ -239,90 +239,6 @@
         "message": "Your NetBird configuration was updated by your IT policy.",
         "description": "Body of the MDM policy-applied notification, telling the user their settings were changed by their organization's device-management policy."
     },
-    "event.title": {
-        "message": "{severity}: {category}",
-        "description": "Notification title for a daemon event, composed from severity and category, e.g. \"Warning: DNS\". Keep both placeholders; use your locale's colon spacing."
-    },
-    "event.severity.info": {
-        "message": "Info",
-        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
-    },
-    "event.severity.warning": {
-        "message": "Warning",
-        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
-    },
-    "event.severity.error": {
-        "message": "Error",
-        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
-    },
-    "event.severity.critical": {
-        "message": "Critical",
-        "description": "Severity label used in the {severity} slot of event.title. Keep it short."
-    },
-    "event.category.network": {
-        "message": "Network",
-        "description": "Event category label used in the {category} slot of event.title. Refers to the overlay network."
-    },
-    "event.category.dns": {
-        "message": "DNS",
-        "description": "Event category label used in the {category} slot of event.title. Acronym, do not translate."
-    },
-    "event.category.authentication": {
-        "message": "Authentication",
-        "description": "Event category label used in the {category} slot of event.title. Refers to signing in to the management server."
-    },
-    "event.category.connectivity": {
-        "message": "Connectivity",
-        "description": "Event category label used in the {category} slot of event.title. Refers to reaching peers."
-    },
-    "event.category.system": {
-        "message": "System",
-        "description": "Event category label used in the {category} slot of event.title. Refers to the local machine and the NetBird service."
-    },
-    "event.panic": {
-        "message": "The NetBird service panicked. Please restart the service and submit a bug report with the client logs.",
-        "description": "Notification body after the NetBird background service crashed. \"Service\" is the daemon, not a remote service."
-    },
-    "event.dns.recovered": {
-        "message": "DNS servers are reachable again.",
-        "description": "Notification body when previously unreachable upstream DNS servers respond again."
-    },
-    "event.dns.unreachable": {
-        "message": "Unable to reach one or more DNS servers. This might affect your ability to connect to some services.",
-        "description": "Notification body when one or more upstream DNS servers stop responding."
-    },
-    "event.exitNode.connected": {
-        "message": "Exit node connected.",
-        "description": "Notification body when a full-tunnel exit node becomes active."
-    },
-    "event.exitNode.disconnected": {
-        "message": "Exit node disconnected.",
-        "description": "Notification body when the user or the client shuts the exit node down deliberately."
-    },
-    "event.exitNode.connectionLost": {
-        "message": "Exit node connection lost. Your internet access might be affected.",
-        "description": "Notification body when the exit node peer became unreachable. \"Internet access\" means the user's own browsing."
-    },
-    "event.exitNode.haChange": {
-        "message": "Exit node disconnected due to high availability change.",
-        "description": "Notification body when a high-availability group switched away from this exit node. High availability is the standard IT term."
-    },
-    "event.exitNode.disconnectedUnknown": {
-        "message": "Exit node disconnected for unknown reasons.",
-        "description": "Notification body when the exit node dropped for a reason the client could not classify."
-    },
-    "event.update.installing": {
-        "message": "Installing update now.",
-        "description": "Notification body shown as an automatic client update starts installing."
-    },
-    "event.update.completed": {
-        "message": "Your NetBird client was auto-updated to version {version}.",
-        "description": "Notification body after an automatic client update succeeded. {version} is a version number, keep verbatim."
-    },
-    "event.update.failed": {
-        "message": "Auto-update failed: {reason}",
-        "description": "Notification body when an automatic client update failed. {reason} is an untranslated technical error string; keep your locale's colon spacing."
-    },
     "common.cancel": {
         "message": "Cancel",
         "description": "Generic Cancel button label, reused across dialogs. Keep short."

client/ui/i18n/locales/es/common.json

@@ -179,69 +179,6 @@
     "notify.mdm.policyApplied.body": {
         "message": "Su configuración de NetBird fue actualizada por su política de TI."
     },
-    "event.title": {
-        "message": "{severity}: {category}"
-    },
-    "event.severity.info": {
-        "message": "Información"
-    },
-    "event.severity.warning": {
-        "message": "Advertencia"
-    },
-    "event.severity.error": {
-        "message": "Error"
-    },
-    "event.severity.critical": {
-        "message": "Crítico"
-    },
-    "event.category.network": {
-        "message": "Red"
-    },
-    "event.category.dns": {
-        "message": "DNS"
-    },
-    "event.category.authentication": {
-        "message": "Autenticación"
-    },
-    "event.category.connectivity": {
-        "message": "Conectividad"
-    },
-    "event.category.system": {
-        "message": "Sistema"
-    },
-    "event.panic": {
-        "message": "El servicio de NetBird falló de forma inesperada. Reinicie el servicio y envíe un informe de error con los registros del cliente."
-    },
-    "event.dns.recovered": {
-        "message": "Los servidores DNS vuelven a estar accesibles."
-    },
-    "event.dns.unreachable": {
-        "message": "No se puede acceder a uno o más servidores DNS. Esto puede afectar la conexión a algunos servicios."
-    },
-    "event.exitNode.connected": {
-        "message": "Nodo de salida conectado."
-    },
-    "event.exitNode.disconnected": {
-        "message": "Nodo de salida desconectado."
-    },
-    "event.exitNode.connectionLost": {
-        "message": "Se perdió la conexión con el nodo de salida. Su acceso a Internet puede verse afectado."
-    },
-    "event.exitNode.haChange": {
-        "message": "Nodo de salida desconectado por un cambio de alta disponibilidad."
-    },
-    "event.exitNode.disconnectedUnknown": {
-        "message": "Nodo de salida desconectado por motivos desconocidos."
-    },
-    "event.update.installing": {
-        "message": "Instalando la actualización ahora."
-    },
-    "event.update.completed": {
-        "message": "Su cliente de NetBird se actualizó automáticamente a la versión {version}."
-    },
-    "event.update.failed": {
-        "message": "La actualización automática falló: {reason}"
-    },
     "common.cancel": {
         "message": "Cancelar"
     },

client/ui/i18n/locales/fr/common.json

@@ -179,69 +179,6 @@
     "notify.mdm.policyApplied.body": {
         "message": "Votre configuration NetBird a été mise à jour par votre politique informatique."
     },
-    "event.title": {
-        "message": "{severity} : {category}"
-    },
-    "event.severity.info": {
-        "message": "Info"
-    },
-    "event.severity.warning": {
-        "message": "Avertissement"
-    },
-    "event.severity.error": {
-        "message": "Erreur"
-    },
-    "event.severity.critical": {
-        "message": "Critique"
-    },
-    "event.category.network": {
-        "message": "Réseau"
-    },
-    "event.category.dns": {
-        "message": "DNS"
-    },
-    "event.category.authentication": {
-        "message": "Authentification"
-    },
-    "event.category.connectivity": {
-        "message": "Connectivité"
-    },
-    "event.category.system": {
-        "message": "Système"
-    },
-    "event.panic": {
-        "message": "Le service NetBird s'est arrêté brutalement. Veuillez redémarrer le service et envoyer un rapport de bug avec les journaux du client."
-    },
-    "event.dns.recovered": {
-        "message": "Les serveurs DNS sont de nouveau joignables."
-    },
-    "event.dns.unreachable": {
-        "message": "Impossible de joindre un ou plusieurs serveurs DNS. Cela peut affecter la connexion à certains services."
-    },
-    "event.exitNode.connected": {
-        "message": "Nœud de sortie connecté."
-    },
-    "event.exitNode.disconnected": {
-        "message": "Nœud de sortie déconnecté."
-    },
-    "event.exitNode.connectionLost": {
-        "message": "Connexion au nœud de sortie perdue. Votre accès à Internet peut être affecté."
-    },
-    "event.exitNode.haChange": {
-        "message": "Nœud de sortie déconnecté suite à un changement de haute disponibilité."
-    },
-    "event.exitNode.disconnectedUnknown": {
-        "message": "Nœud de sortie déconnecté pour une raison inconnue."
-    },
-    "event.update.installing": {
-        "message": "Installation de la mise à jour en cours."
-    },
-    "event.update.completed": {
-        "message": "Votre client NetBird a été mis à jour automatiquement vers la version {version}."
-    },
-    "event.update.failed": {
-        "message": "Échec de la mise à jour automatique : {reason}"
-    },
     "common.cancel": {
         "message": "Annuler"
     },

client/ui/i18n/locales/hu/common.json

@@ -179,69 +179,6 @@
     "notify.mdm.policyApplied.body": {
         "message": "A NetBird konfigurációt az IT-szabályzat frissítette."
     },
-    "event.title": {
-        "message": "{severity}: {category}"
-    },
-    "event.severity.info": {
-        "message": "Információ"
-    },
-    "event.severity.warning": {
-        "message": "Figyelmeztetés"
-    },
-    "event.severity.error": {
-        "message": "Hiba"
-    },
-    "event.severity.critical": {
-        "message": "Kritikus"
-    },
-    "event.category.network": {
-        "message": "Hálózat"
-    },
-    "event.category.dns": {
-        "message": "DNS"
-    },
-    "event.category.authentication": {
-        "message": "Hitelesítés"
-    },
-    "event.category.connectivity": {
-        "message": "Kapcsolat"
-    },
-    "event.category.system": {
-        "message": "Rendszer"
-    },
-    "event.panic": {
-        "message": "A NetBird szolgáltatás összeomlott. Kérjük, indítsa újra a szolgáltatást, és küldjön hibajelentést a kliens naplóival."
-    },
-    "event.dns.recovered": {
-        "message": "A DNS-kiszolgálók ismét elérhetők."
-    },
-    "event.dns.unreachable": {
-        "message": "Egy vagy több DNS-kiszolgáló nem érhető el. Ez befolyásolhatja egyes szolgáltatások elérését."
-    },
-    "event.exitNode.connected": {
-        "message": "Exit Node csatlakoztatva."
-    },
-    "event.exitNode.disconnected": {
-        "message": "Exit Node leválasztva."
-    },
-    "event.exitNode.connectionLost": {
-        "message": "Megszakadt a kapcsolat az Exit Node-dal. Ez érintheti az internetelérést."
-    },
-    "event.exitNode.haChange": {
-        "message": "Az Exit Node leválasztva a magas rendelkezésre állás változása miatt."
-    },
-    "event.exitNode.disconnectedUnknown": {
-        "message": "Az Exit Node ismeretlen okból leválasztva."
-    },
-    "event.update.installing": {
-        "message": "A frissítés telepítése folyamatban."
-    },
-    "event.update.completed": {
-        "message": "A NetBird kliens automatikusan a {version} verzióra frissült."
-    },
-    "event.update.failed": {
-        "message": "Az automatikus frissítés sikertelen: {reason}"
-    },
     "common.cancel": {
         "message": "Mégse"
     },

client/ui/i18n/locales/it/common.json

@@ -179,69 +179,6 @@
     "notify.mdm.policyApplied.body": {
         "message": "La configurazione di NetBird è stata aggiornata dalla policy IT."
     },
-    "event.title": {
-        "message": "{severity}: {category}"
-    },
-    "event.severity.info": {
-        "message": "Info"
-    },
-    "event.severity.warning": {
-        "message": "Avviso"
-    },
-    "event.severity.error": {
-        "message": "Errore"
-    },
-    "event.severity.critical": {
-        "message": "Critico"
-    },
-    "event.category.network": {
-        "message": "Rete"
-    },
-    "event.category.dns": {
-        "message": "DNS"
-    },
-    "event.category.authentication": {
-        "message": "Autenticazione"
-    },
-    "event.category.connectivity": {
-        "message": "Connettività"
-    },
-    "event.category.system": {
-        "message": "Sistema"
-    },
-    "event.panic": {
-        "message": "Il servizio NetBird si è arrestato in modo anomalo. Riavvii il servizio e invii una segnalazione di bug con i log del client."
-    },
-    "event.dns.recovered": {
-        "message": "I server DNS sono di nuovo raggiungibili."
-    },
-    "event.dns.unreachable": {
-        "message": "Impossibile raggiungere uno o più server DNS. Questo potrebbe influire sulla connessione ad alcuni servizi."
-    },
-    "event.exitNode.connected": {
-        "message": "Nodo di uscita connesso."
-    },
-    "event.exitNode.disconnected": {
-        "message": "Nodo di uscita disconnesso."
-    },
-    "event.exitNode.connectionLost": {
-        "message": "Connessione al nodo di uscita perduta. L'accesso a Internet potrebbe essere compromesso."
-    },
-    "event.exitNode.haChange": {
-        "message": "Nodo di uscita disconnesso a causa di una modifica dell'alta disponibilità."
-    },
-    "event.exitNode.disconnectedUnknown": {
-        "message": "Nodo di uscita disconnesso per motivi sconosciuti."
-    },
-    "event.update.installing": {
-        "message": "Installazione dell'aggiornamento in corso."
-    },
-    "event.update.completed": {
-        "message": "Il client NetBird è stato aggiornato automaticamente alla versione {version}."
-    },
-    "event.update.failed": {
-        "message": "Aggiornamento automatico non riuscito: {reason}"
-    },
     "common.cancel": {
         "message": "Annulla"
     },

client/ui/i18n/locales/ja/common.json

@@ -179,69 +179,6 @@
     "notify.mdm.policyApplied.body": {
         "message": "NetBird の構成が IT ポリシーによって更新されました。"
     },
-    "event.title": {
-        "message": "{severity}: {category}"
-    },
-    "event.severity.info": {
-        "message": "情報"
-    },
-    "event.severity.warning": {
-        "message": "警告"
-    },
-    "event.severity.error": {
-        "message": "エラー"
-    },
-    "event.severity.critical": {
-        "message": "重大"
-    },
-    "event.category.network": {
-        "message": "ネットワーク"
-    },
-    "event.category.dns": {
-        "message": "DNS"
-    },
-    "event.category.authentication": {
-        "message": "認証"
-    },
-    "event.category.connectivity": {
-        "message": "接続"
-    },
-    "event.category.system": {
-        "message": "システム"
-    },
-    "event.panic": {
-        "message": "NetBird サービスがクラッシュしました。サービスを再起動し、クライアントログを添えてバグを報告してください。"
-    },
-    "event.dns.recovered": {
-        "message": "DNS サーバーに再び到達できるようになりました。"
-    },
-    "event.dns.unreachable": {
-        "message": "1 つ以上の DNS サーバーに到達できません。一部のサービスへの接続に影響する可能性があります。"
-    },
-    "event.exitNode.connected": {
-        "message": "出口ノードに接続しました。"
-    },
-    "event.exitNode.disconnected": {
-        "message": "出口ノードの接続を解除しました。"
-    },
-    "event.exitNode.connectionLost": {
-        "message": "出口ノードとの接続が失われました。インターネット接続に影響する可能性があります。"
-    },
-    "event.exitNode.haChange": {
-        "message": "高可用性の変更により出口ノードの接続が解除されました。"
-    },
-    "event.exitNode.disconnectedUnknown": {
-        "message": "不明な理由により出口ノードの接続が解除されました。"
-    },
-    "event.update.installing": {
-        "message": "更新をインストールしています。"
-    },
-    "event.update.completed": {
-        "message": "NetBird クライアントがバージョン {version} に自動更新されました。"
-    },
-    "event.update.failed": {
-        "message": "自動更新に失敗しました: {reason}"
-    },
     "common.cancel": {
         "message": "キャンセル"
     },

client/ui/i18n/locales/pt/common.json

@@ -179,69 +179,6 @@
     "notify.mdm.policyApplied.body": {
         "message": "A sua configuração do NetBird foi atualizada pela política de TI."
     },
-    "event.title": {
-        "message": "{severity}: {category}"
-    },
-    "event.severity.info": {
-        "message": "Informação"
-    },
-    "event.severity.warning": {
-        "message": "Aviso"
-    },
-    "event.severity.error": {
-        "message": "Erro"
-    },
-    "event.severity.critical": {
-        "message": "Crítico"
-    },
-    "event.category.network": {
-        "message": "Rede"
-    },
-    "event.category.dns": {
-        "message": "DNS"
-    },
-    "event.category.authentication": {
-        "message": "Autenticação"
-    },
-    "event.category.connectivity": {
-        "message": "Conectividade"
-    },
-    "event.category.system": {
-        "message": "Sistema"
-    },
-    "event.panic": {
-        "message": "O serviço NetBird falhou de forma inesperada. Reinicie o serviço e envie um relatório de erro com os registros do cliente."
-    },
-    "event.dns.recovered": {
-        "message": "Os servidores DNS estão novamente acessíveis."
-    },
-    "event.dns.unreachable": {
-        "message": "Não é possível acessar um ou mais servidores DNS. Isto pode afetar a conexão a alguns serviços."
-    },
-    "event.exitNode.connected": {
-        "message": "Nó de saída conectado."
-    },
-    "event.exitNode.disconnected": {
-        "message": "Nó de saída desconectado."
-    },
-    "event.exitNode.connectionLost": {
-        "message": "Conexão com o nó de saída perdida. O seu acesso à Internet pode ser afetado."
-    },
-    "event.exitNode.haChange": {
-        "message": "Nó de saída desconectado devido a uma alteração de alta disponibilidade."
-    },
-    "event.exitNode.disconnectedUnknown": {
-        "message": "Nó de saída desconectado por motivos desconhecidos."
-    },
-    "event.update.installing": {
-        "message": "Instalando a atualização agora."
-    },
-    "event.update.completed": {
-        "message": "O seu cliente NetBird foi atualizado automaticamente para a versão {version}."
-    },
-    "event.update.failed": {
-        "message": "Falha na atualização automática: {reason}"
-    },
     "common.cancel": {
         "message": "Cancelar"
     },

client/ui/i18n/locales/ru/common.json

@@ -179,69 +179,6 @@
     "notify.mdm.policyApplied.body": {
         "message": "Конфигурация NetBird была обновлена в соответствии с вашей ИТ-политикой."
     },
-    "event.title": {
-        "message": "{severity}: {category}"
-    },
-    "event.severity.info": {
-        "message": "Информация"
-    },
-    "event.severity.warning": {
-        "message": "Предупреждение"
-    },
-    "event.severity.error": {
-        "message": "Ошибка"
-    },
-    "event.severity.critical": {
-        "message": "Критично"
-    },
-    "event.category.network": {
-        "message": "Сеть"
-    },
-    "event.category.dns": {
-        "message": "DNS"
-    },
-    "event.category.authentication": {
-        "message": "Аутентификация"
-    },
-    "event.category.connectivity": {
-        "message": "Связь"
-    },
-    "event.category.system": {
-        "message": "Система"
-    },
-    "event.panic": {
-        "message": "Служба NetBird аварийно завершилась. Перезапустите службу и отправьте отчёт об ошибке с журналами клиента."
-    },
-    "event.dns.recovered": {
-        "message": "DNS-серверы снова доступны."
-    },
-    "event.dns.unreachable": {
-        "message": "Не удалось связаться с одним или несколькими DNS-серверами. Это может повлиять на подключение к некоторым сервисам."
-    },
-    "event.exitNode.connected": {
-        "message": "Выходной узел подключён."
-    },
-    "event.exitNode.disconnected": {
-        "message": "Выходной узел отключён."
-    },
-    "event.exitNode.connectionLost": {
-        "message": "Соединение с выходным узлом потеряно. Доступ в интернет может быть нарушен."
-    },
-    "event.exitNode.haChange": {
-        "message": "Выходной узел отключён из-за изменения конфигурации высокой доступности."
-    },
-    "event.exitNode.disconnectedUnknown": {
-        "message": "Выходной узел отключён по неизвестной причине."
-    },
-    "event.update.installing": {
-        "message": "Устанавливается обновление."
-    },
-    "event.update.completed": {
-        "message": "Клиент NetBird автоматически обновлён до версии {version}."
-    },
-    "event.update.failed": {
-        "message": "Не удалось выполнить автоматическое обновление: {reason}"
-    },
     "common.cancel": {
         "message": "Отмена"
     },

client/ui/i18n/locales/zh-CN/common.json

@@ -179,69 +179,6 @@
     "notify.mdm.policyApplied.body": {
         "message": "您的 NetBird 配置已根据 IT 策略更新。"
     },
-    "event.title": {
-        "message": "{severity}：{category}"
-    },
-    "event.severity.info": {
-        "message": "信息"
-    },
-    "event.severity.warning": {
-        "message": "警告"
-    },
-    "event.severity.error": {
-        "message": "错误"
-    },
-    "event.severity.critical": {
-        "message": "严重"
-    },
-    "event.category.network": {
-        "message": "网络"
-    },
-    "event.category.dns": {
-        "message": "DNS"
-    },
-    "event.category.authentication": {
-        "message": "身份验证"
-    },
-    "event.category.connectivity": {
-        "message": "连接"
-    },
-    "event.category.system": {
-        "message": "系统"
-    },
-    "event.panic": {
-        "message": "NetBird 服务发生崩溃。请重启该服务，并附上客户端日志提交错误报告。"
-    },
-    "event.dns.recovered": {
-        "message": "DNS 服务器已恢复可访问。"
-    },
-    "event.dns.unreachable": {
-        "message": "无法访问一个或多个 DNS 服务器。这可能影响您连接部分服务。"
-    },
-    "event.exitNode.connected": {
-        "message": "出口节点已连接。"
-    },
-    "event.exitNode.disconnected": {
-        "message": "出口节点已断开。"
-    },
-    "event.exitNode.connectionLost": {
-        "message": "与出口节点的连接已丢失。您的互联网访问可能受到影响。"
-    },
-    "event.exitNode.haChange": {
-        "message": "由于高可用性变更，出口节点已断开。"
-    },
-    "event.exitNode.disconnectedUnknown": {
-        "message": "出口节点因未知原因已断开。"
-    },
-    "event.update.installing": {
-        "message": "正在安装更新。"
-    },
-    "event.update.completed": {
-        "message": "NetBird 客户端已自动更新到版本 {version}。"
-    },
-    "event.update.failed": {
-        "message": "自动更新失败：{reason}"
-    },
     "common.cancel": {
         "message": "取消"
     },

client/ui/localizer.go

@@ -63,20 +63,6 @@ func (l *Localizer) T(key string, args ...string) string {
 	return l.bundle.Translate(lang, key, args...)
 }
 
-// Lookup resolves a key supplied at runtime by the daemon, substituting args as
-// {placeholder}/value pairs. It reports false when the key is in no bundle, so
-// the caller can fall back to the daemon's own English text instead of showing a
-// bare key. An empty key never resolves.
-func (l *Localizer) Lookup(key string, args map[string]string) (string, bool) {
-	if l == nil || l.bundle == nil || key == "" {
-		return "", false
-	}
-	l.mu.RLock()
-	lang := l.lang
-	l.mu.RUnlock()
-	return l.bundle.Lookup(lang, key, flattenArgs(args)...)
-}
-
 // Watch invokes cb on each language change, after the cached language is
 // updated so cb may call l.T with the new locale. Replaces any prior subscription.
 func (l *Localizer) Watch(cb func(lang i18n.LanguageCode)) {
@@ -142,17 +128,3 @@ func (l *Localizer) StatusLabel(status string) string {
 	}
 	return status
 }
-
-// flattenArgs turns a placeholder map into the flat name/value slice the bundle
-// takes. Iteration order is irrelevant: each pair substitutes an independent
-// {name}.
-func flattenArgs(args map[string]string) []string {
-	if len(args) == 0 {
-		return nil
-	}
-	out := make([]string, 0, len(args)*2)
-	for name, value := range args {
-		out = append(out, name, value)
-	}
-	return out
-}

client/ui/main.go

@@ -14,7 +14,6 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/application"
 	"github.com/wailsapp/wails/v3/pkg/events"
-	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
@@ -63,7 +62,7 @@ type registeredServices struct {
 	profiles        *services.Profiles
 	update          *services.Update
 	daemonFeed      *services.DaemonFeed
-	notifier        *notifications.NotificationService
+	notifier        *Notifier
 	compat          *services.Compat
 	profileSwitcher *services.ProfileSwitcher
 	bundle          *i18n.Bundle
@@ -102,7 +101,7 @@ func main() {
 	updaterHolder := updater.NewHolder(app.Event)
 	update := services.NewUpdate(conn, updaterHolder)
 	daemonFeed := services.NewDaemonFeed(conn, app.Event, updaterHolder, debugLog)
-	notifier := notifications.New()
+	notifier := newNotifier()
 	compat := services.NewCompat(conn)
 	// macOS shows no toast until permission is requested. Run it after
 	// ApplicationStarted so the notifier's Startup has initialised the
@@ -210,7 +209,7 @@ func main() {
 // requestNotificationAuthorization prompts for macOS notification permission.
 // The request blocks until the user responds (up to 3 minutes), so callers run
 // it in a goroutine. No-op on Linux/Windows.
-func requestNotificationAuthorization(notifier *notifications.NotificationService) {
+func requestNotificationAuthorization(notifier *Notifier) {
 	authorized, err := notifier.CheckNotificationAuthorization()
 	if err != nil {
 		logrus.Debugf("check notification authorization: %v", err)

client/ui/notifier.go

@@ -0,0 +1,101 @@
+//go:build !android && !ios && !freebsd && !js
+
+package main
+
+import (
+	"context"
+	"errors"
+	"sync/atomic"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/wailsapp/wails/v3/pkg/application"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
+)
+
+var errNotificationsUnavailable = errors.New("notifications unavailable")
+
+// Notifier wraps the Wails notification service so an unavailable backend
+// disables notifications instead of aborting the app. Startup fails for
+// environment reasons (a bare unbundled binary on macOS has no bundle
+// identifier, a headless Linux session has no D-Bus session bus), and Wails
+// treats a service startup error as fatal. After a failed startup every call
+// is a no-op: on macOS, touching UNUserNotificationCenter without a bundle
+// identifier raises an Objective-C exception that recover() cannot catch.
+type Notifier struct {
+	inner     *notifications.NotificationService
+	available atomic.Bool
+}
+
+func newNotifier() *Notifier {
+	return &Notifier{inner: notifications.New()}
+}
+
+// ServiceName implements the Wails service-name hook for startup logs.
+func (n *Notifier) ServiceName() string {
+	return n.inner.ServiceName()
+}
+
+// ServiceStartup starts the platform notifier, downgrading failure to a
+// warning so the app keeps running without notifications.
+func (n *Notifier) ServiceStartup(ctx context.Context, options application.ServiceOptions) error {
+	if err := n.inner.ServiceStartup(ctx, options); err != nil {
+		log.Warnf("notifications disabled: %v", err)
+		return nil
+	}
+	n.available.Store(true)
+	return nil
+}
+
+func (n *Notifier) ServiceShutdown() error {
+	if !n.available.Load() {
+		return nil
+	}
+	return n.inner.ServiceShutdown()
+}
+
+func (n *Notifier) CheckNotificationAuthorization() (bool, error) {
+	if !n.available.Load() {
+		return false, errNotificationsUnavailable
+	}
+	return n.inner.CheckNotificationAuthorization()
+}
+
+func (n *Notifier) RequestNotificationAuthorization() (bool, error) {
+	if !n.available.Load() {
+		return false, errNotificationsUnavailable
+	}
+	return n.inner.RequestNotificationAuthorization()
+}
+
+// SendNotification delivers a notification, silently dropping it when the
+// backend never started (notifications are best-effort everywhere).
+func (n *Notifier) SendNotification(options notifications.NotificationOptions) error {
+	if !n.available.Load() {
+		log.Debugf("notifications disabled, dropping %q", options.ID)
+		return nil
+	}
+	return n.inner.SendNotification(options)
+}
+
+func (n *Notifier) SendNotificationWithActions(options notifications.NotificationOptions) error {
+	if !n.available.Load() {
+		log.Debugf("notifications disabled, dropping %q", options.ID)
+		return nil
+	}
+	return n.inner.SendNotificationWithActions(options)
+}
+
+func (n *Notifier) RegisterNotificationCategory(category notifications.NotificationCategory) error {
+	if !n.available.Load() {
+		return nil
+	}
+	return n.inner.RegisterNotificationCategory(category)
+}
+
+// OnNotificationResponse registers the response callback. Pure Go state, so
+// it is safe (and simply inert) when the backend never started.
+//
+//wails:ignore
+func (n *Notifier) OnNotificationResponse(callback func(result notifications.NotificationResult)) {
+	n.inner.OnNotificationResponse(callback)
+}

client/ui/preferences/store.go

@@ -246,6 +246,7 @@ func (s *Store) ExistedAtLoad() bool {
 func (s *Store) load() error {
 	if _, err := os.Stat(s.path); err != nil {
 		if errors.Is(err, os.ErrNotExist) {
+			log.Infof("no ui preferences file at %s; using defaults", s.path)
 			return nil
 		}
 		return fmt.Errorf("stat preferences: %w", err)

client/ui/services/connection.go

@@ -33,12 +33,21 @@ type LoginResult struct {
 	UserCode                string `json:"userCode"`
 	VerificationURI         string `json:"verificationUri"`
 	VerificationURIComplete string `json:"verificationUriComplete"`
+	// ProfileID is the ID of the profile this login ran against, or "" when the
+	// caller named the profile itself and no ID was resolved. Pass it back in
+	// WaitSSOParams so the account email lands on this profile even if the
+	// active one changes during SSO.
+	ProfileID string `json:"profileId"`
 }
 
 // WaitSSOParams are the inputs to waitSSOLogin.
 type WaitSSOParams struct {
 	UserCode string `json:"userCode"`
 	Hostname string `json:"hostname"`
+	// ProfileID is the profile the login was started for, used to file the
+	// account email against it rather than against whichever profile is active
+	// when the flow returns. Optional: empty falls back to the active profile.
+	ProfileID string `json:"profileId"`
 }
 
 // UpParams selects the profile to bring up.
@@ -77,11 +86,16 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 	// Fall back to the daemon's active profile and the current OS user.
 	profileName := p.ProfileName
 	username := p.Username
+	// Only set when the daemon told us the ID. A caller-supplied ProfileName is
+	// a handle — a display name or an ID prefix resolve too — and the state file
+	// is named after the ID, so passing a handle on would name the wrong file.
+	profileID := ""
 	if profileName == "" {
 		if active, aerr := cli.GetActiveProfile(ctx, &proto.GetActiveProfileRequest{}); aerr == nil {
 			// Address the active profile by ID (the daemon resolves it as a
 			// handle); names can collide, the ID cannot.
 			profileName = active.GetId()
+			profileID = profileName
 			if username == "" {
 				username = active.GetUsername()
 			}
@@ -122,6 +136,7 @@ func (s *Connection) Login(ctx context.Context, p LoginParams) (LoginResult, err
 		UserCode:                resp.GetUserCode(),
 		VerificationURI:         resp.GetVerificationURI(),
 		VerificationURIComplete: resp.GetVerificationURIComplete(),
+		ProfileID:               profileID,
 	}, nil
 }
 
@@ -242,6 +257,31 @@ func (s *Connection) waitSSOLogin(ctx context.Context, p WaitSSOParams) (string,
 		return "", s.classifyDaemonError(err)
 	}
 	log.Infof("SSO login completed, daemon reported success")
+
+	// Persist the account email the same way the CLI does after its own
+	// WaitSSOLogin: the daemon returns it but cannot store it, since it runs as
+	// root and the per-profile state file is user-owned (see Logout below).
+	// Without this the profile has no email, so Profiles.List shows no account
+	// and later logins and session extends go out without a login_hint —
+	// leaving the IdP to guess which account was meant.
+	if email := resp.GetEmail(); email != "" {
+		state := &profilemanager.ProfileState{Email: email}
+		pm := profilemanager.NewProfileManager()
+
+		// Against the profile the login was started for: SSO spans seconds of
+		// user interaction, and a profile switch in that window would otherwise
+		// file the email under the wrong profile.
+		if p.ProfileID != "" {
+			err = pm.SetProfileState(profilemanager.ID(p.ProfileID), state)
+		} else {
+			err = pm.SetActiveProfileState(state)
+		}
+		if err != nil {
+			// Non-fatal: the login itself succeeded.
+			log.Warnf("failed to store account email: %v", err)
+		}
+	}
+
 	return resp.GetEmail(), nil
 }
 

client/ui/services/daemon_feed.go

@@ -59,21 +59,13 @@ type Emitter interface {
 
 // SystemEvent is the frontend-facing shape of a daemon SystemEvent.
 type SystemEvent struct {
-	ID          string `json:"id"`
-	Severity    string `json:"severity"`
-	Category    string `json:"category"`
-	Message     string `json:"message"`
-	UserMessage string `json:"userMessage"`
-	// MessageKey names the localizable body for this event; empty on control
-	// events and on events from a daemon that predates the field. Resolve it
-	// against the UI bundle and fall back to UserMessage on a miss.
-	MessageKey  string            `json:"messageKey"`
-	MessageArgs map[string]string `json:"messageArgs"`
-	// TitleKey names the localizable notification title, empty when the event
-	// has none and the consumer should compose one from severity and category.
-	TitleKey  string            `json:"titleKey"`
-	Timestamp int64             `json:"timestamp"`
-	Metadata  map[string]string `json:"metadata"`
+	ID          string            `json:"id"`
+	Severity    string            `json:"severity"`
+	Category    string            `json:"category"`
+	Message     string            `json:"message"`
+	UserMessage string            `json:"userMessage"`
+	Timestamp   int64             `json:"timestamp"`
+	Metadata    map[string]string `json:"metadata"`
 }
 
 // PeerStatus is the frontend-facing shape of a daemon PeerState.
@@ -571,9 +563,6 @@ func systemEventFromProto(e *proto.SystemEvent) SystemEvent {
 		Category:    strings.ToLower(strings.TrimPrefix(e.GetCategory().String(), "SystemEvent_")),
 		Message:     e.GetMessage(),
 		UserMessage: e.GetUserMessage(),
-		MessageKey:  e.GetMessageKey(),
-		MessageArgs: e.GetMessageArgs(),
-		TitleKey:    e.GetTitleKey(),
 		Metadata:    map[string]string{},
 	}
 	if ts := e.GetTimestamp(); ts != nil {

client/ui/services/profile.go

@@ -6,6 +6,8 @@ import (
 	"context"
 	"os/user"
 
+	log "github.com/sirupsen/logrus"
+
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 )
@@ -151,11 +153,31 @@ func (s *Profiles) Remove(ctx context.Context, p ProfileRef) error {
 	if err != nil {
 		return err
 	}
-	_, err = cli.RemoveProfile(ctx, &proto.RemoveProfileRequest{
+	resp, err := cli.RemoveProfile(ctx, &proto.RemoveProfileRequest{
 		ProfileName: p.ProfileName,
 		Username:    p.Username,
 	})
-	return err
+	if err != nil {
+		return err
+	}
+
+	// The daemon deletes what it owns but runs as root, so it leaves the
+	// user-owned state file holding the account email behind (same split as
+	// Connection.Logout). Legacy profiles are keyed by name rather than by a
+	// generated ID, so a recreated profile of the same name would inherit the
+	// deleted one's email and offer it as the login_hint.
+	//
+	// Keyed on the ID the daemon resolved, not on the request handle: that may
+	// have been a display name or an ID prefix, which would name a different
+	// file (or none).
+	if id := resp.GetId(); id != "" {
+		if err := profilemanager.NewProfileManager().RemoveProfileState(id); err != nil {
+			// Non-fatal: the profile itself is gone.
+			log.Warnf("failed to remove profile state for %s: %v", id, err)
+		}
+	}
+
+	return nil
 }
 
 // Rename changes a profile's display name. The on-disk ID is unaffected, so

client/ui/tray.go

@@ -26,6 +26,7 @@ const (
 	notifyIDUpdatePrefix = "netbird-update-"
 	notifyIDEvent        = "netbird-event-"
 	notifyIDTrayError    = "netbird-tray-error"
+	notifyIDMDMPolicy    = "netbird-mdm-policy"
 
 	statusError = "Error"
 
@@ -43,7 +44,7 @@ type TrayServices struct {
 	Profiles        *services.Profiles
 	Networks        *services.Networks
 	DaemonFeed      *services.DaemonFeed
-	Notifier        *notifications.NotificationService
+	Notifier        *Notifier
 	Update          *services.Update
 	ProfileSwitcher *services.ProfileSwitcher
 	WindowManager   *services.WindowManager

client/ui/tray_click_linux.go

@@ -4,17 +4,26 @@ package main
 
 // bindTrayClick wires the tray icon's left-click handler on Linux.
 //
-// Both Linux click paths converge on Wails' linuxSystemTray.Activate, which
-// fires the registered clickHandler:
-//   - Real SNI hosts (KDE Plasma, Waybar, GNOME Shell + AppIndicator) invoke
-//     org.kde.StatusNotifierItem.Activate over D-Bus on left-click.
-//   - The in-process StatusNotifierWatcher + XEmbed host used on minimal WMs
-//     (Fluxbox, i3, dwm, OpenBox) maps a Button1 press to that same Activate
-//     call itself (xembed_host_linux.go), so it routes through the same hook.
-// Registering OnClick here therefore covers both paths with one handler — no
-// changes to the watcher or XEmbed C code are needed. Left-click now opens the
-// main window; right-click still opens the menu via Wails' default
-// SecondaryActivate→OpenMenu handler (and the XEmbed GTK popup on minimal WMs).
+// Expected behaviour per tray host:
+//
+//	Host                           Left click              Right click
+//	KDE Plasma, Waybar             main window (Activate)  menu (host-rendered)
+//	GNOME Shell + AppIndicator     menu only               menu only
+//	Minimal WMs via XEmbed host    main window (Activate)  XEmbed GTK popup
+//
+// OnClick fires only on org.kde.StatusNotifierItem.Activate — a real left
+// click. KDE/Waybar send it over D-Bus; the in-process XEmbed host
+// (xembed_host_linux.go) maps a Button1 press to the same Activate call.
+//
+// GNOME Shell + AppIndicator never sends Activate: it renders the dbusmenu
+// on ANY click and only reports the menu opening via dbusmenu
+// Event("opened"). Upstream Wails treated that event as a click, so on GNOME
+// both buttons raised the main window on top of the menu, and on KDE/Waybar
+// a right click raised it over the freshly opened menu. The netbirdio/wails
+// fork (go.mod replace) drops that heuristic: a menu open never fires
+// OnClick. On GNOME the main window is reached via the "Open NetBird" menu
+// entry; left-click-opens-window is not achievable there anyway, since the
+// host always opens the menu itself.
 //
 // We do NOT register OnDoubleClick: Wails' Linux SNI backend never fires it
 // (unlike Windows). And we deliberately skip AttachWindow — it plus Wails3's

client/ui/tray_events.go

@@ -21,14 +21,32 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 	if !ok {
 		return
 	}
-	// config_changed carries no user-facing message, so handle it before the gate below.
+	// config_changed carries no UserMessage, so handle it before the message gate below.
 	if se.Category == "system" && se.Metadata[proto.MetadataTypeKey] == proto.MetadataTypeConfigChanged {
 		log.Infof("config_changed event received (source=%s); refreshing tray restrictions", se.Metadata[proto.MetadataSourceKey])
 		go t.refreshRestrictions()
 		go t.loadConfig()
+		// MDM gets a localised toast here; the daemon's English "policy_applied"
+		// event is suppressed in shouldSkipSystemEvent. Other sources stay silent.
+		if se.Metadata[proto.MetadataSourceKey] == proto.MetadataSourceMDM {
+			t.profileMu.Lock()
+			enabled := t.notificationsEnabled
+			t.profileMu.Unlock()
+			if enabled {
+				t.notify(
+					t.loc.T("notify.mdm.policyApplied.title"),
+					t.loc.T("notify.mdm.policyApplied.body"),
+					notifyIDMDMPolicy,
+				)
+			}
+		}
 		return
 	}
-	if se.MessageKey == "" && se.UserMessage == "" {
+	// Session-warning and deadline-rejected events build their body locally from
+	// metadata; every other event needs a UserMessage.
+	isSessionWarning := se.Metadata[authsession.MetaWarning] == "true"
+	isDeadlineRejected := se.Metadata[authsession.MetaDeadlineRejected] != ""
+	if !isSessionWarning && !isDeadlineRejected && se.UserMessage == "" {
 		return
 	}
 	if shouldSkipSystemEvent(se) {
@@ -43,56 +61,56 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 		return
 	}
 
-	body := t.localizedEventMessage(se)
+	// Session-warning events route via stable metadata flags rather than
+	// category/severity so a daemon-side reword still lands here. Final warning
+	// auto-opens the SessionExpiration dialog with no notification (the dialog is
+	// the last-chance reminder; doubling up would be noise).
+	if isDeadlineRejected {
+		t.notify(
+			t.loc.T("notify.sessionDeadlineRejected.title"),
+			t.loc.T("notify.sessionDeadlineRejected.body"),
+			notifyIDSessionExpired,
+		)
+		return
+	}
 
-	// The final session warning auto-opens the SessionExpiration dialog instead of
-	// toasting: the dialog is the last-chance reminder and doubling up would be
-	// noise. This routes on metadata rather than the message key because it is a
-	// behavioural distinction, not a wording one.
-	if se.Metadata[authsession.MetaWarning] == "true" {
+	if se.Metadata != nil && se.Metadata[authsession.MetaWarning] == "true" {
 		if se.Metadata[authsession.MetaFinal] == "true" {
 			t.openSessionExpiration()
 			return
 		}
-		t.notifySessionWarning(t.eventTitle(se), body)
+		t.notifySessionWarning(
+			t.loc.T("notify.sessionWarning.title"),
+			t.buildSessionWarningBody(se.Metadata),
+		)
 		return
 	}
 
+	body := se.UserMessage
 	if id := se.Metadata["id"]; id != "" {
 		body += fmt.Sprintf(" ID: %s", id)
 	}
-	t.notify(t.eventTitle(se), body, notifyIDEvent+se.ID)
+	t.notify(eventTitle(se), body, notifyIDEvent+se.ID)
 }
 
-// localizedEventMessage resolves the daemon's message key against the active
-// locale. A key this build does not ship — a daemon newer than the UI — falls
-// back to the daemon's own English rendering rather than showing a bare key.
-func (t *Tray) localizedEventMessage(se services.SystemEvent) string {
-	if body, ok := t.loc.Lookup(se.MessageKey, se.MessageArgs); ok {
-		return body
+// eventTitle composes a notification title, e.g. "Critical: DNS", "Warning: Authentication".
+func eventTitle(e services.SystemEvent) string {
+	prefix := titleCase(e.Severity)
+	if prefix == "" {
+		prefix = "Info"
 	}
-	if se.MessageKey != "" {
-		log.Debugf("no translation for event message key %q, using the daemon's text", se.MessageKey)
+	category := titleCase(e.Category)
+	if category == "" {
+		category = "System"
 	}
-	return se.UserMessage
+	return prefix + ": " + category
 }
 
-// eventTitle resolves the event's own title key, falling back to a title
-// composed from severity and category, e.g. "Critical: DNS" in English. An enum
-// value this build does not know falls back to the Info and System labels.
-func (t *Tray) eventTitle(se services.SystemEvent) string {
-	if title, ok := t.loc.Lookup(se.TitleKey, nil); ok {
-		return title
+func titleCase(s string) string {
+	if s == "" {
+		return ""
 	}
-	severity, ok := t.loc.Lookup("event.severity."+strings.ToLower(se.Severity), nil)
-	if !ok {
-		severity = t.loc.T("event.severity.info")
-	}
-	category, ok := t.loc.Lookup("event.category."+strings.ToLower(se.Category), nil)
-	if !ok {
-		category = t.loc.T("event.category.system")
-	}
-	return t.loc.T("event.title", "severity", severity, "category", category)
+	return strings.ToUpper(s[:1]) + strings.ToLower(s[1:])
 }
 
 // shouldSkipSystemEvent reports whether a daemon SystemEvent must not surface as
@@ -101,6 +119,11 @@ func (t *Tray) eventTitle(se services.SystemEvent) string {
 //   - install-progress signals (consumed by the install-progress window)
 //   - the ::/0 partner of an exit-node default route (0.0.0.0/0 already toasted)
 func shouldSkipSystemEvent(se services.SystemEvent) bool {
+	// "policy_applied" carries a hardcoded English message; the localised toast
+	// fires on the paired config_changed (source=mdm) event instead.
+	if se.Metadata[proto.MetadataTypeKey] == proto.MetadataTypePolicyApplied {
+		return true
+	}
 	if _, isUpdate := se.Metadata["new_version_available"]; isUpdate {
 		return true
 	}

client/ui/tray_events_test.go

@@ -1,150 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"os"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/client/ui/i18n"
-	"github.com/netbirdio/netbird/client/ui/services"
-)
-
-// trayWithLocalizer builds the minimum Tray the message/title resolvers touch:
-// they read t.loc and nothing else, so no app, window or daemon connection is
-// needed. The shipped locale tree is used so the assertions below exercise the
-// real bundles rather than a fixture.
-func trayWithLocalizer(t *testing.T) *Tray {
-	t.Helper()
-	bundle, err := i18n.NewBundle(os.DirFS("i18n/locales"))
-	require.NoError(t, err, "the shipped locale tree must load")
-	return &Tray{loc: NewLocalizer(bundle, nil)}
-}
-
-func TestLocalizedEventMessageResolvesKey(t *testing.T) {
-	tray := trayWithLocalizer(t)
-
-	got := tray.localizedEventMessage(services.SystemEvent{
-		MessageKey: string(proto.UserMsgExitNodeConnected),
-		// A daemon always ships its English rendering too; the key must win.
-		UserMessage: "should not be used",
-	})
-	assert.Equal(t, "Exit node connected.", got)
-}
-
-func TestLocalizedEventMessageSubstitutesArgs(t *testing.T) {
-	tray := trayWithLocalizer(t)
-
-	got := tray.localizedEventMessage(services.SystemEvent{
-		MessageKey:  string(proto.UserMsgUpdateCompleted),
-		MessageArgs: map[string]string{proto.ArgVersion: "0.60.1"},
-	})
-	assert.Equal(t, "Your NetBird client was auto-updated to version 0.60.1.", got)
-}
-
-// A daemon newer than the UI can publish a key this build has never heard of.
-// Showing the raw key would be a visible regression, so the daemon's own English
-// text has to win instead.
-func TestLocalizedEventMessageFallsBackToDaemonText(t *testing.T) {
-	tray := trayWithLocalizer(t)
-
-	got := tray.localizedEventMessage(services.SystemEvent{
-		MessageKey:  "event.somethingThisBuildNeverHeardOf",
-		UserMessage: "A message from a newer daemon.",
-	})
-	assert.Equal(t, "A message from a newer daemon.", got)
-}
-
-// An old daemon sends no key at all, only userMessage.
-func TestLocalizedEventMessageWithoutKey(t *testing.T) {
-	tray := trayWithLocalizer(t)
-
-	got := tray.localizedEventMessage(services.SystemEvent{UserMessage: "Legacy English text."})
-	assert.Equal(t, "Legacy English text.", got)
-}
-
-func TestEventTitlePrefersTitleKey(t *testing.T) {
-	tray := trayWithLocalizer(t)
-
-	got := tray.eventTitle(services.SystemEvent{
-		Severity: "critical",
-		Category: "authentication",
-		TitleKey: string(proto.TitleSessionWarning),
-	})
-	assert.Equal(t, "Session expires soon", got, "a title key must beat the composed title")
-}
-
-func TestEventTitleComposesFromSeverityAndCategory(t *testing.T) {
-	tray := trayWithLocalizer(t)
-
-	tests := []struct {
-		name     string
-		severity string
-		category string
-		want     string
-	}{
-		{"warning dns", "warning", "dns", "Warning: DNS"},
-		{"critical system", "critical", "system", "Critical: System"},
-		{"info network", "info", "network", "Info: Network"},
-		{"error authentication", "error", "authentication", "Error: Authentication"},
-		// Enum values this build does not know, and the empty severity/category
-		// an event carries before the daemon fills them in.
-		{"unknown severity", "apocalyptic", "dns", "Info: DNS"},
-		{"unknown category", "warning", "quantum", "Warning: System"},
-		{"empty", "", "", "Info: System"},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := tray.eventTitle(services.SystemEvent{Severity: tc.severity, Category: tc.category})
-			assert.Equal(t, tc.want, got)
-		})
-	}
-}
-
-func TestShouldSkipSystemEvent(t *testing.T) {
-	tests := []struct {
-		name string
-		ev   services.SystemEvent
-		want bool
-	}{
-		{
-			name: "update announcement handled by the tray updater",
-			ev:   services.SystemEvent{Metadata: map[string]string{"new_version_available": "0.60.1"}},
-			want: true,
-		},
-		{
-			name: "install progress belongs to the progress window",
-			ev:   services.SystemEvent{Metadata: map[string]string{"progress_window": "show"}},
-			want: true,
-		},
-		{
-			name: "the v6 half of a dual-stack default route is already toasted as v4",
-			ev:   services.SystemEvent{Category: "network", Metadata: map[string]string{"network": "::/0"}},
-			want: true,
-		},
-		{
-			name: "the v4 default route is the one that toasts",
-			ev:   services.SystemEvent{Category: "network", Metadata: map[string]string{"network": "0.0.0.0/0"}},
-			want: false,
-		},
-		{
-			// policy_applied used to be suppressed here while the tray toasted
-			// off the paired config_changed event; it now carries its own keys.
-			name: "mdm policy applied surfaces normally",
-			ev: services.SystemEvent{
-				MessageKey: string(proto.UserMsgMDMPolicyApplied),
-				Metadata:   map[string]string{proto.MetadataTypeKey: proto.MetadataTypePolicyApplied},
-			},
-			want: false,
-		},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.want, shouldSkipSystemEvent(tc.ev))
-		})
-	}
-}

client/ui/tray_notify.go

@@ -44,7 +44,7 @@ func safeSendNotification(send sendFn, what string, opts notifications.Notificat
 // notifyIfDaemonOutdated probes the daemon once and fires an OS toast when it
 // is reachable but too old for this UI. A probe error means the daemon isn't
 // reachable (not outdated), so it is left to the normal connection flow.
-func notifyIfDaemonOutdated(compat *services.Compat, notifier *notifications.NotificationService, loc *Localizer) {
+func notifyIfDaemonOutdated(compat *services.Compat, notifier *Notifier, loc *Localizer) {
 	ready, err := compat.DaemonReady(context.Background())
 	if err != nil {
 		log.Debugf("daemon compatibility probe: %v", err)

client/ui/tray_session.go

@@ -10,6 +10,8 @@ import (
 	log "github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
+	nbstatus "github.com/netbirdio/netbird/client/status"
+	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/services"
 )
 
@@ -25,11 +27,10 @@ const (
 	finalWarningCountdownSeconds = 120
 )
 
-// handleSessionExpired notifies and brings the window forward so the frontend's /login route drives renewal.
+// handleSessionExpired notifies and brings the window forward so the user can reconnect.
 func (t *Tray) handleSessionExpired() {
 	t.notify(t.loc.T("notify.sessionExpired.title"), t.loc.T("notify.sessionExpired.body"), notifyIDSessionExpired)
 	if t.window != nil {
-		t.window.SetURL("/#/login")
 		t.window.Show()
 		t.window.Focus()
 	}
@@ -194,6 +195,25 @@ func (t *Tray) registerSessionWarningCategory() {
 	})
 }
 
+// buildSessionWarningBody composes the localised notification body from the daemon's metadata.
+// The daemon has no locale, so it ships an RFC3339 deadline the tray turns into a user-language sentence.
+// Falls back to a generic string when metadata is missing or unparsable.
+func (t *Tray) buildSessionWarningBody(meta map[string]string) string {
+	if meta == nil {
+		return t.loc.T("notify.sessionWarning.bodyGeneric")
+	}
+	raw := meta[authsession.MetaExpiresAt]
+	if raw == "" {
+		return t.loc.T("notify.sessionWarning.bodyGeneric")
+	}
+	deadline, err := authsession.ParseExpiresAt(raw)
+	if err != nil {
+		return t.loc.T("notify.sessionWarning.bodyGeneric")
+	}
+	remaining := nbstatus.FormatRemainingDuration(time.Until(deadline))
+	return t.loc.T("notify.sessionWarning.body", "remaining", remaining)
+}
+
 // notifySessionWarning sends the interactive expiry notification, falling back to plain notify when the
 // with-actions variant is unavailable (older platform impls, or a bare Notifier in tests).
 func (t *Tray) notifySessionWarning(title, body string) {
@@ -287,11 +307,7 @@ func (t *Tray) openSessionExtendFlow() {
 	}
 	seconds := int(time.Until(deadline).Seconds())
 	if seconds <= 0 {
-		if t.window != nil {
-			t.window.SetURL("/#/login")
-			t.window.Show()
-			t.window.Focus()
-		}
+		t.app.Event.Emit(services.EventTriggerLogin)
 		return
 	}
 	if t.svc.WindowManager == nil {

client/ui/tray_update.go

@@ -21,7 +21,7 @@ type trayUpdater struct {
 	app          *application.App
 	window       *application.WebviewWindow
 	update       *services.Update
-	notifier     *notifications.NotificationService
+	notifier     *Notifier
 	loc          *Localizer
 	onIconChange func()
 	// onMenuChange drives a full tray relayout: the update row lives in the
@@ -36,7 +36,7 @@ type trayUpdater struct {
 	progressWindowOpen bool
 }
 
-func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *notifications.NotificationService, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
+func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
 	u := &trayUpdater{
 		app:          app,
 		window:       window,

e2e/agentnetwork/management_test.go

@@ -160,8 +160,19 @@ func TestSettingsRoundTrip(t *testing.T) {
 	assert.Equal(t, before.Cluster, flipped.Cluster, "cluster must be immutable across updates")
 	assert.Equal(t, before.Subdomain, flipped.Subdomain, "subdomain must be immutable across updates")
 
+	// A cluster different from the pinned one must be rejected; echoing the
+	// pinned one back is valid.
+	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		Cluster:                ptr("attacker.cluster.invalid"),
+		EnableLogCollection:    before.EnableLogCollection,
+		EnablePromptCollection: before.EnablePromptCollection,
+		RedactPii:              before.RedactPii,
+	})
+	requireClientError(t, err)
+
 	// Restore the original toggles.
 	_, err = srv.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		Cluster:                ptr(before.Cluster),
 		EnableLogCollection:    before.EnableLogCollection,
 		EnablePromptCollection: before.EnablePromptCollection,
 		RedactPii:              before.RedactPii,

e2e/agentnetwork/settings_bootstrap_test.go

@@ -0,0 +1,114 @@
+//go:build e2e
+
+package agentnetwork
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/e2e/harness"
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// harnessStartFresh boots a dedicated combined server with its own fresh
+// account and registers its teardown on t.
+func harnessStartFresh(ctx context.Context, t *testing.T) (*harness.Combined, error) {
+	t.Helper()
+	fresh, err := harness.StartCombined(ctx)
+	if err != nil {
+		return nil, err
+	}
+	t.Cleanup(func() { _ = fresh.Terminate(context.Background()) })
+	if _, err := fresh.Bootstrap(ctx); err != nil {
+		return nil, err
+	}
+	return fresh, nil
+}
+
+// TestSettingsBootstrapViaPut covers the settings-first bootstrap path on an
+// account that has never been bootstrapped: the GET reads as the defaults
+// with an empty cluster/subdomain/endpoint, a PUT without a cluster has
+// nothing to pin and fails, and a PUT carrying a cluster creates the row and
+// pins it immutably. The shared srv cannot provide that starting state (any
+// provider-creating test bootstraps it, and test order is deliberately not
+// relied on), so this boots a dedicated combined server — the image is
+// already built and cached by TestMain's StartCombined, so the extra cost is
+// one container start.
+func TestSettingsBootstrapViaPut(t *testing.T) {
+	ctx := context.Background()
+
+	fresh, err := harnessStartFresh(ctx, t)
+	require.NoError(t, err, "start dedicated combined server")
+
+	// Before agent-network bootstrap the settings read as the defaults, not
+	// as an error and not as a null body.
+	before, err := fresh.GetSettings(ctx)
+	require.NoError(t, err, "get settings on a fresh account must succeed")
+	assert.Empty(t, before.Cluster, "cluster must be empty before bootstrap")
+	assert.Empty(t, before.Subdomain, "subdomain must be empty before bootstrap")
+	assert.Empty(t, before.Endpoint, "endpoint must be empty before bootstrap, not a bare dot")
+	assert.True(t, before.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
+	assert.False(t, before.EnablePromptCollection, "defaults must show prompt collection off")
+
+	// A PUT without a cluster has nothing to pin the account to.
+	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		EnableLogCollection: true,
+	})
+	requireClientError(t, err)
+
+	// A PUT carrying a cluster bootstraps the account and applies the
+	// mutable fields from the same request. Every toggle is set away from
+	// its bootstrap default so each assertion can actually fail.
+	const cluster = "e2e.bootstrap.netbird.selfhosted"
+	bootstrapped, err := fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		Cluster:                ptr(cluster),
+		EnableLogCollection:    false,
+		EnablePromptCollection: true,
+		RedactPii:              true,
+	})
+	require.NoError(t, err, "bootstrap settings via PUT must succeed")
+	assert.Equal(t, cluster, bootstrapped.Cluster, "cluster must be pinned from the request")
+	require.NotEmpty(t, bootstrapped.Subdomain, "subdomain must be assigned at bootstrap")
+	assert.Equal(t, bootstrapped.Subdomain+"."+cluster, bootstrapped.Endpoint, "endpoint must combine subdomain and cluster")
+	assert.False(t, bootstrapped.EnableLogCollection, "log collection from the bootstrap request must override the default")
+	assert.True(t, bootstrapped.EnablePromptCollection, "prompt collection from the bootstrap request must apply")
+	assert.True(t, bootstrapped.RedactPii, "redact toggle from the bootstrap request must apply")
+
+	// The row is persisted: an independent read agrees on every field.
+	after, err := fresh.GetSettings(ctx)
+	require.NoError(t, err, "get settings after bootstrap must succeed")
+	assert.Equal(t, bootstrapped.Endpoint, after.Endpoint, "bootstrap must persist across reads")
+	assert.Equal(t, bootstrapped.EnableLogCollection, after.EnableLogCollection, "log collection must persist")
+	assert.Equal(t, bootstrapped.EnablePromptCollection, after.EnablePromptCollection, "prompt collection must persist")
+	assert.Equal(t, bootstrapped.RedactPii, after.RedactPii, "redact toggle must persist")
+
+	// Once bootstrapped, later updates may omit the cluster entirely.
+	persisted, err := fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		EnableLogCollection:    true,
+		EnablePromptCollection: false,
+		RedactPii:              true,
+	})
+	require.NoError(t, err, "post-bootstrap update without cluster must succeed")
+	assert.Equal(t, cluster, persisted.Cluster, "omitted cluster must keep the pinned value")
+	assert.True(t, persisted.EnableLogCollection, "post-bootstrap toggle must apply")
+	assert.False(t, persisted.EnablePromptCollection, "post-bootstrap toggle must apply")
+
+	// The cluster is immutable: a different value is rejected rather than
+	// silently ignored, and the rejected update must not disturb anything.
+	_, err = fresh.UpdateSettings(ctx, api.AgentNetworkSettingsRequest{
+		Cluster:             ptr("other.cluster.invalid"),
+		EnableLogCollection: false,
+	})
+	requireClientError(t, err)
+
+	final, err := fresh.GetSettings(ctx)
+	require.NoError(t, err, "get settings after the rejected cluster change must succeed")
+	assert.Equal(t, persisted.Cluster, final.Cluster, "rejected update must not change the cluster")
+	assert.Equal(t, persisted.Endpoint, final.Endpoint, "rejected update must not change the endpoint")
+	assert.Equal(t, persisted.EnableLogCollection, final.EnableLogCollection, "rejected update must not apply its toggles")
+	assert.Equal(t, persisted.EnablePromptCollection, final.EnablePromptCollection, "rejected update must not apply its toggles")
+	assert.Equal(t, persisted.RedactPii, final.RedactPii, "rejected update must not apply its toggles")
+}

go.mod

@@ -114,7 +114,7 @@ require (
 	github.com/ti-mo/conntrack v0.5.1
 	github.com/ti-mo/netfilter v0.5.2
 	github.com/vmihailenco/msgpack/v5 v5.4.1
-	github.com/wailsapp/wails/v3 v3.0.0-alpha2.117
+	github.com/wailsapp/wails/v3 v3.0.0-beta.3
 	github.com/yusufpapurcu/wmi v1.2.4
 	github.com/zcalusic/sysinfo v1.1.3
 	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0
@@ -339,3 +339,5 @@ replace github.com/dexidp/dex => github.com/netbirdio/dex v0.244.1-0.20260716205
 replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-20260512110716-8d70ad8647c1
 
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
+
+replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4

go.sum

@@ -490,6 +490,8 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4 h1:UKztc3QjWvzU5DZk+uYaOWN0x62NSe/pkxuPvzqZIy4=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
@@ -660,8 +662,6 @@ github.com/vmihailenco/msgpack/v5 v5.4.1 h1:cQriyiUvjTwOHg8QZaPihLWeRAAVoCpE00IU
 github.com/vmihailenco/msgpack/v5 v5.4.1/go.mod h1:GaZTsDaehaPpQVyxrf5mtQlH+pc21PIudVV/E3rRQok=
 github.com/vmihailenco/tagparser/v2 v2.0.0 h1:y09buUbR+b5aycVFQs/g70pqKVZNBmxwAhO7/IwNM9g=
 github.com/vmihailenco/tagparser/v2 v2.0.0/go.mod h1:Wri+At7QHww0WTrCBeu4J6bNtoV6mEfg5OIWRZA9qds=
-github.com/wailsapp/wails/v3 v3.0.0-alpha2.117 h1:udyjqPG3AIgkod5QDR/WblCkpV8R86BFPSrsWxSyt5Y=
-github.com/wailsapp/wails/v3 v3.0.0-alpha2.117/go.mod h1:74WH2FScMsgucZvHHvv7eOefDXCm/CjuIxqhhZgPhKg=
 github.com/wlynxg/anet v0.0.5 h1:J3VJGi1gvo0JwZ/P1/Yc/8p63SoW98B5dHkYDmpgvvU=
 github.com/wlynxg/anet v0.0.5/go.mod h1:eay5PRQr7fIVAMbTbchTnO9gG65Hg/uYGdc7mguHxoA=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=

infrastructure_files/getting-started-enterprise.sh

@@ -11,6 +11,13 @@ SED_STRIP_PADDING='s/=//g'
 
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
+# Static IP for Traefik inside the compose bridge network. The management
+# server trusts X-Forwarded-* headers from this address only, so all three
+# values derive from the same /24. Override with NETBIRD_DOCKER_SUBNET.
+DOCKER_SUBNET="172.30.0.0/24"
+DOCKER_GATEWAY="172.30.0.1"
+TRAEFIK_IP="172.30.0.10"
+
 check_docker_compose() {
   if command -v docker-compose &> /dev/null; then
     echo "docker-compose"
@@ -39,6 +46,90 @@ rand_b64_key() {
   openssl rand -base64 32
 }
 
+# ------------------------------------------------------------------
+# Docker network subnet override and conflict check
+# (kept in sync with getting-started.sh; only the compose network
+# name differs)
+# ------------------------------------------------------------------
+
+ip_to_int() {
+  local a b c d
+  IFS=. read -r a b c d <<< "$1"
+  echo $(( (10#$a << 24) + (10#$b << 16) + (10#$c << 8) + 10#$d ))
+}
+
+# cidrs_overlap <cidr> <cidr> — succeeds if the networks overlap
+cidrs_overlap() {
+  local net1="${1%/*}" len1="${1#*/}" net2="${2%/*}" len2="${2#*/}"
+  local min_len=$(( len1 < len2 ? len1 : len2 ))
+  local mask=0
+  if [[ "$min_len" -gt 0 ]]; then
+    mask=$(( (0xFFFFFFFF << (32 - min_len)) & 0xFFFFFFFF ))
+  fi
+  [[ $(( $(ip_to_int "$net1") & mask )) -eq $(( $(ip_to_int "$net2") & mask )) ]]
+}
+
+# valid_ipv4_slash24 <cidr> — accepts a unicast IPv4 /24 like 10.123.45.0/24
+valid_ipv4_slash24() {
+  local octet='(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])'
+  local re="^${octet}\.${octet}\.${octet}\.0/24$"
+  [[ "$1" =~ $re ]] || return 1
+  # Reject non-unicast/reserved ranges: 0/8, loopback, link-local, 224+
+  case "$1" in
+    0.*|127.*|169.254.*|22[4-9].*|2[34][0-9].*|25[0-5].*) return 1 ;;
+  esac
+  return 0
+}
+
+# Apply NETBIRD_DOCKER_SUBNET and derive the gateway (.1) and Traefik IP (.10)
+apply_docker_subnet_override() {
+  if [[ -n "${NETBIRD_DOCKER_SUBNET:-}" ]]; then
+    if ! valid_ipv4_slash24 "$NETBIRD_DOCKER_SUBNET"; then
+      echo "NETBIRD_DOCKER_SUBNET must be a unicast IPv4 /24 network like 10.123.45.0/24 (0/8, 127/8, 169.254/16, and 224+ are not allowed), got: $NETBIRD_DOCKER_SUBNET" > /dev/stderr
+      exit 1
+    fi
+    DOCKER_SUBNET="$NETBIRD_DOCKER_SUBNET"
+  fi
+  local base="${DOCKER_SUBNET%.0/24}"
+  DOCKER_GATEWAY="${base}.1"
+  TRAEFIK_IP="${base}.10"
+  return 0
+}
+
+# check_docker_subnet_conflicts <compose network name>
+# Fail early if an existing Docker network overlaps DOCKER_SUBNET, instead
+# of letting "docker compose up" fail later. Host routes are not checked;
+# NETBIRD_DOCKER_SUBNET covers those cases.
+check_docker_subnet_conflicts() {
+  local expected_network="$1"
+  command -v docker &> /dev/null || return 0
+
+  local name subnets subnet
+  while IFS='|' read -r name subnets; do
+    for subnet in $subnets; do
+      [[ "$subnet" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/[0-9]+$ ]] || continue
+      if [[ "$name" == "$expected_network" ]]; then
+        # Our own leftover network: compose reuses it as-is, so its subnet
+        # must match the one we render
+        if [[ "$subnet" != "$DOCKER_SUBNET" ]]; then
+          echo "ERROR: the Docker network '$name', left over from a previous NetBird install, uses $subnet instead of $DOCKER_SUBNET." > /dev/stderr
+          echo "docker compose would reuse it as-is, and the generated configuration would not match it." > /dev/stderr
+          echo "Remove it and run this script again:" > /dev/stderr
+          echo "  docker network rm $name" > /dev/stderr
+          exit 1
+        fi
+      elif cidrs_overlap "$DOCKER_SUBNET" "$subnet"; then
+        echo "ERROR: the existing Docker network '$name' ($subnet) overlaps $DOCKER_SUBNET, the subnet NetBird would use." > /dev/stderr
+        echo "That network is not managed by this script and is left untouched." > /dev/stderr
+        echo "Pick a free /24 for NetBird instead and run this script again:" > /dev/stderr
+        echo "  NETBIRD_DOCKER_SUBNET=10.123.45.0/24 ./getting-started-enterprise.sh" > /dev/stderr
+        exit 1
+      fi
+    done
+  done < <(docker network inspect --format '{{.Name}}|{{range .IPAM.Config}}{{.Subnet}} {{end}}' $(docker network ls -q 2>/dev/null) 2>/dev/null || true)
+  return 0
+}
+
 check_nb_domain() {
   local domain="$1"
   if [[ -z "$domain" ]]; then
@@ -80,7 +171,7 @@ read_nb_domain() {
   if ! check_domain_resolves "$value"; then
     echo "" > /dev/stderr
     echo "Warning: '$value' does not resolve via DNS from this host." > /dev/stderr
-    echo "Caddy will not be able to issue TLS certificates until it does." > /dev/stderr
+    echo "Traefik will not be able to issue TLS certificates until it does." > /dev/stderr
     local confirm=""
     echo -n "Continue anyway? [y/N]: " > /dev/stderr
     read -r confirm < /dev/tty
@@ -92,6 +183,23 @@ read_nb_domain() {
   echo "$value"
 }
 
+read_letsencrypt_email() {
+  if [[ -n "${NETBIRD_LETSENCRYPT_EMAIL:-}" ]]; then
+    echo "$NETBIRD_LETSENCRYPT_EMAIL"
+    return
+  fi
+  local value=""
+  echo "Enter your email for Let's Encrypt certificate notifications." > /dev/stderr
+  echo -n "Email address: " > /dev/stderr
+  read -r value < /dev/tty
+  if [[ -z "$value" ]]; then
+    echo "Email is required for Let's Encrypt." > /dev/stderr
+    read_letsencrypt_email
+    return
+  fi
+  echo "$value"
+}
+
 read_required() {
   local prompt="$1"
   local value=""
@@ -203,12 +311,15 @@ wait_postgres() {
 init_environment() {
   check_openssl
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
+  # Settle the subnet (and fail on conflicts) before the EULA and prompts
+  apply_docker_subnet_override
+  check_docker_subnet_conflicts "netbird"
 
-  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]] || [[ -f Caddyfile ]]; then
+  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]]; then
     echo "Generated files already exist in $(pwd)."
     echo "If you want to reinitialize the environment, please remove them first:"
     echo "  $DOCKER_COMPOSE_COMMAND down --volumes # removes all containers and volumes"
-    echo "  rm -f .env docker-compose.yml Caddyfile config.yaml"
+    echo "  rm -f .env docker-compose.yml config.yaml"
     echo "Be aware this will remove all data from the database."
     exit 1
   fi
@@ -230,6 +341,9 @@ init_environment() {
   echo ""
   NETBIRD_DOMAIN=$(read_nb_domain)
 
+  echo ""
+  NETBIRD_LETSENCRYPT_EMAIL=$(read_letsencrypt_email)
+
   echo ""
 
   NETBIRD_LICENSE_KEY=$(read_secret "Enter license key (input hidden)")
@@ -247,6 +361,8 @@ init_environment() {
   echo "Selected:"
   echo "  Traffic flow: ${NETBIRD_TRAFFIC_FLOW}"
   echo "  Domain:       ${NETBIRD_DOMAIN}"
+  echo "  ACME email:   ${NETBIRD_LETSENCRYPT_EMAIL}"
+  echo "  Subnet:       ${DOCKER_SUBNET} (Traefik at ${TRAEFIK_IP})"
   echo ""
   echo "Rendering files into $(pwd) ..."
   install -m 600 /dev/null .env
@@ -256,7 +372,6 @@ init_environment() {
   if [[ -z "${NETBIRD_LICENSE_SERVER_BASE_URL:-}" ]]; then
     sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' docker-compose.yml && rm -f docker-compose.yml.bak
   fi
-  render_caddyfile > Caddyfile
   install -m 600 /dev/null config.yaml
   render_config_yaml >> config.yaml
 
@@ -283,7 +398,7 @@ init_environment() {
   echo "All configuration and secrets are stored (mode 600) in $(pwd)/.env"
   echo ""
   echo "Tail logs:"
-  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server caddy"
+  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server traefik"
 }
 
 # ------------------------------------------------------------------
@@ -306,6 +421,16 @@ NETBIRD_TRAFFIC_FLOW_ENABLED=${NETBIRD_TRAFFIC_FLOW}
 # Domain
 NETBIRD_DOMAIN=${NETBIRD_DOMAIN}
 
+# Reverse proxy (Traefik)
+NETBIRD_LETSENCRYPT_EMAIL=${NETBIRD_LETSENCRYPT_EMAIL}
+NETBIRD_TRAEFIK_TAG=${NETBIRD_TRAEFIK_TAG:-v3.6}
+# These three must stay in step with the /32 trust pins in config.yaml
+# (reverseProxy.trustedPeers/trustedHTTPProxies). Shell env vars override
+# this file at compose time.
+NETBIRD_TRAEFIK_IP=${TRAEFIK_IP}
+NETBIRD_NETWORK_SUBNET=${DOCKER_SUBNET}
+NETBIRD_NETWORK_GATEWAY=${DOCKER_GATEWAY}
+
 # Image tags. Default to "latest"
 NETBIRD_DASHBOARD_TAG=${NETBIRD_DASHBOARD_TAG:-latest}
 NETBIRD_SERVER_TAG=${NETBIRD_SERVER_TAG:-latest}
@@ -378,26 +503,81 @@ EOF
 
 render_compose_common() {
   cat <<'EOF'
-  caddy:
+  # Reverse proxy with automatic TLS via Let's Encrypt. Routes are declared as
+  # labels on the services below and picked up through the Docker provider.
+  traefik:
     <<: *default
-    image: caddy:2
-    container_name: netbird-caddy
-    networks: [netbird]
-    environment:
-      - CADDY_SECURE_DOMAIN=${NETBIRD_DOMAIN}
+    image: traefik:${NETBIRD_TRAEFIK_TAG}
+    container_name: netbird-traefik
+    networks:
+      netbird:
+        ipv4_address: ${NETBIRD_TRAEFIK_IP}
+        # Resolve the public domain inside this network (avoids hairpin NAT)
+        aliases:
+          - "${NETBIRD_DOMAIN}"
+    command:
+      # Logging
+      - "--log.level=INFO"
+      - "--accesslog=true"
+      # Docker provider
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--providers.docker.network=netbird"
+      # Entrypoints
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.websecure.address=:443"
+      - "--entrypoints.websecure.allowACMEByPass=true"
+      # readTimeout bounds the whole request, and gRPC streams / relay WebSockets
+      # never end one; idleTimeout would close the keep-alive connection they
+      # are reused over. Entrypoint-wide is the only scope Traefik offers here.
+      # writeTimeout is left alone: it already defaults to 0.
+      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
+      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0"
+      # HTTP to HTTPS redirect
+      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
+      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+      # Let's Encrypt ACME
+      - "--certificatesresolvers.letsencrypt.acme.email=${NETBIRD_LETSENCRYPT_EMAIL}"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
     ports:
       - '443:443'
-      - '443:443/udp'
       - '80:80'
     volumes:
-      - netbird_caddy_data:/data
-      - ./Caddyfile:/etc/caddy/Caddyfile
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - netbird_traefik_letsencrypt:/letsencrypt
+    labels:
+      - traefik.enable=true
+      # Shared security headers, referenced by every NetBird router below. A
+      # label-declared middleware only exists while its container runs, so this
+      # lives on Traefik itself: declaring it on an app container would drop
+      # every router referencing it whenever that container restarts.
+      - traefik.http.middlewares.nb-security.headers.stsSeconds=3600
+      - traefik.http.middlewares.nb-security.headers.stsIncludeSubdomains=true
+      - traefik.http.middlewares.nb-security.headers.contentTypeNosniff=true
+      - traefik.http.middlewares.nb-security.headers.browserXssFilter=true
+      - traefik.http.middlewares.nb-security.headers.referrerPolicy=strict-origin-when-cross-origin
+      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN
+      # Empty value strips the header. Only the dashboard's nginx sets one; the
+      # server emits none. Do not quote it — "" would send a literal Server: "".
+      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.Server=
 
   dashboard:
     <<: *default
     image: ghcr.io/netbirdio/dashboard-cloud:${NETBIRD_DASHBOARD_TAG}
     container_name: netbird-dashboard
     networks: [netbird]
+    labels:
+      - traefik.enable=true
+      # Dashboard catch-all: lowest priority so every route below wins
+      - traefik.http.routers.netbird-dashboard.rule=Host(`${NETBIRD_DOMAIN}`)
+      - traefik.http.routers.netbird-dashboard.entrypoints=websecure
+      - traefik.http.routers.netbird-dashboard.tls=true
+      - traefik.http.routers.netbird-dashboard.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-dashboard.middlewares=nb-security@docker
+      - traefik.http.routers.netbird-dashboard.service=dashboard
+      - traefik.http.routers.netbird-dashboard.priority=1
+      - traefik.http.services.dashboard.loadbalancer.server.port=80
     environment:
       - NETBIRD_MGMT_API_ENDPOINT=https://${NETBIRD_DOMAIN}
       - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://${NETBIRD_DOMAIN}
@@ -435,6 +615,28 @@ render_compose_server() {
       - netbird_data:/var/lib/netbird
       - ./config.yaml:/etc/netbird/config.yaml
     command: ["--config", "/etc/netbird/config.yaml"]
+    labels:
+      - traefik.enable=true
+      # Signal + Management gRPC (needs an h2c backend for HTTP/2 cleartext)
+      - traefik.http.routers.netbird-grpc.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
+      - traefik.http.routers.netbird-grpc.entrypoints=websecure
+      - traefik.http.routers.netbird-grpc.tls=true
+      - traefik.http.routers.netbird-grpc.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-grpc.middlewares=nb-security@docker
+      - traefik.http.routers.netbird-grpc.service=netbird-server-h2c
+      - traefik.http.routers.netbird-grpc.priority=100
+      # Relay WebSocket, management API, and the embedded IdP
+      - traefik.http.routers.netbird-backend.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
+      - traefik.http.routers.netbird-backend.entrypoints=websecure
+      - traefik.http.routers.netbird-backend.tls=true
+      - traefik.http.routers.netbird-backend.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-backend.middlewares=nb-security@docker
+      - traefik.http.routers.netbird-backend.service=netbird-server
+      - traefik.http.routers.netbird-backend.priority=100
+      # Services
+      - traefik.http.services.netbird-server.loadbalancer.server.port=80
+      - traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80
+      - traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c
     environment:
       - NB_LICENSE_KEY=${NETBIRD_LICENSE_KEY}
       - NETBIRD_LICENSE_SERVER_BASE_URL=${NETBIRD_LICENSE_SERVER_BASE_URL}
@@ -497,6 +699,18 @@ render_compose_flow() {
       - NB_FLOW_NATS_ENDPOINTS=nats://nats:4222
       - NB_FLOW_NATS_STREAM=traffic-events
       - NB_FLOW_AUTH_SECRET=${NETBIRD_RELAY_AUTH_SECRET}
+    labels:
+      - traefik.enable=true
+      # Flow receiver gRPC (h2c backend)
+      - traefik.http.routers.netbird-flow.rule=Host(`${NETBIRD_DOMAIN}`) && PathPrefix(`/flow.FlowService/`)
+      - traefik.http.routers.netbird-flow.entrypoints=websecure
+      - traefik.http.routers.netbird-flow.tls=true
+      - traefik.http.routers.netbird-flow.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-flow.middlewares=nb-security@docker
+      - traefik.http.routers.netbird-flow.service=netbird-flow-h2c
+      - traefik.http.routers.netbird-flow.priority=100
+      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.port=80
+      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.scheme=h2c
 
 EOF
 }
@@ -536,61 +750,16 @@ EOF
   fi
   cat <<'EOF'
   netbird_postgres:
-  netbird_caddy_data:
+  netbird_traefik_letsencrypt:
 
 networks:
   netbird:
-EOF
-}
-
-render_caddyfile() {
-  cat <<'EOF'
-{
-  servers :80,:443 {
-    protocols h1 h2c h2 h3
-  }
-}
-
-(security_headers) {
-    header * {
-        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
-        X-Content-Type-Options "nosniff"
-        X-Frame-Options "SAMEORIGIN"
-        X-XSS-Protection "1; mode=block"
-        -Server
-        Referrer-Policy strict-origin-when-cross-origin
-    }
-}
-
-:80 {
-    redir https://{$CADDY_SECURE_DOMAIN}{uri} permanent
-}
-
-{$CADDY_SECURE_DOMAIN}:443 {
-    import security_headers
-    # Signal (gRPC over h2c)
-    reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-server:80
-    # Management (gRPC over h2c + HTTP)
-    reverse_proxy /management.ManagementService/* h2c://netbird-server:80
-    reverse_proxy /api/* netbird-server:80
-    reverse_proxy /ws-proxy/* netbird-server:80
-    # Embedded IdP (OAuth2 endpoints served by netbird server)
-    reverse_proxy /oauth2/* netbird-server:80
-    # Relay (WebSocket multiplexed on the same port)
-    reverse_proxy /relay* netbird-server:80
-EOF
-
-  if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
-    cat <<'EOF'
-    # Flow receiver (gRPC over h2c)
-    reverse_proxy /flow.FlowService/* h2c://receiver:80
-EOF
-  fi
-
-  cat <<'EOF'
-    # Dashboard
-    reverse_proxy /* dashboard:80
-}
+    name: netbird
+    driver: bridge
+    ipam:
+      config:
+        - subnet: ${NETBIRD_NETWORK_SUBNET}
+          gateway: ${NETBIRD_NETWORK_GATEWAY}
 EOF
 }
 
@@ -609,7 +778,7 @@ server:
   logLevel: "info"
   logFile: "console"
 
-  # TLS is terminated by Caddy in front; leave this block empty.
+  # TLS is terminated by Traefik in front; leave this block empty.
   tls:
     certFile: ""
     keyFile: ""
@@ -632,6 +801,16 @@ server:
     cliRedirectURIs:
       - "http://localhost:53000/"
 
+  # Trust X-Forwarded-* only from the Traefik container's static address. Both
+  # keys must stay in step with the ipv4_address pinned in docker-compose.yml:
+  # trustedPeers decides whether forwarded headers are read at all, and leaving
+  # it unset falls back to 0.0.0.0/0.
+  reverseProxy:
+    trustedPeers:
+      - "${TRAEFIK_IP}/32"
+    trustedHTTPProxies:
+      - "${TRAEFIK_IP}/32"
+
   store:
     engine: "postgres"
     dsn: "${POSTGRES_DSN}"

infrastructure_files/getting-started.sh

@@ -108,6 +108,14 @@ check_nb_domain() {
     echo "The NETBIRD_DOMAIN cannot be netbird.example.com" > /dev/stderr
     return 1
   fi
+
+  # Letters, digits, dots, and hyphens only; the domain is embedded in
+  # generated YAML and env files
+  local re='^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$'
+  if [[ "$DOMAIN" != "use-ip" ]] && [[ ! "$DOMAIN" =~ $re ]]; then
+    echo "The NETBIRD_DOMAIN may only contain letters, digits, dots, and hyphens." > /dev/stderr
+    return 1
+  fi
   return 0
 }
 
@@ -337,6 +345,103 @@ wait_management_direct() {
   return 0
 }
 
+############################################
+# Docker Network Subnet Override and Conflict Check
+############################################
+
+ip_to_int() {
+  local a b c d
+  IFS=. read -r a b c d <<< "$1"
+  echo $(( (10#$a << 24) + (10#$b << 16) + (10#$c << 8) + 10#$d ))
+}
+
+# cidrs_overlap <cidr> <cidr> — succeeds if the networks overlap
+cidrs_overlap() {
+  local net1="${1%/*}" len1="${1#*/}" net2="${2%/*}" len2="${2#*/}"
+  local min_len=$(( len1 < len2 ? len1 : len2 ))
+  local mask=0
+  if [[ "$min_len" -gt 0 ]]; then
+    mask=$(( (0xFFFFFFFF << (32 - min_len)) & 0xFFFFFFFF ))
+  fi
+  [[ $(( $(ip_to_int "$net1") & mask )) -eq $(( $(ip_to_int "$net2") & mask )) ]]
+}
+
+# valid_ipv4_slash24 <cidr> — accepts a unicast IPv4 /24 like 10.123.45.0/24
+valid_ipv4_slash24() {
+  local octet='(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])'
+  local re="^${octet}\.${octet}\.${octet}\.0/24$"
+  [[ "$1" =~ $re ]] || return 1
+  # Reject non-unicast/reserved ranges: 0/8, loopback, link-local, 224+
+  case "$1" in
+    0.*|127.*|169.254.*|22[4-9].*|2[34][0-9].*|25[0-5].*) return 1 ;;
+  esac
+  return 0
+}
+
+# Apply NETBIRD_DOCKER_SUBNET and derive the gateway (.1) and Traefik IP (.10)
+apply_docker_subnet_override() {
+  if [[ -n "${NETBIRD_DOCKER_SUBNET:-}" ]]; then
+    if ! valid_ipv4_slash24 "$NETBIRD_DOCKER_SUBNET"; then
+      echo "NETBIRD_DOCKER_SUBNET must be a unicast IPv4 /24 network like 10.123.45.0/24 (0/8, 127/8, 169.254/16, and 224+ are not allowed), got: $NETBIRD_DOCKER_SUBNET" > /dev/stderr
+      exit 1
+    fi
+    DOCKER_SUBNET="$NETBIRD_DOCKER_SUBNET"
+  fi
+  local base="${DOCKER_SUBNET%.0/24}"
+  DOCKER_GATEWAY="${base}.1"
+  TRAEFIK_IP="${base}.10"
+  return 0
+}
+
+# check_docker_subnet_conflicts <compose network name>
+# Fail early if an existing Docker network overlaps DOCKER_SUBNET, instead
+# of letting "docker compose up" fail later. Host routes are not checked;
+# NETBIRD_DOCKER_SUBNET covers those cases.
+check_docker_subnet_conflicts() {
+  local expected_network="$1"
+  command -v docker &> /dev/null || return 0
+
+  local name subnets subnet
+  while IFS='|' read -r name subnets; do
+    for subnet in $subnets; do
+      [[ "$subnet" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/[0-9]+$ ]] || continue
+      if [[ "$name" == "$expected_network" ]]; then
+        # Our own leftover network: compose reuses it as-is, so its subnet
+        # must match the one we render
+        if [[ "$subnet" != "$DOCKER_SUBNET" ]]; then
+          echo "ERROR: the Docker network '$name', left over from a previous NetBird install, uses $subnet instead of $DOCKER_SUBNET." > /dev/stderr
+          echo "docker compose would reuse it as-is, and the generated configuration would not match it." > /dev/stderr
+          echo "Remove it and run this script again:" > /dev/stderr
+          echo "  docker network rm $name" > /dev/stderr
+          exit 1
+        fi
+      elif cidrs_overlap "$DOCKER_SUBNET" "$subnet"; then
+        echo "ERROR: the existing Docker network '$name' ($subnet) overlaps $DOCKER_SUBNET, the subnet NetBird would use." > /dev/stderr
+        echo "That network is not managed by this script and is left untouched." > /dev/stderr
+        echo "Pick a free /24 for NetBird instead and run this script again:" > /dev/stderr
+        echo "  NETBIRD_DOCKER_SUBNET=10.123.45.0/24 ./getting-started.sh" > /dev/stderr
+        exit 1
+      fi
+    done
+  done < <(docker network inspect --format '{{.Name}}|{{range .IPAM.Config}}{{.Subnet}} {{end}}' $(docker network ls -q 2>/dev/null) 2>/dev/null || true)
+  return 0
+}
+
+configure_docker_subnet() {
+  # Only the built-in Traefik mode pins a subnet; other modes let Docker pick
+  if [[ "$REVERSE_PROXY_TYPE" != "0" ]]; then
+    return 0
+  fi
+
+  # Skip our own network (<project>_netbird) in the conflict check;
+  # normalization matches compose-go's NormalizeProjectName
+  local project
+  project="${COMPOSE_PROJECT_NAME:-$(basename "$PWD")}"
+  project=$(echo "$project" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9_-]//g; s/^[_-]*//')
+  check_docker_subnet_conflicts "${project}_netbird"
+  return 0
+}
+
 ############################################
 # Initialization and Configuration
 ############################################
@@ -368,7 +473,11 @@ initialize_default_values() {
   BIND_LOCALHOST_ONLY="true"
   EXTERNAL_PROXY_NETWORK=""
 
-  # Traefik static IP within the internal bridge network
+  # Internal bridge network. Management and proxy trust forwarded headers
+  # from TRAEFIK_IP only, so all three values derive from the same /24.
+  # Override with NETBIRD_DOCKER_SUBNET.
+  DOCKER_SUBNET="172.30.0.0/24"
+  DOCKER_GATEWAY="172.30.0.1"
   TRAEFIK_IP="172.30.0.10"
 
   # NetBird Proxy configuration
@@ -663,8 +772,10 @@ init_environment() {
   check_docker_sock_perms
 
   initialize_default_values
+  apply_docker_subnet_override
   configure_domain
   configure_reverse_proxy
+  configure_docker_subnet
 
   check_jq
 
@@ -686,6 +797,7 @@ render_docker_compose_traefik_builtin() {
   local crowdsec_volumes=""
   local traefik_file_provider=""
   local traefik_dynamic_volume=""
+
   if [[ "$ENABLE_PROXY" == "true" ]]; then
     traefik_file_provider='      - "--providers.file.filename=/etc/traefik/dynamic.yaml"'
     traefik_dynamic_volume="      - ./traefik-dynamic.yaml:/etc/traefik/dynamic.yaml:ro"
@@ -884,8 +996,8 @@ networks:
     driver: bridge
     ipam:
       config:
-        - subnet: 172.30.0.0/24
-          gateway: 172.30.0.1
+        - subnet: $DOCKER_SUBNET
+          gateway: $DOCKER_GATEWAY
 EOF
   return 0
 }

infrastructure_files/migrate-to-enterprise.sh

@@ -15,7 +15,11 @@ set -o pipefail
 #   2. Postgres migration — add Postgres, migrate SQLite data via migrate-store.
 #   3. Traffic flow       — add NATS + flow-enricher + flow-receiver.
 #
-# To revert:
+# If any step fails once the stack has been touched, the script rolls itself
+# back automatically: generated files are removed, the Postgres volume this run
+# created is dropped, and the original deployment is started again.
+#
+# To revert a successful migration:
 #   docker compose down
 #   rm -f docker-compose.override.yml config.yaml.enterprise
 #   # If Postgres migration was done, also restore the SQLite backup printed
@@ -25,6 +29,15 @@ set -o pipefail
 OVERRIDE_FILE="docker-compose.override.yml"
 ENTERPRISE_CONFIG_FILE="config.yaml.enterprise"
 
+# Rollback bookkeeping. ROLLBACK_STATE flips to "armed" the moment the script
+# starts mutating the deployment, and back to "disarmed" once the migration has
+# completed successfully.
+ROLLBACK_STATE="disarmed"
+ENV_EXISTED="unknown"
+ENV_BACKUP=""
+PG_VOLUME_NAME=""
+BACKUP_DIR=""
+
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
 check_docker_compose() {
@@ -361,7 +374,77 @@ render_enterprise_config() {
 # Execution steps
 # ---------------------------------------------------------------------------
 
-resolve_data_volume() {
+combined_container_id() {
+  $DOCKER_COMPOSE_COMMAND ps -aq "$COMBINED_SERVICE" 2>/dev/null | head -1
+}
+
+container_data_mount() {
+  local container="$1"
+  [[ -n "$container" ]] || return 0
+  docker inspect "$container" --format \
+    '{{range .Mounts}}{{if eq .Destination "/var/lib/netbird"}}{{if .Name}}{{.Name}}{{else}}{{.Source}}{{end}}{{end}}{{end}}' 2>/dev/null
+}
+
+# The name comes from the container, so `-v` cannot invent an empty volume here.
+# 0 = empty, 1 = holds data, 2 = could not determine. A failed listing must not
+# be reported as empty: that would abort a healthy migration over a pull error
+# or an unreadable bind mount.
+data_dir_state() {
+  local src="$1" out
+  if [[ "$src" == /* ]]; then
+    [[ -d "$src" ]] || return 2
+    out=$(ls -A "$src" 2>/dev/null) || return 2
+  else
+    docker volume inspect "$src" &> /dev/null || return 0
+    out=$(docker run --rm -v "${src}:/d:ro" busybox sh -c 'ls -A /d' 2>/dev/null) || return 2
+  fi
+  [[ -z "$out" ]] && return 0
+  return 1
+}
+
+check_data_directory() {
+  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
+
+  local container
+  container=$(combined_container_id)
+  if [[ -z "$container" ]]; then
+    echo "" > /dev/stderr
+    echo "No container found for service '$COMBINED_SERVICE'." > /dev/stderr
+    echo "The migration backs up the store by copying it out of that container," > /dev/stderr
+    echo "so it has to exist. Start the deployment and re-run:" > /dev/stderr
+    echo "  $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
+    exit 1
+  fi
+
+  local src
+  src=$(container_data_mount "$container")
+  if [[ -z "$src" ]]; then
+    echo "" > /dev/stderr
+    echo "The '$COMBINED_SERVICE' container has nothing mounted at /var/lib/netbird." > /dev/stderr
+    echo "Cannot locate the NetBird store to back it up." > /dev/stderr
+    exit 1
+  fi
+
+  local state=0
+  data_dir_state "$src" || state=$?
+  if [[ $state -eq 0 ]]; then
+    echo "" > /dev/stderr
+    echo "The NetBird data directory is empty:" > /dev/stderr
+    echo "  $src" > /dev/stderr
+    echo "There is nothing to migrate. Check that you are running this from the" > /dev/stderr
+    echo "deployment directory of the NetBird install you mean to migrate." > /dev/stderr
+    exit 1
+  fi
+  if [[ $state -eq 2 ]]; then
+    echo "  ⚠ Could not read $src to confirm it holds data — continuing." > /dev/stderr
+    echo "    The backup step still fails loudly if it turns out to be empty." > /dev/stderr
+  fi
+
+  echo "  Data directory:   $src"
+}
+
+# Only for the Postgres volume, which has no container to read it off yet.
+resolve_compose_volume() {
   local short="$1"
   local actual
   # Resolve project-prefixed volume name from Docker Compose config first.
@@ -391,18 +474,21 @@ resolve_data_volume() {
 backup_sqlite() {
   BACKUP_DIR="$(pwd)/backups/sqlite-pre-enterprise-$(date +%Y%m%d-%H%M%S)"
   mkdir -p "$BACKUP_DIR"
-  local data_volume_actual
-  data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
-  echo "Backing up SQLite store from volume '$data_volume_actual' to $BACKUP_DIR ..."
-  docker run --rm \
-    -v "${data_volume_actual}:/var/lib/netbird:ro" \
-    -v "${BACKUP_DIR}:/backup" \
-    busybox \
-    sh -c 'cp -a /var/lib/netbird/. /backup/ 2>/dev/null || true'
+
+  local container
+  container=$(combined_container_id)
+  if [[ -z "$container" ]]; then
+    echo "  ⚠ No container found for '$COMBINED_SERVICE' — cannot back up the store." > /dev/stderr
+    exit 1
+  fi
+
+  echo "Backing up the NetBird store to $BACKUP_DIR ..."
+  docker cp "${container}:/var/lib/netbird/." "$BACKUP_DIR/"
+
   local copied
   copied=$(find "$BACKUP_DIR" -mindepth 1 | head -1)
   if [[ -z "$copied" ]]; then
-    echo "  ⚠ Backup directory is empty — the volume '$data_volume_actual' didn't contain data. Aborting." > /dev/stderr
+    echo "  ⚠ Backup directory is empty — /var/lib/netbird held no data. Aborting." > /dev/stderr
     exit 1
   fi
   echo "  done"
@@ -414,6 +500,135 @@ run_migrate_store() {
   echo "  done"
 }
 
+# ---------------------------------------------------------------------------
+# Rollback — a failed run must not leave the operator with a stopped stack and
+# half-written artifacts.
+# ---------------------------------------------------------------------------
+
+# Resolve the name Compose would give the Postgres volume before the override
+# exists, so a leftover volume can be spotted up front.
+compose_project_name() {
+  local container project
+  container=$($DOCKER_COMPOSE_COMMAND ps -aq 2>/dev/null | head -1)
+  if [[ -n "$container" ]]; then
+    project=$(docker inspect "$container" \
+      --format '{{index .Config.Labels "com.docker.compose.project"}}' 2>/dev/null)
+    if [[ -n "$project" ]]; then
+      echo "$project"
+      return 0
+    fi
+  fi
+  project=$($DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval '.name // ""' - 2>/dev/null)
+  if [[ -n "$project" ]] && [[ "$project" != "null" ]]; then
+    echo "$project"
+  fi
+  return 0
+}
+
+postgres_volume_name() {
+  local project
+  project=$(compose_project_name)
+  if [[ -n "$project" ]]; then
+    echo "${project}_netbird_postgres"
+  fi
+  return 0
+}
+
+# Postgres skips initdb when its data directory is non-empty, so a volume left
+# behind by an interrupted run would keep the old password and old contents,
+# and migrate-store would fail against it.
+check_stale_postgres_volume() {
+  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
+
+  PG_VOLUME_NAME=$(postgres_volume_name)
+  if [[ -z "$PG_VOLUME_NAME" ]]; then
+    echo ""
+    echo "  ⚠ Could not determine the Compose project name, so a Postgres volume"
+    echo "    left over from an earlier attempt cannot be checked for. If a"
+    echo "    previous run failed, remove it before continuing:"
+    echo "      docker volume ls | grep netbird_postgres"
+    return 0
+  fi
+  docker volume inspect "$PG_VOLUME_NAME" &> /dev/null || return 0
+
+  echo ""
+  echo "  ⚠  A Postgres volume from an earlier attempt already exists:"
+  echo "       $PG_VOLUME_NAME"
+  echo "     Postgres does not re-initialise a non-empty data directory, so the"
+  echo "     migration would run against stale credentials and stale data."
+  local remove
+  remove=$(read_yes_no "  Remove it and continue?" "y")
+  if [[ "$remove" != "yes" ]]; then
+    echo "" > /dev/stderr
+    echo "Aborted. Remove it manually with: docker volume rm $PG_VOLUME_NAME" > /dev/stderr
+    exit 1
+  fi
+  docker volume rm "$PG_VOLUME_NAME" > /dev/null
+  echo "  Removed."
+}
+
+# Undo whatever this run changed and start the previous deployment again.
+rollback() {
+  ROLLBACK_STATE="done"
+
+  echo ""
+  echo "──────────────────────────────────────────────────────────────────────"
+  echo " Migration failed — restoring the previous deployment"
+  echo "──────────────────────────────────────────────────────────────────────"
+
+  # Resolve while the override is still present; without it Compose no longer
+  # knows about the Postgres volume.
+  local pg_volume="$PG_VOLUME_NAME"
+  if [[ -z "$pg_volume" ]] && [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    pg_volume=$(postgres_volume_name)
+  fi
+
+  echo ""
+  echo "Stopping services ..."
+  $DOCKER_COMPOSE_COMMAND down || true
+
+  echo "Removing generated files ..."
+  rm -f "$OVERRIDE_FILE" "$ENTERPRISE_CONFIG_FILE"
+
+  # Restore .env to exactly what it was, or remove it if this run created it.
+  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
+    mv -f "$ENV_BACKUP" .env || echo "  ⚠ Could not restore .env from $ENV_BACKUP." > /dev/stderr
+  elif [[ "$ENV_EXISTED" == "no" ]]; then
+    rm -f .env || true
+  fi
+
+  # Only ever the volume this run created — never the NetBird data volume.
+  if [[ -n "$pg_volume" ]] && [[ "$pg_volume" != "null" ]]; then
+    echo "Removing Postgres volume $pg_volume ..."
+    docker volume rm "$pg_volume" &> /dev/null || true
+  fi
+
+  echo "Starting the previous deployment ..."
+  if ! $DOCKER_COMPOSE_COMMAND up -d; then
+    echo ""
+    echo "  ⚠ Could not start the previous deployment automatically." > /dev/stderr
+    echo "    Run: $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
+  fi
+
+  echo ""
+  echo "Rolled back. Your docker-compose.yml, config.yaml and the NetBird data"
+  echo "volume were never modified."
+  if [[ -n "$BACKUP_DIR" ]] && [[ -d "$BACKUP_DIR" ]]; then
+    echo "The SQLite backup taken during this run is kept at:"
+    echo "  $BACKUP_DIR"
+  fi
+  echo "──────────────────────────────────────────────────────────────────────"
+}
+
+on_exit() {
+  local code=$?
+  trap - EXIT
+  if [[ $code -ne 0 ]] && [[ "$ROLLBACK_STATE" == "armed" ]]; then
+    rollback
+  fi
+  exit $code
+}
+
 # ---------------------------------------------------------------------------
 # Main
 # ---------------------------------------------------------------------------
@@ -541,9 +756,15 @@ init_migration() {
     ENABLE_FLOW="no"
     echo "Step 3 (traffic flow) skipped — requires Postgres."
   fi
+
+  check_data_directory
+  check_stale_postgres_volume
 }
 
 apply_changes() {
+  # From here on a failure must roll the deployment back.
+  ROLLBACK_STATE="armed"
+
   echo ""
   echo "Writing $OVERRIDE_FILE ..."
   install -m 644 /dev/null "$OVERRIDE_FILE"
@@ -564,6 +785,14 @@ apply_changes() {
   # picks it up automatically.
   echo "Writing .env additions (mode 600) ..."
   local ENV_FILE=".env"
+  # Snapshot the operator's .env so a rollback can restore it byte for byte.
+  if [[ -f "$ENV_FILE" ]]; then
+    ENV_EXISTED="yes"
+    ENV_BACKUP="${ENV_FILE}.pre-enterprise-$(date +%Y%m%d-%H%M%S)"
+    cp -p "$ENV_FILE" "$ENV_BACKUP"
+  else
+    ENV_EXISTED="no"
+  fi
   touch "$ENV_FILE"
   chmod 600 "$ENV_FILE"
   {
@@ -592,11 +821,16 @@ apply_changes() {
 
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     echo ""
-    echo "Stopping existing services (volumes preserved) ..."
-    $DOCKER_COMPOSE_COMMAND down
+    # Stop, but keep the containers: the backup reads the store out of one.
+    echo "Stopping services so the store is quiescent ..."
+    $DOCKER_COMPOSE_COMMAND stop
 
     backup_sqlite
 
+    echo ""
+    echo "Removing stopped containers (volumes preserved) ..."
+    $DOCKER_COMPOSE_COMMAND down
+
     echo ""
     echo "Starting Postgres ..."
     $DOCKER_COMPOSE_COMMAND up -d postgres
@@ -626,6 +860,9 @@ apply_changes() {
 
   echo ""
   echo "Migration complete."
+
+  # Nothing left to undo.
+  ROLLBACK_STATE="disarmed"
 }
 
 print_summary() {
@@ -643,6 +880,7 @@ print_summary() {
   echo "    $OVERRIDE_FILE"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
   echo "    .env  (license key + secrets, mode 600)"
+  [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]] && echo "    $ENV_BACKUP  (.env as it was before this run)"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    backups/sqlite-pre-enterprise-*/  (SQLite backup)"
   echo ""
   echo " Tail logs:"
@@ -651,19 +889,27 @@ print_summary() {
   echo "──────────────────────────────────────────────────────────────────────"
   echo " To revert"
   echo "──────────────────────────────────────────────────────────────────────"
-  echo "  $DOCKER_COMPOSE_COMMAND down"
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    # Resolve project-prefixed volume names now (before override is removed).
-    local pg_volume data_volume_actual
-    pg_volume=$(resolve_data_volume "netbird_postgres")
-    data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
-    echo "  # Remove the Postgres volume FIRST, before deleting the override file:"
-    echo "  docker volume rm $pg_volume"
+    # Resolve the project-prefixed volume name now, before the override is gone.
+    local pg_volume
+    pg_volume=$(resolve_compose_volume "netbird_postgres")
+    echo "  # Stop, but keep the containers so the store can be copied back in:"
+    echo "  $DOCKER_COMPOSE_COMMAND stop"
     echo "  # Restore SQLite from the backup created during this run:"
-    echo "  docker run --rm -v ${data_volume_actual}:/var/lib/netbird -v ${BACKUP_DIR}:/backup busybox sh -c 'cp -a /backup/. /var/lib/netbird/'"
+    echo "  docker cp ${BACKUP_DIR}/. \$($DOCKER_COMPOSE_COMMAND ps -aq $COMBINED_SERVICE):/var/lib/netbird/"
+    echo "  $DOCKER_COMPOSE_COMMAND down"
+    echo "  docker volume rm $pg_volume"
+  else
+    echo "  $DOCKER_COMPOSE_COMMAND down"
   fi
   echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
-  echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
+  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
+    echo "  mv $ENV_BACKUP .env   # restores .env as it was before this run"
+  elif [[ "$ENV_EXISTED" == "no" ]]; then
+    echo "  rm -f .env   # created by this run"
+  else
+    echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
+  fi
   echo "  $DOCKER_COMPOSE_COMMAND up -d"
   echo "──────────────────────────────────────────────────────────────────────"
 }
@@ -672,6 +918,10 @@ print_summary() {
 # Run
 # ---------------------------------------------------------------------------
 
+trap on_exit EXIT
+# Turn signals into a normal exit so the EXIT trap can roll back.
+trap 'exit 130' INT TERM
+
 init_migration
 apply_changes
 print_summary

management/internals/modules/agentnetwork/handlers/handlers_test.go

@@ -17,6 +17,7 @@ import (
 
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/account"
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -61,10 +62,23 @@ func newAgentNetworkHandlerFixture(t *testing.T) *agentNetworkHandlerFixture {
 		Return(true, context.Background(), nil).
 		AnyTimes()
 
-	manager := agentnetwork.NewManager(st, perms, nil, nil)
+	// Swallow activity events so the mutation paths (create/update/delete)
+	// are exercisable through the HTTP layer.
+	accounts := account.NewMockManager(ctrl)
+	accounts.EXPECT().
+		StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).
+		AnyTimes()
+	accounts.EXPECT().
+		UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).
+		AnyTimes()
+
+	manager := agentnetwork.NewManager(st, perms, accounts, nil)
 	h := &handler{manager: manager}
 
 	router := mux.NewRouter()
+	router.HandleFunc("/agent-network/providers", h.createProvider).Methods("POST")
+	router.HandleFunc("/agent-network/providers/{providerId}", h.getProvider).Methods("GET")
+	router.HandleFunc("/agent-network/providers/{providerId}", h.updateProvider).Methods("PUT")
 	h.addPolicyEndpoints(router)
 	h.addConsumptionEndpoints(router)
 	h.addBudgetRuleEndpoints(router)

management/internals/modules/agentnetwork/handlers/providers_handler_test.go

@@ -1,7 +1,9 @@
 package handlers
 
 import (
+	"encoding/json"
 	"math"
+	nethttp "net/http"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -51,3 +53,50 @@ func TestValidate_ModelRates(t *testing.T) {
 		assert.Error(t, validate(base(m), true), "case %q must be rejected", name)
 	}
 }
+
+// TestProviderHandler_UpdateReplacesFullState pins the update contract shared
+// with the other PUT endpoints: the request replaces the provider's mutable
+// state, so optional fields absent from the JSON land as their zero values.
+// The two exceptions are server-side: the api_key (a secret — omitted means
+// "not rotated") and the session keypair, both preserved by the manager. The
+// identity headers stay on the wire as explicit empty strings so a cleared
+// value round-trips.
+func TestProviderHandler_UpdateReplacesFullState(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	create := `{
+        "provider_id": "openai_api",
+        "name": "openai",
+        "upstream_url": "https://api.openai.com",
+        "api_key": "sk-test",
+        "enabled": true,
+        "metadata_disabled": true,
+        "skip_tls_verification": true,
+        "extra_values": {"x-portkey-config": "pc-prod-3f2a"},
+        "identity_header_user_id": "x-bf-dim-netbird_user_id",
+        "models": [{"id": "gpt-4o", "input_per_1k": 0.0025, "output_per_1k": 0.01}]
+    }`
+	rec := f.do(t, nethttp.MethodPost, "/agent-network/providers", create)
+	require.Equal(t, nethttp.StatusOK, rec.Code, "create must succeed: %s", rec.Body.String())
+
+	var created api.AgentNetworkProvider
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &created))
+
+	// Minimal update: only the required fields, no api_key. Everything
+	// optional must land as its zero value.
+	update := `{"provider_id": "openai_api", "name": "openai-renamed", "upstream_url": "https://api.openai.com", "enabled": true}`
+	rec = f.do(t, nethttp.MethodPut, "/agent-network/providers/"+created.Id, update)
+	require.Equal(t, nethttp.StatusOK, rec.Code, "update without api_key must succeed (key is preserved): %s", rec.Body.String())
+
+	var updated api.AgentNetworkProvider
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &updated))
+	assert.Equal(t, "openai-renamed", updated.Name, "sent field must apply")
+	assert.True(t, updated.Enabled, "sent field must apply")
+	assert.False(t, updated.MetadataDisabled, "omitted metadata_disabled must land as false — PUT replaces the full state")
+	assert.False(t, updated.SkipTlsVerification, "omitted skip_tls_verification must land as false")
+	assert.Nil(t, updated.ExtraValues, "omitted extra_values must be cleared")
+	assert.Equal(t, "", updated.IdentityHeaderUserId, "omitted identity header must be cleared yet stay on the wire")
+	assert.Empty(t, updated.Models, "omitted models must be cleared")
+	assert.Contains(t, rec.Body.String(), `"identity_header_user_id":""`,
+		"cleared identity header must round-trip as an explicit empty string")
+}

management/internals/modules/agentnetwork/handlers/settings_handler.go

@@ -2,7 +2,6 @@ package handlers
 
 import (
 	"encoding/json"
-	"errors"
 	"net/http"
 
 	"github.com/gorilla/mux"
@@ -11,19 +10,20 @@ import (
 	nbcontext "github.com/netbirdio/netbird/management/server/context"
 	"github.com/netbirdio/netbird/shared/management/http/api"
 	"github.com/netbirdio/netbird/shared/management/http/util"
-	"github.com/netbirdio/netbird/shared/management/status"
 )
 
 // addSettingsEndpoints registers the Agent Network settings routes. The
-// settings row is bootstrapped server-side on first provider create; GET reads
-// it and PUT updates the mutable collection toggles (cluster/subdomain stay
-// immutable).
+// settings row is bootstrapped server-side on first provider create or on the
+// first PUT carrying a cluster; GET reads it and PUT applies a partial update
+// of the mutable collection toggles (cluster/subdomain stay immutable).
 func (h *handler) addSettingsEndpoints(router *mux.Router) {
 	router.HandleFunc("/agent-network/settings", h.getSettings).Methods("GET", "OPTIONS")
 	router.HandleFunc("/agent-network/settings", h.updateSettings).Methods("PUT", "OPTIONS")
 }
 
-// updateSettings applies the collection toggles to the account's settings row.
+// updateSettings replaces the mutable settings fields on the account's row.
+// A request carrying a cluster bootstraps the row when the account doesn't
+// have one yet.
 func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -48,11 +48,9 @@ func (h *handler) updateSettings(w http.ResponseWriter, r *http.Request) {
 	util.WriteJSONObject(r.Context(), w, updated.ToAPIResponse())
 }
 
-// getSettings returns the account's agent-network settings. The settings
-// row is bootstrapped on first provider create, so freshly-onboarded
-// accounts have nothing to read. Rather than 404-ing in that case (which
-// the dashboard would have to special-case), return a JSON null with 200
-// so consumers can branch on the body alone.
+// getSettings returns the account's agent-network settings. Accounts that
+// haven't been bootstrapped yet read as the defaults with an empty cluster,
+// subdomain and endpoint; the manager synthesises that view.
 func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
 	userAuth, err := nbcontext.GetUserAuthFromContext(r.Context())
 	if err != nil {
@@ -62,11 +60,6 @@ func (h *handler) getSettings(w http.ResponseWriter, r *http.Request) {
 
 	settings, err := h.manager.GetSettings(r.Context(), userAuth.AccountId, userAuth.UserId)
 	if err != nil {
-		var sErr *status.Error
-		if errors.As(err, &sErr) && sErr.Type() == status.NotFound {
-			util.WriteJSONObject(r.Context(), w, nil)
-			return
-		}
 		util.WriteError(r.Context(), err, w)
 		return
 	}

management/internals/modules/agentnetwork/handlers/settings_handler_test.go

@@ -0,0 +1,137 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/shared/management/http/api"
+)
+
+// TestSettingsHandler_GetUnbootstrappedReturnsDefaults pins the settings-read
+// convention shared with the account and DNS settings endpoints: settings
+// always read as a JSON object. Before bootstrap that object carries the
+// defaults with an empty cluster/subdomain/endpoint (the "not bootstrapped"
+// signal) and no timestamps — never a 404 and never the legacy null body.
+func TestSettingsHandler_GetUnbootstrappedReturnsDefaults(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodGet, "/agent-network/settings", "")
+	require.Equal(t, http.StatusOK, rec.Code,
+		"unbootstrapped account must read as 200 with defaults: got %d body=%s", rec.Code, rec.Body.String())
+	require.NotEqual(t, "null", trimSpace(rec.Body.String()),
+		"the legacy 200+null shape must not come back")
+
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.Empty(t, got.Cluster, "cluster must be empty until bootstrapped")
+	assert.Empty(t, got.Subdomain, "subdomain must be empty until bootstrapped")
+	assert.Empty(t, got.Endpoint, "endpoint must be empty until bootstrapped, not a bare dot")
+	assert.True(t, got.EnableLogCollection, "defaults must show log collection on, matching bootstrap")
+	assert.False(t, got.EnablePromptCollection, "defaults must show prompt collection off")
+	assert.False(t, got.RedactPii, "defaults must show redaction off")
+	require.NotNil(t, got.AccessLogRetentionDays)
+	assert.Equal(t, 30, *got.AccessLogRetentionDays, "defaults must show the bootstrap retention")
+	assert.Nil(t, got.CreatedAt, "no timestamps before a row exists")
+	assert.Nil(t, got.UpdatedAt, "no timestamps before a row exists")
+}
+
+// TestSettingsHandler_PutBootstrapsWithCluster covers the settings-first
+// bootstrap path: a PUT carrying a cluster on an unbootstrapped account
+// creates the row (cluster pinned, subdomain assigned) and applies the
+// mutable fields from the same request.
+func TestSettingsHandler_PutBootstrapsWithCluster(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": true, "redact_pii": false, "access_log_retention_days": 30}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap PUT must succeed: %s", rec.Body.String())
+
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.Equal(t, "eu.proxy.netbird.io", got.Cluster, "cluster must be pinned from the request")
+	assert.NotEmpty(t, got.Subdomain, "subdomain must be assigned at bootstrap")
+	assert.Equal(t, got.Subdomain+".eu.proxy.netbird.io", got.Endpoint, "endpoint must combine subdomain and cluster")
+	assert.True(t, got.EnableLogCollection, "toggle from the bootstrap request must apply")
+	assert.True(t, got.EnablePromptCollection, "toggle from the bootstrap request must apply")
+	require.NotNil(t, got.AccessLogRetentionDays)
+	assert.Equal(t, 30, *got.AccessLogRetentionDays, "retention from the bootstrap request must apply")
+
+	// The row is now readable via GET.
+	rec = f.do(t, http.MethodGet, "/agent-network/settings", "")
+	require.Equal(t, http.StatusOK, rec.Code, "GET after bootstrap must succeed")
+}
+
+// TestSettingsHandler_PutWithoutClusterOnUnbootstrapped pins that a PUT
+// without a cluster cannot conjure a settings row out of nothing — there is
+// no cluster to pin — and surfaces as 404 like the GET.
+func TestSettingsHandler_PutWithoutClusterOnUnbootstrapped(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"enable_log_collection": false, "enable_prompt_collection": false, "redact_pii": false}`)
+	assert.Equal(t, http.StatusNotFound, rec.Code,
+		"cluster-less PUT on an unbootstrapped account must 404: got %d body=%s", rec.Code, rec.Body.String())
+	assert.Contains(t, rec.Body.String(), "cluster",
+		"the error must point the caller at the bootstrap paths: %s", rec.Body.String())
+}
+
+// TestSettingsHandler_PutReplacesMutableFields pins the update contract shared
+// with the other PUT endpoints: the request replaces every mutable field, so a
+// toggle absent from the JSON lands as its zero value rather than being
+// preserved. Cluster and subdomain survive untouched.
+func TestSettingsHandler_PutReplacesMutableFields(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": true, "redact_pii": true, "access_log_retention_days": 14}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap PUT must succeed: %s", rec.Body.String())
+
+	var before api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &before))
+
+	rec = f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
+	require.Equal(t, http.StatusOK, rec.Code, "update PUT must succeed: %s", rec.Body.String())
+
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.True(t, got.EnableLogCollection, "sent toggle must apply")
+	assert.False(t, got.EnablePromptCollection, "sent toggle must apply")
+	assert.False(t, got.RedactPii, "sent toggle must apply")
+	require.NotNil(t, got.AccessLogRetentionDays)
+	assert.Equal(t, 0, *got.AccessLogRetentionDays,
+		"retention absent from the request must land as the zero value — PUT replaces all mutable fields")
+	assert.Equal(t, before.Cluster, got.Cluster, "cluster must survive updates untouched")
+	assert.Equal(t, before.Subdomain, got.Subdomain, "subdomain must survive updates untouched")
+}
+
+// TestSettingsHandler_PutRejectsClusterChange pins cluster immutability: once
+// assigned, a differing cluster is rejected as a validation error instead of
+// being silently ignored, so callers never observe a value other than the one
+// they sent. Echoing the assigned cluster back stays valid, which lets
+// declarative clients send their full desired state idempotently.
+func TestSettingsHandler_PutRejectsClusterChange(t *testing.T) {
+	f := newAgentNetworkHandlerFixture(t)
+
+	rec := f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
+	require.Equal(t, http.StatusOK, rec.Code, "bootstrap PUT must succeed: %s", rec.Body.String())
+
+	rec = f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"cluster": "us.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": false}`)
+	assert.Equal(t, http.StatusUnprocessableEntity, rec.Code,
+		"cluster change must be rejected as a validation error: got %d body=%s", rec.Code, rec.Body.String())
+
+	rec = f.do(t, http.MethodPut, "/agent-network/settings",
+		`{"cluster": "eu.proxy.netbird.io", "enable_log_collection": true, "enable_prompt_collection": false, "redact_pii": true}`)
+	require.Equal(t, http.StatusOK, rec.Code, "echoing the assigned cluster must stay valid: %s", rec.Body.String())
+
+	var got api.AgentNetworkSettings
+	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &got))
+	assert.Equal(t, "eu.proxy.netbird.io", got.Cluster, "cluster must be unchanged")
+	assert.True(t, got.RedactPii, "toggle sent alongside the echoed cluster must apply")
+}

management/internals/modules/agentnetwork/manager.go

@@ -157,14 +157,14 @@ func NewManager(
 }
 
 func (m *managerImpl) GetAllProviders(ctx context.Context, accountID, userID string) ([]*types.Provider, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, accountID)
 }
 
 func (m *managerImpl) GetProvider(ctx context.Context, accountID, userID, providerID string) (*types.Provider, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkProviderByID(ctx, store.LockingStrengthNone, accountID, providerID)
@@ -175,9 +175,14 @@ func (m *managerImpl) GetProvider(ctx context.Context, accountID, userID, provid
 // been created yet; otherwise it is ignored (the cluster is pinned on
 // Settings and every provider in the account routes through it).
 func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provider *types.Provider, bootstrapCluster string) (*types.Provider, error) {
-	if err := m.requirePermission(ctx, provider.AccountID, userID, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, provider.AccountID, userID, modules.AgentNetworkProviders, operations.Create); err != nil {
 		return nil, err
 	}
+	if strings.TrimSpace(bootstrapCluster) != "" {
+		if err := m.requireSettingsBootstrapPermission(ctx, provider.AccountID, userID); err != nil {
+			return nil, err
+		}
+	}
 
 	// An empty api_key would silently produce a synthesised service
 	// that 401s on every upstream request. Surface the misconfiguration
@@ -202,7 +207,7 @@ func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provide
 	}
 
 	if strings.TrimSpace(bootstrapCluster) != "" {
-		if _, err := m.bootstrapSettingsIfNeeded(ctx, provider.AccountID, bootstrapCluster); err != nil {
+		if _, err := m.bootstrapSettingsIfNeeded(ctx, m.store, provider.AccountID, bootstrapCluster); err != nil {
 			// The provider create has already succeeded; logging the
 			// bootstrap miss matches the plan's PoC behaviour. The synth
 			// path treats a missing settings row as a no-op, and the next
@@ -218,7 +223,7 @@ func (m *managerImpl) CreateProvider(ctx context.Context, userID string, provide
 }
 
 func (m *managerImpl) UpdateProvider(ctx context.Context, userID string, provider *types.Provider) (*types.Provider, error) {
-	if err := m.requirePermission(ctx, provider.AccountID, userID, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, provider.AccountID, userID, modules.AgentNetworkProviders, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -257,7 +262,7 @@ func (m *managerImpl) UpdateProvider(ctx context.Context, userID string, provide
 }
 
 func (m *managerImpl) DeleteProvider(ctx context.Context, accountID, userID, providerID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkProviders, operations.Delete); err != nil {
 		return err
 	}
 
@@ -306,21 +311,21 @@ func pluralize(n int, singular, plural string) string {
 }
 
 func (m *managerImpl) GetAllPolicies(ctx context.Context, accountID, userID string) ([]*types.Policy, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkPolicies, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
 }
 
 func (m *managerImpl) GetPolicy(ctx context.Context, accountID, userID, policyID string) (*types.Policy, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkPolicies, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkPolicyByID(ctx, store.LockingStrengthNone, accountID, policyID)
 }
 
 func (m *managerImpl) CreatePolicy(ctx context.Context, userID string, policy *types.Policy) (*types.Policy, error) {
-	if err := m.requirePermission(ctx, policy.AccountID, userID, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, policy.AccountID, userID, modules.AgentNetworkPolicies, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -346,7 +351,7 @@ func (m *managerImpl) CreatePolicy(ctx context.Context, userID string, policy *t
 }
 
 func (m *managerImpl) UpdatePolicy(ctx context.Context, userID string, policy *types.Policy) (*types.Policy, error) {
-	if err := m.requirePermission(ctx, policy.AccountID, userID, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, policy.AccountID, userID, modules.AgentNetworkPolicies, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -373,7 +378,7 @@ func (m *managerImpl) UpdatePolicy(ctx context.Context, userID string, policy *t
 }
 
 func (m *managerImpl) DeletePolicy(ctx context.Context, accountID, userID, policyID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkPolicies, operations.Delete); err != nil {
 		return err
 	}
 
@@ -393,21 +398,21 @@ func (m *managerImpl) DeletePolicy(ctx context.Context, accountID, userID, polic
 }
 
 func (m *managerImpl) GetAllGuardrails(ctx context.Context, accountID, userID string) ([]*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkGuardrails, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkGuardrails(ctx, store.LockingStrengthNone, accountID)
 }
 
 func (m *managerImpl) GetGuardrail(ctx context.Context, accountID, userID, guardrailID string) (*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkGuardrails, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkGuardrailByID(ctx, store.LockingStrengthNone, accountID, guardrailID)
 }
 
 func (m *managerImpl) CreateGuardrail(ctx context.Context, userID string, guardrail *types.Guardrail) (*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, guardrail.AccountID, userID, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, guardrail.AccountID, userID, modules.AgentNetworkGuardrails, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -429,7 +434,7 @@ func (m *managerImpl) CreateGuardrail(ctx context.Context, userID string, guardr
 }
 
 func (m *managerImpl) UpdateGuardrail(ctx context.Context, userID string, guardrail *types.Guardrail) (*types.Guardrail, error) {
-	if err := m.requirePermission(ctx, guardrail.AccountID, userID, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, guardrail.AccountID, userID, modules.AgentNetworkGuardrails, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -452,7 +457,7 @@ func (m *managerImpl) UpdateGuardrail(ctx context.Context, userID string, guardr
 }
 
 func (m *managerImpl) DeleteGuardrail(ctx context.Context, accountID, userID, guardrailID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkGuardrails, operations.Delete); err != nil {
 		return err
 	}
 
@@ -473,7 +478,7 @@ func (m *managerImpl) DeleteGuardrail(ctx context.Context, accountID, userID, gu
 
 // GetAllBudgetRules returns every account-level budget rule for the account.
 func (m *managerImpl) GetAllBudgetRules(ctx context.Context, accountID, userID string) ([]*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkBudgets, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAccountAgentNetworkBudgetRules(ctx, store.LockingStrengthNone, accountID)
@@ -481,7 +486,7 @@ func (m *managerImpl) GetAllBudgetRules(ctx context.Context, accountID, userID s
 
 // GetBudgetRule returns a single account-level budget rule.
 func (m *managerImpl) GetBudgetRule(ctx context.Context, accountID, userID, ruleID string) (*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkBudgets, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.GetAgentNetworkBudgetRuleByID(ctx, store.LockingStrengthNone, accountID, ruleID)
@@ -491,7 +496,7 @@ func (m *managerImpl) GetBudgetRule(ctx context.Context, accountID, userID, rule
 // enforced at request time (CheckLLMPolicyLimits), not baked into the synth
 // proxy config, so no reconcile is needed.
 func (m *managerImpl) CreateBudgetRule(ctx context.Context, userID string, rule *types.AccountBudgetRule) (*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, rule.AccountID, userID, operations.Create); err != nil {
+	if err := m.requirePermission(ctx, rule.AccountID, userID, modules.AgentNetworkBudgets, operations.Create); err != nil {
 		return nil, err
 	}
 
@@ -513,7 +518,7 @@ func (m *managerImpl) CreateBudgetRule(ctx context.Context, userID string, rule
 
 // UpdateBudgetRule updates an existing account-level budget rule.
 func (m *managerImpl) UpdateBudgetRule(ctx context.Context, userID string, rule *types.AccountBudgetRule) (*types.AccountBudgetRule, error) {
-	if err := m.requirePermission(ctx, rule.AccountID, userID, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, rule.AccountID, userID, modules.AgentNetworkBudgets, operations.Update); err != nil {
 		return nil, err
 	}
 
@@ -536,7 +541,7 @@ func (m *managerImpl) UpdateBudgetRule(ctx context.Context, userID string, rule
 
 // DeleteBudgetRule removes an account-level budget rule.
 func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, ruleID string) error {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Delete); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkBudgets, operations.Delete); err != nil {
 		return err
 	}
 
@@ -554,40 +559,83 @@ func (m *managerImpl) DeleteBudgetRule(ctx context.Context, accountID, userID, r
 	return nil
 }
 
-// UpdateSettings applies the mutable account-level settings — the collection
-// toggles — onto the existing row. Cluster and Subdomain are immutable and are
-// preserved from the persisted row regardless of the input. Because the
-// collection toggles change the synthesised service config (prompt-capture
-// gating, access-log emission), a reconcile is triggered so the proxy and peer
-// network maps converge on the new state.
+// UpdateSettings replaces the mutable account-level settings — the collection
+// toggles and retention — on the account's row. When the account has no
+// settings row yet, a non-empty settings.Cluster bootstraps one (same path as
+// first provider create); without it the update fails with NotFound. On an
+// existing row the cluster and subdomain are immutable: a differing
+// settings.Cluster is rejected rather than silently ignored so callers never
+// observe a value other than what they sent. Because the collection toggles
+// change the synthesised service config (prompt-capture gating, access-log
+// emission), a reconcile is triggered so the proxy and peer network maps
+// converge on the new state.
 func (m *managerImpl) UpdateSettings(ctx context.Context, userID string, settings *types.Settings) (*types.Settings, error) {
-	if err := m.requirePermission(ctx, settings.AccountID, userID, operations.Update); err != nil {
+	if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Update); err != nil {
 		return nil, err
 	}
 
-	existing, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, settings.AccountID)
+	requestedCluster := strings.TrimSpace(settings.Cluster)
+
+	// The row lock from LockingStrengthUpdate only holds for the duration of
+	// the surrounding transaction, so the read, the cluster-immutability
+	// check, and the save must share one — otherwise concurrent PUTs could
+	// interleave between them.
+	var updated *types.Settings
+	err := m.store.ExecuteInTransaction(ctx, func(tx store.Store) error {
+		existing, err := tx.GetAgentNetworkSettings(ctx, store.LockingStrengthUpdate, settings.AccountID)
+		switch {
+		case err == nil:
+			if requestedCluster != "" && requestedCluster != existing.Cluster {
+				return status.Errorf(status.InvalidArgument, "cluster is immutable once assigned (current: %s)", existing.Cluster)
+			}
+		case isNotFound(err):
+			if requestedCluster == "" {
+				return status.Errorf(status.NotFound, "agent network settings have not been bootstrapped yet; pass cluster to bootstrap them, or create a provider with bootstrap_cluster set")
+			}
+			// Bootstrapping pins the cluster and subdomain — a settings
+			// create on top of the update the caller already passed, matching
+			// the gate on the provider-create bootstrap path.
+			if err := m.requirePermission(ctx, settings.AccountID, userID, modules.AgentNetworkSettings, operations.Create); err != nil {
+				return err
+			}
+			existing, err = m.bootstrapSettingsIfNeeded(ctx, tx, settings.AccountID, requestedCluster)
+			if err != nil {
+				return err
+			}
+		default:
+			return fmt.Errorf("get agent network settings: %w", err)
+		}
+
+		existing.EnableLogCollection = settings.EnableLogCollection
+		existing.EnablePromptCollection = settings.EnablePromptCollection
+		existing.RedactPii = settings.RedactPii
+		existing.AccessLogRetentionDays = settings.AccessLogRetentionDays
+		existing.UpdatedAt = time.Now().UTC()
+
+		if err := tx.SaveAgentNetworkSettings(ctx, existing); err != nil {
+			return fmt.Errorf("save agent network settings: %w", err)
+		}
+		updated = existing
+		return nil
+	})
 	if err != nil {
-		return nil, fmt.Errorf("get agent network settings: %w", err)
-	}
-
-	existing.EnableLogCollection = settings.EnableLogCollection
-	existing.EnablePromptCollection = settings.EnablePromptCollection
-	existing.RedactPii = settings.RedactPii
-	existing.AccessLogRetentionDays = settings.AccessLogRetentionDays
-	existing.UpdatedAt = time.Now().UTC()
-
-	if err := m.store.SaveAgentNetworkSettings(ctx, existing); err != nil {
-		return nil, fmt.Errorf("save agent network settings: %w", err)
+		return nil, err
 	}
 
 	m.accountManager.StoreEvent(ctx, userID, settings.AccountID, settings.AccountID, activity.AgentNetworkSettingsUpdated, map[string]any{
-		"log_collection":    existing.EnableLogCollection,
-		"prompt_collection": existing.EnablePromptCollection,
-		"redact_pii":        existing.RedactPii,
+		"log_collection":    updated.EnableLogCollection,
+		"prompt_collection": updated.EnablePromptCollection,
+		"redact_pii":        updated.RedactPii,
 	})
 	m.reconcile(ctx, settings.AccountID)
 
-	return existing, nil
+	return updated, nil
+}
+
+// isNotFound reports whether err is a status.NotFound error.
+func isNotFound(err error) bool {
+	var sErr *status.Error
+	return errors.As(err, &sErr) && sErr.Type() == status.NotFound
 }
 
 // validateProviderRefs ensures every destination provider id refers to a
@@ -611,14 +659,38 @@ func (m *managerImpl) validateProviderRefs(ctx context.Context, accountID string
 	return nil
 }
 
-// GetSettings returns the agent-network settings row for the account.
-// Returns the underlying status.NotFound when no row has been
-// bootstrapped yet (i.e. the account has no providers).
+// GetSettings returns the agent-network settings row for the account. When no
+// row has been bootstrapped yet, the defaults are returned (without
+// persisting) with cluster and subdomain empty — settings always read as an
+// object, like the account and DNS settings endpoints.
 func (m *managerImpl) GetSettings(ctx context.Context, accountID, userID string) (*types.Settings, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Read); err != nil {
 		return nil, err
 	}
-	return m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	settings, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	switch {
+	case err == nil:
+		return settings, nil
+	case isNotFound(err):
+		return types.DefaultSettings(accountID), nil
+	default:
+		return nil, err
+	}
+}
+
+// requireSettingsBootstrapPermission gates the one-time settings bootstrap a
+// first provider create performs. Pinning the account's cluster and subdomain
+// is a settings write, so it needs the settings permission on top of the
+// provider one. No-op once the settings row exists.
+func (m *managerImpl) requireSettingsBootstrapPermission(ctx context.Context, accountID, userID string) error {
+	_, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	if err == nil {
+		return nil
+	}
+	if !isNotFound(err) {
+		return fmt.Errorf("get agent network settings: %w", err)
+	}
+	return m.requirePermission(ctx, accountID, userID, modules.AgentNetworkSettings, operations.Create)
 }
 
 // bootstrapSettingsIfNeeded creates the per-account agent-network
@@ -626,8 +698,9 @@ func (m *managerImpl) GetSettings(ctx context.Context, accountID, userID string)
 // hint the dashboard sends (auto-picked from the active cluster list);
 // the subdomain is picked from the curated wordlist avoiding
 // collisions on the same cluster. Idempotent: if a row already exists
-// it is returned untouched and the hint is ignored.
-func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID, providerCluster string) (*types.Settings, error) {
+// it is returned untouched and the hint is ignored. st is the store to
+// operate on — pass the transaction store when calling from within one.
+func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, st store.Store, accountID, providerCluster string) (*types.Settings, error) {
 	if accountID == "" {
 		return nil, fmt.Errorf("bootstrap settings: account id is required")
 	}
@@ -635,16 +708,15 @@ func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID,
 		return nil, fmt.Errorf("bootstrap settings: provider cluster is required")
 	}
 
-	existing, err := m.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
+	existing, err := st.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, accountID)
 	if err == nil {
 		return existing, nil
 	}
-	var sErr *status.Error
-	if !errors.As(err, &sErr) || sErr.Type() != status.NotFound {
+	if !isNotFound(err) {
 		return nil, fmt.Errorf("get agent network settings: %w", err)
 	}
 
-	siblings, err := m.store.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, providerCluster)
+	siblings, err := st.GetAgentNetworkSettingsByCluster(ctx, store.LockingStrengthNone, providerCluster)
 	if err != nil {
 		return nil, fmt.Errorf("list agent network settings on cluster: %w", err)
 	}
@@ -663,18 +735,12 @@ func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID,
 	m.labelRngMu.Unlock()
 
 	now := time.Now().UTC()
-	settings := &types.Settings{
-		AccountID: accountID,
-		Cluster:   providerCluster,
-		Subdomain: subdomain,
-		// Logs on by default; usage is collected regardless. Retention bounds
-		// how long full log rows are kept.
-		EnableLogCollection:    true,
-		AccessLogRetentionDays: types.DefaultAccessLogRetentionDays,
-		CreatedAt:              now,
-		UpdatedAt:              now,
-	}
-	if err := m.store.SaveAgentNetworkSettings(ctx, settings); err != nil {
+	settings := types.DefaultSettings(accountID)
+	settings.Cluster = providerCluster
+	settings.Subdomain = subdomain
+	settings.CreatedAt = now
+	settings.UpdatedAt = now
+	if err := st.SaveAgentNetworkSettings(ctx, settings); err != nil {
 		return nil, fmt.Errorf("save agent network settings: %w", err)
 	}
 	return settings, nil
@@ -685,7 +751,7 @@ func (m *managerImpl) bootstrapSettingsIfNeeded(ctx context.Context, accountID,
 // counter view; permission gate is the same Read role that gates
 // every other agent-network surface.
 func (m *managerImpl) ListConsumption(ctx context.Context, accountID, userID string) ([]*types.Consumption, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkUsage, operations.Read); err != nil {
 		return nil, err
 	}
 	return m.store.ListAgentNetworkConsumption(ctx, store.LockingStrengthNone, accountID)
@@ -694,7 +760,7 @@ func (m *managerImpl) ListConsumption(ctx context.Context, accountID, userID str
 // ListAccessLogs returns a paginated, server-side-filtered page of
 // agent-network access logs plus the total count matching the filter.
 func (m *managerImpl) ListAccessLogs(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLog, int64, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkLogs, operations.Read); err != nil {
 		return nil, 0, err
 	}
 	return m.store.GetAgentNetworkAccessLogs(ctx, store.LockingStrengthNone, accountID, filter)
@@ -704,7 +770,7 @@ func (m *managerImpl) ListAccessLogs(ctx context.Context, accountID, userID stri
 // agent-network access logs grouped by session, plus the total number of
 // sessions matching the filter.
 func (m *managerImpl) ListAccessLogSessions(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter) ([]*types.AgentNetworkAccessLogSession, int64, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkLogs, operations.Read); err != nil {
 		return nil, 0, err
 	}
 	return m.store.GetAgentNetworkAccessLogSessions(ctx, store.LockingStrengthNone, accountID, filter)
@@ -713,7 +779,7 @@ func (m *managerImpl) ListAccessLogSessions(ctx context.Context, accountID, user
 // GetUsageOverview returns the filtered usage rows aggregated into time buckets
 // at the requested granularity, oldest-first.
 func (m *managerImpl) GetUsageOverview(ctx context.Context, accountID, userID string, filter types.AgentNetworkAccessLogFilter, granularity types.UsageGranularity) ([]*types.AgentNetworkUsageBucket, error) {
-	if err := m.requirePermission(ctx, accountID, userID, operations.Read); err != nil {
+	if err := m.requirePermission(ctx, accountID, userID, modules.AgentNetworkUsage, operations.Read); err != nil {
 		return nil, err
 	}
 	rows, err := m.store.GetAgentNetworkUsageRows(ctx, store.LockingStrengthNone, accountID, filter)
@@ -787,8 +853,8 @@ func (m *managerImpl) RecordConsumption(ctx context.Context, accountID string, k
 	return m.store.IncrementAgentNetworkConsumption(ctx, accountID, kind, dimID, windowSeconds, windowStart, tokensIn, tokensOut, costUSD)
 }
 
-func (m *managerImpl) requirePermission(ctx context.Context, accountID, userID string, op operations.Operation) error {
-	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, modules.AgentNetwork, op)
+func (m *managerImpl) requirePermission(ctx context.Context, accountID, userID string, module modules.Module, op operations.Operation) error {
+	ok, _, err := m.permissionsManager.ValidateUserPermissions(ctx, accountID, userID, module, op)
 	if err != nil {
 		return status.NewPermissionValidationError(err)
 	}
@@ -877,8 +943,8 @@ func (*mockManager) UpdateBudgetRule(_ context.Context, _ string, r *types.Accou
 
 func (*mockManager) DeleteBudgetRule(_ context.Context, _, _, _ string) error { return nil }
 
-func (*mockManager) GetSettings(_ context.Context, _, _ string) (*types.Settings, error) {
-	return nil, status.Errorf(status.NotFound, "agent network settings not found")
+func (*mockManager) GetSettings(_ context.Context, accountID, _ string) (*types.Settings, error) {
+	return types.DefaultSettings(accountID), nil
 }
 
 func (*mockManager) UpdateSettings(_ context.Context, _ string, s *types.Settings) (*types.Settings, error) {

management/internals/modules/agentnetwork/provider_bootstrap_test.go

@@ -0,0 +1,134 @@
+package agentnetwork
+
+import (
+	"context"
+	"runtime"
+	"testing"
+
+	"github.com/golang/mock/gomock"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/server/account"
+	"github.com/netbirdio/netbird/management/server/permissions"
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/store"
+	nbtypes "github.com/netbirdio/netbird/management/server/types"
+	"github.com/netbirdio/netbird/shared/management/status"
+)
+
+// bootstrapFixture wires a real sqlite store to a gomock permissions manager
+// so tests can grant the provider permission while denying (or never
+// expecting) the settings one.
+type bootstrapFixture struct {
+	manager Manager
+	store   store.Store
+	perms   *permissions.MockManager
+}
+
+func newBootstrapFixture(t *testing.T) *bootstrapFixture {
+	t.Helper()
+	if runtime.GOOS == "windows" {
+		t.Skip("sqlite store not properly supported on Windows yet")
+	}
+	t.Setenv("NETBIRD_STORE_ENGINE", string(nbtypes.SqliteStoreEngine))
+
+	st, cleanUp, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err, "test store setup must succeed")
+	t.Cleanup(cleanUp)
+
+	ctrl := gomock.NewController(t)
+	perms := permissions.NewMockManager(ctrl)
+
+	accounts := account.NewMockManager(ctrl)
+	accounts.EXPECT().StoreEvent(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	accounts.EXPECT().UpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+	accounts.EXPECT().BufferUpdateAccountPeers(gomock.Any(), gomock.Any(), gomock.Any()).AnyTimes()
+
+	return &bootstrapFixture{
+		manager: NewManager(st, perms, accounts, nil),
+		store:   st,
+		perms:   perms,
+	}
+}
+
+func (f *bootstrapFixture) expectPermission(accountID, userID string, module modules.Module, op operations.Operation, allowed bool) {
+	f.perms.EXPECT().
+		ValidateUserPermissions(gomock.Any(), accountID, userID, module, op).
+		Return(allowed, context.Background(), nil)
+}
+
+func newBootstrapProvider(accountID string) *types.Provider {
+	p := types.NewProvider(accountID)
+	p.Name = "openai"
+	p.UpstreamURL = "https://api.openai.com"
+	p.APIKey = "sk-test"
+	p.Enabled = true
+	return p
+}
+
+// TestCreateProviderBootstrapRequiresSettingsPermission pins the gate on the
+// one-time settings bootstrap: creating the first provider with a
+// bootstrap_cluster pins the account's cluster and subdomain, which is a
+// settings write and must not ride on the providers permission alone.
+func TestCreateProviderBootstrapRequiresSettingsPermission(t *testing.T) {
+	ctx := context.Background()
+
+	t.Run("denied without settings permission", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, false)
+
+		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
+		require.Error(t, err, "bootstrap without settings permission must fail")
+		var sErr *status.Error
+		require.ErrorAs(t, err, &sErr)
+		assert.Equal(t, status.PermissionDenied, sErr.Type(), "denial should surface as permission denied")
+
+		providers, err := f.store.GetAccountAgentNetworkProviders(ctx, store.LockingStrengthNone, "account1")
+		require.NoError(t, err)
+		assert.Empty(t, providers, "provider must not be persisted when bootstrap is denied")
+		_, err = f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+		assert.Error(t, err, "settings row must not be created when bootstrap is denied")
+	})
+
+	t.Run("allowed with settings permission", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
+
+		created, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
+		require.NoError(t, err, "bootstrap with both permissions must succeed")
+		require.NotNil(t, created)
+
+		settings, err := f.store.GetAgentNetworkSettings(ctx, store.LockingStrengthNone, "account1")
+		require.NoError(t, err, "bootstrap must create the settings row")
+		assert.Equal(t, "cluster1.example.com", settings.Cluster, "settings should pin the bootstrap cluster")
+	})
+
+	t.Run("existing settings need no settings permission", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		require.NoError(t, f.store.SaveAgentNetworkSettings(ctx, &types.Settings{
+			AccountID: "account1",
+			Cluster:   "cluster1.example.com",
+			Subdomain: "existing",
+		}), "pre-existing settings row setup must succeed")
+
+		// Only the providers permission may be consulted: gomock fails the
+		// test on any unexpected settings-permission call.
+		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "cluster1.example.com")
+		require.NoError(t, err, "create with existing settings must not require the settings permission")
+	})
+
+	t.Run("no bootstrap cluster needs no settings permission", func(t *testing.T) {
+		f := newBootstrapFixture(t)
+		f.expectPermission("account1", "user1", modules.AgentNetworkProviders, operations.Create, true)
+
+		_, err := f.manager.CreateProvider(ctx, "user1", newBootstrapProvider("account1"), "")
+		require.NoError(t, err, "create without bootstrap must not require the settings permission")
+	})
+}

management/internals/modules/agentnetwork/types/provider.go

@@ -164,9 +164,7 @@ func (p *Provider) FromAPIRequest(req *api.AgentNetworkProviderRequest) {
 		p.MetadataDisabled = *req.MetadataDisabled
 	}
 	// Identity-header overrides for catalogs flagged Customizable.
-	// nil pointer = "field omitted on the wire" → leave the stored
-	// value untouched (per the openapi description). Empty string is
-	// an explicit clear that disables stamping for this dimension.
+	// Empty or omitted disables stamping for this dimension.
 	if req.IdentityHeaderUserId != nil {
 		p.IdentityHeaderUserID = strings.TrimSpace(*req.IdentityHeaderUserId)
 	}
@@ -192,16 +190,20 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 	created := p.CreatedAt
 	updated := p.UpdatedAt
 	resp := &api.AgentNetworkProvider{
-		Id:                  p.ID,
-		ProviderId:          p.ProviderID,
-		Name:                p.Name,
-		UpstreamUrl:         p.UpstreamURL,
-		Models:              models,
-		Enabled:             p.Enabled,
-		SkipTlsVerification: p.SkipTLSVerification,
-		MetadataDisabled:    p.MetadataDisabled,
-		CreatedAt:           &created,
-		UpdatedAt:           &updated,
+		Id:          p.ID,
+		ProviderId:  p.ProviderID,
+		Name:        p.Name,
+		UpstreamUrl: p.UpstreamURL,
+		Models:      models,
+		// Always present on the wire so an explicitly cleared header
+		// round-trips as "" instead of vanishing from the response.
+		IdentityHeaderUserId: p.IdentityHeaderUserID,
+		IdentityHeaderGroups: p.IdentityHeaderGroups,
+		Enabled:              p.Enabled,
+		SkipTlsVerification:  p.SkipTLSVerification,
+		MetadataDisabled:     p.MetadataDisabled,
+		CreatedAt:            &created,
+		UpdatedAt:            &updated,
 	}
 	if len(p.ExtraValues) > 0 {
 		out := make(map[string]string, len(p.ExtraValues))
@@ -210,14 +212,6 @@ func (p *Provider) ToAPIResponse() *api.AgentNetworkProvider {
 		}
 		resp.ExtraValues = &out
 	}
-	if p.IdentityHeaderUserID != "" {
-		v := p.IdentityHeaderUserID
-		resp.IdentityHeaderUserId = &v
-	}
-	if p.IdentityHeaderGroups != "" {
-		v := p.IdentityHeaderGroups
-		resp.IdentityHeaderGroups = &v
-	}
 	return resp
 }
 

management/internals/modules/agentnetwork/types/provider_test.go

@@ -77,3 +77,41 @@ func TestProvider_MetadataDisabled_RoundTrip(t *testing.T) {
 	assert.False(t, p.MetadataDisabled, "explicit false must clear metadata_disabled")
 	assert.False(t, p.ToAPIResponse().MetadataDisabled, "response must reflect the cleared value")
 }
+
+// TestProvider_IdentityHeaders_AlwaysOnWire pins that the identity header
+// fields are always present in the API response — an explicitly cleared
+// ("") header must round-trip as "" rather than vanish, so API consumers
+// (e.g. the Terraform provider) never observe a value other than the one
+// they wrote.
+func TestProvider_IdentityHeaders_AlwaysOnWire(t *testing.T) {
+	set := "x-bf-dim-netbird_user_id"
+	empty := ""
+
+	base := func() *api.AgentNetworkProviderRequest {
+		return &api.AgentNetworkProviderRequest{
+			ProviderId:  "custom",
+			Name:        "bifrost",
+			UpstreamUrl: "https://bifrost.internal",
+		}
+	}
+
+	p := NewProvider("acc-1")
+	resp := p.ToAPIResponse()
+	assert.Equal(t, "", resp.IdentityHeaderUserId, "unset header must surface as empty string, not be omitted")
+	assert.Equal(t, "", resp.IdentityHeaderGroups, "unset header must surface as empty string, not be omitted")
+
+	req := base()
+	req.IdentityHeaderUserId = &set
+	p.FromAPIRequest(req)
+	assert.Equal(t, set, p.ToAPIResponse().IdentityHeaderUserId, "configured header must round-trip")
+
+	// Omitting the field preserves it.
+	p.FromAPIRequest(base())
+	assert.Equal(t, set, p.ToAPIResponse().IdentityHeaderUserId, "omitted header must preserve the stored value")
+
+	// An explicit "" clears it AND stays visible on the wire.
+	req = base()
+	req.IdentityHeaderUserId = &empty
+	p.FromAPIRequest(req)
+	assert.Equal(t, "", p.ToAPIResponse().IdentityHeaderUserId, "cleared header must round-trip as empty string")
+}

management/internals/modules/agentnetwork/types/settings.go

@@ -1,6 +1,7 @@
 package types
 
 import (
+	"strings"
 	"time"
 
 	"github.com/netbirdio/netbird/shared/management/http/api"
@@ -42,18 +43,34 @@ type Settings struct {
 // schema cohesive.
 func (Settings) TableName() string { return "agent_network_settings" }
 
+// DefaultSettings returns the settings an account observes before its row is
+// bootstrapped: log collection on with the default retention, everything else
+// off, and no cluster/subdomain assigned yet. Bootstrap persists exactly these
+// values plus the assigned cluster and subdomain, so the pre-bootstrap read
+// and the freshly bootstrapped row agree.
+func DefaultSettings(accountID string) *Settings {
+	return &Settings{
+		AccountID:              accountID,
+		EnableLogCollection:    true,
+		AccessLogRetentionDays: DefaultAccessLogRetentionDays,
+	}
+}
+
 // Endpoint returns the bare hostname agents reach this account at:
-// `<subdomain>.<cluster>`.
+// `<subdomain>.<cluster>`. Empty until both halves are assigned at bootstrap.
 func (s *Settings) Endpoint() string {
+	if s.Cluster == "" || s.Subdomain == "" {
+		return ""
+	}
 	return s.Subdomain + "." + s.Cluster
 }
 
-// ToAPIResponse renders the settings as the API representation.
+// ToAPIResponse renders the settings as the API representation. The
+// timestamps are omitted while zero — a default (not yet bootstrapped) view
+// has no persisted row to date.
 func (s *Settings) ToAPIResponse() *api.AgentNetworkSettings {
-	created := s.CreatedAt
-	updated := s.UpdatedAt
 	retention := s.AccessLogRetentionDays
-	return &api.AgentNetworkSettings{
+	resp := &api.AgentNetworkSettings{
 		Cluster:                s.Cluster,
 		Subdomain:              s.Subdomain,
 		Endpoint:               s.Endpoint(),
@@ -61,14 +78,27 @@ func (s *Settings) ToAPIResponse() *api.AgentNetworkSettings {
 		EnablePromptCollection: s.EnablePromptCollection,
 		RedactPii:              s.RedactPii,
 		AccessLogRetentionDays: &retention,
-		CreatedAt:              &created,
-		UpdatedAt:              &updated,
 	}
+	if !s.CreatedAt.IsZero() {
+		created := s.CreatedAt
+		resp.CreatedAt = &created
+	}
+	if !s.UpdatedAt.IsZero() {
+		updated := s.UpdatedAt
+		resp.UpdatedAt = &updated
+	}
+	return resp
 }
 
-// FromAPIRequest applies the mutable settings fields from the request. Cluster
-// and Subdomain are immutable and intentionally not touched here.
+// FromAPIRequest applies the request onto the receiver. The mutable
+// collection fields are always replaced with the request values. Cluster
+// participates only in bootstrap and the immutability check (see
+// Manager.UpdateSettings); Subdomain is server-assigned and never taken
+// from a request.
 func (s *Settings) FromAPIRequest(req *api.AgentNetworkSettingsRequest) {
+	if req.Cluster != nil {
+		s.Cluster = strings.TrimSpace(*req.Cluster)
+	}
 	s.EnableLogCollection = req.EnableLogCollection
 	s.EnablePromptCollection = req.EnablePromptCollection
 	s.RedactPii = req.RedactPii

management/internals/server/boot.go

@@ -24,13 +24,13 @@ import (
 
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/formatter/hook"
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	accesslogsmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs/manager"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
 	activitystore "github.com/netbirdio/netbird/management/server/activity/store"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	nbcache "github.com/netbirdio/netbird/management/server/cache"
 	nbContext "github.com/netbirdio/netbird/management/server/context"
 	nbhttp "github.com/netbirdio/netbird/management/server/http"
@@ -184,6 +184,10 @@ func (s *BaseServer) GRPCServer() *grpc.Server {
 			grpc.ChainStreamInterceptor(realip.StreamServerInterceptorOpts(realipOpts...), streamInterceptor, proxyStream),
 		}
 
+		// Append interceptors contributed by registered gRPC extensions. These
+		// run after the built-in chain (ChainUnaryInterceptor is additive).
+		gRPCOpts = appendExtensionInterceptors(gRPCOpts, s.grpcExtensions)
+
 		if s.Config.HttpConfig.LetsEncryptDomain != "" {
 			certManager, err := encryption.CreateCertManager(s.Config.Datadir, s.Config.HttpConfig.LetsEncryptDomain)
 			if err != nil {
@@ -215,6 +219,9 @@ func (s *BaseServer) GRPCServer() *grpc.Server {
 		mgmtProto.RegisterProxyServiceServer(gRPCAPIHandler, s.ReverseProxyGRPCServer())
 		log.Info("ProxyService registered on gRPC server")
 
+		// Register services contributed by external modules via the extension seam.
+		registerExtensions(gRPCAPIHandler, s.grpcExtensions)
+
 		return gRPCAPIHandler
 	})
 }

management/internals/server/grpc_extension.go

@@ -0,0 +1,74 @@
+package server
+
+import (
+	"context"
+
+	"google.golang.org/grpc"
+)
+
+// GRPCExtension bundles an external module's contribution to the management
+// gRPC server: the registration of one or more services onto the shared
+// grpc.Server, any server-wide interceptors those services require, and an
+// optional shutdown hook. It is a generic extension point with no knowledge of
+// any specific service.
+type GRPCExtension struct {
+	// Register is invoked with the shared grpc.Server (as a ServiceRegistrar)
+	// after the built-in services are registered. It may register any number of
+	// services. May be nil.
+	Register func(grpc.ServiceRegistrar)
+	// UnaryInterceptors are appended to the server's unary interceptor chain,
+	// running after the built-in interceptors. May be empty.
+	UnaryInterceptors []grpc.UnaryServerInterceptor
+	// StreamInterceptors are appended to the server's stream interceptor chain,
+	// running after the built-in interceptors. May be empty.
+	StreamInterceptors []grpc.StreamServerInterceptor
+	// Shutdown, if non-nil, is called once during Stop() with the context
+	// governing server shutdown, which carries a deadline. The hook MUST
+	// return promptly and MUST abandon its work once that context is
+	// cancelled or expires: it runs before the rest of Stop()'s cleanup
+	// (store, event store, embedded IdP) and before Stop() itself checks the
+	// context's deadline, so a hook that ignores the context will delay all
+	// of that cleanup and prevent Stop() from returning on time. May be nil.
+	Shutdown func(ctx context.Context)
+}
+
+// RegisterGRPCExtension registers a gRPC extension. Call before the gRPC server
+// is first built (i.e. before Start); registrations after that have no effect.
+func (s *BaseServer) RegisterGRPCExtension(ext GRPCExtension) {
+	s.grpcExtensions = append(s.grpcExtensions, ext)
+}
+
+// appendExtensionInterceptors appends each extension's interceptors to the gRPC
+// server options as additional chained interceptors. grpc.ChainUnaryInterceptor
+// and grpc.ChainStreamInterceptor are additive, so the returned options run the
+// extension interceptors after any interceptors already present in opts.
+func appendExtensionInterceptors(opts []grpc.ServerOption, exts []GRPCExtension) []grpc.ServerOption {
+	for _, ext := range exts {
+		if len(ext.UnaryInterceptors) > 0 {
+			opts = append(opts, grpc.ChainUnaryInterceptor(ext.UnaryInterceptors...))
+		}
+		if len(ext.StreamInterceptors) > 0 {
+			opts = append(opts, grpc.ChainStreamInterceptor(ext.StreamInterceptors...))
+		}
+	}
+	return opts
+}
+
+// registerExtensions registers each extension's services onto reg.
+func registerExtensions(reg grpc.ServiceRegistrar, exts []GRPCExtension) {
+	for _, ext := range exts {
+		if ext.Register != nil {
+			ext.Register(reg)
+		}
+	}
+}
+
+// runExtensionShutdownHooks calls each extension's shutdown hook, if set,
+// passing ctx through so hooks can honor its deadline/cancellation.
+func runExtensionShutdownHooks(ctx context.Context, exts []GRPCExtension) {
+	for _, ext := range exts {
+		if ext.Shutdown != nil {
+			ext.Shutdown(ctx)
+		}
+	}
+}

management/internals/server/grpc_extension_test.go

@@ -0,0 +1,160 @@
+package server
+
+import (
+	"context"
+	"net"
+	"sync/atomic"
+	"testing"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	"google.golang.org/grpc/health"
+	healthgrpc "google.golang.org/grpc/health/grpc_health_v1"
+	"google.golang.org/grpc/test/bufconn"
+)
+
+// Test that an extension's interceptors and service registration are actually
+// wired onto a real in-process gRPC server via the helpers, and that shutdown
+// hooks run. This validates the load-bearing assumption that
+// grpc.ChainUnaryInterceptor is additive (extension interceptors run in
+// addition to any base chain).
+func TestGRPCExtensionAppliedToServer(t *testing.T) {
+	var unaryCalls atomic.Int32
+	var streamShutdownCalled atomic.Bool
+
+	ext := GRPCExtension{
+		Register: func(reg grpc.ServiceRegistrar) {
+			healthgrpc.RegisterHealthServer(reg, health.NewServer())
+		},
+		UnaryInterceptors: []grpc.UnaryServerInterceptor{
+			func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+				unaryCalls.Add(1)
+				return handler(ctx, req)
+			},
+		},
+		Shutdown: func(ctx context.Context) { streamShutdownCalled.Store(true) },
+	}
+	exts := []GRPCExtension{ext}
+
+	// Base options mimic GRPCServer(): a pre-existing chain the extension appends to.
+	var baseUnaryCalls atomic.Int32
+	opts := []grpc.ServerOption{
+		grpc.ChainUnaryInterceptor(func(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
+			baseUnaryCalls.Add(1)
+			return handler(ctx, req)
+		}),
+	}
+	opts = appendExtensionInterceptors(opts, exts)
+
+	srv := grpc.NewServer(opts...)
+	registerExtensions(srv, exts)
+
+	lis := bufconn.Listen(1024 * 1024)
+	go func() { _ = srv.Serve(lis) }()
+	t.Cleanup(srv.Stop)
+
+	conn, err := grpc.NewClient("passthrough:///bufnet",
+		grpc.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) { return lis.DialContext(ctx) }),
+		grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = conn.Close() })
+
+	_, err = healthgrpc.NewHealthClient(conn).Check(context.Background(), &healthgrpc.HealthCheckRequest{})
+	if err != nil {
+		t.Fatalf("health check via extension-registered service failed: %v", err)
+	}
+	if baseUnaryCalls.Load() != 1 {
+		t.Errorf("base interceptor calls = %d, want 1 (base chain must be preserved)", baseUnaryCalls.Load())
+	}
+	if unaryCalls.Load() != 1 {
+		t.Errorf("extension interceptor calls = %d, want 1", unaryCalls.Load())
+	}
+
+	runExtensionShutdownHooks(context.Background(), exts)
+	if !streamShutdownCalled.Load() {
+		t.Error("extension shutdown hook was not called")
+	}
+}
+
+// TestGRPCExtensionShutdownHookReceivesCallerContext asserts that each hook receives
+// a non-nil context and that it is the very same context the caller passed
+// in, so hooks can rely on values/deadlines placed on it by Stop().
+func TestGRPCExtensionShutdownHookReceivesCallerContext(t *testing.T) {
+	type sentinelKey struct{}
+	want := "shutdown-ctx-sentinel"
+	ctx := context.WithValue(context.Background(), sentinelKey{}, want)
+
+	var called bool
+	ext := GRPCExtension{
+		Shutdown: func(hookCtx context.Context) {
+			called = true
+			if hookCtx == nil {
+				t.Fatal("hook received a nil context")
+			}
+			got, _ := hookCtx.Value(sentinelKey{}).(string)
+			if got != want {
+				t.Errorf("hook context sentinel = %q, want %q (not the caller's context)", got, want)
+			}
+		},
+	}
+
+	runExtensionShutdownHooks(ctx, []GRPCExtension{ext})
+	if !called {
+		t.Fatal("shutdown hook was not called")
+	}
+}
+
+// TestGRPCExtensionShutdownHookObservesCancellation documents, by test, that
+// hooks can honor cancellation/deadlines: a hook given an already-cancelled
+// context must see ctx.Err() != nil and a closed Done() channel.
+func TestGRPCExtensionShutdownHookObservesCancellation(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	var called bool
+	ext := GRPCExtension{
+		Shutdown: func(hookCtx context.Context) {
+			called = true
+			if hookCtx.Err() == nil {
+				t.Error("hook context Err() = nil, want non-nil for a cancelled context")
+			}
+			select {
+			case <-hookCtx.Done():
+			default:
+				t.Error("hook context Done() channel is not closed for a cancelled context")
+			}
+		},
+	}
+
+	runExtensionShutdownHooks(ctx, []GRPCExtension{ext})
+	if !called {
+		t.Fatal("shutdown hook was not called")
+	}
+}
+
+// TestGRPCExtensionShutdownHookNilSkipped asserts that an extension
+// with a nil Shutdown hook is skipped without panicking, and that hooks for
+// other extensions still run.
+func TestGRPCExtensionShutdownHookNilSkipped(t *testing.T) {
+	var called atomic.Bool
+	exts := []GRPCExtension{
+		{Shutdown: nil},
+		{Shutdown: func(context.Context) { called.Store(true) }},
+	}
+
+	runExtensionShutdownHooks(context.Background(), exts)
+	if !called.Load() {
+		t.Error("shutdown hook for non-nil extension was not called")
+	}
+}
+
+func TestRegisterGRPCExtensionAccumulates(t *testing.T) {
+	s := &BaseServer{}
+	s.RegisterGRPCExtension(GRPCExtension{})
+	s.RegisterGRPCExtension(GRPCExtension{})
+	if len(s.grpcExtensions) != 2 {
+		t.Fatalf("grpcExtensions len = %d, want 2", len(s.grpcExtensions))
+	}
+}

management/internals/server/server.go

@@ -68,6 +68,11 @@ type BaseServer struct {
 
 	proxyAuthClose func()
 
+	// grpcExtensions holds additional gRPC services, interceptors, and shutdown
+	// hooks registered by external modules via RegisterGRPCExtension. Populated
+	// during boot (single-threaded), consumed by GRPCServer() and Stop().
+	grpcExtensions []GRPCExtension
+
 	listener    net.Listener
 	certManager *autocert.Manager
 	update      *version.Update
@@ -257,6 +262,7 @@ func (s *BaseServer) Stop() error {
 		s.proxyAuthClose()
 		s.proxyAuthClose = nil
 	}
+	runExtensionShutdownHooks(ctx, s.grpcExtensions)
 	_ = s.Store().Close(ctx)
 	_ = s.EventStore().Close(ctx)
 	if s.update != nil {

management/internals/shared/grpc/components_encoder.go

@@ -61,6 +61,8 @@ func EncodeNetworkMapEnvelope(in ComponentsEnvelopeInput) *proto.NetworkMapEnvel
 		return &proto.NetworkMapEnvelope{
 			Payload: &proto.NetworkMapEnvelope_Full{
 				Full: &proto.NetworkMapComponentsFull{
+					Serial:     networkSerial(c.Network),
+					Network:    toAccountNetwork(c.Network),
 					PeerConfig: in.PeerConfig,
 					// components.Peers always contains the target peer
 					Peers:            []*proto.PeerCompact{toPeerCompact(c.Peers[c.PeerID])},

management/internals/shared/grpc/components_encoder_test.go

@@ -758,6 +758,9 @@ func TestEncodeNetworkMapEnvelope_NilComponentsGracefulDegrade(t *testing.T) {
 	assert.Equal(t, "netbird.cloud", full.DnsDomain)
 	assert.Len(t, full.Peers, 1)
 	assert.Empty(t, full.Policies)
+	require.NotNil(t, full.Network, "client runs Calculate() over the envelope and dereferences Network unconditionally; a nil here would crash the receiver")
+	assert.Equal(t, "net-empty", full.Network.Identifier)
+	assert.Equal(t, uint64(9), full.Serial)
 }
 
 func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
@@ -776,6 +779,12 @@ func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
 func emptyNetworkMapComponents() *types.NetworkMapComponents {
 	return types.EmptyNetworkMapComponents(
 		&types.NetworkMapComponents{
-			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}}},
+			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}},
+			Network: &types.Network{
+				Identifier: "net-empty",
+				Net:        net.IPNet{IP: net.IP{100, 64, 0, 0}, Mask: net.CIDRMask(10, 32)},
+				Serial:     9,
+			},
+		},
 	)
 }

management/server/agentnetwork_budgetrule_realstack_test.go

@@ -102,11 +102,20 @@ func TestAgentNetwork_UpdateSettings_PreservesImmutableAndTogglesCollection(t *t
 	require.NotEmpty(t, before.Subdomain, "subdomain pinned at bootstrap")
 	assert.False(t, before.EnablePromptCollection, "prompt collection defaults off")
 
-	// Attempt to flip toggles AND smuggle a different cluster/subdomain — the
-	// immutable fields must be ignored.
+	// A cluster different from the one pinned at bootstrap must be rejected
+	// outright — never silently swapped or ignored.
+	_, err = mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
+		AccountID:           accountID,
+		Cluster:             "attacker.cluster",
+		EnableLogCollection: true,
+	})
+	require.Error(t, err, "UpdateSettings with a mismatched cluster must fail")
+
+	// Flipping the toggles works with the pinned cluster echoed back (and
+	// with it omitted); the subdomain is never taken from the request.
 	updated, err := mgr.UpdateSettings(ctx, adminUserID, &agenttypes.Settings{
 		AccountID:              accountID,
-		Cluster:                "attacker.cluster",
+		Cluster:                clusterAddr,
 		Subdomain:              "evil",
 		EnableLogCollection:    true,
 		EnablePromptCollection: true,

management/server/group.go

@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"slices"
 
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 
@@ -744,6 +746,14 @@ func validateDeleteGroup(ctx context.Context, transaction store.Store, group *ty
 		return &GroupLinkError{"network router", linkedRouter.ID}
 	}
 
+	if isLinked, linkedService := isGroupLinkedToReverseProxyService(ctx, transaction, group.AccountID, group.ID); isLinked {
+		return &GroupLinkError{"reverse proxy service", linkedService.Domain}
+	}
+
+	if isLinked, linkedPolicy := isGroupLinkedToAgentNetworkPolicy(ctx, transaction, group.AccountID, group.ID); isLinked {
+		return &GroupLinkError{"agent network policy", linkedPolicy.Name}
+	}
+
 	return checkGroupLinkedToSettings(ctx, transaction, group)
 }
 
@@ -875,6 +885,46 @@ func isGroupLinkedToNetworkRouter(ctx context.Context, transaction store.Store,
 	return false, nil
 }
 
+// isGroupLinkedToReverseProxyService checks if a group is used as an access group
+// of a private reverse proxy service or as a bearer-auth distribution group.
+func isGroupLinkedToReverseProxyService(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *service.Service) {
+	services, err := transaction.GetAccountServices(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("error retrieving reverse proxy services while checking group linkage: %v", err)
+		return false, nil
+	}
+
+	for _, svc := range services {
+		if svc.Private && slices.Contains(svc.AccessGroups, groupID) {
+			return true, svc
+		}
+		if svc.Auth.BearerAuth != nil && svc.Auth.BearerAuth.Enabled && slices.Contains(svc.Auth.BearerAuth.DistributionGroups, groupID) {
+			return true, svc
+		}
+	}
+	return false, nil
+}
+
+// isGroupLinkedToAgentNetworkPolicy checks if a group is used as a source group by any
+// agent network policy in the account.
+func isGroupLinkedToAgentNetworkPolicy(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *agentNetworkTypes.Policy) {
+	policies, err := transaction.GetAccountAgentNetworkPolicies(ctx, store.LockingStrengthNone, accountID)
+	if err != nil {
+		log.WithContext(ctx).Errorf("error retrieving agent network policies while checking group linkage: %v", err)
+		return false, nil
+	}
+
+	for _, policy := range policies {
+		if policy == nil {
+			continue
+		}
+		if slices.Contains(policy.SourceGroups, groupID) {
+			return true, policy
+		}
+	}
+	return false, nil
+}
+
 // areGroupChangesAffectPeers checks if any changes to the specified groups will affect peers.
 // It fetches each collection once and checks all groupIDs against them in memory.
 func areGroupChangesAffectPeers(ctx context.Context, transaction store.Store, accountID string, groupIDs []string) (bool, error) {

management/server/group_test.go

@@ -18,6 +18,8 @@ import (
 	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
+	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
+	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
@@ -125,6 +127,21 @@ func TestDefaultAccountManager_DeleteGroup(t *testing.T) {
 			"grp-for-integration",
 			"only service users with admin power can delete integration group",
 		},
+		{
+			"agent network policy",
+			"grp-for-agent-network-policy",
+			"agent network policy",
+		},
+		{
+			"reverse proxy private service access group",
+			"grp-for-rp-private",
+			"reverse proxy service",
+		},
+		{
+			"reverse proxy bearer distribution group",
+			"grp-for-rp-bearer",
+			"reverse proxy service",
+		},
 	}
 
 	for _, testCase := range testCases {
@@ -218,6 +235,17 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 			groupIDs:        []string{"grp-for-integration"},
 			expectedReasons: []string{"only service users with admin power can delete integration group"},
 		},
+		{
+			name:            "agent network policy",
+			groupIDs:        []string{"grp-for-agent-network-policy"},
+			expectedReasons: []string{"agent network policy"},
+		},
+		{
+			name:               "reverse proxy services",
+			groupIDs:           []string{"grp-for-rp-private", "grp-for-rp-bearer"},
+			expectedReasons:    []string{"reverse proxy service", "reverse proxy service"},
+			expectedNotDeleted: []string{"grp-for-rp-private", "grp-for-rp-bearer"},
+		},
 		{
 			name:            "successfully delete multiple groups",
 			groupIDs:        []string{"group-1", "group-2"},
@@ -285,6 +313,65 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 	}
 }
 
+func TestDefaultAccountManager_DeleteGroupUnlinkedFromReverseProxyService(t *testing.T) {
+	am, _, err := createManager(t)
+	require.NoError(t, err, "Failed to create account manager")
+
+	_, account, err := initTestGroupAccount(am)
+	require.NoError(t, err, "Failed to init testing account")
+
+	deletableGroups := []*types.Group{
+		{
+			ID:        "grp-rp-bearer-disabled",
+			AccountID: account.Id,
+			Name:      "Group only in a disabled bearer auth",
+			Issued:    types.GroupIssuedAPI,
+			Peers:     make([]string, 0),
+		},
+		{
+			ID:        "grp-rp-nonprivate-access",
+			AccountID: account.Id,
+			Name:      "Group only in a non-private service's access groups",
+			Issued:    types.GroupIssuedAPI,
+			Peers:     make([]string, 0),
+		},
+	}
+	for _, group := range deletableGroups {
+		require.NoError(t, am.CreateGroup(context.Background(), account.Id, groupAdminUserID, group))
+	}
+
+	// Disabled bearer auth and stale access groups on a non-private service
+	// are inert configuration and must not block group deletion.
+	services := []*rpservice.Service{
+		{
+			ID:        "rp-svc-bearer-disabled",
+			AccountID: account.Id,
+			Domain:    "bearer-disabled.services.example.com",
+			Auth: rpservice.AuthConfig{
+				BearerAuth: &rpservice.BearerAuthConfig{
+					Enabled:            false,
+					DistributionGroups: []string{"grp-rp-bearer-disabled"},
+				},
+			},
+		},
+		{
+			ID:           "rp-svc-nonprivate-access",
+			AccountID:    account.Id,
+			Domain:       "nonprivate.services.example.com",
+			Private:      false,
+			AccessGroups: []string{"grp-rp-nonprivate-access"},
+		},
+	}
+	for _, svc := range services {
+		require.NoError(t, am.Store.CreateService(context.Background(), svc))
+	}
+
+	for _, group := range deletableGroups {
+		err = am.DeleteGroup(context.Background(), account.Id, groupAdminUserID, group.ID)
+		assert.NoError(t, err, "group %s is not referenced by an active reverse proxy gate and should be deletable", group.ID)
+	}
+}
+
 func TestDefaultAccountManager_DeleteGroupLinkedToFlowGroup(t *testing.T) {
 	am, _, err := createManager(t)
 	require.NoError(t, err)
@@ -406,6 +493,30 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 		Peers:     make([]string, 0),
 	}
 
+	groupForAgentNetworkPolicy := &types.Group{
+		ID:        "grp-for-agent-network-policy",
+		AccountID: "account-id",
+		Name:      "Group for agent network policies",
+		Issued:    types.GroupIssuedAPI,
+		Peers:     make([]string, 0),
+	}
+
+	groupForRPPrivate := &types.Group{
+		ID:        "grp-for-rp-private",
+		AccountID: "account-id",
+		Name:      "Group for private reverse proxy service",
+		Issued:    types.GroupIssuedAPI,
+		Peers:     make([]string, 0),
+	}
+
+	groupForRPBearer := &types.Group{
+		ID:        "grp-for-rp-bearer",
+		AccountID: "account-id",
+		Name:      "Group for bearer reverse proxy service",
+		Issued:    types.GroupIssuedAPI,
+		Peers:     make([]string, 0),
+	}
+
 	routeResource := &route.Route{
 		ID:     "example route",
 		Groups: []string{groupForRoute.ID},
@@ -461,6 +572,66 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForSetupKeys)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForUsers)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForIntegration)
+	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForAgentNetworkPolicy)
+	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPPrivate)
+	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPBearer)
+
+	agentNetworkPolicy := &agentNetworkTypes.Policy{
+		ID:           "example agent network policy",
+		AccountID:    accountID,
+		Name:         "Example agent network policy",
+		Enabled:      true,
+		SourceGroups: []string{groupForAgentNetworkPolicy.ID},
+	}
+	if err := am.Store.SaveAgentNetworkPolicy(context.Background(), agentNetworkPolicy); err != nil {
+		return nil, nil, err
+	}
+
+	// The decoy services are created first so the linkage check has to scan
+	// past services that do not reference the groups under test.
+	rpServices := []*rpservice.Service{
+		{
+			ID:           "rp-svc-private-decoy",
+			AccountID:    accountID,
+			Domain:       "private-decoy.services.example.com",
+			Private:      true,
+			AccessGroups: []string{"unrelated-group"},
+		},
+		{
+			ID:        "rp-svc-bearer-decoy",
+			AccountID: accountID,
+			Domain:    "bearer-decoy.services.example.com",
+			Auth: rpservice.AuthConfig{
+				BearerAuth: &rpservice.BearerAuthConfig{
+					Enabled:            true,
+					DistributionGroups: []string{"unrelated-group"},
+				},
+			},
+		},
+		{
+			ID:           "rp-svc-private",
+			AccountID:    accountID,
+			Domain:       "private.services.example.com",
+			Private:      true,
+			AccessGroups: []string{groupForRPPrivate.ID},
+		},
+		{
+			ID:        "rp-svc-bearer",
+			AccountID: accountID,
+			Domain:    "bearer.services.example.com",
+			Auth: rpservice.AuthConfig{
+				BearerAuth: &rpservice.BearerAuthConfig{
+					Enabled:            true,
+					DistributionGroups: []string{groupForRPBearer.ID},
+				},
+			},
+		},
+	}
+	for _, svc := range rpServices {
+		if err := am.Store.CreateService(context.Background(), svc); err != nil {
+			return nil, nil, err
+		}
+	}
 
 	acc, err := am.Store.GetAccount(context.Background(), account.Id)
 	if err != nil {

management/server/permissions/manager.go

@@ -82,6 +82,9 @@ func (m *managerImpl) ValidateUserPermissions(
 	return m.ValidateRoleModuleAccess(ctx, accountID, role, module, operation), ctxEnriched, nil
 }
 
+// ValidateRoleModuleAccess resolves an operation against the role's explicit
+// grant for the module, then the grant for its parent module when the module
+// is a dotted submodule, and finally the role's AutoAllowNew default.
 func (m *managerImpl) ValidateRoleModuleAccess(
 	ctx context.Context,
 	accountID string,
@@ -89,7 +92,7 @@ func (m *managerImpl) ValidateRoleModuleAccess(
 	module modules.Module,
 	operation operations.Operation,
 ) bool {
-	if permissions, ok := role.Permissions[module]; ok {
+	if permissions, ok := lookupModulePermissions(role, module); ok {
 		if allowed, exists := permissions[operation]; exists {
 			return allowed
 		}
@@ -100,6 +103,21 @@ func (m *managerImpl) ValidateRoleModuleAccess(
 	return role.AutoAllowNew[operation]
 }
 
+// lookupModulePermissions returns the role's explicit permission set for the
+// module, falling back to the parent module's set for dotted submodules. The
+// second return reports whether any explicit set was found.
+func lookupModulePermissions(role roles.RolePermissions, module modules.Module) (map[operations.Operation]bool, bool) {
+	if permissions, ok := role.Permissions[module]; ok {
+		return permissions, true
+	}
+	if parent, hasParent := module.Parent(); hasParent {
+		if permissions, ok := role.Permissions[parent]; ok {
+			return permissions, true
+		}
+	}
+	return nil, false
+}
+
 func (m *managerImpl) ValidateAccountAccess(ctx context.Context, accountID string, user *types.User, allowOwnerAndAdmin bool) (context.Context, error) {
 	if user.AccountID != accountID {
 		return ctx, status.NewUserNotPartOfAccountError()
@@ -119,7 +137,7 @@ func (m *managerImpl) GetPermissionsByRole(ctx context.Context, role types.UserR
 	permissions := roles.Permissions{}
 
 	for k := range modules.All {
-		if rolePermissions, ok := roleMap.Permissions[k]; ok {
+		if rolePermissions, ok := lookupModulePermissions(roleMap, k); ok {
 			permissions[k] = rolePermissions
 			continue
 		}

management/server/permissions/manager_test.go

@@ -0,0 +1,139 @@
+package permissions
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/permissions/modules"
+	"github.com/netbirdio/netbird/management/server/permissions/operations"
+	"github.com/netbirdio/netbird/management/server/permissions/roles"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+func TestValidateRoleModuleAccessSubmoduleCascade(t *testing.T) {
+	manager := NewManager(nil)
+	ctx := context.Background()
+
+	fullAccess := map[operations.Operation]bool{
+		operations.Read:   true,
+		operations.Create: true,
+		operations.Update: true,
+		operations.Delete: true,
+	}
+	readOnly := map[operations.Operation]bool{
+		operations.Read:   true,
+		operations.Create: false,
+		operations.Update: false,
+		operations.Delete: false,
+	}
+	denyAll := map[operations.Operation]bool{
+		operations.Read:   false,
+		operations.Create: false,
+		operations.Update: false,
+		operations.Delete: false,
+	}
+
+	t.Run("parent grant covers submodules", func(t *testing.T) {
+		role := roles.RolePermissions{
+			AutoAllowNew: denyAll,
+			Permissions:  roles.Permissions{modules.AgentNetwork: fullAccess},
+		}
+		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Create),
+			"parent full grant should allow create on a submodule")
+		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkLogs, operations.Read),
+			"parent full grant should allow read on a submodule")
+	})
+
+	t.Run("submodule grant does not leak to parent or siblings", func(t *testing.T) {
+		role := roles.RolePermissions{
+			AutoAllowNew: denyAll,
+			Permissions:  roles.Permissions{modules.AgentNetworkUsage: readOnly},
+		}
+		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Read),
+			"explicit submodule read should be allowed")
+		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Create),
+			"read-only submodule grant should not allow create")
+		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetwork, operations.Read),
+			"submodule grant should not grant the parent module")
+		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Read),
+			"submodule grant should not grant a sibling submodule")
+	})
+
+	t.Run("explicit submodule entry wins over parent grant", func(t *testing.T) {
+		role := roles.RolePermissions{
+			AutoAllowNew: denyAll,
+			Permissions: roles.Permissions{
+				modules.AgentNetwork:     fullAccess,
+				modules.AgentNetworkLogs: denyAll,
+			},
+		}
+		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkLogs, operations.Read),
+			"explicit submodule deny should override the parent grant")
+		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkUsage, operations.Read),
+			"sibling submodules should still resolve through the parent grant")
+	})
+
+	t.Run("auto allow applies when neither submodule nor parent is granted", func(t *testing.T) {
+		role := roles.RolePermissions{
+			AutoAllowNew: readOnly,
+		}
+		assert.True(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Read),
+			"auto-allow read should apply to submodules")
+		assert.False(t, manager.ValidateRoleModuleAccess(ctx, "account", role, modules.AgentNetworkProviders, operations.Delete),
+			"auto-allow should not grant unlisted operations")
+	})
+}
+
+// TestExistingRolesKeepAgentNetworkBehaviorOnSubmodules pins the behavior the
+// submodule split must not change: every built-in role resolves the new
+// submodules exactly as it resolved the agent_network module before.
+func TestExistingRolesKeepAgentNetworkBehaviorOnSubmodules(t *testing.T) {
+	manager := NewManager(nil)
+	ctx := context.Background()
+
+	submodules := []modules.Module{
+		modules.AgentNetworkProviders,
+		modules.AgentNetworkPolicies,
+		modules.AgentNetworkGuardrails,
+		modules.AgentNetworkBudgets,
+		modules.AgentNetworkUsage,
+		modules.AgentNetworkLogs,
+		modules.AgentNetworkSettings,
+	}
+	allOperations := []operations.Operation{operations.Read, operations.Create, operations.Update, operations.Delete}
+
+	for _, role := range []types.UserRole{types.UserRoleOwner, types.UserRoleAdmin, types.UserRoleAuditor, types.UserRoleNetworkAdmin, types.UserRoleUser} {
+		rolePermissions, ok := roles.RolesMap[role]
+		require.True(t, ok, "role %s must exist in RolesMap", role)
+
+		for _, sub := range submodules {
+			for _, op := range allOperations {
+				expected := manager.ValidateRoleModuleAccess(ctx, "account", rolePermissions, modules.AgentNetwork, op)
+				actual := manager.ValidateRoleModuleAccess(ctx, "account", rolePermissions, sub, op)
+				assert.Equal(t, expected, actual, "role %s: %s on %s should match the agent_network module", role, op, sub)
+			}
+		}
+	}
+}
+
+func TestGetPermissionsByRoleIncludesSubmodules(t *testing.T) {
+	manager := NewManager(nil)
+	ctx := context.Background()
+
+	permissions, err := manager.GetPermissionsByRole(ctx, types.UserRoleAuditor)
+	require.NoError(t, err, "auditor role must resolve")
+
+	usage, ok := permissions[modules.AgentNetworkUsage]
+	require.True(t, ok, "permissions map should contain the usage submodule")
+	assert.True(t, usage[operations.Read], "auditor should read the usage submodule")
+	assert.False(t, usage[operations.Update], "auditor should not update the usage submodule")
+
+	adminPermissions, err := manager.GetPermissionsByRole(ctx, types.UserRoleAdmin)
+	require.NoError(t, err, "admin role must resolve")
+	providers, ok := adminPermissions[modules.AgentNetworkProviders]
+	require.True(t, ok, "permissions map should contain the providers submodule")
+	assert.True(t, providers[operations.Delete], "admin should delete on the providers submodule")
+}

management/server/permissions/modules/module.go

@@ -1,5 +1,7 @@
 package modules
 
+import "strings"
+
 type Module string
 
 const (
@@ -20,6 +22,17 @@ const (
 	IdentityProviders Module = "identity_providers"
 	Services          Module = "services"
 	AgentNetwork      Module = "agent_network"
+
+	// Agent Network submodules. A role may grant one of these directly
+	// or grant the AgentNetwork parent, which covers all of them (see
+	// permissions.Manager cascade resolution).
+	AgentNetworkProviders  Module = "agent_network.providers"
+	AgentNetworkPolicies   Module = "agent_network.policies"
+	AgentNetworkGuardrails Module = "agent_network.guardrails"
+	AgentNetworkBudgets    Module = "agent_network.budgets"
+	AgentNetworkUsage      Module = "agent_network.usage"
+	AgentNetworkLogs       Module = "agent_network.logs"
+	AgentNetworkSettings   Module = "agent_network.settings"
 )
 
 var All = map[Module]struct{}{
@@ -40,4 +53,21 @@ var All = map[Module]struct{}{
 	IdentityProviders: {},
 	Services:          {},
 	AgentNetwork:      {},
+
+	AgentNetworkProviders:  {},
+	AgentNetworkPolicies:   {},
+	AgentNetworkGuardrails: {},
+	AgentNetworkBudgets:    {},
+	AgentNetworkUsage:      {},
+	AgentNetworkLogs:       {},
+	AgentNetworkSettings:   {},
+}
+
+// Parent returns the module owning a dotted submodule name and true, or the
+// module itself and false when it has no parent.
+func (m Module) Parent() (Module, bool) {
+	if i := strings.IndexByte(string(m), '.'); i > 0 {
+		return Module(string(m)[:i]), true
+	}
+	return m, false
 }

management/server/types/account.go

@@ -1707,14 +1707,34 @@ func (a *Account) injectPrivateServicePolicies(svc *service.Service, proxyPeers
 	if len(proxyPeers) == 0 {
 		return
 	}
+	// A service's AccessGroups can name groups that no longer exist — persisted
+	// services and the agent-network synthesiser both carry the ids verbatim from
+	// their own state. An unresolvable source authorises nothing, so drop it here
+	// rather than let the network-map assembly resolve it to a nil group.
+	sources := a.existingGroupIDs(svc.AccessGroups)
+	if len(sources) == 0 {
+		return
+	}
 	for _, proxyPeer := range proxyPeers {
-		a.Policies = append(a.Policies, a.createPrivateServicePolicy(svc, proxyPeer))
+		a.Policies = append(a.Policies, a.createPrivateServicePolicy(svc, proxyPeer, sources))
 	}
 }
 
-func (a *Account) createPrivateServicePolicy(svc *service.Service, proxyPeer *nbpeer.Peer) *Policy {
+// existingGroupIDs returns the subset of groupIDs that resolve to a group in the account,
+// preserving the input order.
+func (a *Account) existingGroupIDs(groupIDs []string) []string {
+	out := make([]string, 0, len(groupIDs))
+	for _, groupID := range groupIDs {
+		if _, ok := a.Groups[groupID]; ok {
+			out = append(out, groupID)
+		}
+	}
+	return out
+}
+
+func (a *Account) createPrivateServicePolicy(svc *service.Service, proxyPeer *nbpeer.Peer, accessGroups []string) *Policy {
 	policyID := fmt.Sprintf("private-access-%s-%s", svc.ID, proxyPeer.ID)
-	sources := append([]string(nil), svc.AccessGroups...)
+	sources := append([]string(nil), accessGroups...)
 	return &Policy{
 		ID:      policyID,
 		Name:    fmt.Sprintf("Private Access to %s", svc.Name),

management/server/types/proxy_access_token.go

@@ -68,7 +68,7 @@ type ProxyAccessTokenGenerated struct {
 // CreateNewProxyAccessToken generates a new proxy access token.
 // Returns the token with hashed value stored and plain token for one-time display.
 func CreateNewProxyAccessToken(name string, expiresIn time.Duration, accountID *string, createdBy string) (*ProxyAccessTokenGenerated, error) {
-	hashedToken, plainToken, err := generateProxyToken()
+	hashedToken, plainToken, err := GenerateProxyToken()
 	if err != nil {
 		return nil, err
 	}
@@ -94,7 +94,10 @@ func CreateNewProxyAccessToken(name string, expiresIn time.Duration, accountID *
 	}, nil
 }
 
-func generateProxyToken() (HashedProxyToken, PlainProxyToken, error) {
+// GenerateProxyToken generates a new random proxy token, returning its SHA-256
+// hash (for storage) and the one-time plaintext. Exported so external modules
+// can mint tokens in the canonical proxy-token format.
+func GenerateProxyToken() (HashedProxyToken, PlainProxyToken, error) {
 	secret, err := b.Random(ProxyTokenSecretLength)
 	if err != nil {
 		return "", "", err

management/server/types/proxy_access_token_test.go

@@ -1,6 +1,7 @@
 package types
 
 import (
+	"strings"
 	"testing"
 	"time"
 
@@ -123,6 +124,22 @@ func TestCreateNewProxyAccessToken(t *testing.T) {
 	})
 }
 
+func TestGenerateProxyToken(t *testing.T) {
+	hashed, plain, err := GenerateProxyToken()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := plain.Validate(); err != nil {
+		t.Errorf("generated token failed Validate(): %v", err)
+	}
+	if plain.Hash() != hashed {
+		t.Error("returned hashed token does not match Hash(plain)")
+	}
+	if !strings.HasPrefix(string(plain), ProxyTokenPrefix) {
+		t.Errorf("token %q missing prefix %q", plain, ProxyTokenPrefix)
+	}
+}
+
 func TestProxyAccessToken_IsExpired(t *testing.T) {
 	past := time.Now().Add(-1 * time.Hour)
 	future := time.Now().Add(1 * time.Hour)

release_files/darwin_pkg/postinstall

@@ -30,7 +30,23 @@ mkdir -p /usr/local/bin/
     $AGENT service install || true
     $AGENT service start || true
 
-    open $APP
+    console_user=$(stat -f%Su /dev/console 2>/dev/null)
+    case "$console_user" in
+        ""|root|loginwindow|_mbsetupuser)
+            echo "No active GUI user session (console user: '${console_user:-none}'); skipping UI launch."
+            ;;
+        *)
+            uid=$(id -u "$console_user" 2>/dev/null)
+            if [ -z "$uid" ]; then
+                echo "Could not resolve uid for console user '$console_user'; skipping UI launch."
+            else
+                echo "Launching NetBird UI as console user $console_user (uid $uid)."
+                if ! launchctl asuser "$uid" sudo -u "$console_user" -H open "$APP"; then
+                    echo "Failed to launch NetBird UI; if autostart is enabled it will start at next login."
+                fi
+            fi
+            ;;
+    esac
 
     echo "Finished Netbird installation successfully"
     exit 0 # all good