[client] Update the wails fork reference to the integration branch head

Point the wails replace directive at the current head of the netbirdio
fork's integration branch.

.github/workflows/release.yml

@@ -475,6 +475,132 @@ jobs:
           path: dist/
           retention-days: 3
 
+  release_ui_gtk3:
+    # Legacy GTK3/WebKit2GTK 4.1 UI build for distros without WebKitGTK 6.0
+    # (Ubuntu 22.04, Debian 12, RHEL 9, Fedora <=39). Runs on ubuntu-22.04 so
+    # the binary links against the oldest supported glibc.
+    runs-on: ubuntu-22.04
+    outputs:
+      release_ui_gtk3_artifact_url: ${{ steps.upload_release_ui_gtk3.outputs.artifact-url }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0 # It is required for GoReleaser to work properly
+          persist-credentials: false
+
+      - name: Parse semver string
+        id: semver_parser
+        uses: netbirdio/shared-actions/actions/parse-semver@be5df6047383da2236e02243cceb857d8567c27e # v0.0.2
+
+      - name: Set snapshot flag
+        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
+        run: |
+          echo "flags=--snapshot" >> $GITHUB_ENV
+
+      - name: Set build vars
+        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+        run: |
+          if [[ "x-${{ steps.semver_parser.outputs.prerelease }}" == "x-" && "x-${{ github.repository }}" == "x-netbirdio/netbird" ]]; then
+            echo "x-${{ github.repository }}"
+            echo "x-${{ steps.semver_parser.outputs.prerelease }}"
+            echo "SKIP_PUBLISH=false" >> $GITHUB_ENV
+          else
+            echo "x-${{ github.repository }}"
+            echo "x-${{ steps.semver_parser.outputs.prerelease }}"
+          fi
+
+      - name: Set up Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: "go.mod"
+          cache: false
+      - name: Cache Go modules
+        # Restore-only from the release_ui cache written by trusted runs; the
+        # module cache is identical (same go.sum) and stale build-cache
+        # entries just miss.
+        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        with:
+          path: |
+            ~/go/pkg/mod
+            ~/.cache/go-build
+          key: ${{ runner.os }}-ui-go-releaser-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-ui-go-releaser-
+
+      - name: Install modules
+        run: go mod tidy
+
+      - name: check git status
+        run: git --no-pager diff --exit-code
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
+        with:
+          version: 11
+
+      - name: Install dependencies
+        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libwebkit2gtk-4.1-dev
+
+      - name: Decode GPG signing key
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          GPG_RPM_PRIVATE_KEY: ${{ secrets.GPG_RPM_PRIVATE_KEY }}
+        run: |
+          echo "$GPG_RPM_PRIVATE_KEY" | base64 -d > /tmp/gpg-rpm-signing-key.asc
+          echo "GPG_RPM_KEY_FILE=/tmp/gpg-rpm-signing-key.asc" >> $GITHUB_ENV
+
+      - name: Install wails3 CLI
+        # Version derived from go.mod so the binding generator always matches
+        # the wails runtime the binary links against.
+        # -tags gtk3: the CLI links the wails runtime's cgo packages, and the
+        # default tags request gtk4/webkitgtk-6.0 pkg-config entries that do
+        # not exist on ubuntu-22.04.
+        run: |
+          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
+          go install -tags gtk3 github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
+        with:
+          version: ${{ env.GORELEASER_VER }}
+          args: release --config .goreleaser_ui_gtk3.yaml --clean ${{ env.flags }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          UPLOAD_DEBIAN_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
+          UPLOAD_YUM_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
+          GPG_RPM_KEY_FILE: ${{ env.GPG_RPM_KEY_FILE }}
+          NFPM_NETBIRD_UI_RPM_GTK3_PASSPHRASE: ${{ secrets.GPG_RPM_PASSPHRASE }}
+          SKIP_PUBLISH: ${{ env.SKIP_PUBLISH }}
+      - name: Verify RPM signatures
+        run: |
+          docker run --rm -v $(pwd)/dist:/dist fedora:41 bash -c '
+            dnf install -y -q rpm-sign curl >/dev/null 2>&1
+            curl -sSL https://pkgs.netbird.io/yum/repodata/repomd.xml.key -o /tmp/rpm-pub.key
+            rpm --import /tmp/rpm-pub.key
+            echo "=== Verifying RPM signatures ==="
+            for rpm_file in /dist/*.rpm; do
+              [ -f "$rpm_file" ] || continue
+              echo "--- $(basename $rpm_file) ---"
+              rpm -K "$rpm_file"
+            done
+          '
+      - name: Clean up GPG key
+        if: always()
+        run: rm -f /tmp/gpg-rpm-signing-key.asc
+      - name: upload non tags for debug purposes
+        id: upload_release_ui_gtk3
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
+        with:
+          name: release-ui-gtk3
+          path: dist/
+          retention-days: 3
+
   release_ui_darwin:
     runs-on: macos-latest
     outputs:
@@ -688,7 +814,7 @@ jobs:
   comment_release_artifacts:
     name: Comment release artifacts
     runs-on: ubuntu-latest
-    needs: [release, release_ui, release_ui_darwin]
+    needs: [release, release_ui, release_ui_gtk3, release_ui_darwin]
     if: ${{ always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
     permissions:
       contents: read
@@ -700,12 +826,14 @@ jobs:
         env:
           RELEASE_RESULT: ${{ needs.release.result }}
           RELEASE_UI_RESULT: ${{ needs.release_ui.result }}
+          RELEASE_UI_GTK3_RESULT: ${{ needs.release_ui_gtk3.result }}
           RELEASE_UI_DARWIN_RESULT: ${{ needs.release_ui_darwin.result }}
           RELEASE_ARTIFACT_URL: ${{ needs.release.outputs.release_artifact_url }}
           LINUX_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.linux_packages_artifact_url }}
           WINDOWS_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.windows_packages_artifact_url }}
           MACOS_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.macos_packages_artifact_url }}
           RELEASE_UI_ARTIFACT_URL: ${{ needs.release_ui.outputs.release_ui_artifact_url }}
+          RELEASE_UI_GTK3_ARTIFACT_URL: ${{ needs.release_ui_gtk3.outputs.release_ui_gtk3_artifact_url }}
           RELEASE_UI_DARWIN_ARTIFACT_URL: ${{ needs.release_ui_darwin.outputs.release_ui_darwin_artifact_url }}
           GHCR_IMAGES_MARKDOWN: ${{ needs.release.outputs.ghcr_images }}
         with:
@@ -728,6 +856,7 @@ jobs:
               ['Windows packages', process.env.WINDOWS_PACKAGES_ARTIFACT_URL, process.env.RELEASE_RESULT],
               ['macOS packages', process.env.MACOS_PACKAGES_ARTIFACT_URL, process.env.RELEASE_RESULT],
               ['UI artifacts', process.env.RELEASE_UI_ARTIFACT_URL, process.env.RELEASE_UI_RESULT],
+              ['UI GTK3 artifacts', process.env.RELEASE_UI_GTK3_ARTIFACT_URL, process.env.RELEASE_UI_GTK3_RESULT],
               ['UI macOS artifacts', process.env.RELEASE_UI_DARWIN_ARTIFACT_URL, process.env.RELEASE_UI_DARWIN_RESULT],
             ];
 
@@ -784,7 +913,7 @@ jobs:
 
   trigger_signer:
     runs-on: ubuntu-latest
-    needs: [release, release_ui, release_ui_darwin, test_windows_installer]
+    needs: [release, release_ui, release_ui_gtk3, release_ui_darwin, test_windows_installer]
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Trigger binaries sign pipelines

.github/workflows/test-infrastructure-files.yml

@@ -257,6 +257,15 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Verify fresh-install session cookie key hardening
+        run: |
+          grep -Fxq '  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)' infrastructure_files/getting-started.sh
+          grep -Fxq '    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"' infrastructure_files/getting-started.sh
+          grep -Fxq '  install -m 600 /dev/null config.yaml' infrastructure_files/getting-started.sh
+          grep -Fxq '  openssl rand -base64 32' infrastructure_files/getting-started-enterprise.sh
+          grep -Fxq '  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)' infrastructure_files/getting-started-enterprise.sh
+          grep -Fxq '    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"' infrastructure_files/getting-started-enterprise.sh
+
       - name: Verify Dex retirement notice
         run: |
           if infrastructure_files/getting-started-with-dex.sh >stdout.txt 2>stderr.txt; then

.goreleaser_ui_gtk3.yaml

@@ -0,0 +1,131 @@
+version: 2
+env:
+  - SKIP_PUBLISH={{ if index .Env "SKIP_PUBLISH" }}{{ .Env.SKIP_PUBLISH }}{{ else }}true{{ end }}
+project_name: netbird-ui
+
+before:
+  hooks:
+    # Bindings are gitignored; regenerate before the frontend build so
+    # the @wailsio/runtime Vite plugin can resolve them (vite refuses to
+    # build without them).
+    # -f '-tags gtk3': the generator type-checks client/ui, whose cgo imports
+    # would otherwise resolve gtk4/webkitgtk-6.0 pkg-config entries that do
+    # not exist on ubuntu-22.04.
+    - sh -c 'cd client/ui && wails3 generate bindings -clean=true -ts -f "-tags gtk3"'
+    - sh -c 'cd client/ui/frontend && pnpm install --frozen-lockfile && pnpm build'
+
+builds:
+  # Legacy GTK3 / WebKit2GTK 4.1 build for distros without WebKitGTK 6.0
+  # (Ubuntu 22.04, Debian 12, RHEL 9, Fedora <=39). The gtk3 tag flips the
+  # Wails Linux backend to the GTK3 stack and swaps our GTK4-only XEmbed
+  # tray host for the pure-Go stub (client/ui/xembed_host_gtk3_linux.go).
+  # Must be built on the oldest supported glibc (ubuntu-22.04 runner).
+  - id: netbird-ui-gtk3
+    dir: client/ui
+    binary: netbird-ui
+    env:
+      - CGO_ENABLED=1
+    goos:
+      - linux
+    goarch:
+      - amd64
+    ldflags:
+      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
+    mod_timestamp: "{{ .CommitTimestamp }}"
+    tags:
+      - production
+      - gtk3
+
+archives:
+  - id: linux-gtk3-arch
+    name_template: "{{ .ProjectName }}-linux-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    builds:
+      - netbird-ui-gtk3
+
+nfpms:
+  # Same package_name as the GTK4 packages -- the two are mutually-exclusive
+  # alternatives served from separate repo paths (see uploads below); a given
+  # distro points at exactly one of them. The file names must still differ:
+  # the Debian pool is shared storage keyed by file name, so a default-named
+  # gtk3 .deb would overwrite the stable one.
+  - maintainer: Netbird <dev@netbird.io>
+    description: Netbird client UI.
+    homepage: https://netbird.io/
+    license: BSD-3-Clause
+    vendor: NetBird
+    id: netbird_ui_deb_gtk3
+    package_name: netbird-ui
+    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    builds:
+      - netbird-ui-gtk3
+    formats:
+      - deb
+    scripts:
+      postinstall: "release_files/ui-post-install.sh"
+    contents:
+      - src: client/ui/build/linux/netbird.desktop
+        dst: /usr/share/applications/org.wails.netbird.desktop
+      - src: client/ui/build/appicon.png
+        dst: /usr/share/pixmaps/netbird.png
+    dependencies:
+      - netbird (>= 0.75.0)
+      - libgtk-3-0
+      - libwebkit2gtk-4.1-0
+
+  - maintainer: Netbird <dev@netbird.io>
+    description: Netbird client UI.
+    homepage: https://netbird.io/
+    license: BSD-3-Clause
+    vendor: NetBird
+    id: netbird_ui_rpm_gtk3
+    package_name: netbird-ui
+    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
+    builds:
+      - netbird-ui-gtk3
+    formats:
+      - rpm
+    scripts:
+      postinstall: "release_files/ui-post-install.sh"
+    contents:
+      - src: client/ui/build/linux/netbird.desktop
+        dst: /usr/share/applications/org.wails.netbird.desktop
+      - src: client/ui/build/appicon.png
+        dst: /usr/share/pixmaps/netbird.png
+    dependencies:
+      - netbird >= 0.75.0
+      - (gtk3 or libgtk-3-0)
+      - (webkit2gtk4.1 or libwebkit2gtk-4_1-0)
+
+    rpm:
+      signature:
+        key_file: '{{ if index .Env "GPG_RPM_KEY_FILE" }}{{ .Env.GPG_RPM_KEY_FILE }}{{ end }}'
+
+# The GTK4 UI job shares project_name, so the default checksum file name would
+# collide with it on the shared GitHub release.
+checksum:
+  name_template: "{{ .ProjectName }}_gtk3_checksums.txt"
+
+changelog:
+  disable: true
+
+uploads:
+  # The gtk3 packages reuse the netbird-ui package name, so they live in
+  # dedicated repo paths (deb distribution `gtk3`, yum path `yum-gtk3`) that
+  # legacy distros point their repo config at.
+  - name: debian-gtk3
+    skip: "{{ .Env.SKIP_PUBLISH }}"
+    ids:
+      - netbird_ui_deb_gtk3
+    mode: archive
+    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=gtk3;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
+    username: dev@wiretrustee.com
+    method: PUT
+
+  - name: yum-gtk3
+    skip: "{{ .Env.SKIP_PUBLISH }}"
+    ids:
+      - netbird_ui_rpm_gtk3
+    mode: archive
+    target: https://pkgs.wiretrustee.com/yum-gtk3/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
+    username: dev@wiretrustee.com
+    method: PUT

AGENTS.md

@@ -14,20 +14,22 @@ in this file, not duplicated there.
 
 ## Contents
 
-- [NetBird Agent Guidelines](#netbird-agent-guidelines)
-  - [Contents](#contents)
-  - [STOP and ask the user before](#stop-and-ask-the-user-before)
-  - [Quick reference](#quick-reference)
-  - [Structure](#structure)
-  - [Where to look](#where-to-look)
-  - [Repo-wide principles](#repo-wide-principles)
-  - [Error handling](#error-handling)
-  - [Comments](#comments)
-  - [Testing](#testing)
-  - [Pitfalls](#pitfalls)
-  - [Commits, PRs, releases](#commits-prs-releases)
-  - [After you push: CI and review bots](#after-you-push-ci-and-review-bots)
-  - [Discussion and support](#discussion-and-support)
+- [STOP and ask the user before](#stop-and-ask-the-user-before)
+- [Quick reference](#quick-reference)
+- [Structure](#structure)
+- [Where to look](#where-to-look)
+- [Security](#security)
+- [Agent conventions](#agent-conventions)
+- [Repo-wide principles](#repo-wide-principles)
+- [Type safety](#type-safety)
+- [Concurrency and lifecycle](#concurrency-and-lifecycle)
+- [Error handling](#error-handling)
+- [Comments](#comments)
+- [Testing](#testing)
+- [Pitfalls](#pitfalls)
+- [Commits, PRs, releases](#commits-prs-releases)
+- [After you push: CI and review bots](#after-you-push-ci-and-review-bots)
+- [Discussion and support](#discussion-and-support)
 
 ## STOP and ask the user before
 
@@ -157,11 +159,125 @@ netbird/
 | LLM routing / Agent Network | `proxy/internal/llm/`, `agent-network/`                      |
 | End-to-end tests            | `e2e/`                                                       |
 
+## Security
+
+### Never fail open
+
+When a security check — access control, an IP restriction, an auth decision —
+hits an error such as an unparseable value, an unavailable lookup, or a state it
+does not recognize, it must **deny**. Never skip the check or allow the request
+through because the check itself failed, and make the `default` and unknown cases
+of a security-related `switch` deny rather than fall through.
+
+### Daemon RPC input is untrusted
+
+The agent runs as root (LocalSystem on Windows), so a daemon RPC crosses a
+privilege boundary: treat every field as untrusted input rather than as something
+the UI or CLI validated on the way in.
+
+When you add or change an RPC, ask what the handler does with caller input while
+running as root. If the answer touches a filesystem path, a URL or host, or a
+privileged state change, it needs a gate **in the handler** — a check in the client
+that normally calls it is not a check at all.
+
+- **A caller-supplied path the daemon opens.** Never `os.Open` it as root.
+  Constrain it, then open it *as the caller* with `ipcauth.OpenOwnedFile`, which
+  opens `O_NOFOLLOW`, requires a regular file, and refuses a file the caller does
+  not own — so a symlink or hardlink aimed at a root-only file is rejected.
+- **A caller-supplied URL or host the daemon fetches.** Restrict the scheme and
+  allow only known hosts for unprivileged callers. Prefer a lexical host
+  allowlist plus TLS verification over "resolve the host, then reject private
+  IPs": the resolve-then-trust pattern has a DNS-rebinding race (public IP at
+  check time, attacker IP at connect time), while a name allowlist has no IP
+  check to race. Never accept `http://` where `https://` is expected.
+- **A privileged state change** (SSH root login, management URL, deregistration)
+  gates on the caller identity from `ipcauth.CallerIdentity(ctx)`.
+
+Caller identity comes from the kernel — `SO_PEERCRED`, `LOCAL_PEERCRED`, or the
+named-pipe client token — and never from an RPC field. When
+`ipcauth.CallerIdentity` reports that it could not determine an identity, **deny**;
+do not fall back to treating the caller as the transport peer.
+
+## Agent conventions
+
+### Three networking modes
+
+Where packets actually flow depends on the mode the agent is running in. The
+three are not interchangeable, so establish which one a change applies to — and
+what it should do in the other two — before you write it.
+
+- **kernel mode** (Linux only): in-kernel WireGuard®. The kernel handles both
+  peer-to-peer and routed traffic, and ACLs are iptables or nftables rules. The
+  client programs kernel facilities but never sees the traffic itself.
+- **userspace mode** (wireguard-go with a TUN): wireguard-go runs in-process. The
+  kernel handles peer-to-peer traffic once it leaves the TUN, while routed traffic
+  — exit nodes and network routes — goes through the userspace forwarder, which
+  terminates the connection and re-establishes it over OS sockets. Used on
+  platforms without kernel WireGuard® or when the user opts out.
+- **netstack mode**: wireguard-go in-process with no TUN and no kernel
+  networking. The forwarder does all routing by stitching userspace sockets, and
+  listeners such as the embedded SSH and DNS servers bind on a gVisor netstack.
+  Used where the process cannot create a TUN device, such as the embedded client
+  (`client/embed/`) and the WASM build.
+
+### The overlay interface is not "WireGuard"
+
+Do not put "WireGuard" in identifiers or comments unless the code is genuinely
+coupled to WireGuard® specifically — a wireguard-go call, a handshake field, a
+kernel WireGuard® netlink attribute. For the interface, the host, peers, or
+traffic in general, say "the NetBird interface", "the interface", or "the overlay".
+Most firewall, routing, and DNS code is transport-agnostic, so a WireGuard®
+reference there is simply inaccurate and rots as the transports change.
+
+### IPv6 is a soft feature
+
+The IPv6 overlay is opt-in dual-stack, and capability can change at runtime. Treat
+it as soft rather than a requirement:
+
+- Gate local v6 paths on the interface accessor (`wgIface.Address().HasIPv6()`),
+  not on raw state fields, and skip the v6 path when the host has no v6 rather
+  than returning an error.
+- Treat an empty or unparseable peer v6 address as "no v6 for that peer" and skip
+  it, keeping the v4 path working.
+- Never let a missing v6 break v4. Fail-closed is for security checks; a
+  capability mismatch skips the v6 work and carries on.
+
+### Environment variables
+
+Name the variable in a constant and parse booleans with `strconv.ParseBool` rather
+than comparing strings inline, so an unexpected value is logged instead of
+silently meaning false:
+
+```go
+const EnvDisableFeature = "NB_DISABLE_FEATURE"
+
+func isDisabledByEnv() bool {
+    val := os.Getenv(EnvDisableFeature)
+    if val == "" {
+        return false
+    }
+    disabled, err := strconv.ParseBool(val)
+    if err != nil {
+        log.Warnf("failed to parse %s: %v", EnvDisableFeature, err)
+        return false
+    }
+    return disabled
+}
+```
+
+### Validating against protocol specs
+
+When a change depends on what a protocol actually mandates, read the specification
+text from the [IETF datatracker](https://datatracker.ietf.org/) rather than a
+summary, and check that you have the current RFC — the widely cited one for a
+protocol is often superseded. Cite the section, not just the document, so a
+reviewer can jump straight to the rule.
+
 ## Repo-wide principles
 
 1. **Run `go fmt` on every modified Go file.** Formatting is not optional.
-2. **Zero unaddressed diagnostics.** Fix IDE and linter warnings on code you
-   touch, and delete imports, helpers, and parameters your refactor orphaned.
+2. **Zero unaddressed linter warnings.** Fix what `golangci-lint` reports on code
+   you touch, and delete imports, helpers, and parameters your refactor orphaned.
    Exception: unused parameters in shared code may be consumed by builds outside
    this repository — do not remove them, ask instead.
 3. **Function comments are mandatory for exported functions**, written as full
@@ -175,9 +291,12 @@ netbird/
 7. **Avoid LLM-slop tells:** em dashes, hedging narration, restating the diff in
    prose, trailing summaries. Defaults, not absolute bans. Applies to code,
    comments, commit messages, and PR descriptions alike.
-8. **Concurrency: do a two-pass race analysis after every change** that adds
-   shared state. Guard maps and slices with a mutex, keep critical sections
-   short, and run `go test -race` on the touched packages.
+8. **Concurrency: do a two-pass race analysis after every change** that touches
+   shared state, including reads of existing maps and slices. Guard them with a
+   mutex (or an atomic or channel where that fits better), keep critical
+   sections short, and run `go test -race` on the touched packages. See
+   [Concurrency and lifecycle](#concurrency-and-lifecycle) for the failure modes
+   to check for.
 9. **Cross-platform builds must keep working.** The agent targets Linux, macOS,
    Windows, FreeBSD, Android, and iOS. When you add a platform-specific file,
    add the counterpart or a build-tagged fallback for the others.
@@ -185,6 +304,93 @@ netbird/
 11. **Never log secrets** — private keys, setup keys, tokens, PAT values — and
     keep peer IPs and hostnames out of logs above debug level.
 
+## Type safety
+
+**No bare primitives for domain concepts.** A `string` parameter for an account
+ID next to a `string` parameter for a peer ID is two bugs waiting to happen,
+because the compiler cannot catch the swap. Declare the type once and use it
+throughout, converting only at the boundaries where data enters or leaves —
+protobuf, gRPC, HTTP, an external library.
+
+```go
+type ServiceID string
+type AccountID string
+
+// Internal: typed all the way through
+func (r *Router) RemoveRoute(host SNIHost, svcID ServiceID) { ... }
+
+// Proto boundary: convert once, on the way in and on the way out
+svcID := ServiceID(mapping.GetId())
+req.ServiceId = string(svcID)
+```
+
+- **IP addresses are `netip.Addr`**, not `string` and not `net.IP`. Parse at the
+  boundary and pass the typed value inward.
+- **Always `Unmap()`** after parsing an address, after converting from `net.IP`,
+  and after extracting one from `RemoteAddr()`. This normalizes a v4-mapped v6
+  address (`::ffff:10.1.2.3`) to plain v4 so IPv4 rules match it. A stored or
+  compared mapped address silently fails to match those rules.
+- **Ports are `uint16`** internally; use `int` only where a library forces it and
+  convert immediately.
+- **Enums are a typed string with constants**, so the valid set is discoverable
+  and a typo fails to compile.
+- **Map keys follow the same rule**, and must be a real type (`type ServiceID
+  string`) rather than an alias (`type serviceID = string`) — an alias silently
+  accepts bare strings.
+
+## Concurrency and lifecycle
+
+Beyond the mutex hygiene in the principles above, check for these failure
+modes.
+
+- **Never read a struct field inside a goroutine** when another goroutine may nil
+  or reassign it. Pass the value as a parameter, or capture it into a local before
+  launching. This matters most when `Stop()` nils a field without waiting for the
+  goroutine to finish.
+
+  ```go
+  go func(ifaceName string) {   // good: passed in, cannot be nilled underneath
+      m.Start(ctx, ifaceName)
+  }(iface.Name())
+  ```
+
+- **Never wait on a channel while holding a lock the sender needs.** Copy what you
+  need out from under the lock, release it, then wait.
+
+  ```go
+  func (m *Manager) Stop() {
+      m.mu.Lock()
+      cancel, done := m.cancel, m.done
+      m.mu.Unlock()
+      if cancel != nil {
+          cancel()
+          <-done
+      }
+  }
+  ```
+
+- **`Stop`/`Close` must be idempotent** — guard on an already-stopped flag or a
+  nil cancel — and must release the state they guarded. Clear maps and caches;
+  a cancelled goroutine holding a live map still pins that memory. Note that a
+  nil map only panics on writes; reads and iteration behave like an empty map,
+  so where post-close use must be rejected, check the stopped flag explicitly.
+- **Publish coupled state only after every fallible step succeeds.** When several
+  fields form an invariant, build them into locals and assign them to the receiver
+  at the end. Assigning as you go leaves the object half-initialized when a later
+  step fails, so a readiness predicate reports ready while a coupled field is nil.
+  If an earlier step already had an external side effect — a created chain, an
+  opened handle, an inserted rule — roll it back before returning the error.
+- **Clean up what you own on constructor error paths.** Once a constructor has
+  started something, every later error path must undo it: cancel a goroutine and
+  wait for it to exit, stop a ticker, close a watcher. The object is never
+  returned, so its `Close` will never run.
+- **A failed `Start` must undo everything it started.** When a component brings up
+  several subsystems in sequence — connection manager, watchers, routing, DNS,
+  flow, persisted state — a failure partway through has to tear down the ones
+  already running, not just close the handle the error came from. Put the
+  already-started guard *before* that teardown path, so a rejected second `Start`
+  cannot dismantle the one that is running.
+
 ## Error handling
 
 Use single-assignment form when the error is only needed inside the `if`:
@@ -248,6 +454,45 @@ Log the errors you choose not to act on:
 - Close errors may be ignored for read-only operations; log them at debug for
   writes.
 
+**Do not log and return the same error.** It gets reported twice, from two places,
+and the second reader cannot tell whether it happened once or twice. Return it and
+let the caller decide. The exception is an API handler that has already written a
+response. Internal helpers return errors rather than logging and swallowing them.
+
+**Never return a typed nil as an error.** A nil `*MyError` stored in an `error`
+interface is not nil, so `err != nil` is true and callers take the failure path on
+success. Return the error only where it is actually set:
+
+```go
+if _, err := conn.Write(buf); err != nil {   // good
+    return err
+}
+return nil
+```
+
+**Accumulate with `multierror` when an operation should continue past individual
+failures** — teardown, cleanup, or setup where partial success is acceptable.
+`client/errors.FormatErrorOrNil` returns nil for an empty accumulator, so callers
+still see a plain nil on full success:
+
+```go
+func (m *Manager) Cleanup() error {
+    var merr *multierror.Error
+    for _, r := range m.resources {
+        if err := r.Close(); err != nil {
+            merr = multierror.Append(merr, fmt.Errorf("close %s: %w", r.Name, err))
+        }
+    }
+    return nberrors.FormatErrorOrNil(merr)
+}
+```
+
+| Scenario              | Approach              | Why                                       |
+| --------------------- | --------------------- | ----------------------------------------- |
+| Cleanup / teardown    | Accumulate            | Clean up as much as possible              |
+| Setup with rollback   | Abort on first error  | Partial state is invalid; undo what stuck |
+| Setup with partial OK | Accumulate            | Degraded operation is still useful        |
+
 ## Comments
 
 Comment the **why**, never the **what**. Default to no comment, and add one only
@@ -269,10 +514,14 @@ checksum = updateChecksum(checksum, oldPort, newPort)
 
 ### Length budget
 
-- **90 characters per line.** Wrap the comment, do not run past it.
-- **250 characters per comment**, roughly three wrapped lines. Doc comments on
-  exported identifiers may exceed it when the API genuinely needs the
-  explanation; inline comments inside a function body may not.
+Neither of these is linter-enforced, so they are conventions the surrounding code
+mostly follows rather than hard limits:
+
+- **Around 90 characters per line.** Wrap the comment rather than running well past
+  it.
+- **Roughly 250 characters per comment**, about three wrapped lines. Doc comments
+  on exported identifiers may exceed it when the API genuinely needs the
+  explanation; inline comments inside a function body rarely should.
 
 The budget is a smell detector, not a rule to game. Do not compress a needed
 explanation into cryptic shorthand to fit — if a block of code needs more than
@@ -329,6 +578,19 @@ up, and the 250-character budget does not apply to them.
   otherwise.
 - **Message guidance:** optional for `NoError`/`Error`; always give context for
   comparison, boolean, and collection assertions.
+- **Reproduce a bug before fixing it.** Write the test, watch it fail *for the
+  reason you expect* — a test that fails for an unrelated reason proves nothing —
+  then apply the fix and confirm it passes. Add the thin surrounding cases while
+  you are there.
+- **Use `t.Setenv`** rather than `os.Setenv` so the previous value is restored on
+  cleanup. To test the unset case, call `t.Setenv` first to register the restore,
+  then `os.Unsetenv`.
+- **Prefer `t.Cleanup` over `defer`** in any test with parallel subtests: the
+  parent function returns, running its `defer`s, while parallel subtests are
+  still suspended. Sequential subtests finish inside `t.Run`, so `defer` is safe
+  there, but `t.Cleanup` works in both cases.
+- **Explanatory comments in tests are welcome.** Describe the scenario being set
+  up; the comment budget below does not apply to them.
 
 ```go
 server, err := StartTestServer()
@@ -380,7 +642,8 @@ assert.Equal(t, expectedResult, result, "Result should match expected")
   than replacing it with your own summary: describe the change, link the issue,
   tick the checklist honestly (including "ran locally" and "single purpose"),
   and complete the documentation section. Do not tick a box you have not
-  verified, and do not delete rows that do not apply.
+  verified, and do not delete rows that do not apply — the docs gate in CI reads
+  that section and fails when it is missing.
 
 - **Keep the PR description short.** Under 1000 words on top of the template's
   own text, and usually far less — a few paragraphs. Reviewers read the diff;
@@ -439,6 +702,12 @@ assert.Equal(t, expectedResult, result, "Result should match expected")
   on their own. Propose that split to the user rather than opening one large PR
   and hoping.
 
+  Prefer GitHub's stacked pull requests for such a sequence, rather than
+  hand-managing base branches: open each PR against the branch below it instead of
+  `main`, so every PR's diff shows only its own change. Merging a layer retargets
+  the PRs above it, and branch protections and required checks on the base branch
+  still apply to each one.
+
 - **User-facing changes need a docs PR** in
   [netbirdio/docs](https://github.com/netbirdio/docs), linked from the PR
   description.

client/firewall/firewalld/firewalld.go

@@ -2,8 +2,8 @@
 // its wg interface into firewalld's "trusted" zone. This is required because
 // firewalld's nftables chains are created with NFT_CHAIN_OWNER on recent
 // versions, which returns EPERM to any other process that tries to insert
-// rules into them. The workaround mirrors what Tailscale does: let firewalld
-// itself add the accept rules to its own chains by trusting the interface.
+// rules into them. Trusting the interface makes firewalld itself add the
+// accept rules to its own chains instead.
 package firewalld
 
 // TrustedZone is the firewalld zone name used for interfaces whose traffic

client/internal/engine.go

@@ -48,7 +48,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
 	"github.com/netbirdio/netbird/client/internal/peerstore"
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
@@ -187,7 +186,7 @@ type EngineServices struct {
 type Engine struct {
 	// signal is a Signal Service client
 	signal   signal.Client
-	signaler *signaling.Signaler
+	signaler *peer.Signaler
 	// mgmClient is a Management Service client
 	mgmClient mgm.Client
 	// peerConns is a map that holds all the peers that are known to this peer
@@ -330,7 +329,7 @@ func NewEngine(
 		ctx:                ctx,
 		cancel:             cancel,
 		signal:             services.SignalClient,
-		signaler:           signaling.NewSignaler(services.SignalClient, config.WgPrivateKey),
+		signaler:           peer.NewSignaler(services.SignalClient, config.WgPrivateKey),
 		mgmClient:          services.MgmClient,
 		relayManager:       services.RelayManager,
 		peerStore:          peerstore.NewConnStore(),
@@ -2816,7 +2815,7 @@ func createFile(path string) error {
 	return file.Close()
 }
 
-func convertToOfferAnswer(msg *sProto.Message) (*signaling.OfferAnswer, error) {
+func convertToOfferAnswer(msg *sProto.Message) (*peer.OfferAnswer, error) {
 	remoteCred, err := signal.UnMarshalCredential(msg)
 	if err != nil {
 		return nil, err
@@ -2832,9 +2831,9 @@ func convertToOfferAnswer(msg *sProto.Message) (*signaling.OfferAnswer, error) {
 	}
 
 	// Handle optional SessionID
-	var sessionID *icemaker.SessionID
+	var sessionID *peer.ICESessionID
 	if sessionBytes := msg.GetBody().GetSessionId(); sessionBytes != nil {
-		if id, err := icemaker.SessionIDFromBytes(sessionBytes); err != nil {
+		if id, err := peer.ICESessionIDFromBytes(sessionBytes); err != nil {
 			log.Warnf("Invalid session ID in message: %v", err)
 			sessionID = nil // Set to nil if conversion fails
 		} else {
@@ -2844,8 +2843,8 @@ func convertToOfferAnswer(msg *sProto.Message) (*signaling.OfferAnswer, error) {
 
 	relayIP := decodeRelayIP(msg.GetBody().GetRelayServerIP())
 
-	offerAnswer := signaling.OfferAnswer{
-		IceCredentials: signaling.IceCredentials{
+	offerAnswer := peer.OfferAnswer{
+		IceCredentials: peer.IceCredentials{
 			UFrag: remoteCred.UFrag,
 			Pwd:   remoteCred.Pwd,
 		},

client/internal/peer/conn_status.go

@@ -1,5 +1,18 @@
 package peer
 
+import (
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	// StatusIdle indicate the peer is in disconnected state
+	StatusIdle ConnStatus = iota
+	// StatusConnecting indicate the peer is in connecting state
+	StatusConnecting
+	// StatusConnected indicate the peer is in connected state
+	StatusConnected
+)
+
 // connStatusInputs is the primitive-valued snapshot of the state that drives the
 // tri-state connection classification. Extracted so the decision logic can be unit-tested
 // without constructing full Worker/Handshaker objects.
@@ -8,7 +21,24 @@ type connStatusInputs struct {
 	peerUsesRelay       bool // remote peer advertises relay support AND local has relay
 	relayConnected      bool // statusRelay reports Connected (independent of whether peer uses relay)
 	remoteSupportsICE   bool // remote peer sent ICE credentials
-	iceWorkerCreated    bool // local ICE worker exists (false in force-relay mode)
+	iceWorkerCreated    bool // local WorkerICE exists (false in force-relay mode)
 	iceStatusConnecting bool // statusICE is anything other than Disconnected
 	iceInProgress       bool // a negotiation is currently in flight
 }
+
+// ConnStatus describe the status of a peer's connection
+type ConnStatus int32
+
+func (s ConnStatus) String() string {
+	switch s {
+	case StatusConnecting:
+		return "Connecting"
+	case StatusConnected:
+		return "Connected"
+	case StatusIdle:
+		return "Idle"
+	default:
+		log.Errorf("unknown status: %d", s)
+		return "INVALID_PEER_CONNECTION_STATUS"
+	}
+}

client/internal/peer/conn_status_test.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"testing"

client/internal/peer/conn_test.go

@@ -3,33 +3,28 @@ package peer
 import (
 	"context"
 	"fmt"
-	"net/netip"
 	"os"
 	"testing"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/internal/peer/dispatcher"
 	"github.com/netbirdio/netbird/client/internal/peer/guard"
 	"github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/internal/peer/metricsstages"
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/util"
 )
 
+var testDispatcher = dispatcher.NewConnectionDispatcher()
+
 var connConf = ConnConfig{
 	Key:         "LLHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
 	LocalKey:    "RRHf3Ma6z6mdLbriAJbqhX7+nM/B71lgw2+91q3LfhU=",
 	Timeout:     time.Second,
 	LocalWgPort: 51820,
-	WgConfig: WgConfig{
-		AllowedIps: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
-	},
 	ICEConfig: ice.Config{
 		InterfaceBlackList: nil,
 	},
@@ -57,37 +52,92 @@ func TestConn_GetKey(t *testing.T) {
 	swWatcher := guard.NewSRWatcher(nil, nil, nil, connConf.ICEConfig)
 
 	sd := ServiceDependencies{
-		SrWatcher: swWatcher,
+		SrWatcher:          swWatcher,
+		PeerConnDispatcher: testDispatcher,
 	}
 	conn, err := NewConn(connConf, sd)
-	require.NoError(t, err)
+	if err != nil {
+		return
+	}
 
 	got := conn.GetKey()
 
 	assert.Equal(t, got, connConf.Key, "they should be equal")
 }
 
-// TestConn_DiscardMessagesWhenNotOpened: signal messages posted to a not yet
-// opened connection must be discarded without blocking or panicking.
-func TestConn_DiscardMessagesWhenNotOpened(t *testing.T) {
+func TestConn_OnRemoteOffer(t *testing.T) {
 	swWatcher := guard.NewSRWatcher(nil, nil, nil, connConf.ICEConfig)
 	sd := ServiceDependencies{
-		StatusRecorder: status.NewRecorder("https://mgm"),
-		SrWatcher:      swWatcher,
+		StatusRecorder:     NewRecorder("https://mgm"),
+		SrWatcher:          swWatcher,
+		PeerConnDispatcher: testDispatcher,
 	}
 	conn, err := NewConn(connConf, sd)
-	require.NoError(t, err)
+	if err != nil {
+		return
+	}
 
-	offerAnswer := signaling.OfferAnswer{
-		IceCredentials: signaling.IceCredentials{
+	onNewOfferChan := make(chan struct{})
+
+	conn.handshaker.AddRelayListener(func(remoteOfferAnswer *OfferAnswer) {
+		onNewOfferChan <- struct{}{}
+	})
+
+	conn.OnRemoteOffer(OfferAnswer{
+		IceCredentials: IceCredentials{
 			UFrag: "test",
 			Pwd:   "test",
 		},
+		WgListenPort: 0,
+		Version:      "",
+	})
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	select {
+	case <-onNewOfferChan:
+		// success
+	case <-ctx.Done():
+		t.Error("expected to receive a new offer notification, but timed out")
+	}
+}
+
+func TestConn_OnRemoteAnswer(t *testing.T) {
+	swWatcher := guard.NewSRWatcher(nil, nil, nil, connConf.ICEConfig)
+	sd := ServiceDependencies{
+		StatusRecorder:     NewRecorder("https://mgm"),
+		SrWatcher:          swWatcher,
+		PeerConnDispatcher: testDispatcher,
+	}
+	conn, err := NewConn(connConf, sd)
+	if err != nil {
+		return
+	}
+
+	onNewOfferChan := make(chan struct{})
+
+	conn.handshaker.AddRelayListener(func(remoteOfferAnswer *OfferAnswer) {
+		onNewOfferChan <- struct{}{}
+	})
+
+	conn.OnRemoteAnswer(OfferAnswer{
+		IceCredentials: IceCredentials{
+			UFrag: "test",
+			Pwd:   "test",
+		},
+		WgListenPort: 0,
+		Version:      "",
+	})
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	select {
+	case <-onNewOfferChan:
+		// success
+	case <-ctx.Done():
+		t.Error("expected to receive a new offer notification, but timed out")
 	}
-	conn.OnRemoteOffer(offerAnswer)
-	conn.OnRemoteAnswer(offerAnswer)
-	conn.OnRemoteCandidate(nil, nil)
-	conn.Close(false)
 }
 
 func TestConn_presharedKey(t *testing.T) {
@@ -270,7 +320,7 @@ func newWGTimeoutTestConn(rosenpassEnabled bool, disconnected *[]string) *Conn {
 		ctx:           context.Background(),
 		config:        cfg,
 		Log:           log.WithField("peer", cfg.Key),
-		metricsStages: &metricsstages.MetricsStages{},
+		metricsStages: &MetricsStages{},
 	}
 	conn.SetOnDisconnected(func(remotePeer string) {
 		*disconnected = append(*disconnected, remotePeer)
@@ -289,20 +339,20 @@ func TestConn_onWGDisconnected_EscalatesToRosenpassReset(t *testing.T) {
 	conn := newWGTimeoutTestConn(true, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
 	assert.Empty(t, disconnected, "escalation must not fire below the threshold")
 
-	conn.handleWGTimeout()
+	conn.onWGDisconnected(conn.ctx)
 	assert.Equal(t, []string{conn.config.WgConfig.RemoteKey}, disconnected,
 		"reaching the threshold must report the peer disconnected once")
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
 	assert.Len(t, disconnected, 1, "escalation must restart counting after firing")
 
-	conn.handleWGTimeout()
+	conn.onWGDisconnected(conn.ctx)
 	assert.Len(t, disconnected, 2, "continued timeouts must escalate again")
 }
 
@@ -314,12 +364,12 @@ func TestConn_onWGDisconnected_CheckSuccessResetsEscalation(t *testing.T) {
 	conn := newWGTimeoutTestConn(true, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
-	conn.handleWGCheckSuccess()
+	conn.onWGCheckSuccess()
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
 	assert.Empty(t, disconnected, "handshake success must reset the timeout count")
 }
@@ -327,30 +377,12 @@ func TestConn_onWGDisconnected_CheckSuccessResetsEscalation(t *testing.T) {
 // TestConn_onWGDisconnected_NoEscalationWithoutRosenpass: without rosenpass
 // there is no per-peer key state to reset; repeated timeouts must not report
 // disconnects.
-func TestConn_handleEvent_DropsStaleWGTimeout(t *testing.T) {
-	var disconnected []string
-	conn := newWGTimeoutTestConn(true, &disconnected)
-
-	staleCtx, cancel := context.WithCancel(context.Background())
-	cancel()
-	for i := 0; i < wgTimeoutEscalationThreshold; i++ {
-		conn.handleEvent(evWGTimeout{ctx: staleCtx})
-	}
-	assert.Empty(t, disconnected, "timeouts from a cancelled watcher must be dropped")
-
-	liveCtx := context.Background()
-	for i := 0; i < wgTimeoutEscalationThreshold; i++ {
-		conn.handleEvent(evWGTimeout{ctx: liveCtx})
-	}
-	assert.Len(t, disconnected, 1, "timeouts from the live watcher must be dispatched")
-}
-
 func TestConn_onWGDisconnected_NoEscalationWithoutRosenpass(t *testing.T) {
 	var disconnected []string
 	conn := newWGTimeoutTestConn(false, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold*3; i++ {
-		conn.handleWGTimeout()
+		conn.onWGDisconnected(conn.ctx)
 	}
 	assert.Empty(t, disconnected, "escalation must be limited to rosenpass connections")
 }

client/internal/peer/conntype/priority.go

@@ -1,4 +1,4 @@
-package worker
+package conntype
 
 import (
 	"fmt"

client/internal/peer/dispatcher/dispatcher.go

@@ -0,0 +1,52 @@
+package dispatcher
+
+import (
+	"sync"
+
+	"github.com/netbirdio/netbird/client/internal/peer/id"
+)
+
+type ConnectionListener struct {
+	OnConnected    func(peerID id.ConnID)
+	OnDisconnected func(peerID id.ConnID)
+}
+
+type ConnectionDispatcher struct {
+	listeners map[*ConnectionListener]struct{}
+	mu        sync.Mutex
+}
+
+func NewConnectionDispatcher() *ConnectionDispatcher {
+	return &ConnectionDispatcher{
+		listeners: make(map[*ConnectionListener]struct{}),
+	}
+}
+
+func (e *ConnectionDispatcher) AddListener(listener *ConnectionListener) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.listeners[listener] = struct{}{}
+}
+
+func (e *ConnectionDispatcher) RemoveListener(listener *ConnectionListener) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+
+	delete(e.listeners, listener)
+}
+
+func (e *ConnectionDispatcher) NotifyConnected(peerConnID id.ConnID) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for listener := range e.listeners {
+		listener.OnConnected(peerConnID)
+	}
+}
+
+func (e *ConnectionDispatcher) NotifyDisconnected(peerConnID id.ConnID) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	for listener := range e.listeners {
+		listener.OnDisconnected(peerConnID)
+	}
+}

client/internal/peer/event.go

@@ -1,83 +0,0 @@
-package peer
-
-import (
-	"context"
-	"time"
-
-	"github.com/pion/ice/v4"
-
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/netbirdio/netbird/client/internal/peer/worker"
-	"github.com/netbirdio/netbird/route"
-)
-
-// event is a message processed by the Conn event loop. All mutable Conn state
-// is owned by that loop; producers deliver events through the mailbox and
-// never mutate Conn state directly.
-type event any
-
-// staleableEvent is implemented by events tied to the lifetime of a transport
-// component (WG watcher, ICE agent, relay connection). Each such component runs
-// under its own context, cancelled when the component is superseded; an event
-// carrying a cancelled context is dropped at dispatch time. A cancel performed
-// by an earlier event in the same drained batch already suppresses it.
-type staleableEvent interface {
-	isStale() bool
-}
-
-// evClose asks the event loop to tear down the connection. done is closed
-// once the teardown finished.
-type evClose struct {
-	signalToRemote bool
-	done           chan struct{}
-}
-
-type evRemoteOffer struct {
-	offer signaling.OfferAnswer
-}
-
-type evRemoteAnswer struct {
-	answer signaling.OfferAnswer
-}
-
-type evRemoteCandidate struct {
-	candidate ice.Candidate
-	haRoutes  route.HAMap
-}
-
-type evICEReady struct {
-	priority worker.ConnPriority
-	info     worker.ICEConnInfo
-}
-
-type evICEDown struct {
-	sessionChanged bool
-}
-
-type evRelayReady struct {
-	info worker.RelayConnInfo
-}
-
-type evRelayDown struct{}
-
-// evRelayDialDone reports that the relay dial helper goroutine finished,
-// successfully or not, so the loop may dispatch a pending offer.
-type evRelayDialDone struct{}
-
-type evWGTimeout struct {
-	ctx context.Context
-}
-
-func (e evWGTimeout) isStale() bool { return e.ctx.Err() != nil }
-
-// evWGHandshake reports the first WireGuard handshake of the current watcher run.
-type evWGHandshake struct {
-	when time.Time
-}
-
-// evWGCheckOK reports a watcher check that observed a fresh handshake,
-// including handshakes of connections that were already up.
-type evWGCheckOK struct{}
-
-// evGuardTick asks the loop to send a new offer to restore connectivity.
-type evGuardTick struct{}

client/internal/peer/guard/ice_monitor.go

@@ -21,6 +21,8 @@ const (
 )
 
 type ICEMonitor struct {
+	ReconnectCh chan struct{}
+
 	iFaceDiscover stdnet.ExternalIFaceDiscover
 	iceConfig     icemaker.Config
 	tickerPeriod  time.Duration
@@ -32,6 +34,7 @@ type ICEMonitor struct {
 func NewICEMonitor(iFaceDiscover stdnet.ExternalIFaceDiscover, config icemaker.Config, period time.Duration) *ICEMonitor {
 	log.Debugf("prepare ICE monitor with period: %s", period)
 	cm := &ICEMonitor{
+		ReconnectCh:   make(chan struct{}, 1),
 		iFaceDiscover: iFaceDiscover,
 		iceConfig:     config,
 		tickerPeriod:  period,

client/internal/peer/handshaker.go

@@ -0,0 +1,246 @@
+package peer
+
+import (
+	"context"
+	"errors"
+	"net/netip"
+	"sync"
+	"sync/atomic"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/version"
+)
+
+var (
+	ErrSignalIsNotReady = errors.New("signal is not ready")
+)
+
+// IceCredentials ICE protocol credentials struct
+type IceCredentials struct {
+	UFrag string
+	Pwd   string
+}
+
+// OfferAnswer represents a session establishment offer or answer
+type OfferAnswer struct {
+	IceCredentials IceCredentials
+	// WgListenPort is a remote WireGuard listen port.
+	// This field is used when establishing a direct WireGuard connection without any proxy.
+	// We can set the remote peer's endpoint with this port.
+	WgListenPort int
+
+	// Version of NetBird Agent
+	Version string
+	// RosenpassPubKey is the Rosenpass public key of the remote peer when receiving this message
+	// This value is the local Rosenpass server public key when sending the message
+	RosenpassPubKey []byte
+	// RosenpassAddr is the Rosenpass server address (IP:port) of the remote peer when receiving this message
+	// This value is the local Rosenpass server address when sending the message
+	RosenpassAddr string
+
+	// relay server address
+	RelaySrvAddress string
+	// RelaySrvIP is the IP the remote peer is connected to on its
+	// relay server. Used as a dial target if DNS for RelaySrvAddress
+	// fails. Zero value if the peer did not advertise an IP.
+	RelaySrvIP netip.Addr
+	// SessionID is the unique identifier of the session, used to discard old messages
+	SessionID *ICESessionID
+}
+
+func (o *OfferAnswer) hasICECredentials() bool {
+	return o.IceCredentials.UFrag != "" && o.IceCredentials.Pwd != ""
+}
+
+type Handshaker struct {
+	mu            sync.Mutex
+	log           *log.Entry
+	config        ConnConfig
+	signaler      *Signaler
+	ice           *WorkerICE
+	relay         *WorkerRelay
+	metricsStages *MetricsStages
+	// relayListener is not blocking because the listener is using a goroutine to process the messages
+	// and it will only keep the latest message if multiple offers are received in a short time
+	// this is to avoid blocking the handshaker if the listener is doing some heavy processing
+	// and also to avoid processing old offers if multiple offers are received in a short time
+	// the listener will always process the latest offer
+	relayListener *AsyncOfferListener
+	iceListener   func(remoteOfferAnswer *OfferAnswer)
+
+	// remoteICESupported tracks whether the remote peer includes ICE credentials in its offers/answers.
+	// When false, the local side skips ICE listener dispatch and suppresses ICE credentials in responses.
+	remoteICESupported atomic.Bool
+
+	// remoteOffersCh is a channel used to wait for remote credentials to proceed with the connection
+	remoteOffersCh chan OfferAnswer
+	// remoteAnswerCh is a channel used to wait for remote credentials answer (confirmation of our offer) to proceed with the connection
+	remoteAnswerCh chan OfferAnswer
+}
+
+func NewHandshaker(log *log.Entry, config ConnConfig, signaler *Signaler, ice *WorkerICE, relay *WorkerRelay, metricsStages *MetricsStages) *Handshaker {
+	h := &Handshaker{
+		log:            log,
+		config:         config,
+		signaler:       signaler,
+		ice:            ice,
+		relay:          relay,
+		metricsStages:  metricsStages,
+		remoteOffersCh: make(chan OfferAnswer),
+		remoteAnswerCh: make(chan OfferAnswer),
+	}
+	// assume remote supports ICE until we learn otherwise from received offers
+	h.remoteICESupported.Store(ice != nil)
+	return h
+}
+
+func (h *Handshaker) RemoteICESupported() bool {
+	return h.remoteICESupported.Load()
+}
+
+func (h *Handshaker) AddRelayListener(offer func(remoteOfferAnswer *OfferAnswer)) {
+	h.relayListener = NewAsyncOfferListener(offer)
+}
+
+func (h *Handshaker) AddICEListener(offer func(remoteOfferAnswer *OfferAnswer)) {
+	h.iceListener = offer
+}
+
+func (h *Handshaker) Listen(ctx context.Context) {
+	for {
+		select {
+		case remoteOfferAnswer := <-h.remoteOffersCh:
+			h.log.Infof("received offer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+
+			// Record signaling received for reconnection attempts
+			if h.metricsStages != nil {
+				h.metricsStages.RecordSignalingReceived()
+			}
+
+			h.updateRemoteICEState(&remoteOfferAnswer)
+
+			if h.relayListener != nil {
+				h.relayListener.Notify(&remoteOfferAnswer)
+			}
+
+			if h.iceListener != nil && h.RemoteICESupported() {
+				h.iceListener(&remoteOfferAnswer)
+			}
+
+			if err := h.sendAnswer(); err != nil {
+				h.log.Errorf("failed to send remote offer confirmation: %s", err)
+				continue
+			}
+		case remoteOfferAnswer := <-h.remoteAnswerCh:
+			h.log.Infof("received answer, running version %s, remote WireGuard listen port %d, session id: %s, remote ICE supported: %t", remoteOfferAnswer.Version, remoteOfferAnswer.WgListenPort, remoteOfferAnswer.SessionIDString(), remoteOfferAnswer.hasICECredentials())
+
+			// Record signaling received for reconnection attempts
+			if h.metricsStages != nil {
+				h.metricsStages.RecordSignalingReceived()
+			}
+
+			h.updateRemoteICEState(&remoteOfferAnswer)
+
+			if h.relayListener != nil {
+				h.relayListener.Notify(&remoteOfferAnswer)
+			}
+
+			if h.iceListener != nil && h.RemoteICESupported() {
+				h.iceListener(&remoteOfferAnswer)
+			}
+		case <-ctx.Done():
+			h.log.Infof("stop listening for remote offers and answers")
+			return
+		}
+	}
+}
+
+func (h *Handshaker) SendOffer() error {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return h.sendOffer()
+}
+
+// OnRemoteOffer handles an offer from the remote peer and returns true if the message was accepted, false otherwise
+// doesn't block, discards the message if connection wasn't ready
+func (h *Handshaker) OnRemoteOffer(offer OfferAnswer) {
+	select {
+	case h.remoteOffersCh <- offer:
+		return
+	default:
+		h.log.Warnf("skipping remote offer message because receiver not ready")
+		// connection might not be ready yet to receive so we ignore the message
+		return
+	}
+}
+
+// OnRemoteAnswer handles an offer from the remote peer and returns true if the message was accepted, false otherwise
+// doesn't block, discards the message if connection wasn't ready
+func (h *Handshaker) OnRemoteAnswer(answer OfferAnswer) {
+	select {
+	case h.remoteAnswerCh <- answer:
+		return
+	default:
+		// connection might not be ready yet to receive so we ignore the message
+		h.log.Warnf("skipping remote answer message because receiver not ready")
+		return
+	}
+}
+
+// sendOffer prepares local user credentials and signals them to the remote peer
+func (h *Handshaker) sendOffer() error {
+	if !h.signaler.Ready() {
+		return ErrSignalIsNotReady
+	}
+
+	offer := h.buildOfferAnswer()
+	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
+
+	return h.signaler.SignalOffer(offer, h.config.Key)
+}
+
+func (h *Handshaker) sendAnswer() error {
+	answer := h.buildOfferAnswer()
+	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
+
+	return h.signaler.SignalAnswer(answer, h.config.Key)
+}
+
+func (h *Handshaker) buildOfferAnswer() OfferAnswer {
+	answer := OfferAnswer{
+		WgListenPort:    h.config.LocalWgPort,
+		Version:         version.NetbirdVersion(),
+		RosenpassPubKey: h.config.RosenpassConfig.PubKey,
+		RosenpassAddr:   h.config.RosenpassConfig.Addr,
+	}
+
+	if h.ice != nil && h.RemoteICESupported() {
+		uFrag, pwd := h.ice.GetLocalUserCredentials()
+		sid := h.ice.SessionID()
+		answer.IceCredentials = IceCredentials{uFrag, pwd}
+		answer.SessionID = &sid
+	}
+
+	if addr, ip, err := h.relay.RelayInstanceAddress(); err == nil {
+		answer.RelaySrvAddress = addr
+		answer.RelaySrvIP = ip
+	}
+
+	return answer
+}
+
+func (h *Handshaker) updateRemoteICEState(offer *OfferAnswer) {
+	hasICE := offer.hasICECredentials()
+	prev := h.remoteICESupported.Swap(hasICE)
+	if prev != hasICE {
+		if hasICE {
+			h.log.Infof("remote peer started sending ICE credentials")
+		} else {
+			h.log.Infof("remote peer stopped sending ICE credentials")
+			if h.ice != nil {
+				h.ice.Close()
+			}
+		}
+	}
+}

client/internal/peer/handshaker_listener.go

@@ -0,0 +1,62 @@
+package peer
+
+import (
+	"sync"
+)
+
+type callbackFunc func(remoteOfferAnswer *OfferAnswer)
+
+func (oa *OfferAnswer) SessionIDString() string {
+	if oa.SessionID == nil {
+		return "unknown"
+	}
+	return oa.SessionID.String()
+}
+
+type AsyncOfferListener struct {
+	fn      callbackFunc
+	running bool
+	latest  *OfferAnswer
+	mu      sync.Mutex
+}
+
+func NewAsyncOfferListener(fn callbackFunc) *AsyncOfferListener {
+	return &AsyncOfferListener{
+		fn: fn,
+	}
+}
+
+func (o *AsyncOfferListener) Notify(remoteOfferAnswer *OfferAnswer) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+
+	// Store the latest offer
+	o.latest = remoteOfferAnswer
+
+	// If already running, the running goroutine will pick up this latest value
+	if o.running {
+		return
+	}
+
+	// Start processing
+	o.running = true
+
+	// Process in a goroutine to avoid blocking the caller
+	go func(remoteOfferAnswer *OfferAnswer) {
+		for {
+			o.fn(remoteOfferAnswer)
+
+			o.mu.Lock()
+			if o.latest == nil {
+				// No more work to do
+				o.running = false
+				o.mu.Unlock()
+				return
+			}
+			remoteOfferAnswer = o.latest
+			// Clear the latest to mark it as being processed
+			o.latest = nil
+			o.mu.Unlock()
+		}
+	}(remoteOfferAnswer)
+}

client/internal/peer/handshaker_listener_test.go

@@ -0,0 +1,39 @@
+package peer
+
+import (
+	"testing"
+	"time"
+)
+
+func Test_newOfferListener(t *testing.T) {
+	dummyOfferAnswer := &OfferAnswer{}
+	runChan := make(chan struct{}, 10)
+
+	longRunningFn := func(remoteOfferAnswer *OfferAnswer) {
+		time.Sleep(1 * time.Second)
+		runChan <- struct{}{}
+	}
+
+	hl := NewAsyncOfferListener(longRunningFn)
+
+	hl.Notify(dummyOfferAnswer)
+	hl.Notify(dummyOfferAnswer)
+	hl.Notify(dummyOfferAnswer)
+
+	// Wait for exactly 2 callbacks
+	for i := 0; i < 2; i++ {
+		select {
+		case <-runChan:
+		case <-time.After(3 * time.Second):
+			t.Fatal("Timeout waiting for callback")
+		}
+	}
+
+	// Verify no additional callbacks happen
+	select {
+	case <-runChan:
+		t.Fatal("Unexpected additional callback")
+	case <-time.After(100 * time.Millisecond):
+		t.Log("Correctly received exactly 2 callbacks")
+	}
+}

client/internal/peer/iface.go

@@ -0,0 +1,22 @@
+package peer
+
+import (
+	"net"
+	"net/netip"
+	"time"
+
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/iface/configurer"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgproxy"
+)
+
+type WGIface interface {
+	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
+	RemovePeer(peerKey string) error
+	GetStats() (map[string]configurer.WGStats, error)
+	GetProxy() wgproxy.Proxy
+	Address() wgaddr.Address
+	RemoveEndpointAddress(key string) error
+}

client/internal/peer/listener.go

@@ -0,0 +1,11 @@
+package peer
+
+// Listener is a callback type about the NetBird network connection state
+type Listener interface {
+	OnConnected()
+	OnDisconnected()
+	OnConnecting()
+	OnDisconnecting()
+	OnAddressChanged(string, string)
+	OnPeersListChanged(int)
+}

client/internal/peer/mailbox.go

@@ -1,116 +0,0 @@
-package peer
-
-import (
-	"sync"
-)
-
-// maxQueuedCandidates bounds the remote candidate queue; on overflow the
-// oldest candidate is dropped. Lost candidates are recovered by the next
-// offer exchange triggered by the guard.
-const maxQueuedCandidates = 128
-
-// mailbox is the coalescing inbox of the Conn event loop. Posting never
-// blocks. Per message kind either the latest value wins (offer, answer,
-// guard tick), the values queue in bounded FIFO order (candidates) or in
-// unbounded FIFO order (lifecycle and transport state changes, which are
-// low-volume and must not be lost). A new offer flushes the queued
-// candidates because they belong to the superseded session.
-type mailbox struct {
-	mu     sync.Mutex
-	closed bool
-
-	lifecycle  []event
-	transport  []event
-	offer      *evRemoteOffer
-	answer     *evRemoteAnswer
-	candidates []evRemoteCandidate
-	guardTick  bool
-
-	wake chan struct{}
-}
-
-func newMailbox() *mailbox {
-	return &mailbox{
-		wake: make(chan struct{}, 1),
-	}
-}
-
-// post stores the event and wakes the loop. It reports false if the mailbox
-// is already closed and the event was not accepted.
-func (m *mailbox) post(ev event) bool {
-	m.mu.Lock()
-	if m.closed {
-		m.mu.Unlock()
-		return false
-	}
-
-	switch e := ev.(type) {
-	case evClose:
-		m.lifecycle = append(m.lifecycle, e)
-	case evRemoteOffer:
-		m.offer = &e
-		m.candidates = nil
-	case evRemoteAnswer:
-		m.answer = &e
-	case evRemoteCandidate:
-		if len(m.candidates) >= maxQueuedCandidates {
-			m.candidates = m.candidates[1:]
-		}
-		m.candidates = append(m.candidates, e)
-	case evGuardTick:
-		m.guardTick = true
-	default:
-		m.transport = append(m.transport, ev)
-	}
-	m.mu.Unlock()
-
-	select {
-	case m.wake <- struct{}{}:
-	default:
-	}
-	return true
-}
-
-// drain returns the pending events in processing order: lifecycle first,
-// then transport state changes, the coalesced offer and answer, the queued
-// candidates and finally the guard tick.
-func (m *mailbox) drain() []event {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	return m.drainLocked()
-}
-
-// closeAndDrain marks the mailbox closed so further posts are rejected and
-// returns the events that were still pending.
-func (m *mailbox) closeAndDrain() []event {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	m.closed = true
-	return m.drainLocked()
-}
-
-func (m *mailbox) drainLocked() []event {
-	evs := make([]event, 0, len(m.lifecycle)+len(m.transport)+len(m.candidates)+3)
-	evs = append(evs, m.lifecycle...)
-	evs = append(evs, m.transport...)
-	if m.offer != nil {
-		evs = append(evs, *m.offer)
-	}
-	if m.answer != nil {
-		evs = append(evs, *m.answer)
-	}
-	for _, c := range m.candidates {
-		evs = append(evs, c)
-	}
-	if m.guardTick {
-		evs = append(evs, evGuardTick{})
-	}
-
-	m.lifecycle = nil
-	m.transport = nil
-	m.offer = nil
-	m.answer = nil
-	m.candidates = nil
-	m.guardTick = false
-	return evs
-}

client/internal/peer/mailbox_test.go

@@ -1,128 +0,0 @@
-package peer
-
-import (
-	"testing"
-
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestMailbox_OfferCoalescing(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{WgListenPort: 1}}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{WgListenPort: 2}}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{WgListenPort: 3}}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 1, "consecutive offers must coalesce to a single event")
-	offer, ok := evs[0].(evRemoteOffer)
-	require.True(t, ok, "coalesced event must be an offer")
-	assert.Equal(t, 3, offer.offer.WgListenPort, "the newest offer must win")
-}
-
-func TestMailbox_OfferFlushesCandidates(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRemoteCandidate{}))
-	require.True(t, mb.post(evRemoteCandidate{}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{}}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 1, "candidates of the superseded session must be flushed")
-	_, ok := evs[0].(evRemoteOffer)
-	assert.True(t, ok, "only the offer must remain after the flush")
-}
-
-func TestMailbox_CandidatesKeepOrderAfterOffer(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{}}))
-	require.True(t, mb.post(evRemoteCandidate{haRoutes: nil}))
-	require.True(t, mb.post(evRemoteCandidate{haRoutes: nil}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 3)
-	_, ok := evs[0].(evRemoteOffer)
-	assert.True(t, ok, "offer must be processed before the candidates")
-	for _, ev := range evs[1:] {
-		_, ok := ev.(evRemoteCandidate)
-		assert.True(t, ok, "candidates posted after the offer must survive")
-	}
-}
-
-func TestMailbox_CandidateQueueBounded(t *testing.T) {
-	mb := newMailbox()
-
-	for i := 0; i < maxQueuedCandidates+10; i++ {
-		require.True(t, mb.post(evRemoteCandidate{}))
-	}
-
-	evs := mb.drain()
-	assert.Len(t, evs, maxQueuedCandidates, "candidate queue must stay bounded")
-}
-
-func TestMailbox_DrainOrder(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evGuardTick{}))
-	require.True(t, mb.post(evRemoteAnswer{answer: signaling.OfferAnswer{}}))
-	require.True(t, mb.post(evRemoteOffer{offer: signaling.OfferAnswer{}}))
-	require.True(t, mb.post(evRelayDown{}))
-	require.True(t, mb.post(evICEDown{sessionChanged: true}))
-	require.True(t, mb.post(evClose{}))
-
-	evs := mb.drain()
-	require.Len(t, evs, 6)
-
-	_, ok := evs[0].(evClose)
-	assert.True(t, ok, "lifecycle events must come first")
-	_, ok = evs[1].(evRelayDown)
-	assert.True(t, ok, "transport events must keep FIFO order")
-	_, ok = evs[2].(evICEDown)
-	assert.True(t, ok, "transport events must keep FIFO order")
-	_, ok = evs[3].(evRemoteOffer)
-	assert.True(t, ok, "offer must come after transport events")
-	_, ok = evs[4].(evRemoteAnswer)
-	assert.True(t, ok, "answer must come after the offer")
-	_, ok = evs[5].(evGuardTick)
-	assert.True(t, ok, "guard tick must come last")
-}
-
-func TestMailbox_GuardTickCoalesced(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evGuardTick{}))
-	require.True(t, mb.post(evGuardTick{}))
-	require.True(t, mb.post(evGuardTick{}))
-
-	evs := mb.drain()
-	assert.Len(t, evs, 1, "guard ticks must coalesce to a single event")
-}
-
-func TestMailbox_PostAfterCloseRejected(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRelayDown{}))
-	leftovers := mb.closeAndDrain()
-	assert.Len(t, leftovers, 1, "pending events must be returned on close")
-
-	assert.False(t, mb.post(evRelayDown{}), "posts must be rejected after close")
-	assert.Empty(t, mb.drain(), "no events must remain after close")
-}
-
-func TestMailbox_WakeSignal(t *testing.T) {
-	mb := newMailbox()
-
-	require.True(t, mb.post(evRelayDown{}))
-	require.True(t, mb.post(evGuardTick{}))
-
-	select {
-	case <-mb.wake:
-	default:
-		t.Fatal("wake signal must be pending after posts")
-	}
-
-	assert.Len(t, mb.drain(), 2, "a single wake must deliver all pending events")
-}

client/internal/peer/metrics_saver.go

@@ -1,4 +1,4 @@
-package metricsstages
+package peer
 
 import (
 	"sync"

client/internal/peer/metrics_saver_test.go

@@ -1,4 +1,4 @@
-package metricsstages
+package peer
 
 import (
 	"testing"

client/internal/peer/notifier.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"sync"
@@ -11,16 +11,6 @@ const (
 	stateDisconnecting
 )
 
-// Listener is a callback type about the NetBird network connection state
-type Listener interface {
-	OnConnected()
-	OnDisconnected()
-	OnConnecting()
-	OnDisconnecting()
-	OnAddressChanged(string, string)
-	OnPeersListChanged(int)
-}
-
 type notifier struct {
 	serverStateLock    sync.Mutex
 	listenersLock      sync.Mutex

client/internal/peer/notifier_test.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"sync"

client/internal/peer/route.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"net/netip"

client/internal/peer/session_id.go

@@ -1,4 +1,4 @@
-package ice
+package peer
 
 import (
 	"crypto/rand"
@@ -9,26 +9,26 @@ import (
 
 const sessionIDSize = 5
 
-type SessionID string
+type ICESessionID string
 
-// NewSessionID generates a new session ID for distinguishing sessions
-func NewSessionID() (SessionID, error) {
+// NewICESessionID generates a new session ID for distinguishing sessions
+func NewICESessionID() (ICESessionID, error) {
 	b := make([]byte, sessionIDSize)
 	if _, err := io.ReadFull(rand.Reader, b); err != nil {
 		return "", fmt.Errorf("failed to generate session ID: %w", err)
 	}
-	return SessionID(hex.EncodeToString(b)), nil
+	return ICESessionID(hex.EncodeToString(b)), nil
 }
 
-func SessionIDFromBytes(b []byte) (SessionID, error) {
+func ICESessionIDFromBytes(b []byte) (ICESessionID, error) {
 	if len(b) != sessionIDSize {
 		return "", fmt.Errorf("invalid session ID length: %d", len(b))
 	}
-	return SessionID(hex.EncodeToString(b)), nil
+	return ICESessionID(hex.EncodeToString(b)), nil
 }
 
 // Bytes returns the raw bytes of the session ID for protobuf serialization
-func (id SessionID) Bytes() ([]byte, error) {
+func (id ICESessionID) Bytes() ([]byte, error) {
 	if len(id) == 0 {
 		return nil, fmt.Errorf("ICE session ID is empty")
 	}
@@ -42,6 +42,6 @@ func (id SessionID) Bytes() ([]byte, error) {
 	return b, nil
 }
 
-func (id SessionID) String() string {
+func (id ICESessionID) String() string {
 	return string(id)
 }

client/internal/peer/signaler.go

@@ -1,4 +1,4 @@
-package signaling
+package peer
 
 import (
 	"github.com/pion/ice/v4"

client/internal/peer/signaling/handshaker.go

@@ -1,189 +0,0 @@
-package signaling
-
-import (
-	"errors"
-	"net/netip"
-	"sync"
-	"sync/atomic"
-
-	log "github.com/sirupsen/logrus"
-
-	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
-	relayClient "github.com/netbirdio/netbird/shared/relay/client"
-	"github.com/netbirdio/netbird/version"
-)
-
-var (
-	ErrSignalIsNotReady = errors.New("signal is not ready")
-)
-
-// IceCredentials ICE protocol credentials struct
-type IceCredentials struct {
-	UFrag string
-	Pwd   string
-}
-
-// OfferAnswer represents a session establishment offer or answer
-type OfferAnswer struct {
-	IceCredentials IceCredentials
-	// WgListenPort is a remote WireGuard listen port.
-	// This field is used when establishing a direct WireGuard connection without any proxy.
-	// We can set the remote peer's endpoint with this port.
-	WgListenPort int
-
-	// Version of NetBird Agent
-	Version string
-	// RosenpassPubKey is the Rosenpass public key of the remote peer when receiving this message
-	// This value is the local Rosenpass server public key when sending the message
-	RosenpassPubKey []byte
-	// RosenpassAddr is the Rosenpass server address (IP:port) of the remote peer when receiving this message
-	// This value is the local Rosenpass server address when sending the message
-	RosenpassAddr string
-
-	// relay server address
-	RelaySrvAddress string
-	// RelaySrvIP is the IP the remote peer is connected to on its
-	// relay server. Used as a dial target if DNS for RelaySrvAddress
-	// fails. Zero value if the peer did not advertise an IP.
-	RelaySrvIP netip.Addr
-	// SessionID is the unique identifier of the session, used to discard old messages
-	SessionID *icemaker.SessionID
-}
-
-func (o *OfferAnswer) HasICECredentials() bool {
-	return o.IceCredentials.UFrag != "" && o.IceCredentials.Pwd != ""
-}
-
-func (o *OfferAnswer) SessionIDString() string {
-	if o.SessionID == nil {
-		return "unknown"
-	}
-	return o.SessionID.String()
-}
-
-// Config carries the peer-specific values the Handshaker embeds into offers
-// and answers.
-type Config struct {
-	Key             string
-	LocalWgPort     int
-	RosenpassPubKey []byte
-	RosenpassAddr   string
-}
-
-// Credentials are the local ICE credentials and session id the Handshaker embeds in offers.
-type Credentials struct {
-	UFrag     string
-	Pwd       string
-	SessionID icemaker.SessionID
-}
-
-// ICEWorker is the subset of the ICE worker the Handshaker needs to build offers.
-type ICEWorker interface {
-	Credentials() Credentials
-	Close()
-}
-
-// Handshaker keeps the signaling protocol logic: building and sending offers
-// and answers and tracking whether the remote peer supports ICE. Incoming
-// message processing is driven by the Conn event loop.
-type Handshaker struct {
-	mu           sync.Mutex
-	log          *log.Entry
-	config       Config
-	signaler     *Signaler
-	ice          ICEWorker
-	relayManager *relayClient.Manager
-
-	// remoteICESupported tracks whether the remote peer includes ICE credentials in its offers/answers.
-	// When false, the local side skips ICE dispatch and suppresses ICE credentials in responses.
-	remoteICESupported atomic.Bool
-}
-
-func NewHandshaker(log *log.Entry, config Config, signaler *Signaler, ice ICEWorker, relayManager *relayClient.Manager) *Handshaker {
-	h := &Handshaker{
-		log:          log,
-		config:       config,
-		signaler:     signaler,
-		ice:          ice,
-		relayManager: relayManager,
-	}
-	// assume remote supports ICE until we learn otherwise from received offers
-	h.remoteICESupported.Store(ice != nil)
-	return h
-}
-
-func (h *Handshaker) RemoteICESupported() bool {
-	return h.remoteICESupported.Load()
-}
-
-func (h *Handshaker) SendOffer() error {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	return h.sendOffer()
-}
-
-func (h *Handshaker) SendAnswer() error {
-	h.mu.Lock()
-	defer h.mu.Unlock()
-	return h.sendAnswer()
-}
-
-// sendOffer prepares local user credentials and signals them to the remote peer
-func (h *Handshaker) sendOffer() error {
-	if !h.signaler.Ready() {
-		return ErrSignalIsNotReady
-	}
-
-	offer := h.buildOfferAnswer()
-	h.log.Debugf("sending offer with serial: %s", offer.SessionIDString())
-
-	return h.signaler.SignalOffer(offer, h.config.Key)
-}
-
-func (h *Handshaker) sendAnswer() error {
-	answer := h.buildOfferAnswer()
-	h.log.Debugf("sending answer with serial: %s", answer.SessionIDString())
-
-	return h.signaler.SignalAnswer(answer, h.config.Key)
-}
-
-func (h *Handshaker) buildOfferAnswer() OfferAnswer {
-	answer := OfferAnswer{
-		WgListenPort:    h.config.LocalWgPort,
-		Version:         version.NetbirdVersion(),
-		RosenpassPubKey: h.config.RosenpassPubKey,
-		RosenpassAddr:   h.config.RosenpassAddr,
-	}
-
-	if h.ice != nil && h.RemoteICESupported() {
-		creds := h.ice.Credentials()
-		answer.IceCredentials = IceCredentials{creds.UFrag, creds.Pwd}
-		sid := creds.SessionID
-		answer.SessionID = &sid
-	}
-
-	if addr, ip, err := h.relayManager.RelayInstanceAddress(); err == nil {
-		answer.RelaySrvAddress = addr
-		answer.RelaySrvIP = ip
-	}
-
-	return answer
-}
-
-// UpdateRemoteICEState refreshes the remote ICE support flag from a received
-// offer or answer and closes the ICE worker when the remote peer stopped
-// sending ICE credentials. Runs on the Conn event loop.
-func (h *Handshaker) UpdateRemoteICEState(offer *OfferAnswer) {
-	hasICE := offer.HasICECredentials()
-	prev := h.remoteICESupported.Swap(hasICE)
-	if prev != hasICE {
-		if hasICE {
-			h.log.Infof("remote peer started sending ICE credentials")
-		} else {
-			h.log.Infof("remote peer stopped sending ICE credentials")
-			if h.ice != nil {
-				h.ice.Close()
-			}
-		}
-	}
-}

client/internal/peer/state_dump.go

@@ -1,4 +1,4 @@
-package state_dump
+package peer
 
 import (
 	"context"
@@ -6,13 +6,11 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 )
 
-type StateDump struct {
+type stateDump struct {
 	log    *log.Entry
-	status *status.Recorder
+	status *Status
 	key    string
 
 	sentOffer       int
@@ -28,15 +26,15 @@ type StateDump struct {
 	mu sync.Mutex
 }
 
-func NewStateDump(key string, log *log.Entry, statusRecorder *status.Recorder) *StateDump {
-	return &StateDump{
+func newStateDump(key string, log *log.Entry, statusRecorder *Status) *stateDump {
+	return &stateDump{
 		log:    log,
 		status: statusRecorder,
 		key:    key,
 	}
 }
 
-func (s *StateDump) Start(ctx context.Context) {
+func (s *stateDump) Start(ctx context.Context) {
 	ticker := time.NewTicker(10 * time.Minute)
 	defer ticker.Stop()
 
@@ -50,25 +48,25 @@ func (s *StateDump) Start(ctx context.Context) {
 	}
 }
 
-func (s *StateDump) RemoteOffer() {
+func (s *stateDump) RemoteOffer() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.remoteOffer++
 }
 
-func (s *StateDump) RemoteCandidate() {
+func (s *stateDump) RemoteCandidate() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.remoteCandidate++
 }
 
-func (s *StateDump) SendOffer() {
+func (s *stateDump) SendOffer() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.sentOffer++
 }
 
-func (s *StateDump) dumpState() {
+func (s *stateDump) dumpState() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
@@ -82,41 +80,41 @@ func (s *StateDump) dumpState() {
 		status, s.sentOffer, s.remoteOffer, s.remoteAnswer, s.remoteCandidate, s.p2pConnected, s.switchToRelay, s.wgCheckSuccess, s.relayConnected, s.localProxies)
 }
 
-func (s *StateDump) RemoteAnswer() {
+func (s *stateDump) RemoteAnswer() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.remoteAnswer++
 }
 
-func (s *StateDump) P2PConnected() {
+func (s *stateDump) P2PConnected() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.p2pConnected++
 }
 
-func (s *StateDump) SwitchToRelay() {
+func (s *stateDump) SwitchToRelay() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.switchToRelay++
 }
 
-func (s *StateDump) WGcheckSuccess() {
+func (s *stateDump) WGcheckSuccess() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.wgCheckSuccess++
 }
 
-func (s *StateDump) RelayConnected() {
+func (s *stateDump) RelayConnected() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
 	s.relayConnected++
 }
 
-func (s *StateDump) NewLocalProxy() {
+func (s *stateDump) NewLocalProxy() {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 

client/internal/peer/status/conn_status.go

@@ -1,31 +0,0 @@
-package status
-
-import (
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	// StatusIdle indicate the peer is in disconnected state
-	StatusIdle ConnStatus = iota
-	// StatusConnecting indicate the peer is in connecting state
-	StatusConnecting
-	// StatusConnected indicate the peer is in connected state
-	StatusConnected
-)
-
-// ConnStatus describe the status of a peer's connection
-type ConnStatus int32
-
-func (s ConnStatus) String() string {
-	switch s {
-	case StatusConnecting:
-		return "Connecting"
-	case StatusConnected:
-		return "Connected"
-	case StatusIdle:
-		return "Idle"
-	default:
-		log.Errorf("unknown status: %d", s)
-		return "INVALID_PEER_CONNECTION_STATUS"
-	}
-}

client/internal/peer/status/events.go

@@ -1,48 +0,0 @@
-package status
-
-import (
-	"slices"
-	"sync"
-
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-type EventQueue struct {
-	maxSize int
-	events  []*proto.SystemEvent
-	mutex   sync.RWMutex
-}
-
-func NewEventQueue(size int) *EventQueue {
-	return &EventQueue{
-		maxSize: size,
-		events:  make([]*proto.SystemEvent, 0, size),
-	}
-}
-
-func (q *EventQueue) Add(event *proto.SystemEvent) {
-	q.mutex.Lock()
-	defer q.mutex.Unlock()
-
-	q.events = append(q.events, event)
-
-	if len(q.events) > q.maxSize {
-		q.events = q.events[len(q.events)-q.maxSize:]
-	}
-}
-
-func (q *EventQueue) GetAll() []*proto.SystemEvent {
-	q.mutex.RLock()
-	defer q.mutex.RUnlock()
-
-	return slices.Clone(q.events)
-}
-
-type EventSubscription struct {
-	id     string
-	events chan *proto.SystemEvent
-}
-
-func (s *EventSubscription) Events() <-chan *proto.SystemEvent {
-	return s.events
-}

client/internal/peer/status/full_status.go

@@ -1,122 +0,0 @@
-package status
-
-import (
-	"golang.org/x/exp/maps"
-	"google.golang.org/protobuf/types/known/durationpb"
-	"google.golang.org/protobuf/types/known/timestamppb"
-
-	"github.com/netbirdio/netbird/client/internal/relay"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// FullStatus contains the full state held by the Recorder instance
-type FullStatus struct {
-	Peers                 []State
-	ManagementState       ManagementState
-	SignalState           SignalState
-	LocalPeerState        LocalPeerState
-	RosenpassState        RosenpassState
-	Relays                []relay.ProbeResult
-	NSGroupStates         []NSGroupState
-	NumOfForwardingRules  int
-	LazyConnectionEnabled bool
-	Events                []*proto.SystemEvent
-}
-
-// ToProto converts FullStatus to proto.FullStatus.
-func (fs FullStatus) ToProto() *proto.FullStatus {
-	pbFullStatus := proto.FullStatus{
-		ManagementState: &proto.ManagementState{},
-		SignalState:     &proto.SignalState{},
-		LocalPeerState:  &proto.LocalPeerState{},
-		Peers:           []*proto.PeerState{},
-	}
-
-	pbFullStatus.ManagementState.URL = fs.ManagementState.URL
-	pbFullStatus.ManagementState.Connected = fs.ManagementState.Connected
-	if err := fs.ManagementState.Error; err != nil {
-		pbFullStatus.ManagementState.Error = err.Error()
-	}
-
-	pbFullStatus.SignalState.URL = fs.SignalState.URL
-	pbFullStatus.SignalState.Connected = fs.SignalState.Connected
-	if err := fs.SignalState.Error; err != nil {
-		pbFullStatus.SignalState.Error = err.Error()
-	}
-
-	pbFullStatus.LocalPeerState.IP = fs.LocalPeerState.IP
-	pbFullStatus.LocalPeerState.Ipv6 = fs.LocalPeerState.IPv6
-	pbFullStatus.LocalPeerState.PubKey = fs.LocalPeerState.PubKey
-	pbFullStatus.LocalPeerState.KernelInterface = fs.LocalPeerState.KernelInterface
-	pbFullStatus.LocalPeerState.Fqdn = fs.LocalPeerState.FQDN
-	pbFullStatus.LocalPeerState.WgPort = int32(fs.LocalPeerState.WgPort)
-	pbFullStatus.LocalPeerState.RosenpassPermissive = fs.RosenpassState.Permissive
-	pbFullStatus.LocalPeerState.RosenpassEnabled = fs.RosenpassState.Enabled
-	pbFullStatus.NumberOfForwardingRules = int32(fs.NumOfForwardingRules)
-	pbFullStatus.LazyConnectionEnabled = fs.LazyConnectionEnabled
-
-	pbFullStatus.LocalPeerState.Networks = maps.Keys(fs.LocalPeerState.Routes)
-
-	for _, peerState := range fs.Peers {
-		networks := maps.Keys(peerState.GetRoutes())
-
-		pbPeerState := &proto.PeerState{
-			IP:                         peerState.IP,
-			Ipv6:                       peerState.IPv6,
-			PubKey:                     peerState.PubKey,
-			ConnStatus:                 peerState.ConnStatus.String(),
-			ConnStatusUpdate:           timestamppb.New(peerState.ConnStatusUpdate),
-			Relayed:                    peerState.Relayed,
-			LocalIceCandidateType:      peerState.LocalIceCandidateType,
-			RemoteIceCandidateType:     peerState.RemoteIceCandidateType,
-			LocalIceCandidateEndpoint:  peerState.LocalIceCandidateEndpoint,
-			RemoteIceCandidateEndpoint: peerState.RemoteIceCandidateEndpoint,
-			RelayAddress:               peerState.RelayServerAddress,
-			Fqdn:                       peerState.FQDN,
-			LastWireguardHandshake:     timestamppb.New(peerState.LastWireguardHandshake),
-			BytesRx:                    peerState.BytesRx,
-			BytesTx:                    peerState.BytesTx,
-			RosenpassEnabled:           peerState.RosenpassEnabled,
-			Networks:                   networks,
-			Latency:                    durationpb.New(peerState.Latency),
-			SshHostKey:                 peerState.SSHHostKey,
-		}
-		pbFullStatus.Peers = append(pbFullStatus.Peers, pbPeerState)
-	}
-
-	for _, relayState := range fs.Relays {
-		pbRelayState := &proto.RelayState{
-			URI:       relayState.URI,
-			Available: relayState.Err == nil,
-			Transport: relayState.Transport,
-		}
-		if err := relayState.Err; err != nil {
-			pbRelayState.Error = err.Error()
-		}
-		pbFullStatus.Relays = append(pbFullStatus.Relays, pbRelayState)
-	}
-
-	for _, dnsState := range fs.NSGroupStates {
-		var err string
-		if dnsState.Error != nil {
-			err = dnsState.Error.Error()
-		}
-
-		var servers []string
-		for _, server := range dnsState.Servers {
-			servers = append(servers, server.String())
-		}
-
-		pbDnsState := &proto.NSGroupState{
-			Servers: servers,
-			Domains: dnsState.Domains,
-			Enabled: dnsState.Enabled,
-			Error:   err,
-		}
-		pbFullStatus.DnsServers = append(pbFullStatus.DnsServers, pbDnsState)
-	}
-
-	pbFullStatus.Events = fs.Events
-
-	return &pbFullStatus
-}

client/internal/peer/status/peer_state.go

@@ -1,63 +0,0 @@
-package status
-
-import (
-	"sync"
-	"time"
-
-	"golang.org/x/exp/maps"
-)
-
-// State contains the latest state of a peer
-type State struct {
-	Mux                        *sync.RWMutex
-	IP                         string
-	IPv6                       string
-	PubKey                     string
-	FQDN                       string
-	ConnStatus                 ConnStatus
-	ConnStatusUpdate           time.Time
-	Relayed                    bool
-	LocalIceCandidateType      string
-	RemoteIceCandidateType     string
-	LocalIceCandidateEndpoint  string
-	RemoteIceCandidateEndpoint string
-	RelayServerAddress         string
-	LastWireguardHandshake     time.Time
-	BytesTx                    int64
-	BytesRx                    int64
-	Latency                    time.Duration
-	RosenpassEnabled           bool
-	SSHHostKey                 []byte
-	routes                     map[string]struct{}
-}
-
-// AddRoute add a single route to routes map
-func (s *State) AddRoute(network string) {
-	s.Mux.Lock()
-	defer s.Mux.Unlock()
-	if s.routes == nil {
-		s.routes = make(map[string]struct{})
-	}
-	s.routes[network] = struct{}{}
-}
-
-// SetRoutes set state routes
-func (s *State) SetRoutes(routes map[string]struct{}) {
-	s.Mux.Lock()
-	defer s.Mux.Unlock()
-	s.routes = routes
-}
-
-// DeleteRoute removes a route from the network amp
-func (s *State) DeleteRoute(network string) {
-	s.Mux.Lock()
-	defer s.Mux.Unlock()
-	delete(s.routes, network)
-}
-
-// GetRoutes return routes map
-func (s *State) GetRoutes() map[string]struct{} {
-	s.Mux.RLock()
-	defer s.Mux.RUnlock()
-	return maps.Clone(s.routes)
-}

client/internal/peer/status_alias.go

@@ -1,36 +0,0 @@
-package peer
-
-import "github.com/netbirdio/netbird/client/internal/peer/status"
-
-// Transitional aliases re-exporting the peer status recorder from its own
-// package. Callers are being migrated to reference the status package
-// directly; these aliases will be removed once the migration completes.
-type (
-	Status                   = status.Recorder
-	State                    = status.State
-	ConnStatus               = status.ConnStatus
-	FullStatus               = status.FullStatus
-	RouterState              = status.RouterState
-	LocalPeerState           = status.LocalPeerState
-	SignalState              = status.SignalState
-	ManagementState          = status.ManagementState
-	RosenpassState           = status.RosenpassState
-	NSGroupState             = status.NSGroupState
-	ResolvedDomainInfo       = status.ResolvedDomainInfo
-	StatusChangeSubscription = status.StatusChangeSubscription
-	EventQueue               = status.EventQueue
-	EventSubscription        = status.EventSubscription
-	WGIfaceStatus            = status.WGIfaceStatus
-	Listener                 = status.Listener
-	EventListener            = status.EventListener
-)
-
-const (
-	StatusIdle       = status.StatusIdle
-	StatusConnecting = status.StatusConnecting
-	StatusConnected  = status.StatusConnected
-)
-
-var (
-	NewRecorder = status.NewRecorder
-)

client/internal/peer/status_test.go

@@ -1,4 +1,4 @@
-package status
+package peer
 
 import (
 	"context"

client/internal/peer/wg_watcher.go

@@ -1,4 +1,4 @@
-package wg_watcher
+package peer
 
 import (
 	"context"
@@ -8,7 +8,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/internal/peer/state_dump"
 )
 
 const (
@@ -30,7 +29,7 @@ type WGWatcher struct {
 	log           *log.Entry
 	wgIfaceStater WGInterfaceStater
 	peerKey       string
-	stateDump     *state_dump.StateDump
+	stateDump     *stateDump
 
 	// initialHandshake is not thread-safe; never call PrepareInitialHandshake and EnableWgWatcher concurrently.
 	initialHandshake time.Time
@@ -38,7 +37,7 @@ type WGWatcher struct {
 	resetCh chan struct{}
 }
 
-func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey string, stateDump *state_dump.StateDump) *WGWatcher {
+func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey string, stateDump *stateDump) *WGWatcher {
 	return &WGWatcher{
 		log:           log,
 		wgIfaceStater: wgIfaceStater,

client/internal/peer/wg_watcher_test.go

@@ -1,4 +1,4 @@
-package wg_watcher
+package peer
 
 import (
 	"context"
@@ -9,8 +9,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/internal/peer/state_dump"
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 )
 
 type MocWgIface struct {
@@ -58,7 +56,7 @@ func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
 	// platforms with coarse clock resolution (Windows), where two time.Now() calls
 	// microseconds apart can return the same instant and read as a timed-out handshake.
 	stats := &mockHandshakeStats{handshake: time.Now().Add(-time.Hour)}
-	watcher := NewWGWatcher(mlog, stats, "", state_dump.NewStateDump("peer", mlog, &status.Recorder{}))
+	watcher := NewWGWatcher(mlog, stats, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -67,18 +65,14 @@ func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
 
 	firstHandshake := make(chan struct{}, 1)
 	checkSuccess := make(chan struct{}, 1)
-	watcherDone := make(chan struct{})
-	go func() {
-		defer close(watcherDone)
-		watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
-			firstHandshake <- struct{}{}
-		}, func() {
-			select {
-			case checkSuccess <- struct{}{}:
-			default:
-			}
-		})
-	}()
+	go watcher.EnableWgWatcher(ctx, time.Now(), func() {}, func(when time.Time) {
+		firstHandshake <- struct{}{}
+	}, func() {
+		select {
+		case checkSuccess <- struct{}{}:
+		default:
+		}
+	})
 
 	stats.advance()
 
@@ -93,11 +87,6 @@ func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
 		t.Errorf("first-handshake callback must not fire for a non-zero baseline")
 	default:
 	}
-
-	// Wait for the watcher goroutine to exit so it cannot race with other
-	// tests mutating the package-level check timing variables.
-	cancel()
-	<-watcherDone
 }
 
 func TestWGWatcher_EnableWgWatcher(t *testing.T) {
@@ -106,7 +95,7 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 
 	mlog := log.WithField("peer", "tet")
 	mocWgIface := &MocWgIface{}
-	watcher := NewWGWatcher(mlog, mocWgIface, "", state_dump.NewStateDump("peer", mlog, &status.Recorder{}))
+	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -138,7 +127,7 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 
 	mlog := log.WithField("peer", "tet")
 	mocWgIface := &MocWgIface{}
-	watcher := NewWGWatcher(mlog, mocWgIface, "", state_dump.NewStateDump("peer", mlog, &status.Recorder{}))
+	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
 	watcher.PrepareInitialHandshake()

client/internal/peer/worker/state.go

@@ -1,4 +1,4 @@
-package peer
+package worker
 
 import (
 	"sync/atomic"
@@ -7,17 +7,17 @@ import (
 )
 
 const (
-	WorkerStatusDisconnected WorkerStatus = iota
-	WorkerStatusConnected
+	StatusDisconnected Status = iota
+	StatusConnected
 )
 
-type WorkerStatus int32
+type Status int32
 
-func (s WorkerStatus) String() string {
+func (s Status) String() string {
 	switch s {
-	case WorkerStatusDisconnected:
+	case StatusDisconnected:
 		return "Disconnected"
-	case WorkerStatusConnected:
+	case StatusConnected:
 		return "Connected"
 	default:
 		log.Errorf("unknown status: %d", s)
@@ -37,16 +37,16 @@ func NewAtomicStatus() *AtomicWorkerStatus {
 }
 
 // Get returns the current connection status
-func (acs *AtomicWorkerStatus) Get() WorkerStatus {
-	return WorkerStatus(acs.status.Load())
+func (acs *AtomicWorkerStatus) Get() Status {
+	return Status(acs.status.Load())
 }
 
 func (acs *AtomicWorkerStatus) SetConnected() {
-	acs.status.Store(int32(WorkerStatusConnected))
+	acs.status.Store(int32(StatusConnected))
 }
 
 func (acs *AtomicWorkerStatus) SetDisconnected() {
-	acs.status.Store(int32(WorkerStatusDisconnected))
+	acs.status.Store(int32(StatusDisconnected))
 }
 
 // String returns the string representation of the current status

client/internal/peer/worker_ice.go

@@ -1,4 +1,4 @@
-package worker
+package peer
 
 import (
 	"context"
@@ -13,9 +13,8 @@ import (
 
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
+	"github.com/netbirdio/netbird/client/internal/peer/conntype"
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
-	"github.com/netbirdio/netbird/client/internal/peer/status"
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/route"
@@ -33,68 +32,57 @@ type ICEConnInfo struct {
 	RelayedOnLocal             bool
 }
 
-type ICEDependencies struct {
-	Signaler           *signaling.Signaler
-	IFaceDiscover      stdnet.ExternalIFaceDiscover
-	StatusRecorder     *status.Recorder
-	PortForwardManager *portforward.Manager
-}
-
-type ICE struct {
-	log                *log.Entry
-	key                string
-	iceConfig          icemaker.Config
-	isController       bool
-	onConnReady        func(priority ConnPriority, iceConnInfo ICEConnInfo)
-	onStatusDisconnect func(sessionChanged bool)
-	signaler           *signaling.Signaler
-	iFaceDiscover      stdnet.ExternalIFaceDiscover
-	statusRecorder     *status.Recorder
-	portForwardManager *portforward.Manager
-	hasRelayOnLocally  bool
+type WorkerICE struct {
+	ctx               context.Context
+	log               *log.Entry
+	config            ConnConfig
+	conn              *Conn
+	signaler          *Signaler
+	iFaceDiscover     stdnet.ExternalIFaceDiscover
+	statusRecorder    *Status
+	hasRelayOnLocally bool
 
 	agent             *icemaker.ThreadSafeAgent
 	agentDialerCancel context.CancelFunc
 	agentConnecting   bool      // while it is true, drop all incoming offers
 	lastSuccess       time.Time // with this avoid the too frequent ICE agent recreation
-	// connectedAgent is the agent whose connection was last reported ready; guarded by muxAgent
-	connectedAgent *icemaker.ThreadSafeAgent
 	// remoteSessionID represents the peer's session identifier from the latest remote offer.
-	remoteSessionID icemaker.SessionID
+	remoteSessionID ICESessionID
 	// sessionID is used to track the current session ID of the ICE agent
 	// increase by one when disconnecting the agent
 	// with it the remote peer can discard the already deprecated offer/answer
 	// Without it the remote peer may recreate a workable ICE connection
-	sessionID            icemaker.SessionID
+	sessionID            ICESessionID
 	remoteSessionChanged bool
 	muxAgent             sync.Mutex
 
 	localUfrag string
 	localPwd   string
 
+	// we record the last known state of the ICE agent to avoid duplicate on disconnected events
+	lastKnownState ice.ConnectionState
+
 	// portForwardAttempted tracks if we've already tried port forwarding this session
 	portForwardAttempted bool
 }
 
-func NewICE(log *log.Entry, key string, iceConfig icemaker.Config, isController bool, onConnReady func(ConnPriority, ICEConnInfo), onStatusDisconnect func(bool), services ICEDependencies, hasRelayOnLocally bool) (*ICE, error) {
-	sessionID, err := icemaker.NewSessionID()
+func NewWorkerICE(ctx context.Context, log *log.Entry, config ConnConfig, conn *Conn, signaler *Signaler, ifaceDiscover stdnet.ExternalIFaceDiscover, statusRecorder *Status, hasRelayOnLocally bool) (*WorkerICE, error) {
+	sessionID, err := NewICESessionID()
 	if err != nil {
 		return nil, err
 	}
 
-	w := &ICE{
-		log:                log,
-		key:                key,
-		iceConfig:          iceConfig,
-		isController:       isController,
-		onConnReady:        onConnReady,
-		onStatusDisconnect: onStatusDisconnect,
-		signaler:           services.Signaler,
-		iFaceDiscover:      services.IFaceDiscover,
-		statusRecorder:     services.StatusRecorder,
-		portForwardManager: services.PortForwardManager,
-		hasRelayOnLocally:  hasRelayOnLocally,
-		sessionID:          sessionID,
+	w := &WorkerICE{
+		ctx:               ctx,
+		log:               log,
+		config:            config,
+		conn:              conn,
+		signaler:          signaler,
+		iFaceDiscover:     ifaceDiscover,
+		statusRecorder:    statusRecorder,
+		hasRelayOnLocally: hasRelayOnLocally,
+		lastKnownState:    ice.ConnectionStateDisconnected,
+		sessionID:         sessionID,
 	}
 
 	localUfrag, localPwd, err := icemaker.GenerateICECredentials()
@@ -106,7 +94,7 @@ func NewICE(log *log.Entry, key string, iceConfig icemaker.Config, isController
 	return w, nil
 }
 
-func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.OfferAnswer) {
+func (w *WorkerICE) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	w.log.Debugf("OnNewOffer for ICE, serial: %s", remoteOfferAnswer.SessionIDString())
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
@@ -130,7 +118,7 @@ func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.Offer
 			}
 		}
 
-		sessionID, err := icemaker.NewSessionID()
+		sessionID, err := NewICESessionID()
 		if err != nil {
 			w.log.Errorf("failed to create new session ID: %s", err)
 		}
@@ -148,8 +136,8 @@ func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.Offer
 	if remoteOfferAnswer.SessionID != nil {
 		w.log.Debugf("recreate ICE agent: %s / %s", w.sessionID, *remoteOfferAnswer.SessionID)
 	}
-	dialerCtx, dialerCancel := context.WithCancel(ctx)
-	agent, err := w.reCreateAgent(ctx, dialerCancel, preferredCandidateTypes)
+	dialerCtx, dialerCancel := context.WithCancel(w.ctx)
+	agent, err := w.reCreateAgent(dialerCancel, preferredCandidateTypes)
 	if err != nil {
 		w.log.Errorf("failed to recreate ICE Agent: %s", err)
 		return
@@ -163,14 +151,14 @@ func (w *ICE) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.Offer
 		w.remoteSessionID = ""
 	}
 
-	go w.connect(dialerCtx, dialerCancel, agent, remoteOfferAnswer)
+	go w.connect(dialerCtx, agent, remoteOfferAnswer)
 }
 
 // OnRemoteCandidate Handles ICE connection Candidate provided by the remote peer.
-func (w *ICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HAMap) {
+func (w *WorkerICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HAMap) {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
-	w.log.Debugf("OnRemoteCandidate from peer %s -> %s", w.key, candidate.String())
+	w.log.Debugf("OnRemoteCandidate from peer %s -> %s", w.config.Key, candidate.String())
 	if w.agent == nil {
 		w.log.Warnf("ICE Agent is not initialized yet")
 		return
@@ -197,24 +185,18 @@ func (w *ICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HAMap) {
 	}
 }
 
-func (w *ICE) Credentials() signaling.Credentials {
-	w.muxAgent.Lock()
-	defer w.muxAgent.Unlock()
-	return signaling.Credentials{
-		UFrag:     w.localUfrag,
-		Pwd:       w.localPwd,
-		SessionID: w.sessionID,
-	}
+func (w *WorkerICE) GetLocalUserCredentials() (frag string, pwd string) {
+	return w.localUfrag, w.localPwd
 }
 
-func (w *ICE) InProgress() bool {
+func (w *WorkerICE) InProgress() bool {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
 	return w.agentConnecting
 }
 
-func (w *ICE) Close() {
+func (w *WorkerICE) Close() {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
@@ -230,10 +212,10 @@ func (w *ICE) Close() {
 	w.agent = nil
 }
 
-func (w *ICE) reCreateAgent(ctx context.Context, dialerCancel context.CancelFunc, candidates []ice.CandidateType) (*icemaker.ThreadSafeAgent, error) {
+func (w *WorkerICE) reCreateAgent(dialerCancel context.CancelFunc, candidates []ice.CandidateType) (*icemaker.ThreadSafeAgent, error) {
 	w.portForwardAttempted = false
 
-	agent, err := icemaker.NewAgent(ctx, w.iFaceDiscover, w.iceConfig, candidates, w.localUfrag, w.localPwd)
+	agent, err := icemaker.NewAgent(w.ctx, w.iFaceDiscover, w.config.ICEConfig, candidates, w.localUfrag, w.localPwd)
 	if err != nil {
 		return nil, fmt.Errorf("create agent: %w", err)
 	}
@@ -255,7 +237,7 @@ func (w *ICE) reCreateAgent(ctx context.Context, dialerCancel context.CancelFunc
 	return agent, nil
 }
 
-func (w *ICE) getSessionID() icemaker.SessionID {
+func (w *WorkerICE) SessionID() ICESessionID {
 	w.muxAgent.Lock()
 	defer w.muxAgent.Unlock()
 
@@ -265,11 +247,11 @@ func (w *ICE) getSessionID() icemaker.SessionID {
 // will block until connection succeeded
 // but it won't release if ICE Agent went into Disconnected or Failed state,
 // so we have to cancel it with the provided context once agent detected a broken connection
-func (w *ICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *signaling.OfferAnswer) {
+func (w *WorkerICE) connect(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) {
 	w.log.Debugf("gather candidates")
 	if err := agent.GatherCandidates(); err != nil {
 		w.log.Warnf("failed to gather candidates: %s", err)
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 
@@ -277,19 +259,19 @@ func (w *ICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agen
 	remoteConn, err := w.turnAgentDial(ctx, agent, remoteOfferAnswer)
 	if err != nil {
 		w.log.Debugf("failed to dial the remote peer: %s", err)
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 	w.log.Debugf("agent dial succeeded")
 
 	pair, err := agent.GetSelectedCandidatePair()
 	if err != nil {
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 	if pair == nil {
 		w.log.Warnf("selected candidate pair is nil, cannot proceed")
-		w.closeAgent(agent, dialerCancel)
+		w.closeAgent(agent, w.agentDialerCancel)
 		return
 	}
 
@@ -317,22 +299,17 @@ func (w *ICE) connect(ctx context.Context, dialerCancel context.CancelFunc, agen
 	}
 	w.log.Debugf("on ICE conn is ready to use")
 
+	w.log.Infof("connection succeeded with offer session: %s", remoteOfferAnswer.SessionIDString())
 	w.muxAgent.Lock()
-	if w.agent != agent {
-		w.muxAgent.Unlock()
-		w.log.Debugf("agent has been replaced during connect, dropping obsolete connection")
-		return
-	}
 	w.agentConnecting = false
 	w.lastSuccess = time.Now()
-	w.connectedAgent = agent
 	w.muxAgent.Unlock()
 
-	w.log.Infof("connection succeeded with offer session: %s", remoteOfferAnswer.SessionIDString())
-	w.onConnReady(selectedPriority(pair), ci)
+	// todo: the potential problem is a race between the onConnectionStateChange
+	w.conn.onICEConnectionIsReady(selectedPriority(pair), ci)
 }
 
-func (w *ICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelFunc) bool {
+func (w *WorkerICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelFunc) bool {
 	cancel()
 	if err := agent.Close(); err != nil {
 		w.log.Warnf("failed to close ICE agent: %s", err)
@@ -346,7 +323,7 @@ func (w *ICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelF
 
 	if w.agent == agent {
 		// consider to remove from here and move to the OnNewOffer
-		sessionID, err := icemaker.NewSessionID()
+		sessionID, err := NewICESessionID()
 		if err != nil {
 			w.log.Errorf("failed to create new session ID: %s", err)
 		}
@@ -358,7 +335,7 @@ func (w *ICE) closeAgent(agent *icemaker.ThreadSafeAgent, cancel context.CancelF
 	return sessionChanged
 }
 
-func (w *ICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
+func (w *WorkerICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 	// wait local endpoint configuration
 	time.Sleep(time.Second)
 	addr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(pair.Remote.Address(), strconv.Itoa(remoteWgPort)))
@@ -367,7 +344,7 @@ func (w *ICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 		return
 	}
 
-	mux, ok := w.iceConfig.UDPMuxSrflx.(*udpmux.UniversalUDPMuxDefault)
+	mux, ok := w.config.ICEConfig.UDPMuxSrflx.(*udpmux.UniversalUDPMuxDefault)
 	if !ok {
 		w.log.Warn("invalid udp mux conversion")
 		return
@@ -380,7 +357,7 @@ func (w *ICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int) {
 
 // onICECandidate is a callback attached to an ICE Agent to receive new local connection candidates
 // and then signals them to the remote peer
-func (w *ICE) onICECandidate(candidate ice.Candidate) {
+func (w *WorkerICE) onICECandidate(candidate ice.Candidate) {
 	// nil means candidate gathering has been ended
 	if candidate == nil {
 		return
@@ -389,9 +366,9 @@ func (w *ICE) onICECandidate(candidate ice.Candidate) {
 	// TODO: reported port is incorrect for CandidateTypeHost, makes understanding ICE use via logs confusing as port is ignored
 	w.log.Debugf("discovered local candidate %s", candidate.String())
 	go func() {
-		err := w.signaler.SignalICECandidate(candidate, w.key)
+		err := w.signaler.SignalICECandidate(candidate, w.config.Key)
 		if err != nil {
-			w.log.Errorf("failed signaling candidate to the remote peer %s %s", w.key, err)
+			w.log.Errorf("failed signaling candidate to the remote peer %s %s", w.config.Key, err)
 		}
 	}()
 
@@ -401,8 +378,8 @@ func (w *ICE) onICECandidate(candidate ice.Candidate) {
 }
 
 // injectPortForwardedCandidate signals an additional candidate using the pre-created port mapping.
-func (w *ICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
-	pfManager := w.portForwardManager
+func (w *WorkerICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
+	pfManager := w.conn.portForwardManager
 	if pfManager == nil {
 		return
 	}
@@ -430,7 +407,7 @@ func (w *ICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
 		forwardedCandidate.String(), mapping.InternalPort, mapping.ExternalPort, mapping.NATType, forwardedCandidate.Priority())
 
 	go func() {
-		if err := w.signaler.SignalICECandidate(forwardedCandidate, w.key); err != nil {
+		if err := w.signaler.SignalICECandidate(forwardedCandidate, w.config.Key); err != nil {
 			w.log.Errorf("signal port-forwarded candidate: %v", err)
 		}
 	}()
@@ -438,7 +415,7 @@ func (w *ICE) injectPortForwardedCandidate(srflxCandidate ice.Candidate) {
 
 // createForwardedCandidate creates a new server reflexive candidate with the forwarded port.
 // It uses the NAT gateway's external IP with the forwarded port.
-func (w *ICE) createForwardedCandidate(srflxCandidate ice.Candidate, mapping *portforward.Mapping) (ice.Candidate, error) {
+func (w *WorkerICE) createForwardedCandidate(srflxCandidate ice.Candidate, mapping *portforward.Mapping) (ice.Candidate, error) {
 	var externalIP string
 	if mapping.ExternalIP != nil && !mapping.ExternalIP.IsUnspecified() {
 		externalIP = mapping.ExternalIP.String()
@@ -483,9 +460,9 @@ func (w *ICE) createForwardedCandidate(srflxCandidate ice.Candidate, mapping *po
 	return candidate, nil
 }
 
-func (w *ICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2 ice.Candidate) {
+func (w *WorkerICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2 ice.Candidate) {
 	w.log.Debugf("selected candidate pair [local <-> remote] -> [%s <-> %s], peer %s", c1.String(), c2.String(),
-		w.key)
+		w.config.Key)
 
 	pairStat, ok := agent.GetSelectedCandidatePairStats()
 	if !ok {
@@ -494,14 +471,14 @@ func (w *ICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2
 	}
 
 	duration := time.Duration(pairStat.CurrentRoundTripTime * float64(time.Second))
-	if err := w.statusRecorder.UpdateLatency(w.key, duration); err != nil {
+	if err := w.statusRecorder.UpdateLatency(w.config.Key, duration); err != nil {
 		w.log.Debugf("failed to update latency for peer: %s", err)
 		return
 	}
 }
 
-func (w *ICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
-	sessionID := w.getSessionID()
+func (w *WorkerICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
+	sessionID := w.SessionID()
 	stats := agent.GetCandidatePairsStats()
 	localCandidates, _ := agent.GetLocalCandidates()
 	remoteCandidates, _ := agent.GetRemoteCandidates()
@@ -531,44 +508,32 @@ func (w *ICE) logSuccessfulPaths(agent *icemaker.ThreadSafeAgent) {
 	}
 }
 
-func (w *ICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dialerCancel context.CancelFunc) func(ice.ConnectionState) {
-	// per-agent state; pion delivers callbacks of one agent sequentially
-	var connected bool
+func (w *WorkerICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dialerCancel context.CancelFunc) func(ice.ConnectionState) {
 	return func(state ice.ConnectionState) {
 		w.log.Debugf("ICE ConnectionState has changed to %s", state.String())
 		switch state {
 		case ice.ConnectionStateConnected:
-			connected = true
+			w.lastKnownState = ice.ConnectionStateConnected
 			w.logSuccessfulPaths(agent)
+			return
 		case ice.ConnectionStateFailed, ice.ConnectionStateDisconnected, ice.ConnectionStateClosed:
 			// ice.ConnectionStateClosed happens when we recreate the agent. For the P2P to TURN switch important to
 			// notify the conn.onICEStateDisconnected changes to update the current used priority
 
 			sessionChanged := w.closeAgent(agent, dialerCancel)
 
-			if !connected {
-				return
+			if w.lastKnownState == ice.ConnectionStateConnected {
+				w.lastKnownState = ice.ConnectionStateDisconnected
+				w.conn.onICEStateDisconnected(sessionChanged)
 			}
-			connected = false
-
-			w.muxAgent.Lock()
-			stale := w.connectedAgent != agent
-			if !stale {
-				w.connectedAgent = nil
-			}
-			w.muxAgent.Unlock()
-
-			if stale {
-				w.log.Debugf("suppress disconnected event of replaced ICE agent")
-				return
-			}
-			w.onStatusDisconnect(sessionChanged)
+		default:
+			return
 		}
 	}
 }
 
-func (w *ICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *signaling.OfferAnswer) (*ice.Conn, error) {
-	if w.isController {
+func (w *WorkerICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (*ice.Conn, error) {
+	if isController(w.config) {
 		return agent.Dial(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
 	} else {
 		return agent.Accept(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
@@ -630,10 +595,10 @@ func isRelayed(pair *ice.CandidatePair) bool {
 	return false
 }
 
-func selectedPriority(pair *ice.CandidatePair) ConnPriority {
+func selectedPriority(pair *ice.CandidatePair) conntype.ConnPriority {
 	if isRelayed(pair) {
-		return ICETurn
+		return conntype.ICETurn
 	} else {
-		return ICEP2P
+		return conntype.ICEP2P
 	}
 }

client/internal/peer/worker_relay.go

@@ -1,4 +1,4 @@
-package worker
+package peer
 
 import (
 	"context"
@@ -10,23 +10,22 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/internal/peer/signaling"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
 
 type RelayConnInfo struct {
-	RelayedConn     net.Conn
-	RosenpassPubKey []byte
-	RosenpassAddr   string
+	relayedConn     net.Conn
+	rosenpassPubKey []byte
+	rosenpassAddr   string
 }
 
 type WorkerRelay struct {
-	log            *log.Entry
-	key            string
-	isController   bool
-	onConnReady    func(RelayConnInfo)
-	onDisconnected func()
-	relayManager   *relayClient.Manager
+	peerCtx      context.Context
+	log          *log.Entry
+	isController bool
+	config       ConnConfig
+	conn         *Conn
+	relayManager *relayClient.Manager
 
 	relayedConn net.Conn
 	relayLock   sync.Mutex
@@ -34,19 +33,19 @@ type WorkerRelay struct {
 	relaySupportedOnRemotePeer atomic.Bool
 }
 
-func NewWorkerRelay(log *log.Entry, key string, isController bool, onConnReady func(RelayConnInfo), onDisconnected func(), relayManager *relayClient.Manager) *WorkerRelay {
+func NewWorkerRelay(ctx context.Context, log *log.Entry, ctrl bool, config ConnConfig, conn *Conn, relayManager *relayClient.Manager) *WorkerRelay {
 	r := &WorkerRelay{
-		log:            log,
-		key:            key,
-		isController:   isController,
-		onConnReady:    onConnReady,
-		onDisconnected: onDisconnected,
-		relayManager:   relayManager,
+		peerCtx:      ctx,
+		log:          log,
+		isController: ctrl,
+		config:       config,
+		conn:         conn,
+		relayManager: relayManager,
 	}
 	return r
 }
 
-func (w *WorkerRelay) OnNewOffer(ctx context.Context, remoteOfferAnswer *signaling.OfferAnswer) {
+func (w *WorkerRelay) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 	if !w.isRelaySupported(remoteOfferAnswer) {
 		w.log.Infof("Relay is not supported by remote peer")
 		w.relaySupportedOnRemotePeer.Store(false)
@@ -67,7 +66,7 @@ func (w *WorkerRelay) OnNewOffer(ctx context.Context, remoteOfferAnswer *signali
 		serverIP = remoteOfferAnswer.RelaySrvIP
 	}
 
-	relayedConn, err := w.relayManager.OpenConn(ctx, srv, w.key, serverIP)
+	relayedConn, err := w.relayManager.OpenConn(w.peerCtx, srv, w.config.Key, serverIP)
 	if err != nil {
 		if errors.Is(err, relayClient.ErrConnAlreadyExists) {
 			w.log.Debugf("handled offer by reusing existing relay connection")
@@ -89,10 +88,10 @@ func (w *WorkerRelay) OnNewOffer(ctx context.Context, remoteOfferAnswer *signali
 	}
 
 	w.log.Debugf("peer conn opened via Relay: %s", srv)
-	w.onConnReady(RelayConnInfo{
-		RelayedConn:     relayedConn,
-		RosenpassPubKey: remoteOfferAnswer.RosenpassPubKey,
-		RosenpassAddr:   remoteOfferAnswer.RosenpassAddr,
+	go w.conn.onRelayConnectionIsReady(RelayConnInfo{
+		relayedConn:     relayedConn,
+		rosenpassPubKey: remoteOfferAnswer.RosenpassPubKey,
+		rosenpassAddr:   remoteOfferAnswer.RosenpassAddr,
 	})
 }
 
@@ -120,7 +119,7 @@ func (w *WorkerRelay) CloseConn() {
 	}
 }
 
-func (w *WorkerRelay) isRelaySupported(answer *signaling.OfferAnswer) bool {
+func (w *WorkerRelay) isRelaySupported(answer *OfferAnswer) bool {
 	if !w.relayManager.HasRelayAddress() {
 		return false
 	}
@@ -135,5 +134,5 @@ func (w *WorkerRelay) preferredRelayServer(myRelayAddress, remoteRelayAddress st
 }
 
 func (w *WorkerRelay) onRelayClientDisconnected() {
-	w.onDisconnected()
+	go w.conn.onRelayDisconnected()
 }

client/ui/frontend/src/hooks/useKeepConnectedOnQuit.ts

@@ -0,0 +1,35 @@
+import { useCallback, useEffect, useState } from "react";
+import { Preferences } from "@bindings/services";
+
+export const useKeepConnectedOnQuit = () => {
+    const [keepConnected, setKeepConnected] = useState<boolean | null>(null);
+
+    useEffect(() => {
+        let cancelled = false;
+        Preferences.Get()
+            .then((prefs) => {
+                if (cancelled) return;
+                setKeepConnected(prefs?.keepConnectedOnQuit ?? false);
+            })
+            .catch((err: unknown) => {
+                if (cancelled) return;
+                console.warn("[useKeepConnectedOnQuit] load preferences failed", err);
+                setKeepConnected(false);
+            });
+        return () => {
+            cancelled = true;
+        };
+    }, []);
+
+    const setKeepConnectedOnQuit = useCallback(async (keep: boolean) => {
+        setKeepConnected(keep);
+        try {
+            await Preferences.SetKeepConnectedOnQuit(keep);
+        } catch (err: unknown) {
+            setKeepConnected(!keep);
+            console.error("[useKeepConnectedOnQuit] SetKeepConnectedOnQuit failed", err);
+        }
+    }, []);
+
+    return { keepConnected, setKeepConnectedOnQuit };
+};

client/ui/frontend/src/modules/settings/SettingsGeneral.tsx

@@ -11,6 +11,7 @@ import { ManagementServerSwitch } from "@/components/ManagementServerSwitch.tsx"
 import { ManagementMode, useManagementUrl } from "@/hooks/useManagementUrl.ts";
 import { LanguagePicker } from "@/components/LanguagePicker.tsx";
 import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+import { useKeepConnectedOnQuit } from "@/hooks/useKeepConnectedOnQuit.ts";
 
 export function SettingsGeneral() {
     const { t } = useTranslation();
@@ -19,6 +20,7 @@ export function SettingsGeneral() {
     const { mode, setMode, setUrl, displayUrl, showError, canSave, save, checking, unreachable } =
         useManagementUrl();
     const { mdm, features } = useRestrictions();
+    const { keepConnected, setKeepConnectedOnQuit } = useKeepConnectedOnQuit();
 
     const inputRef = useRef<HTMLInputElement>(null);
     const managementUrlId = useId();
@@ -57,6 +59,15 @@ export function SettingsGeneral() {
                         helpText={t("settings.general.autostart.help")}
                     />
                 )}
+                <FancyToggleSwitch
+                    value={keepConnected ?? false}
+                    onChange={(v) => {
+                        void setKeepConnectedOnQuit(v);
+                    }}
+                    loading={keepConnected === null}
+                    label={t("settings.general.keepConnectedOnQuit.label")}
+                    helpText={t("settings.general.keepConnectedOnQuit.help")}
+                />
             </SectionGroup>
 
             {!mdm.managementURL && !features.disableUpdateSettings && (

client/ui/i18n/locales/de/common.json

@@ -551,6 +551,14 @@
     "settings.general.autostart.errorTitle": {
         "message": "Ändern des Autostarts fehlgeschlagen"
     },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Nach dem Beenden verbunden bleiben",
+        "description": "Toggle label: keep the VPN connection up after quitting the UI."
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "Die Verbindung bleibt im Hintergrund bestehen, nachdem Sie NetBird schließen. Sie endet erst, wenn Sie sie selbst trennen.",
+        "description": "Helper text for the stay-connected-after-quitting toggle."
+    },
     "settings.general.language.label": {
         "message": "Anzeigesprache"
     },

client/ui/i18n/locales/en/common.json

@@ -735,6 +735,14 @@
         "message": "Autostart Change Failed",
         "description": "Error-dialog title when changing the autostart setting fails."
     },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Stay Connected After Quitting",
+        "description": "Toggle label: keep the VPN connection up after quitting the UI."
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "The connection stays up in the background after you close NetBird. It only stops when you disconnect it yourself.",
+        "description": "Helper text for the stay-connected-after-quitting toggle."
+    },
     "settings.general.language.label": {
         "message": "Display Language",
         "description": "Label for the display-language picker."

client/ui/i18n/locales/es/common.json

@@ -551,6 +551,14 @@
     "settings.general.autostart.errorTitle": {
         "message": "Error al cambiar el inicio automático"
     },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Permanecer conectado al salir",
+        "description": "Toggle label: keep the VPN connection up after quitting the UI."
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "La conexión sigue activa en segundo plano después de cerrar NetBird. Solo se detiene cuando la desconectas tú.",
+        "description": "Helper text for the stay-connected-after-quitting toggle."
+    },
     "settings.general.language.label": {
         "message": "Idioma de la interfaz"
     },

client/ui/i18n/locales/fr/common.json

@@ -551,6 +551,14 @@
     "settings.general.autostart.errorTitle": {
         "message": "Échec de la modification du démarrage automatique"
     },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Rester connecté après la fermeture",
+        "description": "Toggle label: keep the VPN connection up after quitting the UI."
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "La connexion reste active en arrière-plan après la fermeture de NetBird. Elle ne s'arrête que si vous la coupez vous-même.",
+        "description": "Helper text for the stay-connected-after-quitting toggle."
+    },
     "settings.general.language.label": {
         "message": "Langue d’affichage"
     },

client/ui/i18n/locales/hu/common.json

@@ -551,6 +551,14 @@
     "settings.general.autostart.errorTitle": {
         "message": "Az automatikus indítás módosítása sikertelen"
     },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Kapcsolat megtartása kilépéskor",
+        "description": "Toggle label: keep the VPN connection up after quitting the UI."
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "A kapcsolat a háttérben megmarad, miután bezárod a NetBirdöt. Csak akkor szakad meg, ha te magad bontod.",
+        "description": "Helper text for the stay-connected-after-quitting toggle."
+    },
     "settings.general.language.label": {
         "message": "Megjelenítési nyelv"
     },

client/ui/i18n/locales/it/common.json

@@ -551,6 +551,14 @@
     "settings.general.autostart.errorTitle": {
         "message": "Modifica avvio automatico non riuscita"
     },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Resta connesso dopo la chiusura",
+        "description": "Toggle label: keep the VPN connection up after quitting the UI."
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "La connessione resta attiva in background dopo la chiusura di NetBird. Si interrompe solo quando la disconnetti tu.",
+        "description": "Helper text for the stay-connected-after-quitting toggle."
+    },
     "settings.general.language.label": {
         "message": "Lingua dell'interfaccia"
     },

client/ui/i18n/locales/ja/common.json

@@ -551,6 +551,14 @@
     "settings.general.autostart.errorTitle": {
         "message": "自動起動の変更に失敗しました"
     },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "終了後も接続を維持",
+        "description": "Toggle label: keep the VPN connection up after quitting the UI."
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "NetBird を閉じたあとも接続はバックグラウンドで維持されます。自分で切断したときにだけ停止します。",
+        "description": "Helper text for the stay-connected-after-quitting toggle."
+    },
     "settings.general.language.label": {
         "message": "表示言語"
     },

client/ui/i18n/locales/pt/common.json

@@ -551,6 +551,14 @@
     "settings.general.autostart.errorTitle": {
         "message": "Falha ao alterar o início automático"
     },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Permanecer conectado ao sair",
+        "description": "Toggle label: keep the VPN connection up after quitting the UI."
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "A conexão continua ativa em segundo plano depois de fechar o NetBird. Ela só para quando você mesmo a desconecta.",
+        "description": "Helper text for the stay-connected-after-quitting toggle."
+    },
     "settings.general.language.label": {
         "message": "Idioma de exibição"
     },

client/ui/i18n/locales/ru/common.json

@@ -551,6 +551,14 @@
     "settings.general.autostart.errorTitle": {
         "message": "Не удалось изменить автозапуск"
     },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "Оставаться подключённым после выхода",
+        "description": "Toggle label: keep the VPN connection up after quitting the UI."
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "Соединение остаётся активным в фоне после закрытия NetBird. Оно прервётся, только когда вы отключите его сами.",
+        "description": "Helper text for the stay-connected-after-quitting toggle."
+    },
     "settings.general.language.label": {
         "message": "Язык интерфейса"
     },

client/ui/i18n/locales/zh-CN/common.json

@@ -551,6 +551,14 @@
     "settings.general.autostart.errorTitle": {
         "message": "更改自启动设置失败"
     },
+    "settings.general.keepConnectedOnQuit.label": {
+        "message": "退出后保持连接",
+        "description": "Toggle label: keep the VPN connection up after quitting the UI."
+    },
+    "settings.general.keepConnectedOnQuit.help": {
+        "message": "关闭 NetBird 后，连接会在后台保持。只有你自己断开时才会停止。",
+        "description": "Helper text for the stay-connected-after-quitting toggle."
+    },
     "settings.general.language.label": {
         "message": "显示语言"
     },

client/ui/main.go

@@ -180,6 +180,7 @@ func main() {
 		WindowManager:   windowManager,
 		Session:         authSession,
 		Localizer:       localizer,
+		Preferences:     prefStore,
 	})
 	listenForShowSignal(context.Background(), tray)
 

client/ui/preferences/store.go

@@ -58,6 +58,10 @@ type UIPreferences struct {
 	// decision has run for this OS user. It only ever transitions to true
 	// and is never reset, so the default-on flow runs at most once, ever.
 	AutostartInitialized bool `json:"autostartInitialized"`
+	// KeepConnectedOnQuit leaves the daemon connected when the GUI quits.
+	// Its false zero value preserves the historical disconnect-on-quit
+	// behaviour for preference files written before the field existed.
+	KeepConnectedOnQuit bool `json:"keepConnectedOnQuit"`
 }
 
 // LanguageValidator rejects SetLanguage inputs with no shipped bundle.
@@ -183,6 +187,26 @@ func (s *Store) SetAutostartInitialized(done bool) error {
 	return nil
 }
 
+// SetKeepConnectedOnQuit persists the disconnect-on-quit opt-out. No-op if unchanged.
+func (s *Store) SetKeepConnectedOnQuit(keep bool) error {
+	s.mu.Lock()
+	if s.current.KeepConnectedOnQuit == keep {
+		s.mu.Unlock()
+		return nil
+	}
+	next := s.current
+	next.KeepConnectedOnQuit = keep
+	if err := s.persistLocked(next); err != nil {
+		s.mu.Unlock()
+		return fmt.Errorf("persist preferences: %w", err)
+	}
+	s.current = next
+	s.mu.Unlock()
+
+	s.broadcast(next)
+	return nil
+}
+
 // SetLanguage validates, persists, and broadcasts. No-op if unchanged.
 func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
 	if lang == "" {

client/ui/preferences/store_test.go

@@ -238,6 +238,42 @@ func TestStore_SetAutostartInitializedPersistsAcrossReload(t *testing.T) {
 	assert.True(t, reloaded.Get().AutostartInitialized, "marker must survive a reload from disk")
 }
 
+func TestStore_SetKeepConnectedOnQuitPersistsAcrossReload(t *testing.T) {
+	withTempConfigDir(t)
+	emitter := &recordingEmitter{}
+	s, err := NewStore(nil, emitter)
+	require.NoError(t, err)
+
+	assert.False(t, s.Get().KeepConnectedOnQuit, "quitting must disconnect by default")
+
+	require.NoError(t, s.SetKeepConnectedOnQuit(true))
+	assert.True(t, s.Get().KeepConnectedOnQuit, "Get should reflect the persisted opt-out")
+	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first write should broadcast")
+
+	require.NoError(t, s.SetKeepConnectedOnQuit(true))
+	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent write should not broadcast again")
+
+	reloaded, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.True(t, reloaded.Get().KeepConnectedOnQuit, "opt-out must survive a reload from disk")
+}
+
+func TestStore_KeepConnectedOnQuitDefaultsFalseForPreExistingFile(t *testing.T) {
+	withTempConfigDir(t)
+
+	// A preferences file written before the field existed must keep the
+	// historical disconnect-on-quit behaviour rather than silently opting out.
+	path, err := preferencesPath()
+	require.NoError(t, err)
+	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
+	require.NoError(t, os.WriteFile(path, []byte(`{"language":"en","viewMode":"default"}`), 0o600))
+
+	s, err := NewStore(nil, nil)
+	require.NoError(t, err)
+	assert.False(t, s.Get().KeepConnectedOnQuit, "a file predating the field must not opt out of disconnect-on-quit")
+	assert.True(t, s.ExistedAtLoad(), "the pre-existing file must be seen on disk")
+}
+
 func TestStore_ExistedAtLoad(t *testing.T) {
 	withTempConfigDir(t)
 

client/ui/services/cursor_linux.go

@@ -49,5 +49,11 @@ func getCursorPosition(app *application.App) (application.Point, bool) {
 	if app == nil || app.Screen == nil {
 		return p, true
 	}
+	// The wails GTK3 backend caches screens from the active window; a tray app
+	// has none at startup, so the cache is empty and PhysicalToDipPoint would
+	// dereference a nil nearest screen. Raw pixels are correct there anyway.
+	if app.Screen.ScreenNearestPhysicalPoint(p) == nil {
+		return p, true
+	}
 	return app.Screen.PhysicalToDipPoint(p), true
 }

client/ui/services/preferences.go

@@ -34,3 +34,7 @@ func (s *Preferences) SetViewMode(_ context.Context, mode preferences.ViewMode)
 func (s *Preferences) SetOnboardingCompleted(_ context.Context, done bool) error {
 	return s.store.SetOnboardingCompleted(done)
 }
+
+func (s *Preferences) SetKeepConnectedOnQuit(_ context.Context, keep bool) error {
+	return s.store.SetKeepConnectedOnQuit(keep)
+}

client/ui/tray.go

@@ -16,6 +16,7 @@ import (
 
 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
+	"github.com/netbirdio/netbird/client/ui/preferences"
 	"github.com/netbirdio/netbird/client/ui/services"
 	"github.com/netbirdio/netbird/version"
 )
@@ -50,8 +51,9 @@ type TrayServices struct {
 	WindowManager   *services.WindowManager
 	// Session is bound to authsession directly because the services wrapper
 	// only re-exposes the React subset.
-	Session   *authsession.Session
-	Localizer *Localizer
+	Session     *authsession.Session
+	Localizer   *Localizer
+	Preferences *preferences.Store
 }
 
 type Tray struct {
@@ -461,10 +463,12 @@ func (t *Tray) handleQuit() {
 	t.profileMu.Unlock()
 	t.svc.DaemonFeed.CancelProfileSwitch()
 
-	ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
-	defer cancel()
-	if err := t.svc.Connection.Down(ctx); err != nil {
-		log.Errorf("disconnect on quit: %v", err)
+	if t.svc.Preferences == nil || !t.svc.Preferences.Get().KeepConnectedOnQuit {
+		ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
+		defer cancel()
+		if err := t.svc.Connection.Down(ctx); err != nil {
+			log.Errorf("disconnect on quit: %v", err)
+		}
 	}
 	t.app.Quit()
 }

client/ui/xembed_host_gtk3_linux.go

@@ -0,0 +1,40 @@
+//go:build linux && gtk3 && !(linux && 386)
+
+package main
+
+import (
+	"errors"
+
+	"github.com/godbus/dbus/v5"
+)
+
+// The legacy GTK3 / WebKit2GTK 4.1 build (-tags gtk3) drops the in-process
+// XEmbed StatusNotifierWatcher entirely. The real implementation
+// (xembed_host_linux.go + xembed_tray_linux.c) links GTK4 and uses GTK4-only
+// popup-menu APIs that have no drop-in GTK3 equivalent, so rather than port the
+// C layer we stub the host out on gtk3 builds. The tray still works on every
+// desktop that ships its own StatusNotifierWatcher (KDE, GNOME+AppIndicator,
+// Cinnamon/xapp, XFCE, …); only the minimal-WM fallback (Fluxbox/OpenBox/i3/
+// dwm/vanilla GNOME) is unavailable on gtk3 packages. See LINUX-TRAY.md.
+
+// xembedHost is a placeholder so the package compiles on gtk3 builds; the real
+// type (with X11/GTK4 state) lives in xembed_host_linux.go. It is never
+// instantiated here because xembedTrayAvailable always reports false.
+type xembedHost struct{}
+
+// run satisfies the call in tray_watcher_linux.go; unreachable on gtk3 because
+// newXembedHost never returns a non-nil host.
+func (*xembedHost) run() {}
+
+// xembedTrayAvailable always reports false on gtk3 builds, so the watcher probe
+// loop in startStatusNotifierWatcher exits immediately and newXembedHost is
+// never reached. recenter_linux.go's predicate becomes a harmless no-op too.
+func xembedTrayAvailable() bool {
+	return false
+}
+
+// newXembedHost exists only to satisfy the reference in tray_watcher_linux.go;
+// it is unreachable because xembedTrayAvailable returns false on gtk3.
+func newXembedHost(conn *dbus.Conn, busName string, objPath dbus.ObjectPath) (*xembedHost, error) {
+	return nil, errors.New("xembed host unsupported on gtk3 build")
+}

client/ui/xembed_host_linux.go

@@ -1,4 +1,4 @@
-//go:build linux && !(linux && 386)
+//go:build linux && !gtk3 && !(linux && 386)
 
 package main
 

client/ui/xembed_tray_linux.c

@@ -1,3 +1,5 @@
+//go:build linux && !gtk3 && !(linux && 386)
+
 #include "xembed_tray_linux.h"
 
 #include <X11/Xatom.h>

go.mod

@@ -340,4 +340,4 @@ replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-2
 
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
 
-replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4
+replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701

go.sum

@@ -490,8 +490,8 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4 h1:UKztc3QjWvzU5DZk+uYaOWN0x62NSe/pkxuPvzqZIy4=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701 h1:QL9nupfRom0L9jcY7N9l/Bc6QK2PtC6pHzC+ftpTqpw=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=

infrastructure_files/getting-started-enterprise.sh

@@ -11,6 +11,10 @@ SED_STRIP_PADDING='s/=//g'
 
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
+# Static IP for Traefik inside the compose bridge network. The management
+# server trusts X-Forwarded-* headers from this address only.
+TRAEFIK_IP="172.30.0.10"
+
 check_docker_compose() {
   if command -v docker-compose &> /dev/null; then
     echo "docker-compose"
@@ -80,7 +84,7 @@ read_nb_domain() {
   if ! check_domain_resolves "$value"; then
     echo "" > /dev/stderr
     echo "Warning: '$value' does not resolve via DNS from this host." > /dev/stderr
-    echo "Caddy will not be able to issue TLS certificates until it does." > /dev/stderr
+    echo "Traefik will not be able to issue TLS certificates until it does." > /dev/stderr
     local confirm=""
     echo -n "Continue anyway? [y/N]: " > /dev/stderr
     read -r confirm < /dev/tty
@@ -92,6 +96,23 @@ read_nb_domain() {
   echo "$value"
 }
 
+read_letsencrypt_email() {
+  if [[ -n "${NETBIRD_LETSENCRYPT_EMAIL:-}" ]]; then
+    echo "$NETBIRD_LETSENCRYPT_EMAIL"
+    return
+  fi
+  local value=""
+  echo "Enter your email for Let's Encrypt certificate notifications." > /dev/stderr
+  echo -n "Email address: " > /dev/stderr
+  read -r value < /dev/tty
+  if [[ -z "$value" ]]; then
+    echo "Email is required for Let's Encrypt." > /dev/stderr
+    read_letsencrypt_email
+    return
+  fi
+  echo "$value"
+}
+
 read_required() {
   local prompt="$1"
   local value=""
@@ -204,11 +225,11 @@ init_environment() {
   check_openssl
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
 
-  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]] || [[ -f Caddyfile ]]; then
+  if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]]; then
     echo "Generated files already exist in $(pwd)."
     echo "If you want to reinitialize the environment, please remove them first:"
     echo "  $DOCKER_COMPOSE_COMMAND down --volumes # removes all containers and volumes"
-    echo "  rm -f .env docker-compose.yml Caddyfile config.yaml"
+    echo "  rm -f .env docker-compose.yml config.yaml"
     echo "Be aware this will remove all data from the database."
     exit 1
   fi
@@ -230,6 +251,9 @@ init_environment() {
   echo ""
   NETBIRD_DOMAIN=$(read_nb_domain)
 
+  echo ""
+  NETBIRD_LETSENCRYPT_EMAIL=$(read_letsencrypt_email)
+
   echo ""
 
   NETBIRD_LICENSE_KEY=$(read_secret "Enter license key (input hidden)")
@@ -238,6 +262,7 @@ init_environment() {
   POSTGRES_DB="netbird"
   POSTGRES_PASSWORD=$(rand_secret)
   NETBIRD_ENCRYPTION_KEY=$(rand_b64_key)
+  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)
   NETBIRD_RELAY_AUTH_SECRET=$(rand_secret)
 
   POSTGRES_DSN="host=postgres user=${POSTGRES_USER} password=${POSTGRES_PASSWORD} dbname=${POSTGRES_DB} port=5432 sslmode=disable TimeZone=UTC"
@@ -247,6 +272,7 @@ init_environment() {
   echo "Selected:"
   echo "  Traffic flow: ${NETBIRD_TRAFFIC_FLOW}"
   echo "  Domain:       ${NETBIRD_DOMAIN}"
+  echo "  ACME email:   ${NETBIRD_LETSENCRYPT_EMAIL}"
   echo ""
   echo "Rendering files into $(pwd) ..."
   install -m 600 /dev/null .env
@@ -256,7 +282,6 @@ init_environment() {
   if [[ -z "${NETBIRD_LICENSE_SERVER_BASE_URL:-}" ]]; then
     sed -i.bak '/NETBIRD_LICENSE_SERVER_BASE_URL/d' docker-compose.yml && rm -f docker-compose.yml.bak
   fi
-  render_caddyfile > Caddyfile
   install -m 600 /dev/null config.yaml
   render_config_yaml >> config.yaml
 
@@ -283,7 +308,7 @@ init_environment() {
   echo "All configuration and secrets are stored (mode 600) in $(pwd)/.env"
   echo ""
   echo "Tail logs:"
-  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server caddy"
+  echo "  cd $(pwd) && $DOCKER_COMPOSE_COMMAND logs -f netbird-server traefik"
 }
 
 # ------------------------------------------------------------------
@@ -306,6 +331,11 @@ NETBIRD_TRAFFIC_FLOW_ENABLED=${NETBIRD_TRAFFIC_FLOW}
 # Domain
 NETBIRD_DOMAIN=${NETBIRD_DOMAIN}
 
+# Reverse proxy (Traefik)
+NETBIRD_LETSENCRYPT_EMAIL=${NETBIRD_LETSENCRYPT_EMAIL}
+NETBIRD_TRAEFIK_TAG=${NETBIRD_TRAEFIK_TAG:-v3.6}
+NETBIRD_TRAEFIK_IP=${TRAEFIK_IP}
+
 # Image tags. Default to "latest"
 NETBIRD_DASHBOARD_TAG=${NETBIRD_DASHBOARD_TAG:-latest}
 NETBIRD_SERVER_TAG=${NETBIRD_SERVER_TAG:-latest}
@@ -378,26 +408,78 @@ EOF
 
 render_compose_common() {
   cat <<'EOF'
-  caddy:
+  # Reverse proxy with automatic TLS via Let's Encrypt. Routes are declared as
+  # labels on the services below and picked up through the Docker provider.
+  traefik:
     <<: *default
-    image: caddy:2
-    container_name: netbird-caddy
-    networks: [netbird]
-    environment:
-      - CADDY_SECURE_DOMAIN=${NETBIRD_DOMAIN}
+    image: traefik:${NETBIRD_TRAEFIK_TAG}
+    container_name: netbird-traefik
+    networks:
+      netbird:
+        ipv4_address: ${NETBIRD_TRAEFIK_IP}
+    command:
+      # Logging
+      - "--log.level=INFO"
+      - "--accesslog=true"
+      # Docker provider
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--providers.docker.network=netbird"
+      # Entrypoints
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.websecure.address=:443"
+      - "--entrypoints.websecure.allowACMEByPass=true"
+      # readTimeout bounds the whole request, and gRPC streams / relay WebSockets
+      # never end one; idleTimeout would close the keep-alive connection they
+      # are reused over. Entrypoint-wide is the only scope Traefik offers here.
+      # writeTimeout is left alone: it already defaults to 0.
+      - "--entrypoints.websecure.transport.respondingTimeouts.readTimeout=0"
+      - "--entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0"
+      # HTTP to HTTPS redirect
+      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
+      - "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+      # Let's Encrypt ACME
+      - "--certificatesresolvers.letsencrypt.acme.email=${NETBIRD_LETSENCRYPT_EMAIL}"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
     ports:
       - '443:443'
-      - '443:443/udp'
       - '80:80'
     volumes:
-      - netbird_caddy_data:/data
-      - ./Caddyfile:/etc/caddy/Caddyfile
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - netbird_traefik_letsencrypt:/letsencrypt
+    labels:
+      - traefik.enable=true
+      # Shared security headers, referenced by every NetBird router below. A
+      # label-declared middleware only exists while its container runs, so this
+      # lives on Traefik itself: declaring it on an app container would drop
+      # every router referencing it whenever that container restarts.
+      - traefik.http.middlewares.nb-security.headers.stsSeconds=3600
+      - traefik.http.middlewares.nb-security.headers.stsIncludeSubdomains=true
+      - traefik.http.middlewares.nb-security.headers.contentTypeNosniff=true
+      - traefik.http.middlewares.nb-security.headers.browserXssFilter=true
+      - traefik.http.middlewares.nb-security.headers.referrerPolicy=strict-origin-when-cross-origin
+      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.X-Frame-Options=SAMEORIGIN
+      # Empty value strips the header. Only the dashboard's nginx sets one; the
+      # server emits none. Do not quote it — "" would send a literal Server: "".
+      - traefik.http.middlewares.nb-security.headers.customResponseHeaders.Server=
 
   dashboard:
     <<: *default
     image: ghcr.io/netbirdio/dashboard-cloud:${NETBIRD_DASHBOARD_TAG}
     container_name: netbird-dashboard
     networks: [netbird]
+    labels:
+      - traefik.enable=true
+      # Dashboard catch-all: lowest priority so every route below wins
+      - traefik.http.routers.netbird-dashboard.rule=Host(`${NETBIRD_DOMAIN}`)
+      - traefik.http.routers.netbird-dashboard.entrypoints=websecure
+      - traefik.http.routers.netbird-dashboard.tls=true
+      - traefik.http.routers.netbird-dashboard.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-dashboard.middlewares=nb-security@docker
+      - traefik.http.routers.netbird-dashboard.service=dashboard
+      - traefik.http.routers.netbird-dashboard.priority=1
+      - traefik.http.services.dashboard.loadbalancer.server.port=80
     environment:
       - NETBIRD_MGMT_API_ENDPOINT=https://${NETBIRD_DOMAIN}
       - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://${NETBIRD_DOMAIN}
@@ -435,6 +517,28 @@ render_compose_server() {
       - netbird_data:/var/lib/netbird
       - ./config.yaml:/etc/netbird/config.yaml
     command: ["--config", "/etc/netbird/config.yaml"]
+    labels:
+      - traefik.enable=true
+      # Signal + Management gRPC (needs an h2c backend for HTTP/2 cleartext)
+      - traefik.http.routers.netbird-grpc.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ManagementService/`) || PathPrefix(`/management.ProxyService/`))
+      - traefik.http.routers.netbird-grpc.entrypoints=websecure
+      - traefik.http.routers.netbird-grpc.tls=true
+      - traefik.http.routers.netbird-grpc.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-grpc.middlewares=nb-security@docker
+      - traefik.http.routers.netbird-grpc.service=netbird-server-h2c
+      - traefik.http.routers.netbird-grpc.priority=100
+      # Relay WebSocket, management API, and the embedded IdP
+      - traefik.http.routers.netbird-backend.rule=Host(`${NETBIRD_DOMAIN}`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`))
+      - traefik.http.routers.netbird-backend.entrypoints=websecure
+      - traefik.http.routers.netbird-backend.tls=true
+      - traefik.http.routers.netbird-backend.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-backend.middlewares=nb-security@docker
+      - traefik.http.routers.netbird-backend.service=netbird-server
+      - traefik.http.routers.netbird-backend.priority=100
+      # Services
+      - traefik.http.services.netbird-server.loadbalancer.server.port=80
+      - traefik.http.services.netbird-server-h2c.loadbalancer.server.port=80
+      - traefik.http.services.netbird-server-h2c.loadbalancer.server.scheme=h2c
     environment:
       - NB_LICENSE_KEY=${NETBIRD_LICENSE_KEY}
       - NETBIRD_LICENSE_SERVER_BASE_URL=${NETBIRD_LICENSE_SERVER_BASE_URL}
@@ -497,6 +601,18 @@ render_compose_flow() {
       - NB_FLOW_NATS_ENDPOINTS=nats://nats:4222
       - NB_FLOW_NATS_STREAM=traffic-events
       - NB_FLOW_AUTH_SECRET=${NETBIRD_RELAY_AUTH_SECRET}
+    labels:
+      - traefik.enable=true
+      # Flow receiver gRPC (h2c backend)
+      - traefik.http.routers.netbird-flow.rule=Host(`${NETBIRD_DOMAIN}`) && PathPrefix(`/flow.FlowService/`)
+      - traefik.http.routers.netbird-flow.entrypoints=websecure
+      - traefik.http.routers.netbird-flow.tls=true
+      - traefik.http.routers.netbird-flow.tls.certresolver=letsencrypt
+      - traefik.http.routers.netbird-flow.middlewares=nb-security@docker
+      - traefik.http.routers.netbird-flow.service=netbird-flow-h2c
+      - traefik.http.routers.netbird-flow.priority=100
+      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.port=80
+      - traefik.http.services.netbird-flow-h2c.loadbalancer.server.scheme=h2c
 
 EOF
 }
@@ -536,61 +652,16 @@ EOF
   fi
   cat <<'EOF'
   netbird_postgres:
-  netbird_caddy_data:
+  netbird_traefik_letsencrypt:
 
 networks:
   netbird:
-EOF
-}
-
-render_caddyfile() {
-  cat <<'EOF'
-{
-  servers :80,:443 {
-    protocols h1 h2c h2 h3
-  }
-}
-
-(security_headers) {
-    header * {
-        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
-        X-Content-Type-Options "nosniff"
-        X-Frame-Options "SAMEORIGIN"
-        X-XSS-Protection "1; mode=block"
-        -Server
-        Referrer-Policy strict-origin-when-cross-origin
-    }
-}
-
-:80 {
-    redir https://{$CADDY_SECURE_DOMAIN}{uri} permanent
-}
-
-{$CADDY_SECURE_DOMAIN}:443 {
-    import security_headers
-    # Signal (gRPC over h2c)
-    reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-server:80
-    # Management (gRPC over h2c + HTTP)
-    reverse_proxy /management.ManagementService/* h2c://netbird-server:80
-    reverse_proxy /api/* netbird-server:80
-    reverse_proxy /ws-proxy/* netbird-server:80
-    # Embedded IdP (OAuth2 endpoints served by netbird server)
-    reverse_proxy /oauth2/* netbird-server:80
-    # Relay (WebSocket multiplexed on the same port)
-    reverse_proxy /relay* netbird-server:80
-EOF
-
-  if [[ "$NETBIRD_TRAFFIC_FLOW" == "yes" ]]; then
-    cat <<'EOF'
-    # Flow receiver (gRPC over h2c)
-    reverse_proxy /flow.FlowService/* h2c://receiver:80
-EOF
-  fi
-
-  cat <<'EOF'
-    # Dashboard
-    reverse_proxy /* dashboard:80
-}
+    name: netbird
+    driver: bridge
+    ipam:
+      config:
+        - subnet: 172.30.0.0/24
+          gateway: 172.30.0.1
 EOF
 }
 
@@ -609,7 +680,7 @@ server:
   logLevel: "info"
   logFile: "console"
 
-  # TLS is terminated by Caddy in front; leave this block empty.
+  # TLS is terminated by Traefik in front; leave this block empty.
   tls:
     certFile: ""
     keyFile: ""
@@ -626,12 +697,23 @@ server:
     issuer: "https://${NETBIRD_DOMAIN}/oauth2"
     localAuthDisabled: false
     signKeyRefreshEnabled: false
+    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"
     dashboardRedirectURIs:
       - "https://${NETBIRD_DOMAIN}/nb-auth"
       - "https://${NETBIRD_DOMAIN}/nb-silent-auth"
     cliRedirectURIs:
       - "http://localhost:53000/"
 
+  # Trust X-Forwarded-* only from the Traefik container's static address. Both
+  # keys must stay in step with the ipv4_address pinned in docker-compose.yml:
+  # trustedPeers decides whether forwarded headers are read at all, and leaving
+  # it unset falls back to 0.0.0.0/0.
+  reverseProxy:
+    trustedPeers:
+      - "${TRAEFIK_IP}/32"
+    trustedHTTPProxies:
+      - "${TRAEFIK_IP}/32"
+
   store:
     engine: "postgres"
     dsn: "${POSTGRES_DSN}"

infrastructure_files/getting-started.sh

@@ -348,6 +348,7 @@ initialize_default_values() {
   NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
   # Note: DataStoreEncryptionKey must keep base64 padding (=) for Go's base64.StdEncoding
   DATASTORE_ENCRYPTION_KEY=$(openssl rand -base64 32)
+  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)
   NETBIRD_STUN_PORT=3478
 
   # Docker images
@@ -527,7 +528,8 @@ generate_configuration_files() {
 
   # Common files for all configurations
   render_dashboard_env > dashboard.env
-  render_combined_yaml > config.yaml
+  install -m 600 /dev/null config.yaml
+  render_combined_yaml >> config.yaml
   return 0
 }
 
@@ -911,6 +913,7 @@ server:
   auth:
     issuer: "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/oauth2"
     signKeyRefreshEnabled: true
+    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"
     dashboardRedirectURIs:
       - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-auth"
       - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-silent-auth"

infrastructure_files/migrate-to-enterprise.sh

@@ -15,7 +15,11 @@ set -o pipefail
 #   2. Postgres migration — add Postgres, migrate SQLite data via migrate-store.
 #   3. Traffic flow       — add NATS + flow-enricher + flow-receiver.
 #
-# To revert:
+# If any step fails once the stack has been touched, the script rolls itself
+# back automatically: generated files are removed, the Postgres volume this run
+# created is dropped, and the original deployment is started again.
+#
+# To revert a successful migration:
 #   docker compose down
 #   rm -f docker-compose.override.yml config.yaml.enterprise
 #   # If Postgres migration was done, also restore the SQLite backup printed
@@ -25,6 +29,15 @@ set -o pipefail
 OVERRIDE_FILE="docker-compose.override.yml"
 ENTERPRISE_CONFIG_FILE="config.yaml.enterprise"
 
+# Rollback bookkeeping. ROLLBACK_STATE flips to "armed" the moment the script
+# starts mutating the deployment, and back to "disarmed" once the migration has
+# completed successfully.
+ROLLBACK_STATE="disarmed"
+ENV_EXISTED="unknown"
+ENV_BACKUP=""
+PG_VOLUME_NAME=""
+BACKUP_DIR=""
+
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
 check_docker_compose() {
@@ -361,7 +374,77 @@ render_enterprise_config() {
 # Execution steps
 # ---------------------------------------------------------------------------
 
-resolve_data_volume() {
+combined_container_id() {
+  $DOCKER_COMPOSE_COMMAND ps -aq "$COMBINED_SERVICE" 2>/dev/null | head -1
+}
+
+container_data_mount() {
+  local container="$1"
+  [[ -n "$container" ]] || return 0
+  docker inspect "$container" --format \
+    '{{range .Mounts}}{{if eq .Destination "/var/lib/netbird"}}{{if .Name}}{{.Name}}{{else}}{{.Source}}{{end}}{{end}}{{end}}' 2>/dev/null
+}
+
+# The name comes from the container, so `-v` cannot invent an empty volume here.
+# 0 = empty, 1 = holds data, 2 = could not determine. A failed listing must not
+# be reported as empty: that would abort a healthy migration over a pull error
+# or an unreadable bind mount.
+data_dir_state() {
+  local src="$1" out
+  if [[ "$src" == /* ]]; then
+    [[ -d "$src" ]] || return 2
+    out=$(ls -A "$src" 2>/dev/null) || return 2
+  else
+    docker volume inspect "$src" &> /dev/null || return 0
+    out=$(docker run --rm -v "${src}:/d:ro" busybox sh -c 'ls -A /d' 2>/dev/null) || return 2
+  fi
+  [[ -z "$out" ]] && return 0
+  return 1
+}
+
+check_data_directory() {
+  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
+
+  local container
+  container=$(combined_container_id)
+  if [[ -z "$container" ]]; then
+    echo "" > /dev/stderr
+    echo "No container found for service '$COMBINED_SERVICE'." > /dev/stderr
+    echo "The migration backs up the store by copying it out of that container," > /dev/stderr
+    echo "so it has to exist. Start the deployment and re-run:" > /dev/stderr
+    echo "  $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
+    exit 1
+  fi
+
+  local src
+  src=$(container_data_mount "$container")
+  if [[ -z "$src" ]]; then
+    echo "" > /dev/stderr
+    echo "The '$COMBINED_SERVICE' container has nothing mounted at /var/lib/netbird." > /dev/stderr
+    echo "Cannot locate the NetBird store to back it up." > /dev/stderr
+    exit 1
+  fi
+
+  local state=0
+  data_dir_state "$src" || state=$?
+  if [[ $state -eq 0 ]]; then
+    echo "" > /dev/stderr
+    echo "The NetBird data directory is empty:" > /dev/stderr
+    echo "  $src" > /dev/stderr
+    echo "There is nothing to migrate. Check that you are running this from the" > /dev/stderr
+    echo "deployment directory of the NetBird install you mean to migrate." > /dev/stderr
+    exit 1
+  fi
+  if [[ $state -eq 2 ]]; then
+    echo "  ⚠ Could not read $src to confirm it holds data — continuing." > /dev/stderr
+    echo "    The backup step still fails loudly if it turns out to be empty." > /dev/stderr
+  fi
+
+  echo "  Data directory:   $src"
+}
+
+# Only for the Postgres volume, which has no container to read it off yet.
+resolve_compose_volume() {
   local short="$1"
   local actual
   # Resolve project-prefixed volume name from Docker Compose config first.
@@ -391,18 +474,21 @@ resolve_data_volume() {
 backup_sqlite() {
   BACKUP_DIR="$(pwd)/backups/sqlite-pre-enterprise-$(date +%Y%m%d-%H%M%S)"
   mkdir -p "$BACKUP_DIR"
-  local data_volume_actual
-  data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
-  echo "Backing up SQLite store from volume '$data_volume_actual' to $BACKUP_DIR ..."
-  docker run --rm \
-    -v "${data_volume_actual}:/var/lib/netbird:ro" \
-    -v "${BACKUP_DIR}:/backup" \
-    busybox \
-    sh -c 'cp -a /var/lib/netbird/. /backup/ 2>/dev/null || true'
+
+  local container
+  container=$(combined_container_id)
+  if [[ -z "$container" ]]; then
+    echo "  ⚠ No container found for '$COMBINED_SERVICE' — cannot back up the store." > /dev/stderr
+    exit 1
+  fi
+
+  echo "Backing up the NetBird store to $BACKUP_DIR ..."
+  docker cp "${container}:/var/lib/netbird/." "$BACKUP_DIR/"
+
   local copied
   copied=$(find "$BACKUP_DIR" -mindepth 1 | head -1)
   if [[ -z "$copied" ]]; then
-    echo "  ⚠ Backup directory is empty — the volume '$data_volume_actual' didn't contain data. Aborting." > /dev/stderr
+    echo "  ⚠ Backup directory is empty — /var/lib/netbird held no data. Aborting." > /dev/stderr
     exit 1
   fi
   echo "  done"
@@ -414,6 +500,135 @@ run_migrate_store() {
   echo "  done"
 }
 
+# ---------------------------------------------------------------------------
+# Rollback — a failed run must not leave the operator with a stopped stack and
+# half-written artifacts.
+# ---------------------------------------------------------------------------
+
+# Resolve the name Compose would give the Postgres volume before the override
+# exists, so a leftover volume can be spotted up front.
+compose_project_name() {
+  local container project
+  container=$($DOCKER_COMPOSE_COMMAND ps -aq 2>/dev/null | head -1)
+  if [[ -n "$container" ]]; then
+    project=$(docker inspect "$container" \
+      --format '{{index .Config.Labels "com.docker.compose.project"}}' 2>/dev/null)
+    if [[ -n "$project" ]]; then
+      echo "$project"
+      return 0
+    fi
+  fi
+  project=$($DOCKER_COMPOSE_COMMAND config 2>/dev/null | yq eval '.name // ""' - 2>/dev/null)
+  if [[ -n "$project" ]] && [[ "$project" != "null" ]]; then
+    echo "$project"
+  fi
+  return 0
+}
+
+postgres_volume_name() {
+  local project
+  project=$(compose_project_name)
+  if [[ -n "$project" ]]; then
+    echo "${project}_netbird_postgres"
+  fi
+  return 0
+}
+
+# Postgres skips initdb when its data directory is non-empty, so a volume left
+# behind by an interrupted run would keep the old password and old contents,
+# and migrate-store would fail against it.
+check_stale_postgres_volume() {
+  [[ "$MIGRATE_POSTGRES" == "yes" ]] || return 0
+
+  PG_VOLUME_NAME=$(postgres_volume_name)
+  if [[ -z "$PG_VOLUME_NAME" ]]; then
+    echo ""
+    echo "  ⚠ Could not determine the Compose project name, so a Postgres volume"
+    echo "    left over from an earlier attempt cannot be checked for. If a"
+    echo "    previous run failed, remove it before continuing:"
+    echo "      docker volume ls | grep netbird_postgres"
+    return 0
+  fi
+  docker volume inspect "$PG_VOLUME_NAME" &> /dev/null || return 0
+
+  echo ""
+  echo "  ⚠  A Postgres volume from an earlier attempt already exists:"
+  echo "       $PG_VOLUME_NAME"
+  echo "     Postgres does not re-initialise a non-empty data directory, so the"
+  echo "     migration would run against stale credentials and stale data."
+  local remove
+  remove=$(read_yes_no "  Remove it and continue?" "y")
+  if [[ "$remove" != "yes" ]]; then
+    echo "" > /dev/stderr
+    echo "Aborted. Remove it manually with: docker volume rm $PG_VOLUME_NAME" > /dev/stderr
+    exit 1
+  fi
+  docker volume rm "$PG_VOLUME_NAME" > /dev/null
+  echo "  Removed."
+}
+
+# Undo whatever this run changed and start the previous deployment again.
+rollback() {
+  ROLLBACK_STATE="done"
+
+  echo ""
+  echo "──────────────────────────────────────────────────────────────────────"
+  echo " Migration failed — restoring the previous deployment"
+  echo "──────────────────────────────────────────────────────────────────────"
+
+  # Resolve while the override is still present; without it Compose no longer
+  # knows about the Postgres volume.
+  local pg_volume="$PG_VOLUME_NAME"
+  if [[ -z "$pg_volume" ]] && [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
+    pg_volume=$(postgres_volume_name)
+  fi
+
+  echo ""
+  echo "Stopping services ..."
+  $DOCKER_COMPOSE_COMMAND down || true
+
+  echo "Removing generated files ..."
+  rm -f "$OVERRIDE_FILE" "$ENTERPRISE_CONFIG_FILE"
+
+  # Restore .env to exactly what it was, or remove it if this run created it.
+  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
+    mv -f "$ENV_BACKUP" .env || echo "  ⚠ Could not restore .env from $ENV_BACKUP." > /dev/stderr
+  elif [[ "$ENV_EXISTED" == "no" ]]; then
+    rm -f .env || true
+  fi
+
+  # Only ever the volume this run created — never the NetBird data volume.
+  if [[ -n "$pg_volume" ]] && [[ "$pg_volume" != "null" ]]; then
+    echo "Removing Postgres volume $pg_volume ..."
+    docker volume rm "$pg_volume" &> /dev/null || true
+  fi
+
+  echo "Starting the previous deployment ..."
+  if ! $DOCKER_COMPOSE_COMMAND up -d; then
+    echo ""
+    echo "  ⚠ Could not start the previous deployment automatically." > /dev/stderr
+    echo "    Run: $DOCKER_COMPOSE_COMMAND up -d" > /dev/stderr
+  fi
+
+  echo ""
+  echo "Rolled back. Your docker-compose.yml, config.yaml and the NetBird data"
+  echo "volume were never modified."
+  if [[ -n "$BACKUP_DIR" ]] && [[ -d "$BACKUP_DIR" ]]; then
+    echo "The SQLite backup taken during this run is kept at:"
+    echo "  $BACKUP_DIR"
+  fi
+  echo "──────────────────────────────────────────────────────────────────────"
+}
+
+on_exit() {
+  local code=$?
+  trap - EXIT
+  if [[ $code -ne 0 ]] && [[ "$ROLLBACK_STATE" == "armed" ]]; then
+    rollback
+  fi
+  exit $code
+}
+
 # ---------------------------------------------------------------------------
 # Main
 # ---------------------------------------------------------------------------
@@ -541,9 +756,15 @@ init_migration() {
     ENABLE_FLOW="no"
     echo "Step 3 (traffic flow) skipped — requires Postgres."
   fi
+
+  check_data_directory
+  check_stale_postgres_volume
 }
 
 apply_changes() {
+  # From here on a failure must roll the deployment back.
+  ROLLBACK_STATE="armed"
+
   echo ""
   echo "Writing $OVERRIDE_FILE ..."
   install -m 644 /dev/null "$OVERRIDE_FILE"
@@ -564,6 +785,14 @@ apply_changes() {
   # picks it up automatically.
   echo "Writing .env additions (mode 600) ..."
   local ENV_FILE=".env"
+  # Snapshot the operator's .env so a rollback can restore it byte for byte.
+  if [[ -f "$ENV_FILE" ]]; then
+    ENV_EXISTED="yes"
+    ENV_BACKUP="${ENV_FILE}.pre-enterprise-$(date +%Y%m%d-%H%M%S)"
+    cp -p "$ENV_FILE" "$ENV_BACKUP"
+  else
+    ENV_EXISTED="no"
+  fi
   touch "$ENV_FILE"
   chmod 600 "$ENV_FILE"
   {
@@ -592,11 +821,16 @@ apply_changes() {
 
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
     echo ""
-    echo "Stopping existing services (volumes preserved) ..."
-    $DOCKER_COMPOSE_COMMAND down
+    # Stop, but keep the containers: the backup reads the store out of one.
+    echo "Stopping services so the store is quiescent ..."
+    $DOCKER_COMPOSE_COMMAND stop
 
     backup_sqlite
 
+    echo ""
+    echo "Removing stopped containers (volumes preserved) ..."
+    $DOCKER_COMPOSE_COMMAND down
+
     echo ""
     echo "Starting Postgres ..."
     $DOCKER_COMPOSE_COMMAND up -d postgres
@@ -626,6 +860,9 @@ apply_changes() {
 
   echo ""
   echo "Migration complete."
+
+  # Nothing left to undo.
+  ROLLBACK_STATE="disarmed"
 }
 
 print_summary() {
@@ -643,6 +880,7 @@ print_summary() {
   echo "    $OVERRIDE_FILE"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    $ENTERPRISE_CONFIG_FILE"
   echo "    .env  (license key + secrets, mode 600)"
+  [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]] && echo "    $ENV_BACKUP  (.env as it was before this run)"
   [[ "$MIGRATE_POSTGRES" == "yes" ]] && echo "    backups/sqlite-pre-enterprise-*/  (SQLite backup)"
   echo ""
   echo " Tail logs:"
@@ -651,19 +889,27 @@ print_summary() {
   echo "──────────────────────────────────────────────────────────────────────"
   echo " To revert"
   echo "──────────────────────────────────────────────────────────────────────"
-  echo "  $DOCKER_COMPOSE_COMMAND down"
   if [[ "$MIGRATE_POSTGRES" == "yes" ]]; then
-    # Resolve project-prefixed volume names now (before override is removed).
-    local pg_volume data_volume_actual
-    pg_volume=$(resolve_data_volume "netbird_postgres")
-    data_volume_actual=$(resolve_data_volume "$DATA_VOLUME")
-    echo "  # Remove the Postgres volume FIRST, before deleting the override file:"
-    echo "  docker volume rm $pg_volume"
+    # Resolve the project-prefixed volume name now, before the override is gone.
+    local pg_volume
+    pg_volume=$(resolve_compose_volume "netbird_postgres")
+    echo "  # Stop, but keep the containers so the store can be copied back in:"
+    echo "  $DOCKER_COMPOSE_COMMAND stop"
     echo "  # Restore SQLite from the backup created during this run:"
-    echo "  docker run --rm -v ${data_volume_actual}:/var/lib/netbird -v ${BACKUP_DIR}:/backup busybox sh -c 'cp -a /backup/. /var/lib/netbird/'"
+    echo "  docker cp ${BACKUP_DIR}/. \$($DOCKER_COMPOSE_COMMAND ps -aq $COMBINED_SERVICE):/var/lib/netbird/"
+    echo "  $DOCKER_COMPOSE_COMMAND down"
+    echo "  docker volume rm $pg_volume"
+  else
+    echo "  $DOCKER_COMPOSE_COMMAND down"
   fi
   echo "  rm -f $OVERRIDE_FILE $ENTERPRISE_CONFIG_FILE"
-  echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
+  if [[ "$ENV_EXISTED" == "yes" ]] && [[ -f "$ENV_BACKUP" ]]; then
+    echo "  mv $ENV_BACKUP .env   # restores .env as it was before this run"
+  elif [[ "$ENV_EXISTED" == "no" ]]; then
+    echo "  rm -f .env   # created by this run"
+  else
+    echo "  # Remove migrate-to-enterprise.sh additions from .env (search for the timestamp marker)"
+  fi
   echo "  $DOCKER_COMPOSE_COMMAND up -d"
   echo "──────────────────────────────────────────────────────────────────────"
 }
@@ -672,6 +918,10 @@ print_summary() {
 # Run
 # ---------------------------------------------------------------------------
 
+trap on_exit EXIT
+# Turn signals into a normal exit so the EXIT trap can roll back.
+trap 'exit 130' INT TERM
+
 init_migration
 apply_changes
 print_summary

release_files/darwin_pkg/preinstall

@@ -4,9 +4,67 @@ set -x
 
 LOG_FILE=/var/log/netbird/client_pre_install.log
 AGENT=/usr/local/bin/netbird
+UI_PROCESS=netbird-ui
 
 mkdir -p /var/log/netbird/
 
+# wait_for_ui_exit polls for up to $1 seconds, returning 0 as soon as no UI
+# process is left and 1 if one is still running when the time is up.
+wait_for_ui_exit() {
+    waited=0
+    while [ "$waited" -lt "$1" ]; do
+        pgrep -x "$UI_PROCESS" > /dev/null 2>&1 || return 0
+        sleep 1
+        waited=$((waited + 1))
+    done
+    return 1
+}
+
+# request_ui_quit asks the UI to quit from inside the console user's session and
+# reports whether the request could be sent at all. The installer runs as root
+# outside that session, so a quit Apple event sent straight from here always
+# fails with -600.
+request_ui_quit() {
+    console_user=$(stat -f%Su /dev/console 2>/dev/null)
+    case "$console_user" in
+        ""|root|loginwindow|_mbsetupuser)
+            echo "No active GUI user session (console user: '${console_user:-none}'); skipping the quit request."
+            return 1
+            ;;
+    esac
+
+    uid=$(id -u "$console_user" 2>/dev/null)
+    if [ -z "$uid" ]; then
+        echo "Could not resolve uid for console user '$console_user'; skipping the quit request."
+        return 1
+    fi
+
+    echo "Asking the NetBird UI to quit as console user $console_user (uid $uid)."
+    launchctl asuser "$uid" sudo -u "$console_user" -H osascript -e 'quit app "NetBird"' || true
+}
+
+# quit_ui stops a running UI so the app bundle can be replaced underneath it. A
+# UI process that survives the install keeps serving the old binary until it is
+# quit by hand, so anything still running once the quit request is out of the
+# way is signalled. Waiting for a graceful exit only makes sense when a quit
+# request was actually sent.
+quit_ui() {
+    if request_ui_quit && wait_for_ui_exit 10; then
+        return 0
+    fi
+
+    pgrep -x "$UI_PROCESS" > /dev/null 2>&1 || return 0
+
+    echo "NetBird UI still running; terminating it."
+    pkill -x "$UI_PROCESS" || true
+    if wait_for_ui_exit 3; then
+        return 0
+    fi
+
+    echo "NetBird UI ignored SIGTERM; killing it."
+    pkill -KILL -x "$UI_PROCESS" || true
+}
+
 {
     # check if it was installed with brew
     brew list --formula | grep netbird
@@ -15,10 +73,9 @@ mkdir -p /var/log/netbird/
         echo "NetBird has been installed with Brew. Please use Brew to update the package."
         exit 1
     fi
-    osascript -e 'quit app "Netbird"' || true
+    quit_ui
     $AGENT service stop || true
 
     echo "Preinstall complete"
     exit 0 # all good
 } &> $LOG_FILE
-

shared/relay/client/guard.go

@@ -156,9 +156,11 @@ func (g *Guard) notifyReconnected() {
 func (g *Guard) exponentTicker(ctx context.Context) *backoff.Ticker {
 	bo := backoff.WithContext(&backoff.ExponentialBackOff{
 		InitialInterval: 2 * time.Second,
-		Multiplier:      2,
-		MaxInterval:     g.maxBackoffInterval,
-		Clock:           backoff.SystemClock,
+		// Spreads the reconnects of every client that lost the same relay server.
+		RandomizationFactor: backoff.DefaultRandomizationFactor,
+		Multiplier:          2,
+		MaxInterval:         g.maxBackoffInterval,
+		Clock:               backoff.SystemClock,
 	}, ctx)
 
 	return backoff.NewTicker(bo)