Redact credential form values instead of dropping the body, and bound AppSec settings

## Describe your changes

Make `Test_ConnectPeers` deterministic. Two issues, both surfaced once
the
privileged suite moved into a `--privileged` Docker container (#6425):

1. The peers used `getLocalIP()` as their WireGuard endpoint, i.e. the
host's
routable NIC IP (the docker bridge IP `172.17.0.2` in CI). That address
might
not hairpin reliably inside the container, so the handshake
intermittently
timed out (flaky). Use loopback (`127.1.0.x`) instead — always
self-reachable.
2. On a Linux runner with the WG kernel module the iface uses the eBPF
proxy
factory. Its manager is a singleton with one shared XDP program +
settings
map, so bringing up the two ifaces makes the second factory overwrite
the
first's `wg_port`/`proxy_port` and the handshake is dropped. The test is
   incompatible with the eBPF factory, so disable it via
`NB_DISABLE_EBPF_WG_PROXY` (peers then handshake directly over
loopback).
Running the suite across all three modes (eBPF / UDP proxy / ICE bind)
would
   need a larger refactor.

Also fixes a typo in the `ErrSharedSockStopped` message (`socked` →
`socket`).

## Issue ticket number and link

No public issue — CI flakiness follow-up to #6871 on `Test_ConnectPeers`

(https://github.com/netbirdio/netbird/blob/main/client/iface/iface_test.go).

## Stack

<!-- branch-stack -->

### Checklist
- [x] Is it a bug fix
- [ ] Is a typo/documentation fix
- [ ] Is a feature enhancement
- [ ] It is a refactor
- [ ] Created tests that fail without the change (if possible)

> By submitting this pull request, you confirm that you have read and
agree to the terms of the [Contributor License
Agreement](https://github.com/netbirdio/netbird/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT.md).

## Documentation
Select exactly one:

- [ ] I added/updated documentation for this change
- [x] Documentation is **not needed** for this change (explain why)

Test-only change (plus a log-string typo). No public API, CLI, config,
or
behavior change.

### Docs PR URL (required if "docs added" is checked)
Paste the PR link from https://github.com/netbirdio/docs here:

N/A

<!-- codesmith:footer -->
---
<a
href="https://app.blacksmith.sh/netbirdio/codesmith/netbird/pr/6884"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg"><img
alt="View with [code]smith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg"></picture></a>
<a
href="https://backend.blacksmith.sh/track/enable-autofix?expires=1787485967&installation_model_id=427504&pr_number=6884&repository=netbirdio%2Fnetbird&return_to=https%3A%2F%2Fgithub.com%2Fnetbirdio%2Fnetbird%2Fpull%2F6884&signature=09fb996715d039bd02775a140e8cc03deca5cb42540790b82a744527264a30ad"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg"><img
alt="Autofix with [code]smith"
src="https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg"></picture></a>
<sup>Need help on this PR? Tag <code>@codesmith-bot</code> with what you
need. Autofix is disabled.</sup>

<!-- codesmith:autofix:disabled -->
<!-- /codesmith:footer -->

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Corrected the “shared socket stopped” error message for clearer
output.
* **Tests**
* Improved peer connection test reliability in privileged CI by
disabling the eBPF WireGuard proxy and using fixed loopback UDP
endpoints for deterministic setup.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

client/iface/iface_test.go

@@ -464,6 +464,8 @@ func Test_RemovePeer(t *testing.T) {
 }
 
 func Test_ConnectPeers(t *testing.T) {
+	t.Setenv("NB_DISABLE_EBPF_WG_PROXY", "true")
+
 	peer1ifaceName := fmt.Sprintf("utun%d", WgIntNumber+400)
 	peer1wgIP := netip.MustParsePrefix("10.99.99.17/30")
 	peer1Key, _ := wgtypes.GeneratePrivateKey()
@@ -505,12 +507,8 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	localIP, err := getLocalIP()
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer1wgPort))
+	localIP1 := "127.0.0.1"
+	peer1endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP1, peer1wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -546,7 +544,8 @@ func Test_ConnectPeers(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP, peer2wgPort))
+	localIP2 := "127.0.0.1"
+	peer2endpoint, err := net.ResolveUDPAddr("udp", fmt.Sprintf("%s:%d", localIP2, peer2wgPort))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -621,28 +620,3 @@ func getPeer(ifaceName, peerPubKey string) (wgtypes.Peer, error) {
 	}
 	return wgtypes.Peer{}, fmt.Errorf("peer not found")
 }
-
-func getLocalIP() (string, error) {
-	// Get all interfaces
-	addrs, err := net.InterfaceAddrs()
-	if err != nil {
-		return "", err
-	}
-
-	for _, addr := range addrs {
-		ipNet, ok := addr.(*net.IPNet)
-		if !ok {
-			continue
-		}
-		if ipNet.IP.IsLoopback() {
-			continue
-		}
-
-		if ipNet.IP.To4() == nil {
-			continue
-		}
-		return ipNet.IP.String(), nil
-	}
-
-	return "", fmt.Errorf("no local IP found")
-}

infrastructure_files/getting-started.sh

@@ -228,6 +228,8 @@ read_enable_crowdsec() {
   echo "CrowdSec checks client IPs against a community threat intelligence database" > /dev/stderr
   echo "and blocks known malicious sources before they reach your services." > /dev/stderr
   echo "A local CrowdSec LAPI container will be added to your deployment." > /dev/stderr
+  echo "It also enables the AppSec (WAF) endpoint, so services can inspect HTTP" > /dev/stderr
+  echo "requests for exploits. Both stay off per service until you enable them." > /dev/stderr
   echo -n "Enable CrowdSec? [y/N]: " > /dev/stderr
   read -r CHOICE < /dev/tty
 
@@ -497,7 +499,8 @@ generate_configuration_files() {
         # TCP ServersTransport for PROXY protocol v2 to the proxy backend
         render_traefik_dynamic > traefik-dynamic.yaml
         if [[ "$ENABLE_CROWDSEC" == "true" ]]; then
-          mkdir -p crowdsec
+          mkdir -p crowdsec/acquis.d
+          render_crowdsec_appsec_acquis > crowdsec/acquis.d/appsec.yaml
         fi
       fi
       ;;
@@ -531,6 +534,23 @@ generate_configuration_files() {
   return 0
 }
 
+# The AppSec (WAF) listener only exists if an appsec acquisition datasource is
+# configured. One datasource is one listener carrying one merged rule set: the
+# protocol has no rule-set selector, so per-service rule variation would need
+# either a second datasource on another port or pre_eval hooks filtering on
+# req.Host.
+render_crowdsec_appsec_acquis() {
+  cat <<EOF
+source: appsec
+listen_addr: 0.0.0.0:7422
+appsec_configs:
+  - crowdsecurity/appsec-default
+labels:
+  type: appsec
+EOF
+  return 0
+}
+
 start_services_and_show_instructions() {
   # For built-in Traefik, start containers immediately
   # For NPM, start containers first (NPM needs services running to create proxy)
@@ -742,7 +762,11 @@ render_docker_compose_traefik_builtin() {
     restart: unless-stopped
     networks: [netbird]
     environment:
-      COLLECTIONS: crowdsecurity/linux
+      # appsec-generic-rules is required alongside appsec-virtual-patching:
+      # the appsec-default config references crowdsecurity/generic-* and
+      # crowdsecurity/experimental-*, which only that collection provides, and
+      # the engine exits at startup if they are missing.
+      COLLECTIONS: crowdsecurity/linux crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules
     volumes:
       - ./crowdsec:/etc/crowdsec
       - crowdsec_db:/var/lib/crowdsec/data
@@ -1007,6 +1031,11 @@ EOF
     cat <<EOF
 NB_PROXY_CROWDSEC_API_URL=http://crowdsec:8080
 NB_PROXY_CROWDSEC_API_KEY=$CROWDSEC_BOUNCER_KEY
+# AppSec (WAF) request inspection. Separate endpoint from the LAPI above and
+# validated with the same bouncer key. Setting it makes the proxy advertise the
+# AppSec capability, which is what lets a service select appsec_mode; nothing is
+# inspected until a service opts in.
+NB_PROXY_CROWDSEC_APPSEC_URL=http://crowdsec:7422/
 EOF
   fi
 

management/internals/modules/reverseproxy/domain/domain.go

@@ -23,6 +23,9 @@ type Domain struct {
 	// SupportsCrowdSec is populated at query time from proxy cluster capabilities.
 	// Not persisted.
 	SupportsCrowdSec *bool `gorm:"-"`
+	// SupportsAppSec is populated at query time from proxy cluster capabilities.
+	// Not persisted.
+	SupportsAppSec *bool `gorm:"-"`
 	// SupportsPrivate is populated at query time from proxy cluster capabilities. Not persisted.
 	SupportsPrivate *bool `gorm:"-"`
 }

management/internals/modules/reverseproxy/domain/manager/api.go

@@ -49,6 +49,7 @@ func domainToApi(d *domain.Domain) api.ReverseProxyDomain {
 		SupportsCustomPorts: d.SupportsCustomPorts,
 		RequireSubdomain:    d.RequireSubdomain,
 		SupportsCrowdsec:    d.SupportsCrowdSec,
+		SupportsAppsec:      d.SupportsAppSec,
 		SupportsPrivate:     d.SupportsPrivate,
 	}
 	if d.TargetCluster != "" {

management/internals/modules/reverseproxy/domain/manager/manager.go

@@ -35,6 +35,7 @@ type proxyManager interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 }
 
@@ -94,6 +95,7 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 		d.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, cluster)
 		d.RequireSubdomain = m.proxyManager.ClusterRequireSubdomain(ctx, cluster)
 		d.SupportsCrowdSec = m.proxyManager.ClusterSupportsCrowdSec(ctx, cluster)
+		d.SupportsAppSec = m.proxyManager.ClusterSupportsAppSec(ctx, cluster)
 		d.SupportsPrivate = m.proxyManager.ClusterSupportsPrivate(ctx, cluster)
 		ret = append(ret, d)
 	}
@@ -111,6 +113,7 @@ func (m Manager) GetDomains(ctx context.Context, accountID, userID string) ([]*d
 		if d.TargetCluster != "" {
 			cd.SupportsCustomPorts = m.proxyManager.ClusterSupportsCustomPorts(ctx, d.TargetCluster)
 			cd.SupportsCrowdSec = m.proxyManager.ClusterSupportsCrowdSec(ctx, d.TargetCluster)
+			cd.SupportsAppSec = m.proxyManager.ClusterSupportsAppSec(ctx, d.TargetCluster)
 			cd.SupportsPrivate = m.proxyManager.ClusterSupportsPrivate(ctx, d.TargetCluster)
 		}
 		// Custom domains never require a subdomain by default since

management/internals/modules/reverseproxy/domain/manager/manager_test.go

@@ -40,6 +40,10 @@ func (m *mockProxyManager) ClusterSupportsCrowdSec(_ context.Context, _ string)
 	return nil
 }
 
+func (m *mockProxyManager) ClusterSupportsAppSec(_ context.Context, _ string) *bool {
+	return nil
+}
+
 func (m *mockProxyManager) ClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }

management/internals/modules/reverseproxy/proxy/manager.go

@@ -19,6 +19,7 @@ type Manager interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStale(ctx context.Context, inactivityDuration time.Duration) error
 	GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error)

management/internals/modules/reverseproxy/proxy/manager/manager.go

@@ -21,6 +21,7 @@ type store interface {
 	GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetProxyByAccountID(ctx context.Context, accountID string) (*proxy.Proxy, error)
@@ -138,6 +139,13 @@ func (m Manager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string
 	return m.store.GetClusterSupportsCrowdSec(ctx, clusterAddr)
 }
 
+// ClusterSupportsAppSec returns whether all active proxies in the cluster have
+// a CrowdSec AppSec endpoint configured (unanimous). Returns nil when no proxy
+// has reported capabilities.
+func (m Manager) ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	return m.store.GetClusterSupportsAppSec(ctx, clusterAddr)
+}
+
 // ClusterSupportsPrivate reports whether any active proxy claims the private capability (nil = unreported).
 func (m Manager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
 	return m.store.GetClusterSupportsPrivate(ctx, clusterAddr)

management/internals/modules/reverseproxy/proxy/manager/manager_test.go

@@ -99,6 +99,9 @@ func (m *mockStore) GetClusterRequireSubdomain(_ context.Context, _ string) *boo
 func (m *mockStore) GetClusterSupportsCrowdSec(_ context.Context, _ string) *bool {
 	return nil
 }
+func (m *mockStore) GetClusterSupportsAppSec(_ context.Context, _ string) *bool {
+	return nil
+}
 func (m *mockStore) GetClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }

management/internals/modules/reverseproxy/proxy/manager_mock.go

@@ -50,20 +50,6 @@ func (mr *MockManagerMockRecorder) CleanupStale(ctx, inactivityDuration interfac
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanupStale", reflect.TypeOf((*MockManager)(nil).CleanupStale), ctx, inactivityDuration)
 }
 
-// ClusterSupportsCustomPorts mocks base method.
-func (m *MockManager) ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "ClusterSupportsCustomPorts", ctx, clusterAddr)
-	ret0, _ := ret[0].(*bool)
-	return ret0
-}
-
-// ClusterSupportsCustomPorts indicates an expected call of ClusterSupportsCustomPorts.
-func (mr *MockManagerMockRecorder) ClusterSupportsCustomPorts(ctx, clusterAddr interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCustomPorts", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCustomPorts), ctx, clusterAddr)
-}
-
 // ClusterRequireSubdomain mocks base method.
 func (m *MockManager) ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -78,6 +64,20 @@ func (mr *MockManagerMockRecorder) ClusterRequireSubdomain(ctx, clusterAddr inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterRequireSubdomain", reflect.TypeOf((*MockManager)(nil).ClusterRequireSubdomain), ctx, clusterAddr)
 }
 
+// ClusterSupportsAppSec mocks base method.
+func (m *MockManager) ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ClusterSupportsAppSec", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// ClusterSupportsAppSec indicates an expected call of ClusterSupportsAppSec.
+func (mr *MockManagerMockRecorder) ClusterSupportsAppSec(ctx, clusterAddr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsAppSec", reflect.TypeOf((*MockManager)(nil).ClusterSupportsAppSec), ctx, clusterAddr)
+}
+
 // ClusterSupportsCrowdSec mocks base method.
 func (m *MockManager) ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -92,6 +92,20 @@ func (mr *MockManagerMockRecorder) ClusterSupportsCrowdSec(ctx, clusterAddr inte
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCrowdSec", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCrowdSec), ctx, clusterAddr)
 }
 
+// ClusterSupportsCustomPorts mocks base method.
+func (m *MockManager) ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ClusterSupportsCustomPorts", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// ClusterSupportsCustomPorts indicates an expected call of ClusterSupportsCustomPorts.
+func (mr *MockManagerMockRecorder) ClusterSupportsCustomPorts(ctx, clusterAddr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ClusterSupportsCustomPorts", reflect.TypeOf((*MockManager)(nil).ClusterSupportsCustomPorts), ctx, clusterAddr)
+}
+
 // ClusterSupportsPrivate mocks base method.
 func (m *MockManager) ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()
@@ -121,6 +135,35 @@ func (mr *MockManagerMockRecorder) Connect(ctx, proxyID, sessionID, clusterAddre
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Connect", reflect.TypeOf((*MockManager)(nil).Connect), ctx, proxyID, sessionID, clusterAddress, ipAddress, accountID, capabilities)
 }
 
+// CountAccountProxies mocks base method.
+func (m *MockManager) CountAccountProxies(ctx context.Context, accountID string) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CountAccountProxies", ctx, accountID)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CountAccountProxies indicates an expected call of CountAccountProxies.
+func (mr *MockManagerMockRecorder) CountAccountProxies(ctx, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountProxies", reflect.TypeOf((*MockManager)(nil).CountAccountProxies), ctx, accountID)
+}
+
+// DeleteAccountCluster mocks base method.
+func (m *MockManager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteAccountCluster", ctx, clusterAddress, accountID)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
+func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
+}
+
 // Disconnect mocks base method.
 func (m *MockManager) Disconnect(ctx context.Context, proxyID, sessionID string) error {
 	m.ctrl.T.Helper()
@@ -135,6 +178,21 @@ func (mr *MockManagerMockRecorder) Disconnect(ctx, proxyID, sessionID interface{
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Disconnect", reflect.TypeOf((*MockManager)(nil).Disconnect), ctx, proxyID, sessionID)
 }
 
+// GetAccountProxy mocks base method.
+func (m *MockManager) GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAccountProxy", ctx, accountID)
+	ret0, _ := ret[0].(*Proxy)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetAccountProxy indicates an expected call of GetAccountProxy.
+func (mr *MockManagerMockRecorder) GetAccountProxy(ctx, accountID interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountProxy", reflect.TypeOf((*MockManager)(nil).GetAccountProxy), ctx, accountID)
+}
+
 // GetActiveClusterAddresses mocks base method.
 func (m *MockManager) GetActiveClusterAddresses(ctx context.Context) ([]string, error) {
 	m.ctrl.T.Helper()
@@ -150,6 +208,7 @@ func (mr *MockManagerMockRecorder) GetActiveClusterAddresses(ctx interface{}) *g
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveClusterAddresses", reflect.TypeOf((*MockManager)(nil).GetActiveClusterAddresses), ctx)
 }
 
+// GetActiveClusterAddressesForAccount mocks base method.
 func (m *MockManager) GetActiveClusterAddressesForAccount(ctx context.Context, accountID string) ([]string, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetActiveClusterAddressesForAccount", ctx, accountID)
@@ -158,6 +217,7 @@ func (m *MockManager) GetActiveClusterAddressesForAccount(ctx context.Context, a
 	return ret0, ret1
 }
 
+// GetActiveClusterAddressesForAccount indicates an expected call of GetActiveClusterAddressesForAccount.
 func (mr *MockManagerMockRecorder) GetActiveClusterAddressesForAccount(ctx, accountID interface{}) *gomock.Call {
 	mr.mock.ctrl.T.Helper()
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetActiveClusterAddressesForAccount", reflect.TypeOf((*MockManager)(nil).GetActiveClusterAddressesForAccount), ctx, accountID)
@@ -177,36 +237,6 @@ func (mr *MockManagerMockRecorder) Heartbeat(ctx, p interface{}) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Heartbeat", reflect.TypeOf((*MockManager)(nil).Heartbeat), ctx, p)
 }
 
-// GetAccountProxy mocks base method.
-func (m *MockManager) GetAccountProxy(ctx context.Context, accountID string) (*Proxy, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "GetAccountProxy", ctx, accountID)
-	ret0, _ := ret[0].(*Proxy)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// GetAccountProxy indicates an expected call of GetAccountProxy.
-func (mr *MockManagerMockRecorder) GetAccountProxy(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAccountProxy", reflect.TypeOf((*MockManager)(nil).GetAccountProxy), ctx, accountID)
-}
-
-// CountAccountProxies mocks base method.
-func (m *MockManager) CountAccountProxies(ctx context.Context, accountID string) (int64, error) {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "CountAccountProxies", ctx, accountID)
-	ret0, _ := ret[0].(int64)
-	ret1, _ := ret[1].(error)
-	return ret0, ret1
-}
-
-// CountAccountProxies indicates an expected call of CountAccountProxies.
-func (mr *MockManagerMockRecorder) CountAccountProxies(ctx, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAccountProxies", reflect.TypeOf((*MockManager)(nil).CountAccountProxies), ctx, accountID)
-}
-
 // IsClusterAddressAvailable mocks base method.
 func (m *MockManager) IsClusterAddressAvailable(ctx context.Context, clusterAddress, accountID string) (bool, error) {
 	m.ctrl.T.Helper()
@@ -222,20 +252,6 @@ func (mr *MockManagerMockRecorder) IsClusterAddressAvailable(ctx, clusterAddress
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "IsClusterAddressAvailable", reflect.TypeOf((*MockManager)(nil).IsClusterAddressAvailable), ctx, clusterAddress, accountID)
 }
 
-// DeleteAccountCluster mocks base method.
-func (m *MockManager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
-	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "DeleteAccountCluster", ctx, clusterAddress, accountID)
-	ret0, _ := ret[0].(error)
-	return ret0
-}
-
-// DeleteAccountCluster indicates an expected call of DeleteAccountCluster.
-func (mr *MockManagerMockRecorder) DeleteAccountCluster(ctx, clusterAddress, accountID interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteAccountCluster", reflect.TypeOf((*MockManager)(nil).DeleteAccountCluster), ctx, clusterAddress, accountID)
-}
-
 // MockController is a mock of Controller interface.
 type MockController struct {
 	ctrl     *gomock.Controller

management/internals/modules/reverseproxy/proxy/proxy.go

@@ -20,6 +20,9 @@ type Capabilities struct {
 	RequireSubdomain *bool
 	// SupportsCrowdsec indicates whether this proxy has CrowdSec configured.
 	SupportsCrowdsec *bool
+	// SupportsAppsec indicates whether this proxy has a CrowdSec AppSec (WAF)
+	// endpoint configured.
+	SupportsAppsec *bool
 	// Private indicates whether this proxy supports inbound access via Wireguard
 	// tunnel and netbird-only authentication policies
 	Private *bool
@@ -74,5 +77,6 @@ type Cluster struct {
 	SupportsCustomPorts *bool
 	RequireSubdomain    *bool
 	SupportsCrowdSec    *bool
+	SupportsAppSec      *bool
 	Private             *bool
 }

management/internals/modules/reverseproxy/service/manager/api.go

@@ -204,6 +204,7 @@ func (h *handler) getClusters(w http.ResponseWriter, r *http.Request) {
 			SupportsCustomPorts: c.SupportsCustomPorts,
 			RequireSubdomain:    c.RequireSubdomain,
 			SupportsCrowdsec:    c.SupportsCrowdSec,
+			SupportsAppsec:      c.SupportsAppSec,
 			Private:             c.Private,
 		})
 	}

management/internals/modules/reverseproxy/service/manager/manager.go

@@ -82,6 +82,7 @@ type CapabilityProvider interface {
 	ClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	ClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	ClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	ClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 }
 
@@ -137,6 +138,7 @@ func (m *Manager) GetClusters(ctx context.Context, accountID, userID string) ([]
 		clusters[i].SupportsCustomPorts = m.capabilities.ClusterSupportsCustomPorts(ctx, clusters[i].Address)
 		clusters[i].RequireSubdomain = m.capabilities.ClusterRequireSubdomain(ctx, clusters[i].Address)
 		clusters[i].SupportsCrowdSec = m.capabilities.ClusterSupportsCrowdSec(ctx, clusters[i].Address)
+		clusters[i].SupportsAppSec = m.capabilities.ClusterSupportsAppSec(ctx, clusters[i].Address)
 		clusters[i].Private = m.capabilities.ClusterSupportsPrivate(ctx, clusters[i].Address)
 	}
 

management/internals/modules/reverseproxy/service/service.go

@@ -165,6 +165,13 @@ type AccessRestrictions struct {
 	AllowedCountries []string `json:"allowed_countries,omitempty" gorm:"serializer:json"`
 	BlockedCountries []string `json:"blocked_countries,omitempty" gorm:"serializer:json"`
 	CrowdSecMode     string   `json:"crowdsec_mode,omitempty" gorm:"serializer:json"`
+	// AllowMatch controls how the allowlists combine: "" or "all" require
+	// matching every allowlist (AND), "any" requires matching at least one (OR).
+	// Empty is treated as "all" for backward compatibility with existing records.
+	AllowMatch string `json:"allow_match,omitempty" gorm:"serializer:json"`
+	// AppSecMode is the CrowdSec AppSec (WAF) request inspection mode: "",
+	// "off", "enforce", or "observe". HTTP services only.
+	AppSecMode string `json:"appsec_mode,omitempty" gorm:"serializer:json"`
 }
 
 // Copy returns a deep copy of the AccessRestrictions.
@@ -175,6 +182,8 @@ func (r AccessRestrictions) Copy() AccessRestrictions {
 		AllowedCountries: slices.Clone(r.AllowedCountries),
 		BlockedCountries: slices.Clone(r.BlockedCountries),
 		CrowdSecMode:     r.CrowdSecMode,
+		AllowMatch:       r.AllowMatch,
+		AppSecMode:       r.AppSecMode,
 	}
 }
 
@@ -808,13 +817,25 @@ func restrictionsFromAPI(r *api.AccessRestrictions) (AccessRestrictions, error)
 		}
 		res.CrowdSecMode = string(*r.CrowdsecMode)
 	}
+	if r.AllowMatch != nil {
+		if !r.AllowMatch.Valid() {
+			return AccessRestrictions{}, fmt.Errorf("invalid allow_match %q", *r.AllowMatch)
+		}
+		res.AllowMatch = string(*r.AllowMatch)
+	}
+	if r.AppsecMode != nil {
+		if !r.AppsecMode.Valid() {
+			return AccessRestrictions{}, fmt.Errorf("invalid appsec_mode %q", *r.AppsecMode)
+		}
+		res.AppSecMode = string(*r.AppsecMode)
+	}
 	return res, nil
 }
 
 func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
 	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
 		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" {
+		r.CrowdSecMode == "" && r.AllowMatch == "" && r.AppSecMode == "" {
 		return nil
 	}
 	res := &api.AccessRestrictions{}
@@ -834,13 +855,21 @@ func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
 		mode := api.AccessRestrictionsCrowdsecMode(r.CrowdSecMode)
 		res.CrowdsecMode = &mode
 	}
+	if r.AllowMatch != "" {
+		match := api.AccessRestrictionsAllowMatch(r.AllowMatch)
+		res.AllowMatch = &match
+	}
+	if r.AppSecMode != "" {
+		mode := api.AccessRestrictionsAppsecMode(r.AppSecMode)
+		res.AppsecMode = &mode
+	}
 	return res
 }
 
 func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
 	if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
 		len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
-		r.CrowdSecMode == "" {
+		r.CrowdSecMode == "" && r.AllowMatch == "" && r.AppSecMode == "" {
 		return nil
 	}
 	return &proto.AccessRestrictions{
@@ -849,6 +878,8 @@ func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
 		AllowedCountries: r.AllowedCountries,
 		BlockedCountries: r.BlockedCountries,
 		CrowdsecMode:     r.CrowdSecMode,
+		AllowMatch:       r.AllowMatch,
+		AppsecMode:       r.AppSecMode,
 	}
 }
 
@@ -874,6 +905,11 @@ func (s *Service) Validate() error {
 	if err := validateAccessRestrictions(&s.Restrictions); err != nil {
 		return err
 	}
+	// AppSec inspects HTTP requests, so it cannot apply to the L4 modes, which
+	// forward opaque byte streams.
+	if appSecEnabled(s.Restrictions.AppSecMode) && s.Mode != ModeHTTP {
+		return fmt.Errorf("appsec_mode is only supported for HTTP services, got mode %q", s.Mode)
+	}
 	if err := s.validatePrivateRequirements(); err != nil {
 		return err
 	}
@@ -1242,10 +1278,39 @@ func validateCrowdSecMode(mode string) error {
 	}
 }
 
+func validateAllowMatch(mode string) error {
+	switch mode {
+	case "", "all", "any":
+		return nil
+	default:
+		return fmt.Errorf("allow_match %q is invalid", mode)
+	}
+}
+
+func validateAppSecMode(mode string) error {
+	switch mode {
+	case "", "off", "enforce", "observe":
+		return nil
+	default:
+		return fmt.Errorf("appsec_mode %q is invalid", mode)
+	}
+}
+
+// appSecEnabled reports whether the mode asks for request inspection.
+func appSecEnabled(mode string) bool {
+	return mode == "enforce" || mode == "observe"
+}
+
 func validateAccessRestrictions(r *AccessRestrictions) error {
 	if err := validateCrowdSecMode(r.CrowdSecMode); err != nil {
 		return err
 	}
+	if err := validateAllowMatch(r.AllowMatch); err != nil {
+		return err
+	}
+	if err := validateAppSecMode(r.AppSecMode); err != nil {
+		return err
+	}
 
 	if len(r.AllowedCIDRs) > maxCIDREntries {
 		return fmt.Errorf("allowed_cidrs: exceeds maximum of %d entries", maxCIDREntries)

management/internals/modules/reverseproxy/service/service_test.go

@@ -26,6 +26,17 @@ func validProxy() *Service {
 	}
 }
 
+// validL4Proxy returns a service that passes validation in one of the L4 modes.
+func validL4Proxy(mode string) *Service {
+	rp := validProxy()
+	rp.Mode = mode
+	rp.ListenPort = 9000
+	rp.Targets = []*Target{
+		{TargetId: "peer-1", TargetType: TargetTypePeer, Host: "10.0.0.1", Port: 5432, Protocol: mode, Enabled: true},
+	}
+	return rp
+}
+
 func TestValidate_Valid(t *testing.T) {
 	require.NoError(t, validProxy().Validate())
 }
@@ -1302,6 +1313,130 @@ func TestValidate_Private_AcceptsClusterTargetWithAccessGroups(t *testing.T) {
 	require.NoError(t, rp.Validate())
 }
 
+func TestRestrictions_AllowMatch_RoundTrip(t *testing.T) {
+	anyMatch := api.AccessRestrictionsAllowMatchAny
+	apiIn := &api.AccessRestrictions{
+		AllowedCidrs:     &[]string{"203.0.113.0/24"},
+		AllowedCountries: &[]string{"US"},
+		AllowMatch:       &anyMatch,
+	}
+
+	model, err := restrictionsFromAPI(apiIn)
+	require.NoError(t, err)
+	assert.Equal(t, "any", model.AllowMatch)
+
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut.AllowMatch)
+	assert.Equal(t, api.AccessRestrictionsAllowMatchAny, *apiOut.AllowMatch)
+
+	protoOut := restrictionsToProto(model)
+	require.NotNil(t, protoOut)
+	assert.Equal(t, "any", protoOut.AllowMatch)
+}
+
+func TestRestrictions_AllowMatch_EmptyDefaultsToAll(t *testing.T) {
+	// A stored record with no allow_match (existing services) stays empty and
+	// must not surface a value on the API, preserving AND behavior downstream.
+	model, err := restrictionsFromAPI(&api.AccessRestrictions{
+		AllowedCidrs: &[]string{"203.0.113.0/24"},
+	})
+	require.NoError(t, err)
+	assert.Empty(t, model.AllowMatch, "unset allow_match stays empty")
+
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut)
+	assert.Nil(t, apiOut.AllowMatch, "empty allow_match is omitted from the API response")
+}
+
+func TestRestrictions_AllowMatchOnly_Preserved(t *testing.T) {
+	// allow_match set without any list must not be dropped by the emptiness
+	// guards, so it round-trips through both the API and proto conversions.
+	model := AccessRestrictions{AllowMatch: "any"}
+
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut, "allow-match-only restriction must not be omitted from the API response")
+	require.NotNil(t, apiOut.AllowMatch)
+	assert.Equal(t, api.AccessRestrictionsAllowMatchAny, *apiOut.AllowMatch)
+
+	protoOut := restrictionsToProto(model)
+	require.NotNil(t, protoOut, "allow-match-only restriction must not be omitted from the proto output")
+	assert.Equal(t, "any", protoOut.AllowMatch)
+}
+
+func TestValidate_RejectsInvalidAllowMatch(t *testing.T) {
+	rp := validProxy()
+	rp.Restrictions = AccessRestrictions{
+		AllowedCIDRs: []string{"203.0.113.0/24"},
+		AllowMatch:   "sometimes",
+	}
+	assert.ErrorContains(t, rp.Validate(), "allow_match")
+}
+
+func TestRestrictions_AppSecMode_RoundTrip(t *testing.T) {
+	mode := api.AccessRestrictionsAppsecModeEnforce
+	apiIn := &api.AccessRestrictions{AppsecMode: &mode}
+
+	model, err := restrictionsFromAPI(apiIn)
+	require.NoError(t, err)
+	assert.Equal(t, "enforce", model.AppSecMode)
+
+	// appsec_mode alone must keep the restrictions object alive on both the API
+	// and proto legs: it is meaningful without any CIDR or country entry.
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut, "appsec_mode alone must not collapse the restrictions to nil")
+	require.NotNil(t, apiOut.AppsecMode)
+	assert.Equal(t, api.AccessRestrictionsAppsecModeEnforce, *apiOut.AppsecMode)
+
+	protoOut := restrictionsToProto(model)
+	require.NotNil(t, protoOut, "appsec_mode alone must reach the proxy")
+	assert.Equal(t, "enforce", protoOut.AppsecMode)
+}
+
+func TestRestrictions_AppSecMode_EmptyIsOmitted(t *testing.T) {
+	model, err := restrictionsFromAPI(&api.AccessRestrictions{
+		AllowedCidrs: &[]string{"203.0.113.0/24"},
+	})
+	require.NoError(t, err)
+	assert.Empty(t, model.AppSecMode)
+
+	apiOut := restrictionsToAPI(model)
+	require.NotNil(t, apiOut)
+	assert.Nil(t, apiOut.AppsecMode, "empty appsec_mode is omitted from the API response")
+}
+
+func TestRestrictions_AppSecMode_CopyIsDeep(t *testing.T) {
+	original := AccessRestrictions{AppSecMode: "observe", CrowdSecMode: "enforce"}
+	assert.Equal(t, original, original.Copy(), "Copy must carry every mode field")
+}
+
+func TestValidate_RejectsInvalidAppSecMode(t *testing.T) {
+	rp := validProxy()
+	rp.Restrictions = AccessRestrictions{AppSecMode: "sometimes"}
+	assert.ErrorContains(t, rp.Validate(), "appsec_mode")
+}
+
+func TestValidate_RejectsAppSecOnL4Modes(t *testing.T) {
+	// AppSec inspects HTTP requests, so the L4 modes cannot honor it. Accepting
+	// the field there would report protection that never runs.
+	for _, mode := range []string{ModeTCP, ModeUDP, ModeTLS} {
+		t.Run(mode, func(t *testing.T) {
+			rp := validL4Proxy(mode)
+			rp.Restrictions = AccessRestrictions{AppSecMode: "enforce"}
+			assert.ErrorContains(t, rp.Validate(), "appsec_mode is only supported for HTTP services")
+		})
+	}
+}
+
+func TestValidate_AllowsAppSecOffOnL4Modes(t *testing.T) {
+	for _, mode := range []string{ModeTCP, ModeUDP, ModeTLS} {
+		t.Run(mode, func(t *testing.T) {
+			rp := validL4Proxy(mode)
+			rp.Restrictions = AccessRestrictions{AppSecMode: "off"}
+			require.NoError(t, rp.Validate(), "an explicit off must not be rejected on L4 services")
+		})
+	}
+}
+
 func TestValidate_Private_RejectsNonHTTPMode(t *testing.T) {
 	rp := validProxy()
 	rp.Private = true

management/internals/shared/grpc/components_encoder.go

@@ -5,9 +5,6 @@ import (
 	"strconv"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
-	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
 	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/networkmap"
@@ -166,7 +163,7 @@ func (e *componentEncoder) indexAllPeers() {
 	}
 }
 
-func (e *componentEncoder) appendPeer(p *nbpeer.Peer) uint32 {
+func (e *componentEncoder) appendPeer(p *types.ComponentPeer) uint32 {
 	if idx, ok := e.peerOrder[p.ID]; ok {
 		return idx
 	}
@@ -180,7 +177,7 @@ func (e *componentEncoder) appendPeer(p *nbpeer.Peer) uint32 {
 // (c.RouterPeers may contain peers not in c.Peers when validation rules drop
 // them) and returns their wire indexes for the RouterPeerIndexes field. Must
 // run before any encoder that resolves peer ids via e.peerOrder.
-func (e *componentEncoder) indexRouterPeers(routers map[string]*nbpeer.Peer) []uint32 {
+func (e *componentEncoder) indexRouterPeers(routers map[string]*types.ComponentPeer) []uint32 {
 	if len(routers) == 0 {
 		return nil
 	}
@@ -514,7 +511,7 @@ func encodeCustomZones(zones []nbdns.CustomZone) []*proto.CustomZone {
 	return out
 }
 
-func (e *componentEncoder) encodeNetworkResources(resources []*resourceTypes.NetworkResource) []*proto.NetworkResourceRaw {
+func (e *componentEncoder) encodeNetworkResources(resources []*types.ComponentResource) []*proto.NetworkResourceRaw {
 	if len(resources) == 0 {
 		return nil
 	}
@@ -543,7 +540,7 @@ func (e *componentEncoder) encodeNetworkResources(resources []*resourceTypes.Net
 	return out
 }
 
-func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*routerTypes.NetworkRouter) map[string]*proto.NetworkRouterList {
+func (e *componentEncoder) encodeRoutersMap(routersMap map[string]map[string]*types.ComponentRouter) map[string]*proto.NetworkRouterList {
 	if len(routersMap) == 0 {
 		return nil
 	}
@@ -692,20 +689,20 @@ func toAccountNetwork(n *types.Network) *proto.AccountNetwork {
 	return out
 }
 
-func toPeerCompact(p *nbpeer.Peer) *proto.PeerCompact {
+func toPeerCompact(p *types.ComponentPeer) *proto.PeerCompact {
 	pc := &proto.PeerCompact{
 		WgPubKey:               decodeWgKey(p.Key),
 		SshPubKey:              []byte(p.SSHKey),
 		DnsLabel:               p.DNSLabel,
-		AgentVersion:           p.Meta.WtVersion,
-		AddedWithSsoLogin:      p.UserID != "",
+		AgentVersion:           p.AgentVersion,
+		AddedWithSsoLogin:      p.AddedWithSSOLogin,
 		LoginExpirationEnabled: p.LoginExpirationEnabled,
 		SshEnabled:             p.SSHEnabled,
-		SupportsIpv6:           p.SupportsIPv6(),
-		SupportsSourcePrefixes: p.SupportsSourcePrefixes(),
-		ServerSshAllowed:       p.Meta.Flags.ServerSSHAllowed,
+		SupportsIpv6:           p.SupportsIPv6,
+		SupportsSourcePrefixes: p.SupportsSourcePrefixes,
+		ServerSshAllowed:       p.ServerSSHAllowed,
 	}
-	if p.LastLogin != nil {
+	if !p.LastLogin.IsZero() {
 		pc.LastLoginUnixNano = p.LastLogin.UnixNano()
 	}
 	switch {

management/internals/shared/grpc/components_encoder_test.go

@@ -15,9 +15,6 @@ import (
 	goproto "google.golang.org/protobuf/proto"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
-	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
 	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/proto"
@@ -155,29 +152,28 @@ func envelopesEquivalent(a, b *proto.NetworkMapEnvelope) bool {
 }
 
 func newTestComponents() *types.NetworkMapComponents {
-	peerA := &nbpeer.Peer{
-		ID:       "peer-a",
-		Key:      testWgKeyA,
-		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 1}),
-		DNSLabel: "peera",
-		SSHKey:   "ssh-a",
-		Status:   &nbpeer.PeerStatus{Connected: true, LastSeen: time.Now()},
-		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
+	peerA := &types.ComponentPeer{
+		ID:           "peer-a",
+		Key:          testWgKeyA,
+		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 1}),
+		DNSLabel:     "peera",
+		SSHKey:       "ssh-a",
+		AgentVersion: "0.40.0",
 	}
-	peerB := &nbpeer.Peer{
-		ID:       "peer-b",
-		Key:      testWgKeyB,
-		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 2}),
-		IPv6:     netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2}),
-		DNSLabel: "peerb",
-		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.25.0"},
+	peerB := &types.ComponentPeer{
+		ID:           "peer-b",
+		Key:          testWgKeyB,
+		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 2}),
+		IPv6:         netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2}),
+		DNSLabel:     "peerb",
+		AgentVersion: "0.25.0",
 	}
-	peerC := &nbpeer.Peer{
-		ID:       "peer-c",
-		Key:      testWgKeyC,
-		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 3}),
-		DNSLabel: "peerc",
-		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
+	peerC := &types.ComponentPeer{
+		ID:           "peer-c",
+		Key:          testWgKeyC,
+		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 3}),
+		DNSLabel:     "peerc",
+		AgentVersion: "0.40.0",
 	}
 
 	return &types.NetworkMapComponents{
@@ -191,12 +187,12 @@ func newTestComponents() *types.NetworkMapComponents {
 			PeerLoginExpirationEnabled: true,
 			PeerLoginExpiration:        2 * time.Hour,
 		},
-		Peers: map[string]*nbpeer.Peer{
+		Peers: map[string]*types.ComponentPeer{
 			"peer-a": peerA,
 			"peer-b": peerB,
 			"peer-c": peerC,
 		},
-		Groups: map[string]*types.Group{
+		Groups: map[string]*types.ComponentGroup{
 			"group-src": {ID: "group-src", PublicID: "1", Name: "Src", Peers: []string{"peer-a"}},
 			"group-dst": {ID: "group-dst", PublicID: "2", Name: "Dst", Peers: []string{"peer-b", "peer-c"}},
 		},
@@ -215,7 +211,7 @@ func newTestComponents() *types.NetworkMapComponents {
 				}},
 			},
 		},
-		RouterPeers: map[string]*nbpeer.Peer{"peer-c": peerC},
+		RouterPeers: map[string]*types.ComponentPeer{"peer-c": peerC},
 	}
 }
 
@@ -381,12 +377,12 @@ func TestEncodeNetworkMapEnvelope_MalformedWgKey(t *testing.T) {
 
 func TestEncodeNetworkMapEnvelope_IPv6OnlyPeer(t *testing.T) {
 	c := newTestComponents()
-	v6Only := &nbpeer.Peer{
-		ID:       "peer-v6",
-		Key:      testWgKeyA,
-		IPv6:     netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 9}),
-		DNSLabel: "peerv6",
-		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
+	v6Only := &types.ComponentPeer{
+		ID:           "peer-v6",
+		Key:          testWgKeyA,
+		IPv6:         netip.AddrFrom16([16]byte{0xfd, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 9}),
+		DNSLabel:     "peerv6",
+		AgentVersion: "0.40.0",
 	}
 	c.Peers["peer-v6"] = v6Only
 
@@ -405,11 +401,11 @@ func TestEncodeNetworkMapEnvelope_IPv6OnlyPeer(t *testing.T) {
 
 func TestEncodeNetworkMapEnvelope_PeerWithoutIP(t *testing.T) {
 	c := newTestComponents()
-	c.Peers["peer-noip"] = &nbpeer.Peer{
-		ID:       "peer-noip",
-		Key:      testWgKeyA,
-		DNSLabel: "peernoip",
-		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
+	c.Peers["peer-noip"] = &types.ComponentPeer{
+		ID:           "peer-noip",
+		Key:          testWgKeyA,
+		DNSLabel:     "peernoip",
+		AgentVersion: "0.40.0",
 	}
 
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
@@ -444,9 +440,9 @@ func TestEncodeNetworkMapEnvelope_EmptyInput(t *testing.T) {
 func TestEncodeNetworkMapEnvelope_PeerLoginExpirationFields(t *testing.T) {
 	c := newTestComponents()
 	now := time.Date(2024, 1, 2, 3, 4, 5, 0, time.UTC)
-	c.Peers["peer-a"].UserID = "user-1"
+	c.Peers["peer-a"].AddedWithSSOLogin = true
 	c.Peers["peer-a"].LoginExpirationEnabled = true
-	c.Peers["peer-a"].LastLogin = &now
+	c.Peers["peer-a"].LastLogin = now
 
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
 
@@ -557,7 +553,7 @@ func TestEncodeNetworkMapEnvelope_ResourceOnlyPolicyShippedAndIndexed(t *testing
 	}
 	// Resource must appear in components.NetworkResources with a seq id —
 	// encoder uses that to translate the xid map key to uint32.
-	c.NetworkResources = []*resourceTypes.NetworkResource{
+	c.NetworkResources = []*types.ComponentResource{
 		{ID: "resource-x", PublicID: "77", Name: "res-x", Enabled: true},
 	}
 
@@ -625,11 +621,11 @@ func TestEncodeNetworkMapEnvelope_PostureFailedPeers(t *testing.T) {
 func TestEncodeNetworkMapEnvelope_RoutersMap(t *testing.T) {
 	c := newTestComponents()
 	c.NetworkXIDToPublicID = map[string]string{"net-1": "5"}
-	c.RoutersMap = map[string]map[string]*routerTypes.NetworkRouter{
+	c.RoutersMap = map[string]map[string]*types.ComponentRouter{
 		"net-1": {
 			"peer-c": {
-				ID: "router-1", PublicID: "200",
-				Peer: "peer-c", Masquerade: true, Metric: 10, Enabled: true,
+				PublicID: "200",
+				Peer:     "peer-c", Masquerade: true, Metric: 10, Enabled: true,
 			},
 		},
 	}
@@ -655,14 +651,14 @@ func TestEncodeNetworkMapEnvelope_RouterPeerNotInComponentsPeers(t *testing.T) {
 	// peer_index reference must still resolve.
 	c := newTestComponents()
 	delete(c.Peers, "peer-c")
-	routerPeer := &nbpeer.Peer{
+	routerPeer := &types.ComponentPeer{
 		ID: "peer-c", Key: testWgKeyC, IP: netip.AddrFrom4([4]byte{100, 64, 0, 3}),
-		DNSLabel: "peerc", Meta: nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
+		DNSLabel: "peerc", AgentVersion: "0.40.0",
 	}
-	c.RouterPeers = map[string]*nbpeer.Peer{"peer-c": routerPeer}
+	c.RouterPeers = map[string]*types.ComponentPeer{"peer-c": routerPeer}
 	c.NetworkXIDToPublicID = map[string]string{"net-1": "5"}
-	c.RoutersMap = map[string]map[string]*routerTypes.NetworkRouter{
-		"net-1": {"peer-c": {ID: "r-1", PublicID: "1", Peer: "peer-c", Enabled: true}},
+	c.RoutersMap = map[string]map[string]*types.ComponentRouter{
+		"net-1": {"peer-c": {PublicID: "1", Peer: "peer-c", Enabled: true}},
 	}
 
 	full := EncodeNetworkMapEnvelope(ComponentsEnvelopeInput{Components: c}).GetFull()
@@ -695,9 +691,9 @@ func TestToProxyPatch_EmptyInputReturnsNil(t *testing.T) {
 
 func TestToProxyPatch_PopulatesAllFields(t *testing.T) {
 	nm := &types.NetworkMap{
-		Peers: []*nbpeer.Peer{{
+		Peers: []*types.ComponentPeer{{
 			ID: "ext-peer", Key: testWgKeyA, IP: netip.AddrFrom4([4]byte{100, 64, 0, 9}),
-			DNSLabel: "extpeer", Meta: nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
+			DNSLabel: "extpeer", AgentVersion: "0.40.0",
 		}},
 		FirewallRules: []*types.FirewallRule{{
 			PeerIP: "100.64.0.9", Action: "accept", Direction: 0, Protocol: "tcp",
@@ -780,6 +776,6 @@ func TestEncodeNetworkMapEnvelope_AccountSettingsAlwaysEmitted(t *testing.T) {
 func emptyNetworkMapComponents() *types.NetworkMapComponents {
 	return types.EmptyNetworkMapComponents(
 		&types.NetworkMapComponents{
-			PeerID: "peer-id", Peers: map[string]*nbpeer.Peer{"peer-id": {}}},
+			PeerID: "peer-id", Peers: map[string]*types.ComponentPeer{"peer-id": {}}},
 	)
 }

management/internals/shared/grpc/components_envelope_response_test.go

@@ -19,10 +19,10 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 
 	mkComponents := func(rule *types.PolicyRule, sshEnabled bool) (*types.NetworkMapComponents, *nbpeer.Peer) {
 		peer := &nbpeer.Peer{ID: targetPeerID, SSHEnabled: sshEnabled}
-		group := &types.Group{ID: targetGroupID, Name: "dst", Peers: []string{targetPeerID}}
+		group := &types.ComponentGroup{ID: targetGroupID, Name: "dst", Peers: []string{targetPeerID}}
 		return &types.NetworkMapComponents{
-			Peers:  map[string]*nbpeer.Peer{targetPeerID: peer},
-			Groups: map[string]*types.Group{targetGroupID: group},
+			Peers:  map[string]*types.ComponentPeer{targetPeerID: peer.ToComponent()},
+			Groups: map[string]*types.ComponentGroup{targetGroupID: group},
 			Policies: []*types.Policy{{
 				ID:      "p",
 				Enabled: true,
@@ -158,8 +158,8 @@ func TestComputeSSHEnabledForPeer(t *testing.T) {
 func TestComputeSSHEnabledForPeer_TargetMissingFromComponents(t *testing.T) {
 	peer := &nbpeer.Peer{ID: "missing", SSHEnabled: true}
 	c := &types.NetworkMapComponents{
-		Peers: map[string]*nbpeer.Peer{}, // target peer NOT present
-		Groups: map[string]*types.Group{
+		Peers: map[string]*types.ComponentPeer{}, // target peer NOT present
+		Groups: map[string]*types.ComponentGroup{
 			"g": {ID: "g", Peers: []string{"missing"}},
 		},
 		Policies: []*types.Policy{{

management/internals/shared/grpc/proxy.go

@@ -29,6 +29,7 @@ import (
 
 	"github.com/netbirdio/netbird/shared/management/domain"
 
+	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
@@ -36,7 +37,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
 	"github.com/netbirdio/netbird/management/server/idp"
 	"github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/management/server/users"
 	proxyauth "github.com/netbirdio/netbird/proxy/auth"
@@ -505,6 +505,7 @@ func (s *ProxyServiceServer) registerProxyConnection(ctx context.Context, params
 			SupportsCustomPorts: c.SupportsCustomPorts,
 			RequireSubdomain:    c.RequireSubdomain,
 			SupportsCrowdsec:    c.SupportsCrowdsec,
+			SupportsAppsec:      c.SupportsAppsec,
 			Private:             c.Private,
 		}
 	}

management/server/groups/manager.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
+	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
@@ -30,6 +31,10 @@ type managerImpl struct {
 	accountManager     account.Manager
 }
 
+func eventMetaResource(group *types.Group, resource *resourceTypes.NetworkResource) map[string]any {
+	return map[string]any{"name": group.Name, "id": group.ID, "resource_name": resource.Name, "resource_id": resource.ID, "resource_type": resource.Type}
+}
+
 type mockManager struct {
 }
 
@@ -109,7 +114,7 @@ func (m *managerImpl) AddResourceToGroupInTransaction(ctx context.Context, trans
 	}
 
 	event := func() {
-		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceAddedToGroup, group.EventMetaResource(networkResource))
+		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceAddedToGroup, eventMetaResource(group, networkResource))
 	}
 
 	return event, nil
@@ -133,7 +138,7 @@ func (m *managerImpl) RemoveResourceFromGroupInTransaction(ctx context.Context,
 	}
 
 	event := func() {
-		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceRemovedFromGroup, group.EventMetaResource(networkResource))
+		m.accountManager.StoreEvent(ctx, userID, groupID, accountID, activity.ResourceRemovedFromGroup, eventMetaResource(group, networkResource))
 	}
 
 	return event, nil

management/server/http/handlers/peers/peers_handler.go

@@ -446,7 +446,7 @@ func (h *Handler) GetAccessiblePeers(w http.ResponseWriter, r *http.Request) {
 
 	netMap := account.GetPeerNetworkMapFromComponents(ctx, peerID, dns.CustomZone{}, nil, validPeers, account.GetResourcePoliciesMap(), account.GetResourceRoutersMap(), nil, account.GetActiveGroupUsers())
 
-	util.WriteJSONObject(ctx, w, toAccessiblePeers(netMap, dnsDomain))
+	util.WriteJSONObject(ctx, w, toAccessiblePeers(netMap, account.Peers, dnsDomain))
 }
 
 func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request) {
@@ -534,15 +534,20 @@ func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request)
 	util.WriteJSONObject(r.Context(), w, resp)
 }
 
-func toAccessiblePeers(netMap *types.NetworkMap, dnsDomain string) []api.AccessiblePeer {
+// toAccessiblePeers rehydrates the calculated map's component peers into the
+// account's full peer objects, which carry the location/status/meta fields
+// the API response needs.
+func toAccessiblePeers(netMap *types.NetworkMap, accountPeers map[string]*nbpeer.Peer, dnsDomain string) []api.AccessiblePeer {
 	accessiblePeers := make([]api.AccessiblePeer, 0, len(netMap.Peers)+len(netMap.OfflinePeers))
-	for _, p := range netMap.Peers {
-		accessiblePeers = append(accessiblePeers, peerToAccessiblePeer(p, dnsDomain))
-	}
-
-	for _, p := range netMap.OfflinePeers {
-		accessiblePeers = append(accessiblePeers, peerToAccessiblePeer(p, dnsDomain))
+	add := func(peers []*types.ComponentPeer) {
+		for _, p := range peers {
+			if peer := accountPeers[p.ID]; peer != nil {
+				accessiblePeers = append(accessiblePeers, peerToAccessiblePeer(peer, dnsDomain))
+			}
+		}
 	}
+	add(netMap.Peers)
+	add(netMap.OfflinePeers)
 
 	return accessiblePeers
 }

management/server/networks/resources/types/resource.go

@@ -14,6 +14,7 @@ import (
 	nbDomain "github.com/netbirdio/netbird/shared/management/domain"
 
 	"github.com/netbirdio/netbird/shared/management/http/api"
+	sharedTypes "github.com/netbirdio/netbird/shared/management/types"
 )
 
 type NetworkResourceType string
@@ -64,6 +65,27 @@ func NewNetworkResource(accountID, networkID, name, description, address string,
 	}, nil
 }
 
+// ToComponent converts the resource to its self-contained components
+// representation. Returns nil for a nil resource.
+func (n *NetworkResource) ToComponent() *sharedTypes.ComponentResource {
+	if n == nil {
+		return nil
+	}
+	return &sharedTypes.ComponentResource{
+		ID:          n.ID,
+		PublicID:    n.PublicID,
+		NetworkID:   n.NetworkID,
+		AccountID:   n.AccountID,
+		Name:        n.Name,
+		Description: n.Description,
+		Type:        sharedTypes.ComponentResourceType(n.Type),
+		Address:     n.Address,
+		Domain:      n.Domain,
+		Prefix:      n.Prefix,
+		Enabled:     n.Enabled,
+	}
+}
+
 func (n *NetworkResource) ToAPIResponse(groups []api.GroupMinimum) *api.NetworkResource {
 	addr := n.Prefix.String()
 	if n.Type == Domain {

management/server/networks/routers/types/router.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/networks/types"
 	"github.com/netbirdio/netbird/shared/management/http/api"
+	sharedTypes "github.com/netbirdio/netbird/shared/management/types"
 )
 
 type NetworkRouter struct {
@@ -21,6 +22,36 @@ type NetworkRouter struct {
 	Enabled    bool
 }
 
+// ToComponent converts the router to its self-contained components
+// representation. Returns nil for a nil router.
+func (n *NetworkRouter) ToComponent() *sharedTypes.ComponentRouter {
+	if n == nil {
+		return nil
+	}
+	return &sharedTypes.ComponentRouter{
+		NetworkID:  n.NetworkID,
+		PublicID:   n.PublicID,
+		Peer:       n.Peer,
+		PeerGroups: n.PeerGroups,
+		Masquerade: n.Masquerade,
+		Metric:     n.Metric,
+		Enabled:    n.Enabled,
+	}
+}
+
+// ToComponentMap converts a peer-keyed router map to its components
+// representation.
+func ToComponentMap(routers map[string]*NetworkRouter) map[string]*sharedTypes.ComponentRouter {
+	if routers == nil {
+		return nil
+	}
+	out := make(map[string]*sharedTypes.ComponentRouter, len(routers))
+	for id, r := range routers {
+		out[id] = r.ToComponent()
+	}
+	return out
+}
+
 func NewNetworkRouter(accountID string, networkID string, peer string, peerGroups []string, masquerade bool, metric int, enabled bool) (*NetworkRouter, error) {
 	r := &NetworkRouter{
 		ID:         xid.New().String(),

management/server/peer.go

@@ -405,7 +405,7 @@ func (am *DefaultAccountManager) CreatePeerJob(ctx context.Context, accountID, p
 		return status.NewPeerNotPartOfAccountError()
 	}
 
-	meetMinVer, err := posture.MeetsMinVersion(remoteJobsMinVer, p.Meta.WtVersion)
+	meetMinVer, err := version.MeetsMinVersion(remoteJobsMinVer, p.Meta.WtVersion)
 	if !version.IsDevelopmentVersion(p.Meta.WtVersion) && (!meetMinVer || err != nil) {
 		return status.Errorf(status.PreconditionFailed, "peer version %s does not meet the minimum required version %s for remote jobs", p.Meta.WtVersion, remoteJobsMinVer)
 	}
@@ -1588,7 +1588,7 @@ func affectedPeerIDsFromNetworkMap(nmap *types.NetworkMap, selfPeerID string) []
 	}
 	seen := make(map[string]struct{}, len(nmap.Peers)+len(nmap.OfflinePeers))
 	ids := make([]string, 0, len(nmap.Peers)+len(nmap.OfflinePeers))
-	add := func(peers []*nbpeer.Peer) {
+	add := func(peers []*types.ComponentPeer) {
 		for _, p := range peers {
 			if p == nil || p.ID == "" || p.ID == selfPeerID {
 				continue

management/server/peer/peer.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/netbirdio/netbird/management/server/util"
 	"github.com/netbirdio/netbird/shared/management/http/api"
+	sharedTypes "github.com/netbirdio/netbird/shared/management/types"
 )
 
 // Peer capability constants mirror the proto enum values.
@@ -205,6 +206,35 @@ func (p *Peer) AddedWithSSOLogin() bool {
 	return p.UserID != ""
 }
 
+// ToComponent converts the peer to its self-contained components
+// representation, carrying exactly the subset of peer data that crosses the
+// components wire format. Returns nil for a nil peer so callers can convert
+// possibly-missing peers without guarding.
+func (p *Peer) ToComponent() *sharedTypes.ComponentPeer {
+	if p == nil {
+		return nil
+	}
+	cp := &sharedTypes.ComponentPeer{
+		ID:                     p.ID,
+		Key:                    p.Key,
+		IP:                     p.IP,
+		IPv6:                   p.IPv6,
+		DNSLabel:               p.DNSLabel,
+		SSHKey:                 p.SSHKey,
+		SSHEnabled:             p.SSHEnabled,
+		ServerSSHAllowed:       p.Meta.Flags.ServerSSHAllowed,
+		AgentVersion:           p.Meta.WtVersion,
+		SupportsSourcePrefixes: p.SupportsSourcePrefixes(),
+		SupportsIPv6:           p.SupportsIPv6(),
+		LoginExpirationEnabled: p.LoginExpirationEnabled,
+		AddedWithSSOLogin:      p.AddedWithSSOLogin(),
+	}
+	if p.LastLogin != nil {
+		cp.LastLogin = *p.LastLogin
+	}
+	return cp
+}
+
 // HasCapability reports whether the peer has the given capability.
 func (p *Peer) HasCapability(capability int32) bool {
 	return slices.Contains(p.Meta.Capabilities, capability)

management/server/peer_test.go

@@ -1092,14 +1092,14 @@ func TestToSyncResponse(t *testing.T) {
 	}
 	networkMap := &types.NetworkMap{
 		Network: &types.Network{Net: *ipnet, Serial: 1000},
-		Peers: []*nbpeer.Peer{{
+		Peers: []*types.ComponentPeer{{
 			IP:         netip.MustParseAddr("192.168.1.2"),
 			IPv6:       netip.MustParseAddr("fd00::2"),
 			Key:        "peer2-key",
 			DNSLabel:   "peer2",
 			SSHEnabled: true,
 			SSHKey:     "peer2-ssh-key"}},
-		OfflinePeers: []*nbpeer.Peer{{
+		OfflinePeers: []*types.ComponentPeer{{
 			IP:         netip.MustParseAddr("192.168.1.3"),
 			IPv6:       netip.MustParseAddr("fd00::3"),
 			Key:        "peer3-key",

management/server/posture/nb_version.go

@@ -3,11 +3,9 @@ package posture
 import (
 	"context"
 	"fmt"
-	"strings"
-
-	"github.com/hashicorp/go-version"
 
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	nbversion "github.com/netbirdio/netbird/version"
 )
 
 type NBVersionCheck struct {
@@ -16,14 +14,8 @@ type NBVersionCheck struct {
 
 var _ Check = (*NBVersionCheck)(nil)
 
-// sanitizeVersion removes anything after the pre-release tag (e.g., "-dev", "-alpha", etc.)
-func sanitizeVersion(version string) string {
-	parts := strings.Split(version, "-")
-	return parts[0]
-}
-
 func (n *NBVersionCheck) Check(ctx context.Context, peer nbpeer.Peer) (bool, error) {
-	meetsMin, err := MeetsMinVersion(n.MinVersion, peer.Meta.WtVersion)
+	meetsMin, err := nbversion.MeetsMinVersion(n.MinVersion, peer.Meta.WtVersion)
 	if err != nil {
 		return false, err
 	}
@@ -48,21 +40,3 @@ func (n *NBVersionCheck) Validate() error {
 	}
 	return nil
 }
-
-// MeetsMinVersion checks if the peer's version meets or exceeds the minimum required version
-func MeetsMinVersion(minVer, peerVer string) (bool, error) {
-	peerVer = sanitizeVersion(peerVer)
-	minVer = sanitizeVersion(minVer)
-
-	peerNBVer, err := version.NewVersion(peerVer)
-	if err != nil {
-		return false, err
-	}
-
-	constraints, err := version.NewConstraint(">= " + minVer)
-	if err != nil {
-		return false, err
-	}
-
-	return constraints.Check(peerNBVer), nil
-}

management/server/posture/nb_version_test.go

@@ -139,68 +139,3 @@ func TestNBVersionCheck_Validate(t *testing.T) {
 		})
 	}
 }
-
-func TestMeetsMinVersion(t *testing.T) {
-	tests := []struct {
-		name    string
-		minVer  string
-		peerVer string
-		want    bool
-		wantErr bool
-	}{
-		{
-			name:    "Peer version greater than min version",
-			minVer:  "0.26.0",
-			peerVer: "0.60.1",
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name:    "Peer version equals min version",
-			minVer:  "1.0.0",
-			peerVer: "1.0.0",
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name:    "Peer version less than min version",
-			minVer:  "1.0.0",
-			peerVer: "0.9.9",
-			want:    false,
-			wantErr: false,
-		},
-		{
-			name:    "Peer version with pre-release tag greater than min version",
-			minVer:  "1.0.0",
-			peerVer: "1.0.1-alpha",
-			want:    true,
-			wantErr: false,
-		},
-		{
-			name:    "Invalid peer version format",
-			minVer:  "1.0.0",
-			peerVer: "dev",
-			want:    false,
-			wantErr: true,
-		},
-		{
-			name:    "Invalid min version format",
-			minVer:  "invalid.version",
-			peerVer: "1.0.0",
-			want:    false,
-			wantErr: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, err := MeetsMinVersion(tt.minVer, tt.peerVer)
-			if tt.wantErr {
-				assert.Error(t, err)
-			} else {
-				assert.NoError(t, err)
-			}
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}

management/server/store/sql_store.go

@@ -2259,7 +2259,7 @@ func (s *SqlStore) getPostureChecks(ctx context.Context, accountID string) ([]*p
 }
 
 func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpservice.Service, error) {
-	const serviceQuery = `SELECT id, account_id, name, domain, enabled, auth,
+	const serviceQuery = `SELECT id, account_id, name, domain, enabled, auth, restrictions,
 		meta_created_at, meta_certificate_issued_at, meta_status, proxy_cluster,
 		pass_host_header, rewrite_redirects, session_private_key, session_public_key,
 		mode, listen_port, port_auto_assigned, source, source_peer, terminated,
@@ -2278,6 +2278,7 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 	services, err := pgx.CollectRows(serviceRows, func(row pgx.CollectableRow) (*rpservice.Service, error) {
 		var s rpservice.Service
 		var auth []byte
+		var restrictions []byte
 		var accessGroups []byte
 		var createdAt, certIssuedAt sql.NullTime
 		var status, proxyCluster, sessionPrivateKey, sessionPublicKey sql.NullString
@@ -2291,6 +2292,7 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 			&s.Domain,
 			&s.Enabled,
 			&auth,
+			&restrictions,
 			&createdAt,
 			&certIssuedAt,
 			&status,
@@ -2318,6 +2320,12 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 			}
 		}
 
+		if len(restrictions) > 0 {
+			if err := json.Unmarshal(restrictions, &s.Restrictions); err != nil {
+				return nil, fmt.Errorf("unmarshal restrictions: %w", err)
+			}
+		}
+
 		if len(accessGroups) > 0 {
 			if err := json.Unmarshal(accessGroups, &s.AccessGroups); err != nil {
 				return nil, fmt.Errorf("unmarshal access_groups: %w", err)
@@ -6357,6 +6365,7 @@ var validCapabilityColumns = map[string]struct{}{
 	"supports_custom_ports": {},
 	"require_subdomain":     {},
 	"supports_crowdsec":     {},
+	"supports_appsec":       {},
 	"private":               {},
 }
 
@@ -6387,6 +6396,14 @@ func (s *SqlStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr s
 	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_crowdsec")
 }
 
+// GetClusterSupportsAppSec returns whether all active proxies in the cluster
+// have a CrowdSec AppSec endpoint configured. Returns nil when no proxy
+// reported the capability. Unanimous for the same reason as CrowdSec: a single
+// proxy without AppSec would let requests through uninspected.
+func (s *SqlStore) GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	return s.getClusterUnanimousCapability(ctx, clusterAddr, "supports_appsec")
+}
+
 // getClusterUnanimousCapability returns an aggregated boolean capability
 // requiring all active proxies in the cluster to report true.
 func (s *SqlStore) getClusterUnanimousCapability(ctx context.Context, clusterAddr, column string) *bool {

management/server/store/sql_store_service_test.go

@@ -44,3 +44,46 @@ func TestSqlStore_GetAccount_PrivateServiceRoundtrip(t *testing.T) {
 		assert.Equal(t, []string{"grp-admins", "grp-ops"}, got.AccessGroups)
 	})
 }
+
+func TestSqlStore_GetAccount_ServiceRestrictionsRoundtrip(t *testing.T) {
+	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
+		t.Skip("skip CI tests on darwin and windows")
+	}
+
+	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
+		ctx := context.Background()
+		account := newAccountWithId(ctx, "account_svc_restrictions", "testuser", "")
+		require.NoError(t, store.SaveAccount(ctx, account))
+
+		svc := &rpservice.Service{
+			ID:        "svc-restrictions",
+			AccountID: account.Id,
+			Name:      "restricted-svc",
+			Domain:    "restricted.example",
+			Enabled:   true,
+			Mode:      rpservice.ModeHTTP,
+			Restrictions: rpservice.AccessRestrictions{
+				AllowedCIDRs:     []string{"203.0.113.0/24"},
+				AllowedCountries: []string{"US"},
+				AllowMatch:       "any",
+				CrowdSecMode:     "observe",
+				AppSecMode:       "enforce",
+			},
+		}
+		require.NoError(t, store.CreateService(ctx, svc))
+
+		loaded, err := store.GetAccount(ctx, account.Id)
+		require.NoError(t, err)
+		require.Len(t, loaded.Services, 1)
+
+		// Restrictions are stored as a JSON blob; confirm the whole struct,
+		// including allow_match and the crowdsec/appsec modes, survives the
+		// read path (Postgres pgx path included via runTestForAllEngines).
+		got := loaded.Services[0].Restrictions
+		assert.Equal(t, []string{"203.0.113.0/24"}, got.AllowedCIDRs)
+		assert.Equal(t, []string{"US"}, got.AllowedCountries)
+		assert.Equal(t, "any", got.AllowMatch)
+		assert.Equal(t, "observe", got.CrowdSecMode)
+		assert.Equal(t, "enforce", got.AppSecMode)
+	})
+}

management/server/store/store.go

@@ -321,6 +321,7 @@ type Store interface {
 	GetClusterSupportsCustomPorts(ctx context.Context, clusterAddr string) *bool
 	GetClusterRequireSubdomain(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool
+	GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool
 	GetClusterSupportsPrivate(ctx context.Context, clusterAddr string) *bool
 	CleanupStaleProxies(ctx context.Context, inactivityDuration time.Duration) error
 	GetAllProxies(ctx context.Context) ([]*proxy.Proxy, error)

management/server/store/store_mock.go

@@ -1835,6 +1835,20 @@ func (mr *MockStoreMockRecorder) GetClusterRequireSubdomain(ctx, clusterAddr int
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterRequireSubdomain", reflect.TypeOf((*MockStore)(nil).GetClusterRequireSubdomain), ctx, clusterAddr)
 }
 
+// GetClusterSupportsAppSec mocks base method.
+func (m *MockStore) GetClusterSupportsAppSec(ctx context.Context, clusterAddr string) *bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetClusterSupportsAppSec", ctx, clusterAddr)
+	ret0, _ := ret[0].(*bool)
+	return ret0
+}
+
+// GetClusterSupportsAppSec indicates an expected call of GetClusterSupportsAppSec.
+func (mr *MockStoreMockRecorder) GetClusterSupportsAppSec(ctx, clusterAddr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetClusterSupportsAppSec", reflect.TypeOf((*MockStore)(nil).GetClusterSupportsAppSec), ctx, clusterAddr)
+}
+
 // GetClusterSupportsCrowdSec mocks base method.
 func (m *MockStore) GetClusterSupportsCrowdSec(ctx context.Context, clusterAddr string) *bool {
 	m.ctrl.T.Helper()

management/server/types/account.go

@@ -1082,6 +1082,7 @@ func (a *Account) connResourcesGenerator(ctx context.Context, targetPeer *nbpeer
 	peersExists := make(map[string]struct{})
 	rules := make([]*FirewallRule, 0)
 	peers := make([]*nbpeer.Peer, 0)
+	targetComponent := targetPeer.ToComponent()
 
 	return func(rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int) {
 			for _, peer := range groupPeers {
@@ -1117,10 +1118,10 @@ func (a *Account) connResourcesGenerator(ctx context.Context, targetPeer *nbpeer
 				if len(rule.Ports) == 0 && len(rule.PortRanges) == 0 {
 					rules = append(rules, &fr)
 				} else {
-					rules = append(rules, ExpandPortsAndRanges(fr, rule, targetPeer)...)
+					rules = append(rules, ExpandPortsAndRanges(fr, rule, targetComponent)...)
 				}
 
-				rules = AppendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, FirewallRuleContext{
+				rules = AppendIPv6FirewallRule(rules, rulesExists, peer.ToComponent(), targetComponent, rule, FirewallRuleContext{
 					Direction:   direction,
 					DirStr:      strconv.Itoa(direction),
 					ProtocolStr: string(protocol),
@@ -1280,7 +1281,7 @@ func (a *Account) getRouteFirewallRules(ctx context.Context, peerID string, poli
 	return fwRules
 }
 
-func (a *Account) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}, validatedPeersMap map[string]struct{}) []*nbpeer.Peer {
+func (a *Account) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}, validatedPeersMap map[string]struct{}) []*ComponentPeer {
 	distPeersWithPolicy := make(map[string]struct{})
 	for _, id := range rule.Sources {
 		group := a.Groups[id]
@@ -1307,13 +1308,13 @@ func (a *Account) getRulePeers(rule *PolicyRule, postureChecks []string, peerID
 		}
 	}
 
-	distributionGroupPeers := make([]*nbpeer.Peer, 0, len(distPeersWithPolicy))
+	distributionGroupPeers := make([]*ComponentPeer, 0, len(distPeersWithPolicy))
 	for pID := range distPeersWithPolicy {
 		peer := a.Peers[pID]
 		if peer == nil {
 			continue
 		}
-		distributionGroupPeers = append(distributionGroupPeers, peer)
+		distributionGroupPeers = append(distributionGroupPeers, peer.ToComponent())
 	}
 	return distributionGroupPeers
 }

management/server/types/account_components.go

@@ -9,9 +9,7 @@ import (
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/management/internals/modules/zones"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/telemetry"
 	"github.com/netbirdio/netbird/route"
 )
@@ -113,7 +111,7 @@ func (a *Account) GetPeerNetworkMapComponents(
 			PeerID:  peerID,
 			Network: a.Network.Copy(),
 			// must include the target peer as it's required on the client
-			Peers: map[string]*nbpeer.Peer{peerID: peer},
+			Peers: map[string]*ComponentPeer{peerID: peer.ToComponent()},
 		})
 	}
 
@@ -126,7 +124,7 @@ func (a *Account) GetPeerNetworkMapComponents(
 			PeerID:  peerID,
 			Network: a.Network.Copy(),
 			// must include the target peer as it's required on the client
-			Peers: map[string]*nbpeer.Peer{peerID: peer},
+			Peers: map[string]*ComponentPeer{peerID: peer.ToComponent()},
 		})
 	}
 
@@ -136,10 +134,10 @@ func (a *Account) GetPeerNetworkMapComponents(
 		NameServerGroups:          make([]*nbdns.NameServerGroup, 0),
 		CustomZoneDomain:          peersCustomZone.Domain,
 		ResourcePoliciesMap:       make(map[string][]*Policy),
-		RoutersMap:                make(map[string]map[string]*routerTypes.NetworkRouter),
-		NetworkResources:          make([]*resourceTypes.NetworkResource, 0),
+		RoutersMap:                make(map[string]map[string]*ComponentRouter),
+		NetworkResources:          make([]*ComponentResource, 0),
 		PostureFailedPeers:        make(map[string]map[string]struct{}, len(a.PostureChecks)),
-		RouterPeers:               make(map[string]*nbpeer.Peer),
+		RouterPeers:               make(map[string]*ComponentPeer),
 		NetworkXIDToPublicID:      make(map[string]string, len(a.Networks)),
 		PostureCheckXIDToPublicID: make(map[string]string, len(a.PostureChecks)),
 	}
@@ -174,7 +172,7 @@ func (a *Account) GetPeerNetworkMapComponents(
 	}
 
 	components.Peers = relevantPeers
-	components.Groups = relevantGroups
+	components.Groups = GroupsToComponent(relevantGroups)
 	components.Policies = relevantPolicies
 	components.Routes = relevantRoutes
 	components.AllDNSRecords = filterDNSRecordsByPeers(peersCustomZone.Records, relevantPeers, peer.SupportsIPv6() && peer.IPv6.IsValid())
@@ -223,7 +221,7 @@ func (a *Account) GetPeerNetworkMapComponents(
 				}
 				for _, pID := range a.getPostureValidPeersSaveFailed(peers, policy.SourcePostureChecks, validatedPeersMap, &components.PostureFailedPeers) {
 					if _, exists := components.Peers[pID]; !exists {
-						components.Peers[pID] = a.GetPeer(pID)
+						components.Peers[pID] = a.GetPeer(pID).ToComponent()
 					}
 				}
 			} else {
@@ -256,14 +254,14 @@ func (a *Account) GetPeerNetworkMapComponents(
 				for _, srcGroupID := range rule.Sources {
 					if g := a.Groups[srcGroupID]; g != nil {
 						if _, exists := components.Groups[srcGroupID]; !exists {
-							components.Groups[srcGroupID] = g
+							components.Groups[srcGroupID] = g.ToComponent()
 						}
 					}
 				}
 				for _, dstGroupID := range rule.Destinations {
 					if g := a.Groups[dstGroupID]; g != nil {
 						if _, exists := components.Groups[dstGroupID]; !exists {
-							components.Groups[dstGroupID] = g
+							components.Groups[dstGroupID] = g.ToComponent()
 						}
 					}
 				}
@@ -278,20 +276,22 @@ func (a *Account) GetPeerNetworkMapComponents(
 		// network in the account — accounts with many tenants/networks
 		// shipped tens of unrelated peers in `peers[]` and `routers_map`.
 		if addSourcePeers {
-			components.RoutersMap[resource.NetworkID] = networkRoutingPeers
+			components.RoutersMap[resource.NetworkID] = routerTypes.ToComponentMap(networkRoutingPeers)
 			for peerIDKey := range networkRoutingPeers {
 				if p := a.Peers[peerIDKey]; p != nil {
-					if _, exists := components.RouterPeers[peerIDKey]; !exists {
-						components.RouterPeers[peerIDKey] = p
+					cp := components.RouterPeers[peerIDKey]
+					if cp == nil {
+						cp = p.ToComponent()
+						components.RouterPeers[peerIDKey] = cp
 					}
 					if _, exists := components.Peers[peerIDKey]; !exists {
 						if _, validated := validatedPeersMap[peerIDKey]; validated {
-							components.Peers[peerIDKey] = p
+							components.Peers[peerIDKey] = cp
 						}
 					}
 				}
 			}
-			components.NetworkResources = append(components.NetworkResources, resource)
+			components.NetworkResources = append(components.NetworkResources, resource.ToComponent())
 		}
 	}
 
@@ -312,14 +312,14 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 	peerSSHEnabled bool,
 	validatedPeersMap map[string]struct{},
 	postureFailedPeers *map[string]map[string]struct{},
-) (map[string]*nbpeer.Peer, map[string]*Group, []*Policy, []*route.Route, sshRequirements) {
-	relevantPeerIDs := make(map[string]*nbpeer.Peer, len(a.Peers)/4)
+) (map[string]*ComponentPeer, map[string]*Group, []*Policy, []*route.Route, sshRequirements) {
+	relevantPeerIDs := make(map[string]*ComponentPeer, len(a.Peers)/4)
 	relevantGroupIDs := make(map[string]*Group, len(a.Groups)/4)
 	relevantPolicies := make([]*Policy, 0, len(a.Policies))
 	relevantRoutes := make([]*route.Route, 0, len(a.Routes))
 	sshReqs := sshRequirements{neededGroupIDs: make(map[string]struct{})}
 
-	relevantPeerIDs[peerID] = a.GetPeer(peerID)
+	relevantPeerIDs[peerID] = a.GetPeer(peerID).ToComponent()
 
 	peerGroupSet := make(map[string]struct{}, 8)
 	for groupID, group := range a.Groups {
@@ -384,7 +384,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 		if r.Peer != "" {
 			if _, ok := validatedPeersMap[r.Peer]; ok {
 				if p := a.GetPeer(r.Peer); p != nil {
-					relevantPeerIDs[r.Peer] = p
+					relevantPeerIDs[r.Peer] = p.ToComponent()
 				}
 			}
 		}
@@ -401,7 +401,7 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 					continue
 				}
 				if p := a.GetPeer(pid); p != nil {
-					relevantPeerIDs[pid] = p
+					relevantPeerIDs[pid] = p.ToComponent()
 				}
 			}
 		}
@@ -458,7 +458,9 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 			if peerInSources {
 				policyRelevant = true
 				for _, pid := range destinationPeers {
-					relevantPeerIDs[pid] = a.GetPeer(pid)
+					if _, exists := relevantPeerIDs[pid]; !exists {
+						relevantPeerIDs[pid] = a.GetPeer(pid).ToComponent()
+					}
 				}
 				for _, dstGroupID := range rule.Destinations {
 					relevantGroupIDs[dstGroupID] = a.GetGroup(dstGroupID)
@@ -468,7 +470,9 @@ func (a *Account) getPeersGroupsPoliciesRoutes(
 			if peerInDestinations {
 				policyRelevant = true
 				for _, pid := range sourcePeers {
-					relevantPeerIDs[pid] = a.GetPeer(pid)
+					if _, exists := relevantPeerIDs[pid]; !exists {
+						relevantPeerIDs[pid] = a.GetPeer(pid).ToComponent()
+					}
 				}
 				for _, srcGroupID := range rule.Sources {
 					relevantGroupIDs[srcGroupID] = a.GetGroup(srcGroupID)
@@ -624,7 +628,7 @@ func (a *Account) getPostureValidPeersSaveFailed(inputPeers []string, postureChe
 // that name them. Calculate() tolerates groups with empty Peers (the inner
 // loops simply iterate zero times), so retaining them is behaviourally a
 // no-op for the legacy path that consumes the same NetworkMapComponents.
-func filterGroupPeers(groups *map[string]*Group, peers map[string]*nbpeer.Peer) {
+func filterGroupPeers(groups *map[string]*ComponentGroup, peers map[string]*ComponentPeer) {
 	for groupID, groupInfo := range *groups {
 		filteredPeers := make([]string, 0, len(groupInfo.Peers))
 		for _, pid := range groupInfo.Peers {
@@ -634,14 +638,14 @@ func filterGroupPeers(groups *map[string]*Group, peers map[string]*nbpeer.Peer)
 		}
 
 		if len(filteredPeers) != len(groupInfo.Peers) {
-			ng := groupInfo.Copy()
+			ng := *groupInfo
 			ng.Peers = filteredPeers
-			(*groups)[groupID] = ng
+			(*groups)[groupID] = &ng
 		}
 	}
 }
 
-func filterPostureFailedPeers(postureFailedPeers *map[string]map[string]struct{}, policies []*Policy, resourcePoliciesMap map[string][]*Policy, peers map[string]*nbpeer.Peer) {
+func filterPostureFailedPeers(postureFailedPeers *map[string]map[string]struct{}, policies []*Policy, resourcePoliciesMap map[string][]*Policy, peers map[string]*ComponentPeer) {
 	if len(*postureFailedPeers) == 0 {
 		return
 	}
@@ -676,7 +680,7 @@ func filterPostureFailedPeers(postureFailedPeers *map[string]map[string]struct{}
 	}
 }
 
-func filterDNSRecordsByPeers(records []nbdns.SimpleRecord, peers map[string]*nbpeer.Peer, includeIPv6 bool) []nbdns.SimpleRecord {
+func filterDNSRecordsByPeers(records []nbdns.SimpleRecord, peers map[string]*ComponentPeer, includeIPv6 bool) []nbdns.SimpleRecord {
 	if len(records) == 0 || len(peers) == 0 {
 		return nil
 	}

management/server/types/account_private_netmap_test.go

@@ -9,7 +9,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 )
 
 func TestPrivateService_NetworkMap_UserPeer_AndProxyPeer(t *testing.T) {
@@ -49,7 +48,7 @@ func TestPrivateService_NetworkMap_UserPeer_AndProxyPeer(t *testing.T) {
 	})
 }
 
-func netmapPeerIDs(peers []*nbpeer.Peer) []string {
+func netmapPeerIDs(peers []*ComponentPeer) []string {
 	ids := make([]string, 0, len(peers))
 	for _, p := range peers {
 		if p == nil {

management/server/types/account_test.go

@@ -666,7 +666,7 @@ func Test_ExpandPortsAndRanges_SSHRuleExpansion(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := ExpandPortsAndRanges(tt.base, tt.rule, tt.peer)
+			result := ExpandPortsAndRanges(tt.base, tt.rule, tt.peer.ToComponent())
 
 			var ports []string
 			for _, fr := range result {

management/server/types/aliases.go

@@ -6,7 +6,6 @@ import (
 	"net"
 	"net/netip"
 
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	nbroute "github.com/netbirdio/netbird/route"
 	sharedtypes "github.com/netbirdio/netbird/shared/management/types"
 )
@@ -18,9 +17,6 @@ type DNSSettings = sharedtypes.DNSSettings
 
 type FirewallRule = sharedtypes.FirewallRule
 
-type Group = sharedtypes.Group
-type GroupPeer = sharedtypes.GroupPeer
-
 type Network = sharedtypes.Network
 type NetworkMap = sharedtypes.NetworkMap
 type ForwardingRule = sharedtypes.ForwardingRule
@@ -42,6 +38,18 @@ type RouteFirewallRule = sharedtypes.RouteFirewallRule
 
 type NetworkMapComponents = sharedtypes.NetworkMapComponents
 
+type ComponentPeer = sharedtypes.ComponentPeer
+type ComponentGroup = sharedtypes.ComponentGroup
+type ComponentRouter = sharedtypes.ComponentRouter
+type ComponentResource = sharedtypes.ComponentResource
+type ComponentResourceType = sharedtypes.ComponentResourceType
+
+const (
+	ComponentResourceHost   = sharedtypes.ComponentResourceHost
+	ComponentResourceSubnet = sharedtypes.ComponentResourceSubnet
+	ComponentResourceDomain = sharedtypes.ComponentResourceDomain
+)
+
 var EmptyNetworkMapComponents = sharedtypes.EmptyNetworkMapComponents
 
 type AccountSettingsInfo = sharedtypes.AccountSettingsInfo
@@ -52,12 +60,7 @@ type NetworkMapComponentsCompact = sharedtypes.NetworkMapComponentsCompact
 type LookupMap = sharedtypes.LookupMap
 type FirewallRuleContext = sharedtypes.FirewallRuleContext
 
-const (
-	GroupIssuedAPI         = sharedtypes.GroupIssuedAPI
-	GroupIssuedJWT         = sharedtypes.GroupIssuedJWT
-	GroupIssuedIntegration = sharedtypes.GroupIssuedIntegration
-	GroupAllName           = sharedtypes.GroupAllName
-)
+const GroupAllName = sharedtypes.GroupAllName
 
 // Function forwarders preserve types.X(...) call sites that previously
 // resolved to package-local funcs. Plain forwarders (not var aliases) keep
@@ -67,11 +70,11 @@ func PolicyRuleImpliesLegacySSH(rule *PolicyRule) bool {
 	return sharedtypes.PolicyRuleImpliesLegacySSH(rule)
 }
 
-func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *nbpeer.Peer) []*FirewallRule {
+func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *ComponentPeer) []*FirewallRule {
 	return sharedtypes.ExpandPortsAndRanges(base, rule, peer)
 }
 
-func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *nbpeer.Peer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
+func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *ComponentPeer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
 	return sharedtypes.AppendIPv6FirewallRule(rules, rulesExists, peer, targetPeer, rule, rc)
 }
 
@@ -79,7 +82,7 @@ func CalculateNetworkMapFromComponents(ctx context.Context, components *NetworkM
 	return sharedtypes.CalculateNetworkMapFromComponents(ctx, components)
 }
 
-func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int, includeIPv6 bool) []*RouteFirewallRule {
+func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*ComponentPeer, direction int, includeIPv6 bool) []*RouteFirewallRule {
 	return sharedtypes.GenerateRouteFirewallRules(ctx, route, rule, groupPeers, direction, includeIPv6)
 }
 

management/server/types/group.go

@@ -2,7 +2,6 @@ package types
 
 import (
 	"github.com/netbirdio/netbird/management/server/integration_reference"
-	"github.com/netbirdio/netbird/management/server/networks/resources/types"
 )
 
 const (
@@ -68,10 +67,6 @@ func (g *Group) EventMeta() map[string]any {
 	return map[string]any{"name": g.Name}
 }
 
-func (g *Group) EventMetaResource(resource *types.NetworkResource) map[string]any {
-	return map[string]any{"name": g.Name, "id": g.ID, "resource_name": resource.Name, "resource_id": resource.ID, "resource_type": resource.Type}
-}
-
 func (g *Group) Copy() *Group {
 	group := &Group{
 		ID:                   g.ID,
@@ -95,14 +90,39 @@ func (g *Group) HasPeers() bool {
 	return len(g.Peers) > 0
 }
 
-// GroupAllName is the reserved name of the default group that contains every peer in an account.
-const GroupAllName = "All"
-
 // IsGroupAll checks if the group is a default "All" group.
 func (g *Group) IsGroupAll() bool {
 	return g.Name == GroupAllName
 }
 
+// ToComponent converts the group to its self-contained components
+// representation. The Peers slice is shared, not copied — components are
+// treated as immutable snapshots. Returns nil for a nil group.
+func (g *Group) ToComponent() *ComponentGroup {
+	if g == nil {
+		return nil
+	}
+	return &ComponentGroup{
+		ID:       g.ID,
+		PublicID: g.PublicID,
+		Name:     g.Name,
+		Peers:    g.Peers,
+	}
+}
+
+// GroupsToComponent converts an id-keyed group map to its components
+// representation, preserving nil entries.
+func GroupsToComponent(groups map[string]*Group) map[string]*ComponentGroup {
+	if groups == nil {
+		return nil
+	}
+	out := make(map[string]*ComponentGroup, len(groups))
+	for id, g := range groups {
+		out[id] = g.ToComponent()
+	}
+	return out
+}
+
 // AddPeer adds peerID to Peers if not present, returning true if added.
 func (g *Group) AddPeer(peerID string) bool {
 	if peerID == "" {

management/server/types/ipv6_endtoend_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
 )
 
 func TestNetworkMapComponents_IPv6EndToEnd(t *testing.T) {
@@ -104,7 +105,7 @@ func TestNetworkMapComponents_RemotePeerWithoutCapability(t *testing.T) {
 	require.NotNil(t, nm)
 
 	t.Run("AllowedIPs include remote v6", func(t *testing.T) {
-		var dst *nbpeer.Peer
+		var dst *types.ComponentPeer
 		for _, p := range nm.Peers {
 			if p.ID == "peer-dst-1" {
 				dst = p

management/server/types/networkmap_components_test.go

@@ -49,7 +49,7 @@ func allPeersValidated(account *types.Account, excludePeerIDs ...string) map[str
 	return validated
 }
 
-func peerIDs(peers []*nbpeer.Peer) []string {
+func peerIDs(peers []*types.ComponentPeer) []string {
 	ids := make([]string, len(peers))
 	for i, p := range peers {
 		ids[i] = p.ID

management/server/util/util.go

@@ -19,34 +19,3 @@ func Difference(a, b []string) []string {
 func ToPtr[T any](value T) *T {
 	return &value
 }
-
-type comparableObject[T any] interface {
-	Equal(other T) bool
-}
-
-func MergeUnique[T comparableObject[T]](arr1, arr2 []T) []T {
-	var result []T
-
-	for _, item := range arr1 {
-		if !contains(result, item) {
-			result = append(result, item)
-		}
-	}
-
-	for _, item := range arr2 {
-		if !contains(result, item) {
-			result = append(result, item)
-		}
-	}
-
-	return result
-}
-
-func contains[T comparableObject[T]](slice []T, element T) bool {
-	for _, item := range slice {
-		if item.Equal(element) {
-			return true
-		}
-	}
-	return false
-}

proxy/cmd/proxy/cmd/root.go

@@ -79,6 +79,9 @@ var (
 	geoDataDir            string
 	crowdsecAPIURL        string
 	crowdsecAPIKey        string
+	appsecURL             string
+	appsecTimeout         time.Duration
+	appsecMaxBodyBytes    int64
 )
 
 var rootCmd = &cobra.Command{
@@ -125,6 +128,9 @@ func init() {
 	rootCmd.Flags().StringVar(&geoDataDir, "geo-data-dir", envStringOrDefault("NB_PROXY_GEO_DATA_DIR", "/var/lib/netbird/geolocation"), "Directory for the GeoLite2 MMDB file (auto-downloaded if missing)")
 	rootCmd.Flags().StringVar(&crowdsecAPIURL, "crowdsec-api-url", envStringOrDefault("NB_PROXY_CROWDSEC_API_URL", ""), "CrowdSec LAPI URL for IP reputation checks")
 	rootCmd.Flags().StringVar(&crowdsecAPIKey, "crowdsec-api-key", envStringOrDefault("NB_PROXY_CROWDSEC_API_KEY", ""), "CrowdSec bouncer API key")
+	rootCmd.Flags().StringVar(&appsecURL, "crowdsec-appsec-url", envStringOrDefault("NB_PROXY_CROWDSEC_APPSEC_URL", ""), "CrowdSec AppSec (WAF) endpoint for HTTP request inspection, e.g. http://127.0.0.1:7422/ (reuses the bouncer API key)")
+	rootCmd.Flags().DurationVar(&appsecTimeout, "crowdsec-appsec-timeout", envDurationOrDefault("NB_PROXY_CROWDSEC_APPSEC_TIMEOUT", 0), "Timeout for a single AppSec inspection call (0 = 200ms)")
+	rootCmd.Flags().Int64Var(&appsecMaxBodyBytes, "crowdsec-appsec-max-body-bytes", envInt64OrDefault("NB_PROXY_CROWDSEC_APPSEC_MAX_BODY_BYTES", 0), "Cap on the request body mirrored to AppSec (0 = 64KiB, negative = headers and URI only)")
 }
 
 // Execute runs the root command.
@@ -219,41 +225,44 @@ func runServer(cmd *cobra.Command, args []string) error {
 	defer stop()
 
 	srv := proxy.New(ctx, proxy.Config{
-		ListenAddr:               addr,
-		Logger:                   logger,
-		Version:                  Version,
-		ManagementAddress:        mgmtAddr,
-		ProxyURL:                 proxyDomain,
-		ProxyToken:               proxyToken,
-		CertificateDirectory:     certDir,
-		CertificateFile:          certFile,
-		CertificateKeyFile:       certKeyFile,
-		GenerateACMECertificates: acmeCerts,
-		ACMEChallengeAddress:     acmeAddr,
-		ACMEDirectory:            acmeDir,
-		ACMEEABKID:               acmeEABKID,
-		ACMEEABHMACKey:           acmeEABHMACKey,
-		ACMEChallengeType:        acmeChallengeType,
-		DebugEndpointEnabled:     debugEndpoint,
-		DebugEndpointAddress:     debugEndpointAddr,
-		HealthAddr:               healthAddr,
-		ForwardedProto:           forwardedProto,
-		TrustedProxies:           parsedTrustedProxies,
-		CertLockMethod:           nbacme.CertLockMethod(certLockMethod),
-		WildcardCertDir:          wildcardCertDir,
-		WireguardPort:            wgPort,
-		Performance:              perf,
-		ProxyProtocol:            proxyProtocol,
-		PreSharedKey:             preSharedKey,
-		SupportsCustomPorts:      supportsCustomPorts,
-		RequireSubdomain:         requireSubdomain,
-		Private:                  private,
-		MaxDialTimeout:           maxDialTimeout,
-		MaxSessionIdleTimeout:    maxSessionIdleTimeout,
-		MappingBatchWatchdog:     envDurationOrDefault("NB_PROXY_MAPPING_BATCH_WATCHDOG", 0),
-		GeoDataDir:               geoDataDir,
-		CrowdSecAPIURL:           crowdsecAPIURL,
-		CrowdSecAPIKey:           crowdsecAPIKey,
+		ListenAddr:                 addr,
+		Logger:                     logger,
+		Version:                    Version,
+		ManagementAddress:          mgmtAddr,
+		ProxyURL:                   proxyDomain,
+		ProxyToken:                 proxyToken,
+		CertificateDirectory:       certDir,
+		CertificateFile:            certFile,
+		CertificateKeyFile:         certKeyFile,
+		GenerateACMECertificates:   acmeCerts,
+		ACMEChallengeAddress:       acmeAddr,
+		ACMEDirectory:              acmeDir,
+		ACMEEABKID:                 acmeEABKID,
+		ACMEEABHMACKey:             acmeEABHMACKey,
+		ACMEChallengeType:          acmeChallengeType,
+		DebugEndpointEnabled:       debugEndpoint,
+		DebugEndpointAddress:       debugEndpointAddr,
+		HealthAddr:                 healthAddr,
+		ForwardedProto:             forwardedProto,
+		TrustedProxies:             parsedTrustedProxies,
+		CertLockMethod:             nbacme.CertLockMethod(certLockMethod),
+		WildcardCertDir:            wildcardCertDir,
+		WireguardPort:              wgPort,
+		Performance:                perf,
+		ProxyProtocol:              proxyProtocol,
+		PreSharedKey:               preSharedKey,
+		SupportsCustomPorts:        supportsCustomPorts,
+		RequireSubdomain:           requireSubdomain,
+		Private:                    private,
+		MaxDialTimeout:             maxDialTimeout,
+		MaxSessionIdleTimeout:      maxSessionIdleTimeout,
+		MappingBatchWatchdog:       envDurationOrDefault("NB_PROXY_MAPPING_BATCH_WATCHDOG", 0),
+		GeoDataDir:                 geoDataDir,
+		CrowdSecAPIURL:             crowdsecAPIURL,
+		CrowdSecAPIKey:             crowdsecAPIKey,
+		CrowdSecAppSecURL:          appsecURL,
+		CrowdSecAppSecTimeout:      appsecTimeout,
+		CrowdSecAppSecMaxBodyBytes: appsecMaxBodyBytes,
 	})
 
 	return srv.ListenAndServe(ctx, addr)
@@ -293,6 +302,19 @@ func envUint16OrDefault(key string, def uint16) uint16 {
 	return uint16(parsed)
 }
 
+func envInt64OrDefault(key string, def int64) int64 {
+	v, exists := os.LookupEnv(key)
+	if !exists {
+		return def
+	}
+	parsed, err := strconv.ParseInt(v, 10, 64)
+	if err != nil {
+		log.Warnf("parse %s=%q: %v, using default %d", key, v, err, def)
+		return def
+	}
+	return parsed
+}
+
 func envDurationOrDefault(key string, def time.Duration) time.Duration {
 	v, exists := os.LookupEnv(key)
 	if !exists {

proxy/internal/appsec/body.go

@@ -0,0 +1,112 @@
+package appsec
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"mime"
+	"net/http"
+	"net/url"
+	"slices"
+	"strconv"
+)
+
+// bufferBody reads up to limit+1 bytes from r.Body and always restores r.Body so
+// the request stays forwardable. oversize reports that the body exceeded limit, in
+// which case the returned prefix must not be used for inspection: the bytes are
+// only read so they can be replayed to the backend.
+func bufferBody(r *http.Request, limit int64) (body []byte, oversize bool, err error) {
+	original := r.Body
+	buf, readErr := io.ReadAll(io.LimitReader(original, limit+1))
+	if readErr != nil && !errors.Is(readErr, io.EOF) {
+		// Restore what was read so a downstream retry sees a consistent stream,
+		// then surface the failure.
+		r.Body = replay(buf, original)
+		return nil, false, readErr
+	}
+
+	if int64(len(buf)) > limit {
+		r.Body = replay(buf, original)
+		return nil, true, nil
+	}
+
+	// The whole body is buffered, so the original is drained and can be closed.
+	// A close error on a drained read-only body does not invalidate the bytes.
+	_ = original.Close()
+	r.Body = io.NopCloser(bytes.NewReader(buf))
+	if r.ContentLength <= 0 {
+		// A chunked request now has a known length. Keep ContentLength and the
+		// header in agreement so the upstream request is framed consistently.
+		r.ContentLength = int64(len(buf))
+		r.Header.Set("Content-Length", strconv.Itoa(len(buf)))
+		r.Header.Del("Transfer-Encoding")
+		r.TransferEncoding = nil
+	}
+	return buf, false, nil
+}
+
+// replay returns a ReadCloser that yields the already-read prefix followed by
+// the remainder of the original stream, and closes the original.
+func replay(prefix []byte, rest io.ReadCloser) io.ReadCloser {
+	return struct {
+		io.Reader
+		io.Closer
+	}{
+		Reader: io.MultiReader(bytes.NewReader(prefix), rest),
+		Closer: rest,
+	}
+}
+
+// redactedPlaceholder replaces a credential value in the mirrored body. It is
+// inert for rule matching, and its fixed length leaks nothing about the secret.
+const redactedPlaceholder = "redacted"
+
+// redactFormFields returns the body to mirror for a URL-encoded form, with the
+// values of the named fields replaced. The proxy's own password / PIN login
+// form posts to the service path itself, so without this the plaintext
+// credential would reach the Security Engine.
+//
+// Only the credential values are removed, never the whole body: dropping the
+// body outright would let a caller exempt any payload from inspection just by
+// appending a field named "password". Everything else in the form stays
+// inspectable, which is the point.
+//
+// Returns body unchanged when it is not a URL-encoded form or carries none of
+// the fields. Note that url.ParseQuery returns whatever it could parse
+// alongside an error, and the login handler reads the form with the same
+// tolerance, so a partially parsable body carrying a credential is still
+// redacted (and re-encoded from the parsed subset) rather than sent raw.
+//
+// Field names match case-sensitively, on purpose: the caller passes the exact
+// names the login handler reads via r.FormValue, and that lookup is itself
+// case-sensitive. A "Password" field is therefore never a credential as far as
+// the proxy is concerned, and redacting it would only blind the WAF to a value
+// the proxy does not own.
+func redactFormFields(contentType string, body []byte, fields []string) []byte {
+	if len(fields) == 0 || len(body) == 0 {
+		return body
+	}
+	media, _, err := mime.ParseMediaType(contentType)
+	if err != nil || media != "application/x-www-form-urlencoded" {
+		return body
+	}
+
+	values, parseErr := url.ParseQuery(string(body))
+	redacted := false
+	for field := range values {
+		if !slices.Contains(fields, field) {
+			continue
+		}
+		for i := range values[field] {
+			values[field][i] = redactedPlaceholder
+		}
+		redacted = true
+	}
+	if !redacted {
+		// Nothing to protect. A body that failed to parse is forwarded as-is:
+		// it carries no credential the login handler could read either.
+		_ = parseErr
+		return body
+	}
+	return []byte(values.Encode())
+}

proxy/internal/appsec/client.go

@@ -0,0 +1,376 @@
+// Package appsec implements the CrowdSec AppSec (WAF) side of the remediation
+// component protocol: each inspected HTTP request is mirrored to the Security
+// Engine's AppSec endpoint, which replies with an allow / ban / captcha verdict
+// for that request.
+//
+// This is a separate endpoint from the LAPI decision stream used by the
+// crowdsec package: LAPI answers "is this IP known bad", AppSec answers "is
+// this request an attack". The two are configured and enabled independently.
+package appsec
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"strings"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/proxy/internal/restrict"
+)
+
+// Header names the AppSec component reads off the mirrored request. IP, URI and
+// Verb are mandatory: the engine answers 500 when any of them is missing.
+const (
+	headerAPIKey        = "X-Crowdsec-Appsec-Api-Key" //nolint:gosec // G101: a header name, not a credential
+	headerIP            = "X-Crowdsec-Appsec-Ip"
+	headerURI           = "X-Crowdsec-Appsec-Uri"
+	headerVerb          = "X-Crowdsec-Appsec-Verb"
+	headerHost          = "X-Crowdsec-Appsec-Host"
+	headerUserAgent     = "X-Crowdsec-Appsec-User-Agent"
+	headerHTTPVersion   = "X-Crowdsec-Appsec-Http-Version"
+	headerTransactionID = "X-Crowdsec-Appsec-Transaction-Id"
+)
+
+// headerPrefix covers every protocol header. Any client-supplied header in this
+// namespace is dropped before forwarding so a caller cannot influence the
+// engine's view of its own address, or replay an API key.
+const headerPrefix = "X-Crowdsec-Appsec-"
+
+// Remediation actions the engine can return.
+const (
+	actionAllow   = "allow"
+	actionBan     = "ban"
+	actionCaptcha = "captcha"
+)
+
+const (
+	// DefaultTimeout matches the 200ms budget CrowdSec's remediation component
+	// spec sets for the blocking AppSec call.
+	DefaultTimeout = 200 * time.Millisecond
+	// MinTimeout and MaxTimeout bound the configured inspection timeout.
+	// Inspection is synchronous, so the upper bound is what keeps a
+	// mis-set value from parking every request to an inspected service on a
+	// slow engine; the lower bound keeps the call from timing out before the
+	// engine can realistically answer. Mirrors the per-middleware bounds the
+	// proxy already applies to in-path calls.
+	MinTimeout = 10 * time.Millisecond
+	MaxTimeout = 5 * time.Second
+	// DefaultMaxBodyBytes caps the request body mirrored to the engine.
+	// Requests with a larger body are inspected on headers and URI only.
+	DefaultMaxBodyBytes int64 = 64 << 10
+	// MaxBodyBytesLimit is the ceiling for that cap. Each in-flight inspected
+	// request holds its buffered body in memory with no shared budget, so the
+	// worst case is this value times the concurrent request count. Matches the
+	// proxy-wide body-capture ceiling.
+	MaxBodyBytesLimit int64 = 8 << 20
+	// maxResponseBytes bounds how much of a verdict response is read. The
+	// engine answers with a two-field JSON object, so anything beyond this is
+	// not a response we can act on.
+	maxResponseBytes int64 = 4 << 10
+)
+
+// ErrUnavailable reports that the engine could not produce a verdict: the call
+// failed, timed out, or the engine rejected it (401 bad key, 500 malformed).
+// Distinguished from a block verdict so the caller can apply the per-service
+// mode: enforce fails closed, observe allows.
+var ErrUnavailable = errors.New("appsec engine unavailable")
+
+// Config configures a Client.
+type Config struct {
+	// URL is the AppSec endpoint, e.g. http://127.0.0.1:7422/.
+	URL string
+	// APIKey is the CrowdSec bouncer API key. The AppSec component validates it
+	// against LAPI, so the same key used for the decision stream works here.
+	APIKey string
+	// Timeout bounds a single inspection call. Zero means DefaultTimeout.
+	Timeout time.Duration
+	// MaxBodyBytes caps the mirrored request body. Zero means
+	// DefaultMaxBodyBytes; negative disables body forwarding entirely.
+	MaxBodyBytes int64
+	Logger       *log.Entry
+}
+
+// Client mirrors HTTP requests to a CrowdSec AppSec endpoint. It holds no
+// per-service state and is safe for concurrent use.
+type Client struct {
+	url          string
+	apiKey       string
+	maxBodyBytes int64
+	http         *http.Client
+	logger       *log.Entry
+}
+
+// New validates the config and returns a Client. The endpoint is not contacted
+// here: the engine may come up after the proxy.
+func New(cfg Config) (*Client, error) {
+	if cfg.URL == "" {
+		return nil, errors.New("appsec url is empty")
+	}
+	if cfg.APIKey == "" {
+		return nil, errors.New("appsec api key is empty")
+	}
+	parsed, err := url.Parse(cfg.URL)
+	if err != nil {
+		return nil, fmt.Errorf("parse appsec url: %w", err)
+	}
+	if parsed.Scheme != "http" && parsed.Scheme != "https" {
+		return nil, fmt.Errorf("appsec url scheme %q is not http(s)", parsed.Scheme)
+	}
+	if parsed.Host == "" {
+		return nil, errors.New("appsec url has no host")
+	}
+
+	logger := cfg.Logger
+	if logger == nil {
+		logger = log.NewEntry(log.StandardLogger())
+	}
+
+	timeout := cfg.Timeout
+	switch {
+	case timeout <= 0:
+		timeout = DefaultTimeout
+	case timeout < MinTimeout:
+		logger.Warnf("appsec timeout %s is below the minimum, using %s", timeout, MinTimeout)
+		timeout = MinTimeout
+	case timeout > MaxTimeout:
+		logger.Warnf("appsec timeout %s exceeds the maximum, using %s", timeout, MaxTimeout)
+		timeout = MaxTimeout
+	}
+
+	// A negative cap is meaningful: forward no body at all.
+	maxBody := cfg.MaxBodyBytes
+	switch {
+	case maxBody == 0:
+		maxBody = DefaultMaxBodyBytes
+	case maxBody > MaxBodyBytesLimit:
+		logger.Warnf("appsec max body %d exceeds the maximum, using %d", maxBody, MaxBodyBytesLimit)
+		maxBody = MaxBodyBytesLimit
+	}
+
+	return &Client{
+		url:          cfg.URL,
+		apiKey:       cfg.APIKey,
+		maxBodyBytes: maxBody,
+		logger:       logger,
+		http: &http.Client{
+			Timeout: timeout,
+			Transport: &http.Transport{
+				MaxIdleConns:        100,
+				MaxIdleConnsPerHost: 32,
+				IdleConnTimeout:     90 * time.Second,
+			},
+		},
+	}, nil
+}
+
+// Request is one inspection request.
+type Request struct {
+	// HTTP is the in-flight client request. Inspect buffers and restores its
+	// body, so the request stays forwardable afterwards.
+	HTTP *http.Request
+	// ClientIP is the resolved client address (after trusted-proxy handling).
+	ClientIP netip.Addr
+	// TransactionID correlates the engine's alert with the proxy's access log
+	// entry. Empty lets the engine generate its own UUID.
+	TransactionID string
+	// RedactBodyFields lists form fields whose values are replaced before the
+	// body is mirrored. Used to keep credentials submitted to the proxy's own
+	// login form out of the engine while still inspecting the rest.
+	RedactBodyFields []string
+}
+
+// Inspect mirrors r to the AppSec engine and returns its verdict. A nil error
+// with restrict.Allow means the request passed. On failure it returns
+// DenyAppSecUnavailable wrapped with ErrUnavailable; the caller decides whether
+// that blocks, based on the per-service mode.
+func (c *Client) Inspect(ctx context.Context, req Request) (restrict.Verdict, error) {
+	if c == nil {
+		return restrict.DenyAppSecUnavailable, ErrUnavailable
+	}
+	if req.HTTP == nil {
+		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: nil request", ErrUnavailable)
+	}
+
+	body, err := c.readBody(req)
+	if err != nil {
+		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: read body: %w", ErrUnavailable, err)
+	}
+
+	outbound, err := c.buildRequest(ctx, req, body)
+	if err != nil {
+		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: %w", ErrUnavailable, err)
+	}
+
+	resp, err := c.http.Do(outbound)
+	if err != nil {
+		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: %w", ErrUnavailable, err)
+	}
+	defer func() {
+		// Drain before closing. net/http only returns a connection to the idle
+		// pool once its body is read to EOF; closing with bytes outstanding
+		// discards it. Every verdict carries a JSON body, so skipping this
+		// would cost a fresh handshake per inspected request, inside the
+		// timeout budget.
+		if _, err := io.Copy(io.Discard, io.LimitReader(resp.Body, maxResponseBytes)); err != nil {
+			c.logger.Tracef("drain appsec response body: %v", err)
+		}
+		if err := resp.Body.Close(); err != nil {
+			c.logger.Tracef("close appsec response body: %v", err)
+		}
+	}()
+
+	return c.verdict(resp)
+}
+
+// readBody buffers the body so it can be mirrored, always restoring it on the
+// original request. Returns nil when there is no body to forward: no body at
+// all, an upgrade request, or a body over the cap. A login form is forwarded
+// with its credential values redacted rather than suppressed.
+func (c *Client) readBody(req Request) ([]byte, error) {
+	r := req.HTTP
+	if c.maxBodyBytes < 0 || r.Body == nil || r.Body == http.NoBody {
+		return nil, nil
+	}
+	// Upgrade requests (websockets) have no meaningful request body and their
+	// stream must not be consumed here.
+	if r.Header.Get("Upgrade") != "" || strings.EqualFold(r.Header.Get("Connection"), "upgrade") {
+		return nil, nil
+	}
+	// A Content-Length over the cap is known to be too large before reading.
+	if r.ContentLength > c.maxBodyBytes {
+		return nil, nil
+	}
+
+	body, oversize, err := bufferBody(r, c.maxBodyBytes)
+	if err != nil {
+		return nil, err
+	}
+	// An oversize body was only partially read: a truncated prefix changes the
+	// engine's verdict in both directions, so inspect headers and URI only.
+	if oversize {
+		return nil, nil
+	}
+	return redactFormFields(r.Header.Get("Content-Type"), body, req.RedactBodyFields), nil
+}
+
+// buildRequest assembles the mirrored request. Per the protocol it is a GET
+// when there is no body and a POST otherwise; bytes.Reader gives the outbound
+// request an accurate Content-Length, which the engine relies on to read the
+// body at all.
+func (c *Client) buildRequest(ctx context.Context, req Request, body []byte) (*http.Request, error) {
+	method := http.MethodGet
+	var payload io.Reader
+	if len(body) > 0 {
+		method = http.MethodPost
+		payload = bytes.NewReader(body)
+	}
+
+	outbound, err := http.NewRequestWithContext(ctx, method, c.url, payload)
+	if err != nil {
+		return nil, fmt.Errorf("build appsec request: %w", err)
+	}
+
+	r := req.HTTP
+	copyInspectableHeaders(outbound.Header, r.Header)
+
+	outbound.Header.Set(headerAPIKey, c.apiKey)
+	outbound.Header.Set(headerIP, req.ClientIP.Unmap().String())
+	outbound.Header.Set(headerURI, r.URL.RequestURI())
+	outbound.Header.Set(headerVerb, r.Method)
+	outbound.Header.Set(headerHost, r.Host)
+	if ua := r.UserAgent(); ua != "" {
+		outbound.Header.Set(headerUserAgent, ua)
+	}
+	outbound.Header.Set(headerHTTPVersion, httpVersion(r))
+	if req.TransactionID != "" {
+		outbound.Header.Set(headerTransactionID, req.TransactionID)
+	}
+	return outbound, nil
+}
+
+// verdict maps the engine's response to a restrict.Verdict. 200 is a pass and
+// 401/500 are engine-side failures; every other status carries a remediation in
+// the body. The blocked status code is operator-configurable
+// (blocked_http_code), so the action field decides, not the status.
+func (c *Client) verdict(resp *http.Response) (restrict.Verdict, error) {
+	switch resp.StatusCode {
+	case http.StatusOK:
+		return restrict.Allow, nil
+	case http.StatusUnauthorized:
+		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: rejected api key", ErrUnavailable)
+	case http.StatusInternalServerError:
+		return restrict.DenyAppSecUnavailable, fmt.Errorf("%w: engine error", ErrUnavailable)
+	}
+
+	var decoded struct {
+		Action string `json:"action"`
+	}
+	if err := json.NewDecoder(io.LimitReader(resp.Body, maxResponseBytes)).Decode(&decoded); err != nil {
+		// A non-2xx status with an unreadable body is still a block: the engine
+		// answered, we just cannot tell which remediation it chose.
+		c.logger.Debugf("failed to decode appsec response (status %d): %v", resp.StatusCode, err)
+		return restrict.DenyAppSecBan, nil
+	}
+
+	switch decoded.Action {
+	case actionAllow:
+		return restrict.Allow, nil
+	case actionCaptcha:
+		return restrict.DenyAppSecCaptcha, nil
+	case actionBan:
+		return restrict.DenyAppSecBan, nil
+	default:
+		// Unknown remediation: the engine flagged the request, so deny.
+		c.logger.Debugf("unknown appsec action %q (status %d), treating as ban", decoded.Action, resp.StatusCode)
+		return restrict.DenyAppSecBan, nil
+	}
+}
+
+// copyInspectableHeaders copies the client's headers, which are what the WAF
+// rules actually match on, dropping hop-by-hop headers that describe the
+// proxy-to-engine connection rather than the client request, and any header in
+// the AppSec protocol namespace.
+func copyInspectableHeaders(dst, src http.Header) {
+	for name, values := range src {
+		if hopByHopHeaders[http.CanonicalHeaderKey(name)] {
+			continue
+		}
+		if strings.HasPrefix(http.CanonicalHeaderKey(name), headerPrefix) {
+			continue
+		}
+		dst[http.CanonicalHeaderKey(name)] = append([]string(nil), values...)
+	}
+	// Content-Length describes the mirrored payload, not the client's: net/http
+	// sets it from the body we actually attach. Content-Type is kept either way
+	// so rules matching on it still fire when the body was not forwarded.
+	dst.Del("Content-Length")
+}
+
+var hopByHopHeaders = map[string]bool{
+	"Connection":          true,
+	"Keep-Alive":          true,
+	"Proxy-Authenticate":  true,
+	"Proxy-Authorization": true,
+	"Proxy-Connection":    true,
+	"Te":                  true,
+	"Trailer":             true,
+	"Transfer-Encoding":   true,
+	"Upgrade":             true,
+}
+
+// httpVersion renders the two-digit form the engine parses ("11", "20").
+func httpVersion(r *http.Request) string {
+	major, minor := r.ProtoMajor, r.ProtoMinor
+	if major < 0 || major > 9 || minor < 0 || minor > 9 {
+		return ""
+	}
+	return fmt.Sprintf("%d%d", major, minor)
+}

proxy/internal/appsec/client_test.go

@@ -0,0 +1,518 @@
+package appsec
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/restrict"
+)
+
+// engine records what the AppSec component received and replies with a
+// canned status and body.
+type engine struct {
+	status int
+	body   string
+
+	gotMethod string
+	gotHeader http.Header
+	gotBody   []byte
+	gotLength int64
+	requests  int
+}
+
+func (e *engine) start(t *testing.T) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, err := io.ReadAll(r.Body)
+		require.NoError(t, err)
+		e.requests++
+		e.gotMethod = r.Method
+		e.gotHeader = r.Header.Clone()
+		e.gotBody = body
+		e.gotLength = r.ContentLength
+
+		status := e.status
+		if status == 0 {
+			status = http.StatusOK
+		}
+		w.WriteHeader(status)
+		if e.body != "" {
+			_, _ = w.Write([]byte(e.body))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+func newClient(t *testing.T, url string, cfg ...func(*Config)) *Client {
+	t.Helper()
+	c := Config{URL: url, APIKey: "test-key"}
+	for _, fn := range cfg {
+		fn(&c)
+	}
+	client, err := New(c)
+	require.NoError(t, err)
+	return client
+}
+
+func inbound(method, target string, body string) *http.Request {
+	var r *http.Request
+	if body == "" {
+		r = httptest.NewRequest(method, target, nil)
+	} else {
+		r = httptest.NewRequest(method, target, strings.NewReader(body))
+	}
+	r.Host = "svc.example.com"
+	r.Header.Set("User-Agent", "curl/8.0")
+	return r
+}
+
+func TestNew_RejectsBadConfig(t *testing.T) {
+	tests := []struct {
+		name string
+		cfg  Config
+	}{
+		{"empty url", Config{APIKey: "k"}},
+		{"empty key", Config{URL: "http://127.0.0.1:7422/"}},
+		{"non http scheme", Config{URL: "tcp://127.0.0.1:7422", APIKey: "k"}},
+		{"no host", Config{URL: "http:///path", APIKey: "k"}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := New(tt.cfg)
+			require.Error(t, err)
+		})
+	}
+}
+
+func TestInspect_AllowSendsProtocolHeaders(t *testing.T) {
+	eng := &engine{status: http.StatusOK, body: `{"action":"allow","http_status":200}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL)
+
+	r := inbound(http.MethodGet, "http://svc.example.com/admin?q=1", "")
+	r.Header.Set("Cookie", "session=abc")
+
+	verdict, err := client.Inspect(context.Background(), Request{
+		HTTP:          r,
+		ClientIP:      netip.MustParseAddr("203.0.113.7"),
+		TransactionID: "req-42",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, restrict.Allow, verdict, "allow action must pass the request")
+
+	assert.Equal(t, http.MethodGet, eng.gotMethod, "a bodyless request is forwarded as GET")
+	assert.Equal(t, "203.0.113.7", eng.gotHeader.Get(headerIP))
+	assert.Equal(t, "/admin?q=1", eng.gotHeader.Get(headerURI), "URI header must carry path and query")
+	assert.Equal(t, http.MethodGet, eng.gotHeader.Get(headerVerb))
+	assert.Equal(t, "svc.example.com", eng.gotHeader.Get(headerHost))
+	assert.Equal(t, "curl/8.0", eng.gotHeader.Get(headerUserAgent))
+	assert.Equal(t, "11", eng.gotHeader.Get(headerHTTPVersion))
+	assert.Equal(t, "req-42", eng.gotHeader.Get(headerTransactionID))
+	assert.Equal(t, "test-key", eng.gotHeader.Get(headerAPIKey))
+	// Client headers are what the WAF rules match on.
+	assert.Equal(t, "session=abc", eng.gotHeader.Get("Cookie"))
+}
+
+func TestInspect_MapsActionsToVerdicts(t *testing.T) {
+	tests := []struct {
+		name    string
+		status  int
+		body    string
+		want    restrict.Verdict
+		wantErr bool
+	}{
+		{"allow", http.StatusOK, `{"action":"allow"}`, restrict.Allow, false},
+		{"ban", http.StatusForbidden, `{"action":"ban","http_status":403}`, restrict.DenyAppSecBan, false},
+		{"captcha", http.StatusForbidden, `{"action":"captcha","http_status":403}`, restrict.DenyAppSecCaptcha, false},
+		// blocked_http_code is operator-configurable, so the action decides.
+		{"custom block status", http.StatusTeapot, `{"action":"ban"}`, restrict.DenyAppSecBan, false},
+		{"allow on custom status", http.StatusTeapot, `{"action":"allow"}`, restrict.Allow, false},
+		{"unknown action denies", http.StatusForbidden, `{"action":"something-new"}`, restrict.DenyAppSecBan, false},
+		{"unreadable body denies", http.StatusForbidden, `not json`, restrict.DenyAppSecBan, false},
+		{"bad api key is unavailable", http.StatusUnauthorized, "", restrict.DenyAppSecUnavailable, true},
+		{"engine error is unavailable", http.StatusInternalServerError, "", restrict.DenyAppSecUnavailable, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			eng := &engine{status: tt.status, body: tt.body}
+			srv := eng.start(t)
+			client := newClient(t, srv.URL)
+
+			verdict, err := client.Inspect(context.Background(), Request{
+				HTTP:     inbound(http.MethodGet, "http://svc.example.com/", ""),
+				ClientIP: netip.MustParseAddr("203.0.113.7"),
+			})
+			if tt.wantErr {
+				require.Error(t, err)
+				assert.True(t, errors.Is(err, ErrUnavailable), "engine-side failures must be ErrUnavailable so the caller can apply the mode")
+			} else {
+				require.NoError(t, err)
+			}
+			assert.Equal(t, tt.want, verdict)
+		})
+	}
+}
+
+func TestInspect_ForwardsBodyAndRestoresIt(t *testing.T) {
+	eng := &engine{body: `{"action":"allow"}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL)
+
+	const payload = `{"user":"' OR 1=1--"}`
+	r := inbound(http.MethodPost, "http://svc.example.com/login", payload)
+	r.Header.Set("Content-Type", "application/json")
+
+	_, err := client.Inspect(context.Background(), Request{
+		HTTP:     r,
+		ClientIP: netip.MustParseAddr("203.0.113.7"),
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, http.MethodPost, eng.gotMethod, "a request with a body is forwarded as POST")
+	assert.Equal(t, payload, string(eng.gotBody))
+	assert.Equal(t, int64(len(payload)), eng.gotLength,
+		"the engine reads exactly Content-Length bytes, so it must be accurate")
+
+	// The backend still needs the body.
+	restored, err := io.ReadAll(r.Body)
+	require.NoError(t, err)
+	assert.Equal(t, payload, string(restored), "body must be restored for the upstream request")
+}
+
+func TestInspect_OversizeBodyFallsBackToHeaders(t *testing.T) {
+	eng := &engine{body: `{"action":"allow"}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL, func(c *Config) { c.MaxBodyBytes = 16 })
+
+	payload := strings.Repeat("A", 64)
+	r := inbound(http.MethodPost, "http://svc.example.com/upload", payload)
+
+	_, err := client.Inspect(context.Background(), Request{
+		HTTP:     r,
+		ClientIP: netip.MustParseAddr("203.0.113.7"),
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, http.MethodGet, eng.gotMethod, "an oversize body is not forwarded")
+	assert.Empty(t, eng.gotBody, "a truncated prefix must never be sent: it changes the verdict")
+
+	restored, err := io.ReadAll(r.Body)
+	require.NoError(t, err)
+	assert.Equal(t, payload, string(restored), "the full body must still reach the upstream")
+}
+
+func TestInspect_ChunkedOversizeBodyIsReplayed(t *testing.T) {
+	eng := &engine{body: `{"action":"allow"}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL, func(c *Config) { c.MaxBodyBytes = 8 })
+
+	payload := strings.Repeat("B", 40)
+	r := inbound(http.MethodPost, "http://svc.example.com/upload", payload)
+	// Unknown length: the cap can only be detected while reading.
+	r.ContentLength = -1
+	r.Header.Del("Content-Length")
+
+	_, err := client.Inspect(context.Background(), Request{
+		HTTP:     r,
+		ClientIP: netip.MustParseAddr("203.0.113.7"),
+	})
+	require.NoError(t, err)
+
+	assert.Empty(t, eng.gotBody)
+	restored, err := io.ReadAll(r.Body)
+	require.NoError(t, err)
+	assert.Equal(t, payload, string(restored), "bytes read to detect the cap must be replayed")
+}
+
+func TestInspect_RedactsCredentialForm(t *testing.T) {
+	eng := &engine{body: `{"action":"allow"}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL)
+
+	r := inbound(http.MethodPost, "http://svc.example.com/", "password=hunter2&next=%2Fhome")
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	_, err := client.Inspect(context.Background(), Request{
+		HTTP:             r,
+		ClientIP:         netip.MustParseAddr("203.0.113.7"),
+		RedactBodyFields: []string{"password", "pin"},
+	})
+	require.NoError(t, err)
+
+	assert.NotContains(t, string(eng.gotBody), "hunter2", "the credential must not reach the engine")
+	assert.Contains(t, string(eng.gotBody), "next=%2Fhome", "the rest of the form stays inspectable")
+	assert.Equal(t, 1, eng.requests)
+
+	restored, err := io.ReadAll(r.Body)
+	require.NoError(t, err)
+	assert.Equal(t, "password=hunter2&next=%2Fhome", string(restored),
+		"the login handler still needs to read the real form")
+}
+
+// A caller must not be able to exempt a payload from inspection by naming one
+// of its fields "password": only the credential value is dropped.
+func TestInspect_RedactionIsNotABodyBypass(t *testing.T) {
+	eng := &engine{body: `{"action":"allow"}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL)
+
+	const payload = "q=%27+OR+1%3D1--&password=x"
+	r := inbound(http.MethodPost, "http://svc.example.com/search", payload)
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	_, err := client.Inspect(context.Background(), Request{
+		HTTP:             r,
+		ClientIP:         netip.MustParseAddr("203.0.113.7"),
+		RedactBodyFields: []string{"password", "pin"},
+	})
+	require.NoError(t, err)
+
+	forwarded := string(eng.gotBody)
+	assert.Contains(t, forwarded, "OR+1%3D1", "the attack payload must still be inspected")
+	assert.NotContains(t, forwarded, "password=x")
+}
+
+// A body that fails to parse carries no credential the login handler could
+// read either, so it is inspected as-is rather than withheld.
+func TestInspect_MalformedFormIsStillInspected(t *testing.T) {
+	eng := &engine{body: `{"action":"allow"}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL)
+
+	const payload = "q=%zz&evil=%3Cscript%3E"
+	r := inbound(http.MethodPost, "http://svc.example.com/search", payload)
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	_, err := client.Inspect(context.Background(), Request{
+		HTTP:             r,
+		ClientIP:         netip.MustParseAddr("203.0.113.7"),
+		RedactBodyFields: []string{"password", "pin"},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, payload, string(eng.gotBody))
+}
+
+func TestInspect_ForwardsNonCredentialForm(t *testing.T) {
+	eng := &engine{body: `{"action":"allow"}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL)
+
+	r := inbound(http.MethodPost, "http://svc.example.com/search", "q=%3Cscript%3E")
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	_, err := client.Inspect(context.Background(), Request{
+		HTTP:             r,
+		ClientIP:         netip.MustParseAddr("203.0.113.7"),
+		RedactBodyFields: []string{"password", "pin"},
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "q=%3Cscript%3E", string(eng.gotBody), "ordinary form bodies must be inspected")
+}
+
+func TestInspect_StripsSpoofedProtocolHeaders(t *testing.T) {
+	eng := &engine{body: `{"action":"allow"}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL)
+
+	r := inbound(http.MethodGet, "http://svc.example.com/", "")
+	// A caller trying to make the engine see a different source address, and to
+	// smuggle in its own key.
+	r.Header.Set(headerIP, "10.0.0.1")
+	r.Header.Set(headerAPIKey, "attacker-key")
+	r.Header.Set(headerURI, "/harmless")
+
+	_, err := client.Inspect(context.Background(), Request{
+		HTTP:     r,
+		ClientIP: netip.MustParseAddr("203.0.113.7"),
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, "203.0.113.7", eng.gotHeader.Get(headerIP), "the proxy's resolved IP must win")
+	assert.Equal(t, "test-key", eng.gotHeader.Get(headerAPIKey))
+	assert.Equal(t, "/", eng.gotHeader.Get(headerURI))
+	assert.Len(t, eng.gotHeader.Values(headerIP), 1, "no duplicate protocol headers")
+}
+
+func TestInspect_DropsHopByHopHeaders(t *testing.T) {
+	eng := &engine{body: `{"action":"allow"}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL)
+
+	r := inbound(http.MethodGet, "http://svc.example.com/", "")
+	r.Header.Set("Proxy-Authorization", "Basic zzz")
+	r.Header.Set("Keep-Alive", "timeout=5")
+
+	_, err := client.Inspect(context.Background(), Request{
+		HTTP:     r,
+		ClientIP: netip.MustParseAddr("203.0.113.7"),
+	})
+	require.NoError(t, err)
+
+	assert.Empty(t, eng.gotHeader.Get("Proxy-Authorization"))
+	assert.Empty(t, eng.gotHeader.Get("Keep-Alive"))
+}
+
+func TestInspect_UpgradeRequestKeepsStreamIntact(t *testing.T) {
+	eng := &engine{body: `{"action":"allow"}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL)
+
+	r := inbound(http.MethodGet, "http://svc.example.com/ws", "")
+	r.Header.Set("Upgrade", "websocket")
+	r.Header.Set("Connection", "upgrade")
+
+	_, err := client.Inspect(context.Background(), Request{
+		HTTP:     r,
+		ClientIP: netip.MustParseAddr("203.0.113.7"),
+	})
+	require.NoError(t, err)
+	assert.Equal(t, http.MethodGet, eng.gotMethod)
+	assert.Empty(t, eng.gotBody)
+	assert.Equal(t, 1, eng.requests, "upgrade requests are still inspected on headers")
+}
+
+func TestInspect_TimeoutIsUnavailable(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		time.Sleep(200 * time.Millisecond)
+		w.WriteHeader(http.StatusOK)
+	}))
+	t.Cleanup(srv.Close)
+
+	client := newClient(t, srv.URL, func(c *Config) { c.Timeout = 10 * time.Millisecond })
+
+	verdict, err := client.Inspect(context.Background(), Request{
+		HTTP:     inbound(http.MethodGet, "http://svc.example.com/", ""),
+		ClientIP: netip.MustParseAddr("203.0.113.7"),
+	})
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, ErrUnavailable))
+	assert.Equal(t, restrict.DenyAppSecUnavailable, verdict)
+}
+
+func TestInspect_UnreachableEngineIsUnavailable(t *testing.T) {
+	// Port 1 on loopback refuses connections.
+	client := newClient(t, "http://127.0.0.1:1/")
+
+	verdict, err := client.Inspect(context.Background(), Request{
+		HTTP:     inbound(http.MethodGet, "http://svc.example.com/", ""),
+		ClientIP: netip.MustParseAddr("203.0.113.7"),
+	})
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, ErrUnavailable))
+	assert.Equal(t, restrict.DenyAppSecUnavailable, verdict)
+}
+
+func TestInspect_NilClientFailsClosed(t *testing.T) {
+	var client *Client
+	verdict, err := client.Inspect(context.Background(), Request{
+		HTTP:     inbound(http.MethodGet, "http://svc.example.com/", ""),
+		ClientIP: netip.MustParseAddr("203.0.113.7"),
+	})
+	require.Error(t, err)
+	assert.Equal(t, restrict.DenyAppSecUnavailable, verdict)
+}
+
+func TestInspect_NegativeCapDisablesBodyForwarding(t *testing.T) {
+	eng := &engine{body: `{"action":"allow"}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL, func(c *Config) { c.MaxBodyBytes = -1 })
+
+	const payload = `{"a":1}`
+	r := inbound(http.MethodPost, "http://svc.example.com/", payload)
+
+	_, err := client.Inspect(context.Background(), Request{
+		HTTP:     r,
+		ClientIP: netip.MustParseAddr("203.0.113.7"),
+	})
+	require.NoError(t, err)
+	assert.Empty(t, eng.gotBody)
+
+	restored, err := io.ReadAll(r.Body)
+	require.NoError(t, err)
+	assert.Equal(t, payload, string(restored), "an untouched body must still be forwardable")
+}
+
+func TestInspect_MapsV4MappedClientIP(t *testing.T) {
+	eng := &engine{body: `{"action":"allow"}`}
+	srv := eng.start(t)
+	client := newClient(t, srv.URL)
+
+	_, err := client.Inspect(context.Background(), Request{
+		HTTP:     inbound(http.MethodGet, "http://svc.example.com/", ""),
+		ClientIP: netip.MustParseAddr("::ffff:203.0.113.7"),
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "203.0.113.7", eng.gotHeader.Get(headerIP),
+		"v4-mapped addresses must be unmapped so engine allowlists and rules match")
+}
+
+// Inspection is a blocking call on every request, so the connection to the
+// engine must be reused. net/http only pools a connection whose body was read
+// to EOF, which a verdict path returning early would skip.
+func TestInspect_ReusesConnections(t *testing.T) {
+	var conns atomic.Int64
+	srv := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"action":"allow","http_status":200}`))
+	}))
+	srv.Config.ConnState = func(_ net.Conn, state http.ConnState) {
+		if state == http.StateNew {
+			conns.Add(1)
+		}
+	}
+	srv.Start()
+	t.Cleanup(srv.Close)
+
+	client := newClient(t, srv.URL)
+	for range 5 {
+		verdict, err := client.Inspect(context.Background(), Request{
+			HTTP:     inbound(http.MethodGet, "http://svc.example.com/", ""),
+			ClientIP: netip.MustParseAddr("203.0.113.7"),
+		})
+		require.NoError(t, err)
+		require.Equal(t, restrict.Allow, verdict)
+	}
+
+	assert.Equal(t, int64(1), conns.Load(),
+		"all five inspections must share one connection; a fresh handshake per request would eat the timeout budget")
+}
+
+func TestNew_ClampsOperatorValues(t *testing.T) {
+	tests := []struct {
+		name        string
+		cfg         Config
+		wantTimeout time.Duration
+		wantMaxBody int64
+	}{
+		{"defaults", Config{}, DefaultTimeout, DefaultMaxBodyBytes},
+		{"timeout below minimum", Config{Timeout: time.Microsecond}, MinTimeout, DefaultMaxBodyBytes},
+		{"timeout above maximum", Config{Timeout: time.Hour}, MaxTimeout, DefaultMaxBodyBytes},
+		{"body above maximum", Config{MaxBodyBytes: 1 << 30}, DefaultTimeout, MaxBodyBytesLimit},
+		// A negative cap means "forward no body" and must survive clamping.
+		{"negative body preserved", Config{MaxBodyBytes: -1}, DefaultTimeout, -1},
+		{"in-range values kept", Config{Timeout: time.Second, MaxBodyBytes: 1 << 10}, time.Second, 1 << 10},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			tt.cfg.URL = "http://127.0.0.1:7422/"
+			tt.cfg.APIKey = "k"
+			client, err := New(tt.cfg)
+			require.NoError(t, err)
+			assert.Equal(t, tt.wantTimeout, client.http.Timeout, "inspection is in the request path, so the timeout must stay bounded")
+			assert.Equal(t, tt.wantMaxBody, client.maxBodyBytes, "buffered bodies are held per in-flight request")
+		})
+	}
+}

proxy/internal/auth/appsec_test.go

@@ -0,0 +1,176 @@
+package auth
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/proxy/internal/appsec"
+	"github.com/netbirdio/netbird/proxy/internal/proxy"
+	"github.com/netbirdio/netbird/proxy/internal/restrict"
+	"github.com/netbirdio/netbird/proxy/internal/types"
+)
+
+// appsecEngine is a stub AppSec component returning a fixed remediation.
+func appsecEngine(t *testing.T, status int, body string) *httptest.Server {
+	t.Helper()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(status)
+		if body != "" {
+			_, _ = w.Write([]byte(body))
+		}
+	}))
+	t.Cleanup(srv.Close)
+	return srv
+}
+
+// serveWithAppSec runs a request through the middleware for a domain configured
+// with the given AppSec mode, returning the response and the captured metadata.
+func serveWithAppSec(t *testing.T, mode restrict.AppSecMode, client *appsec.Client, r *http.Request) (*httptest.ResponseRecorder, map[string]string, bool) {
+	t.Helper()
+
+	mw := NewMiddleware(log.StandardLogger(), nil, nil)
+	mw.SetAppSec(client)
+	require.NoError(t, mw.AddDomain("svc.example.com", DomainSettings{
+		AccountID:  types.AccountID("acct-1"),
+		ServiceID:  types.ServiceID("svc-1"),
+		AppSecMode: mode,
+	}))
+
+	reached := false
+	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		reached = true
+		w.WriteHeader(http.StatusOK)
+	}))
+
+	cd := proxy.NewCapturedData("req-1")
+	r = r.WithContext(proxy.WithCapturedData(r.Context(), cd))
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, r)
+
+	return rec, cd.GetMetadata(), reached
+}
+
+func appsecRequest() *http.Request {
+	r := httptest.NewRequest(http.MethodGet, "http://svc.example.com/?x=/etc/passwd", nil)
+	r.Host = "svc.example.com"
+	r.RemoteAddr = "203.0.113.7:44444"
+	return r
+}
+
+func TestCheckAppSec_EnforceBlocksBannedRequest(t *testing.T) {
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban","http_status":403}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
+
+	assert.Equal(t, http.StatusForbidden, rec.Code)
+	assert.False(t, reached, "a banned request must not reach the backend")
+	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
+	assert.NotContains(t, meta, "appsec_mode", "enforce is the default, only observe is annotated")
+}
+
+func TestCheckAppSec_ObserveAllowsAndRecordsVerdict(t *testing.T) {
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban","http_status":403}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecObserve, client, appsecRequest())
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.True(t, reached, "observe mode must not block")
+	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
+	assert.Equal(t, "observe", meta["appsec_mode"])
+}
+
+func TestCheckAppSec_AllowedRequestPasses(t *testing.T) {
+	srv := appsecEngine(t, http.StatusOK, `{"action":"allow","http_status":200}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.True(t, reached)
+	assert.NotContains(t, meta, "appsec_verdict", "a clean request records no verdict")
+}
+
+func TestCheckAppSec_OffSkipsInspection(t *testing.T) {
+	// An engine that would ban everything; the mode must keep us away from it.
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecOff, client, appsecRequest())
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.True(t, reached)
+	assert.Empty(t, meta)
+}
+
+func TestCheckAppSec_EnforceFailsClosedWithoutClient(t *testing.T) {
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, nil, appsecRequest())
+
+	assert.Equal(t, http.StatusForbidden, rec.Code,
+		"enforce with no configured endpoint must deny rather than pass traffic uninspected")
+	assert.False(t, reached)
+	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
+}
+
+func TestCheckAppSec_ObserveAllowsWithoutClient(t *testing.T) {
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecObserve, nil, appsecRequest())
+
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.True(t, reached)
+	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
+	assert.Equal(t, "observe", meta["appsec_mode"])
+}
+
+func TestCheckAppSec_EnforceFailsClosedWhenEngineUnreachable(t *testing.T) {
+	client, err := appsec.New(appsec.Config{URL: "http://127.0.0.1:1/", APIKey: "k"})
+	require.NoError(t, err)
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, appsecRequest())
+
+	assert.Equal(t, http.StatusForbidden, rec.Code)
+	assert.False(t, reached)
+	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
+}
+
+func TestCheckAppSec_InspectsOverlayTraffic(t *testing.T) {
+	srv := appsecEngine(t, http.StatusForbidden, `{"action":"ban"}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	// Requests arriving over the WireGuard overlay skip the geo and IP-reputation
+	// checks, but request content is just as inspectable.
+	r := appsecRequest()
+	r = r.WithContext(types.WithOverlayOrigin(r.Context()))
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
+
+	assert.Equal(t, http.StatusForbidden, rec.Code, "overlay traffic must still be inspected")
+	assert.False(t, reached)
+	assert.Equal(t, "appsec_ban", meta["appsec_verdict"])
+}
+
+func TestCheckAppSec_UnresolvableClientIPFailsClosed(t *testing.T) {
+	srv := appsecEngine(t, http.StatusOK, `{"action":"allow"}`)
+	client, err := appsec.New(appsec.Config{URL: srv.URL, APIKey: "k"})
+	require.NoError(t, err)
+
+	r := appsecRequest()
+	r.RemoteAddr = "not-an-address"
+
+	rec, meta, reached := serveWithAppSec(t, restrict.AppSecEnforce, client, r)
+
+	assert.Equal(t, http.StatusForbidden, rec.Code,
+		"the engine requires a client address; a request we cannot attribute must not pass")
+	assert.False(t, reached)
+	assert.Equal(t, "appsec_unavailable", meta["appsec_verdict"])
+}

proxy/internal/auth/middleware.go

@@ -18,6 +18,7 @@ import (
 	"google.golang.org/grpc"
 
 	"github.com/netbirdio/netbird/proxy/auth"
+	"github.com/netbirdio/netbird/proxy/internal/appsec"
 	"github.com/netbirdio/netbird/proxy/internal/proxy"
 	"github.com/netbirdio/netbird/proxy/internal/restrict"
 	"github.com/netbirdio/netbird/proxy/internal/types"
@@ -59,6 +60,8 @@ type DomainConfig struct {
 	IPRestrictions    *restrict.Filter
 	// Private routes the domain through ValidateTunnelPeer; failure → 403.
 	Private bool
+	// AppSecMode enables CrowdSec AppSec request inspection for this domain.
+	AppSecMode restrict.AppSecMode
 }
 
 type validationResult struct {
@@ -82,6 +85,9 @@ type Middleware struct {
 	sessionValidator SessionValidator
 	geo              restrict.GeoResolver
 	tunnelCache      *tunnelValidationCache
+	// appsec is the shared CrowdSec AppSec client, nil when the proxy has no
+	// AppSec endpoint configured. Set once during startup, before serving.
+	appsec *appsec.Client
 }
 
 // NewMiddleware creates a new authentication middleware. The sessionValidator is
@@ -99,6 +105,12 @@ func NewMiddleware(logger *log.Logger, sessionValidator SessionValidator, geo re
 	}
 }
 
+// SetAppSec installs the shared CrowdSec AppSec client. Must be called during
+// startup, before the middleware serves any request.
+func (mw *Middleware) SetAppSec(client *appsec.Client) {
+	mw.appsec = client
+}
+
 // Protect wraps next with per-domain authentication and IP restriction checks.
 // Requests whose Host is not registered pass through unchanged.
 func (mw *Middleware) Protect(next http.Handler) http.Handler {
@@ -123,6 +135,10 @@ func (mw *Middleware) Protect(next http.Handler) http.Handler {
 			return
 		}
 
+		if !mw.checkAppSec(w, r, config) {
+			return
+		}
+
 		// Private services bypass operator schemes and gate on tunnel peer.
 		if config.Private {
 			if mw.forwardWithTunnelPeer(w, r, host, config, next) {
@@ -262,6 +278,97 @@ func (mw *Middleware) checkIPRestrictions(w http.ResponseWriter, r *http.Request
 	return false
 }
 
+// checkAppSec mirrors the request to the CrowdSec AppSec engine when the domain
+// enables inspection. Returns false when the request was blocked and a response
+// has been written.
+//
+// Every non-allow remediation blocks with 403, captcha included: the proxy has
+// no challenge flow to serve. The distinct verdict is still recorded so the
+// access log shows which remediation the engine actually chose.
+//
+// Unlike the geo and IP-reputation checks, this runs for overlay traffic too:
+// AppSec inspects request content, which is just as meaningful when the caller
+// reached the proxy through the WireGuard tunnel.
+func (mw *Middleware) checkAppSec(w http.ResponseWriter, r *http.Request, config DomainConfig) bool {
+	if !config.AppSecMode.Enabled() {
+		return true
+	}
+
+	verdict := mw.inspectAppSec(r, config)
+	if verdict == restrict.Allow {
+		return true
+	}
+
+	observe := config.AppSecMode == restrict.AppSecObserve
+	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+		cd.SetMetadata("appsec_verdict", verdict.String())
+		if observe {
+			cd.SetMetadata("appsec_mode", "observe")
+		}
+	}
+
+	if observe {
+		mw.logger.Debugf("AppSec observe: would block %s for %s (%s)", r.RemoteAddr, r.Host, verdict)
+		return true
+	}
+
+	mw.markDenied(r, verdict.String())
+	mw.logger.Debugf("AppSec: %s for %s %s", verdict, r.Host, r.RemoteAddr)
+	http.Error(w, "Forbidden", http.StatusForbidden)
+	return false
+}
+
+// inspectAppSec runs the AppSec call and returns its verdict. Failures come
+// back as DenyAppSecUnavailable regardless of mode so observe mode still
+// records that inspection did not happen; the caller decides what blocks.
+func (mw *Middleware) inspectAppSec(r *http.Request, config DomainConfig) restrict.Verdict {
+	// Mode requested but the proxy has no AppSec endpoint configured. Management
+	// gates this on the cluster capability; a stale mapping can still arrive.
+	if mw.appsec == nil {
+		mw.logger.Debugf("AppSec mode %q requested for %s but no AppSec endpoint is configured", config.AppSecMode, r.Host)
+		return restrict.DenyAppSecUnavailable
+	}
+
+	clientIP := mw.resolveClientIP(r)
+	if !clientIP.IsValid() {
+		// The engine requires a client address, and a request whose source we
+		// cannot establish is exactly the kind we must not wave through.
+		mw.logger.Debugf("AppSec: cannot resolve client address for %q", r.RemoteAddr)
+		return restrict.DenyAppSecUnavailable
+	}
+
+	req := appsec.Request{
+		HTTP:             r,
+		ClientIP:         clientIP,
+		RedactBodyFields: credentialFormFields(config.Schemes),
+	}
+	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
+		req.TransactionID = cd.GetRequestID()
+	}
+
+	verdict, err := mw.appsec.Inspect(r.Context(), req)
+	if err != nil {
+		mw.logger.Debugf("AppSec inspection failed for %s: %v", r.Host, err)
+	}
+	return verdict
+}
+
+// credentialFormFields lists the login form fields whose values are redacted
+// from the mirrored body, so a password or PIN submitted to the proxy's own
+// login form never reaches the Security Engine.
+func credentialFormFields(schemes []Scheme) []string {
+	var fields []string
+	for _, s := range schemes {
+		switch s.Type() {
+		case auth.MethodPassword:
+			fields = append(fields, passwordFormId)
+		case auth.MethodPIN:
+			fields = append(fields, pinFormId)
+		}
+	}
+	return fields
+}
+
 // resolveClientIP extracts the real client IP from CapturedData, falling back to r.RemoteAddr.
 func (mw *Middleware) resolveClientIP(r *http.Request) netip.Addr {
 	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
@@ -281,12 +388,18 @@ func (mw *Middleware) resolveClientIP(r *http.Request) netip.Addr {
 	return addr.Unmap()
 }
 
-// blockIPRestriction sets captured data fields for an IP-restriction block event.
-func (mw *Middleware) blockIPRestriction(r *http.Request, reason string) {
+// markDenied records the deny reason on the captured data so the access log
+// attributes the response to the proxy rather than the backend.
+func (mw *Middleware) markDenied(r *http.Request, reason string) {
 	if cd := proxy.CapturedDataFromContext(r.Context()); cd != nil {
 		cd.SetOrigin(proxy.OriginAuth)
 		cd.SetAuthMethod(reason)
 	}
+}
+
+// blockIPRestriction sets captured data fields for an IP-restriction block event.
+func (mw *Middleware) blockIPRestriction(r *http.Request, reason string) {
+	mw.markDenied(r, reason)
 	mw.logger.Debugf("IP restriction: %s for %s", reason, r.RemoteAddr)
 }
 
@@ -642,40 +755,49 @@ func wasCredentialSubmitted(r *http.Request, method auth.Method) bool {
 	return false
 }
 
-// AddDomain registers authentication schemes for the given domain. With schemes a valid session public key is required.
-// private=true forces ValidateTunnelPeer enforcement (403 on failure) regardless of the schemes list.
-func (mw *Middleware) AddDomain(domain string, schemes []Scheme, publicKeyB64 string, expiration time.Duration, accountID types.AccountID, serviceID types.ServiceID, ipRestrictions *restrict.Filter, private bool) error {
-	if len(schemes) == 0 {
-		mw.domainsMux.Lock()
-		defer mw.domainsMux.Unlock()
-		mw.domains[domain] = DomainConfig{
-			AccountID:      accountID,
-			ServiceID:      serviceID,
-			IPRestrictions: ipRestrictions,
-			Private:        private,
-		}
-		return nil
+// DomainSettings is the per-domain configuration AddDomain applies.
+type DomainSettings struct {
+	Schemes []Scheme
+	// SessionPublicKey is the base64-encoded ed25519 key used to verify session
+	// cookies. Required when Schemes is non-empty.
+	SessionPublicKey  string
+	SessionExpiration time.Duration
+	AccountID         types.AccountID
+	ServiceID         types.ServiceID
+	IPRestrictions    *restrict.Filter
+	// Private forces ValidateTunnelPeer enforcement (403 on failure) regardless
+	// of the schemes list.
+	Private    bool
+	AppSecMode restrict.AppSecMode
+}
+
+// AddDomain registers authentication schemes for the given domain. With schemes
+// a valid session public key is required.
+func (mw *Middleware) AddDomain(domain string, settings DomainSettings) error {
+	config := DomainConfig{
+		AccountID:      settings.AccountID,
+		ServiceID:      settings.ServiceID,
+		IPRestrictions: settings.IPRestrictions,
+		Private:        settings.Private,
+		AppSecMode:     settings.AppSecMode,
 	}
 
-	pubKeyBytes, err := base64.StdEncoding.DecodeString(publicKeyB64)
-	if err != nil {
-		return fmt.Errorf("decode session public key for domain %s: %w", domain, err)
-	}
-	if len(pubKeyBytes) != ed25519.PublicKeySize {
-		return fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
+	if len(settings.Schemes) > 0 {
+		pubKeyBytes, err := base64.StdEncoding.DecodeString(settings.SessionPublicKey)
+		if err != nil {
+			return fmt.Errorf("decode session public key for domain %s: %w", domain, err)
+		}
+		if len(pubKeyBytes) != ed25519.PublicKeySize {
+			return fmt.Errorf("invalid session public key size for domain %s: got %d, want %d", domain, len(pubKeyBytes), ed25519.PublicKeySize)
+		}
+		config.Schemes = settings.Schemes
+		config.SessionPublicKey = pubKeyBytes
+		config.SessionExpiration = settings.SessionExpiration
 	}
 
 	mw.domainsMux.Lock()
 	defer mw.domainsMux.Unlock()
-	mw.domains[domain] = DomainConfig{
-		Schemes:           schemes,
-		SessionPublicKey:  pubKeyBytes,
-		SessionExpiration: expiration,
-		AccountID:         accountID,
-		ServiceID:         serviceID,
-		IPRestrictions:    ipRestrictions,
-		Private:           private,
-	}
+	mw.domains[domain] = config
 	return nil
 }
 

proxy/internal/auth/middleware_test.go

@@ -64,7 +64,7 @@ func TestAddDomain_ValidKey(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour})
 	require.NoError(t, err)
 
 	mw.domainsMux.RLock()
@@ -81,7 +81,7 @@ func TestAddDomain_EmptyKey(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, "", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionExpiration: time.Hour})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid session public key size")
 
@@ -95,7 +95,7 @@ func TestAddDomain_InvalidBase64(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, "not-valid-base64!!!", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: "not-valid-base64!!!", SessionExpiration: time.Hour})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "decode session public key")
 
@@ -110,7 +110,7 @@ func TestAddDomain_WrongKeySize(t *testing.T) {
 
 	shortKey := base64.StdEncoding.EncodeToString([]byte("tooshort"))
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	err := mw.AddDomain("example.com", []Scheme{scheme}, shortKey, time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: shortKey, SessionExpiration: time.Hour})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "invalid session public key size")
 
@@ -123,7 +123,7 @@ func TestAddDomain_WrongKeySize(t *testing.T) {
 func TestAddDomain_NoSchemes_NoKeyRequired(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{SessionExpiration: time.Hour})
 	require.NoError(t, err, "domains with no auth schemes should not require a key")
 
 	mw.domainsMux.RLock()
@@ -139,8 +139,8 @@ func TestAddDomain_OverwritesPreviousConfig(t *testing.T) {
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
 
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false))
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp2.PublicKey, 2*time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp1.PublicKey, SessionExpiration: time.Hour}))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp2.PublicKey, SessionExpiration: 2 * time.Hour}))
 
 	mw.domainsMux.RLock()
 	config := mw.domains["example.com"]
@@ -156,7 +156,7 @@ func TestRemoveDomain(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	mw.RemoveDomain("example.com")
 
@@ -180,7 +180,7 @@ func TestProtect_UnknownDomainPassesThrough(t *testing.T) {
 
 func TestProtect_DomainWithNoSchemesPassesThrough(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
-	require.NoError(t, mw.AddDomain("example.com", nil, "", time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -197,7 +197,7 @@ func TestProtect_UnauthenticatedRequestIsBlocked(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -218,7 +218,7 @@ func TestProtect_HostWithPortIsMatched(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -239,7 +239,7 @@ func TestProtect_ValidSessionCookiePassesThrough(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
 	require.NoError(t, err)
@@ -272,7 +272,7 @@ func TestProtect_SessionCookieGroupsPropagate(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	groups := []string{"engineering", "sre"}
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, groups, nil, time.Hour)
@@ -337,7 +337,7 @@ func TestProtect_PrivateService_TunnelPeerGroupsPropagate(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	// Private service: no operator schemes — auth gates solely on the tunnel peer.
-	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("agent.example.com", DomainSettings{SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
 
 	cd := proxy.NewCapturedData("")
 	cd.SetClientIP(netip.MustParseAddr("100.90.1.14")) // CGNAT tunnel source
@@ -377,7 +377,7 @@ func TestProtect_PrivateService_TunnelPeerDenied(t *testing.T) {
 	}}
 	mw := NewMiddleware(log.StandardLogger(), validator, nil)
 	kp := generateTestKeyPair(t)
-	require.NoError(t, mw.AddDomain("agent.example.com", nil, kp.PublicKey, time.Hour, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("agent.example.com", DomainSettings{SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
 
 	cd := proxy.NewCapturedData("")
 	cd.SetClientIP(netip.MustParseAddr("100.90.1.14"))
@@ -405,7 +405,7 @@ func TestProtect_ExpiredSessionCookieIsRejected(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	// Sign a token that expired 1 second ago.
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, -time.Second)
@@ -431,7 +431,7 @@ func TestProtect_WrongDomainCookieIsRejected(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	// Token signed for a different domain audience.
 	token, err := sessionkey.SignToken(kp.PrivateKey, "test-user", "", "other.com", auth.MethodPIN, nil, nil, time.Hour)
@@ -458,7 +458,7 @@ func TestProtect_WrongKeyCookieIsRejected(t *testing.T) {
 	kp2 := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp1.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp1.PublicKey, SessionExpiration: time.Hour}))
 
 	// Token signed with a different private key.
 	token, err := sessionkey.SignToken(kp2.PrivateKey, "test-user", "", "example.com", auth.MethodPIN, nil, nil, time.Hour)
@@ -495,7 +495,7 @@ func TestProtect_SchemeAuthRedirectsWithCookie(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -548,7 +548,7 @@ func TestProtect_FailedAuthDoesNotSetCookie(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -584,7 +584,7 @@ func TestProtect_MultipleSchemes(t *testing.T) {
 			return "", "password", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{pinScheme, passwordScheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{pinScheme, passwordScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	var backendCalled bool
 	backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -614,7 +614,7 @@ func TestProtect_InvalidTokenFromSchemeReturns400(t *testing.T) {
 			return "invalid-jwt-token", "", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -638,7 +638,7 @@ func TestAddDomain_RandomBytes32NotEd25519(t *testing.T) {
 	key := base64.StdEncoding.EncodeToString(randomBytes)
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
 
-	err = mw.AddDomain("example.com", []Scheme{scheme}, key, time.Hour, "", "", nil, false)
+	err = mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: key, SessionExpiration: time.Hour})
 	require.NoError(t, err, "any 32-byte key should be accepted at registration time")
 }
 
@@ -647,10 +647,10 @@ func TestAddDomain_InvalidKeyDoesNotCorruptExistingConfig(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	// Attempt to overwrite with an invalid key.
-	err := mw.AddDomain("example.com", []Scheme{scheme}, "bad", time.Hour, "", "", nil, false)
+	err := mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: "bad", SessionExpiration: time.Hour})
 	require.Error(t, err)
 
 	// The original valid config should still be intact.
@@ -674,7 +674,7 @@ func TestProtect_FailedPinAuthCapturesAuthMethod(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -701,7 +701,7 @@ func TestProtect_FailedPasswordAuthCapturesAuthMethod(t *testing.T) {
 			return "", "password", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -728,7 +728,7 @@ func TestProtect_NoCredentialsDoesNotCaptureAuthMethod(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -815,8 +815,7 @@ func TestWasCredentialSubmitted(t *testing.T) {
 func TestCheckIPRestrictions_UnparseableAddress(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"10.0.0.0/8"}})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -851,8 +850,7 @@ func TestCheckIPRestrictions_UsesCapturedDataClientIP(t *testing.T) {
 	// trusted proxies), checkIPRestrictions should use that IP, not RemoteAddr.
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"203.0.113.0/24"}}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"203.0.113.0/24"}})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -892,8 +890,7 @@ func TestCheckIPRestrictions_NilGeoWithCountryRules(t *testing.T) {
 	// Geo is nil, country restrictions are configured: must deny (fail-close).
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCountries: []string{"US"}}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCountries: []string{"US"}})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -916,11 +913,10 @@ func TestCheckIPRestrictions_NilGeoWithCountryRules(t *testing.T) {
 func TestCheckIPRestrictions_OverlayOriginSkipsCountryRules(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{
-			AllowedCIDRs:     []string{"100.64.0.0/10"},
-			AllowedCountries: []string{"US"},
-		}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{
+		AllowedCIDRs:     []string{"100.64.0.0/10"},
+		AllowedCountries: []string{"US"},
+	})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -953,8 +949,7 @@ func TestCheckIPRestrictions_OverlayOriginSkipsCountryRules(t *testing.T) {
 func TestCheckIPRestrictions_OverlayOriginRespectsCIDR(t *testing.T) {
 	mw := NewMiddleware(log.StandardLogger(), nil, nil)
 
-	err := mw.AddDomain("example.com", nil, "", 0, "acc1", "svc1",
-		restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}}), false)
+	err := mw.AddDomain("example.com", DomainSettings{AccountID: "acc1", ServiceID: "svc1", IPRestrictions: restrict.ParseFilter(restrict.FilterConfig{AllowedCIDRs: []string{"100.64.0.0/16"}})})
 	require.NoError(t, err)
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -982,7 +977,7 @@ func TestProtect_OIDCOnlyRedirectsDirectly(t *testing.T) {
 			return "", oidcURL, nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1011,7 +1006,7 @@ func TestProtect_OIDCWithOtherMethodShowsLoginPage(t *testing.T) {
 			return "", "pin", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{oidcScheme, pinScheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{oidcScheme, pinScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1055,7 +1050,7 @@ func TestProtect_HeaderAuth_ForwardsOnSuccess(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	var backendCalled bool
 	capturedData := proxy.NewCapturedData("")
@@ -1098,7 +1093,7 @@ func TestProtect_HeaderAuth_MissingHeaderFallsThrough(t *testing.T) {
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
 	// Also add a PIN scheme so we can verify fallthrough behavior.
 	pinScheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr, pinScheme}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr, pinScheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1118,7 +1113,7 @@ func TestProtect_HeaderAuth_WrongValueReturns401(t *testing.T) {
 		return &proto.AuthenticateResponse{Success: false}, nil
 	}}
 	hdr := NewHeader(mock, "svc1", "acc1", "X-API-Key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	capturedData := proxy.NewCapturedData("")
 	handler := mw.Protect(newPassthroughHandler())
@@ -1141,7 +1136,7 @@ func TestProtect_HeaderAuth_InfraErrorReturns502(t *testing.T) {
 		return nil, errors.New("gRPC unavailable")
 	}}
 	hdr := NewHeader(mock, "svc1", "acc1", "X-API-Key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1158,7 +1153,7 @@ func TestProtect_HeaderAuth_SubsequentRequestUsesSessionCookie(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	hdr := newHeaderSchemeWithToken(t, kp, "X-API-Key", "secret-key")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
@@ -1218,7 +1213,7 @@ func TestProtect_HeaderAuth_MultipleValuesSameHeader(t *testing.T) {
 
 	// Single Header scheme (as if one entry existed), but the mock checks both values.
 	hdr := NewHeader(mock, "svc1", "acc1", "Authorization")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{hdr}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour, AccountID: "acc1", ServiceID: "svc1"}))
 
 	var backendCalled bool
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -1276,7 +1271,7 @@ func TestProtect_OIDCOnPlainHTTP_BlockedWith400(t *testing.T) {
 			return "", "https://idp.example.com/authorize", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1300,7 +1295,7 @@ func TestProtect_OIDCOverTLS_NotBlocked(t *testing.T) {
 			return "", "https://idp.example.com/authorize", nil
 		},
 	}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1320,7 +1315,7 @@ func TestProtect_NonOIDCSchemes_PlainHTTP_NotBlocked(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1350,7 +1345,7 @@ func TestProtect_TunnelPeerFastPath_RequiresInboundMarker(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 
@@ -1385,7 +1380,7 @@ func TestProtect_TunnelPeerFastPath_TakesPathWithInboundMarker(t *testing.T) {
 	kp := generateTestKeyPair(t)
 
 	scheme := &stubScheme{method: auth.MethodPIN, promptID: "pin"}
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{scheme}, kp.PublicKey, time.Hour, "", "", nil, false))
+	require.NoError(t, mw.AddDomain("example.com", DomainSettings{Schemes: []Scheme{scheme}, SessionPublicKey: kp.PublicKey, SessionExpiration: time.Hour}))
 
 	handler := mw.Protect(newPassthroughHandler())
 

proxy/internal/auth/tunnel_lookup_test.go

@@ -44,7 +44,7 @@ func (s *stubSessionValidator) ValidateTunnelPeer(_ context.Context, in *proto.V
 func newTunnelMiddleware(t *testing.T, validator SessionValidator) *Middleware {
 	t.Helper()
 	mw := NewMiddleware(log.New(), validator, nil)
-	require.NoError(t, mw.AddDomain("svc.example", nil, "", 0, "acct-1", "svc-1", nil, false))
+	require.NoError(t, mw.AddDomain("svc.example", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1"}))
 	return mw
 }
 
@@ -235,8 +235,8 @@ func TestForwardWithTunnelPeer_RoutesAccountIDIntoCacheKey(t *testing.T) {
 	}
 	mw := NewMiddleware(log.New(), validator, nil)
 
-	require.NoError(t, mw.AddDomain("svc-a.example", nil, "", 0, "acct-a", "svc-a", nil, false))
-	require.NoError(t, mw.AddDomain("svc-b.example", nil, "", 0, "acct-b", "svc-b", nil, false))
+	require.NoError(t, mw.AddDomain("svc-a.example", DomainSettings{AccountID: "acct-a", ServiceID: "svc-a"}))
+	require.NoError(t, mw.AddDomain("svc-b.example", DomainSettings{AccountID: "acct-b", ServiceID: "svc-b"}))
 
 	// The fast-path requires the inbound-listener marker on the context.
 	// The peerstore lookup itself is account-agnostic at this level
@@ -299,7 +299,7 @@ func TestForwardWithTunnelPeer_LocalLookupShortCircuitDoesNotPopulateCache(t *te
 
 func TestPrivateService_FailsClosedOnTunnelPeerFailure(t *testing.T) {
 	mw := NewMiddleware(log.New(), nil, nil)
-	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("private.svc", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
 
 	called := false
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@@ -328,7 +328,7 @@ func TestPrivateService_ForwardsOnTunnelPeerSuccess(t *testing.T) {
 		},
 	}
 	mw := NewMiddleware(log.New(), validator, nil)
-	require.NoError(t, mw.AddDomain("private.svc", nil, "", 0, "acct-1", "svc-1", nil, true))
+	require.NoError(t, mw.AddDomain("private.svc", DomainSettings{AccountID: "acct-1", ServiceID: "svc-1", Private: true}))
 
 	called := false
 	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {

proxy/internal/restrict/restrict.go

@@ -50,6 +50,59 @@ const (
 	CrowdSecObserve CrowdSecMode = "observe"
 )
 
+// AppSecMode is the per-service CrowdSec AppSec (WAF) enforcement mode.
+type AppSecMode string
+
+const (
+	// AppSecOff disables request inspection.
+	AppSecOff AppSecMode = ""
+	// AppSecEnforce blocks requests the engine flags, and fails closed when the
+	// engine is unreachable.
+	AppSecEnforce AppSecMode = "enforce"
+	// AppSecObserve records the verdict without blocking.
+	AppSecObserve AppSecMode = "observe"
+)
+
+// ParseAppSecMode maps a wire value to an AppSecMode. Unrecognized values map
+// to AppSecOff so a typo never turns inspection into an unintended block.
+func ParseAppSecMode(s string) AppSecMode {
+	switch AppSecMode(s) {
+	case AppSecEnforce:
+		return AppSecEnforce
+	case AppSecObserve:
+		return AppSecObserve
+	default:
+		return AppSecOff
+	}
+}
+
+// Enabled reports whether the mode asks for request inspection.
+func (m AppSecMode) Enabled() bool {
+	return m == AppSecEnforce || m == AppSecObserve
+}
+
+// AllowMatch controls how the configured allowlists (CIDR, country) combine.
+// Blocklists are always a separate hard-deny gate and are unaffected by it.
+type AllowMatch string
+
+const (
+	// AllowMatchAll requires the address to match every configured allowlist
+	// (AND). This is the default and preserves the historical behavior.
+	AllowMatchAll AllowMatch = "all"
+	// AllowMatchAny requires the address to match at least one configured
+	// allowlist (OR), e.g. "allowed country OR allowed CIDR".
+	AllowMatchAny AllowMatch = "any"
+)
+
+// normalizeAllowMatch maps unknown or empty values to the restrictive default
+// (AllowMatchAll) so an unrecognized mode never loosens access.
+func normalizeAllowMatch(m AllowMatch) AllowMatch {
+	if m == AllowMatchAny {
+		return AllowMatchAny
+	}
+	return AllowMatchAll
+}
+
 // Filter evaluates IP restrictions. CIDR checks are performed first
 // (cheap), followed by country lookups (more expensive) only when needed.
 type Filter struct {
@@ -59,6 +112,9 @@ type Filter struct {
 	BlockedCountries []string
 	CrowdSec         CrowdSecChecker
 	CrowdSecMode     CrowdSecMode
+	// AllowMatch controls how the allowlists combine (AND vs OR). Empty means
+	// AllowMatchAll.
+	AllowMatch AllowMatch
 }
 
 // FilterConfig holds the raw configuration for building a Filter.
@@ -69,6 +125,7 @@ type FilterConfig struct {
 	BlockedCountries []string
 	CrowdSec         CrowdSecChecker
 	CrowdSecMode     CrowdSecMode
+	AllowMatch       AllowMatch
 	Logger           *log.Entry
 }
 
@@ -89,6 +146,7 @@ func ParseFilter(cfg FilterConfig) *Filter {
 	f := &Filter{
 		AllowedCountries: normalizeCountryCodes(cfg.AllowedCountries),
 		BlockedCountries: normalizeCountryCodes(cfg.BlockedCountries),
+		AllowMatch:       normalizeAllowMatch(cfg.AllowMatch),
 	}
 	if hasCS {
 		f.CrowdSec = cfg.CrowdSec
@@ -146,6 +204,13 @@ const (
 	// DenyCrowdSecUnavailable indicates enforce mode but the bouncer has not
 	// completed its initial sync.
 	DenyCrowdSecUnavailable
+	// DenyAppSecBan indicates a CrowdSec AppSec "ban" remediation.
+	DenyAppSecBan
+	// DenyAppSecCaptcha indicates a CrowdSec AppSec "captcha" remediation.
+	DenyAppSecCaptcha
+	// DenyAppSecUnavailable indicates enforce mode but the AppSec engine could
+	// not produce a verdict (unreachable, timed out, or it rejected the call).
+	DenyAppSecUnavailable
 )
 
 // String returns the deny reason string matching the HTTP auth mechanism names.
@@ -167,11 +232,27 @@ func (v Verdict) String() string {
 		return "crowdsec_throttle"
 	case DenyCrowdSecUnavailable:
 		return "crowdsec_unavailable"
+	case DenyAppSecBan:
+		return "appsec_ban"
+	case DenyAppSecCaptcha:
+		return "appsec_captcha"
+	case DenyAppSecUnavailable:
+		return "appsec_unavailable"
 	default:
 		return "unknown"
 	}
 }
 
+// IsAppSec returns true when the verdict originates from an AppSec inspection.
+func (v Verdict) IsAppSec() bool {
+	switch v {
+	case DenyAppSecBan, DenyAppSecCaptcha, DenyAppSecUnavailable:
+		return true
+	default:
+		return false
+	}
+}
+
 // IsCrowdSec returns true when the verdict originates from a CrowdSec check.
 func (v Verdict) IsCrowdSec() bool {
 	switch v {
@@ -216,6 +297,10 @@ func (f *Filter) Check(addr netip.Addr, geo GeoResolver) Verdict {
 	// IPv4 CIDR rules match regardless of how the address was received.
 	addr = addr.Unmap()
 
+	if f.AllowMatch == AllowMatchAny {
+		return f.checkAny(addr, geo)
+	}
+
 	if v := f.checkCIDR(addr); v != Allow {
 		return v
 	}
@@ -225,6 +310,77 @@ func (f *Filter) Check(addr netip.Addr, geo GeoResolver) Verdict {
 	return f.checkCrowdSec(addr)
 }
 
+// checkAny evaluates the filter with OR semantics across allowlists: the
+// address is admitted if it matches any configured allowlist (CIDR or country).
+// Blocklists remain a hard-deny gate evaluated first and are independent of the
+// allow-combine mode, so a blocklist match (or unverifiable country block) still
+// denies. CrowdSec runs last, as in the default path.
+func (f *Filter) checkAny(addr netip.Addr, geo GeoResolver) Verdict {
+	if v := f.checkBlocked(addr, geo); v != Allow {
+		return v
+	}
+	if v := f.checkAllowedAny(addr, geo); v != Allow {
+		return v
+	}
+	return f.checkCrowdSec(addr)
+}
+
+// checkBlocked is the hard-deny gate: it denies on any blocklist match,
+// regardless of the allow-combine mode. A configured country blocklist with an
+// unavailable geo lookup fails closed.
+func (f *Filter) checkBlocked(addr netip.Addr, geo GeoResolver) Verdict {
+	for _, prefix := range f.BlockedCIDRs {
+		if prefix.Contains(addr) {
+			return DenyCIDR
+		}
+	}
+
+	if len(f.BlockedCountries) == 0 {
+		return Allow
+	}
+	if geo == nil || !geo.Available() {
+		return DenyGeoUnavailable
+	}
+	if code := geo.LookupAddr(addr).CountryCode; code != "" && slices.Contains(f.BlockedCountries, code) {
+		return DenyCountry
+	}
+	return Allow
+}
+
+// checkAllowedAny admits the address if it matches any active allowlist. The
+// CIDR allowlist is evaluated first so a match admits without a geo lookup;
+// only when it does not match is the country allowlist consulted, where an
+// unavailable geo lookup fails closed.
+func (f *Filter) checkAllowedAny(addr netip.Addr, geo GeoResolver) Verdict {
+	cidrActive := len(f.AllowedCIDRs) > 0
+	countryActive := len(f.AllowedCountries) > 0
+	if !cidrActive && !countryActive {
+		return Allow
+	}
+
+	if cidrActive {
+		for _, prefix := range f.AllowedCIDRs {
+			if prefix.Contains(addr) {
+				return Allow
+			}
+		}
+	}
+
+	if countryActive {
+		if geo == nil || !geo.Available() {
+			return DenyGeoUnavailable
+		}
+		if code := geo.LookupAddr(addr).CountryCode; code != "" && slices.Contains(f.AllowedCountries, code) {
+			return Allow
+		}
+	}
+
+	if cidrActive {
+		return DenyCIDR
+	}
+	return DenyCountry
+}
+
 func (f *Filter) checkCIDR(addr netip.Addr) Verdict {
 	if len(f.AllowedCIDRs) > 0 {
 		allowed := false

proxy/internal/restrict/restrict_test.go

@@ -150,6 +150,187 @@ func TestFilter_Check_CIDRAllowThenCountryBlock(t *testing.T) {
 	assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr("192.168.1.1"), geo), "CIDR denied before country check")
 }
 
+// TestFilter_Check_CrossCategoryAllowlistsAreAND documents the current
+// behavior: when both a CIDR allowlist and a country allowlist are set, a
+// request must satisfy BOTH to be allowed (AND across categories). There is no
+// way today to express "allow if in allowed country OR in allowed CIDR", e.g.
+// "allow all US traffic plus our office IP abroad". This is the gap an
+// any/all allow-combine mode would close; the cases marked "GAP" are the ones
+// that would flip to Allow under an "any" mode.
+func TestFilter_Check_CrossCategoryAllowlistsAreAND(t *testing.T) {
+	officeAbroad := "203.0.113.7" // in allowed CIDR, but country not in allowlist
+	usOutsideOffice := "1.1.1.1"  // allowed country, but not in allowed CIDR
+	usOffice := "203.0.113.8"     // both
+	neither := "198.51.100.1"     // neither
+
+	geo := newMockGeo(map[string]string{
+		officeAbroad:    "DE",
+		usOutsideOffice: "US",
+		usOffice:        "US",
+		neither:         "CN",
+	})
+	f := ParseFilter(FilterConfig{
+		AllowedCIDRs:     []string{"203.0.113.0/24"},
+		AllowedCountries: []string{"US"},
+	})
+
+	assert.Equal(t, Allow, f.Check(netip.MustParseAddr(usOffice), geo), "in allowed CIDR and allowed country")
+	assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr(officeAbroad), geo), "GAP: in allowed CIDR but country not allowed; any-mode should Allow")
+	assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr(usOutsideOffice), geo), "GAP: allowed country but not in allowed CIDR; any-mode should Allow")
+	assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr(neither), geo), "neither: denied under both modes")
+}
+
+// TestFilter_Check_CrossCategoryBlockAndAllow locks the current (all/AND)
+// cross-category semantics that the evaluator must preserve: a blocklist match
+// in any category denies regardless of allowlists, and blocklists across
+// categories are effectively OR (a match in either denies).
+func TestFilter_Check_CrossCategoryBlockAndAllow(t *testing.T) {
+	geo := newMockGeo(map[string]string{
+		"1.1.1.1":  "US",
+		"10.1.2.3": "US",
+		"2.2.2.2":  "CN",
+		"3.3.3.3":  "US",
+	})
+
+	t.Run("country allowlist with CIDR blocklist", func(t *testing.T) {
+		f := ParseFilter(FilterConfig{
+			AllowedCountries: []string{"US"},
+			BlockedCIDRs:     []string{"10.1.0.0/16"},
+		})
+		assert.Equal(t, Allow, f.Check(netip.MustParseAddr("1.1.1.1"), geo), "US and not in blocked CIDR")
+		assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr("10.1.2.3"), geo), "US but in blocked CIDR, block wins")
+		assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("2.2.2.2"), geo), "not in allowed country")
+	})
+
+	t.Run("blocklists across categories are OR", func(t *testing.T) {
+		f := ParseFilter(FilterConfig{
+			BlockedCIDRs:     []string{"10.1.0.0/16"},
+			BlockedCountries: []string{"CN"},
+		})
+		assert.Equal(t, DenyCIDR, f.Check(netip.MustParseAddr("10.1.2.3"), geo), "in blocked CIDR")
+		assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("2.2.2.2"), geo), "in blocked country")
+		assert.Equal(t, Allow, f.Check(netip.MustParseAddr("3.3.3.3"), geo), "in neither blocklist")
+	})
+}
+
+// TestFilter_Check_AllowCIDRPlusAllowCountryDeniesGeolessLAN documents a trap
+// with all/AND mode: pairing an allowed CIDR (a private LAN) with an allowed
+// country denies the LAN source, because a private IP has no country in the
+// geo DB and an active country allowlist denies unknown countries. Under an
+// "any" mode the CIDR match alone would admit it. This is the strongest reason
+// allow-CIDR + allow-country usually wants OR, not AND.
+func TestFilter_Check_AllowCIDRPlusAllowCountryDeniesGeolessLAN(t *testing.T) {
+	geo := newMockGeo(map[string]string{}) // no entries: every lookup is unknown country
+	f := ParseFilter(FilterConfig{
+		AllowedCIDRs:     []string{"192.168.50.0/24"},
+		AllowedCountries: []string{"US"},
+	})
+
+	got := f.Check(netip.MustParseAddr("192.168.50.5"), geo)
+	assert.Equal(t, DenyCountry, got, "GAP: LAN source in allowed CIDR is denied by the country allowlist; any-mode should Allow")
+}
+
+func TestFilter_Check_AllowMatchAny(t *testing.T) {
+	bannedIP := "203.0.113.9"
+	geo := newMockGeo(map[string]string{
+		"1.1.1.1":      "US", // allowed country, outside allowed CIDR
+		"203.0.113.7":  "DE", // allowed CIDR, non-allowed country
+		"203.0.113.8":  "US", // both
+		bannedIP:       "US", // allowed CIDR, but CrowdSec-banned
+		"198.51.100.1": "CN", // neither
+		"2.2.2.2":      "CN", // blocked country, but in allowed CIDR
+	})
+
+	tests := []struct {
+		name   string
+		config FilterConfig
+		addr   string
+		geo    GeoResolver
+		want   Verdict
+	}{
+		{
+			name:   "in allowed CIDR only",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "203.0.113.7", geo: geo, want: Allow,
+		},
+		{
+			name:   "in allowed country only",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "1.1.1.1", geo: geo, want: Allow,
+		},
+		{
+			name:   "in both",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "203.0.113.8", geo: geo, want: Allow,
+		},
+		{
+			name:   "in neither",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "198.51.100.1", geo: geo, want: DenyCIDR,
+		},
+		{
+			name:   "geoless LAN admitted via CIDR (the #597 trap, fixed)",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"192.168.50.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "192.168.50.5", geo: newMockGeo(map[string]string{}), want: Allow,
+		},
+		{
+			name:   "CIDR match short-circuits geo when geo unavailable",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "203.0.113.7", geo: &unavailableGeo{}, want: Allow,
+		},
+		{
+			name:   "geo unavailable fails closed when CIDR does not match",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"203.0.113.0/24"}, AllowedCountries: []string{"US"}},
+			addr:   "1.1.1.1", geo: &unavailableGeo{}, want: DenyGeoUnavailable,
+		},
+		{
+			name:   "block gate wins over allowed CIDR (blocked country)",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCIDRs: []string{"0.0.0.0/0"}, BlockedCountries: []string{"CN"}},
+			addr:   "2.2.2.2", geo: geo, want: DenyCountry,
+		},
+		{
+			name:   "block gate wins over allowed country (blocked CIDR)",
+			config: FilterConfig{AllowMatch: AllowMatchAny, AllowedCountries: []string{"US"}, BlockedCIDRs: []string{"203.0.113.0/24"}},
+			addr:   "203.0.113.8", geo: geo, want: DenyCIDR,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			f := ParseFilter(tc.config)
+			assert.Equal(t, tc.want, f.Check(netip.MustParseAddr(tc.addr), tc.geo))
+		})
+	}
+}
+
+func TestFilter_Check_AllowMatchAny_CrowdSecStillRuns(t *testing.T) {
+	bannedIP := "203.0.113.9"
+	cs := &mockCrowdSec{decisions: map[string]*CrowdSecDecision{bannedIP: {Type: DecisionBan}}, ready: true}
+	geo := newMockGeo(map[string]string{bannedIP: "US", "203.0.113.7": "US"})
+
+	f := ParseFilter(FilterConfig{
+		AllowMatch:   AllowMatchAny,
+		AllowedCIDRs: []string{"203.0.113.0/24"},
+		CrowdSec:     cs,
+		CrowdSecMode: CrowdSecEnforce,
+	})
+	assert.Equal(t, DenyCrowdSecBan, f.Check(netip.MustParseAddr(bannedIP), geo), "CrowdSec ban denies even when allowlist admits")
+	assert.Equal(t, Allow, f.Check(netip.MustParseAddr("203.0.113.7"), geo), "clean IP in allowed CIDR is allowed")
+}
+
+func TestFilter_Check_UnknownAllowMatchDefaultsToAll(t *testing.T) {
+	// An unrecognized allow-combine mode must fall back to the restrictive
+	// AND default, never loosen access.
+	geo := newMockGeo(map[string]string{"203.0.113.7": "DE"})
+	f := ParseFilter(FilterConfig{
+		AllowMatch:       AllowMatch("bogus"),
+		AllowedCIDRs:     []string{"203.0.113.0/24"},
+		AllowedCountries: []string{"US"},
+	})
+	assert.Equal(t, AllowMatchAll, f.AllowMatch, "unknown mode normalizes to all")
+	assert.Equal(t, DenyCountry, f.Check(netip.MustParseAddr("203.0.113.7"), geo), "AND semantics: in CIDR but wrong country denied")
+}
+
 func TestParseFilter_Empty(t *testing.T) {
 	f := ParseFilter(FilterConfig{})
 	assert.Nil(t, f)

proxy/lifecycle.go

@@ -126,6 +126,15 @@ type Config struct {
 	// CrowdSecAPIKey is the CrowdSec bouncer API key. Empty disables
 	// CrowdSec.
 	CrowdSecAPIKey string
+	// CrowdSecAppSecURL is the CrowdSec AppSec (WAF) endpoint. Empty disables
+	// HTTP request inspection.
+	CrowdSecAppSecURL string
+	// CrowdSecAppSecTimeout bounds a single AppSec inspection call. Zero falls
+	// back to the internal default.
+	CrowdSecAppSecTimeout time.Duration
+	// CrowdSecAppSecMaxBodyBytes caps the request body mirrored to AppSec.
+	// Zero falls back to the internal default; negative forwards no body.
+	CrowdSecAppSecMaxBodyBytes int64
 }
 
 // New builds a Server from cfg without performing any I/O. No goroutines
@@ -135,42 +144,45 @@ type Config struct {
 // directly) byte-for-byte equivalent.
 func New(ctx context.Context, cfg Config) *Server {
 	return &Server{
-		ctx:                      ctx,
-		ListenAddr:               cfg.ListenAddr,
-		ID:                       cfg.ID,
-		Logger:                   cfg.Logger,
-		Version:                  cfg.Version,
-		ProxyURL:                 cfg.ProxyURL,
-		ManagementAddress:        cfg.ManagementAddress,
-		ProxyToken:               cfg.ProxyToken,
-		CertificateDirectory:     cfg.CertificateDirectory,
-		CertificateFile:          cfg.CertificateFile,
-		CertificateKeyFile:       cfg.CertificateKeyFile,
-		GenerateACMECertificates: cfg.GenerateACMECertificates,
-		ACMEChallengeAddress:     cfg.ACMEChallengeAddress,
-		ACMEDirectory:            cfg.ACMEDirectory,
-		ACMEEABKID:               cfg.ACMEEABKID,
-		ACMEEABHMACKey:           cfg.ACMEEABHMACKey,
-		ACMEChallengeType:        cfg.ACMEChallengeType,
-		CertLockMethod:           cfg.CertLockMethod,
-		WildcardCertDir:          cfg.WildcardCertDir,
-		DebugEndpointEnabled:     cfg.DebugEndpointEnabled,
-		DebugEndpointAddress:     cfg.DebugEndpointAddress,
-		HealthAddress:            cfg.HealthAddr,
-		ForwardedProto:           cfg.ForwardedProto,
-		TrustedProxies:           cfg.TrustedProxies,
-		WireguardPort:            cfg.WireguardPort,
-		ProxyProtocol:            cfg.ProxyProtocol,
-		PreSharedKey:             cfg.PreSharedKey,
-		Performance:              cfg.Performance,
-		SupportsCustomPorts:      cfg.SupportsCustomPorts,
-		RequireSubdomain:         cfg.RequireSubdomain,
-		Private:                  cfg.Private,
-		MaxDialTimeout:           cfg.MaxDialTimeout,
-		MaxSessionIdleTimeout:    cfg.MaxSessionIdleTimeout,
-		MappingBatchWatchdog:     cfg.MappingBatchWatchdog,
-		GeoDataDir:               cfg.GeoDataDir,
-		CrowdSecAPIURL:           cfg.CrowdSecAPIURL,
-		CrowdSecAPIKey:           cfg.CrowdSecAPIKey,
+		ctx:                        ctx,
+		ListenAddr:                 cfg.ListenAddr,
+		ID:                         cfg.ID,
+		Logger:                     cfg.Logger,
+		Version:                    cfg.Version,
+		ProxyURL:                   cfg.ProxyURL,
+		ManagementAddress:          cfg.ManagementAddress,
+		ProxyToken:                 cfg.ProxyToken,
+		CertificateDirectory:       cfg.CertificateDirectory,
+		CertificateFile:            cfg.CertificateFile,
+		CertificateKeyFile:         cfg.CertificateKeyFile,
+		GenerateACMECertificates:   cfg.GenerateACMECertificates,
+		ACMEChallengeAddress:       cfg.ACMEChallengeAddress,
+		ACMEDirectory:              cfg.ACMEDirectory,
+		ACMEEABKID:                 cfg.ACMEEABKID,
+		ACMEEABHMACKey:             cfg.ACMEEABHMACKey,
+		ACMEChallengeType:          cfg.ACMEChallengeType,
+		CertLockMethod:             cfg.CertLockMethod,
+		WildcardCertDir:            cfg.WildcardCertDir,
+		DebugEndpointEnabled:       cfg.DebugEndpointEnabled,
+		DebugEndpointAddress:       cfg.DebugEndpointAddress,
+		HealthAddress:              cfg.HealthAddr,
+		ForwardedProto:             cfg.ForwardedProto,
+		TrustedProxies:             cfg.TrustedProxies,
+		WireguardPort:              cfg.WireguardPort,
+		ProxyProtocol:              cfg.ProxyProtocol,
+		PreSharedKey:               cfg.PreSharedKey,
+		Performance:                cfg.Performance,
+		SupportsCustomPorts:        cfg.SupportsCustomPorts,
+		RequireSubdomain:           cfg.RequireSubdomain,
+		Private:                    cfg.Private,
+		MaxDialTimeout:             cfg.MaxDialTimeout,
+		MaxSessionIdleTimeout:      cfg.MaxSessionIdleTimeout,
+		MappingBatchWatchdog:       cfg.MappingBatchWatchdog,
+		GeoDataDir:                 cfg.GeoDataDir,
+		CrowdSecAPIURL:             cfg.CrowdSecAPIURL,
+		CrowdSecAPIKey:             cfg.CrowdSecAPIKey,
+		CrowdSecAppSecURL:          cfg.CrowdSecAppSecURL,
+		CrowdSecAppSecTimeout:      cfg.CrowdSecAppSecTimeout,
+		CrowdSecAppSecMaxBodyBytes: cfg.CrowdSecAppSecMaxBodyBytes,
 	}
 }

proxy/management_integration_test.go

@@ -240,6 +240,10 @@ func (m *testProxyManager) ClusterSupportsCrowdSec(_ context.Context, _ string)
 	return nil
 }
 
+func (m *testProxyManager) ClusterSupportsAppSec(_ context.Context, _ string) *bool {
+	return nil
+}
+
 func (m *testProxyManager) ClusterSupportsPrivate(_ context.Context, _ string) *bool {
 	return nil
 }
@@ -562,16 +566,11 @@ func TestIntegration_ProxyConnection_ReconnectDoesNotDuplicateState(t *testing.T
 				addMappingCalls.Add(1)
 
 				// Apply to real auth middleware (idempotent)
-				err := authMw.AddDomain(
-					mapping.GetDomain(),
-					nil,
-					"",
-					0,
-					proxytypes.AccountID(mapping.GetAccountId()),
-					proxytypes.ServiceID(mapping.GetId()),
-					nil,
-					mapping.GetPrivate(),
-				)
+				err := authMw.AddDomain(mapping.GetDomain(), auth.DomainSettings{
+					AccountID: proxytypes.AccountID(mapping.GetAccountId()),
+					ServiceID: proxytypes.ServiceID(mapping.GetId()),
+					Private:   mapping.GetPrivate(),
+				})
 				require.NoError(t, err)
 
 				// Apply to real proxy (idempotent)

proxy/server.go

@@ -45,6 +45,7 @@ import (
 	"github.com/netbirdio/netbird/client/embed"
 	"github.com/netbirdio/netbird/proxy/internal/accesslog"
 	"github.com/netbirdio/netbird/proxy/internal/acme"
+	"github.com/netbirdio/netbird/proxy/internal/appsec"
 	"github.com/netbirdio/netbird/proxy/internal/auth"
 	"github.com/netbirdio/netbird/proxy/internal/certwatch"
 	"github.com/netbirdio/netbird/proxy/internal/conntrack"
@@ -126,6 +127,10 @@ type Server struct {
 	crowdsecMu       sync.Mutex
 	crowdsecServices map[types.ServiceID]bool
 
+	// appsecClient is the shared CrowdSec AppSec client, nil when no AppSec
+	// endpoint is configured. Stateless, so it needs no per-service lifecycle.
+	appsecClient *appsec.Client
+
 	// routerReady is closed once mainRouter is fully initialized.
 	// The mapping worker waits on this before processing updates.
 	routerReady chan struct{}
@@ -238,6 +243,17 @@ type Server struct {
 	CrowdSecAPIURL string
 	// CrowdSecAPIKey is the CrowdSec bouncer API key. Empty disables CrowdSec.
 	CrowdSecAPIKey string
+	// CrowdSecAppSecURL is the CrowdSec AppSec (WAF) endpoint, e.g.
+	// http://127.0.0.1:7422/. Empty disables request inspection. Requires
+	// CrowdSecAPIKey, which the AppSec component validates against LAPI.
+	CrowdSecAppSecURL string
+	// CrowdSecAppSecTimeout bounds a single AppSec inspection call.
+	// Zero means appsec.DefaultTimeout.
+	CrowdSecAppSecTimeout time.Duration
+	// CrowdSecAppSecMaxBodyBytes caps the request body mirrored to the AppSec
+	// engine. Zero means appsec.DefaultMaxBodyBytes; negative disables body
+	// forwarding, leaving header and URI inspection.
+	CrowdSecAppSecMaxBodyBytes int64
 	// MaxSessionIdleTimeout caps the per-service session idle timeout.
 	// Zero means no cap (the proxy honors whatever management sends).
 	// Set via NB_PROXY_MAX_SESSION_IDLE_TIMEOUT for shared deployments.
@@ -411,6 +427,10 @@ func (s *Server) Start(ctx context.Context) error {
 	}()
 
 	s.auth = auth.NewMiddleware(s.Logger, s.mgmtClient, s.geo)
+	// Must follow the auth middleware: the AppSec client is installed on it.
+	if err := s.initAppSec(); err != nil {
+		return err
+	}
 	s.accessLog = accesslog.NewLogger(s.mgmtClient, s.Logger, s.TrustedProxies)
 
 	s.startDebugEndpoint()
@@ -1274,6 +1294,7 @@ func (s *Server) newManagementMappingWorker(ctx context.Context, client proto.Pr
 
 func (s *Server) proxyCapabilities() *proto.ProxyCapabilities {
 	supportsCrowdSec := s.crowdsecRegistry.Available()
+	supportsAppSec := s.appsecClient != nil
 	privateCapability := s.Private
 	// Always true: this build enforces ProxyMapping.private via the auth middleware.
 	supportsPrivateService := true
@@ -1281,6 +1302,7 @@ func (s *Server) proxyCapabilities() *proto.ProxyCapabilities {
 		SupportsCustomPorts:    &s.SupportsCustomPorts,
 		RequireSubdomain:       &s.RequireSubdomain,
 		SupportsCrowdsec:       &supportsCrowdSec,
+		SupportsAppsec:         &supportsAppSec,
 		Private:                &privateCapability,
 		SupportsPrivateService: &supportsPrivateService,
 	}
@@ -1904,10 +1926,51 @@ func (s *Server) parseRestrictions(mapping *proto.ProxyMapping) *restrict.Filter
 		BlockedCountries: r.GetBlockedCountries(),
 		CrowdSec:         checker,
 		CrowdSecMode:     csMode,
+		AllowMatch:       restrict.AllowMatch(r.GetAllowMatch()),
 		Logger:           log.NewEntry(s.Logger),
 	})
 }
 
+// initAppSec builds the shared AppSec client when an endpoint is configured.
+// A configured-but-invalid endpoint is a startup error rather than a silent
+// downgrade: services asking for enforce would otherwise fail closed on every
+// request with no indication why.
+func (s *Server) initAppSec() error {
+	if s.CrowdSecAppSecURL == "" {
+		return nil
+	}
+	if s.CrowdSecAPIKey == "" {
+		return errors.New("crowdsec appsec url is set but the crowdsec api key is empty")
+	}
+
+	client, err := appsec.New(appsec.Config{
+		URL:          s.CrowdSecAppSecURL,
+		APIKey:       s.CrowdSecAPIKey,
+		Timeout:      s.CrowdSecAppSecTimeout,
+		MaxBodyBytes: s.CrowdSecAppSecMaxBodyBytes,
+		Logger:       log.NewEntry(s.Logger),
+	})
+	if err != nil {
+		return fmt.Errorf("init crowdsec appsec: %w", err)
+	}
+
+	s.appsecClient = client
+	s.auth.SetAppSec(client)
+	s.Logger.Infof("CrowdSec AppSec inspection available at %s", s.CrowdSecAppSecURL)
+	return nil
+}
+
+// appSecMode resolves the per-service AppSec mode. A service asking for
+// inspection on a proxy with no AppSec endpoint keeps its mode so the auth
+// middleware fails closed for enforce, mirroring the CrowdSec behavior.
+func (s *Server) appSecMode(mapping *proto.ProxyMapping) restrict.AppSecMode {
+	mode := restrict.ParseAppSecMode(mapping.GetAccessRestrictions().GetAppsecMode())
+	if mode.Enabled() && s.appsecClient == nil {
+		s.Logger.Warnf("service %s requests AppSec mode %q but proxy has no AppSec endpoint configured", mapping.GetId(), mode)
+	}
+	return mode
+}
+
 // releaseCrowdSec releases the CrowdSec bouncer reference for the given
 // service if it had one.
 func (s *Server) releaseCrowdSec(svcID types.ServiceID) {
@@ -2074,7 +2137,17 @@ func (s *Server) updateMapping(ctx context.Context, mapping *proto.ProxyMapping)
 	s.warnIfGeoUnavailable(mapping.GetDomain(), mapping.GetAccessRestrictions())
 
 	maxSessionAge := time.Duration(mapping.GetAuth().GetMaxSessionAgeSeconds()) * time.Second
-	if err := s.auth.AddDomain(mapping.GetDomain(), schemes, mapping.GetAuth().GetSessionKey(), maxSessionAge, accountID, svcID, ipRestrictions, mapping.GetPrivate()); err != nil {
+	settings := auth.DomainSettings{
+		Schemes:           schemes,
+		SessionPublicKey:  mapping.GetAuth().GetSessionKey(),
+		SessionExpiration: maxSessionAge,
+		AccountID:         accountID,
+		ServiceID:         svcID,
+		IPRestrictions:    ipRestrictions,
+		Private:           mapping.GetPrivate(),
+		AppSecMode:        s.appSecMode(mapping),
+	}
+	if err := s.auth.AddDomain(mapping.GetDomain(), settings); err != nil {
 		return fmt.Errorf("auth setup for domain %s: %w", mapping.GetDomain(), err)
 	}
 	m := s.protoToMapping(ctx, mapping)

shared/management/http/api/openapi.yml

@@ -3379,6 +3379,30 @@ components:
             - "observe"
           default: "off"
           description: CrowdSec IP reputation mode. Only available when the proxy cluster supports CrowdSec.
+        allow_match:
+          type: string
+          enum:
+            - "all"
+            - "any"
+          default: "all"
+          description: >-
+            How the allowlists (allowed_cidrs, allowed_countries) combine.
+            "all" (default) requires a connection to match every configured
+            allowlist (AND); "any" requires it to match at least one (OR), e.g.
+            an allowed country OR an allowed CIDR. Blocklists always reject on
+            match regardless of this setting.
+        appsec_mode:
+          type: string
+          enum:
+            - "off"
+            - "enforce"
+            - "observe"
+          default: "off"
+          description: >-
+            CrowdSec AppSec (WAF) request inspection mode. Only available when
+            the proxy cluster supports AppSec, and only applied to HTTP
+            services. "enforce" blocks requests the WAF flags; "observe" records
+            the verdict in the access log without blocking.
     PasswordAuthConfig:
       type: object
       properties:
@@ -3515,6 +3539,10 @@ components:
           type: boolean
           description: Whether all active proxies in the cluster have CrowdSec configured
           example: false
+        supports_appsec:
+          type: boolean
+          description: Whether all active proxies in the cluster have a CrowdSec AppSec (WAF) endpoint configured
+          example: false
         private:
           type: boolean
           description: True when at least one connected proxy in this cluster is running embedded in a netbird client (`netbird proxy`) and serving over a WireGuard tunnel. Lets the dashboard distinguish per-peer / private clusters from centralised ones.
@@ -3574,6 +3602,10 @@ components:
           type: boolean
           description: Whether the proxy cluster has CrowdSec configured
           example: false
+        supports_appsec:
+          type: boolean
+          description: Whether the proxy cluster has a CrowdSec AppSec (WAF) endpoint configured
+          example: false
         supports_private:
           type: boolean
           description: Whether the proxy cluster supports private (NetBird-only) services. True when at least one connected proxy in the cluster runs embedded in a netbird client.

shared/management/http/api/types.gen.go

@@ -17,6 +17,45 @@ const (
 	TokenAuthScopes  tokenAuthContextKey  = "TokenAuth.Scopes"
 )
 
+// Defines values for AccessRestrictionsAllowMatch.
+const (
+	AccessRestrictionsAllowMatchAll AccessRestrictionsAllowMatch = "all"
+	AccessRestrictionsAllowMatchAny AccessRestrictionsAllowMatch = "any"
+)
+
+// Valid indicates whether the value is a known member of the AccessRestrictionsAllowMatch enum.
+func (e AccessRestrictionsAllowMatch) Valid() bool {
+	switch e {
+	case AccessRestrictionsAllowMatchAll:
+		return true
+	case AccessRestrictionsAllowMatchAny:
+		return true
+	default:
+		return false
+	}
+}
+
+// Defines values for AccessRestrictionsAppsecMode.
+const (
+	AccessRestrictionsAppsecModeEnforce AccessRestrictionsAppsecMode = "enforce"
+	AccessRestrictionsAppsecModeObserve AccessRestrictionsAppsecMode = "observe"
+	AccessRestrictionsAppsecModeOff     AccessRestrictionsAppsecMode = "off"
+)
+
+// Valid indicates whether the value is a known member of the AccessRestrictionsAppsecMode enum.
+func (e AccessRestrictionsAppsecMode) Valid() bool {
+	switch e {
+	case AccessRestrictionsAppsecModeEnforce:
+		return true
+	case AccessRestrictionsAppsecModeObserve:
+		return true
+	case AccessRestrictionsAppsecModeOff:
+		return true
+	default:
+		return false
+	}
+}
+
 // Defines values for AccessRestrictionsCrowdsecMode.
 const (
 	AccessRestrictionsCrowdsecModeEnforce AccessRestrictionsCrowdsecMode = "enforce"
@@ -1534,12 +1573,18 @@ func (e PutApiIntegrationsMspTenantsIdInviteJSONBodyValue) Valid() bool {
 
 // AccessRestrictions Connection-level access restrictions based on IP address or geography. Applies to both HTTP and L4 services.
 type AccessRestrictions struct {
+	// AllowMatch How the allowlists (allowed_cidrs, allowed_countries) combine. "all" (default) requires a connection to match every configured allowlist (AND); "any" requires it to match at least one (OR), e.g. an allowed country OR an allowed CIDR. Blocklists always reject on match regardless of this setting.
+	AllowMatch *AccessRestrictionsAllowMatch `json:"allow_match,omitempty"`
+
 	// AllowedCidrs CIDR allowlist. If non-empty, only IPs matching these CIDRs are allowed.
 	AllowedCidrs *[]string `json:"allowed_cidrs,omitempty"`
 
 	// AllowedCountries ISO 3166-1 alpha-2 country codes to allow. If non-empty, only these countries are permitted.
 	AllowedCountries *[]string `json:"allowed_countries,omitempty"`
 
+	// AppsecMode CrowdSec AppSec (WAF) request inspection mode. Only available when the proxy cluster supports AppSec, and only applied to HTTP services. "enforce" blocks requests the WAF flags; "observe" records the verdict in the access log without blocking.
+	AppsecMode *AccessRestrictionsAppsecMode `json:"appsec_mode,omitempty"`
+
 	// BlockedCidrs CIDR blocklist. Connections from these CIDRs are rejected. Evaluated after allowed_cidrs.
 	BlockedCidrs *[]string `json:"blocked_cidrs,omitempty"`
 
@@ -1550,6 +1595,12 @@ type AccessRestrictions struct {
 	CrowdsecMode *AccessRestrictionsCrowdsecMode `json:"crowdsec_mode,omitempty"`
 }
 
+// AccessRestrictionsAllowMatch How the allowlists (allowed_cidrs, allowed_countries) combine. "all" (default) requires a connection to match every configured allowlist (AND); "any" requires it to match at least one (OR), e.g. an allowed country OR an allowed CIDR. Blocklists always reject on match regardless of this setting.
+type AccessRestrictionsAllowMatch string
+
+// AccessRestrictionsAppsecMode CrowdSec AppSec (WAF) request inspection mode. Only available when the proxy cluster supports AppSec, and only applied to HTTP services. "enforce" blocks requests the WAF flags; "observe" records the verdict in the access log without blocking.
+type AccessRestrictionsAppsecMode string
+
 // AccessRestrictionsCrowdsecMode CrowdSec IP reputation mode. Only available when the proxy cluster supports CrowdSec.
 type AccessRestrictionsCrowdsecMode string
 
@@ -4665,6 +4716,9 @@ type ProxyCluster struct {
 	// RequireSubdomain Whether services on this cluster must include a subdomain label
 	RequireSubdomain *bool `json:"require_subdomain,omitempty"`
 
+	// SupportsAppsec Whether all active proxies in the cluster have a CrowdSec AppSec (WAF) endpoint configured
+	SupportsAppsec *bool `json:"supports_appsec,omitempty"`
+
 	// SupportsCrowdsec Whether all active proxies in the cluster have CrowdSec configured
 	SupportsCrowdsec *bool `json:"supports_crowdsec,omitempty"`
 
@@ -4733,6 +4787,9 @@ type ReverseProxyDomain struct {
 	// RequireSubdomain Whether a subdomain label is required in front of this domain. When true, the domain cannot be used bare.
 	RequireSubdomain *bool `json:"require_subdomain,omitempty"`
 
+	// SupportsAppsec Whether the proxy cluster has a CrowdSec AppSec (WAF) endpoint configured
+	SupportsAppsec *bool `json:"supports_appsec,omitempty"`
+
 	// SupportsCrowdsec Whether the proxy cluster has CrowdSec configured
 	SupportsCrowdsec *bool `json:"supports_crowdsec,omitempty"`
 

shared/management/networkmap/decode.go

@@ -11,9 +11,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
-	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/management/proto"
@@ -38,17 +35,17 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 		Network:             decodeAccountNetwork(full.Network),
 		AccountSettings:     decodeAccountSettings(full.AccountSettings),
 		CustomZoneDomain:    full.CustomZoneDomain,
-		Peers:               make(map[string]*nbpeer.Peer, len(full.Peers)),
-		Groups:              make(map[string]*types.Group, len(full.Groups)),
+		Peers:               make(map[string]*types.ComponentPeer, len(full.Peers)),
+		Groups:              make(map[string]*types.ComponentGroup, len(full.Groups)),
 		Policies:            make([]*types.Policy, 0, len(full.Policies)),
 		Routes:              make([]*nbroute.Route, 0, len(full.Routes)),
 		NameServerGroups:    make([]*nbdns.NameServerGroup, 0, len(full.NameserverGroups)),
 		AllDNSRecords:       decodeSimpleRecords(full.AllDnsRecords),
 		AccountZones:        decodeCustomZones(full.AccountZones),
 		ResourcePoliciesMap: make(map[string][]*types.Policy),
-		RoutersMap:          make(map[string]map[string]*routerTypes.NetworkRouter),
-		NetworkResources:    make([]*resourceTypes.NetworkResource, 0, len(full.NetworkResources)),
-		RouterPeers:         make(map[string]*nbpeer.Peer),
+		RoutersMap:          make(map[string]map[string]*types.ComponentRouter),
+		NetworkResources:    make([]*types.ComponentResource, 0, len(full.NetworkResources)),
+		RouterPeers:         make(map[string]*types.ComponentPeer),
 		AllowedUserIDs:      stringSliceToSet(full.AllowedUserIds),
 		PostureFailedPeers:  make(map[string]map[string]struct{}, len(full.PostureFailedPeers)),
 		GroupIDToUserIDs:    make(map[string][]string, len(full.GroupIdToUserIds)),
@@ -101,7 +98,7 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 				log.WithField("peer idx", idx).Error("unrecognized peer idx during decoding")
 			}
 		}
-		group := &types.Group{
+		group := &types.ComponentGroup{
 			ID:       groupID,
 			PublicID: gc.Id,
 			Peers:    peerIDs,
@@ -151,7 +148,7 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 	// Phase 7: routers_map (outer key = network seq id, inner key = peer-id
 	// reconstructed from peer_index). Synthesized network id is "net_<seq>".
 	for networkID, list := range full.RoutersMap {
-		inner := make(map[string]*routerTypes.NetworkRouter, len(list.Entries))
+		inner := make(map[string]*types.ComponentRouter, len(list.Entries))
 		for _, entry := range list.Entries {
 			if !entry.PeerIndexSet {
 				continue
@@ -161,8 +158,7 @@ func DecodeEnvelope(env *proto.NetworkMapEnvelope) (*types.NetworkMapComponents,
 				continue
 			}
 			peerID := peerIDByIndex[entry.PeerIndex]
-			inner[peerID] = &routerTypes.NetworkRouter{
-				ID:         "",
+			inner[peerID] = &types.ComponentRouter{
 				NetworkID:  networkID,
 				PublicID:   entry.Id,
 				Peer:       peerID,
@@ -264,40 +260,22 @@ func decodeAccountSettings(as *proto.AccountSettingsCompact) *types.AccountSetti
 	}
 }
 
-func decodePeerCompact(pc *proto.PeerCompact, peerID string) *nbpeer.Peer {
-	var caps []int32
-	if pc.SupportsSourcePrefixes {
-		caps = append(caps, nbpeer.PeerCapabilitySourcePrefixes)
-	}
-	if pc.SupportsIpv6 {
-		caps = append(caps, nbpeer.PeerCapabilityIPv6Overlay)
-	}
-	peer := &nbpeer.Peer{
+func decodePeerCompact(pc *proto.PeerCompact, peerID string) *types.ComponentPeer {
+	peer := &types.ComponentPeer{
 		ID:                     peerID,
 		Key:                    peerID,
 		SSHKey:                 string(pc.SshPubKey),
 		SSHEnabled:             pc.SshEnabled,
 		DNSLabel:               pc.DnsLabel,
 		LoginExpirationEnabled: pc.LoginExpirationEnabled,
-		Meta: nbpeer.PeerSystemMeta{
-			WtVersion:    pc.AgentVersion,
-			Capabilities: caps,
-			Flags: nbpeer.Flags{
-				ServerSSHAllowed: pc.ServerSshAllowed,
-			},
-		},
-	}
-	if pc.AddedWithSsoLogin {
-		// Set a non-empty UserID so (*Peer).AddedWithSSOLogin() returns true.
-		// The original UserID isn't on the wire; the value is intentionally
-		// visibly synthetic so any future consumer that mistakes UserID for a
-		// real account user xid won't silently match (or worse, write the
-		// sentinel into a downstream record).
-		peer.UserID = "<env-sso>"
+		AgentVersion:           pc.AgentVersion,
+		SupportsSourcePrefixes: pc.SupportsSourcePrefixes,
+		SupportsIPv6:           pc.SupportsIpv6,
+		ServerSSHAllowed:       pc.ServerSshAllowed,
+		AddedWithSSOLogin:      pc.AddedWithSsoLogin,
 	}
 	if pc.LastLoginUnixNano != 0 {
-		t := time.Unix(0, pc.LastLoginUnixNano)
-		peer.LastLogin = &t
+		peer.LastLogin = time.Unix(0, pc.LastLoginUnixNano)
 	}
 	switch len(pc.Ip) {
 	case 4:
@@ -424,14 +402,14 @@ func decodeNameServerGroupRaw(nsg *proto.NameServerGroupRaw) *nbdns.NameServerGr
 	return out
 }
 
-func decodeNetworkResource(nr *proto.NetworkResourceRaw) *resourceTypes.NetworkResource {
-	out := &resourceTypes.NetworkResource{
+func decodeNetworkResource(nr *proto.NetworkResourceRaw) *types.ComponentResource {
+	out := &types.ComponentResource{
 		ID:          nr.Id,
 		PublicID:    nr.Id,
 		NetworkID:   nr.NetworkSeq,
 		Name:        nr.Name,
 		Description: nr.Description,
-		Type:        resourceTypes.NetworkResourceType(nr.Type),
+		Type:        types.ComponentResourceType(nr.Type),
 		Address:     nr.Address,
 		Domain:      nr.DomainValue,
 		Enabled:     nr.Enabled,

shared/management/networkmap/encode.go

@@ -20,7 +20,6 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 	"net/netip"
 
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	nbroute "github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/types"
@@ -274,7 +273,7 @@ func ToProtocolDNSConfig(update nbdns.Config, cache DNSConfigCache, forwardPort
 
 // AppendRemotePeerConfig appends typed peers as proto.RemotePeerConfig
 // entries to dst and returns the result.
-func AppendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*nbpeer.Peer, dnsName string, includeIPv6 bool) []*proto.RemotePeerConfig {
+func AppendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*types.ComponentPeer, dnsName string, includeIPv6 bool) []*proto.RemotePeerConfig {
 	for _, rPeer := range peers {
 		allowedIPs := []string{rPeer.IP.String() + "/32"}
 		if includeIPv6 && rPeer.IPv6.IsValid() {
@@ -285,7 +284,7 @@ func AppendRemotePeerConfig(dst []*proto.RemotePeerConfig, peers []*nbpeer.Peer,
 			AllowedIps:   allowedIPs,
 			SshConfig:    &proto.SSHConfig{SshPubKey: []byte(rPeer.SSHKey)},
 			Fqdn:         rPeer.FQDN(dnsName),
-			AgentVersion: rPeer.Meta.WtVersion,
+			AgentVersion: rPeer.AgentVersion,
 		})
 	}
 	return dst

shared/management/networkmap/envelope.go

@@ -54,8 +54,8 @@ func EnvelopeToNetworkMap(ctx context.Context, env *proto.NetworkMapEnvelope, lo
 	}
 	components.PeerID = canonicalKey
 
-	includeIPv6 := localPeer.SupportsIPv6() && localPeer.IPv6.IsValid()
-	useSourcePrefixes := localPeer.SupportsSourcePrefixes()
+	includeIPv6 := localPeer.SupportsIPv6 && localPeer.IPv6.IsValid()
+	useSourcePrefixes := localPeer.SupportsSourcePrefixes
 
 	typedNM := components.Calculate(ctx)
 

shared/management/networkmap/envelope_test.go

@@ -13,7 +13,6 @@ import (
 	goproto "google.golang.org/protobuf/proto"
 
 	mgmtgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
 	nbnetworkmap "github.com/netbirdio/netbird/shared/management/networkmap"
 	"github.com/netbirdio/netbird/shared/management/proto"
@@ -144,14 +143,14 @@ func TestDecodeEnvelope_MalformedWgKeyPeerSkipped(t *testing.T) {
 func TestEnvelopeRoundTrip_AllGroupShortCircuitParity(t *testing.T) {
 	ctx := context.Background()
 
-	peers := map[string]*nbpeer.Peer{}
+	peers := map[string]*types.ComponentPeer{}
 	for i, id := range []string{"peer-T", "peer-S", "peer-ALL", "peer-O"} {
-		peers[id] = &nbpeer.Peer{
-			ID:       id,
-			Key:      randomWgKey(t),
-			IP:       netip.AddrFrom4([4]byte{100, 64, 0, byte(i + 1)}),
-			DNSLabel: id,
-			Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
+		peers[id] = &types.ComponentPeer{
+			ID:           id,
+			Key:          randomWgKey(t),
+			IP:           netip.AddrFrom4([4]byte{100, 64, 0, byte(i + 1)}),
+			DNSLabel:     id,
+			AgentVersion: "0.40.0",
 		}
 	}
 
@@ -165,7 +164,7 @@ func TestEnvelopeRoundTrip_AllGroupShortCircuitParity(t *testing.T) {
 		AccountSettings: &types.AccountSettingsInfo{},
 		DNSSettings:     &types.DNSSettings{},
 		Peers:           peers,
-		Groups: map[string]*types.Group{
+		Groups: map[string]*types.ComponentGroup{
 			"g-src": {ID: "g-src", PublicID: "1", Name: "staff", Peers: []string{"peer-T", "peer-S"}},
 			"g-all": {ID: "g-all", PublicID: "2", Name: "All", Peers: []string{"peer-ALL"}},
 			"g-two": {ID: "g-two", PublicID: "3", Name: "second", Peers: []string{"peer-T", "peer-O"}},
@@ -232,22 +231,22 @@ func buildSmokeComponents(t *testing.T) (*types.NetworkMapComponents, string) {
 	peerAKey := randomWgKey(t)
 	peerBKey := randomWgKey(t)
 
-	peerA := &nbpeer.Peer{
-		ID:       "peer-A",
-		Key:      peerAKey,
-		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 1}),
-		DNSLabel: "peerA",
-		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
+	peerA := &types.ComponentPeer{
+		ID:           "peer-A",
+		Key:          peerAKey,
+		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 1}),
+		DNSLabel:     "peerA",
+		AgentVersion: "0.40.0",
 	}
-	peerB := &nbpeer.Peer{
-		ID:       "peer-B",
-		Key:      peerBKey,
-		IP:       netip.AddrFrom4([4]byte{100, 64, 0, 2}),
-		DNSLabel: "peerB",
-		Meta:     nbpeer.PeerSystemMeta{WtVersion: "0.40.0"},
+	peerB := &types.ComponentPeer{
+		ID:           "peer-B",
+		Key:          peerBKey,
+		IP:           netip.AddrFrom4([4]byte{100, 64, 0, 2}),
+		DNSLabel:     "peerB",
+		AgentVersion: "0.40.0",
 	}
 
-	group := &types.Group{
+	group := &types.ComponentGroup{
 		ID: "group-all", PublicID: "1", Name: "All",
 		Peers: []string{"peer-A", "peer-B"},
 	}
@@ -274,11 +273,11 @@ func buildSmokeComponents(t *testing.T) (*types.NetworkMapComponents, string) {
 		},
 		AccountSettings: &types.AccountSettingsInfo{},
 		DNSSettings:     &types.DNSSettings{},
-		Peers: map[string]*nbpeer.Peer{
+		Peers: map[string]*types.ComponentPeer{
 			"peer-A": peerA,
 			"peer-B": peerB,
 		},
-		Groups: map[string]*types.Group{
+		Groups: map[string]*types.ComponentGroup{
 			"group-all": group,
 		},
 		Policies: []*types.Policy{policy},

shared/management/proto/proxy_service.proto

@@ -73,6 +73,10 @@ message ProxyCapabilities {
   optional bool private = 4;
   // Whether the proxy enforces ProxyMapping.private (fails closed on ValidateTunnelPeer failure). Management MUST NOT stream private mappings to proxies that don't claim this.
   optional bool supports_private_service = 5;
+  // Whether the proxy has a CrowdSec AppSec (WAF) endpoint configured and can
+  // inspect HTTP requests. Independent of supports_crowdsec: AppSec is a
+  // separate endpoint on the Security Engine and applies to HTTP services only.
+  optional bool supports_appsec = 6;
 }
 
 // GetMappingUpdateRequest is sent to initialise a mapping stream.
@@ -203,6 +207,13 @@ message AccessRestrictions {
   repeated string blocked_countries = 4;
   // CrowdSec IP reputation mode: "", "off", "enforce", or "observe".
   string crowdsec_mode = 5;
+  // How the allowlists (CIDR, country) combine: "" or "all" require matching
+  // every allowlist (AND); "any" requires matching at least one (OR).
+  // Blocklists are always a hard-deny gate, independent of this mode.
+  string allow_match = 6;
+  // CrowdSec AppSec (WAF) request inspection mode: "", "off", "enforce", or
+  // "observe". HTTP services only; ignored for TCP/UDP/TLS modes.
+  string appsec_mode = 7;
 }
 
 message ProxyMapping {

shared/management/types/component_types.go

@@ -0,0 +1,103 @@
+package types
+
+import (
+	"net/netip"
+	"time"
+)
+
+// ComponentPeer is the self-contained peer representation used by
+// NetworkMapComponents and the calculated NetworkMap. It carries exactly the
+// subset of peer data that crosses the components wire format, so the shared
+// calculation layer stays independent of the management server's domain
+// types.
+type ComponentPeer struct {
+	ID                     string
+	Key                    string
+	IP                     netip.Addr
+	IPv6                   netip.Addr
+	DNSLabel               string
+	SSHKey                 string
+	SSHEnabled             bool
+	ServerSSHAllowed       bool
+	AgentVersion           string
+	SupportsSourcePrefixes bool
+	SupportsIPv6           bool
+	LoginExpirationEnabled bool
+	AddedWithSSOLogin      bool
+	LastLogin              time.Time
+}
+
+// FQDN returns the peer's FQDN combined of the peer's DNS label and the system's DNS domain.
+func (p *ComponentPeer) FQDN(dnsDomain string) string {
+	if dnsDomain == "" {
+		return ""
+	}
+	return p.DNSLabel + "." + dnsDomain
+}
+
+// LoginExpired indicates whether the peer's login has expired, mirroring the
+// server-side peer semantics: only SSO-added peers with login expiration
+// enabled can expire.
+func (p *ComponentPeer) LoginExpired(expiresIn time.Duration) (bool, time.Duration) {
+	if !p.AddedWithSSOLogin || !p.LoginExpirationEnabled {
+		return false, 0
+	}
+	timeLeft := time.Until(p.LastLogin.Add(expiresIn))
+	return timeLeft <= 0, timeLeft
+}
+
+// GroupAllName is the reserved name of the default group that contains every peer in an account.
+const GroupAllName = "All"
+
+// ComponentGroup is the self-contained group representation used by
+// NetworkMapComponents: just the membership view the network-map calculation
+// needs, without the server's storage fields.
+type ComponentGroup struct {
+	ID       string
+	PublicID string
+	Name     string
+	Peers    []string
+}
+
+// IsGroupAll checks if the group is a default "All" group.
+func (g *ComponentGroup) IsGroupAll() bool {
+	return g.Name == GroupAllName
+}
+
+// ComponentRouter is the self-contained network-router representation used by
+// NetworkMapComponents.
+type ComponentRouter struct {
+	NetworkID  string
+	PublicID   string
+	Peer       string
+	PeerGroups []string
+	Masquerade bool
+	Metric     int
+	Enabled    bool
+}
+
+// ComponentResourceType mirrors the network-resource type enum on the
+// components wire format.
+type ComponentResourceType string
+
+const (
+	ComponentResourceHost   ComponentResourceType = "host"
+	ComponentResourceSubnet ComponentResourceType = "subnet"
+	ComponentResourceDomain ComponentResourceType = "domain"
+)
+
+// ComponentResource is the self-contained network-resource representation
+// used by NetworkMapComponents.
+type ComponentResource struct {
+	ID          string
+	PublicID    string
+	NetworkID   string
+	AccountID   string
+	Name        string
+	Description string
+	Type        ComponentResourceType
+	Address     string
+	Domain      string
+	Prefix      netip.Prefix
+	Enabled     bool
+}

shared/management/types/firewall_helpers.go

@@ -3,8 +3,6 @@ package types
 import (
 	"strconv"
 
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/version"
 )
 
@@ -48,8 +46,8 @@ func portsIncludesSSH(ports []string) bool {
 }
 
 // ExpandPortsAndRanges expands Ports and PortRanges of a rule into individual firewall rules.
-func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *nbpeer.Peer) []*FirewallRule {
-	features := peerSupportedFirewallFeatures(peer.Meta.WtVersion)
+func ExpandPortsAndRanges(base FirewallRule, rule *PolicyRule, peer *ComponentPeer) []*FirewallRule {
+	features := peerSupportedFirewallFeatures(peer.AgentVersion)
 
 	var expanded []*FirewallRule
 
@@ -106,8 +104,8 @@ func isPortInRule(portString string, portInt uint16, rule *FirewallRule) bool {
 	return rule.Port == portString || (rule.PortRange.Start <= portInt && portInt <= rule.PortRange.End)
 }
 
-func shouldCheckRulesForNativeSSH(supportsNative bool, rule *PolicyRule, peer *nbpeer.Peer) bool {
-	return supportsNative && peer.SSHEnabled && peer.Meta.Flags.ServerSSHAllowed && rule.Protocol == PolicyRuleProtocolTCP
+func shouldCheckRulesForNativeSSH(supportsNative bool, rule *PolicyRule, peer *ComponentPeer) bool {
+	return supportsNative && peer.SSHEnabled && peer.ServerSSHAllowed && rule.Protocol == PolicyRuleProtocolTCP
 }
 
 func peerSupportedFirewallFeatures(peerVer string) supportedFeatures {
@@ -117,13 +115,13 @@ func peerSupportedFirewallFeatures(peerVer string) supportedFeatures {
 
 	var features supportedFeatures
 
-	meetMinVer, err := posture.MeetsMinVersion(firewallRuleMinNativeSSHVer, peerVer)
+	meetMinVer, err := version.MeetsMinVersion(firewallRuleMinNativeSSHVer, peerVer)
 	features.nativeSSH = err == nil && meetMinVer
 
 	if features.nativeSSH {
 		features.portRanges = true
 	} else {
-		meetMinVer, err = posture.MeetsMinVersion(firewallRuleMinPortRangesVer, peerVer)
+		meetMinVer, err = version.MeetsMinVersion(firewallRuleMinPortRangesVer, peerVer)
 		features.portRanges = err == nil && meetMinVer
 	}
 

shared/management/types/firewall_rule.go

@@ -9,7 +9,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	nbroute "github.com/netbirdio/netbird/route"
 )
 
@@ -51,7 +50,7 @@ func (r *FirewallRule) Equal(other *FirewallRule) bool {
 // For static routes, source ranges match the destination family (v4 or v6).
 // For dynamic routes (domain-based), separate v4 and v6 rules are generated
 // so the routing peer's forwarding chain allows both address families.
-func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int, includeIPv6 bool) []*RouteFirewallRule {
+func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule *PolicyRule, groupPeers []*ComponentPeer, direction int, includeIPv6 bool) []*RouteFirewallRule {
 	rulesExists := make(map[string]struct{})
 	rules := make([]*RouteFirewallRule, 0)
 
@@ -107,7 +106,7 @@ func GenerateRouteFirewallRules(ctx context.Context, route *nbroute.Route, rule
 }
 
 // splitPeerSourcesByFamily separates peer IPs into v4 (/32) and v6 (/128) source ranges.
-func splitPeerSourcesByFamily(groupPeers []*nbpeer.Peer) (v4, v6 []string) {
+func splitPeerSourcesByFamily(groupPeers []*ComponentPeer) (v4, v6 []string) {
 	v4 = make([]string, 0, len(groupPeers))
 	v6 = make([]string, 0, len(groupPeers))
 	for _, peer := range groupPeers {

shared/management/types/firewall_rule_test.go

@@ -8,13 +8,12 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 func TestSplitPeerSourcesByFamily(t *testing.T) {
-	peers := []*nbpeer.Peer{
+	peers := []*ComponentPeer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -36,7 +35,7 @@ func TestSplitPeerSourcesByFamily(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_V4Route(t *testing.T) {
-	peers := []*nbpeer.Peer{
+	peers := []*ComponentPeer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -65,7 +64,7 @@ func TestGenerateRouteFirewallRules_V4Route(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_V6Route(t *testing.T) {
-	peers := []*nbpeer.Peer{
+	peers := []*ComponentPeer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -93,7 +92,7 @@ func TestGenerateRouteFirewallRules_V6Route(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_DynamicRoute_DualStack(t *testing.T) {
-	peers := []*nbpeer.Peer{
+	peers := []*ComponentPeer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),
@@ -126,7 +125,7 @@ func TestGenerateRouteFirewallRules_DynamicRoute_DualStack(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_DynamicRoute_NoV6Peers(t *testing.T) {
-	peers := []*nbpeer.Peer{
+	peers := []*ComponentPeer{
 		{IP: netip.MustParseAddr("100.64.0.1")},
 		{IP: netip.MustParseAddr("100.64.0.2")},
 	}
@@ -150,7 +149,7 @@ func TestGenerateRouteFirewallRules_DynamicRoute_NoV6Peers(t *testing.T) {
 }
 
 func TestGenerateRouteFirewallRules_IncludeIPv6False(t *testing.T) {
-	peers := []*nbpeer.Peer{
+	peers := []*ComponentPeer{
 		{
 			IP:   netip.MustParseAddr("100.64.0.1"),
 			IPv6: netip.MustParseAddr("fd00::1"),

shared/management/types/network.go

@@ -15,8 +15,6 @@ import (
 	"golang.org/x/exp/maps"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
-	"github.com/netbirdio/netbird/management/server/util"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/proto"
 	"github.com/netbirdio/netbird/shared/management/status"
@@ -39,11 +37,11 @@ const (
 )
 
 type NetworkMap struct {
-	Peers               []*nbpeer.Peer
+	Peers               []*ComponentPeer
 	Network             *Network
 	Routes              []*route.Route
 	DNSConfig           nbdns.Config
-	OfflinePeers        []*nbpeer.Peer
+	OfflinePeers        []*ComponentPeer
 	FirewallRules       []*FirewallRule
 	RoutesFirewallRules []*RouteFirewallRule
 	ForwardingRules     []*ForwardingRule
@@ -53,15 +51,46 @@ type NetworkMap struct {
 
 func (nm *NetworkMap) Merge(other *NetworkMap) {
 	nm.Peers = mergeUniquePeersByID(nm.Peers, other.Peers)
-	nm.Routes = util.MergeUnique(nm.Routes, other.Routes)
+	nm.Routes = mergeUnique(nm.Routes, other.Routes)
 	nm.OfflinePeers = mergeUniquePeersByID(nm.OfflinePeers, other.OfflinePeers)
-	nm.FirewallRules = util.MergeUnique(nm.FirewallRules, other.FirewallRules)
-	nm.RoutesFirewallRules = util.MergeUnique(nm.RoutesFirewallRules, other.RoutesFirewallRules)
-	nm.ForwardingRules = util.MergeUnique(nm.ForwardingRules, other.ForwardingRules)
+	nm.FirewallRules = mergeUnique(nm.FirewallRules, other.FirewallRules)
+	nm.RoutesFirewallRules = mergeUnique(nm.RoutesFirewallRules, other.RoutesFirewallRules)
+	nm.ForwardingRules = mergeUnique(nm.ForwardingRules, other.ForwardingRules)
 }
 
-func mergeUniquePeersByID(peers1, peers2 []*nbpeer.Peer) []*nbpeer.Peer {
-	result := make(map[string]*nbpeer.Peer)
+type comparableObject[T any] interface {
+	Equal(other T) bool
+}
+
+func mergeUnique[T comparableObject[T]](arr1, arr2 []T) []T {
+	var result []T
+
+	for _, item := range arr1 {
+		if !containsEqual(result, item) {
+			result = append(result, item)
+		}
+	}
+
+	for _, item := range arr2 {
+		if !containsEqual(result, item) {
+			result = append(result, item)
+		}
+	}
+
+	return result
+}
+
+func containsEqual[T comparableObject[T]](slice []T, element T) bool {
+	for _, item := range slice {
+		if item.Equal(element) {
+			return true
+		}
+	}
+	return false
+}
+
+func mergeUniquePeersByID(peers1, peers2 []*ComponentPeer) []*ComponentPeer {
+	result := make(map[string]*ComponentPeer)
 	for _, peer := range peers1 {
 		result[peer.ID] = peer
 	}

shared/management/types/network_merge_test.go

@@ -1,4 +1,4 @@
-package util
+package types
 
 import (
 	"testing"
@@ -17,7 +17,7 @@ func (t testObject) Equal(other testObject) bool {
 func Test_MergeUniqueArraysWithoutDuplicates(t *testing.T) {
 	arr1 := []testObject{{value: 1}, {value: 2}}
 	arr2 := []testObject{{value: 2}, {value: 3}}
-	result := MergeUnique(arr1, arr2)
+	result := mergeUnique(arr1, arr2)
 	assert.Len(t, result, 3)
 	assert.Contains(t, result, testObject{value: 1})
 	assert.Contains(t, result, testObject{value: 2})
@@ -27,14 +27,14 @@ func Test_MergeUniqueArraysWithoutDuplicates(t *testing.T) {
 func Test_MergeUniqueHandlesEmptyArrays(t *testing.T) {
 	arr1 := []testObject{}
 	arr2 := []testObject{}
-	result := MergeUnique(arr1, arr2)
+	result := mergeUnique(arr1, arr2)
 	assert.Empty(t, result)
 }
 
 func Test_MergeUniqueHandlesOneEmptyArray(t *testing.T) {
 	arr1 := []testObject{{value: 1}, {value: 2}}
 	arr2 := []testObject{}
-	result := MergeUnique(arr1, arr2)
+	result := mergeUnique(arr1, arr2)
 	assert.Len(t, result, 2)
 	assert.Contains(t, result, testObject{value: 1})
 	assert.Contains(t, result, testObject{value: 2})

shared/management/types/networkmap_components.go

@@ -12,9 +12,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/ssh/auth"
 	nbdns "github.com/netbirdio/netbird/dns"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
-	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
@@ -27,22 +24,22 @@ type NetworkMapComponents struct {
 	DNSSettings      *DNSSettings
 	CustomZoneDomain string
 
-	Peers               map[string]*nbpeer.Peer
-	Groups              map[string]*Group
+	Peers               map[string]*ComponentPeer
+	Groups              map[string]*ComponentGroup
 	Policies            []*Policy
 	Routes              []*route.Route
 	NameServerGroups    []*nbdns.NameServerGroup
 	AllDNSRecords       []nbdns.SimpleRecord
 	AccountZones        []nbdns.CustomZone
 	ResourcePoliciesMap map[string][]*Policy
-	RoutersMap          map[string]map[string]*routerTypes.NetworkRouter
-	NetworkResources    []*resourceTypes.NetworkResource
+	RoutersMap          map[string]map[string]*ComponentRouter
+	NetworkResources    []*ComponentResource
 
 	GroupIDToUserIDs   map[string][]string
 	AllowedUserIDs     map[string]struct{}
 	PostureFailedPeers map[string]map[string]struct{}
 
-	RouterPeers map[string]*nbpeer.Peer
+	RouterPeers map[string]*ComponentPeer
 
 	// NetworkXIDToPublicID maps Network.ID (xid) → PublicID.
 	// Consumed by the envelope encoder to
@@ -78,15 +75,15 @@ func EmptyNetworkMapComponents(nm *NetworkMapComponents) *NetworkMapComponents {
 	return nm
 }
 
-func (c *NetworkMapComponents) GetPeerInfo(peerID string) *nbpeer.Peer {
+func (c *NetworkMapComponents) GetPeerInfo(peerID string) *ComponentPeer {
 	return c.Peers[peerID]
 }
 
-func (c *NetworkMapComponents) GetRouterPeerInfo(peerID string) *nbpeer.Peer {
+func (c *NetworkMapComponents) GetRouterPeerInfo(peerID string) *ComponentPeer {
 	return c.RouterPeers[peerID]
 }
 
-func (c *NetworkMapComponents) GetGroupInfo(groupID string) *Group {
+func (c *NetworkMapComponents) GetGroupInfo(groupID string) *ComponentGroup {
 	return c.Groups[groupID]
 }
 
@@ -142,7 +139,7 @@ func (c *NetworkMapComponents) Calculate(ctx context.Context) *NetworkMap {
 
 	includeIPv6 := false
 	if p := c.Peers[targetPeerID]; p != nil {
-		includeIPv6 = p.SupportsIPv6() && p.IPv6.IsValid()
+		includeIPv6 = p.SupportsIPv6 && p.IPv6.IsValid()
 	}
 	routesUpdate := filterAndExpandRoutes(c.getRoutesToSync(targetPeerID, peersToConnect, peerGroups), includeIPv6)
 	routesFirewallRules := c.getPeerRoutesFirewallRules(ctx, targetPeerID, includeIPv6)
@@ -200,7 +197,7 @@ func (c *NetworkMapComponents) IsEmpty() bool {
 	return c.empty
 }
 
-func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) ([]*nbpeer.Peer, []*FirewallRule, map[string]map[string]struct{}, bool) {
+func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) ([]*ComponentPeer, []*FirewallRule, map[string]map[string]struct{}, bool) {
 	targetPeer := c.GetPeerInfo(targetPeerID)
 	if targetPeer == nil {
 		return nil, nil, nil, false
@@ -220,7 +217,7 @@ func (c *NetworkMapComponents) getPeerConnectionResources(targetPeerID string) (
 				continue
 			}
 
-			var sourcePeers, destinationPeers []*nbpeer.Peer
+			var sourcePeers, destinationPeers []*ComponentPeer
 			var peerInSources, peerInDestinations bool
 
 			if rule.SourceResource.Type == ResourceTypePeer && rule.SourceResource.ID != "" {
@@ -303,13 +300,13 @@ func (c *NetworkMapComponents) getAllowedUserIDs() map[string]struct{} {
 	return make(map[string]struct{})
 }
 
-func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *nbpeer.Peer) (func(*PolicyRule, []*nbpeer.Peer, int), func() ([]*nbpeer.Peer, []*FirewallRule)) {
+func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *ComponentPeer) (func(*PolicyRule, []*ComponentPeer, int), func() ([]*ComponentPeer, []*FirewallRule)) {
 	rulesExists := make(map[string]struct{})
 	peersExists := make(map[string]struct{})
 	rules := make([]*FirewallRule, 0)
-	peers := make([]*nbpeer.Peer, 0)
+	peers := make([]*ComponentPeer, 0)
 
-	return func(rule *PolicyRule, groupPeers []*nbpeer.Peer, direction int) {
+	return func(rule *PolicyRule, groupPeers []*ComponentPeer, direction int) {
 			protocol := rule.Protocol
 			if protocol == PolicyRuleProtocolNetbirdSSH {
 				protocol = PolicyRuleProtocolTCP
@@ -361,15 +358,15 @@ func (c *NetworkMapComponents) connResourcesGenerator(targetPeer *nbpeer.Peer) (
 					PortsJoined: portsJoined,
 				})
 			}
-		}, func() ([]*nbpeer.Peer, []*FirewallRule) {
+		}, func() ([]*ComponentPeer, []*FirewallRule) {
 			return peers, rules
 		}
 }
 
-func (c *NetworkMapComponents) getAllPeersFromGroups(groups []string, peerID string, sourcePostureChecksIDs []string) ([]*nbpeer.Peer, bool) {
+func (c *NetworkMapComponents) getAllPeersFromGroups(groups []string, peerID string, sourcePostureChecksIDs []string) ([]*ComponentPeer, bool) {
 	peerInGroups := false
 	uniquePeerIDs := c.getUniquePeerIDsFromGroupsIDs(groups)
-	filteredPeers := make([]*nbpeer.Peer, 0, len(uniquePeerIDs))
+	filteredPeers := make([]*ComponentPeer, 0, len(uniquePeerIDs))
 
 	for _, p := range uniquePeerIDs {
 		peerInfo := c.GetPeerInfo(p)
@@ -421,22 +418,22 @@ func (c *NetworkMapComponents) getUniquePeerIDsFromGroupsIDs(groups []string) []
 	return ids
 }
 
-func (c *NetworkMapComponents) getPeerFromResource(resource Resource, peerID string) ([]*nbpeer.Peer, bool) {
+func (c *NetworkMapComponents) getPeerFromResource(resource Resource, peerID string) ([]*ComponentPeer, bool) {
 	if resource.ID == peerID {
-		return []*nbpeer.Peer{}, true
+		return []*ComponentPeer{}, true
 	}
 
 	peerInfo := c.GetPeerInfo(resource.ID)
 	if peerInfo == nil {
-		return []*nbpeer.Peer{}, false
+		return []*ComponentPeer{}, false
 	}
 
-	return []*nbpeer.Peer{peerInfo}, false
+	return []*ComponentPeer{peerInfo}, false
 }
 
-func (c *NetworkMapComponents) filterPeersByLoginExpiration(aclPeers []*nbpeer.Peer) ([]*nbpeer.Peer, []*nbpeer.Peer) {
-	peersToConnect := make([]*nbpeer.Peer, 0, len(aclPeers))
-	var expiredPeers []*nbpeer.Peer
+func (c *NetworkMapComponents) filterPeersByLoginExpiration(aclPeers []*ComponentPeer) ([]*ComponentPeer, []*ComponentPeer) {
+	peersToConnect := make([]*ComponentPeer, 0, len(aclPeers))
+	var expiredPeers []*ComponentPeer
 
 	for _, p := range aclPeers {
 		expired, _ := p.LoginExpired(c.AccountSettings.PeerLoginExpiration)
@@ -518,7 +515,7 @@ func filterAndExpandRoutes(routes []*route.Route, includeIPv6 bool) []*route.Rou
 	return filtered
 }
 
-func (c *NetworkMapComponents) getRoutesToSync(peerID string, aclPeers []*nbpeer.Peer, peerGroups LookupMap) []*route.Route {
+func (c *NetworkMapComponents) getRoutesToSync(peerID string, aclPeers []*ComponentPeer, peerGroups LookupMap) []*route.Route {
 	routes, peerDisabledRoutes := c.getRoutingPeerRoutes(peerID)
 	peerRoutesMembership := make(LookupMap)
 	for _, r := range append(routes, peerDisabledRoutes...) {
@@ -732,7 +729,7 @@ func (c *NetworkMapComponents) getRouteFirewallRules(ctx context.Context, peerID
 	return fwRules
 }
 
-func (c *NetworkMapComponents) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}) []*nbpeer.Peer {
+func (c *NetworkMapComponents) getRulePeers(rule *PolicyRule, postureChecks []string, peerID string, distributionPeers map[string]struct{}) []*ComponentPeer {
 	distPeersWithPolicy := make(map[string]struct{})
 	for _, id := range rule.Sources {
 		group := c.GetGroupInfo(id)
@@ -759,7 +756,7 @@ func (c *NetworkMapComponents) getRulePeers(rule *PolicyRule, postureChecks []st
 		}
 	}
 
-	distributionGroupPeers := make([]*nbpeer.Peer, 0, len(distPeersWithPolicy))
+	distributionGroupPeers := make([]*ComponentPeer, 0, len(distPeersWithPolicy))
 	for pID := range distPeersWithPolicy {
 		peerInfo := c.GetPeerInfo(pID)
 		if peerInfo == nil {
@@ -799,8 +796,8 @@ func (c *NetworkMapComponents) getNetworkResourcesRoutesToSync(peerID string) (b
 
 func (c *NetworkMapComponents) processResourcePolicies(
 	peerID string,
-	resource *resourceTypes.NetworkResource,
-	networkRoutingPeers map[string]*routerTypes.NetworkRouter,
+	resource *ComponentResource,
+	networkRoutingPeers map[string]*ComponentRouter,
 	addSourcePeers bool,
 	allSourcePeers map[string]struct{},
 ) []*route.Route {
@@ -833,7 +830,7 @@ func (c *NetworkMapComponents) getResourcePolicyPeers(policy *Policy) []string {
 	return c.getUniquePeerIDsFromGroupsIDs(policy.SourceGroups())
 }
 
-func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *resourceTypes.NetworkResource, peerID string, router *routerTypes.NetworkRouter) []*route.Route {
+func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *ComponentResource, peerID string, router *ComponentRouter) []*route.Route {
 	resourceAppliedPolicies := c.ResourcePoliciesMap[resource.ID]
 
 	var routes []*route.Route
@@ -847,7 +844,7 @@ func (c *NetworkMapComponents) getNetworkResourcesRoutes(resource *resourceTypes
 	return routes
 }
 
-func (c *NetworkMapComponents) networkResourceToRoute(resource *resourceTypes.NetworkResource, peer *nbpeer.Peer, router *routerTypes.NetworkRouter) *route.Route {
+func (c *NetworkMapComponents) networkResourceToRoute(resource *ComponentResource, peer *ComponentPeer, router *ComponentRouter) *route.Route {
 	r := &route.Route{
 		ID:          route.ID(resource.ID + ":" + peer.ID),
 		AccountID:   resource.AccountID,
@@ -861,7 +858,7 @@ func (c *NetworkMapComponents) networkResourceToRoute(resource *resourceTypes.Ne
 		Description: resource.Description,
 	}
 
-	if resource.Type == resourceTypes.Host || resource.Type == resourceTypes.Subnet {
+	if resource.Type == ComponentResourceHost || resource.Type == ComponentResourceSubnet {
 		r.Network = resource.Prefix
 
 		r.NetworkType = route.IPv4Network
@@ -870,7 +867,7 @@ func (c *NetworkMapComponents) networkResourceToRoute(resource *resourceTypes.Ne
 		}
 	}
 
-	if resource.Type == resourceTypes.Domain {
+	if resource.Type == ComponentResourceDomain {
 		domainList, err := domain.FromStringList([]string{resource.Domain})
 		if err == nil {
 			r.Domains = domainList
@@ -948,11 +945,11 @@ func (c *NetworkMapComponents) getPoliciesSourcePeers(policies []*Policy) map[st
 func (c *NetworkMapComponents) addNetworksRoutingPeers(
 	networkResourcesRoutes []*route.Route,
 	peerID string,
-	peersToConnect []*nbpeer.Peer,
-	expiredPeers []*nbpeer.Peer,
+	peersToConnect []*ComponentPeer,
+	expiredPeers []*ComponentPeer,
 	isRouter bool,
 	sourcePeers map[string]struct{},
-) []*nbpeer.Peer {
+) []*ComponentPeer {
 
 	networkRoutesPeers := make(map[string]struct{}, len(networkResourcesRoutes))
 	for _, r := range networkResourcesRoutes {
@@ -1002,8 +999,8 @@ type FirewallRuleContext struct {
 	PortsJoined string
 }
 
-func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *nbpeer.Peer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
-	if !peer.IPv6.IsValid() || !targetPeer.SupportsIPv6() || !targetPeer.IPv6.IsValid() {
+func AppendIPv6FirewallRule(rules []*FirewallRule, rulesExists map[string]struct{}, peer, targetPeer *ComponentPeer, rule *PolicyRule, rc FirewallRuleContext) []*FirewallRule {
+	if !peer.IPv6.IsValid() || !targetPeer.SupportsIPv6 || !targetPeer.IPv6.IsValid() {
 		return rules
 	}
 

shared/management/types/networkmap_components_compact.go

@@ -2,9 +2,6 @@ package types
 
 import (
 	nbdns "github.com/netbirdio/netbird/dns"
-	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
-	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/route"
 )
 
@@ -21,7 +18,7 @@ type NetworkMapComponentsCompact struct {
 	DNSSettings      *DNSSettings
 	CustomZoneDomain string
 
-	AllPeers          []*nbpeer.Peer
+	AllPeers          []*ComponentPeer
 	PeerIndexes       []int
 	RouterPeerIndexes []int
 
@@ -34,8 +31,8 @@ type NetworkMapComponentsCompact struct {
 	AllDNSRecords       []nbdns.SimpleRecord
 	AccountZones        []nbdns.CustomZone
 
-	RoutersMap       map[string]map[string]*routerTypes.NetworkRouter
-	NetworkResources []*resourceTypes.NetworkResource
+	RoutersMap       map[string]map[string]*ComponentRouter
+	NetworkResources []*ComponentResource
 
 	GroupIDToUserIDs   map[string][]string
 	AllowedUserIDs     map[string]struct{}
@@ -44,7 +41,7 @@ type NetworkMapComponentsCompact struct {
 
 func (c *NetworkMapComponents) ToCompact() *NetworkMapComponentsCompact {
 	peerToIndex := make(map[string]int)
-	var allPeers []*nbpeer.Peer
+	var allPeers []*ComponentPeer
 
 	for id, peer := range c.Peers {
 		if _, exists := peerToIndex[id]; !exists {
@@ -150,7 +147,7 @@ func (c *NetworkMapComponents) ToCompact() *NetworkMapComponentsCompact {
 }
 
 func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
-	peers := make(map[string]*nbpeer.Peer, len(c.PeerIndexes))
+	peers := make(map[string]*ComponentPeer, len(c.PeerIndexes))
 	for _, idx := range c.PeerIndexes {
 		if idx >= 0 && idx < len(c.AllPeers) {
 			peer := c.AllPeers[idx]
@@ -158,7 +155,7 @@ func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
 		}
 	}
 
-	routerPeers := make(map[string]*nbpeer.Peer, len(c.RouterPeerIndexes))
+	routerPeers := make(map[string]*ComponentPeer, len(c.RouterPeerIndexes))
 	for _, idx := range c.RouterPeerIndexes {
 		if idx >= 0 && idx < len(c.AllPeers) {
 			peer := c.AllPeers[idx]
@@ -166,7 +163,7 @@ func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
 		}
 	}
 
-	groups := make(map[string]*Group, len(c.Groups))
+	groups := make(map[string]*ComponentGroup, len(c.Groups))
 	for id, gc := range c.Groups {
 		peerIDs := make([]string, 0, len(gc.PeerIndexes))
 		for _, idx := range gc.PeerIndexes {
@@ -174,7 +171,7 @@ func (c *NetworkMapComponentsCompact) ToFull() *NetworkMapComponents {
 				peerIDs = append(peerIDs, c.AllPeers[idx].ID)
 			}
 		}
-		groups[id] = &Group{
+		groups[id] = &ComponentGroup{
 			ID:    id,
 			Name:  gc.Name,
 			Peers: peerIDs,

sharedsock/sock_linux.go

@@ -24,7 +24,7 @@ import (
 )
 
 // ErrSharedSockStopped indicates that shared socket has been stopped
-var ErrSharedSockStopped = fmt.Errorf("shared socked stopped")
+var ErrSharedSockStopped = fmt.Errorf("shared socket stopped")
 
 // SharedSocket is a net.PacketConn that initiates two raw sockets (ipv4 and ipv6) and listens to UDP packets filtered
 // by BPF instructions (e.g., IncomingSTUNFilter that checks and sends only STUN packets to the listeners (ReadFrom)).

version/version.go

@@ -71,6 +71,30 @@ func NetbirdCommit() string {
 	return revision
 }
 
+// sanitizeVersion removes anything after the pre-release tag (e.g., "-dev", "-alpha", etc.)
+func sanitizeVersion(version string) string {
+	parts := strings.Split(version, "-")
+	return parts[0]
+}
+
+// MeetsMinVersion checks if the peer's version meets or exceeds the minimum required version
+func MeetsMinVersion(minVer, peerVer string) (bool, error) {
+	peerVer = sanitizeVersion(peerVer)
+	minVer = sanitizeVersion(minVer)
+
+	peerNBVer, err := v.NewVersion(peerVer)
+	if err != nil {
+		return false, err
+	}
+
+	constraints, err := v.NewConstraint(">= " + minVer)
+	if err != nil {
+		return false, err
+	}
+
+	return constraints.Check(peerNBVer), nil
+}
+
 // IsDevelopmentVersion reports whether the given version string identifies
 // a non-release / development build. It is the single source of truth for
 // "is this a dev build" checks across the codebase; use it instead of

version/version_test.go

@@ -1,6 +1,10 @@
 package version
 
-import "testing"
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
 
 func TestIsDevelopmentVersion(t *testing.T) {
 	tests := []struct {
@@ -26,3 +30,68 @@ func TestIsDevelopmentVersion(t *testing.T) {
 		})
 	}
 }
+
+func TestMeetsMinVersion(t *testing.T) {
+	tests := []struct {
+		name    string
+		minVer  string
+		peerVer string
+		want    bool
+		wantErr bool
+	}{
+		{
+			name:    "Peer version greater than min version",
+			minVer:  "0.26.0",
+			peerVer: "0.60.1",
+			want:    true,
+			wantErr: false,
+		},
+		{
+			name:    "Peer version equals min version",
+			minVer:  "1.0.0",
+			peerVer: "1.0.0",
+			want:    true,
+			wantErr: false,
+		},
+		{
+			name:    "Peer version less than min version",
+			minVer:  "1.0.0",
+			peerVer: "0.9.9",
+			want:    false,
+			wantErr: false,
+		},
+		{
+			name:    "Peer version with pre-release tag greater than min version",
+			minVer:  "1.0.0",
+			peerVer: "1.0.1-alpha",
+			want:    true,
+			wantErr: false,
+		},
+		{
+			name:    "Invalid peer version format",
+			minVer:  "1.0.0",
+			peerVer: "dev",
+			want:    false,
+			wantErr: true,
+		},
+		{
+			name:    "Invalid min version format",
+			minVer:  "invalid.version",
+			peerVer: "1.0.0",
+			want:    false,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := MeetsMinVersion(tt.minVer, tt.peerVer)
+			if tt.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+			}
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}