[client] Declare GTK4/WebKitGTK runtime deps for the Linux UI packages

The 0.75.0 UI is built against GTK 4.14 (Ubuntu 24.04 runner) and Wails v3
calls gdk_monitor_get_scale (GTK 4.14+) unconditionally, but the deb/rpm
packages only depended on netbird. On distros shipping an older GTK4
(Ubuntu 22.04, RHEL 9, openSUSE Leap 15.6) the package installed fine and
then died at startup with a symbol lookup error (#6890).

Declare the real runtime dependencies so package managers reject the
install up front instead:

- deb: libgtk-4-1 (>= 4.14) and libwebkitgtk-6.0-4
- rpm: rich (boolean) dependencies that accept both the Fedora/RHEL and
  the SUSE package names, with the 4.14 floor:
    (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
    (webkitgtk6.0 or libwebkitgtk-6_0-4)

Rich deps are supported by dnf and zypper (RPM 4.13+); the pinned
goreleaser v2.16.0 -> nfpm v2.46.3 -> rpmpack v0.7.1 chain passes the
parenthesized form through verbatim. On RHEL/Alma/Rocky 10 the webkitgtk6.0
package comes from EPEL, which becomes an install prerequisite for the UI.

The wails3 packaging config (client/ui/build/linux/nfpm/nfpm.yaml, local
dev packaging only) is kept in sync.

.goreleaser_ui.yaml

@@ -88,6 +88,8 @@ nfpms:
         dst: /usr/share/pixmaps/netbird.png
     dependencies:
       - netbird
+      - libgtk-4-1 (>= 4.14)
+      - libwebkitgtk-6.0-4
 
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
@@ -109,6 +111,8 @@ nfpms:
         dst: /usr/share/pixmaps/netbird.png
     dependencies:
       - netbird
+      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
+      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
 
     rpm:
       signature:

client/internal/peer/conn.go

@@ -841,8 +841,6 @@ func (conn *Conn) enableWgWatcherIfNeeded(enabledTime time.Time) {
 		return
 	}
 
-	conn.endpointUpdater.EnableKeepAlive()
-
 	watcher := NewWGWatcher(conn.Log, conn.config.WgConfig.WgInterface, conn.config.Key, conn.dumpState)
 	watcher.PrepareInitialHandshake()
 
@@ -890,7 +888,6 @@ func (conn *Conn) resetEndpoint() {
 		return
 	}
 	conn.Log.Infof("reset wg endpoint")
-	conn.endpointUpdater.EnableKeepAlive()
 	if conn.wgWatcher != nil {
 		conn.wgWatcher.Reset()
 	}
@@ -948,12 +945,7 @@ func (conn *Conn) onWGHandshakeSuccess(when time.Time) {
 func (conn *Conn) onWGCheckSuccess() {
 	conn.mu.Lock()
 	conn.wgTimeouts = 0
-	presharedKey := conn.presharedKey(conn.rosenpassRemoteKey)
 	conn.mu.Unlock()
-
-	if err := conn.endpointUpdater.DisableKeepAlive(presharedKey); err != nil {
-		conn.Log.Warnf("failed to disable WireGuard keepalive: %v", err)
-	}
 }
 
 // recordConnectionMetrics records connection stage timestamps as metrics

client/internal/peer/conn_test.go

@@ -316,16 +316,11 @@ func newWGTimeoutTestConn(rosenpassEnabled bool, disconnected *[]string) *Conn {
 		cfg.RosenpassConfig = RosenpassConfig{PubKey: []byte("dummykey")}
 	}
 
-	connLog := log.WithField("peer", cfg.Key)
-	endpointUpdater := NewEndpointUpdater(connLog, cfg.WgConfig, false)
-	endpointUpdater.keepAlive = 0
-
 	conn := &Conn{
-		ctx:             context.Background(),
-		config:          cfg,
-		Log:             connLog,
-		metricsStages:   &MetricsStages{},
-		endpointUpdater: endpointUpdater,
+		ctx:           context.Background(),
+		config:        cfg,
+		Log:           log.WithField("peer", cfg.Key),
+		metricsStages: &MetricsStages{},
 	}
 	conn.SetOnDisconnected(func(remotePeer string) {
 		*disconnected = append(*disconnected, remotePeer)

client/internal/peer/endpoint.go

@@ -20,11 +20,10 @@ type EndpointUpdater struct {
 	wgConfig  WgConfig
 	initiator bool
 
-	// mu protects cancelFunc and keepAlive
+	// mu protects cancelFunc
 	mu         sync.Mutex
 	cancelFunc func()
 	updateWg   sync.WaitGroup
-	keepAlive  time.Duration
 }
 
 func NewEndpointUpdater(log *logrus.Entry, wgConfig WgConfig, initiator bool) *EndpointUpdater {
@@ -32,7 +31,6 @@ func NewEndpointUpdater(log *logrus.Entry, wgConfig WgConfig, initiator bool) *E
 		log:       log,
 		wgConfig:  wgConfig,
 		initiator: initiator,
-		keepAlive: defaultWgKeepAlive,
 	}
 }
 
@@ -75,31 +73,6 @@ func (e *EndpointUpdater) RemoveEndpointAddress() error {
 	return e.wgConfig.WgInterface.RemoveEndpointAddress(e.wgConfig.RemoteKey)
 }
 
-func (e *EndpointUpdater) DisableKeepAlive(presharedKey *wgtypes.Key) error {
-	if !isWgKeepAliveDisabled() {
-		return nil
-	}
-
-	e.mu.Lock()
-	defer e.mu.Unlock()
-
-	if e.keepAlive == 0 {
-		return nil
-	}
-
-	e.waitForCloseTheDelayedUpdate()
-	e.keepAlive = 0
-	e.log.Debugf("disable WireGuard persistent keepalive")
-	return e.updateWireGuardPeer(nil, presharedKey)
-}
-
-func (e *EndpointUpdater) EnableKeepAlive() {
-	e.mu.Lock()
-	defer e.mu.Unlock()
-
-	e.keepAlive = defaultWgKeepAlive
-}
-
 func (e *EndpointUpdater) configureAsInitiator(addr *net.UDPAddr, presharedKey *wgtypes.Key) error {
 	if err := e.updateWireGuardPeer(addr, presharedKey); err != nil {
 		return err
@@ -154,7 +127,7 @@ func (e *EndpointUpdater) updateWireGuardPeer(endpoint *net.UDPAddr, presharedKe
 	return e.wgConfig.WgInterface.UpdatePeer(
 		e.wgConfig.RemoteKey,
 		e.wgConfig.AllowedIps,
-		e.keepAlive,
+		defaultWgKeepAlive,
 		endpoint,
 		presharedKey,
 	)

client/internal/peer/env.go

@@ -7,9 +7,8 @@ import (
 )
 
 const (
-	EnvKeyNBForceRelay         = "NB_FORCE_RELAY"
-	EnvKeyNBHomeRelayServers   = "NB_HOME_RELAY_SERVERS"
-	EnvKeyNBDisableWgKeepAlive = "NB_DISABLE_WG_KEEP_ALIVE"
+	EnvKeyNBForceRelay       = "NB_FORCE_RELAY"
+	EnvKeyNBHomeRelayServers = "NB_HOME_RELAY_SERVERS"
 )
 
 func IsForceRelayed() bool {
@@ -19,10 +18,6 @@ func IsForceRelayed() bool {
 	return strings.EqualFold(os.Getenv(EnvKeyNBForceRelay), "true")
 }
 
-func isWgKeepAliveDisabled() bool {
-	return strings.EqualFold(os.Getenv(EnvKeyNBDisableWgKeepAlive), "true")
-}
-
 // OverrideRelayURLs returns the relay server URL list set in
 // NB_HOME_RELAY_SERVERS (comma-separated) and a boolean indicating whether
 // the override is active. When the env var is unset, the boolean is false

client/internal/peer/wg_watcher.go

@@ -109,15 +109,10 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 			}
 
 			lastHandshake = *handshake
-			w.stateDump.WGcheckSuccess()
-
-			if isWgKeepAliveDisabled() {
-				w.log.Debugf("WireGuard watcher waiting for peer reset")
-				continue
-			}
 
 			resetTime := time.Until(handshake.Add(checkPeriod))
 			timer.Reset(resetTime)
+			w.stateDump.WGcheckSuccess()
 
 			w.log.Debugf("WireGuard watcher reset timer: %v", resetTime)
 		case <-w.resetCh:

client/ui/build/linux/nfpm/nfpm.yaml

@@ -26,17 +26,17 @@ contents:
 
 # Default dependencies for the GTK4 + WebKitGTK 6.0 stack (Ubuntu 24.04+ / Debian 13+)
 depends:
-  - libgtk-4-1
+  - libgtk-4-1 (>= 4.14)
   - libwebkitgtk-6.0-4
   - xdg-utils
 
 # Distribution-specific overrides for different package formats
 overrides:
-  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux
+  # RPM packages for Fedora / RHEL / AlmaLinux / Rocky Linux / openSUSE
   rpm:
     depends:
-      - gtk4
-      - webkitgtk6.0
+      - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
+      - (webkitgtk6.0 or libwebkitgtk-6_0-4)
       - xdg-utils
 
   # Arch Linux packages