Convey MDM overlay config to Debug Bundle output

Aligns to other clients OSes behavior

.github/workflows/test-infrastructure-files.yml

@@ -249,35 +249,78 @@ jobs:
           docker compose exec management ls -l /var/lib/netbird/ | grep -i GeoLite2-City_[0-9]*.mmdb
           docker compose exec management ls -l /var/lib/netbird/ | grep -i geonames_[0-9]*.db
 
-  test-legacy-getting-started-scripts:
+  test-getting-started-script:
     runs-on: ubuntu-latest
     steps:
+      - name: Install jq
+        run: sudo apt-get install -y jq
+
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - name: Verify Dex retirement notice
-        run: |
-          if infrastructure_files/getting-started-with-dex.sh >stdout.txt 2>stderr.txt; then
-            echo "Expected the retired Dex installer to fail"
-            exit 1
-          fi
-          test ! -s stdout.txt
-          grep -Fq "Dex support is not deprecated." stderr.txt
-          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-quickstart" stderr.txt
-          grep -Fq "https://docs.netbird.io/selfhosted/identity-providers/local" stderr.txt
-          grep -Fq "removed in NetBird v0.80" stderr.txt
+      - name: run script with Zitadel PostgreSQL
+        run: NETBIRD_DOMAIN=use-ip bash -x infrastructure_files/getting-started-with-zitadel.sh
 
-      - name: Verify Zitadel retirement notice
+      - name: test Caddy file gen postgres
+        run: test -f Caddyfile
+
+      - name: test docker-compose file gen postgres
+        run: test -f docker-compose.yml
+
+      - name: test management.json file gen postgres
+        run: test -f management.json
+
+      - name: test turnserver.conf file gen postgres
         run: |
-          if bash infrastructure_files/getting-started-with-zitadel.sh >stdout.txt 2>stderr.txt; then
-            echo "Expected the retired Zitadel installer to fail"
-            exit 1
-          fi
-          test ! -s stdout.txt
-          grep -Fq "Zitadel support and existing Zitadel deployments are not deprecated." stderr.txt
-          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-quickstart" stderr.txt
-          grep -Fq "https://docs.netbird.io/selfhosted/identity-providers/zitadel" stderr.txt
-          grep -Fq "https://docs.netbird.io/selfhosted/selfhosted-guide" stderr.txt
-          grep -Fq "removed in NetBird v0.80" stderr.txt
+          set -x
+          test -f turnserver.conf
+          grep external-ip turnserver.conf
+
+      - name: test zitadel.env file gen postgres
+        run: test -f zitadel.env
+
+      - name: test dashboard.env file gen postgres
+        run: test -f dashboard.env
+
+      - name: test relay.env file gen postgres
+        run: test -f relay.env
+
+      - name: test zdb.env file gen postgres
+        run: test -f zdb.env
+
+      - name: Postgres run cleanup
+        run: |
+          docker compose down --volumes --rmi all
+          rm -rf docker-compose.yml Caddyfile zitadel.env dashboard.env machinekey/zitadel-admin-sa.token turnserver.conf management.json zdb.env
+
+      - name: run script with Zitadel CockroachDB
+        run: bash -x infrastructure_files/getting-started-with-zitadel.sh
+        env:
+          NETBIRD_DOMAIN: use-ip
+          ZITADEL_DATABASE: cockroach
+
+      - name: test Caddy file gen CockroachDB
+        run: test -f Caddyfile
+
+      - name: test docker-compose file gen CockroachDB
+        run: test -f docker-compose.yml
+
+      - name: test management.json file gen CockroachDB
+        run: test -f management.json
+
+      - name: test turnserver.conf file gen CockroachDB
+        run: |
+          set -x
+          test -f turnserver.conf
+          grep external-ip turnserver.conf
+
+      - name: test zitadel.env file gen CockroachDB
+        run: test -f zitadel.env
+
+      - name: test dashboard.env file gen CockroachDB
+        run: test -f dashboard.env
+
+      - name: test relay.env file gen CockroachDB
+        run: test -f relay.env

.goreleaser_ui.yaml

@@ -24,8 +24,6 @@ builds:
     ldflags:
       - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
     mod_timestamp: "{{ .CommitTimestamp }}"
-    tags:
-      - production
 
   - id: netbird-ui-windows-amd64
     dir: client/ui
@@ -41,8 +39,6 @@ builds:
       - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
       - -H windowsgui
     mod_timestamp: "{{ .CommitTimestamp }}"
-    tags:
-      - production
 
   - id: netbird-ui-windows-arm64
     dir: client/ui
@@ -59,8 +55,6 @@ builds:
       - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
       - -H windowsgui
     mod_timestamp: "{{ .CommitTimestamp }}"
-    tags:
-      - production
 
 archives:
   - id: linux-arch

.goreleaser_ui_darwin.yaml

@@ -29,8 +29,6 @@ builds:
     ldflags:
       - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
     mod_timestamp: "{{ .CommitTimestamp }}"
-    tags:
-      - production
 
 universal_binaries:
   - id: netbird-ui-darwin

client/android/client.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"os"
 	"slices"
-	"strings"
 	"sync"
 	"time"
 
@@ -24,6 +23,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/routemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
+	"github.com/netbirdio/netbird/client/mdm"
 	"github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
@@ -76,6 +76,13 @@ type Client struct {
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
 	cacheDir      string
+
+	// mdmLoader holds the per-Client MDM policy source. Set by
+	// SetMDMPolicyFetcher (called from the Kotlin side). Each Run
+	// passes this loader to the resolved Config so applyMDMPolicy
+	// picks up the active overlay. Nil means "MDM enforcement off
+	// for this Client".
+	mdmLoader *mdm.Loader
 }
 
 func (c *Client) setState(cfg *profilemanager.Config, cacheDir string, cc *internal.ConnectClient) {
@@ -130,6 +137,7 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	if err != nil {
 		return err
 	}
+	c.applyMDMOverlay(cfg)
 	c.recorder.UpdateManagementAddress(cfg.ManagementURL.String())
 	c.recorder.UpdateRosenpass(cfg.RosenpassEnabled, cfg.RosenpassPermissive)
 
@@ -174,6 +182,7 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 	if err != nil {
 		return err
 	}
+	c.applyMDMOverlay(cfg)
 	c.recorder.UpdateManagementAddress(cfg.ManagementURL.String())
 	c.recorder.UpdateRosenpass(cfg.RosenpassEnabled, cfg.RosenpassPermissive)
 
@@ -231,6 +240,7 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 		if err != nil {
 			return "", fmt.Errorf("load config: %w", err)
 		}
+		c.applyMDMOverlay(cfg)
 		cacheDir = platformFiles.CacheDir()
 	}
 
@@ -300,13 +310,6 @@ func (c *Client) SetInfoLogLevel() {
 // PeersList return with the list of the PeerInfos
 func (c *Client) PeersList() *PeerInfoArray {
 
-	// The recorder only caches transfer counters and handshake times; nothing
-	// refreshes them on its own, so without this they read as zero. The desktop
-	// daemon does the same before serving a full peer status.
-	if err := c.recorder.RefreshWireGuardStats(); err != nil {
-		log.Debugf("failed to refresh WireGuard stats: %v", err)
-	}
-
 	fullStatus := c.recorder.GetFullStatus()
 
 	peerInfos := make([]PeerInfo, len(fullStatus.Peers))
@@ -317,20 +320,6 @@ func (c *Client) PeersList() *PeerInfoArray {
 			FQDN:       p.FQDN,
 			ConnStatus: int(p.ConnStatus),
 			Routes:     PeerRoutes{routes: maps.Keys(p.GetRoutes())},
-
-			PubKey:                     p.PubKey,
-			Latency:                    formatDuration(p.Latency),
-			LatencyMs:                  p.Latency.Milliseconds(),
-			BytesRx:                    p.BytesRx,
-			BytesTx:                    p.BytesTx,
-			ConnStatusUpdate:           formatTime(p.ConnStatusUpdate),
-			Relayed:                    p.Relayed,
-			RosenpassEnabled:           p.RosenpassEnabled,
-			LastWireguardHandshake:     formatTime(p.LastWireguardHandshake),
-			LocalIceCandidateType:      p.LocalIceCandidateType,
-			RemoteIceCandidateType:     p.RemoteIceCandidateType,
-			LocalIceCandidateEndpoint:  p.LocalIceCandidateEndpoint,
-			RemoteIceCandidateEndpoint: p.RemoteIceCandidateEndpoint,
 		}
 		peerInfos[n] = pi
 	}
@@ -461,6 +450,10 @@ func (c *Client) RemoveConnectionListener() {
 	c.recorder.RemoveConnectionListener()
 }
 
+func (c *Client) toggleRoute(command routeCommand) error {
+	return command.toggleRoute()
+}
+
 func (c *Client) getRouteManager() (routemanager.Manager, error) {
 	client := c.getConnectClient()
 	if client == nil {
@@ -480,22 +473,22 @@ func (c *Client) getRouteManager() (routemanager.Manager, error) {
 	return manager, nil
 }
 
-func (c *Client) SelectRoute(id string) error {
+func (c *Client) SelectRoute(route string) error {
 	manager, err := c.getRouteManager()
 	if err != nil {
 		return err
 	}
 
-	return manager.SelectRoutes([]route.NetID{route.NetID(id)}, true)
+	return c.toggleRoute(selectRouteCommand{route: route, manager: manager})
 }
 
-func (c *Client) DeselectRoute(id string) error {
+func (c *Client) DeselectRoute(route string) error {
 	manager, err := c.getRouteManager()
 	if err != nil {
 		return err
 	}
 
-	return manager.DeselectRoutes([]route.NetID{route.NetID(id)})
+	return c.toggleRoute(deselectRouteCommand{route: route, manager: manager})
 }
 
 // getNetworkDomainsFromRoute extracts domains from a route and enriches each domain
@@ -530,28 +523,3 @@ func exportEnvList(list *EnvList) {
 		}
 	}
 }
-
-// formatDuration renders a duration for display, trimming the fractional part
-// to two digits so latencies read as "12.34ms" rather than "12.345678ms".
-func formatDuration(d time.Duration) string {
-	ds := d.String()
-	dotIndex := strings.Index(ds, ".")
-	if dotIndex == -1 {
-		return ds
-	}
-
-	endIndex := min(dotIndex+3, len(ds))
-
-	// Skip the remaining digits so only the unit suffix is appended back.
-	unitStart := endIndex
-	for unitStart < len(ds) && ds[unitStart] >= '0' && ds[unitStart] <= '9' {
-		unitStart++
-	}
-	return ds[:endIndex] + ds[unitStart:]
-}
-
-// formatTime renders a timestamp in UTC using a fixed layout. The zero time is
-// passed through as-is so the UI can recognise it and show "never" instead.
-func formatTime(t time.Time) string {
-	return t.UTC().Format("2006-01-02 15:04:05")
-}

client/android/mdm.go

@@ -0,0 +1,80 @@
+//go:build android
+
+package android
+
+import (
+	"encoding/json"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+// PolicyFetcher is the mobile-side bridge for the MDM managed-config
+// snapshot. The native layer (Kotlin) implements this and registers
+// the instance per Client via Client.SetMDMPolicyFetcher. Every
+// invocation of fetchJSON must read the current RestrictionsManager
+// state and return the result as a JSON-encoded map[string]any string.
+//
+// JSON is used because gomobile does not support map[string]any
+// crossing the JNI boundary — the adapter on the Go side parses the
+// string back into the map[string]any expected by mdm.Loader.
+//
+// Return value contract:
+//   - "" (empty)         : interpreted as "no MDM source / no managed keys"
+//   - "{}"               : managed config explicitly empty
+//   - "{...}"            : JSON object with key/value pairs
+//   - malformed JSON     : logged and treated as empty
+type PolicyFetcher interface {
+	FetchJSON() string
+}
+
+// jsonFetcherAdapter wraps a gomobile-exposed PolicyFetcher into the
+// internal mdm.PolicyFetcher interface, taking care of JSON decoding
+// on every Fetch.
+type jsonFetcherAdapter struct {
+	inner PolicyFetcher
+}
+
+func (a *jsonFetcherAdapter) Fetch() map[string]any {
+	raw := a.inner.FetchJSON()
+	if raw == "" {
+		return nil
+	}
+	var out map[string]any
+	if err := json.Unmarshal([]byte(raw), &out); err != nil {
+		log.Warnf("MDM mobile fetcher: invalid JSON payload from native: %v", err)
+		return nil
+	}
+	return out
+}
+
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher
+// on this Client. Call once from the gomobile-init code (Kotlin
+// Application.onCreate or Service onCreate) before invoking Run /
+// RunWithoutLogin. Passing nil disables MDM enforcement on this
+// Client.
+//
+// The fetcher is held as a *mdm.Loader instance on the Client (no
+// package-level state) — multiple Clients in the same process get
+// independent Loaders, and tests can inject fakes per Client.
+func (c *Client) SetMDMPolicyFetcher(p PolicyFetcher) {
+	if p == nil {
+		c.mdmLoader = mdm.NewLoader(nil)
+		return
+	}
+	c.mdmLoader = mdm.NewLoader(&jsonFetcherAdapter{inner: p})
+}
+
+// applyMDMOverlay applies the Client-held MDM Loader's current policy
+// on top of the just-read Config. Called immediately after every
+// UpdateOrCreateConfig — profilemanager's apply() initialises the
+// policy to empty and leaves overlay responsibility to the lifecycle
+// owner. No-op when no fetcher was registered.
+func (c *Client) applyMDMOverlay(cfg *profilemanager.Config) {
+	if cfg == nil || c.mdmLoader == nil {
+		return
+	}
+	cfg.ApplyMDMPolicy(c.mdmLoader.Load())
+}

client/android/peer_notifier.go

@@ -12,30 +12,12 @@ const (
 )
 
 // PeerInfo describe information about the peers. It designed for the UI usage
-//
-// The fields below ConnStatus back the peer detail screen. Durations and times
-// are pre-formatted into strings so the UI does not have to know Go's layouts;
-// Latency is additionally exposed as LatencyMs for colour coding.
 type PeerInfo struct {
 	IP         string
 	IPv6       string
 	FQDN       string
 	ConnStatus int
 	Routes     PeerRoutes
-
-	PubKey                     string
-	Latency                    string
-	LatencyMs                  int64
-	BytesRx                    int64
-	BytesTx                    int64
-	ConnStatusUpdate           string
-	Relayed                    bool
-	RosenpassEnabled           bool
-	LastWireguardHandshake     string
-	LocalIceCandidateType      string
-	RemoteIceCandidateType     string
-	LocalIceCandidateEndpoint  string
-	RemoteIceCandidateEndpoint string
 }
 
 func (p *PeerInfo) GetPeerRoutes() *PeerRoutes {

client/android/profile_manager.go

@@ -189,19 +189,6 @@ func (pm *ProfileManager) LogoutProfile(id string) error {
 	return nil
 }
 
-// RenameProfile changes a profile's display name. The profile ID, and therefore
-// its on-disk filename, is left untouched: only the "name" field of the config
-// is rewritten. This works for the default profile too, whose config lives in
-// netbird.cfg rather than under profiles/.
-func (pm *ProfileManager) RenameProfile(id string, newName string) error {
-	if err := pm.serviceMgr.RenameProfile(profilemanager.ID(id), androidUsername, newName); err != nil {
-		return fmt.Errorf("failed to rename profile: %w", err)
-	}
-
-	log.Infof("renamed profile %s to: %s", id, newName)
-	return nil
-}
-
 // RemoveProfile deletes a profile
 func (pm *ProfileManager) RemoveProfile(id string) error {
 	// Use ServiceManager (removes profile from profiles/ directory)

client/android/route_command.go

@@ -0,0 +1,70 @@
+//go:build android
+
+package android
+
+import (
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+	"golang.org/x/exp/maps"
+
+	"github.com/netbirdio/netbird/client/internal/routemanager"
+	"github.com/netbirdio/netbird/route"
+)
+
+func executeRouteToggle(id string, manager routemanager.Manager,
+	operationName string,
+	routeOperation func(routes []route.NetID, allRoutes []route.NetID) error) error {
+	netID := route.NetID(id)
+	routes := []route.NetID{netID}
+
+	routesMap := manager.GetClientRoutesWithNetID()
+	routes = route.ExpandV6ExitPairs(routes, routesMap)
+
+	log.Debugf("%s with ids: %v", operationName, routes)
+
+	if err := routeOperation(routes, maps.Keys(routesMap)); err != nil {
+		log.Debugf("error when %s: %s", operationName, err)
+		return fmt.Errorf("error %s: %w", operationName, err)
+	}
+
+	manager.TriggerSelection(manager.GetClientRoutes())
+
+	return nil
+}
+
+type routeCommand interface {
+	toggleRoute() error
+}
+
+type selectRouteCommand struct {
+	route   string
+	manager routemanager.Manager
+}
+
+func (s selectRouteCommand) toggleRoute() error {
+	routeSelector := s.manager.GetRouteSelector()
+	if routeSelector == nil {
+		return fmt.Errorf("no route selector available")
+	}
+
+	routeOperation := func(routes []route.NetID, allRoutes []route.NetID) error {
+		return routeSelector.SelectRoutes(routes, true, allRoutes)
+	}
+
+	return executeRouteToggle(s.route, s.manager, "selecting route", routeOperation)
+}
+
+type deselectRouteCommand struct {
+	route   string
+	manager routemanager.Manager
+}
+
+func (d deselectRouteCommand) toggleRoute() error {
+	routeSelector := d.manager.GetRouteSelector()
+	if routeSelector == nil {
+		return fmt.Errorf("no route selector available")
+	}
+
+	return executeRouteToggle(d.route, d.manager, "deselecting route", routeSelector.DeselectRoutes)
+}

client/cmd/login.go

@@ -17,6 +17,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/server"
@@ -332,6 +333,11 @@ func doForegroundLogin(ctx context.Context, cmd *cobra.Command, setupKey string,
 	if err != nil {
 		return fmt.Errorf("read config file %s: %v", configFilePath, err)
 	}
+	// CLI standalone login: profilemanager no longer auto-applies MDM,
+	// so layer in the OS-native policy here. Desktop builds construct
+	// a Loader with no fetcher — the build-tagged loadPlatform reads
+	// the registry/plist directly.
+	config.ApplyMDMPolicy(mdm.NewLoader(nil).Load())
 
 	// Mirror runInForegroundMode: recover residual state (DNS, firewall,
 	// ssh config, legacy routing) from a previous unclean shutdown and

client/cmd/up.go

@@ -21,6 +21,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 	"github.com/netbirdio/netbird/client/proto"
 	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/server"
@@ -228,6 +229,10 @@ func runInForegroundMode(ctx context.Context, cmd *cobra.Command, activeProf *pr
 	if err != nil {
 		return fmt.Errorf("get config file: %v", err)
 	}
+	// CLI foreground path runs without the daemon Server: layer in the
+	// active MDM policy explicitly so a forced ManagementURL / PSK /
+	// other managed key actually takes effect on this run.
+	config.ApplyMDMPolicy(mdm.NewLoader(nil).Load())
 
 	_, _ = profilemanager.UpdateOldManagementURL(ctx, config, configFilePath)
 

client/embed/embed.go

@@ -21,6 +21,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 	sshcommon "github.com/netbirdio/netbird/client/ssh"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -215,6 +216,10 @@ func New(opts Options) (*Client, error) {
 	if err != nil {
 		return nil, fmt.Errorf("create config: %w", err)
 	}
+	// Embedded path runs without the daemon Server: apply the active
+	// MDM policy explicitly so a forced ManagementURL / PSK / other
+	// managed key takes effect on this embedded engine instance.
+	config.ApplyMDMPolicy(mdm.NewLoader(nil).Load())
 
 	if opts.PrivateKey != "" {
 		config.PrivateKey = opts.PrivateKey

client/internal/conn_mgr.go

@@ -385,20 +385,11 @@ func inactivityThresholdEnv() *time.Duration {
 		return nil
 	}
 
-	// Documented format: a Go duration such as "30m" or "1h".
-	if d, err := time.ParseDuration(envValue); err == nil {
-		if d <= 0 {
-			return nil
-		}
-		return &d
+	parsedMinutes, err := strconv.Atoi(envValue)
+	if err != nil || parsedMinutes <= 0 {
+		return nil
 	}
 
-	// Backwards compatibility: a bare integer used to be interpreted as minutes.
-	if parsedMinutes, err := strconv.Atoi(envValue); err == nil && parsedMinutes > 0 {
-		d := time.Duration(parsedMinutes) * time.Minute
-		return &d
-	}
-
-	log.Warnf("invalid %s value %q: expected a Go duration such as 30m or 1h", lazyconn.EnvInactivityThreshold, envValue)
-	return nil
+	d := time.Duration(parsedMinutes) * time.Minute
+	return &d
 }

client/internal/conn_mgr_test.go

@@ -104,38 +104,3 @@ func TestConnMgr_ActivatePeerConcurrentWithLifecycle(t *testing.T) {
 	close(done)
 	wg.Wait()
 }
-
-func TestInactivityThresholdEnv(t *testing.T) {
-	tests := []struct {
-		name string
-		val  string
-		want *time.Duration
-	}{
-		{name: "unset", val: "", want: nil},
-		{name: "go duration minutes", val: "30m", want: durPtr(30 * time.Minute)},
-		{name: "go duration hours", val: "1h", want: durPtr(time.Hour)},
-		{name: "go duration seconds", val: "90s", want: durPtr(90 * time.Second)},
-		{name: "bare integer is minutes (backwards compat)", val: "5", want: durPtr(5 * time.Minute)},
-		{name: "zero duration", val: "0s", want: nil},
-		{name: "zero integer", val: "0", want: nil},
-		{name: "negative duration", val: "-5m", want: nil},
-		{name: "garbage", val: "abc", want: nil},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Setenv(lazyconn.EnvInactivityThreshold, tc.val)
-			got := inactivityThresholdEnv()
-			switch {
-			case tc.want == nil && got != nil:
-				t.Fatalf("want nil, got %v", *got)
-			case tc.want != nil && got == nil:
-				t.Fatalf("want %v, got nil", *tc.want)
-			case tc.want != nil && *got != *tc.want:
-				t.Fatalf("want %v, got %v", *tc.want, *got)
-			}
-		})
-	}
-}
-
-func durPtr(d time.Duration) *time.Duration { return &d }

client/internal/connect.go

@@ -34,7 +34,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	"github.com/netbirdio/netbird/client/internal/tunnelnotifier"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/internal/updater/installer"
 	nbnet "github.com/netbirdio/netbird/client/net"
@@ -137,13 +136,10 @@ func (c *ConnectClient) RunOniOS(
 	// Set GC percent to 5% to reduce memory usage as iOS only allows 50MB of memory for the extension.
 	debug.SetGCPercent(5)
 
-	notifier := tunnelnotifier.New(networkChangeListener, dnsManager)
-	defer notifier.Close()
-
 	mobileDependency := MobileDependency{
 		FileDescriptor:        fileDescriptor,
-		NetworkChangeListener: notifier,
-		DnsManager:            notifier,
+		NetworkChangeListener: networkChangeListener,
+		DnsManager:            dnsManager,
 		StateFilePath:         stateFilePath,
 		TempDir:               cacheDir,
 	}

client/internal/mobile_dependency.go

@@ -11,14 +11,12 @@ import (
 
 // MobileDependency collect all dependencies for mobile platform
 type MobileDependency struct {
-	// Android and iOS
-	NetworkChangeListener listener.NetworkChangeListener
-
 	// Android only
-	TunAdapter       device.TunAdapter
-	IFaceDiscover    stdnet.ExternalIFaceDiscover
-	HostDNSAddresses []netip.AddrPort
-	DnsReadyListener dns.ReadyListener
+	TunAdapter            device.TunAdapter
+	IFaceDiscover         stdnet.ExternalIFaceDiscover
+	NetworkChangeListener listener.NetworkChangeListener
+	HostDNSAddresses      []netip.AddrPort
+	DnsReadyListener      dns.ReadyListener
 
 	//	iOS only
 	DnsManager     dns.IosDnsManager

client/internal/profilemanager/config.go

@@ -58,10 +58,6 @@ var DefaultInterfaceBlacklist = []string{
 	"Tailscale", "tailscale", "docker", "veth", "br-", "lo",
 }
 
-// loadMDMPolicy is the package-level indirection used by apply() to read the
-// active MDM policy. Tests override this to inject a fake policy.
-var loadMDMPolicy = mdm.LoadPolicy
-
 // ConfigInput carries configuration changes to the client
 type ConfigInput struct {
 	ManagementURL                 string
@@ -186,14 +182,27 @@ type Config struct {
 
 	MTU uint16
 
-	// policy is the MDM policy that produced the currently-set values for
-	// any MDM-enforced fields. Set by applyMDMPolicy at the tail of apply()
-	// and reset on every apply() invocation. Never persisted to disk.
-	// Callers query enforcement state via Policy() and the mdm.Policy API
-	// (HasKey, ManagedKeys, IsEmpty).
+	// policy is the MDM policy that produced the currently-set values
+	// for any MDM-enforced fields. Set by ApplyMDMPolicy on every
+	// invocation. Never persisted to disk. Callers query enforcement
+	// state via Policy() and the mdm.Policy API (HasKey, ManagedKeys,
+	// IsEmpty).
 	policy *mdm.Policy `json:"-"`
 }
 
+// ApplyMDMPolicy overlays the supplied MDM Policy on top of the
+// currently resolved Config values. Idempotent — pass an empty Policy
+// to clear any prior overlay. The lifecycle owner (Server.getConfig
+// on desktop, the Client.Run path on mobile) calls this with
+// loader.Load() once the per-process Loader is known; the Config
+// itself holds no reference to the Loader.
+func (config *Config) ApplyMDMPolicy(policy *mdm.Policy) {
+	if config == nil {
+		return
+	}
+	config.applyMDMPolicy(policy)
+}
+
 // Policy returns the MDM policy applied to this Config. Returns a non-nil
 // empty Policy when MDM enforcement is inactive; callers can always invoke
 // HasKey / ManagedKeys / IsEmpty without a nil check.
@@ -650,9 +659,11 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	// MDM is the last override layer: any key present in the policy
-	// supersedes defaults, on-disk config, env vars and CLI input.
-	config.applyMDMPolicy(loadMDMPolicy())
+	// Initialise the MDM overlay to "no enforcement" so Config.Policy()
+	// never returns a stale or nil policy on a freshly applied Config.
+	// Lifecycle owners that want to enforce a real MDM policy invoke
+	// Config.ApplyMDMPolicy(loader.Load()) after this returns.
+	config.applyMDMPolicy(mdm.NewPolicy(nil))
 
 	return updated, nil
 }

client/internal/profilemanager/config_mdm_test.go

@@ -10,24 +10,58 @@ import (
 	"github.com/netbirdio/netbird/client/mdm"
 )
 
-// withMDMPolicy temporarily overrides the package-level loadMDMPolicy hook so
-// apply() observes the supplied Policy. The original loader is restored at
-// test cleanup.
-func withMDMPolicy(t *testing.T, policy *mdm.Policy) {
+// fakeFetcher implements mdm.PolicyFetcher returning a pre-set policy
+// map. Test helper used to construct a Loader without touching the OS
+// or any package-level state.
+type fakeFetcher struct{ values map[string]any }
+
+func (f *fakeFetcher) Fetch() map[string]any { return f.values }
+
+// loaderFor builds an mdm.Loader whose loadPlatform returns the
+// supplied Policy's underlying values.
+func loaderFor(policy *mdm.Policy) *mdm.Loader {
+	if policy == nil || policy.IsEmpty() {
+		return mdm.NewLoader(&fakeFetcher{values: nil})
+	}
+	values := make(map[string]any)
+	for _, k := range policy.ManagedKeys() {
+		if v, ok := policy.GetString(k); ok {
+			values[k] = v
+			continue
+		}
+		if v, ok := policy.GetBool(k); ok {
+			values[k] = v
+			continue
+		}
+		if v, ok := policy.GetInt(k); ok {
+			values[k] = v
+			continue
+		}
+		if v, ok := policy.GetStringSlice(k); ok {
+			values[k] = v
+		}
+	}
+	return mdm.NewLoader(&fakeFetcher{values: values})
+}
+
+// configWithMDM is the test convenience that builds a Config via
+// UpdateOrCreateConfig and overlays the supplied MDM policy on top —
+// mirrors the production pattern (Server.getConfig / Client.applyMDMOverlay)
+// where the Loader lives outside Config and the apply step is driven
+// by the lifecycle owner.
+func configWithMDM(t *testing.T, input ConfigInput, policy *mdm.Policy) *Config {
 	t.Helper()
-	prev := loadMDMPolicy
-	loadMDMPolicy = func() *mdm.Policy { return policy }
-	t.Cleanup(func() { loadMDMPolicy = prev })
+	cfg, err := UpdateOrCreateConfig(input)
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+	cfg.ApplyMDMPolicy(loaderFor(policy).Load())
+	return cfg
 }
 
 func TestApply_MDMEmpty_NoEnforcement(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(nil))
-
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
+	cfg := configWithMDM(t, ConfigInput{
 		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
+	}, mdm.NewPolicy(nil))
 
 	assert.True(t, cfg.Policy().IsEmpty(), "no MDM source ⇒ empty Policy")
 	assert.False(t, cfg.Policy().HasKey(mdm.KeyManagementURL))
@@ -39,18 +73,15 @@ func TestApply_MDMEmpty_NoEnforcement(t *testing.T) {
 
 func TestApply_MDMOnly_OverridesDefaults(t *testing.T) {
 	const mdmURL = "https://corp.mdm.example.com:443"
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL:       mdmURL,
 		mdm.KeyDisableClientRoutes: true,
 		mdm.KeyBlockInbound:        true,
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	assert.Equal(t, mdmURL, cfg.ManagementURL.String())
 	assert.True(t, cfg.DisableClientRoutes)
 	assert.True(t, cfg.BlockInbound)
@@ -65,16 +96,12 @@ func TestApply_MDMBeatsCLIInput(t *testing.T) {
 	const mdmURL = "https://mdm.example.com:443"
 	const cliURL = "https://cli.example.com:443"
 
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
-		mdm.KeyManagementURL: mdmURL,
-	}))
-
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
+	cfg := configWithMDM(t, ConfigInput{
 		ConfigPath:    filepath.Join(t.TempDir(), "config.json"),
 		ManagementURL: cliURL,
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
+	}, mdm.NewPolicy(map[string]any{
+		mdm.KeyManagementURL: mdmURL,
+	}))
 
 	// MDM wins over CLI-supplied management URL.
 	assert.Equal(t, mdmURL, cfg.ManagementURL.String())
@@ -82,16 +109,12 @@ func TestApply_MDMBeatsCLIInput(t *testing.T) {
 }
 
 func TestApply_MDMInvalidURL_KeepsPreviousValue(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL: "not-a-url",
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	// Invalid MDM URL is logged and skipped: default URL stays in place
 	// to keep the client functional.
 	assert.Equal(t, DefaultManagementURL, cfg.ManagementURL.String())
@@ -106,24 +129,20 @@ func TestApply_MDMBoolKeysOverrideOnDiskValue(t *testing.T) {
 	tmp := filepath.Join(t.TempDir(), "config.json")
 
 	// Seed without MDM.
-	withMDMPolicy(t, mdm.NewPolicy(nil))
-	_, err := UpdateOrCreateConfig(ConfigInput{
+	configWithMDM(t, ConfigInput{
 		ConfigPath:          tmp,
 		DisableClientRoutes: boolPtr(false),
 		RosenpassEnabled:    boolPtr(false),
-	})
-	require.NoError(t, err)
+	}, mdm.NewPolicy(nil))
 
 	// Now enable MDM enforcement for these keys.
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: tmp,
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyDisableClientRoutes: true,
 		mdm.KeyRosenpassEnabled:    true,
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: tmp})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	assert.True(t, cfg.DisableClientRoutes, "MDM override should flip on-disk false to true")
 	assert.True(t, cfg.RosenpassEnabled)
 	assert.True(t, cfg.Policy().HasKey(mdm.KeyDisableClientRoutes))
@@ -164,16 +183,12 @@ func TestApply_MDMLazyConnection(t *testing.T) {
 func TestApply_MDMPreSharedKeyRedactionSentinelRejected(t *testing.T) {
 	const maskSentinel = "**********"
 
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	cfg := configWithMDM(t, ConfigInput{
+		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
+	}, mdm.NewPolicy(map[string]any{
 		mdm.KeyPreSharedKey: maskSentinel,
 	}))
 
-	cfg, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath: filepath.Join(t.TempDir(), "config.json"),
-	})
-	require.NoError(t, err)
-	require.NotNil(t, cfg)
-
 	// Mask sentinel must not be persisted as the actual PSK.
 	assert.NotEqual(t, maskSentinel, cfg.PreSharedKey)
 	// Key still marked managed so user writes are still rejected.

client/internal/routemanager/manager.go

@@ -52,10 +52,6 @@ type Manager interface {
 	UpdateRoutes(updateSerial uint64, serverRoutes map[route.ID]*route.Route, clientRoutes route.HAMap, useNewDNSRoute bool) error
 	ClassifyRoutes(newRoutes []*route.Route) (map[route.ID]*route.Route, route.HAMap)
 	TriggerSelection(route.HAMap)
-	SelectRoutes(ids []route.NetID, appendRoute bool) error
-	DeselectRoutes(ids []route.NetID) error
-	SelectAllRoutes()
-	DeselectAllRoutes()
 	GetRouteSelector() *routeselector.RouteSelector
 	GetClientRoutes() route.HAMap
 	GetSelectedClientRoutes() route.HAMap
@@ -804,7 +800,7 @@ func (m *DefaultManager) collectExitNodeInfo(clientRoutes route.HAMap) exitNodeI
 	var info exitNodeInfo
 
 	for haID, routes := range clientRoutes {
-		if !isExitNodeRoutes(routes) {
+		if !m.isExitNodeRoute(routes) {
 			continue
 		}
 
@@ -824,6 +820,13 @@ func (m *DefaultManager) collectExitNodeInfo(clientRoutes route.HAMap) exitNodeI
 	return info
 }
 
+func (m *DefaultManager) isExitNodeRoute(routes []*route.Route) bool {
+	if len(routes) == 0 {
+		return false
+	}
+	return route.IsV4DefaultRoute(routes[0].Network) || route.IsV6DefaultRoute(routes[0].Network)
+}
+
 func (m *DefaultManager) categorizeUserSelection(netID route.NetID, info *exitNodeInfo) {
 	if m.routeSelector.IsSelected(netID) {
 		info.userSelected = append(info.userSelected, netID)

client/internal/routemanager/mock.go

@@ -16,8 +16,6 @@ type MockManager struct {
 	ClassifyRoutesFunc           func(routes []*route.Route) (map[route.ID]*route.Route, route.HAMap)
 	UpdateRoutesFunc             func(updateSerial uint64, serverRoutes map[route.ID]*route.Route, clientRoutes route.HAMap, useNewDNSRoute bool) error
 	TriggerSelectionFunc         func(haMap route.HAMap)
-	SelectRoutesFunc             func(ids []route.NetID, appendRoute bool) error
-	DeselectRoutesFunc           func(ids []route.NetID) error
 	GetRouteSelectorFunc         func() *routeselector.RouteSelector
 	GetClientRoutesFunc          func() route.HAMap
 	GetSelectedClientRoutesFunc  func() route.HAMap
@@ -57,30 +55,6 @@ func (m *MockManager) TriggerSelection(networks route.HAMap) {
 	}
 }
 
-// SelectRoutes mock implementation of SelectRoutes from Manager interface
-func (m *MockManager) SelectRoutes(ids []route.NetID, appendRoute bool) error {
-	if m.SelectRoutesFunc != nil {
-		return m.SelectRoutesFunc(ids, appendRoute)
-	}
-	return nil
-}
-
-// DeselectRoutes mock implementation of DeselectRoutes from Manager interface
-func (m *MockManager) DeselectRoutes(ids []route.NetID) error {
-	if m.DeselectRoutesFunc != nil {
-		return m.DeselectRoutesFunc(ids)
-	}
-	return nil
-}
-
-// SelectAllRoutes mock implementation of SelectAllRoutes from Manager interface
-func (m *MockManager) SelectAllRoutes() {
-}
-
-// DeselectAllRoutes mock implementation of DeselectAllRoutes from Manager interface
-func (m *MockManager) DeselectAllRoutes() {
-}
-
 // GetRouteSelector mock implementation of GetRouteSelector from Manager interface
 func (m *MockManager) GetRouteSelector() *routeselector.RouteSelector {
 	if m.GetRouteSelectorFunc != nil {

client/internal/routemanager/notifier/notifier_ios.go

@@ -3,6 +3,7 @@
 package notifier
 
 import (
+	"container/list"
 	"net/netip"
 	"slices"
 	"sort"
@@ -15,12 +16,20 @@ import (
 
 type Notifier struct {
 	mu              sync.Mutex
+	cond            *sync.Cond
 	currentPrefixes []string
 	listener        listener.NetworkChangeListener
+	queue           *list.List
+	closed          bool
 }
 
 func NewNotifier() *Notifier {
-	return &Notifier{}
+	n := &Notifier{
+		queue: list.New(),
+	}
+	n.cond = sync.NewCond(&n.mu)
+	go n.deliverLoop()
+	return n
 }
 
 func (n *Notifier) SetListener(listener listener.NetworkChangeListener) {
@@ -50,19 +59,44 @@ func (n *Notifier) OnNewPrefixes(prefixes []netip.Prefix) {
 	sort.Strings(newNets)
 
 	n.mu.Lock()
-	defer n.mu.Unlock()
 	if slices.Equal(n.currentPrefixes, newNets) {
+		n.mu.Unlock()
 		return
 	}
 	n.currentPrefixes = newNets
-	if n.listener != nil {
-		n.listener.OnNetworkChanged(strings.Join(n.currentPrefixes, ","))
-	}
+	routes := strings.Join(n.currentPrefixes, ",")
+	n.queue.PushBack(routes)
+	n.cond.Signal()
+	n.mu.Unlock()
 }
 
 func (n *Notifier) Close() {
+	n.mu.Lock()
+	n.closed = true
+	n.cond.Signal()
+	n.mu.Unlock()
 }
 
 func (n *Notifier) GetInitialRouteRanges() []string {
 	return nil
 }
+
+func (n *Notifier) deliverLoop() {
+	for {
+		n.mu.Lock()
+		for n.queue.Len() == 0 && !n.closed {
+			n.cond.Wait()
+		}
+		if n.closed && n.queue.Len() == 0 {
+			n.mu.Unlock()
+			return
+		}
+		routes := n.queue.Remove(n.queue.Front()).(string)
+		l := n.listener
+		n.mu.Unlock()
+
+		if l != nil {
+			l.OnNetworkChanged(routes)
+		}
+	}
+}

client/internal/routemanager/reconcile_test.go

@@ -54,7 +54,7 @@ func (m *reconcileWGMock) GetNet() *netstack.Net                      { return n
 func TestReconcilePeerAllowedIPs(t *testing.T) {
 	wg := &reconcileWGMock{}
 	m := &DefaultManager{wgInterface: wg}
-	m.allowedIPsRefCounter = refcounter.NewAllowedIPs(
+	m.allowedIPsRefCounter = refcounter.New[netip.Prefix, string, string](
 		func(_ netip.Prefix, peerKey string) (string, error) { return peerKey, nil },
 		func(netip.Prefix, string) error { return nil },
 	)

client/internal/routemanager/refcounter/allowedips.go

@@ -169,27 +169,6 @@ func (rm *AllowedIPsRefCounter) Flush() error {
 	return nberrors.FormatErrorOrNil(merr)
 }
 
-// ReapplyMatching calls apply for every prefix whose currently installed (active) peer satisfies
-// pred, holding the lock for the whole pass. It is used to re-push allowed IPs onto a peer whose
-// WireGuard entry was rebuilt (e.g. a lazy connection cycling idle->wake) without a matching
-// refcounter change, which would otherwise leave the prefix installed in the counter but missing
-// on the device. Only the active peer is considered — a prefix that lost its installed peer to a
-// failed swap is skipped here and reconciled by the next Increment/Decrement.
-func (rm *AllowedIPsRefCounter) ReapplyMatching(pred func(out string) bool, apply func(key netip.Prefix) error) error {
-	rm.mu.Lock()
-	defer rm.mu.Unlock()
-
-	var merr *multierror.Error
-	for prefix, e := range rm.entries {
-		if e.active != "" && pred(e.active) {
-			if err := apply(prefix); err != nil {
-				merr = multierror.Append(merr, err)
-			}
-		}
-	}
-	return nberrors.FormatErrorOrNil(merr)
-}
-
 // pickSurvivor deterministically selects a peer still referencing the prefix. WireGuard cannot do
 // multipath for a single prefix, so any surviving peer is a valid winner; the choice is made stable
 // (lowest peerKey) for predictable behavior and testability.

client/internal/routemanager/selection.go

@@ -1,138 +0,0 @@
-package routemanager
-
-import (
-	"fmt"
-	"slices"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/exp/maps"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/route"
-)
-
-// SelectRoutes selects the routes with the given network IDs and applies the
-// new selection. V4/v6 exit-node pairs are expanded automatically. Exit nodes
-// are mutually exclusive: if the selection activates an exit node, every other
-// available exit node is deselected so two can't be active at once. With
-// appendRoute=false the previous selection is replaced instead of extended.
-func (m *DefaultManager) SelectRoutes(ids []route.NetID, appendRoute bool) error {
-	if err := m.selectRoutes(ids, appendRoute); err != nil {
-		return err
-	}
-	m.TriggerSelection(m.GetClientRoutes())
-	return nil
-}
-
-// DeselectRoutes removes the routes with the given network IDs from the
-// selection and applies the change. V4/v6 exit-node pairs are expanded
-// automatically.
-func (m *DefaultManager) DeselectRoutes(ids []route.NetID) error {
-	if err := m.deselectRoutes(ids); err != nil {
-		return err
-	}
-	m.TriggerSelection(m.GetClientRoutes())
-	return nil
-}
-
-func (m *DefaultManager) deselectRoutes(ids []route.NetID) error {
-	routesMap := m.GetClientRoutesWithNetID()
-	routes := route.ExpandV6ExitPairs(slices.Clone(ids), routesMap)
-
-	log.Debugf("deselecting routes with ids: %v", routes)
-
-	if err := m.routeSelector.DeselectRoutes(routes, maps.Keys(routesMap)); err != nil {
-		return fmt.Errorf("deselect routes: %w", err)
-	}
-
-	return nil
-}
-
-// SelectAllRoutes selects every available route and applies the selection.
-// Exit nodes stay mutually exclusive: at most one remains active.
-func (m *DefaultManager) SelectAllRoutes() {
-	m.selectAllRoutes()
-	m.TriggerSelection(m.GetClientRoutes())
-}
-
-func (m *DefaultManager) selectAllRoutes() {
-	m.routeSelector.SelectAllRoutes()
-
-	// Select-all wipes every explicit selection, so exit nodes fall back to
-	// management's auto-apply flags — which may mark several at once.
-	// Reconcile immediately so at most one exit node stays active instead of
-	// waiting for the next network map to enforce it.
-	m.mux.Lock()
-	defer m.mux.Unlock()
-	m.updateRouteSelectorFromManagement(m.clientRoutes)
-}
-
-// DeselectAllRoutes deselects every route and applies the change.
-func (m *DefaultManager) DeselectAllRoutes() {
-	m.routeSelector.DeselectAllRoutes()
-	m.TriggerSelection(m.GetClientRoutes())
-}
-
-func (m *DefaultManager) selectRoutes(ids []route.NetID, appendRoute bool) error {
-	routesMap := m.GetClientRoutesWithNetID()
-	routes := route.ExpandV6ExitPairs(slices.Clone(ids), routesMap)
-	allIDs := maps.Keys(routesMap)
-
-	log.Debugf("selecting routes with ids: %v", routes)
-
-	// A partial failure (e.g. an unknown ID in the request) still selects the
-	// valid routes, so exclusivity below must run regardless of the error.
-	var merr *multierror.Error
-	if err := m.routeSelector.SelectRoutes(routes, appendRoute, allIDs); err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("select routes: %w", err))
-	}
-
-	// Exit nodes are mutually exclusive: if this selection activates an
-	// exit node, deselect every other available exit node so two can't be
-	// selected at once. Non-exit route selections are left untouched.
-	if requestActivatesExitNode(routes, routesMap) {
-		if others := otherExitNodeIDs(routesMap, routes); len(others) > 0 {
-			if err := m.routeSelector.DeselectRoutes(others, allIDs); err != nil {
-				merr = multierror.Append(merr, fmt.Errorf("deselect sibling exit nodes: %w", err))
-			}
-		}
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
-func isExitNodeRoutes(routes []*route.Route) bool {
-	return len(routes) > 0 && (route.IsV4DefaultRoute(routes[0].Network) || route.IsV6DefaultRoute(routes[0].Network))
-}
-
-// requestActivatesExitNode reports whether any requested NetID maps to an exit
-// node (default route) in the current route table.
-func requestActivatesExitNode(requested []route.NetID, routesMap map[route.NetID][]*route.Route) bool {
-	for _, id := range requested {
-		if isExitNodeRoutes(routesMap[id]) {
-			return true
-		}
-	}
-	return false
-}
-
-// otherExitNodeIDs returns every available exit-node NetID that is not in the
-// requested set — the siblings to deselect so a single exit node stays active.
-func otherExitNodeIDs(routesMap map[route.NetID][]*route.Route, requested []route.NetID) []route.NetID {
-	keep := make(map[route.NetID]struct{}, len(requested))
-	for _, id := range requested {
-		keep[id] = struct{}{}
-	}
-	var others []route.NetID
-	for id, routes := range routesMap {
-		if !isExitNodeRoutes(routes) {
-			continue
-		}
-		if _, ok := keep[id]; ok {
-			continue
-		}
-		others = append(others, id)
-	}
-	return others
-}

client/internal/routemanager/selection_test.go

@@ -1,129 +0,0 @@
-package routemanager
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal/routeselector"
-	"github.com/netbirdio/netbird/route"
-)
-
-func v6ExitRoute(netID, peer string) *route.Route {
-	return &route.Route{
-		NetID:   route.NetID(netID),
-		Network: netip.MustParsePrefix("::/0"),
-		Peer:    peer,
-	}
-}
-
-func newSelectionTestManager() *DefaultManager {
-	return &DefaultManager{
-		routeSelector: routeselector.NewRouteSelector(),
-		clientRoutes: route.HAMap{
-			"exitA|0.0.0.0/0":    {exitRoute("exitA", "p1", true)},
-			"exitA-v6|::/0":      {v6ExitRoute("exitA-v6", "p1")},
-			"exitB|0.0.0.0/0":    {exitRoute("exitB", "p2", true)},
-			"lan|192.168.1.0/24": {{NetID: "lan", Network: netip.MustParsePrefix("192.168.1.0/24"), Peer: "p3"}},
-		},
-	}
-}
-
-func TestSelectRoutes_ExitNodeExclusivity(t *testing.T) {
-	m := newSelectionTestManager()
-
-	// Selecting an exit node selects its v6 pair and deselects the sibling.
-	require.NoError(t, m.selectRoutes([]route.NetID{"exitA"}, true))
-	assert.True(t, m.routeSelector.IsSelected("exitA"), "exitA should be selected")
-	assert.True(t, m.routeSelector.IsSelected("exitA-v6"), "the v6 pair follows its v4 base")
-	assert.False(t, m.routeSelector.IsSelected("exitB"), "the sibling exit node must be deselected")
-
-	// Switching to the sibling deselects the previous exit node and its v6 pair.
-	require.NoError(t, m.selectRoutes([]route.NetID{"exitB"}, true))
-	assert.True(t, m.routeSelector.IsSelected("exitB"), "exitB should now be selected")
-	assert.False(t, m.routeSelector.IsSelected("exitA"), "the previous exit node must be deselected")
-	assert.False(t, m.routeSelector.IsSelected("exitA-v6"), "the previous exit node's v6 pair must be deselected")
-	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit route selection is untouched")
-
-	// Selecting a non-exit route leaves the active exit node alone.
-	require.NoError(t, m.selectRoutes([]route.NetID{"lan"}, true))
-	assert.True(t, m.routeSelector.IsSelected("exitB"), "selecting a non-exit route keeps the exit node")
-
-	// Deselecting the active exit node turns every exit node off.
-	require.NoError(t, m.deselectRoutes([]route.NetID{"exitB"}))
-	assert.False(t, m.routeSelector.IsSelected("exitB"), "exitB should be deselected")
-	assert.False(t, m.routeSelector.IsSelected("exitA"), "exitA stays deselected")
-	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit route selection is untouched")
-}
-
-func TestSelectRoutes_PartialErrorStillEnforcesExclusivity(t *testing.T) {
-	// The unknown ID must be reported, but the valid exit node in the same
-	// request is still selected — so its sibling must still be deselected.
-	// Both orderings are covered: processing must continue past the invalid
-	// ID wherever it sits in the request.
-	requests := map[string][]route.NetID{
-		"invalid id first": {"missing", "exitB"},
-		"invalid id last":  {"exitB", "missing"},
-	}
-
-	for name, ids := range requests {
-		t.Run(name, func(t *testing.T) {
-			m := newSelectionTestManager()
-
-			require.NoError(t, m.selectRoutes([]route.NetID{"exitA"}, true))
-
-			err := m.selectRoutes(ids, true)
-			assert.Error(t, err, "unknown id must be reported")
-			assert.True(t, m.routeSelector.IsSelected("exitB"), "valid exit node from the request is selected")
-			assert.False(t, m.routeSelector.IsSelected("exitA"), "sibling exit node must be deselected despite the error")
-			assert.False(t, m.routeSelector.IsSelected("exitA-v6"), "sibling's v6 pair must be deselected too")
-		})
-	}
-}
-
-func TestSelectAllRoutes_KeepsSingleExitNode(t *testing.T) {
-	// Both exit nodes are marked for auto-apply by management
-	// (SkipAutoApply=false), the state where select-all could turn on two at
-	// once without the immediate reconciliation.
-	m := &DefaultManager{
-		routeSelector: routeselector.NewRouteSelector(),
-		clientRoutes: route.HAMap{
-			"exitA|0.0.0.0/0":    {exitRoute("exitA", "p1", false)},
-			"exitB|0.0.0.0/0":    {exitRoute("exitB", "p2", false)},
-			"lan|192.168.1.0/24": {{NetID: "lan", Network: netip.MustParsePrefix("192.168.1.0/24"), Peer: "p3"}},
-		},
-	}
-
-	require.NoError(t, m.selectRoutes([]route.NetID{"exitB"}, true))
-
-	m.selectAllRoutes()
-
-	assert.True(t, m.routeSelector.IsSelected("lan"), "non-exit routes are all selected")
-	assert.True(t, m.routeSelector.IsSelected("exitA"), "the deterministic management pick stays active")
-	assert.False(t, m.routeSelector.IsSelected("exitB"), "select-all must not leave a second exit node active")
-}
-
-func TestSelectRoutes_UnknownRoute(t *testing.T) {
-	m := newSelectionTestManager()
-
-	assert.Error(t, m.selectRoutes([]route.NetID{"missing"}, true), "selecting an unavailable route must fail")
-	assert.Error(t, m.deselectRoutes([]route.NetID{"missing"}), "deselecting an unavailable route must fail")
-}
-
-func TestExitNodeSelectionHelpers(t *testing.T) {
-	routesMap := map[route.NetID][]*route.Route{
-		"exitA": {{Network: netip.MustParsePrefix("0.0.0.0/0")}},
-		"exitB": {{Network: netip.MustParsePrefix("::/0")}},
-		"lan":   {{Network: netip.MustParsePrefix("192.168.0.0/16")}},
-	}
-
-	assert.True(t, requestActivatesExitNode([]route.NetID{"exitA"}, routesMap), "v4 default route is an exit node")
-	assert.True(t, requestActivatesExitNode([]route.NetID{"exitB"}, routesMap), "v6 default route is an exit node")
-	assert.False(t, requestActivatesExitNode([]route.NetID{"lan"}, routesMap), "lan route is not an exit node")
-	assert.False(t, requestActivatesExitNode([]route.NetID{"missing"}, routesMap), "unknown id is not an exit node")
-
-	others := otherExitNodeIDs(routesMap, []route.NetID{"exitB"})
-	assert.ElementsMatch(t, []route.NetID{"exitA"}, others, "only the other exit node is a sibling; the lan route is ignored")
-}

client/internal/routemanager/sysctl/sysctl_linux.go

@@ -20,8 +20,6 @@ const (
 	rpFilterPath          = "net.ipv4.conf.all.rp_filter"
 	rpFilterInterfacePath = "net.ipv4.conf.%s.rp_filter"
 	srcValidMarkPath      = "net.ipv4.conf.all.src_valid_mark"
-	percentEscape         = "%25"
-	dotEscape             = "%2E"
 )
 
 type iface interface {
@@ -58,11 +56,7 @@ func Setup(wgIface iface) (map[string]int, error) {
 			continue
 		}
 
-		// Escape '%' and '.' so they survive the dot-to-slash conversion in Set()
-		safeName := strings.ReplaceAll(intf.Name, "%", percentEscape)
-		safeName = strings.ReplaceAll(safeName, ".", dotEscape)
-
-		i := fmt.Sprintf(rpFilterInterfacePath, safeName)
+		i := fmt.Sprintf(rpFilterInterfacePath, intf.Name)
 		oldVal, err := Set(i, 2, true)
 		if err != nil {
 			result = multierror.Append(result, err)
@@ -76,11 +70,7 @@ func Setup(wgIface iface) (map[string]int, error) {
 
 // Set sets a sysctl configuration, if onlyIfOne is true it will only set the new value if it's set to 1
 func Set(key string, desiredValue int, onlyIfOne bool) (int, error) {
-	path := strings.ReplaceAll(key, ".", "/")
-	// Unescape interface dots and percent signs
-	path = strings.ReplaceAll(path, dotEscape, ".")
-	path = strings.ReplaceAll(path, percentEscape, "%")
-	path = fmt.Sprintf("/proc/sys/%s", path)
+	path := fmt.Sprintf("/proc/sys/%s", strings.ReplaceAll(key, ".", "/"))
 	currentValue, err := os.ReadFile(path)
 	if err != nil {
 		return -1, fmt.Errorf("read sysctl %s: %w", key, err)

client/internal/tunnelnotifier/notifier.go

@@ -1,124 +0,0 @@
-package tunnelnotifier
-
-import (
-	"container/list"
-	"sync"
-
-	"github.com/netbirdio/netbird/client/internal/dns"
-	"github.com/netbirdio/netbird/client/internal/listener"
-)
-
-type eventKind int
-
-const (
-	eventRoutes eventKind = iota
-	eventIfaceIP
-	eventIfaceIPv6
-	eventDNS
-)
-
-var (
-	_ listener.NetworkChangeListener = (*Notifier)(nil)
-	_ dns.IosDnsManager              = (*Notifier)(nil)
-)
-
-type event struct {
-	kind    eventKind
-	payload string
-}
-
-type Notifier struct {
-	mu     sync.Mutex
-	cond   *sync.Cond
-	queue  *list.List
-	closed bool
-	done   chan struct{}
-
-	listener   listener.NetworkChangeListener
-	dnsManager dns.IosDnsManager
-}
-
-func New(l listener.NetworkChangeListener, dm dns.IosDnsManager) *Notifier {
-	n := &Notifier{
-		queue:      list.New(),
-		done:       make(chan struct{}),
-		listener:   l,
-		dnsManager: dm,
-	}
-	n.cond = sync.NewCond(&n.mu)
-	go n.deliverLoop()
-	return n
-}
-
-func (n *Notifier) OnNetworkChanged(routes string) {
-	n.enqueue(event{kind: eventRoutes, payload: routes})
-}
-
-func (n *Notifier) SetInterfaceIP(ip string) {
-	n.enqueue(event{kind: eventIfaceIP, payload: ip})
-}
-
-func (n *Notifier) SetInterfaceIPv6(ip string) {
-	n.enqueue(event{kind: eventIfaceIPv6, payload: ip})
-}
-
-func (n *Notifier) ApplyDns(config string) {
-	n.enqueue(event{kind: eventDNS, payload: config})
-}
-
-// Close stops accepting new events and blocks until the delivery loop has
-// drained all queued events and exited.
-func (n *Notifier) Close() {
-	n.mu.Lock()
-	n.closed = true
-	n.cond.Signal()
-	n.mu.Unlock()
-	<-n.done
-}
-
-func (n *Notifier) enqueue(ev event) {
-	n.mu.Lock()
-	defer n.mu.Unlock()
-	if n.closed {
-		return
-	}
-	n.queue.PushBack(ev)
-	n.cond.Signal()
-}
-
-func (n *Notifier) deliverLoop() {
-	defer close(n.done)
-	for {
-		n.mu.Lock()
-		for n.queue.Len() == 0 && !n.closed {
-			n.cond.Wait()
-		}
-		if n.closed && n.queue.Len() == 0 {
-			n.mu.Unlock()
-			return
-		}
-		ev := n.queue.Remove(n.queue.Front()).(event)
-		l := n.listener
-		dm := n.dnsManager
-		n.mu.Unlock()
-
-		switch ev.kind {
-		case eventRoutes:
-			if l != nil {
-				l.OnNetworkChanged(ev.payload)
-			}
-		case eventIfaceIP:
-			if l != nil {
-				l.SetInterfaceIP(ev.payload)
-			}
-		case eventIfaceIPv6:
-			if l != nil {
-				l.SetInterfaceIPv6(ev.payload)
-			}
-		case eventDNS:
-			if dm != nil {
-				dm.ApplyDns(ev.payload)
-			}
-		}
-	}
-}

client/internal/tunnelnotifier/notifier_test.go

@@ -1,192 +0,0 @@
-package tunnelnotifier
-
-import (
-	"fmt"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type call struct {
-	kind    string
-	payload string
-}
-
-type recorder struct {
-	mu       sync.Mutex
-	calls    []call
-	inFlight atomic.Int32
-	overlap  atomic.Bool
-	delay    time.Duration
-}
-
-func (r *recorder) record(kind, payload string) {
-	if r.inFlight.Add(1) != 1 {
-		r.overlap.Store(true)
-	}
-	if r.delay > 0 {
-		time.Sleep(r.delay)
-	}
-	r.mu.Lock()
-	r.calls = append(r.calls, call{kind: kind, payload: payload})
-	r.mu.Unlock()
-	r.inFlight.Add(-1)
-}
-
-func (r *recorder) count() int {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	return len(r.calls)
-}
-
-func (r *recorder) snapshot() []call {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	out := make([]call, len(r.calls))
-	copy(out, r.calls)
-	return out
-}
-
-type fakeListener struct {
-	rec *recorder
-}
-
-func (f *fakeListener) OnNetworkChanged(routes string) {
-	f.rec.record("routes", routes)
-}
-
-func (f *fakeListener) SetInterfaceIP(ip string) {
-	f.rec.record("ip", ip)
-}
-
-func (f *fakeListener) SetInterfaceIPv6(ip string) {
-	f.rec.record("ipv6", ip)
-}
-
-type fakeDNSManager struct {
-	rec *recorder
-}
-
-func (f *fakeDNSManager) ApplyDns(config string) {
-	f.rec.record("dns", config)
-}
-
-func TestFIFOOrder(t *testing.T) {
-	rec := &recorder{}
-	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
-	defer n.Close()
-
-	n.SetInterfaceIP("10.0.0.1")
-	n.SetInterfaceIPv6("fd00::1")
-	n.ApplyDns(`{"domains":[]}`)
-	n.OnNetworkChanged("10.0.0.0/8,192.168.0.0/16")
-	n.ApplyDns(`{"domains":["example.com"]}`)
-
-	require.Eventually(t, func() bool { return rec.count() == 5 }, time.Second, time.Millisecond)
-
-	expected := []call{
-		{kind: "ip", payload: "10.0.0.1"},
-		{kind: "ipv6", payload: "fd00::1"},
-		{kind: "dns", payload: `{"domains":[]}`},
-		{kind: "routes", payload: "10.0.0.0/8,192.168.0.0/16"},
-		{kind: "dns", payload: `{"domains":["example.com"]}`},
-	}
-	assert.Equal(t, expected, rec.snapshot())
-}
-
-func TestNoOverlappingCalls(t *testing.T) {
-	rec := &recorder{delay: 100 * time.Microsecond}
-	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
-	defer n.Close()
-
-	const producers = 8
-	const perProducer = 25
-
-	var wg sync.WaitGroup
-	for i := 0; i < producers; i++ {
-		wg.Add(1)
-		go func(id int) {
-			defer wg.Done()
-			for j := 0; j < perProducer; j++ {
-				payload := fmt.Sprintf("%d-%d", id, j)
-				switch j % 4 {
-				case 0:
-					n.OnNetworkChanged(payload)
-				case 1:
-					n.SetInterfaceIP(payload)
-				case 2:
-					n.SetInterfaceIPv6(payload)
-				case 3:
-					n.ApplyDns(payload)
-				}
-			}
-		}(i)
-	}
-	wg.Wait()
-
-	require.Eventually(t, func() bool { return rec.count() == producers*perProducer }, 5*time.Second, time.Millisecond)
-	assert.False(t, rec.overlap.Load())
-}
-
-func TestDNSAndRoutesInterleaved(t *testing.T) {
-	rec := &recorder{delay: 100 * time.Microsecond}
-	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
-	defer n.Close()
-
-	const events = 50
-
-	var wg sync.WaitGroup
-	wg.Add(2)
-	go func() {
-		defer wg.Done()
-		for i := 0; i < events; i++ {
-			n.ApplyDns(fmt.Sprintf("dns-%d", i))
-		}
-	}()
-	go func() {
-		defer wg.Done()
-		for i := 0; i < events; i++ {
-			n.OnNetworkChanged(fmt.Sprintf("routes-%d", i))
-		}
-	}()
-	wg.Wait()
-
-	require.Eventually(t, func() bool { return rec.count() == 2*events }, 5*time.Second, time.Millisecond)
-	assert.False(t, rec.overlap.Load())
-
-	var dnsSeen, routesSeen int
-	for _, c := range rec.snapshot() {
-		switch c.kind {
-		case "dns":
-			assert.Equal(t, fmt.Sprintf("dns-%d", dnsSeen), c.payload)
-			dnsSeen++
-		case "routes":
-			assert.Equal(t, fmt.Sprintf("routes-%d", routesSeen), c.payload)
-			routesSeen++
-		}
-	}
-	assert.Equal(t, events, dnsSeen)
-	assert.Equal(t, events, routesSeen)
-}
-
-func TestCloseDrainsQueue(t *testing.T) {
-	rec := &recorder{delay: time.Millisecond}
-	n := New(&fakeListener{rec: rec}, &fakeDNSManager{rec: rec})
-
-	const events = 20
-	for i := 0; i < events; i++ {
-		n.OnNetworkChanged(fmt.Sprintf("routes-%d", i))
-	}
-	n.Close()
-
-	require.Equal(t, events, rec.count(), "Close must not return before all queued events are delivered")
-
-	n.OnNetworkChanged("after-close")
-	n.ApplyDns("after-close")
-	time.Sleep(50 * time.Millisecond)
-	assert.Equal(t, events, rec.count())
-}

client/ios/NetBirdSDK/client.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/exp/maps"
 
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
@@ -21,6 +22,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -82,6 +84,13 @@ type Client struct {
 	// preloadedConfig holds config loaded from JSON (used on tvOS where file writes are blocked)
 	preloadedConfig *profilemanager.Config
 
+	// mdmLoader holds the per-Client MDM policy source. Set by
+	// SetMDMPolicyFetcher (called from the Swift side at extension
+	// init). Each Run passes this loader to the resolved Config so
+	// applyMDMPolicy picks up the active overlay. Nil means "MDM
+	// enforcement off for this Client".
+	mdmLoader *mdm.Loader
+
 	stateMu       sync.RWMutex
 	connectClient *internal.ConnectClient
 	config        *profilemanager.Config
@@ -142,6 +151,7 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 		if err != nil {
 			return err
 		}
+		c.applyMDMOverlay(cfg)
 	}
 	c.recorder.UpdateManagementAddress(cfg.ManagementURL.String())
 	c.recorder.UpdateRosenpass(cfg.RosenpassEnabled, cfg.RosenpassPermissive)
@@ -214,6 +224,7 @@ func (c *Client) DebugBundle(anonymize bool) (string, error) {
 				return "", fmt.Errorf("load config: %w", err)
 			}
 		}
+		c.applyMDMOverlay(cfg)
 	}
 
 	deps := debug.GeneratorDependencies{
@@ -363,6 +374,7 @@ func (c *Client) IsLoginRequired() bool {
 			// If we can't load config, assume login is required
 			return true
 		}
+		c.applyMDMOverlay(cfg)
 	}
 
 	if cfg == nil {
@@ -411,6 +423,7 @@ func (c *Client) LoginForMobile() string {
 		log.Errorf("LoginForMobile: failed to load config: %v", err)
 		return fmt.Sprintf("failed to load config: %v", err)
 	}
+	c.applyMDMOverlay(cfg)
 
 	oAuthFlow, err := auth.NewOAuthFlow(ctx, cfg, false, false, "")
 	if err != nil {
@@ -636,18 +649,23 @@ func (c *Client) SelectRoute(id string) error {
 	}
 
 	routeManager := engine.GetRouteManager()
+	routeSelector := routeManager.GetRouteSelector()
 	if id == "All" {
 		log.Debugf("select all routes")
-		routeManager.SelectAllRoutes()
-		return nil
-	}
-
-	log.Debugf("select route with id: %s", id)
-	if err := routeManager.SelectRoutes(toNetIDs([]string{id}), true); err != nil {
-		log.Debugf("error when selecting routes: %s", err)
-		return err
+		routeSelector.SelectAllRoutes()
+	} else {
+		log.Debugf("select route with id: %s", id)
+		routes := toNetIDs([]string{id})
+		routesMap := routeManager.GetClientRoutesWithNetID()
+		routes = route.ExpandV6ExitPairs(routes, routesMap)
+		if err := routeSelector.SelectRoutes(routes, true, maps.Keys(routesMap)); err != nil {
+			log.Debugf("error when selecting routes: %s", err)
+			return fmt.Errorf("select routes: %w", err)
+		}
 	}
+	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 	return nil
+
 }
 
 func (c *Client) DeselectRoute(id string) error {
@@ -661,17 +679,21 @@ func (c *Client) DeselectRoute(id string) error {
 	}
 
 	routeManager := engine.GetRouteManager()
+	routeSelector := routeManager.GetRouteSelector()
 	if id == "All" {
 		log.Debugf("deselect all routes")
-		routeManager.DeselectAllRoutes()
-		return nil
-	}
-
-	log.Debugf("deselect route with id: %s", id)
-	if err := routeManager.DeselectRoutes(toNetIDs([]string{id})); err != nil {
-		log.Debugf("error when deselecting routes: %s", err)
-		return err
+		routeSelector.DeselectAllRoutes()
+	} else {
+		log.Debugf("deselect route with id: %s", id)
+		routes := toNetIDs([]string{id})
+		routesMap := routeManager.GetClientRoutesWithNetID()
+		routes = route.ExpandV6ExitPairs(routes, routesMap)
+		if err := routeSelector.DeselectRoutes(routes, maps.Keys(routesMap)); err != nil {
+			log.Debugf("error when deselecting routes: %s", err)
+			return fmt.Errorf("deselect routes: %w", err)
+		}
 	}
+	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 	return nil
 }
 

client/ios/NetBirdSDK/mdm.go

@@ -0,0 +1,82 @@
+//go:build ios
+
+package NetBirdSDK
+
+import (
+	"encoding/json"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/mdm"
+)
+
+// PolicyFetcher is the mobile-side bridge for the MDM managed-config
+// snapshot. The native layer (Swift) implements this and registers
+// the instance per Client via Client.SetMDMPolicyFetcher. Every
+// invocation of fetchJSON must read the current
+// UserDefaults.standard.dictionary(forKey: "com.apple.configuration.managed")
+// and return the result as a JSON-encoded map[string]any string.
+//
+// JSON is used because gomobile does not support map[string]any
+// crossing the Objective-C boundary — the adapter on the Go side
+// parses the string back into the map[string]any expected by
+// mdm.Loader.
+//
+// Return value contract:
+//   - "" (empty)         : interpreted as "no MDM source / no managed keys"
+//   - "{}"               : managed config explicitly empty
+//   - "{...}"            : JSON object with key/value pairs
+//   - malformed JSON     : logged and treated as empty
+type PolicyFetcher interface {
+	FetchJSON() string
+}
+
+// jsonFetcherAdapter wraps a gomobile-exposed PolicyFetcher into the
+// internal mdm.PolicyFetcher interface, taking care of JSON decoding
+// on every Fetch.
+type jsonFetcherAdapter struct {
+	inner PolicyFetcher
+}
+
+func (a *jsonFetcherAdapter) Fetch() map[string]any {
+	raw := a.inner.FetchJSON()
+	if raw == "" {
+		return nil
+	}
+	var out map[string]any
+	if err := json.Unmarshal([]byte(raw), &out); err != nil {
+		log.Warnf("MDM mobile fetcher: invalid JSON payload from native: %v", err)
+		return nil
+	}
+	return out
+}
+
+// SetMDMPolicyFetcher registers the native-provided MDM policy fetcher
+// on this Client. Call once from the gomobile-init code (Swift
+// AppDelegate / PacketTunnelProvider.startTunnel) before invoking Run.
+// Passing nil disables MDM enforcement on this Client.
+//
+// The fetcher is held as a *mdm.Loader instance on the Client (no
+// package-level state) — multiple Clients in the same process get
+// independent Loaders, and tests can inject fakes per Client.
+func (c *Client) SetMDMPolicyFetcher(p PolicyFetcher) {
+	if p == nil {
+		c.mdmLoader = mdm.NewLoader(nil)
+		return
+	}
+	c.mdmLoader = mdm.NewLoader(&jsonFetcherAdapter{inner: p})
+}
+
+// applyMDMOverlay applies the Client-held MDM Loader's current policy
+// on top of the just-read Config. Called immediately after every
+// UpdateOrCreateConfig / DirectUpdateOrCreateConfig — profilemanager's
+// apply() initialises the policy to empty and leaves overlay
+// responsibility to the lifecycle owner. No-op when no fetcher was
+// registered.
+func (c *Client) applyMDMOverlay(cfg *profilemanager.Config) {
+	if cfg == nil || c.mdmLoader == nil {
+		return
+	}
+	cfg.ApplyMDMPolicy(c.mdmLoader.Load())
+}

client/mdm/policy.go

@@ -104,16 +104,48 @@ func NewPolicy(values map[string]any) *Policy {
 	return &Policy{values: values}
 }
 
-// LoadPolicy reads the platform-native MDM configuration. Returns an
-// empty (but non-nil) Policy when no source is present, the source is
-// empty, or the platform is unsupported.
+// PolicyFetcher is implemented by mobile platforms (Android / iOS) that
+// push the OS-managed configuration into the Go runtime instead of
+// having Go read an on-disk source directly. Desktop platforms ignore
+// this interface — Loader.loadPlatform on windows/darwin reads the
+// registry / plist on its own. A Loader constructed with a non-nil
+// fetcher delegates to it on mobile; passing nil disables MDM
+// enforcement (loadPlatform returns nil values).
+type PolicyFetcher interface {
+	Fetch() map[string]any
+}
+
+// Loader is the DI-friendly entry point for reading the active MDM
+// policy. Construct one at the daemon's lifecycle owner (Server on
+// desktop, gomobile-exposed bridge on mobile) and pass it to anything
+// that needs to read MDM state (the reload ticker, profilemanager's
+// Config). Each callsite has the Loader handed in instead of looking
+// up package-level state.
+type Loader struct {
+	fetcher PolicyFetcher
+}
+
+// NewLoader constructs a Loader. The fetcher is consulted only on
+// mobile builds (ios || android); on desktop it is unused but accepted
+// to keep a single constructor signature across platforms — pass nil
+// on desktop.
+func NewLoader(f PolicyFetcher) *Loader {
+	return &Loader{fetcher: f}
+}
+
+// Load reads the platform-native MDM configuration and returns a
+// Policy. Returns an empty (but non-nil) Policy when no source is
+// present, the source is empty, or the platform is unsupported.
 //
 // Diagnostic logging differentiates the three states:
 //   - source absent / unsupported platform: trace log only
 //   - source present, zero keys:             info "MDM enrolled (no managed keys)"
 //   - source present, N keys:                info "MDM enrolled with N managed keys: [...]"
-func LoadPolicy() *Policy {
-	values, err := loadPlatformPolicy()
+func (l *Loader) Load() *Policy {
+	if l == nil {
+		return &Policy{values: map[string]any{}}
+	}
+	values, err := l.loadPlatform()
 	if err != nil {
 		log.Tracef("MDM policy load: %v", err)
 		return &Policy{values: map[string]any{}}

client/mdm/policy_darwin.go

@@ -25,8 +25,10 @@ import (
 // writable plist, as a defense against tampered installs.
 const policyPlistPath = "/Library/Managed Preferences/io.netbird.client.plist"
 
-// loadPlatformPolicy reads the MDM-managed configuration from the macOS
-// managed-preferences plist at policyPlistPath. Returns:
+// loadPlatform reads the MDM-managed configuration from the macOS
+// managed-preferences plist at policyPlistPath. The Loader's fetcher
+// field is unused on this platform — the plist is the authoritative
+// source. Returns:
 //   - (nil, nil)  when the plist is absent (device not MDM-enrolled for
 //     NetBird, or admin has not yet pushed a payload)
 //   - (map, nil)  with N entries when N managed values are present
@@ -39,7 +41,13 @@ const policyPlistPath = "/Library/Managed Preferences/io.netbird.client.plist"
 // skipped so a stray entry in the payload does not block startup.
 // Native plist value types map naturally onto the Policy accessor
 // expectations (GetString / GetBool / GetInt / GetStringSlice).
-func loadPlatformPolicy() (map[string]any, error) {
+func (l *Loader) loadPlatform() (map[string]any, error) {
+	// Honour the injected fetcher when present so tests (and any
+	// future non-macOS MDM channel) can short-circuit the plist read
+	// with a scripted policy.
+	if l != nil && l.fetcher != nil {
+		return l.fetcher.Fetch(), nil
+	}
 	f, err := os.Open(policyPlistPath)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {

client/mdm/policy_mobile.go

@@ -2,13 +2,14 @@
 
 package mdm
 
-// loadPlatformPolicy is unused on mobile: the native layer (Swift on iOS,
-// Kotlin/Java on Android) reads the OS managed-config store and pushes the
-// resulting dictionary in-process via a gomobile entry point that lands in
-// Phase 5 / Phase 6. The stub keeps the package compilable for mobile
-// builds and returns (nil, nil) — the platform-absent sentinel that
-// LoadPolicy in policy.go treats as "no MDM source present".
-func loadPlatformPolicy() (map[string]any, error) {
-	//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
-	return nil, nil
+// loadPlatform reads the OS-managed configuration via the native
+// PolicyFetcher injected at Loader construction. Returns
+// (nil, nil) — the platform-absent sentinel that Loader.Load treats as
+// "no MDM source present" — when no fetcher was provided.
+func (l *Loader) loadPlatform() (map[string]any, error) {
+	if l == nil || l.fetcher == nil {
+		//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see Loader.Load.
+		return nil, nil
+	}
+	return l.fetcher.Fetch(), nil
 }

client/mdm/policy_other.go

@@ -2,13 +2,17 @@
 
 package mdm
 
-// loadPlatformPolicy returns no policy on platforms without an MDM channel
-// (Linux, FreeBSD). MDM enforcement is off and the client behaves as if
-// the feature did not exist. Returns (nil, nil) — the platform-absent
-// sentinel the caller (LoadPolicy in policy.go) treats as "no MDM
-// source present"; an error here would just translate to the same
-// outcome with an extra log line.
-func loadPlatformPolicy() (map[string]any, error) {
-	//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
+// loadPlatform reads the MDM policy on platforms without a native MDM
+// channel (Linux, FreeBSD). When no fetcher was injected the policy is
+// (nil, nil) — the platform-absent sentinel that Loader.Load treats as
+// "MDM enforcement disabled". A non-nil fetcher takes precedence: it
+// is the test-seam used by unit tests to inject a scripted policy
+// without touching the OS, and the same hook supports any future
+// non-mobile OS that grows an out-of-band MDM channel.
+func (l *Loader) loadPlatform() (map[string]any, error) {
+	if l != nil && l.fetcher != nil {
+		return l.fetcher.Fetch(), nil
+	}
+	//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see Loader.Load.
 	return nil, nil
 }

client/mdm/policy_test.go

@@ -155,10 +155,12 @@ func TestPolicy_GetStringSlice(t *testing.T) {
 	})
 }
 
-func TestLoadPolicy_PlatformStubReturnsEmpty(t *testing.T) {
-	// loadPlatformPolicy is a stub on every OS for Phase 1. LoadPolicy must
-	// degrade gracefully and never return nil.
-	p := LoadPolicy()
+func TestLoader_NilFetcherReturnsEmpty(t *testing.T) {
+	// Loader.Load with no fetcher (desktop construction) must degrade
+	// gracefully and never return nil; on linux loadPlatform is a stub
+	// returning (nil, nil), and Load is expected to translate that
+	// into a non-nil empty Policy.
+	p := NewLoader(nil).Load()
 	require.NotNil(t, p)
 	assert.True(t, p.IsEmpty())
 	assert.Empty(t, p.ManagedKeys())

client/mdm/policy_windows.go

@@ -61,8 +61,10 @@ func readRegistryValue(k registry.Key, name, canonical string, out map[string]an
 	}
 }
 
-// loadPlatformPolicy reads the MDM-managed configuration from the
-// Windows registry under HKLM\Software\Policies\NetBird. Returns:
+// loadPlatform reads the MDM-managed configuration from the Windows
+// registry under HKLM\Software\Policies\NetBird. The Loader's fetcher
+// field is unused on this platform — the registry is the
+// authoritative source. Returns:
 //   - (nil, nil)  when the key is absent (device not MDM-enrolled for NetBird)
 //   - (map, nil)  with N entries when N managed values are set (N may be 0)
 //   - (nil, err)  on open / enumerate registry errors
@@ -70,7 +72,13 @@ func readRegistryValue(k registry.Key, name, canonical string, out map[string]an
 // Per-value type coercion + skip-on-error is delegated to
 // readRegistryValue. Unknown value names are logged and skipped so a
 // malformed deployment does not block startup.
-func loadPlatformPolicy() (map[string]any, error) {
+func (l *Loader) loadPlatform() (map[string]any, error) {
+	// Honour the injected fetcher when present so tests (and any
+	// future non-Windows MDM channel) can short-circuit the registry
+	// read with a scripted policy.
+	if l != nil && l.fetcher != nil {
+		return l.fetcher.Fetch(), nil
+	}
 	k, err := registry.OpenKey(registry.LOCAL_MACHINE, policyRegistryPath, registry.QUERY_VALUE)
 	if err != nil {
 		if errors.Is(err, registry.ErrNotExist) {

client/mdm/ticker.go

@@ -15,33 +15,33 @@ import (
 // instead, hence anticipating the ticker mechanism entirely.
 const DefaultReloadInterval = 1 * time.Minute
 
-// policyLoader is the indirection through which the ticker reads the
-// OS-native policy, both for the initial observation and on every tick.
-// Production points it at LoadPolicy; tests in this package override it to
-// feed a scripted sequence of policies without touching the real OS store.
-var policyLoader = LoadPolicy
-
-// Ticker periodically re-reads the OS-native MDM policy via LoadPolicy and
-// invokes the onChange callback (supplied to Run) whenever the observed
-// Policy diverges from the last observation (added / removed / changed
-// keys). Launch with Run from a goroutine; cancel the supplied context
-// to stop.
+// Ticker periodically re-reads the OS-native MDM policy via the
+// injected Loader and invokes the onChange callback (supplied to Run)
+// whenever the observed Policy diverges from the last observation
+// (added / removed / changed keys). Launch with Run from a goroutine;
+// cancel the supplied context to stop.
 type Ticker struct {
 	interval time.Duration
+	loader   *Loader
 	prev     *Policy
 }
 
 // NewTicker constructs a Ticker that will re-read the OS-native policy
-// every reloadInterval once Run is called.
-// The initial snapshot is populated by calling policyLoader at
+// every reloadInterval once Run is called. The Loader is injected so
+// the ticker doesn't depend on any package-level state — production
+// passes the daemon-owned Loader, tests pass a fake Loader (built with
+// a fake PolicyFetcher).
+//
+// The initial snapshot is populated by calling loader.Load() at
 // construction time so the first tick only fires
 // onChange when the policy actually changed since boot — without
 // this baseline the first tick would report every currently-managed
 // key as "added" and trigger a spurious engine restart.
-func NewTicker(reloadInterval time.Duration) *Ticker {
+func NewTicker(reloadInterval time.Duration, loader *Loader) *Ticker {
 	return &Ticker{
 		interval: reloadInterval,
-		prev:     policyLoader(),
+		loader:   loader,
+		prev:     loader.Load(),
 	}
 }
 
@@ -58,7 +58,7 @@ func (t *Ticker) Run(ctx context.Context, onChange func(prev, curr *Policy) erro
 			log.Info("MDM policy reload ticker stopped")
 			return
 		case <-tk.C:
-			curr := policyLoader()
+			curr := t.loader.Load()
 			if policiesEqual(t.prev, curr) {
 				continue
 			}

client/mdm/ticker_test.go

@@ -13,28 +13,40 @@ import (
 // testReloadInterval for speeding up the ticker cadence under `go test`
 const testReloadInterval = 1 * time.Second
 
-// withPolicyLoader overrides the package-level policyLoader for the duration
-// of the test so the ticker observes a scripted policy instead of the real
-// OS-native store. The original loader is restored on cleanup.
-func withPolicyLoader(t *testing.T, fn func() *Policy) {
-	t.Helper()
-	prev := policyLoader
-	policyLoader = fn
-	t.Cleanup(func() { policyLoader = prev })
+// fakePolicyFetcher implements PolicyFetcher returning a scripted
+// policy map. Goroutine-safe so the test can mutate the script while
+// the ticker is observing it.
+type fakePolicyFetcher struct {
+	mu     sync.Mutex
+	values map[string]any
+}
+
+func (f *fakePolicyFetcher) Fetch() map[string]any {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.values == nil {
+		return nil
+	}
+	out := make(map[string]any, len(f.values))
+	for k, v := range f.values {
+		out[k] = v
+	}
+	return out
+}
+
+func (f *fakePolicyFetcher) set(values map[string]any) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.values = values
 }
 
 func TestTicker_FiresOnChangeWithDelta(t *testing.T) {
-	var mu sync.Mutex
-	current := NewPolicy(nil) // initial observation: empty (no enforcement)
-	withPolicyLoader(t, func() *Policy {
-		mu.Lock()
-		defer mu.Unlock()
-		return current
-	})
+	fetcher := &fakePolicyFetcher{} // initial observation: empty (no enforcement)
+	loader := NewLoader(fetcher)
 
 	type change struct{ prev, curr *Policy }
 	changes := make(chan change, 1)
-	tk := NewTicker(testReloadInterval)
+	tk := NewTicker(testReloadInterval, loader)
 	require.Equal(t, testReloadInterval, tk.interval)
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -49,15 +61,13 @@ func TestTicker_FiresOnChangeWithDelta(t *testing.T) {
 		})
 		close(done)
 	}()
-	// Stop Run and wait for it to exit before returning, so the policyLoader
-	// restore in t.Cleanup can't race the ticker goroutine still reading it.
+	// Stop Run and wait for it to exit before returning, so the test
+	// goroutine doesn't race the still-running ticker.
 	defer func() { cancel(); <-done }()
 
-	// Flip the OS-observed policy from empty to one managed key. The next
-	// tick must detect the diff and invoke onChange.
-	mu.Lock()
-	current = NewPolicy(map[string]any{KeyManagementURL: "https://mdm.example.com:443"})
-	mu.Unlock()
+	// Flip the OS-observed policy from empty to one managed key. The
+	// next tick must detect the diff and invoke onChange.
+	fetcher.set(map[string]any{KeyManagementURL: "https://mdm.example.com:443"})
 
 	select {
 	case c := <-changes:
@@ -69,12 +79,11 @@ func TestTicker_FiresOnChangeWithDelta(t *testing.T) {
 }
 
 func TestTicker_NoCallbackWhenPolicyUnchanged(t *testing.T) {
-	withPolicyLoader(t, func() *Policy {
-		return NewPolicy(map[string]any{KeyBlockInbound: true})
-	})
+	fetcher := &fakePolicyFetcher{values: map[string]any{KeyBlockInbound: true}}
+	loader := NewLoader(fetcher)
 
 	fired := make(chan struct{}, 1)
-	tk := NewTicker(testReloadInterval)
+	tk := NewTicker(testReloadInterval, loader)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	done := make(chan struct{})
@@ -90,8 +99,8 @@ func TestTicker_NoCallbackWhenPolicyUnchanged(t *testing.T) {
 	}()
 	defer func() { cancel(); <-done }()
 
-	// Over ~2 ticks at the 1s test cadence the policy never changes, so the
-	// diff guard must suppress the callback entirely.
+	// Over ~2 ticks at the 1s test cadence the policy never changes,
+	// so the diff guard must suppress the callback entirely.
 	select {
 	case <-fired:
 		t.Fatal("onChange fired despite an unchanged policy")

client/server/mdm.go

@@ -21,10 +21,6 @@ import (
 // a no-op echo, never as a conflict with the policy.
 const preSharedKeyRedactedSentinel = "**********"
 
-// loadMDMPolicy is the indirection used by server handlers to read the
-// active MDM policy. Tests override this to inject a fake policy.
-var loadMDMPolicy = mdm.LoadPolicy
-
 // conflictCheck is a value-aware comparison between a single field in
 // the incoming request and the corresponding MDM-enforced value. It
 // runs only when the field was actually set in the request (presence

client/server/network.go

@@ -8,6 +8,7 @@ import (
 	"sort"
 	"strings"
 
+	"golang.org/x/exp/maps"
 	"google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"
 
@@ -160,11 +161,30 @@ func (s *Server) SelectNetworks(_ context.Context, req *proto.SelectNetworksRequ
 		return nil, fmt.Errorf("no route manager")
 	}
 
+	routeSelector := routeManager.GetRouteSelector()
 	if req.GetAll() {
-		routeManager.SelectAllRoutes()
-	} else if err := routeManager.SelectRoutes(toNetIDs(req.GetNetworkIDs()), req.GetAppend()); err != nil {
-		return nil, err
+		routeSelector.SelectAllRoutes()
+	} else {
+		routes := toNetIDs(req.GetNetworkIDs())
+		routesMap := routeManager.GetClientRoutesWithNetID()
+		routes = route.ExpandV6ExitPairs(routes, routesMap)
+		netIdRoutes := maps.Keys(routesMap)
+		if err := routeSelector.SelectRoutes(routes, req.GetAppend(), netIdRoutes); err != nil {
+			return nil, fmt.Errorf("select routes: %w", err)
+		}
+
+		// Exit nodes are mutually exclusive: if this selection activates an
+		// exit node, deselect every other available exit node so two can't be
+		// selected at once. Non-exit route selections are left untouched.
+		if requestActivatesExitNode(routes, routesMap) {
+			if others := otherExitNodeIDs(routesMap, routes); len(others) > 0 {
+				if err := routeSelector.DeselectRoutes(others, netIdRoutes); err != nil {
+					return nil, fmt.Errorf("deselect sibling exit nodes: %w", err)
+				}
+			}
+		}
 	}
+	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 
 	s.statusRecorder.PublishEvent(
 		proto.SystemEvent_INFO,
@@ -204,11 +224,19 @@ func (s *Server) DeselectNetworks(_ context.Context, req *proto.SelectNetworksRe
 		return nil, fmt.Errorf("no route manager")
 	}
 
+	routeSelector := routeManager.GetRouteSelector()
 	if req.GetAll() {
-		routeManager.DeselectAllRoutes()
-	} else if err := routeManager.DeselectRoutes(toNetIDs(req.GetNetworkIDs())); err != nil {
-		return nil, err
+		routeSelector.DeselectAllRoutes()
+	} else {
+		routes := toNetIDs(req.GetNetworkIDs())
+		routesMap := routeManager.GetClientRoutesWithNetID()
+		routes = route.ExpandV6ExitPairs(routes, routesMap)
+		netIdRoutes := maps.Keys(routesMap)
+		if err := routeSelector.DeselectRoutes(routes, netIdRoutes); err != nil {
+			return nil, fmt.Errorf("deselect routes: %w", err)
+		}
 	}
+	routeManager.TriggerSelection(routeManager.GetClientRoutes())
 
 	s.statusRecorder.PublishEvent(
 		proto.SystemEvent_INFO,
@@ -233,3 +261,37 @@ func toNetIDs(routes []string) []route.NetID {
 	return netIDs
 }
 
+func isExitNodeRoutes(routes []*route.Route) bool {
+	return len(routes) > 0 && (route.IsV4DefaultRoute(routes[0].Network) || route.IsV6DefaultRoute(routes[0].Network))
+}
+
+// requestActivatesExitNode reports whether any requested NetID maps to an exit
+// node (default route) in the current route table.
+func requestActivatesExitNode(requested []route.NetID, routesMap map[route.NetID][]*route.Route) bool {
+	for _, id := range requested {
+		if isExitNodeRoutes(routesMap[id]) {
+			return true
+		}
+	}
+	return false
+}
+
+// otherExitNodeIDs returns every available exit-node NetID that is not in the
+// requested set — the siblings to deselect so a single exit node stays active.
+func otherExitNodeIDs(routesMap map[route.NetID][]*route.Route, requested []route.NetID) []route.NetID {
+	keep := make(map[route.NetID]struct{}, len(requested))
+	for _, id := range requested {
+		keep[id] = struct{}{}
+	}
+	var others []route.NetID
+	for id, routes := range routesMap {
+		if !isExitNodeRoutes(routes) {
+			continue
+		}
+		if _, ok := keep[id]; ok {
+			continue
+		}
+		others = append(others, id)
+	}
+	return others
+}

client/server/network_exitnode_test.go

@@ -0,0 +1,26 @@
+package server
+
+import (
+	"net/netip"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/route"
+)
+
+func TestExitNodeSelectionHelpers(t *testing.T) {
+	routesMap := map[route.NetID][]*route.Route{
+		"exitA": {{Network: netip.MustParsePrefix("0.0.0.0/0")}},
+		"exitB": {{Network: netip.MustParsePrefix("::/0")}},
+		"lan":   {{Network: netip.MustParsePrefix("192.168.0.0/16")}},
+	}
+
+	assert.True(t, requestActivatesExitNode([]route.NetID{"exitA"}, routesMap), "v4 default route is an exit node")
+	assert.True(t, requestActivatesExitNode([]route.NetID{"exitB"}, routesMap), "v6 default route is an exit node")
+	assert.False(t, requestActivatesExitNode([]route.NetID{"lan"}, routesMap), "lan route is not an exit node")
+	assert.False(t, requestActivatesExitNode([]route.NetID{"missing"}, routesMap), "unknown id is not an exit node")
+
+	others := otherExitNodeIDs(routesMap, []route.NetID{"exitB"})
+	assert.ElementsMatch(t, []route.NetID{"exitA"}, others, "only the other exit node is a sibling; the lan route is ignored")
+}

client/server/server.go

@@ -123,6 +123,15 @@ type Server struct {
 	// stopped by the rootCtx cancellation.
 	mdmTicker *mdm.Ticker
 
+	// mdmLoader is the daemon-owned source of the active MDM policy.
+	// Constructed once during Server.Start (with a nil PolicyFetcher on
+	// desktop — the build-tagged Loader.loadPlatform reads the OS
+	// registry / plist directly) and injected into every consumer:
+	// mdmTicker for its periodic reload, the SetConfig / Login MDM
+	// gates for conflict detection, and every Config produced via
+	// getConfig() so its apply() picks up the same overlay.
+	mdmLoader *mdm.Loader
+
 	updateManager *updater.Manager
 
 	jwtCache *jwtCache
@@ -197,8 +206,14 @@ func (s *Server) Start() error {
 	// Runs re-resolves Config (re-running profilemanager.Config.apply which
 	// applies the freshly-read MDM policy as the last layer) and brings
 	// the engine back with the new values.
+	if s.mdmLoader == nil {
+		// Desktop builds pass a nil PolicyFetcher: the Loader's
+		// build-tagged loadPlatform reads the OS source directly
+		// (registry on Windows, plist on macOS, no-op elsewhere).
+		s.mdmLoader = mdm.NewLoader(nil)
+	}
 	if s.mdmTicker == nil {
-		s.mdmTicker = mdm.NewTicker(mdm.DefaultReloadInterval)
+		s.mdmTicker = mdm.NewTicker(mdm.DefaultReloadInterval, s.mdmLoader)
 		go s.mdmTicker.Run(s.rootCtx, s.onMDMPolicyChange)
 	}
 
@@ -406,7 +421,7 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 	// by the active MDM policy. The error carries an MDMManagedFields-
 	// Violation detail listing the offending key names. Non-conflicting
 	// fields in the same request are not applied either.
-	policy := loadMDMPolicy()
+	policy := s.mdmLoader.Load()
 	if err := rejectMDMManagedFieldConflicts(mdmManagedFieldConflicts(msg, policy)); err != nil {
 		return nil, err
 	}
@@ -531,7 +546,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		if s.checkUpdateSettingsDisabled() {
 			return nil, gstatus.Errorf(codes.Unavailable, errUpdateSettingsDisabled)
 		}
-		policy := loadMDMPolicy()
+		policy := s.mdmLoader.Load()
 		if err := rejectMDMManagedFieldConflicts(loginRequestMDMConflicts(msg, policy)); err != nil {
 			return nil, err
 		}
@@ -1260,6 +1275,12 @@ func (s *Server) getConfig(activeProf *profilemanager.ActiveProfileState) (*prof
 		return nil, false, fmt.Errorf("failed to get config: %w", err)
 	}
 
+	// Apply the daemon-owned MDM policy on top of the just-resolved
+	// Config. profilemanager's apply() initialises the policy to
+	// empty — the Loader lives outside Config, so this overlay step
+	// is driven externally here.
+	config.ApplyMDMPolicy(s.mdmLoader.Load())
+
 	return config, configExisted, nil
 }
 
@@ -1309,6 +1330,9 @@ func (s *Server) logoutFromProfile(ctx context.Context, profile *profilemanager.
 	if err != nil {
 		return fmt.Errorf("profile '%s' not found", profile.ID)
 	}
+	// Honour any MDM-enforced ManagementURL when issuing the logout
+	// RPC: the user-stored value may have been overridden by policy.
+	config.ApplyMDMPolicy(s.mdmLoader.Load())
 
 	return s.sendLogoutRequestWithConfig(ctx, config)
 }
@@ -1909,6 +1933,11 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		log.Errorf("failed to get active profile config: %v", err)
 		return nil, fmt.Errorf("failed to get active profile config: %w", err)
 	}
+	// Overlay the active MDM policy so the response's MDMManagedFields
+	// list reflects what the GUI / CLI must render as read-only.
+	// profilemanager.GetConfig itself returns a Config without the
+	// overlay (Loader lives outside profilemanager).
+	cfg.ApplyMDMPolicy(s.mdmLoader.Load())
 	managementURL := cfg.ManagementURL
 	adminURL := cfg.AdminURL
 

client/server/setconfig_mdm_test.go

@@ -16,14 +16,40 @@ import (
 	"github.com/netbirdio/netbird/client/proto"
 )
 
-// withMDMPolicy temporarily overrides the server-package loadMDMPolicy hook
-// so SetConfig observes the supplied Policy. Restores the original loader
-// at test cleanup.
-func withMDMPolicy(t *testing.T, policy *mdm.Policy) {
+// fakeMDMFetcher implements mdm.PolicyFetcher returning a pre-set
+// policy map. Tests build one per Server instance to inject a
+// scripted MDM overlay via a Loader rather than via package-level state.
+type fakeMDMFetcher struct{ values map[string]any }
+
+func (f *fakeMDMFetcher) Fetch() map[string]any { return f.values }
+
+// withMDMPolicy installs an mdm.Loader on the given Server whose
+// loadPlatform returns the supplied Policy's underlying values. Use
+// after setupServerWithProfile to inject the scripted policy the
+// SetConfig / Login MDM gates will observe.
+func withMDMPolicy(t *testing.T, s *Server, policy *mdm.Policy) {
 	t.Helper()
-	prev := loadMDMPolicy
-	loadMDMPolicy = func() *mdm.Policy { return policy }
-	t.Cleanup(func() { loadMDMPolicy = prev })
+	values := map[string]any{}
+	if policy != nil {
+		for _, k := range policy.ManagedKeys() {
+			if v, ok := policy.GetString(k); ok {
+				values[k] = v
+				continue
+			}
+			if v, ok := policy.GetBool(k); ok {
+				values[k] = v
+				continue
+			}
+			if v, ok := policy.GetInt(k); ok {
+				values[k] = v
+				continue
+			}
+			if v, ok := policy.GetStringSlice(k); ok {
+				values[k] = v
+			}
+		}
+	}
+	s.mdmLoader = mdm.NewLoader(&fakeMDMFetcher{values: values})
 }
 
 // setupServerWithProfile mirrors the boilerplate of TestSetConfig_AllFieldsSaved:
@@ -89,12 +115,11 @@ func extractViolation(t *testing.T, err error) *proto.MDMManagedFieldsViolation
 }
 
 func TestSetConfig_MDMReject_SingleField(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL: "https://mdm.example.com:443",
 	}))
 
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:   profName,
 		Username:      username,
@@ -106,14 +131,13 @@ func TestSetConfig_MDMReject_SingleField(t *testing.T) {
 }
 
 func TestSetConfig_MDMReject_MultipleFields(t *testing.T) {
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL:    "https://mdm.example.com:443",
 		mdm.KeyBlockInbound:     true,
 		mdm.KeyRosenpassEnabled: true,
 	}))
 
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 	blockInbound := false
 	rosenpassEnabled := false
 	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
@@ -137,12 +161,11 @@ func TestSetConfig_MDMReject_AllOrNothing(t *testing.T) {
 	// enforced field AND a non-enforced field (RosenpassEnabled).
 	// The whole request must be rejected — non-conflicting fields are not
 	// applied either.
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL: "https://mdm.example.com:443",
 	}))
 
-	s, ctx, profName, username, cfgPath := setupServerWithProfile(t)
-
 	rosenpassEnabled := true
 	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:      profName,
@@ -164,12 +187,11 @@ func TestSetConfig_MDMReject_AllOrNothing(t *testing.T) {
 func TestSetConfig_MDMAllow_NonManagedFields(t *testing.T) {
 	// MDM enforces ManagementURL but the user only writes RosenpassEnabled.
 	// Request must succeed.
-	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL: "https://mdm.example.com:443",
 	}))
 
-	s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 	rosenpassEnabled := true
 	resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:      profName,
@@ -198,12 +220,11 @@ func TestSetConfig_MDMAllow_ManagementURLPortNormalized(t *testing.T) {
 
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
-			withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+			s, ctx, profName, username, _ := setupServerWithProfile(t)
+			withMDMPolicy(t, s, mdm.NewPolicy(map[string]any{
 				mdm.KeyManagementURL: tc.mdmURL,
 			}))
 
-			s, ctx, profName, username, _ := setupServerWithProfile(t)
-
 			rosenpassEnabled := true
 			resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 				ProfileName:      profName,
@@ -220,9 +241,8 @@ func TestSetConfig_MDMAllow_ManagementURLPortNormalized(t *testing.T) {
 
 func TestSetConfig_MDMEmpty_NoEnforcement(t *testing.T) {
 	// No MDM policy active: any field can be written.
-	withMDMPolicy(t, mdm.NewPolicy(nil))
-
 	s, ctx, profName, username, _ := setupServerWithProfile(t)
+	withMDMPolicy(t, s, mdm.NewPolicy(nil))
 
 	resp, err := s.SetConfig(ctx, &proto.SetConfigRequest{
 		ProfileName:   profName,

client/ui/main.go

@@ -14,6 +14,7 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/application"
 	"github.com/wailsapp/wails/v3/pkg/events"
+	"github.com/wailsapp/wails/v3/pkg/services/notifications"
 
 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
@@ -62,7 +63,7 @@ type registeredServices struct {
 	profiles        *services.Profiles
 	update          *services.Update
 	daemonFeed      *services.DaemonFeed
-	notifier        *Notifier
+	notifier        *notifications.NotificationService
 	compat          *services.Compat
 	profileSwitcher *services.ProfileSwitcher
 	bundle          *i18n.Bundle
@@ -102,7 +103,7 @@ func main() {
 	updaterHolder := updater.NewHolder(app.Event)
 	update := services.NewUpdate(conn, updaterHolder)
 	daemonFeed := services.NewDaemonFeed(conn, app.Event, updaterHolder, debugLog)
-	notifier := newNotifier()
+	notifier := notifications.New()
 	compat := services.NewCompat(conn)
 	// macOS shows no toast until permission is requested. Run it after
 	// ApplicationStarted so the notifier's Startup has initialised the
@@ -209,7 +210,7 @@ func main() {
 // requestNotificationAuthorization prompts for macOS notification permission.
 // The request blocks until the user responds (up to 3 minutes), so callers run
 // it in a goroutine. No-op on Linux/Windows.
-func requestNotificationAuthorization(notifier *Notifier) {
+func requestNotificationAuthorization(notifier *notifications.NotificationService) {
 	authorized, err := notifier.CheckNotificationAuthorization()
 	if err != nil {
 		logrus.Debugf("check notification authorization: %v", err)

client/ui/notifier.go

@@ -1,101 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"context"
-	"errors"
-	"sync/atomic"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/wailsapp/wails/v3/pkg/application"
-	"github.com/wailsapp/wails/v3/pkg/services/notifications"
-)
-
-var errNotificationsUnavailable = errors.New("notifications unavailable")
-
-// Notifier wraps the Wails notification service so an unavailable backend
-// disables notifications instead of aborting the app. Startup fails for
-// environment reasons (a bare unbundled binary on macOS has no bundle
-// identifier, a headless Linux session has no D-Bus session bus), and Wails
-// treats a service startup error as fatal. After a failed startup every call
-// is a no-op: on macOS, touching UNUserNotificationCenter without a bundle
-// identifier raises an Objective-C exception that recover() cannot catch.
-type Notifier struct {
-	inner     *notifications.NotificationService
-	available atomic.Bool
-}
-
-func newNotifier() *Notifier {
-	return &Notifier{inner: notifications.New()}
-}
-
-// ServiceName implements the Wails service-name hook for startup logs.
-func (n *Notifier) ServiceName() string {
-	return n.inner.ServiceName()
-}
-
-// ServiceStartup starts the platform notifier, downgrading failure to a
-// warning so the app keeps running without notifications.
-func (n *Notifier) ServiceStartup(ctx context.Context, options application.ServiceOptions) error {
-	if err := n.inner.ServiceStartup(ctx, options); err != nil {
-		log.Warnf("notifications disabled: %v", err)
-		return nil
-	}
-	n.available.Store(true)
-	return nil
-}
-
-func (n *Notifier) ServiceShutdown() error {
-	if !n.available.Load() {
-		return nil
-	}
-	return n.inner.ServiceShutdown()
-}
-
-func (n *Notifier) CheckNotificationAuthorization() (bool, error) {
-	if !n.available.Load() {
-		return false, errNotificationsUnavailable
-	}
-	return n.inner.CheckNotificationAuthorization()
-}
-
-func (n *Notifier) RequestNotificationAuthorization() (bool, error) {
-	if !n.available.Load() {
-		return false, errNotificationsUnavailable
-	}
-	return n.inner.RequestNotificationAuthorization()
-}
-
-// SendNotification delivers a notification, silently dropping it when the
-// backend never started (notifications are best-effort everywhere).
-func (n *Notifier) SendNotification(options notifications.NotificationOptions) error {
-	if !n.available.Load() {
-		log.Debugf("notifications disabled, dropping %q", options.ID)
-		return nil
-	}
-	return n.inner.SendNotification(options)
-}
-
-func (n *Notifier) SendNotificationWithActions(options notifications.NotificationOptions) error {
-	if !n.available.Load() {
-		log.Debugf("notifications disabled, dropping %q", options.ID)
-		return nil
-	}
-	return n.inner.SendNotificationWithActions(options)
-}
-
-func (n *Notifier) RegisterNotificationCategory(category notifications.NotificationCategory) error {
-	if !n.available.Load() {
-		return nil
-	}
-	return n.inner.RegisterNotificationCategory(category)
-}
-
-// OnNotificationResponse registers the response callback. Pure Go state, so
-// it is safe (and simply inert) when the backend never started.
-//
-//wails:ignore
-func (n *Notifier) OnNotificationResponse(callback func(result notifications.NotificationResult)) {
-	n.inner.OnNotificationResponse(callback)
-}

client/ui/tray.go

@@ -44,7 +44,7 @@ type TrayServices struct {
 	Profiles        *services.Profiles
 	Networks        *services.Networks
 	DaemonFeed      *services.DaemonFeed
-	Notifier        *Notifier
+	Notifier        *notifications.NotificationService
 	Update          *services.Update
 	ProfileSwitcher *services.ProfileSwitcher
 	WindowManager   *services.WindowManager

client/ui/tray_notify.go

@@ -44,7 +44,7 @@ func safeSendNotification(send sendFn, what string, opts notifications.Notificat
 // notifyIfDaemonOutdated probes the daemon once and fires an OS toast when it
 // is reachable but too old for this UI. A probe error means the daemon isn't
 // reachable (not outdated), so it is left to the normal connection flow.
-func notifyIfDaemonOutdated(compat *services.Compat, notifier *Notifier, loc *Localizer) {
+func notifyIfDaemonOutdated(compat *services.Compat, notifier *notifications.NotificationService, loc *Localizer) {
 	ready, err := compat.DaemonReady(context.Background())
 	if err != nil {
 		log.Debugf("daemon compatibility probe: %v", err)

client/ui/tray_update.go

@@ -21,7 +21,7 @@ type trayUpdater struct {
 	app          *application.App
 	window       *application.WebviewWindow
 	update       *services.Update
-	notifier     *Notifier
+	notifier     *notifications.NotificationService
 	loc          *Localizer
 	onIconChange func()
 	// onMenuChange drives a full tray relayout: the update row lives in the
@@ -36,7 +36,7 @@ type trayUpdater struct {
 	progressWindowOpen bool
 }
 
-func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
+func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *notifications.NotificationService, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
 	u := &trayUpdater{
 		app:          app,
 		window:       window,

infrastructure_files/getting-started-with-dex.sh

@@ -1,19 +1,557 @@
-#!/usr/bin/env bash
+#!/bin/bash
 
-cat >&2 <<'EOF'
-ERROR: This legacy installation script has been retired and no longer runs.
+set -e
 
-Dex support is not deprecated. For new deployments, use getting-started.sh:
+# NetBird Getting Started with Dex IDP
+# This script sets up NetBird with Dex as the identity provider
 
-https://docs.netbird.io/selfhosted/selfhosted-quickstart
+# Sed pattern to strip base64 padding characters
+SED_STRIP_PADDING='s/=//g'
 
-The current installer includes NetBird's embedded Dex-based identity provider.
-Local users and external identity providers can be managed through the
-NetBird Dashboard:
+check_docker_compose() {
+  if command -v docker-compose &> /dev/null
+  then
+      echo "docker-compose"
+      return
+  fi
+  if docker compose --help &> /dev/null
+  then
+      echo "docker compose"
+      return
+  fi
 
-https://docs.netbird.io/selfhosted/identity-providers/local
+  echo "docker-compose is not installed or not in PATH. Please follow the steps from the official guide: https://docs.docker.com/engine/install/" > /dev/stderr
+  exit 1
+}
 
-This compatibility notice will be removed in NetBird v0.80.
+check_jq() {
+  if ! command -v jq &> /dev/null
+  then
+    echo "jq is not installed or not in PATH, please install with your package manager. e.g. sudo apt install jq" > /dev/stderr
+    exit 1
+  fi
+  return 0
+}
+
+get_main_ip_address() {
+  if [[ "$OSTYPE" == "darwin"* ]]; then
+    interface=$(route -n get default | grep 'interface:' | awk '{print $2}')
+    ip_address=$(ifconfig "$interface" | grep 'inet ' | awk '{print $2}')
+  else
+    interface=$(ip route | grep default | awk '{print $5}' | head -n 1)
+    ip_address=$(ip addr show "$interface" | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)
+  fi
+
+  echo "$ip_address"
+  return 0
+}
+
+check_nb_domain() {
+  DOMAIN=$1
+  if [[ "$DOMAIN-x" == "-x" ]]; then
+    echo "The NETBIRD_DOMAIN variable cannot be empty." > /dev/stderr
+    return 1
+  fi
+
+  if [[ "$DOMAIN" == "netbird.example.com" ]]; then
+    echo "The NETBIRD_DOMAIN cannot be netbird.example.com" > /dev/stderr
+    return 1
+  fi
+  return 0
+}
+
+read_nb_domain() {
+  READ_NETBIRD_DOMAIN=""
+  echo -n "Enter the domain you want to use for NetBird (e.g. netbird.my-domain.com): " > /dev/stderr
+  read -r READ_NETBIRD_DOMAIN < /dev/tty
+  if ! check_nb_domain "$READ_NETBIRD_DOMAIN"; then
+    read_nb_domain
+  fi
+  echo "$READ_NETBIRD_DOMAIN"
+  return 0
+}
+
+get_turn_external_ip() {
+  TURN_EXTERNAL_IP_CONFIG="#external-ip="
+  IP=$(curl -s -4 https://jsonip.com | jq -r '.ip')
+  if [[ "x-$IP" != "x-" ]]; then
+    TURN_EXTERNAL_IP_CONFIG="external-ip=$IP"
+  fi
+  echo "$TURN_EXTERNAL_IP_CONFIG"
+  return 0
+}
+
+wait_dex() {
+  set +e
+  echo -n "Waiting for Dex to become ready (via $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN)"
+  counter=1
+  while true; do
+    # Check Dex through Caddy proxy (also validates TLS is working)
+    if curl -sk -f -o /dev/null "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/.well-known/openid-configuration" 2>/dev/null; then
+      break
+    fi
+    if [[ $counter -eq 60 ]]; then
+      echo ""
+      echo "Taking too long. Checking logs..."
+      $DOCKER_COMPOSE_COMMAND logs --tail=20 caddy
+      $DOCKER_COMPOSE_COMMAND logs --tail=20 dex
+    fi
+    echo -n " ."
+    sleep 2
+    counter=$((counter + 1))
+  done
+  echo " done"
+  set -e
+  return 0
+}
+
+init_environment() {
+  CADDY_SECURE_DOMAIN=""
+  NETBIRD_PORT=80
+  NETBIRD_HTTP_PROTOCOL="http"
+  NETBIRD_RELAY_PROTO="rel"
+  TURN_USER="self"
+  TURN_PASSWORD=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
+  NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
+  TURN_MIN_PORT=49152
+  TURN_MAX_PORT=65535
+  TURN_EXTERNAL_IP_CONFIG=$(get_turn_external_ip)
+
+  # Generate secrets for Dex
+  DEX_DASHBOARD_CLIENT_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
+
+  # Generate admin password
+  NETBIRD_ADMIN_PASSWORD=$(openssl rand -base64 16 | sed "$SED_STRIP_PADDING")
+
+  if ! check_nb_domain "$NETBIRD_DOMAIN"; then
+    NETBIRD_DOMAIN=$(read_nb_domain)
+  fi
+
+  if [[ "$NETBIRD_DOMAIN" == "use-ip" ]]; then
+    NETBIRD_DOMAIN=$(get_main_ip_address)
+  else
+    NETBIRD_PORT=443
+    CADDY_SECURE_DOMAIN=", $NETBIRD_DOMAIN:$NETBIRD_PORT"
+    NETBIRD_HTTP_PROTOCOL="https"
+    NETBIRD_RELAY_PROTO="rels"
+  fi
+
+  check_jq
+
+  DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
+
+  if [[ -f dex.yaml ]]; then
+    echo "Generated files already exist, if you want to reinitialize the environment, please remove them first."
+    echo "You can use the following commands:"
+    echo "  $DOCKER_COMPOSE_COMMAND down --volumes # to remove all containers and volumes"
+    echo "  rm -f docker-compose.yml Caddyfile dex.yaml dashboard.env turnserver.conf management.json relay.env"
+    echo "Be aware that this will remove all data from the database, and you will have to reconfigure the dashboard."
+    exit 1
+  fi
+
+  echo Rendering initial files...
+  render_docker_compose > docker-compose.yml
+  render_caddyfile > Caddyfile
+  render_dex_config > dex.yaml
+  render_dashboard_env > dashboard.env
+  render_management_json > management.json
+  render_turn_server_conf > turnserver.conf
+  render_relay_env > relay.env
+
+  echo -e "\nStarting Dex IDP\n"
+  $DOCKER_COMPOSE_COMMAND up -d caddy dex
+
+  # Wait for Dex to be ready (through caddy proxy)
+  sleep 3
+  wait_dex
+
+  echo -e "\nStarting NetBird services\n"
+  $DOCKER_COMPOSE_COMMAND up -d
+
+  echo -e "\nDone!\n"
+  echo "You can access the NetBird dashboard at $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN"
+  echo ""
+  echo "Login with the following credentials:"
+  install -m 600 /dev/null .env
+  printf 'Email: admin@%s\nPassword: %s\n' \
+      "$NETBIRD_DOMAIN" "$NETBIRD_ADMIN_PASSWORD" >> .env
+  echo "Email: admin@$NETBIRD_DOMAIN"
+  echo "Password: $NETBIRD_ADMIN_PASSWORD"
+  echo ""
+  echo "Dex admin UI is not available (Dex has no built-in UI)."
+  echo "To add more users, edit dex.yaml and restart: $DOCKER_COMPOSE_COMMAND restart dex"
+  return 0
+}
+
+render_caddyfile() {
+  cat <<EOF
+{
+  debug
+  servers :80,:443 {
+    protocols h1 h2c h2 h3
+  }
+}
+
+(security_headers) {
+    header * {
+        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"
+        X-Content-Type-Options "nosniff"
+        X-Frame-Options "SAMEORIGIN"
+        X-XSS-Protection "1; mode=block"
+        -Server
+        Referrer-Policy strict-origin-when-cross-origin
+    }
+}
+
+:80${CADDY_SECURE_DOMAIN} {
+    import security_headers
+    # Relay
+    reverse_proxy /relay* relay:80
+    # Signal
+    reverse_proxy /signalexchange.SignalExchange/* h2c://signal:10000
+    # Management
+    reverse_proxy /api/* management:80
+    reverse_proxy /management.ManagementService/* h2c://management:80
+    # Dex
+    reverse_proxy /dex/* dex:5556
+    # Dashboard
+    reverse_proxy /* dashboard:80
+}
 EOF
+  return 0
+}
 
-exit 1
+render_dex_config() {
+  # Generate bcrypt hash of the admin password
+  # Using a simple approach - htpasswd or python if available
+  ADMIN_PASSWORD_HASH=""
+  if command -v htpasswd &> /dev/null; then
+    ADMIN_PASSWORD_HASH=$(htpasswd -bnBC 10 "" "$NETBIRD_ADMIN_PASSWORD" | tr -d ':\n')
+  elif command -v python3 &> /dev/null; then
+    ADMIN_PASSWORD_HASH=$(python3 -c "import bcrypt; print(bcrypt.hashpw('$NETBIRD_ADMIN_PASSWORD'.encode(), bcrypt.gensalt(rounds=10)).decode())" 2>/dev/null || echo "")
+  fi
+
+  # Fallback to a known hash if we can't generate one
+  if [[ -z "$ADMIN_PASSWORD_HASH" ]]; then
+    # This is hash of "password" - user should change it
+    ADMIN_PASSWORD_HASH='$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W'
+    NETBIRD_ADMIN_PASSWORD="password"
+    echo "Warning: Could not generate password hash. Using default password: password. Please change it in dex.yaml" > /dev/stderr
+  fi
+
+  cat <<EOF
+# Dex configuration for NetBird
+# Generated by getting-started-with-dex.sh
+
+issuer: $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex
+
+storage:
+  type: sqlite3
+  config:
+    file: /var/dex/dex.db
+
+web:
+  http: 0.0.0.0:5556
+
+# gRPC API for user management (used by NetBird IDP manager)
+grpc:
+  addr: 0.0.0.0:5557
+
+oauth2:
+  skipApprovalScreen: true
+
+# Static OAuth2 clients for NetBird
+staticClients:
+  # Dashboard client
+  - id: netbird-dashboard
+    name: NetBird Dashboard
+    secret: $DEX_DASHBOARD_CLIENT_SECRET
+    redirectURIs:
+      - $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-auth
+      - $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-silent-auth
+
+  # CLI client (public - uses PKCE)
+  - id: netbird-cli
+    name: NetBird CLI
+    public: true
+    redirectURIs:
+      - http://localhost:53000/
+      - http://localhost:54000/
+
+# Enable password database for static users
+enablePasswordDB: true
+
+# Static users - add more users here as needed
+staticPasswords:
+  - email: "admin@$NETBIRD_DOMAIN"
+    hash: "$ADMIN_PASSWORD_HASH"
+    username: "admin"
+    userID: "$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || echo "admin-user-id-001")"
+
+# Optional: Add external identity provider connectors
+# connectors:
+#   - type: github
+#     id: github
+#     name: GitHub
+#     config:
+#       clientID: \$GITHUB_CLIENT_ID
+#       clientSecret: \$GITHUB_CLIENT_SECRET
+#       redirectURI: $NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/callback
+#
+#   - type: ldap
+#     id: ldap
+#     name: LDAP
+#     config:
+#       host: ldap.example.com:636
+#       insecureNoSSL: false
+#       bindDN: cn=admin,dc=example,dc=com
+#       bindPW: admin
+#       userSearch:
+#         baseDN: ou=users,dc=example,dc=com
+#         filter: "(objectClass=person)"
+#         username: uid
+#         idAttr: uid
+#         emailAttr: mail
+#         nameAttr: cn
+EOF
+  return 0
+}
+
+render_turn_server_conf() {
+  cat <<EOF
+listening-port=3478
+$TURN_EXTERNAL_IP_CONFIG
+tls-listening-port=5349
+min-port=$TURN_MIN_PORT
+max-port=$TURN_MAX_PORT
+fingerprint
+lt-cred-mech
+user=$TURN_USER:$TURN_PASSWORD
+realm=wiretrustee.com
+cert=/etc/coturn/certs/cert.pem
+pkey=/etc/coturn/private/privkey.pem
+log-file=stdout
+no-software-attribute
+pidfile="/var/tmp/turnserver.pid"
+no-cli
+EOF
+  return 0
+}
+
+render_management_json() {
+  cat <<EOF
+{
+    "Stuns": [
+        {
+            "Proto": "udp",
+            "URI": "stun:$NETBIRD_DOMAIN:3478"
+        }
+    ],
+    "Relay": {
+        "Addresses": ["$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT"],
+        "CredentialsTTL": "24h",
+        "Secret": "$NETBIRD_RELAY_AUTH_SECRET"
+    },
+    "Signal": {
+        "Proto": "$NETBIRD_HTTP_PROTOCOL",
+        "URI": "$NETBIRD_DOMAIN:$NETBIRD_PORT"
+    },
+    "HttpConfig": {
+        "AuthIssuer": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex",
+        "AuthAudience": "netbird-dashboard",
+        "OIDCConfigEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/.well-known/openid-configuration"
+    },
+    "IdpManagerConfig": {
+        "ManagerType": "dex",
+        "ClientConfig": {
+            "Issuer": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex"
+        },
+        "ExtraConfig": {
+            "GRPCAddr": "dex:5557"
+        }
+    },
+    "DeviceAuthorizationFlow": {
+        "Provider": "hosted",
+        "ProviderConfig": {
+            "Audience": "netbird-cli",
+            "ClientID": "netbird-cli",
+            "Scope": "openid profile email offline_access",
+            "DeviceAuthEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/device/code",
+            "TokenEndpoint": "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex/token"
+        }
+    },
+    "PKCEAuthorizationFlow": {
+        "ProviderConfig": {
+            "Audience": "netbird-cli",
+            "ClientID": "netbird-cli",
+            "Scope": "openid profile email offline_access",
+            "RedirectURLs": ["http://localhost:53000/", "http://localhost:54000/"]
+        }
+    }
+}
+EOF
+  return 0
+}
+
+render_dashboard_env() {
+  cat <<EOF
+# Endpoints
+NETBIRD_MGMT_API_ENDPOINT=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
+NETBIRD_MGMT_GRPC_API_ENDPOINT=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN
+# OIDC
+AUTH_AUDIENCE=netbird-dashboard
+AUTH_CLIENT_ID=netbird-dashboard
+AUTH_CLIENT_SECRET=$DEX_DASHBOARD_CLIENT_SECRET
+AUTH_AUTHORITY=$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/dex
+USE_AUTH0=false
+AUTH_SUPPORTED_SCOPES=openid profile email offline_access
+AUTH_REDIRECT_URI=/nb-auth
+AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
+# SSL
+NGINX_SSL_PORT=443
+# Letsencrypt
+LETSENCRYPT_DOMAIN=none
+EOF
+  return 0
+}
+
+render_relay_env() {
+  cat <<EOF
+NB_LOG_LEVEL=info
+NB_LISTEN_ADDRESS=:80
+NB_EXPOSED_ADDRESS=$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT
+NB_AUTH_SECRET=$NETBIRD_RELAY_AUTH_SECRET
+EOF
+  return 0
+}
+
+render_docker_compose() {
+  cat <<EOF
+services:
+  # Caddy reverse proxy
+  caddy:
+    image: caddy
+    container_name: netbird-caddy
+    restart: unless-stopped
+    networks: [netbird]
+    ports:
+      - '443:443'
+      - '443:443/udp'
+      - '80:80'
+    volumes:
+      - netbird_caddy_data:/data
+      - ./Caddyfile:/etc/caddy/Caddyfile
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
+
+  # Dex - identity provider
+  dex:
+    image: ghcr.io/dexidp/dex:v2.38.0
+    container_name: netbird-dex
+    restart: unless-stopped
+    networks: [netbird]
+    volumes:
+      - ./dex.yaml:/etc/dex/config.docker.yaml:ro
+      - netbird_dex_data:/var/dex
+    command: ["dex", "serve", "/etc/dex/config.docker.yaml"]
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
+
+  # UI dashboard
+  dashboard:
+    image: netbirdio/dashboard:latest
+    container_name: netbird-dashboard
+    restart: unless-stopped
+    networks: [netbird]
+    env_file:
+      - ./dashboard.env
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
+
+  # Signal
+  signal:
+    image: netbirdio/signal:latest
+    container_name: netbird-signal
+    restart: unless-stopped
+    networks: [netbird]
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
+
+  # Relay
+  relay:
+    image: netbirdio/relay:latest
+    container_name: netbird-relay
+    restart: unless-stopped
+    networks: [netbird]
+    env_file:
+      - ./relay.env
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
+
+  # Management
+  management:
+    image: netbirdio/management:latest
+    container_name: netbird-management
+    restart: unless-stopped
+    networks: [netbird]
+    volumes:
+      - netbird_management:/var/lib/netbird
+      - ./management.json:/etc/netbird/management.json
+    command: [
+      "--port", "80",
+      "--log-file", "console",
+      "--log-level", "info",
+      "--disable-anonymous-metrics=false",
+      "--single-account-mode-domain=netbird.selfhosted",
+      "--dns-domain=netbird.selfhosted",
+      "--idp-sign-key-refresh-enabled",
+    ]
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
+
+  # Coturn, AKA TURN server
+  coturn:
+    image: coturn/coturn
+    container_name: netbird-coturn
+    restart: unless-stopped
+    volumes:
+      - ./turnserver.conf:/etc/turnserver.conf:ro
+    network_mode: host
+    command:
+      - -c /etc/turnserver.conf
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
+
+volumes:
+  netbird_caddy_data:
+  netbird_dex_data:
+  netbird_management:
+
+networks:
+  netbird:
+EOF
+  return 0
+}
+
+init_environment

management/internals/shared/grpc/components_envelope_response.go

@@ -50,7 +50,7 @@ func ToComponentSyncResponse(
 	// TODO (dmitri) consider using invariants?
 	//
 	enableSSH := computeSSHEnabledForPeer(components, peer)
-	peerConfig := toPeerConfig(peer, components.Network, dnsName, settings, httpConfig, deviceFlowConfig, enableSSH, components.ForceRoutingPeerDNSResolution)
+	peerConfig := toPeerConfig(peer, components.Network, dnsName, settings, httpConfig, deviceFlowConfig, enableSSH)
 
 	includeIPv6 := peer.SupportsIPv6() && peer.IPv6.IsValid()
 	useSourcePrefixes := peer.SupportsSourcePrefixes()

management/internals/shared/grpc/conversion.go

@@ -119,7 +119,7 @@ func toNetbirdConfig(config *nbconfig.Config, turnCredentials *Token, relayToken
 	return nbConfig
 }
 
-func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, settings *types.Settings, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, enableSSH bool, forceRoutingPeerDNS bool) *proto.PeerConfig {
+func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, settings *types.Settings, httpConfig *nbconfig.HttpServerConfig, deviceFlowConfig *nbconfig.DeviceAuthorizationFlow, enableSSH bool) *proto.PeerConfig {
 	netmask, _ := network.Net.Mask.Size()
 	fqdn := peer.FQDN(dnsName)
 
@@ -135,7 +135,7 @@ func toPeerConfig(peer *nbpeer.Peer, network *types.Network, dnsName string, set
 		Address:                         fmt.Sprintf("%s/%d", peer.IP.String(), netmask),
 		SshConfig:                       sshConfig,
 		Fqdn:                            fqdn,
-		RoutingPeerDnsResolutionEnabled: settings.RoutingPeerDNSResolutionEnabled || peer.ProxyMeta.Embedded || forceRoutingPeerDNS,
+		RoutingPeerDnsResolutionEnabled: settings.RoutingPeerDNSResolutionEnabled,
 		LazyConnectionEnabled:           settings.LazyConnectionEnabled,
 		AutoUpdate: &proto.AutoUpdateSettings{
 			Version:      settings.AutoUpdateVersion,
@@ -162,12 +162,12 @@ func ToSyncResponse(ctx context.Context, config *nbconfig.Config, httpConfig *nb
 	useSourcePrefixes := peer.SupportsSourcePrefixes()
 
 	response := &proto.SyncResponse{
-		PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH, networkMap.ForceRoutingPeerDNSResolution),
+		PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH),
 		NetworkMap: &proto.NetworkMap{
 			Serial:     networkMap.Network.CurrentSerial(),
 			Routes:     networkmap.ToProtocolRoutes(networkMap.Routes),
 			DNSConfig:  networkmap.ToProtocolDNSConfig(networkMap.DNSConfig, dnsCache, dnsFwdPort),
-			PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH, networkMap.ForceRoutingPeerDNSResolution),
+			PeerConfig: toPeerConfig(peer, networkMap.Network, dnsName, settings, httpConfig, deviceFlowConfig, networkMap.EnableSSH),
 		},
 		Checks: toProtocolChecks(ctx, checks),
 	}

management/internals/shared/grpc/conversion_test.go

@@ -2,7 +2,6 @@ package grpc
 
 import (
 	"fmt"
-	"net"
 	"net/netip"
 	"reflect"
 	"testing"
@@ -15,7 +14,6 @@ import (
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map"
 	"github.com/netbirdio/netbird/management/internals/controllers/network_map/controller/cache"
 	nbconfig "github.com/netbirdio/netbird/management/internals/server/config"
-	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 	"github.com/netbirdio/netbird/management/server/types"
 	"github.com/netbirdio/netbird/shared/management/networkmap"
 )
@@ -303,35 +301,3 @@ func TestToNetbirdConfig_RelayInvariant(t *testing.T) {
 		assert.True(t, nbCfg.Metrics.Enabled, "metrics flag should carry the settings value")
 	})
 }
-
-func TestToPeerConfig_RoutingPeerDNSResolution(t *testing.T) {
-	network := &types.Network{Net: net.IPNet{IP: net.IPv4(100, 0, 0, 0), Mask: net.CIDRMask(8, 32)}}
-
-	newPeer := func(embedded bool) *nbpeer.Peer {
-		p := &nbpeer.Peer{IP: netip.MustParseAddr("100.0.0.1")}
-		p.ProxyMeta.Embedded = embedded
-		return p
-	}
-
-	tests := []struct {
-		name        string
-		globalFlag  bool
-		embedded    bool
-		forceParam  bool
-		wantEnabled bool
-	}{
-		{name: "global off, regular peer, no force", wantEnabled: false},
-		{name: "global on wins", globalFlag: true, wantEnabled: true},
-		{name: "embedded proxy peer forced", embedded: true, wantEnabled: true},
-		{name: "routing peer forced via param", forceParam: true, wantEnabled: true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			settings := &types.Settings{RoutingPeerDNSResolutionEnabled: tt.globalFlag}
-			cfg := toPeerConfig(newPeer(tt.embedded), network, "netbird.selfhosted", settings, nil, nil, false, tt.forceParam)
-			assert.Equal(t, tt.wantEnabled, cfg.RoutingPeerDnsResolutionEnabled,
-				"RoutingPeerDnsResolutionEnabled should reflect global || embedded || forced")
-		})
-	}
-}

management/internals/shared/grpc/server.go

@@ -921,7 +921,7 @@ func (s *Server) prepareLoginResponse(ctx context.Context, peer *nbpeer.Peer, ne
 	// if peer has reached this point then it has logged in
 	loginResp := &proto.LoginResponse{
 		NetbirdConfig: toNetbirdConfig(s.config, nil, relayToken, nil, settings),
-		PeerConfig:    toPeerConfig(peer, network, s.networkMapController.GetDNSDomain(settings), settings, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, enableSSH, false),
+		PeerConfig:    toPeerConfig(peer, network, s.networkMapController.GetDNSDomain(settings), settings, s.config.HttpConfig, s.config.DeviceAuthorizationFlow, enableSSH),
 		Checks:        toProtocolChecks(ctx, postureChecks),
 	}
 

management/server/store/sql_store.go

@@ -6,7 +6,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"math"
 	"net"
 	"net/netip"
 	"net/url"
@@ -2259,30 +2258,117 @@ func (s *SqlStore) getPostureChecks(ctx context.Context, accountID string) ([]*p
 	return checks, nil
 }
 
-// serviceSelectColumns and targetSelectColumns are the column lists the Postgres
-// pgx read path scans. They must stay in sync with the rpservice.Service and
-// rpservice.Target gorm models; TestPgxServiceColumnsMatchGorm enforces this.
-const serviceSelectColumns = `id, account_id, name, domain, enabled, auth, restrictions,
-	meta_created_at, meta_certificate_issued_at, meta_last_renewed_at, meta_status, proxy_cluster,
-	pass_host_header, rewrite_redirects, session_private_key, session_public_key,
-	mode, listen_port, port_auto_assigned, source, source_peer, terminated,
-	private, access_groups`
-
-const targetSelectColumns = `id, account_id, service_id, path, host, port, protocol,
-	target_id, target_type, enabled, proxy_protocol,
-	skip_tls_verify, request_timeout, session_idle_timeout, path_rewrite, custom_headers,
-	direct_upstream, middlewares, capture_max_request_bytes, capture_max_response_bytes,
-	capture_content_types, agent_network, disable_access_log`
-
 func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpservice.Service, error) {
-	const serviceQuery = `SELECT ` + serviceSelectColumns + ` FROM services WHERE account_id = $1`
+	const serviceQuery = `SELECT id, account_id, name, domain, enabled, auth,
+		meta_created_at, meta_certificate_issued_at, meta_status, proxy_cluster,
+		pass_host_header, rewrite_redirects, session_private_key, session_public_key,
+		mode, listen_port, port_auto_assigned, source, source_peer, terminated,
+		private, access_groups
+		FROM services WHERE account_id = $1`
+
+	const targetsQuery = `SELECT id, account_id, service_id, path, host, port, protocol,
+		target_id, target_type, enabled
+		FROM targets WHERE service_id = ANY($1)`
 
 	serviceRows, err := s.pool.Query(ctx, serviceQuery, accountID)
 	if err != nil {
 		return nil, err
 	}
 
-	services, err := pgx.CollectRows(serviceRows, scanService)
+	services, err := pgx.CollectRows(serviceRows, func(row pgx.CollectableRow) (*rpservice.Service, error) {
+		var s rpservice.Service
+		var auth []byte
+		var accessGroups []byte
+		var createdAt, certIssuedAt sql.NullTime
+		var status, proxyCluster, sessionPrivateKey, sessionPublicKey sql.NullString
+		var mode, source, sourcePeer sql.NullString
+		var terminated, portAutoAssigned, private sql.NullBool
+		var listenPort sql.NullInt64
+		err := row.Scan(
+			&s.ID,
+			&s.AccountID,
+			&s.Name,
+			&s.Domain,
+			&s.Enabled,
+			&auth,
+			&createdAt,
+			&certIssuedAt,
+			&status,
+			&proxyCluster,
+			&s.PassHostHeader,
+			&s.RewriteRedirects,
+			&sessionPrivateKey,
+			&sessionPublicKey,
+			&mode,
+			&listenPort,
+			&portAutoAssigned,
+			&source,
+			&sourcePeer,
+			&terminated,
+			&private,
+			&accessGroups,
+		)
+		if err != nil {
+			return nil, err
+		}
+
+		if auth != nil {
+			if err := json.Unmarshal(auth, &s.Auth); err != nil {
+				return nil, err
+			}
+		}
+
+		if len(accessGroups) > 0 {
+			if err := json.Unmarshal(accessGroups, &s.AccessGroups); err != nil {
+				return nil, fmt.Errorf("unmarshal access_groups: %w", err)
+			}
+		}
+
+		if private.Valid {
+			s.Private = private.Bool
+		}
+
+		s.Meta = rpservice.Meta{}
+		if createdAt.Valid {
+			s.Meta.CreatedAt = createdAt.Time
+		}
+		if certIssuedAt.Valid {
+			t := certIssuedAt.Time
+			s.Meta.CertificateIssuedAt = &t
+		}
+		if status.Valid {
+			s.Meta.Status = status.String
+		}
+		if proxyCluster.Valid {
+			s.ProxyCluster = proxyCluster.String
+		}
+		if sessionPrivateKey.Valid {
+			s.SessionPrivateKey = sessionPrivateKey.String
+		}
+		if sessionPublicKey.Valid {
+			s.SessionPublicKey = sessionPublicKey.String
+		}
+		if mode.Valid {
+			s.Mode = mode.String
+		}
+		if source.Valid {
+			s.Source = source.String
+		}
+		if sourcePeer.Valid {
+			s.SourcePeer = sourcePeer.String
+		}
+		if terminated.Valid {
+			s.Terminated = terminated.Bool
+		}
+		if portAutoAssigned.Valid {
+			s.PortAutoAssigned = portAutoAssigned.Bool
+		}
+		if listenPort.Valid {
+			s.ListenPort = uint16(listenPort.Int64)
+		}
+		s.Targets = []*rpservice.Target{}
+		return &s, nil
+	})
 	if err != nil {
 		return nil, err
 	}
@@ -2293,12 +2379,39 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 
 	serviceIDs := make([]string, len(services))
 	serviceMap := make(map[string]*rpservice.Service)
-	for i, svc := range services {
-		serviceIDs[i] = svc.ID
-		serviceMap[svc.ID] = svc
+	for i, s := range services {
+		serviceIDs[i] = s.ID
+		serviceMap[s.ID] = s
 	}
 
-	targets, err := s.getServiceTargets(ctx, serviceIDs)
+	targetRows, err := s.pool.Query(ctx, targetsQuery, serviceIDs)
+	if err != nil {
+		return nil, err
+	}
+
+	targets, err := pgx.CollectRows(targetRows, func(row pgx.CollectableRow) (*rpservice.Target, error) {
+		var t rpservice.Target
+		var path sql.NullString
+		err := row.Scan(
+			&t.ID,
+			&t.AccountID,
+			&t.ServiceID,
+			&path,
+			&t.Host,
+			&t.Port,
+			&t.Protocol,
+			&t.TargetId,
+			&t.TargetType,
+			&t.Enabled,
+		)
+		if err != nil {
+			return nil, err
+		}
+		if path.Valid {
+			t.Path = &path.String
+		}
+		return &t, nil
+	})
 	if err != nil {
 		return nil, err
 	}
@@ -2312,201 +2425,6 @@ func (s *SqlStore) getServices(ctx context.Context, accountID string) ([]*rpserv
 	return services, nil
 }
 
-func scanService(row pgx.CollectableRow) (*rpservice.Service, error) {
-	var s rpservice.Service
-	var auth []byte
-	var restrictions []byte
-	var accessGroups []byte
-	var createdAt, certIssuedAt, lastRenewedAt sql.NullTime
-	var status, proxyCluster, sessionPrivateKey, sessionPublicKey sql.NullString
-	var mode, source, sourcePeer sql.NullString
-	var terminated, portAutoAssigned, private sql.NullBool
-	var listenPort sql.NullInt64
-	err := row.Scan(
-		&s.ID,
-		&s.AccountID,
-		&s.Name,
-		&s.Domain,
-		&s.Enabled,
-		&auth,
-		&restrictions,
-		&createdAt,
-		&certIssuedAt,
-		&lastRenewedAt,
-		&status,
-		&proxyCluster,
-		&s.PassHostHeader,
-		&s.RewriteRedirects,
-		&sessionPrivateKey,
-		&sessionPublicKey,
-		&mode,
-		&listenPort,
-		&portAutoAssigned,
-		&source,
-		&sourcePeer,
-		&terminated,
-		&private,
-		&accessGroups,
-	)
-	if err != nil {
-		return nil, err
-	}
-
-	if auth != nil {
-		if err := json.Unmarshal(auth, &s.Auth); err != nil {
-			return nil, err
-		}
-	}
-
-	if len(restrictions) > 0 {
-		if err := json.Unmarshal(restrictions, &s.Restrictions); err != nil {
-			return nil, fmt.Errorf("unmarshal restrictions: %w", err)
-		}
-	}
-
-	if len(accessGroups) > 0 {
-		if err := json.Unmarshal(accessGroups, &s.AccessGroups); err != nil {
-			return nil, fmt.Errorf("unmarshal access_groups: %w", err)
-		}
-	}
-
-	if private.Valid {
-		s.Private = private.Bool
-	}
-
-	s.Meta = serviceMetaFromRow(createdAt, certIssuedAt, lastRenewedAt, status)
-	if proxyCluster.Valid {
-		s.ProxyCluster = proxyCluster.String
-	}
-	if sessionPrivateKey.Valid {
-		s.SessionPrivateKey = sessionPrivateKey.String
-	}
-	if sessionPublicKey.Valid {
-		s.SessionPublicKey = sessionPublicKey.String
-	}
-	if mode.Valid {
-		s.Mode = mode.String
-	}
-	if source.Valid {
-		s.Source = source.String
-	}
-	if sourcePeer.Valid {
-		s.SourcePeer = sourcePeer.String
-	}
-	if terminated.Valid {
-		s.Terminated = terminated.Bool
-	}
-	if portAutoAssigned.Valid {
-		s.PortAutoAssigned = portAutoAssigned.Bool
-	}
-	if listenPort.Valid {
-		if listenPort.Int64 < 0 || listenPort.Int64 > math.MaxUint16 {
-			return nil, fmt.Errorf("listen_port %d out of range", listenPort.Int64)
-		}
-		s.ListenPort = uint16(listenPort.Int64)
-	}
-	s.Targets = []*rpservice.Target{}
-	return &s, nil
-}
-
-func serviceMetaFromRow(createdAt, certIssuedAt, lastRenewedAt sql.NullTime, status sql.NullString) rpservice.Meta {
-	meta := rpservice.Meta{}
-	if createdAt.Valid {
-		meta.CreatedAt = createdAt.Time
-	}
-	if certIssuedAt.Valid {
-		t := certIssuedAt.Time
-		meta.CertificateIssuedAt = &t
-	}
-	if lastRenewedAt.Valid {
-		t := lastRenewedAt.Time
-		meta.LastRenewedAt = &t
-	}
-	if status.Valid {
-		meta.Status = status.String
-	}
-	return meta
-}
-
-func (s *SqlStore) getServiceTargets(ctx context.Context, serviceIDs []string) ([]*rpservice.Target, error) {
-	const targetsQuery = `SELECT ` + targetSelectColumns + ` FROM targets WHERE service_id = ANY($1)`
-
-	rows, err := s.pool.Query(ctx, targetsQuery, serviceIDs)
-	if err != nil {
-		return nil, err
-	}
-
-	return pgx.CollectRows(rows, scanTarget)
-}
-
-func scanTarget(row pgx.CollectableRow) (*rpservice.Target, error) {
-	var t rpservice.Target
-	var path sql.NullString
-	var pathRewrite sql.NullString
-	var proxyProtocol, skipTLSVerify, directUpstream, agentNetwork, disableAccessLog sql.NullBool
-	var requestTimeout, sessionIdleTimeout, captureMaxRequestBytes, captureMaxResponseBytes sql.NullInt64
-	var customHeaders, middlewares, captureContentTypes []byte
-	err := row.Scan(
-		&t.ID,
-		&t.AccountID,
-		&t.ServiceID,
-		&path,
-		&t.Host,
-		&t.Port,
-		&t.Protocol,
-		&t.TargetId,
-		&t.TargetType,
-		&t.Enabled,
-		&proxyProtocol,
-		&skipTLSVerify,
-		&requestTimeout,
-		&sessionIdleTimeout,
-		&pathRewrite,
-		&customHeaders,
-		&directUpstream,
-		&middlewares,
-		&captureMaxRequestBytes,
-		&captureMaxResponseBytes,
-		&captureContentTypes,
-		&agentNetwork,
-		&disableAccessLog,
-	)
-	if err != nil {
-		return nil, err
-	}
-	if path.Valid {
-		t.Path = &path.String
-	}
-
-	t.ProxyProtocol = proxyProtocol.Bool
-	t.Options.SkipTLSVerify = skipTLSVerify.Bool
-	t.Options.RequestTimeout = time.Duration(requestTimeout.Int64)
-	t.Options.SessionIdleTimeout = time.Duration(sessionIdleTimeout.Int64)
-	t.Options.PathRewrite = rpservice.PathRewriteMode(pathRewrite.String)
-	t.Options.DirectUpstream = directUpstream.Bool
-	t.Options.CaptureMaxRequestBytes = captureMaxRequestBytes.Int64
-	t.Options.CaptureMaxResponseBytes = captureMaxResponseBytes.Int64
-	t.Options.AgentNetwork = agentNetwork.Bool
-	t.Options.DisableAccessLog = disableAccessLog.Bool
-
-	if len(customHeaders) > 0 {
-		if err := json.Unmarshal(customHeaders, &t.Options.CustomHeaders); err != nil {
-			return nil, fmt.Errorf("unmarshal custom_headers: %w", err)
-		}
-	}
-	if len(middlewares) > 0 {
-		if err := json.Unmarshal(middlewares, &t.Options.Middlewares); err != nil {
-			return nil, fmt.Errorf("unmarshal middlewares: %w", err)
-		}
-	}
-	if len(captureContentTypes) > 0 {
-		if err := json.Unmarshal(captureContentTypes, &t.Options.CaptureContentTypes); err != nil {
-			return nil, fmt.Errorf("unmarshal capture_content_types: %w", err)
-		}
-	}
-	return &t, nil
-}
-
 func (s *SqlStore) getNetworks(ctx context.Context, accountID string) ([]*networkTypes.Network, error) {
 	const query = `SELECT id, account_id, public_id, name, description FROM networks WHERE account_id = $1`
 	rows, err := s.pool.Query(ctx, query, accountID)

management/server/store/sql_store_pgx_parity_test.go

@@ -1,74 +0,0 @@
-package store
-
-import (
-	"strings"
-	"sync"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gorm.io/gorm/schema"
-
-	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
-)
-
-// TestPgxServiceColumnsMatchGorm guards the Postgres pgx read path against
-// drifting from the gorm model. The SQLite/MySQL gorm path loads rows by struct,
-// so a new column on a model is picked up automatically, but the hand-written
-// pgx SELECT in sql_store.go must be updated by hand. This test fails when a
-// gorm column is missing from the pgx column list, which otherwise silently
-// returns zero-valued on Postgres with no compile error.
-func TestPgxServiceColumnsMatchGorm(t *testing.T) {
-	tests := []struct {
-		name          string
-		model         any
-		selectColumns string
-		// excluded lists gorm columns intentionally not loaded by the pgx path.
-		excluded map[string]struct{}
-	}{
-		{
-			name:          "service",
-			model:         &rpservice.Service{},
-			selectColumns: serviceSelectColumns,
-		},
-		{
-			name:          "target",
-			model:         &rpservice.Target{},
-			selectColumns: targetSelectColumns,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			selected := parseColumnList(tc.selectColumns)
-			for _, col := range gormColumnNames(t, tc.model) {
-				if _, ok := tc.excluded[col]; ok {
-					continue
-				}
-				_, ok := selected[col]
-				assert.Truef(t, ok,
-					"gorm column %q is not read by the Postgres pgx SELECT; add it to %sSelectColumns in sql_store.go (or to the test's excluded set if it is intentionally not loaded)",
-					col, tc.name)
-			}
-		})
-	}
-}
-
-func parseColumnList(cols string) map[string]struct{} {
-	set := make(map[string]struct{})
-	for _, c := range strings.Split(cols, ",") {
-		if c = strings.TrimSpace(c); c != "" {
-			set[c] = struct{}{}
-		}
-	}
-	return set
-}
-
-// gormColumnNames returns the DB column names gorm would migrate for the model,
-// using the same default naming strategy the store configures.
-func gormColumnNames(t *testing.T, model any) []string {
-	t.Helper()
-	sch, err := schema.Parse(model, &sync.Map{}, schema.NamingStrategy{})
-	require.NoError(t, err)
-	return sch.DBNames
-}

management/server/store/sql_store_service_test.go

@@ -5,7 +5,6 @@ import (
 	"os"
 	"runtime"
 	"testing"
-	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -45,91 +44,3 @@ func TestSqlStore_GetAccount_PrivateServiceRoundtrip(t *testing.T) {
 		assert.Equal(t, []string{"grp-admins", "grp-ops"}, got.AccessGroups)
 	})
 }
-
-// TestSqlStore_GetAccount_ServiceTargetOptionsRoundtrip guards the Postgres pgx
-// read path (getServices) against silently dropping columns present on the gorm
-// model. Before the fix these fields loaded correctly on SQLite but came back
-// zero-valued on Postgres because the hand-written SELECT and scan omitted them.
-func TestSqlStore_GetAccount_ServiceTargetOptionsRoundtrip(t *testing.T) {
-	if os.Getenv("CI") == "true" && (runtime.GOOS == "darwin" || runtime.GOOS == "windows") {
-		t.Skip("skip CI tests on darwin and windows")
-	}
-
-	runTestForAllEngines(t, "", func(t *testing.T, store Store) {
-		ctx := context.Background()
-		account := newAccountWithId(ctx, "account_svc_opts", "testuser", "")
-		require.NoError(t, store.SaveAccount(ctx, account))
-
-		renewedAt := time.Now().UTC().Truncate(time.Second)
-		targetPath := "/api"
-		svc := &rpservice.Service{
-			ID:        "svc-opts",
-			AccountID: account.Id,
-			Name:      "opts-svc",
-			Domain:    "opts.example",
-			Enabled:   true,
-			Mode:      rpservice.ModeHTTP,
-			Restrictions: rpservice.AccessRestrictions{
-				AllowedCIDRs:     []string{"10.0.0.0/8"},
-				BlockedCountries: []string{"XX"},
-				CrowdSecMode:     "block",
-			},
-			Meta: rpservice.Meta{
-				LastRenewedAt: &renewedAt,
-			},
-			Targets: []*rpservice.Target{
-				{
-					AccountID:     account.Id,
-					ServiceID:     "svc-opts",
-					Path:          &targetPath,
-					Host:          "backend.internal",
-					Port:          8080,
-					Protocol:      "http",
-					TargetId:      "tgt-1",
-					Enabled:       true,
-					ProxyProtocol: true,
-					Options: rpservice.TargetOptions{
-						SkipTLSVerify:           true,
-						RequestTimeout:          30 * time.Second,
-						SessionIdleTimeout:      5 * time.Minute,
-						PathRewrite:             rpservice.PathRewritePreserve,
-						CustomHeaders:           map[string]string{"X-Foo": "bar"},
-						DirectUpstream:          true,
-						CaptureMaxRequestBytes:  1024,
-						CaptureMaxResponseBytes: 2048,
-						CaptureContentTypes:     []string{"application/json"},
-						AgentNetwork:            true,
-						DisableAccessLog:        true,
-					},
-				},
-			},
-		}
-		require.NoError(t, store.CreateService(ctx, svc))
-
-		loaded, err := store.GetAccount(ctx, account.Id)
-		require.NoError(t, err)
-		require.Len(t, loaded.Services, 1)
-
-		got := loaded.Services[0]
-		assert.Equal(t, []string{"10.0.0.0/8"}, got.Restrictions.AllowedCIDRs, "restrictions allowed CIDRs")
-		assert.Equal(t, []string{"XX"}, got.Restrictions.BlockedCountries, "restrictions blocked countries")
-		assert.Equal(t, "block", got.Restrictions.CrowdSecMode, "restrictions crowdsec mode")
-		require.NotNil(t, got.Meta.LastRenewedAt, "meta last renewed at")
-		assert.WithinDuration(t, renewedAt, *got.Meta.LastRenewedAt, time.Second, "meta last renewed at")
-
-		require.Len(t, got.Targets, 1)
-		tg := got.Targets[0]
-		assert.True(t, tg.ProxyProtocol, "target proxy protocol")
-		assert.True(t, tg.Options.SkipTLSVerify, "options skip TLS verify")
-		assert.Equal(t, 30*time.Second, tg.Options.RequestTimeout, "options request timeout")
-		assert.Equal(t, 5*time.Minute, tg.Options.SessionIdleTimeout, "options session idle timeout")
-		assert.Equal(t, rpservice.PathRewritePreserve, tg.Options.PathRewrite, "options path rewrite")
-		assert.Equal(t, map[string]string{"X-Foo": "bar"}, tg.Options.CustomHeaders, "options custom headers")
-		assert.True(t, tg.Options.DirectUpstream, "options direct upstream")
-		assert.Equal(t, int64(1024), tg.Options.CaptureMaxRequestBytes, "options capture max request bytes")
-		assert.Equal(t, int64(2048), tg.Options.CaptureMaxResponseBytes, "options capture max response bytes")
-		assert.Equal(t, []string{"application/json"}, tg.Options.CaptureContentTypes, "options capture content types")
-		assert.True(t, tg.Options.AgentNetwork, "options agent network")
-		assert.True(t, tg.Options.DisableAccessLog, "options disable access log")
-	})
-}

management/server/types/account.go

@@ -1517,54 +1517,6 @@ func (a *Account) GetResourceRoutersMap() map[string]map[string]*routerTypes.Net
 	return routers
 }
 
-// forcesRoutingPeerDNSResolution reports whether the given peer must run
-// routing-peer DNS resolution regardless of the account-global
-// RoutingPeerDNSResolutionEnabled setting. It returns true when the peer is a
-// router for a domain network resource that is targeted by an enabled
-// reverse-proxy service, so the peer's DNS forwarder starts and can resolve
-// the target for the embedded proxy peers. Embedded proxy peers themselves are
-// handled at PeerConfig build time.
-func (a *Account) forcesRoutingPeerDNSResolution(peerID string, routers map[string]map[string]*routerTypes.NetworkRouter) bool {
-	targeted := a.proxyTargetedDomainResourceIDs()
-	if len(targeted) == 0 {
-		return false
-	}
-
-	for _, resource := range a.NetworkResources {
-		if resource == nil || !resource.Enabled || resource.Type != resourceTypes.Domain {
-			continue
-		}
-		if _, ok := targeted[resource.ID]; !ok {
-			continue
-		}
-		if _, isRouter := routers[resource.NetworkID][peerID]; isRouter {
-			return true
-		}
-	}
-
-	return false
-}
-
-// proxyTargetedDomainResourceIDs returns the set of domain network resource IDs
-// targeted by an enabled, non-terminated reverse-proxy service.
-func (a *Account) proxyTargetedDomainResourceIDs() map[string]struct{} {
-	ids := make(map[string]struct{})
-	for _, svc := range a.Services {
-		if svc == nil || !svc.Enabled || svc.Terminated {
-			continue
-		}
-		for _, target := range svc.Targets {
-			if target == nil || !target.Enabled {
-				continue
-			}
-			if target.TargetType == service.TargetTypeDomain {
-				ids[target.TargetId] = struct{}{}
-			}
-		}
-	}
-	return ids
-}
-
 // getPoliciesSourcePeers collects all unique peers from the source groups defined in the given policies.
 func getPoliciesSourcePeers(policies []*Policy, groups map[string]*Group) map[string]struct{} {
 	sourcePeers := make(map[string]struct{})

management/server/types/account_components.go

@@ -140,8 +140,6 @@ func (a *Account) GetPeerNetworkMapComponents(
 		RouterPeers:               make(map[string]*ComponentPeer),
 		NetworkXIDToPublicID:      make(map[string]string, len(a.Networks)),
 		PostureCheckXIDToPublicID: make(map[string]string, len(a.PostureChecks)),
-
-		ForceRoutingPeerDNSResolution: a.forcesRoutingPeerDNSResolution(peerID, routers),
 	}
 	for _, n := range a.Networks {
 		if n != nil {

management/server/types/account_test.go

@@ -1751,71 +1751,3 @@ func hasPrivateAccessPolicy(account *Account, serviceID string) bool {
 	}
 	return false
 }
-
-func TestForcesRoutingPeerDNSResolution(t *testing.T) {
-	buildAccountRes := func(serviceEnabled, targetEnabled, resourceEnabled bool, targetType service.TargetType, resType resourceTypes.NetworkResourceType) *Account {
-		return &Account{
-			Id: "accountID",
-			Groups: map[string]*Group{
-				"router-group": {ID: "router-group", Peers: []string{"router-peer-grp"}},
-			},
-			NetworkRouters: []*routerTypes.NetworkRouter{
-				{ID: "r1", NetworkID: "net-1", AccountID: "accountID", Peer: "router-peer", Enabled: true},
-				{ID: "r2", NetworkID: "net-1", AccountID: "accountID", PeerGroups: []string{"router-group"}, Enabled: true},
-			},
-			NetworkResources: []*resourceTypes.NetworkResource{
-				{ID: "res-domain", AccountID: "accountID", NetworkID: "net-1", Type: resType, Domain: "example.org", Enabled: resourceEnabled},
-			},
-			Services: []*service.Service{
-				{
-					ID: "svc-1", AccountID: "accountID", Enabled: serviceEnabled,
-					Targets: []*service.Target{
-						{TargetId: "res-domain", TargetType: targetType, Enabled: targetEnabled},
-					},
-				},
-			},
-		}
-	}
-
-	buildAccount := func(serviceEnabled, targetEnabled, resourceEnabled bool, targetType service.TargetType) *Account {
-		return buildAccountRes(serviceEnabled, targetEnabled, resourceEnabled, targetType, resourceTypes.Domain)
-	}
-
-	t.Run("router peer for RP-targeted domain resource is forced", func(t *testing.T) {
-		account := buildAccount(true, true, true, service.TargetTypeDomain)
-		routers := account.GetResourceRoutersMap()
-		assert.True(t, account.forcesRoutingPeerDNSResolution("router-peer", routers), "direct router peer should be forced")
-		assert.True(t, account.forcesRoutingPeerDNSResolution("router-peer-grp", routers), "group-member router peer should be forced")
-	})
-
-	t.Run("non-router peer is not forced", func(t *testing.T) {
-		account := buildAccount(true, true, true, service.TargetTypeDomain)
-		assert.False(t, account.forcesRoutingPeerDNSResolution("other-peer", account.GetResourceRoutersMap()))
-	})
-
-	t.Run("not forced when service disabled", func(t *testing.T) {
-		account := buildAccount(false, true, true, service.TargetTypeDomain)
-		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()))
-	})
-
-	t.Run("not forced when target disabled", func(t *testing.T) {
-		account := buildAccount(true, false, true, service.TargetTypeDomain)
-		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()))
-	})
-
-	t.Run("not forced when resource disabled", func(t *testing.T) {
-		account := buildAccount(true, true, false, service.TargetTypeDomain)
-		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()))
-	})
-
-	t.Run("not forced for non-domain target type", func(t *testing.T) {
-		account := buildAccount(true, true, true, service.TargetTypePeer)
-		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()))
-	})
-
-	t.Run("not forced when targeted resource is not a domain", func(t *testing.T) {
-		account := buildAccountRes(true, true, true, service.TargetTypeDomain, resourceTypes.Host)
-		assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()),
-			"a domain target pointing at a non-domain resource must not force resolution")
-	})
-}

management/server/user.go

@@ -321,10 +321,6 @@ func (am *DefaultAccountManager) DeleteUser(ctx context.Context, accountID, init
 		return err
 	}
 
-	if targetUser.AccountID != accountID {
-		return status.NewUserNotFoundError(targetUserID)
-	}
-
 	if targetUser.Role == types.UserRoleOwner {
 		return status.NewOwnerDeletePermissionError()
 	}

management/server/user_test.go

@@ -802,52 +802,6 @@ func TestUser_DeleteUser_SelfDelete(t *testing.T) {
 	}
 }
 
-func TestUser_DeleteUser_OtherAccount(t *testing.T) {
-	testStore, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	if err != nil {
-		t.Fatalf("Error when creating store: %s", err)
-	}
-	t.Cleanup(cleanup)
-
-	account := newAccountWithId(context.Background(), mockAccountID, mockUserID, "", "", "", false)
-	if err = testStore.SaveAccount(context.Background(), account); err != nil {
-		t.Fatalf("Error when saving account: %s", err)
-	}
-
-	otherAccount := newAccountWithId(context.Background(), "otherAccount", "otherOwner", "", "", "", false)
-	otherAccount.Users["otherRegularUser"] = &types.User{
-		Id:        "otherRegularUser",
-		AccountID: "otherAccount",
-		Role:      types.UserRoleUser,
-	}
-	otherAccount.Users["otherServiceUser"] = &types.User{
-		Id:              "otherServiceUser",
-		AccountID:       "otherAccount",
-		Role:            types.UserRoleUser,
-		IsServiceUser:   true,
-		ServiceUserName: "otherServiceUser",
-	}
-	if err = testStore.SaveAccount(context.Background(), otherAccount); err != nil {
-		t.Fatalf("Error when saving other account: %s", err)
-	}
-
-	am := DefaultAccountManager{
-		Store:              testStore,
-		eventStore:         &activity.InMemoryEventStore{},
-		permissionsManager: permissions.NewManager(testStore),
-	}
-
-	for _, targetUserID := range []string{"otherRegularUser", "otherServiceUser"} {
-		t.Run(targetUserID, func(t *testing.T) {
-			err := am.DeleteUser(context.Background(), mockAccountID, mockUserID, targetUserID)
-			assert.Equal(t, status.NewUserNotFoundError(targetUserID), err)
-
-			_, err = testStore.GetUserByUserID(context.Background(), store.LockingStrengthNone, targetUserID)
-			assert.NoError(t, err, "user of another account must not be deleted")
-		})
-	}
-}
-
 func TestUser_DeleteUser_regularUser(t *testing.T) {
 	store, cleanup, err := store.NewTestStoreFromSQL(context.Background(), "", t.TempDir())
 	if err != nil {

shared/management/types/network.go

@@ -47,10 +47,6 @@ type NetworkMap struct {
 	ForwardingRules     []*ForwardingRule
 	AuthorizedUsers     map[string]map[string]struct{}
 	EnableSSH           bool
-	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS
-	// resolution regardless of the account-global setting, for reverse-proxy
-	// domain targets.
-	ForceRoutingPeerDNSResolution bool
 }
 
 func (nm *NetworkMap) Merge(other *NetworkMap) {
@@ -60,7 +56,6 @@ func (nm *NetworkMap) Merge(other *NetworkMap) {
 	nm.FirewallRules = mergeUnique(nm.FirewallRules, other.FirewallRules)
 	nm.RoutesFirewallRules = mergeUnique(nm.RoutesFirewallRules, other.RoutesFirewallRules)
 	nm.ForwardingRules = mergeUnique(nm.ForwardingRules, other.ForwardingRules)
-	nm.ForceRoutingPeerDNSResolution = nm.ForceRoutingPeerDNSResolution || other.ForceRoutingPeerDNSResolution
 }
 
 type comparableObject[T any] interface {

shared/management/types/networkmap_components.go

@@ -56,11 +56,6 @@ type NetworkMapComponents struct {
 
 	// true when returning an empty-like map (returned instead of nil)
 	empty bool
-
-	// ForceRoutingPeerDNSResolution forces the peer to run/use routing-peer DNS
-	// resolution regardless of the account-global setting, for reverse-proxy
-	// domain targets.
-	ForceRoutingPeerDNSResolution bool
 }
 
 type routeIndexEntry struct {
@@ -195,8 +190,6 @@ func (c *NetworkMapComponents) Calculate(ctx context.Context) *NetworkMap {
 		RoutesFirewallRules: append(networkResourcesFirewallRules, routesFirewallRules...),
 		AuthorizedUsers:     authorizedUsers,
 		EnableSSH:           sshEnabled,
-
-		ForceRoutingPeerDNSResolution: c.ForceRoutingPeerDNSResolution,
 	}
 }