[client] Add comment explaining kernel-only RemovePeer guard

In userspace bind mode, the WireGuard-go patch triggers SendStagedPackets
automatically via IpcSet/handlePostConfig when the peer endpoint is updated,
so RemovePeer is not needed. Only call RemovePeer for kernel mode where the
kernel WireGuard implementation requires it to force a new handshake.

.github/workflows/release.yml

@@ -29,10 +29,10 @@ jobs:
           persist-credentials: false
 
       - name: Generate FreeBSD port diff
-        run: bash -x release_files/freebsd-port-diff.sh
+        run: bash release_files/freebsd-port-diff.sh
 
       - name: Generate FreeBSD port issue body
-        run: bash -x release_files/freebsd-port-issue-body.sh
+        run: bash release_files/freebsd-port-issue-body.sh
 
       - name: Check if diff was generated
         id: check_diff

.github/workflows/wasm-build-validation.yml

@@ -65,7 +65,7 @@ jobs:
 
           echo "Size: ${SIZE} bytes (${SIZE_MB} MB)"
 
-          if [ ${SIZE} -gt 62914560 ]; then
-            echo "Wasm binary size (${SIZE_MB}MB) exceeds 60MB limit!"
+          if [ ${SIZE} -gt 58720256 ]; then
+            echo "Wasm binary size (${SIZE_MB}MB) exceeds 56MB limit!"
             exit 1
           fi

client/internal/lazyconn/activity/listener_bind.go

@@ -119,10 +119,6 @@ func (d *BindListener) ReadPackets() {
 	}
 
 	d.peerCfg.Log.Debugf("removing lazy endpoint for peer %s", d.peerCfg.PublicKey)
-	if err := d.wgIface.RemovePeer(d.peerCfg.PublicKey); err != nil {
-		d.peerCfg.Log.Errorf("failed to remove endpoint: %s", err)
-	}
-
 	_ = d.lazyConn.Close()
 	d.bind.RemoveEndpoint(d.fakeIP)
 	d.done.Done()

client/internal/lazyconn/activity/listener_udp.go

@@ -67,8 +67,13 @@ func (d *UDPListener) ReadPackets() {
 	}
 
 	d.peerCfg.Log.Debugf("removing lazy endpoint: %s", d.endpoint.String())
-	if err := d.wgIface.RemovePeer(d.peerCfg.PublicKey); err != nil {
-		d.peerCfg.Log.Errorf("failed to remove endpoint: %s", err)
+	// In kernel mode, RemovePeer is required to force a new handshake initiation on the real endpoint.
+	// In userspace mode, the WireGuard-go patch triggers SendStagedPackets via IpcSet/handlePostConfig
+	// when UpdatePeer is called after ICE/relay negotiation, so the removal is not needed.
+	if !d.wgIface.IsUserspaceBind() {
+		if err := d.wgIface.RemovePeer(d.peerCfg.PublicKey); err != nil {
+			d.peerCfg.Log.Errorf("failed to remove endpoint: %s", err)
+		}
 	}
 
 	// Ignore close error as it may return "use of closed network connection" if already closed.

go.mod

@@ -335,7 +335,7 @@ replace github.com/kardianos/service => github.com/netbirdio/service v0.0.0-2024
 
 replace github.com/getlantern/systray => github.com/netbirdio/systray v0.0.0-20231030152038-ef1ed2a27949
 
-replace golang.zx2c4.com/wireguard => github.com/netbirdio/wireguard-go v0.0.0-20260523085312-4b4a4e36017f
+replace golang.zx2c4.com/wireguard => github.com/netbirdio/wireguard-go v0.0.0-20260607154536-934b34d74f86
 
 replace github.com/cloudflare/circl => codeberg.org/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6
 

go.sum

@@ -503,8 +503,8 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wireguard-go v0.0.0-20260523085312-4b4a4e36017f h1:ff2D57RBjWtyQ2wVwJOxOgXAXOe/J2lJWtSX0Bz/BRk=
-github.com/netbirdio/wireguard-go v0.0.0-20260523085312-4b4a4e36017f/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
+github.com/netbirdio/wireguard-go v0.0.0-20260607154536-934b34d74f86 h1:RRE/wwAsukj4/06pgVcMiRzJEHi2AYtoFyVlNeapamY=
+github.com/netbirdio/wireguard-go v0.0.0-20260607154536-934b34d74f86/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=
 github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646/go.mod h1:jpp1/29i3P1S/RLdc7JQKbRpFeM1dOBd8T9ki5s+AY8=
 github.com/nicksnyder/go-i18n/v2 v2.5.1 h1:IxtPxYsR9Gp60cGXjfuR/llTqV8aYMsC472zD0D1vHk=

management/internals/shared/grpc/proxy.go

@@ -978,7 +978,6 @@ func shallowCloneMapping(m *proto.ProxyMapping) *proto.ProxyMapping {
 		Mode:               m.Mode,
 		ListenPort:         m.ListenPort,
 		AccessRestrictions: m.AccessRestrictions,
-		Private:            m.Private,
 	}
 }
 

management/internals/shared/grpc/proxy_clone_test.go

@@ -1,88 +0,0 @@
-package grpc
-
-import (
-	"reflect"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/shared/management/proto"
-)
-
-// authTokenField is the only per-proxy field that shallowCloneMapping must NOT
-// copy from the source, since callers assign it individually after cloning.
-const authTokenField = "AuthToken"
-
-// TestShallowCloneMapping_ClonesAllFields populates every exported field of
-// ProxyMapping with a non-zero value and verifies the clone carries each one
-// (except AuthToken). It uses reflection so adding a new field to ProxyMapping
-// without updating shallowCloneMapping fails this test.
-func TestShallowCloneMapping_ClonesAllFields(t *testing.T) {
-	src := &proto.ProxyMapping{}
-	populated := populateExportedFields(t, reflect.ValueOf(src).Elem())
-	require.NotEmpty(t, populated, "ProxyMapping should expose fields to populate")
-
-	clone := shallowCloneMapping(src)
-	require.NotNil(t, clone, "clone must not be nil")
-
-	srcVal := reflect.ValueOf(src).Elem()
-	cloneVal := reflect.ValueOf(clone).Elem()
-
-	for _, name := range populated {
-		srcField := srcVal.FieldByName(name).Interface()
-		cloneField := cloneVal.FieldByName(name).Interface()
-
-		if name == authTokenField {
-			assert.Zero(t, cloneField, "AuthToken must not be cloned; it is set per proxy after cloning")
-			continue
-		}
-
-		assert.Equal(t, srcField, cloneField, "field %s must be carried over by shallowCloneMapping", name)
-	}
-}
-
-// populateExportedFields sets a non-zero value on every settable exported field
-// of the struct and returns their names.
-func populateExportedFields(t *testing.T, v reflect.Value) []string {
-	t.Helper()
-
-	var names []string
-	typ := v.Type()
-	for i := 0; i < v.NumField(); i++ {
-		field := v.Field(i)
-		structField := typ.Field(i)
-
-		if structField.PkgPath != "" || !field.CanSet() {
-			continue
-		}
-
-		setNonZero(t, field, structField.Name)
-		names = append(names, structField.Name)
-	}
-	return names
-}
-
-// setNonZero assigns a deterministic non-zero value based on the field kind.
-func setNonZero(t *testing.T, field reflect.Value, name string) {
-	t.Helper()
-
-	switch field.Kind() {
-	case reflect.String:
-		field.SetString("non-zero-" + name)
-	case reflect.Bool:
-		field.SetBool(true)
-	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
-		field.SetInt(7)
-	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
-		field.SetUint(7)
-	case reflect.Ptr:
-		field.Set(reflect.New(field.Type().Elem()))
-	case reflect.Slice:
-		field.Set(reflect.MakeSlice(field.Type(), 1, 1))
-	case reflect.Map:
-		field.Set(reflect.MakeMapWithSize(field.Type(), 0))
-	default:
-		t.Fatalf("unhandled field kind %s for field %s; extend setNonZero", field.Kind(), name)
-	}
-}

management/server/store/sql_store.go

@@ -1216,7 +1216,6 @@ func (s *SqlStore) getAccountGorm(ctx context.Context, accountID string) (*types
 		Preload("NetworkResources").
 		Preload("Onboarding").
 		Preload("Services.Targets").
-		Preload("Domains").
 		Take(&account, idQueryCondition, accountID)
 	if result.Error != nil {
 		log.WithContext(ctx).Errorf("error when getting account %s from the store: %s", accountID, result.Error)
@@ -1303,7 +1302,7 @@ func (s *SqlStore) getAccountPgx(ctx context.Context, accountID string) (*types.
 	}
 
 	var wg sync.WaitGroup
-	errChan := make(chan error, 16)
+	errChan := make(chan error, 12)
 
 	wg.Add(1)
 	go func() {
@@ -1404,17 +1403,6 @@ func (s *SqlStore) getAccountPgx(ctx context.Context, accountID string) (*types.
 		account.Services = services
 	}()
 
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		domains, err := s.ListCustomDomains(ctx, accountID)
-		if err != nil {
-			errChan <- err
-			return
-		}
-		account.Domains = domains
-	}()
-
 	wg.Add(1)
 	go func() {
 		defer wg.Done()

management/server/store/sql_store_get_account_test.go

@@ -4,8 +4,6 @@ import (
 	"context"
 	"net"
 	"net/netip"
-	"os"
-	"runtime"
 	"testing"
 	"time"
 
@@ -23,63 +21,6 @@ import (
 	"github.com/netbirdio/netbird/route"
 )
 
-// TestGetAccount_LoadsCustomDomains verifies GetAccount populates account.Domains.
-// SynthesizePrivateServiceZones depends on this relation to anchor a custom-domain
-// private service's DNS zone; without the preload the relation is empty and the
-// service is silently skipped, so a custom domain never resolves on clients.
-func TestGetAccount_LoadsCustomDomains(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		t.Skip("The SQLite store is not properly supported by Windows yet")
-	}
-
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	require.NoError(t, err)
-	defer cleanup()
-
-	assertGetAccountLoadsCustomDomains(t, store)
-}
-
-func TestPostgresql_GetAccount_LoadsCustomDomains(t *testing.T) {
-	if (os.Getenv("CI") == "true" && runtime.GOOS == "darwin") || runtime.GOOS == "windows" {
-		t.Skip("skip CI tests on darwin and windows")
-	}
-
-	t.Setenv("NETBIRD_STORE_ENGINE", string(types.PostgresStoreEngine))
-	store, cleanup, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
-	require.NoError(t, err)
-	t.Cleanup(cleanup)
-
-	assertGetAccountLoadsCustomDomains(t, store)
-}
-
-// assertGetAccountLoadsCustomDomains exercises both the gorm and pgx GetAccount
-// paths: it persists two custom domains and asserts the relation comes back
-// populated, which SynthesizePrivateServiceZones relies on.
-func assertGetAccountLoadsCustomDomains(t *testing.T, store Store) {
-	t.Helper()
-	ctx := context.Background()
-
-	accountID := "acct-custom-domains"
-	require.NoError(t, store.SaveAccount(ctx, newAccountWithId(ctx, accountID, "user-1", "")))
-
-	_, err := store.CreateCustomDomain(ctx, accountID, "example.com", "eu.proxy.netbird.io", true)
-	require.NoError(t, err, "creating the first custom domain must succeed")
-	_, err = store.CreateCustomDomain(ctx, accountID, "apps.acme.io", "us.proxy.netbird.io", false)
-	require.NoError(t, err, "creating the second custom domain must succeed")
-
-	account, err := store.GetAccount(ctx, accountID)
-	require.NoError(t, err)
-	require.Len(t, account.Domains, 2, "GetAccount must preload the account's custom domains")
-
-	byDomain := map[string]string{}
-	for _, d := range account.Domains {
-		require.NotNil(t, d)
-		byDomain[d.Domain] = d.TargetCluster
-	}
-	assert.Equal(t, "eu.proxy.netbird.io", byDomain["example.com"], "custom domain must carry its target cluster")
-	assert.Equal(t, "us.proxy.netbird.io", byDomain["apps.acme.io"], "custom domain must carry its target cluster")
-}
-
 // TestGetAccount_ComprehensiveFieldValidation validates that GetAccount properly loads
 // all fields and nested objects from the database, including deeply nested structures.
 func TestGetAccount_ComprehensiveFieldValidation(t *testing.T) {

management/server/types/account.go

@@ -273,7 +273,7 @@ func (a *Account) SynthesizePrivateServiceZones(peerID string) []nbdns.CustomZon
 	}
 
 	peerGroups := a.GetPeerGroups(peerID)
-	zonesByApex := map[string]*nbdns.CustomZone{}
+	zonesByCluster := map[string]*nbdns.CustomZone{}
 
 	for _, svc := range a.Services {
 		if svc == nil || !svc.Enabled || !svc.Private {
@@ -290,24 +290,19 @@ func (a *Account) SynthesizePrivateServiceZones(peerID string) []nbdns.CustomZon
 			continue
 		}
 
-		serviceDomainZone := a.privateServiceDomainZone(svc)
-		if serviceDomainZone == "" {
-			continue
-		}
-
-		zone, exists := zonesByApex[serviceDomainZone]
+		zone, exists := zonesByCluster[svc.ProxyCluster]
 		if !exists {
 			// NonAuthoritative makes this a match-only zone: queries for
 			// names without an explicit record fall through to the
 			// upstream resolver instead of returning NXDOMAIN. Without
 			// it, adding a single private service would black-hole every
-			// other name under the zone apex.
+			// other name under the cluster apex.
 			zone = &nbdns.CustomZone{
-				Domain:           dns.Fqdn(serviceDomainZone),
+				Domain:           dns.Fqdn(svc.ProxyCluster),
 				Records:          []nbdns.SimpleRecord{},
 				NonAuthoritative: true,
 			}
-			zonesByApex[serviceDomainZone] = zone
+			zonesByCluster[svc.ProxyCluster] = zone
 		}
 
 		emitted := 0
@@ -345,8 +340,8 @@ func (a *Account) SynthesizePrivateServiceZones(peerID string) []nbdns.CustomZon
 		}
 	}
 
-	out := make([]nbdns.CustomZone, 0, len(zonesByApex))
-	for _, zone := range zonesByApex {
+	out := make([]nbdns.CustomZone, 0, len(zonesByCluster))
+	for _, zone := range zonesByCluster {
 		if len(zone.Records) == 0 {
 			continue
 		}
@@ -362,33 +357,6 @@ func (a *Account) SynthesizePrivateServiceZones(peerID string) []nbdns.CustomZon
 	return out
 }
 
-// privateServiceDomainZone returns the DNS zone name for the given private service domain by
-// looking at the proxy cluster domain then the custom domains.
-func (a *Account) privateServiceDomainZone(svc *service.Service) string {
-	if domainFromSuffix(svc.Domain, svc.ProxyCluster) {
-		return svc.ProxyCluster
-	}
-
-	// Longest matching custom domain wins
-	zoneName := ""
-	for _, d := range a.Domains {
-		if d == nil || d.TargetCluster != svc.ProxyCluster {
-			continue
-		}
-		if domainFromSuffix(svc.Domain, d.Domain) && len(d.Domain) > len(zoneName) {
-			zoneName = d.Domain
-		}
-	}
-	return zoneName
-}
-
-func domainFromSuffix(domain, suffix string) bool {
-	if suffix == "" {
-		return false
-	}
-	return domain == suffix || strings.HasSuffix(domain, "."+suffix)
-}
-
 // peerInDistributionGroups reports whether any of the peer's groups
 // matches the service's bearer-auth distribution_groups.
 func peerInDistributionGroups(peerGroups LookupMap, distributionGroups []string) bool {

management/server/types/account_private_zones_test.go

@@ -11,7 +11,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbdns "github.com/netbirdio/netbird/dns"
-	proxydomain "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/domain"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbpeer "github.com/netbirdio/netbird/management/server/peer"
 )
@@ -235,113 +234,6 @@ func TestPrivateZone_GetPeerNetworkMap_PeerOutsideGroups_OmitsSynthZone(t *testi
 	assert.False(t, ok, "peer outside the distribution_groups must not see the synth zone")
 }
 
-func TestSynthesizePrivateServiceZones_CustomDomain_ZoneApexIsRegisteredDomain(t *testing.T) {
-	account := privateZoneTestAccount(t)
-	// A custom-domain service: Domain is the custom FQDN, ProxyCluster
-	// is the cluster serving it, and account.Domains holds the registered
-	// custom domain. The synth zone apex must be the registered domain,
-	// not the cluster, or the client's match-only zone never intercepts
-	// the query.
-	account.Services[0].Domain = "app.example.com"
-	account.Domains = []*proxydomain.Domain{
-		{Domain: "example.com", AccountID: "acct-1", TargetCluster: "eu.proxy.netbird.io", Validated: true},
-	}
-
-	zones := account.SynthesizePrivateServiceZones("user-peer")
-	require.Len(t, zones, 1, "custom-domain service must still produce one zone")
-	zone := zones[0]
-	assert.Equal(t, "example.com.", zone.Domain, "zone apex must be the registered custom domain, not the cluster or the service FQDN")
-	assert.True(t, zone.NonAuthoritative, "synth zone must remain match-only")
-	require.Len(t, zone.Records, 1, "custom-domain service yields one A record")
-	rec := zone.Records[0]
-	assert.Equal(t, "app.example.com.", rec.Name, "record name is the custom service FQDN")
-	assert.Equal(t, "100.64.0.99", rec.RData, "record points at the embedded proxy peer's tunnel IP")
-}
-
-func TestSynthesizePrivateServiceZones_CustomAndFreeDomain_SeparateZones(t *testing.T) {
-	account := privateZoneTestAccount(t)
-	account.Domains = []*proxydomain.Domain{
-		{Domain: "example.com", AccountID: "acct-1", TargetCluster: "eu.proxy.netbird.io", Validated: true},
-	}
-	account.Services = append(account.Services, &service.Service{
-		ID:           "svc-2",
-		AccountID:    "acct-1",
-		Name:         "custom",
-		Domain:       "app.example.com",
-		ProxyCluster: "eu.proxy.netbird.io",
-		Enabled:      true,
-		Private:      true,
-		Mode:         service.ModeHTTP,
-		AccessGroups: []string{"grp-admins"},
-	})
-
-	zones := account.SynthesizePrivateServiceZones("user-peer")
-	require.Len(t, zones, 2, "a free-domain and a custom-domain service must not collapse into one zone")
-
-	free, ok := findCustomZone(zones, "eu.proxy.netbird.io")
-	require.True(t, ok, "free-domain service keeps the shared cluster-apex zone")
-	require.Len(t, free.Records, 1, "cluster zone carries only the free-domain record")
-	assert.Equal(t, "myapp.eu.proxy.netbird.io.", free.Records[0].Name, "cluster zone record is the free-domain FQDN")
-
-	custom, ok := findCustomZone(zones, "example.com")
-	require.True(t, ok, "custom-domain service gets its own zone at the registered custom domain apex")
-	require.Len(t, custom.Records, 1, "custom zone carries only the custom-domain record")
-	assert.Equal(t, "app.example.com.", custom.Records[0].Name, "custom zone record is the custom-domain FQDN")
-}
-
-func TestSynthesizePrivateServiceZones_TwoServicesSameCustomDomain_OneZone(t *testing.T) {
-	account := privateZoneTestAccount(t)
-	account.Domains = []*proxydomain.Domain{
-		{Domain: "example.com", AccountID: "acct-1", TargetCluster: "eu.proxy.netbird.io", Validated: true},
-	}
-	account.Services[0].Domain = "a.example.com"
-	account.Services = append(account.Services, &service.Service{
-		ID:           "svc-2",
-		AccountID:    "acct-1",
-		Name:         "bapp",
-		Domain:       "b.example.com",
-		ProxyCluster: "eu.proxy.netbird.io",
-		Enabled:      true,
-		Private:      true,
-		Mode:         service.ModeHTTP,
-		AccessGroups: []string{"grp-admins"},
-	})
-
-	zones := account.SynthesizePrivateServiceZones("user-peer")
-	require.Len(t, zones, 1, "two services under the same registered custom domain must share one zone")
-	assert.Equal(t, "example.com.", zones[0].Domain, "shared zone apex is the registered custom domain")
-	require.Len(t, zones[0].Records, 2, "both services surface as records in the shared custom-domain zone")
-	names := []string{zones[0].Records[0].Name, zones[0].Records[1].Name}
-	assert.ElementsMatch(t, []string{"a.example.com.", "b.example.com."}, names, "both custom-domain service FQDNs must surface")
-}
-
-func TestSynthesizePrivateServiceZones_CustomDomainNotRegistered_NoZone(t *testing.T) {
-	account := privateZoneTestAccount(t)
-	// Service domain is outside the cluster and no account.Domains entry
-	// covers it: there is no apex that would intercept the query, so the
-	// service must be skipped rather than emit an unmatchable record.
-	account.Services[0].Domain = "app.example.com"
-
-	zones := account.SynthesizePrivateServiceZones("user-peer")
-	assert.Empty(t, zones, "a custom-domain service with no registered domain apex must not produce a zone")
-}
-
-func TestSynthesizePrivateServiceZones_CustomDomainClusterMismatch_NoZone(t *testing.T) {
-	account := privateZoneTestAccount(t)
-	// The registered custom domain matches the service FQDN by suffix but
-	// targets a different cluster than the service's ProxyCluster. It must
-	// be ignored, leaving no apex to intercept the query — otherwise the
-	// zone would point at this cluster's proxy peers under a domain owned
-	// by a different cluster.
-	account.Services[0].Domain = "app.example.com"
-	account.Domains = []*proxydomain.Domain{
-		{Domain: "example.com", AccountID: "acct-1", TargetCluster: "us.proxy.netbird.io", Validated: true},
-	}
-
-	zones := account.SynthesizePrivateServiceZones("user-peer")
-	assert.Empty(t, zones, "a custom domain targeting a different cluster must not anchor the service zone")
-}
-
 func TestSynthesizePrivateServiceZones_TwoServicesSameCluster_OneZone(t *testing.T) {
 	account := privateZoneTestAccount(t)
 	account.Services = append(account.Services, &service.Service{
@@ -362,72 +254,3 @@ func TestSynthesizePrivateServiceZones_TwoServicesSameCluster_OneZone(t *testing
 	names := []string{zones[0].Records[0].Name, zones[0].Records[1].Name}
 	assert.ElementsMatch(t, []string{"myapp.eu.proxy.netbird.io.", "anotherapp.eu.proxy.netbird.io."}, names, "both service domains must surface")
 }
-
-func TestSynthesizePrivateServiceZones_MixedClusterCustomAndPublic(t *testing.T) {
-	account := privateZoneTestAccount(t)
-	account.Domains = []*proxydomain.Domain{
-		{Domain: "example.com", AccountID: "acct-1", TargetCluster: "eu.proxy.netbird.io", Validated: true},
-	}
-
-	privateService := func(id, domain string) *service.Service {
-		return &service.Service{
-			ID:           id,
-			AccountID:    "acct-1",
-			Name:         id,
-			Domain:       domain,
-			ProxyCluster: "eu.proxy.netbird.io",
-			Enabled:      true,
-			Private:      true,
-			Mode:         service.ModeHTTP,
-			AccessGroups: []string{"grp-admins"},
-		}
-	}
-	publicService := func(id, domain string) *service.Service {
-		s := privateService(id, domain)
-		s.Private = false
-		return s
-	}
-
-	account.Services = []*service.Service{
-		// 3 private services under the cluster suffix.
-		privateService("cluster-1", "cluster1.eu.proxy.netbird.io"),
-		privateService("cluster-2", "cluster2.eu.proxy.netbird.io"),
-		privateService("cluster-3", "cluster3.eu.proxy.netbird.io"),
-		// 4 private services under the custom domain suffix.
-		privateService("custom-1", "custom1.example.com"),
-		privateService("custom-2", "custom2.example.com"),
-		privateService("custom-3", "custom3.example.com"),
-		privateService("custom-4", "custom4.example.com"),
-		// 2 public services, one per suffix, must not surface.
-		publicService("public-cluster", "public.eu.proxy.netbird.io"),
-		publicService("public-custom", "public.example.com"),
-	}
-
-	zones := account.SynthesizePrivateServiceZones("user-peer")
-	require.Len(t, zones, 2, "one zone per apex: the cluster apex and the custom domain apex")
-
-	cluster, ok := findCustomZone(zones, "eu.proxy.netbird.io")
-	require.True(t, ok, "cluster-suffix services collapse into the cluster-apex zone")
-	clusterNames := recordNames(cluster)
-	assert.ElementsMatch(t,
-		[]string{"cluster1.eu.proxy.netbird.io.", "cluster2.eu.proxy.netbird.io.", "cluster3.eu.proxy.netbird.io."},
-		clusterNames,
-		"only the 3 private cluster services surface in the cluster zone (public one excluded)")
-
-	custom, ok := findCustomZone(zones, "example.com")
-	require.True(t, ok, "custom-suffix services collapse into the custom-domain-apex zone")
-	customNames := recordNames(custom)
-	assert.ElementsMatch(t,
-		[]string{"custom1.example.com.", "custom2.example.com.", "custom3.example.com.", "custom4.example.com."},
-		customNames,
-		"only the 4 private custom services surface in the custom zone (public one excluded)")
-}
-
-// recordNames returns the record names of a zone for order-independent assertions.
-func recordNames(zone nbdns.CustomZone) []string {
-	names := make([]string, 0, len(zone.Records))
-	for _, r := range zone.Records {
-		names = append(names, r.Name)
-	}
-	return names
-}