Subnet docker conflict check; enterprice domain alias.

.github/workflows/release.yml

@@ -475,132 +475,6 @@ jobs:
           path: dist/
           retention-days: 3
 
-  release_ui_gtk3:
-    # Legacy GTK3/WebKit2GTK 4.1 UI build for distros without WebKitGTK 6.0
-    # (Ubuntu 22.04, Debian 12, RHEL 9, Fedora <=39). Runs on ubuntu-22.04 so
-    # the binary links against the oldest supported glibc.
-    runs-on: ubuntu-22.04
-    outputs:
-      release_ui_gtk3_artifact_url: ${{ steps.upload_release_ui_gtk3.outputs.artifact-url }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          fetch-depth: 0 # It is required for GoReleaser to work properly
-          persist-credentials: false
-
-      - name: Parse semver string
-        id: semver_parser
-        uses: netbirdio/shared-actions/actions/parse-semver@be5df6047383da2236e02243cceb857d8567c27e # v0.0.2
-
-      - name: Set snapshot flag
-        if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
-        run: |
-          echo "flags=--snapshot" >> $GITHUB_ENV
-
-      - name: Set build vars
-        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
-        run: |
-          if [[ "x-${{ steps.semver_parser.outputs.prerelease }}" == "x-" && "x-${{ github.repository }}" == "x-netbirdio/netbird" ]]; then
-            echo "x-${{ github.repository }}"
-            echo "x-${{ steps.semver_parser.outputs.prerelease }}"
-            echo "SKIP_PUBLISH=false" >> $GITHUB_ENV
-          else
-            echo "x-${{ github.repository }}"
-            echo "x-${{ steps.semver_parser.outputs.prerelease }}"
-          fi
-
-      - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version-file: "go.mod"
-          cache: false
-      - name: Cache Go modules
-        # Restore-only from the release_ui cache written by trusted runs; the
-        # module cache is identical (same go.sum) and stale build-cache
-        # entries just miss.
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
-        with:
-          path: |
-            ~/go/pkg/mod
-            ~/.cache/go-build
-          key: ${{ runner.os }}-ui-go-releaser-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-ui-go-releaser-
-
-      - name: Install modules
-        run: go mod tidy
-
-      - name: check git status
-        run: git --no-pager diff --exit-code
-
-      - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-        with:
-          node-version: '22'
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
-        with:
-          version: 11
-
-      - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libwebkit2gtk-4.1-dev
-
-      - name: Decode GPG signing key
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-        env:
-          GPG_RPM_PRIVATE_KEY: ${{ secrets.GPG_RPM_PRIVATE_KEY }}
-        run: |
-          echo "$GPG_RPM_PRIVATE_KEY" | base64 -d > /tmp/gpg-rpm-signing-key.asc
-          echo "GPG_RPM_KEY_FILE=/tmp/gpg-rpm-signing-key.asc" >> $GITHUB_ENV
-
-      - name: Install wails3 CLI
-        # Version derived from go.mod so the binding generator always matches
-        # the wails runtime the binary links against.
-        # -tags gtk3: the CLI links the wails runtime's cgo packages, and the
-        # default tags request gtk4/webkitgtk-6.0 pkg-config entries that do
-        # not exist on ubuntu-22.04.
-        run: |
-          WAILS_VERSION=$(go list -m -f '{{.Version}}' github.com/wailsapp/wails/v3)
-          go install -tags gtk3 github.com/wailsapp/wails/v3/cmd/wails3@$WAILS_VERSION
-
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
-        with:
-          version: ${{ env.GORELEASER_VER }}
-          args: release --config .goreleaser_ui_gtk3.yaml --clean ${{ env.flags }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          UPLOAD_DEBIAN_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
-          UPLOAD_YUM_SECRET: ${{ secrets.PKG_UPLOAD_SECRET }}
-          GPG_RPM_KEY_FILE: ${{ env.GPG_RPM_KEY_FILE }}
-          NFPM_NETBIRD_UI_RPM_GTK3_PASSPHRASE: ${{ secrets.GPG_RPM_PASSPHRASE }}
-          SKIP_PUBLISH: ${{ env.SKIP_PUBLISH }}
-      - name: Verify RPM signatures
-        run: |
-          docker run --rm -v $(pwd)/dist:/dist fedora:41 bash -c '
-            dnf install -y -q rpm-sign curl >/dev/null 2>&1
-            curl -sSL https://pkgs.netbird.io/yum/repodata/repomd.xml.key -o /tmp/rpm-pub.key
-            rpm --import /tmp/rpm-pub.key
-            echo "=== Verifying RPM signatures ==="
-            for rpm_file in /dist/*.rpm; do
-              [ -f "$rpm_file" ] || continue
-              echo "--- $(basename $rpm_file) ---"
-              rpm -K "$rpm_file"
-            done
-          '
-      - name: Clean up GPG key
-        if: always()
-        run: rm -f /tmp/gpg-rpm-signing-key.asc
-      - name: upload non tags for debug purposes
-        id: upload_release_ui_gtk3
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
-        with:
-          name: release-ui-gtk3
-          path: dist/
-          retention-days: 3
-
   release_ui_darwin:
     runs-on: macos-latest
     outputs:
@@ -814,7 +688,7 @@ jobs:
   comment_release_artifacts:
     name: Comment release artifacts
     runs-on: ubuntu-latest
-    needs: [release, release_ui, release_ui_gtk3, release_ui_darwin]
+    needs: [release, release_ui, release_ui_darwin]
     if: ${{ always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository }}
     permissions:
       contents: read
@@ -826,14 +700,12 @@ jobs:
         env:
           RELEASE_RESULT: ${{ needs.release.result }}
           RELEASE_UI_RESULT: ${{ needs.release_ui.result }}
-          RELEASE_UI_GTK3_RESULT: ${{ needs.release_ui_gtk3.result }}
           RELEASE_UI_DARWIN_RESULT: ${{ needs.release_ui_darwin.result }}
           RELEASE_ARTIFACT_URL: ${{ needs.release.outputs.release_artifact_url }}
           LINUX_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.linux_packages_artifact_url }}
           WINDOWS_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.windows_packages_artifact_url }}
           MACOS_PACKAGES_ARTIFACT_URL: ${{ needs.release.outputs.macos_packages_artifact_url }}
           RELEASE_UI_ARTIFACT_URL: ${{ needs.release_ui.outputs.release_ui_artifact_url }}
-          RELEASE_UI_GTK3_ARTIFACT_URL: ${{ needs.release_ui_gtk3.outputs.release_ui_gtk3_artifact_url }}
           RELEASE_UI_DARWIN_ARTIFACT_URL: ${{ needs.release_ui_darwin.outputs.release_ui_darwin_artifact_url }}
           GHCR_IMAGES_MARKDOWN: ${{ needs.release.outputs.ghcr_images }}
         with:
@@ -856,7 +728,6 @@ jobs:
               ['Windows packages', process.env.WINDOWS_PACKAGES_ARTIFACT_URL, process.env.RELEASE_RESULT],
               ['macOS packages', process.env.MACOS_PACKAGES_ARTIFACT_URL, process.env.RELEASE_RESULT],
               ['UI artifacts', process.env.RELEASE_UI_ARTIFACT_URL, process.env.RELEASE_UI_RESULT],
-              ['UI GTK3 artifacts', process.env.RELEASE_UI_GTK3_ARTIFACT_URL, process.env.RELEASE_UI_GTK3_RESULT],
               ['UI macOS artifacts', process.env.RELEASE_UI_DARWIN_ARTIFACT_URL, process.env.RELEASE_UI_DARWIN_RESULT],
             ];
 
@@ -913,7 +784,7 @@ jobs:
 
   trigger_signer:
     runs-on: ubuntu-latest
-    needs: [release, release_ui, release_ui_gtk3, release_ui_darwin, test_windows_installer]
+    needs: [release, release_ui, release_ui_darwin, test_windows_installer]
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Trigger binaries sign pipelines

.github/workflows/test-infrastructure-files.yml

@@ -257,15 +257,6 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Verify fresh-install session cookie key hardening
-        run: |
-          grep -Fxq '  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)' infrastructure_files/getting-started.sh
-          grep -Fxq '    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"' infrastructure_files/getting-started.sh
-          grep -Fxq '  install -m 600 /dev/null config.yaml' infrastructure_files/getting-started.sh
-          grep -Fxq '  openssl rand -base64 32' infrastructure_files/getting-started-enterprise.sh
-          grep -Fxq '  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)' infrastructure_files/getting-started-enterprise.sh
-          grep -Fxq '    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"' infrastructure_files/getting-started-enterprise.sh
-
       - name: Verify Dex retirement notice
         run: |
           if infrastructure_files/getting-started-with-dex.sh >stdout.txt 2>stderr.txt; then

.goreleaser_ui_gtk3.yaml

@@ -1,131 +0,0 @@
-version: 2
-env:
-  - SKIP_PUBLISH={{ if index .Env "SKIP_PUBLISH" }}{{ .Env.SKIP_PUBLISH }}{{ else }}true{{ end }}
-project_name: netbird-ui
-
-before:
-  hooks:
-    # Bindings are gitignored; regenerate before the frontend build so
-    # the @wailsio/runtime Vite plugin can resolve them (vite refuses to
-    # build without them).
-    # -f '-tags gtk3': the generator type-checks client/ui, whose cgo imports
-    # would otherwise resolve gtk4/webkitgtk-6.0 pkg-config entries that do
-    # not exist on ubuntu-22.04.
-    - sh -c 'cd client/ui && wails3 generate bindings -clean=true -ts -f "-tags gtk3"'
-    - sh -c 'cd client/ui/frontend && pnpm install --frozen-lockfile && pnpm build'
-
-builds:
-  # Legacy GTK3 / WebKit2GTK 4.1 build for distros without WebKitGTK 6.0
-  # (Ubuntu 22.04, Debian 12, RHEL 9, Fedora <=39). The gtk3 tag flips the
-  # Wails Linux backend to the GTK3 stack and swaps our GTK4-only XEmbed
-  # tray host for the pure-Go stub (client/ui/xembed_host_gtk3_linux.go).
-  # Must be built on the oldest supported glibc (ubuntu-22.04 runner).
-  - id: netbird-ui-gtk3
-    dir: client/ui
-    binary: netbird-ui
-    env:
-      - CGO_ENABLED=1
-    goos:
-      - linux
-    goarch:
-      - amd64
-    ldflags:
-      - -s -w -X github.com/netbirdio/netbird/version.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}} -X main.builtBy=goreleaser
-    mod_timestamp: "{{ .CommitTimestamp }}"
-    tags:
-      - production
-      - gtk3
-
-archives:
-  - id: linux-gtk3-arch
-    name_template: "{{ .ProjectName }}-linux-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
-    builds:
-      - netbird-ui-gtk3
-
-nfpms:
-  # Same package_name as the GTK4 packages -- the two are mutually-exclusive
-  # alternatives served from separate repo paths (see uploads below); a given
-  # distro points at exactly one of them. The file names must still differ:
-  # the Debian pool is shared storage keyed by file name, so a default-named
-  # gtk3 .deb would overwrite the stable one.
-  - maintainer: Netbird <dev@netbird.io>
-    description: Netbird client UI.
-    homepage: https://netbird.io/
-    license: BSD-3-Clause
-    vendor: NetBird
-    id: netbird_ui_deb_gtk3
-    package_name: netbird-ui
-    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
-    builds:
-      - netbird-ui-gtk3
-    formats:
-      - deb
-    scripts:
-      postinstall: "release_files/ui-post-install.sh"
-    contents:
-      - src: client/ui/build/linux/netbird.desktop
-        dst: /usr/share/applications/org.wails.netbird.desktop
-      - src: client/ui/build/appicon.png
-        dst: /usr/share/pixmaps/netbird.png
-    dependencies:
-      - netbird (>= 0.75.0)
-      - libgtk-3-0
-      - libwebkit2gtk-4.1-0
-
-  - maintainer: Netbird <dev@netbird.io>
-    description: Netbird client UI.
-    homepage: https://netbird.io/
-    license: BSD-3-Clause
-    vendor: NetBird
-    id: netbird_ui_rpm_gtk3
-    package_name: netbird-ui
-    file_name_template: "{{ .PackageName }}-gtk3_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
-    builds:
-      - netbird-ui-gtk3
-    formats:
-      - rpm
-    scripts:
-      postinstall: "release_files/ui-post-install.sh"
-    contents:
-      - src: client/ui/build/linux/netbird.desktop
-        dst: /usr/share/applications/org.wails.netbird.desktop
-      - src: client/ui/build/appicon.png
-        dst: /usr/share/pixmaps/netbird.png
-    dependencies:
-      - netbird >= 0.75.0
-      - (gtk3 or libgtk-3-0)
-      - (webkit2gtk4.1 or libwebkit2gtk-4_1-0)
-
-    rpm:
-      signature:
-        key_file: '{{ if index .Env "GPG_RPM_KEY_FILE" }}{{ .Env.GPG_RPM_KEY_FILE }}{{ end }}'
-
-# The GTK4 UI job shares project_name, so the default checksum file name would
-# collide with it on the shared GitHub release.
-checksum:
-  name_template: "{{ .ProjectName }}_gtk3_checksums.txt"
-
-changelog:
-  disable: true
-
-uploads:
-  # The gtk3 packages reuse the netbird-ui package name, so they live in
-  # dedicated repo paths (deb distribution `gtk3`, yum path `yum-gtk3`) that
-  # legacy distros point their repo config at.
-  - name: debian-gtk3
-    skip: "{{ .Env.SKIP_PUBLISH }}"
-    ids:
-      - netbird_ui_deb_gtk3
-    mode: archive
-    target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=gtk3;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
-    username: dev@wiretrustee.com
-    method: PUT
-
-  - name: yum-gtk3
-    skip: "{{ .Env.SKIP_PUBLISH }}"
-    ids:
-      - netbird_ui_rpm_gtk3
-    mode: archive
-    target: https://pkgs.wiretrustee.com/yum-gtk3/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
-    username: dev@wiretrustee.com
-    method: PUT

AGENTS.md

@@ -14,22 +14,20 @@ in this file, not duplicated there.
 
 ## Contents
 
-- [STOP and ask the user before](#stop-and-ask-the-user-before)
-- [Quick reference](#quick-reference)
-- [Structure](#structure)
-- [Where to look](#where-to-look)
-- [Security](#security)
-- [Agent conventions](#agent-conventions)
-- [Repo-wide principles](#repo-wide-principles)
-- [Type safety](#type-safety)
-- [Concurrency and lifecycle](#concurrency-and-lifecycle)
-- [Error handling](#error-handling)
-- [Comments](#comments)
-- [Testing](#testing)
-- [Pitfalls](#pitfalls)
-- [Commits, PRs, releases](#commits-prs-releases)
-- [After you push: CI and review bots](#after-you-push-ci-and-review-bots)
-- [Discussion and support](#discussion-and-support)
+- [NetBird Agent Guidelines](#netbird-agent-guidelines)
+  - [Contents](#contents)
+  - [STOP and ask the user before](#stop-and-ask-the-user-before)
+  - [Quick reference](#quick-reference)
+  - [Structure](#structure)
+  - [Where to look](#where-to-look)
+  - [Repo-wide principles](#repo-wide-principles)
+  - [Error handling](#error-handling)
+  - [Comments](#comments)
+  - [Testing](#testing)
+  - [Pitfalls](#pitfalls)
+  - [Commits, PRs, releases](#commits-prs-releases)
+  - [After you push: CI and review bots](#after-you-push-ci-and-review-bots)
+  - [Discussion and support](#discussion-and-support)
 
 ## STOP and ask the user before
 
@@ -159,125 +157,11 @@ netbird/
 | LLM routing / Agent Network | `proxy/internal/llm/`, `agent-network/`                      |
 | End-to-end tests            | `e2e/`                                                       |
 
-## Security
-
-### Never fail open
-
-When a security check — access control, an IP restriction, an auth decision —
-hits an error such as an unparseable value, an unavailable lookup, or a state it
-does not recognize, it must **deny**. Never skip the check or allow the request
-through because the check itself failed, and make the `default` and unknown cases
-of a security-related `switch` deny rather than fall through.
-
-### Daemon RPC input is untrusted
-
-The agent runs as root (LocalSystem on Windows), so a daemon RPC crosses a
-privilege boundary: treat every field as untrusted input rather than as something
-the UI or CLI validated on the way in.
-
-When you add or change an RPC, ask what the handler does with caller input while
-running as root. If the answer touches a filesystem path, a URL or host, or a
-privileged state change, it needs a gate **in the handler** — a check in the client
-that normally calls it is not a check at all.
-
-- **A caller-supplied path the daemon opens.** Never `os.Open` it as root.
-  Constrain it, then open it *as the caller* with `ipcauth.OpenOwnedFile`, which
-  opens `O_NOFOLLOW`, requires a regular file, and refuses a file the caller does
-  not own — so a symlink or hardlink aimed at a root-only file is rejected.
-- **A caller-supplied URL or host the daemon fetches.** Restrict the scheme and
-  allow only known hosts for unprivileged callers. Prefer a lexical host
-  allowlist plus TLS verification over "resolve the host, then reject private
-  IPs": the resolve-then-trust pattern has a DNS-rebinding race (public IP at
-  check time, attacker IP at connect time), while a name allowlist has no IP
-  check to race. Never accept `http://` where `https://` is expected.
-- **A privileged state change** (SSH root login, management URL, deregistration)
-  gates on the caller identity from `ipcauth.CallerIdentity(ctx)`.
-
-Caller identity comes from the kernel — `SO_PEERCRED`, `LOCAL_PEERCRED`, or the
-named-pipe client token — and never from an RPC field. When
-`ipcauth.CallerIdentity` reports that it could not determine an identity, **deny**;
-do not fall back to treating the caller as the transport peer.
-
-## Agent conventions
-
-### Three networking modes
-
-Where packets actually flow depends on the mode the agent is running in. The
-three are not interchangeable, so establish which one a change applies to — and
-what it should do in the other two — before you write it.
-
-- **kernel mode** (Linux only): in-kernel WireGuard®. The kernel handles both
-  peer-to-peer and routed traffic, and ACLs are iptables or nftables rules. The
-  client programs kernel facilities but never sees the traffic itself.
-- **userspace mode** (wireguard-go with a TUN): wireguard-go runs in-process. The
-  kernel handles peer-to-peer traffic once it leaves the TUN, while routed traffic
-  — exit nodes and network routes — goes through the userspace forwarder, which
-  terminates the connection and re-establishes it over OS sockets. Used on
-  platforms without kernel WireGuard® or when the user opts out.
-- **netstack mode**: wireguard-go in-process with no TUN and no kernel
-  networking. The forwarder does all routing by stitching userspace sockets, and
-  listeners such as the embedded SSH and DNS servers bind on a gVisor netstack.
-  Used where the process cannot create a TUN device, such as the embedded client
-  (`client/embed/`) and the WASM build.
-
-### The overlay interface is not "WireGuard"
-
-Do not put "WireGuard" in identifiers or comments unless the code is genuinely
-coupled to WireGuard® specifically — a wireguard-go call, a handshake field, a
-kernel WireGuard® netlink attribute. For the interface, the host, peers, or
-traffic in general, say "the NetBird interface", "the interface", or "the overlay".
-Most firewall, routing, and DNS code is transport-agnostic, so a WireGuard®
-reference there is simply inaccurate and rots as the transports change.
-
-### IPv6 is a soft feature
-
-The IPv6 overlay is opt-in dual-stack, and capability can change at runtime. Treat
-it as soft rather than a requirement:
-
-- Gate local v6 paths on the interface accessor (`wgIface.Address().HasIPv6()`),
-  not on raw state fields, and skip the v6 path when the host has no v6 rather
-  than returning an error.
-- Treat an empty or unparseable peer v6 address as "no v6 for that peer" and skip
-  it, keeping the v4 path working.
-- Never let a missing v6 break v4. Fail-closed is for security checks; a
-  capability mismatch skips the v6 work and carries on.
-
-### Environment variables
-
-Name the variable in a constant and parse booleans with `strconv.ParseBool` rather
-than comparing strings inline, so an unexpected value is logged instead of
-silently meaning false:
-
-```go
-const EnvDisableFeature = "NB_DISABLE_FEATURE"
-
-func isDisabledByEnv() bool {
-    val := os.Getenv(EnvDisableFeature)
-    if val == "" {
-        return false
-    }
-    disabled, err := strconv.ParseBool(val)
-    if err != nil {
-        log.Warnf("failed to parse %s: %v", EnvDisableFeature, err)
-        return false
-    }
-    return disabled
-}
-```
-
-### Validating against protocol specs
-
-When a change depends on what a protocol actually mandates, read the specification
-text from the [IETF datatracker](https://datatracker.ietf.org/) rather than a
-summary, and check that you have the current RFC — the widely cited one for a
-protocol is often superseded. Cite the section, not just the document, so a
-reviewer can jump straight to the rule.
-
 ## Repo-wide principles
 
 1. **Run `go fmt` on every modified Go file.** Formatting is not optional.
-2. **Zero unaddressed linter warnings.** Fix what `golangci-lint` reports on code
-   you touch, and delete imports, helpers, and parameters your refactor orphaned.
+2. **Zero unaddressed diagnostics.** Fix IDE and linter warnings on code you
+   touch, and delete imports, helpers, and parameters your refactor orphaned.
    Exception: unused parameters in shared code may be consumed by builds outside
    this repository — do not remove them, ask instead.
 3. **Function comments are mandatory for exported functions**, written as full
@@ -291,12 +175,9 @@ reviewer can jump straight to the rule.
 7. **Avoid LLM-slop tells:** em dashes, hedging narration, restating the diff in
    prose, trailing summaries. Defaults, not absolute bans. Applies to code,
    comments, commit messages, and PR descriptions alike.
-8. **Concurrency: do a two-pass race analysis after every change** that touches
-   shared state, including reads of existing maps and slices. Guard them with a
-   mutex (or an atomic or channel where that fits better), keep critical
-   sections short, and run `go test -race` on the touched packages. See
-   [Concurrency and lifecycle](#concurrency-and-lifecycle) for the failure modes
-   to check for.
+8. **Concurrency: do a two-pass race analysis after every change** that adds
+   shared state. Guard maps and slices with a mutex, keep critical sections
+   short, and run `go test -race` on the touched packages.
 9. **Cross-platform builds must keep working.** The agent targets Linux, macOS,
    Windows, FreeBSD, Android, and iOS. When you add a platform-specific file,
    add the counterpart or a build-tagged fallback for the others.
@@ -304,93 +185,6 @@ reviewer can jump straight to the rule.
 11. **Never log secrets** — private keys, setup keys, tokens, PAT values — and
     keep peer IPs and hostnames out of logs above debug level.
 
-## Type safety
-
-**No bare primitives for domain concepts.** A `string` parameter for an account
-ID next to a `string` parameter for a peer ID is two bugs waiting to happen,
-because the compiler cannot catch the swap. Declare the type once and use it
-throughout, converting only at the boundaries where data enters or leaves —
-protobuf, gRPC, HTTP, an external library.
-
-```go
-type ServiceID string
-type AccountID string
-
-// Internal: typed all the way through
-func (r *Router) RemoveRoute(host SNIHost, svcID ServiceID) { ... }
-
-// Proto boundary: convert once, on the way in and on the way out
-svcID := ServiceID(mapping.GetId())
-req.ServiceId = string(svcID)
-```
-
-- **IP addresses are `netip.Addr`**, not `string` and not `net.IP`. Parse at the
-  boundary and pass the typed value inward.
-- **Always `Unmap()`** after parsing an address, after converting from `net.IP`,
-  and after extracting one from `RemoteAddr()`. This normalizes a v4-mapped v6
-  address (`::ffff:10.1.2.3`) to plain v4 so IPv4 rules match it. A stored or
-  compared mapped address silently fails to match those rules.
-- **Ports are `uint16`** internally; use `int` only where a library forces it and
-  convert immediately.
-- **Enums are a typed string with constants**, so the valid set is discoverable
-  and a typo fails to compile.
-- **Map keys follow the same rule**, and must be a real type (`type ServiceID
-  string`) rather than an alias (`type serviceID = string`) — an alias silently
-  accepts bare strings.
-
-## Concurrency and lifecycle
-
-Beyond the mutex hygiene in the principles above, check for these failure
-modes.
-
-- **Never read a struct field inside a goroutine** when another goroutine may nil
-  or reassign it. Pass the value as a parameter, or capture it into a local before
-  launching. This matters most when `Stop()` nils a field without waiting for the
-  goroutine to finish.
-
-  ```go
-  go func(ifaceName string) {   // good: passed in, cannot be nilled underneath
-      m.Start(ctx, ifaceName)
-  }(iface.Name())
-  ```
-
-- **Never wait on a channel while holding a lock the sender needs.** Copy what you
-  need out from under the lock, release it, then wait.
-
-  ```go
-  func (m *Manager) Stop() {
-      m.mu.Lock()
-      cancel, done := m.cancel, m.done
-      m.mu.Unlock()
-      if cancel != nil {
-          cancel()
-          <-done
-      }
-  }
-  ```
-
-- **`Stop`/`Close` must be idempotent** — guard on an already-stopped flag or a
-  nil cancel — and must release the state they guarded. Clear maps and caches;
-  a cancelled goroutine holding a live map still pins that memory. Note that a
-  nil map only panics on writes; reads and iteration behave like an empty map,
-  so where post-close use must be rejected, check the stopped flag explicitly.
-- **Publish coupled state only after every fallible step succeeds.** When several
-  fields form an invariant, build them into locals and assign them to the receiver
-  at the end. Assigning as you go leaves the object half-initialized when a later
-  step fails, so a readiness predicate reports ready while a coupled field is nil.
-  If an earlier step already had an external side effect — a created chain, an
-  opened handle, an inserted rule — roll it back before returning the error.
-- **Clean up what you own on constructor error paths.** Once a constructor has
-  started something, every later error path must undo it: cancel a goroutine and
-  wait for it to exit, stop a ticker, close a watcher. The object is never
-  returned, so its `Close` will never run.
-- **A failed `Start` must undo everything it started.** When a component brings up
-  several subsystems in sequence — connection manager, watchers, routing, DNS,
-  flow, persisted state — a failure partway through has to tear down the ones
-  already running, not just close the handle the error came from. Put the
-  already-started guard *before* that teardown path, so a rejected second `Start`
-  cannot dismantle the one that is running.
-
 ## Error handling
 
 Use single-assignment form when the error is only needed inside the `if`:
@@ -454,45 +248,6 @@ Log the errors you choose not to act on:
 - Close errors may be ignored for read-only operations; log them at debug for
   writes.
 
-**Do not log and return the same error.** It gets reported twice, from two places,
-and the second reader cannot tell whether it happened once or twice. Return it and
-let the caller decide. The exception is an API handler that has already written a
-response. Internal helpers return errors rather than logging and swallowing them.
-
-**Never return a typed nil as an error.** A nil `*MyError` stored in an `error`
-interface is not nil, so `err != nil` is true and callers take the failure path on
-success. Return the error only where it is actually set:
-
-```go
-if _, err := conn.Write(buf); err != nil {   // good
-    return err
-}
-return nil
-```
-
-**Accumulate with `multierror` when an operation should continue past individual
-failures** — teardown, cleanup, or setup where partial success is acceptable.
-`client/errors.FormatErrorOrNil` returns nil for an empty accumulator, so callers
-still see a plain nil on full success:
-
-```go
-func (m *Manager) Cleanup() error {
-    var merr *multierror.Error
-    for _, r := range m.resources {
-        if err := r.Close(); err != nil {
-            merr = multierror.Append(merr, fmt.Errorf("close %s: %w", r.Name, err))
-        }
-    }
-    return nberrors.FormatErrorOrNil(merr)
-}
-```
-
-| Scenario              | Approach              | Why                                       |
-| --------------------- | --------------------- | ----------------------------------------- |
-| Cleanup / teardown    | Accumulate            | Clean up as much as possible              |
-| Setup with rollback   | Abort on first error  | Partial state is invalid; undo what stuck |
-| Setup with partial OK | Accumulate            | Degraded operation is still useful        |
-
 ## Comments
 
 Comment the **why**, never the **what**. Default to no comment, and add one only
@@ -514,14 +269,10 @@ checksum = updateChecksum(checksum, oldPort, newPort)
 
 ### Length budget
 
-Neither of these is linter-enforced, so they are conventions the surrounding code
-mostly follows rather than hard limits:
-
-- **Around 90 characters per line.** Wrap the comment rather than running well past
-  it.
-- **Roughly 250 characters per comment**, about three wrapped lines. Doc comments
-  on exported identifiers may exceed it when the API genuinely needs the
-  explanation; inline comments inside a function body rarely should.
+- **90 characters per line.** Wrap the comment, do not run past it.
+- **250 characters per comment**, roughly three wrapped lines. Doc comments on
+  exported identifiers may exceed it when the API genuinely needs the
+  explanation; inline comments inside a function body may not.
 
 The budget is a smell detector, not a rule to game. Do not compress a needed
 explanation into cryptic shorthand to fit — if a block of code needs more than
@@ -578,19 +329,6 @@ up, and the 250-character budget does not apply to them.
   otherwise.
 - **Message guidance:** optional for `NoError`/`Error`; always give context for
   comparison, boolean, and collection assertions.
-- **Reproduce a bug before fixing it.** Write the test, watch it fail *for the
-  reason you expect* — a test that fails for an unrelated reason proves nothing —
-  then apply the fix and confirm it passes. Add the thin surrounding cases while
-  you are there.
-- **Use `t.Setenv`** rather than `os.Setenv` so the previous value is restored on
-  cleanup. To test the unset case, call `t.Setenv` first to register the restore,
-  then `os.Unsetenv`.
-- **Prefer `t.Cleanup` over `defer`** in any test with parallel subtests: the
-  parent function returns, running its `defer`s, while parallel subtests are
-  still suspended. Sequential subtests finish inside `t.Run`, so `defer` is safe
-  there, but `t.Cleanup` works in both cases.
-- **Explanatory comments in tests are welcome.** Describe the scenario being set
-  up; the comment budget below does not apply to them.
 
 ```go
 server, err := StartTestServer()
@@ -642,8 +380,7 @@ assert.Equal(t, expectedResult, result, "Result should match expected")
   than replacing it with your own summary: describe the change, link the issue,
   tick the checklist honestly (including "ran locally" and "single purpose"),
   and complete the documentation section. Do not tick a box you have not
-  verified, and do not delete rows that do not apply — the docs gate in CI reads
-  that section and fails when it is missing.
+  verified, and do not delete rows that do not apply.
 
 - **Keep the PR description short.** Under 1000 words on top of the template's
   own text, and usually far less — a few paragraphs. Reviewers read the diff;
@@ -702,12 +439,6 @@ assert.Equal(t, expectedResult, result, "Result should match expected")
   on their own. Propose that split to the user rather than opening one large PR
   and hoping.
 
-  Prefer GitHub's stacked pull requests for such a sequence, rather than
-  hand-managing base branches: open each PR against the branch below it instead of
-  `main`, so every PR's diff shows only its own change. Merging a layer retargets
-  the PRs above it, and branch protections and required checks on the base branch
-  still apply to each one.
-
 - **User-facing changes need a docs PR** in
   [netbirdio/docs](https://github.com/netbirdio/docs), linked from the PR
   description.

client/firewall/firewalld/firewalld.go

@@ -2,8 +2,8 @@
 // its wg interface into firewalld's "trusted" zone. This is required because
 // firewalld's nftables chains are created with NFT_CHAIN_OWNER on recent
 // versions, which returns EPERM to any other process that tries to insert
-// rules into them. Trusting the interface makes firewalld itself add the
-// accept rules to its own chains instead.
+// rules into them. The workaround mirrors what Tailscale does: let firewalld
+// itself add the accept rules to its own chains by trusting the interface.
 package firewalld
 
 // TrustedZone is the firewalld zone name used for interfaces whose traffic

client/ui/frontend/src/components/ReadySignal.tsx

@@ -1,18 +0,0 @@
-import { useEffect, useRef } from "react";
-import { Events } from "@wailsio/runtime";
-import { useStatus } from "@/contexts/StatusContext.tsx";
-
-const EVENT_WINDOW_PAINTED = "netbird:window-painted";
-
-export const ReadySignal = () => {
-    const { isReady } = useStatus();
-    const sent = useRef(false);
-
-    useEffect(() => {
-        if (!isReady || sent.current) return;
-        sent.current = true;
-        void Events.Emit(EVENT_WINDOW_PAINTED);
-    }, [isReady]);
-
-    return null;
-};

client/ui/frontend/src/hooks/useKeepConnectedOnQuit.ts

@@ -1,35 +0,0 @@
-import { useCallback, useEffect, useState } from "react";
-import { Preferences } from "@bindings/services";
-
-export const useKeepConnectedOnQuit = () => {
-    const [keepConnected, setKeepConnected] = useState<boolean | null>(null);
-
-    useEffect(() => {
-        let cancelled = false;
-        Preferences.Get()
-            .then((prefs) => {
-                if (cancelled) return;
-                setKeepConnected(prefs?.keepConnectedOnQuit ?? false);
-            })
-            .catch((err: unknown) => {
-                if (cancelled) return;
-                console.warn("[useKeepConnectedOnQuit] load preferences failed", err);
-                setKeepConnected(false);
-            });
-        return () => {
-            cancelled = true;
-        };
-    }, []);
-
-    const setKeepConnectedOnQuit = useCallback(async (keep: boolean) => {
-        setKeepConnected(keep);
-        try {
-            await Preferences.SetKeepConnectedOnQuit(keep);
-        } catch (err: unknown) {
-            setKeepConnected(!keep);
-            console.error("[useKeepConnectedOnQuit] SetKeepConnectedOnQuit failed", err);
-        }
-    }, []);
-
-    return { keepConnected, setKeepConnectedOnQuit };
-};

client/ui/frontend/src/layouts/AppLayout.tsx

@@ -5,7 +5,6 @@ import { DebugBundleProvider } from "@/contexts/DebugBundleContext.tsx";
 import { ProfileProvider } from "@/contexts/ProfileContext.tsx";
 import { DialogProvider } from "@/contexts/DialogContext.tsx";
 import { RestrictionsProvider } from "@/contexts/RestrictionsContext.tsx";
-import { ReadySignal } from "@/components/ReadySignal.tsx";
 
 export const AppLayout = () => {
     return (
@@ -17,7 +16,6 @@ export const AppLayout = () => {
                             <DebugBundleProvider>
                                 <ClientVersionProvider>
                                     <Outlet />
-                                    <ReadySignal />
                                 </ClientVersionProvider>
                             </DebugBundleProvider>
                         </RestrictionsProvider>

client/ui/frontend/src/modules/settings/SettingsGeneral.tsx

@@ -11,7 +11,6 @@ import { ManagementServerSwitch } from "@/components/ManagementServerSwitch.tsx"
 import { ManagementMode, useManagementUrl } from "@/hooks/useManagementUrl.ts";
 import { LanguagePicker } from "@/components/LanguagePicker.tsx";
 import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
-import { useKeepConnectedOnQuit } from "@/hooks/useKeepConnectedOnQuit.ts";
 
 export function SettingsGeneral() {
     const { t } = useTranslation();
@@ -20,7 +19,6 @@ export function SettingsGeneral() {
     const { mode, setMode, setUrl, displayUrl, showError, canSave, save, checking, unreachable } =
         useManagementUrl();
     const { mdm, features } = useRestrictions();
-    const { keepConnected, setKeepConnectedOnQuit } = useKeepConnectedOnQuit();
 
     const inputRef = useRef<HTMLInputElement>(null);
     const managementUrlId = useId();
@@ -59,15 +57,6 @@ export function SettingsGeneral() {
                         helpText={t("settings.general.autostart.help")}
                     />
                 )}
-                <FancyToggleSwitch
-                    value={keepConnected ?? false}
-                    onChange={(v) => {
-                        void setKeepConnectedOnQuit(v);
-                    }}
-                    loading={keepConnected === null}
-                    label={t("settings.general.keepConnectedOnQuit.label")}
-                    helpText={t("settings.general.keepConnectedOnQuit.help")}
-                />
             </SectionGroup>
 
             {!mdm.managementURL && !features.disableUpdateSettings && (

client/ui/i18n/locales/de/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Ändern des Autostarts fehlgeschlagen"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Nach dem Beenden verbunden bleiben",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "Die Verbindung bleibt im Hintergrund bestehen, nachdem Sie NetBird schließen. Sie endet erst, wenn Sie sie selbst trennen.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Anzeigesprache"
     },

client/ui/i18n/locales/en/common.json

@@ -735,14 +735,6 @@
         "message": "Autostart Change Failed",
         "description": "Error-dialog title when changing the autostart setting fails."
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Stay Connected After Quitting",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "The connection stays up in the background after you close NetBird. It only stops when you disconnect it yourself.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Display Language",
         "description": "Label for the display-language picker."

client/ui/i18n/locales/es/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Error al cambiar el inicio automático"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Permanecer conectado al salir",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La conexión sigue activa en segundo plano después de cerrar NetBird. Solo se detiene cuando la desconectas tú.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Idioma de la interfaz"
     },

client/ui/i18n/locales/fr/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Échec de la modification du démarrage automatique"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Rester connecté après la fermeture",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La connexion reste active en arrière-plan après la fermeture de NetBird. Elle ne s'arrête que si vous la coupez vous-même.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Langue d’affichage"
     },

client/ui/i18n/locales/hu/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Az automatikus indítás módosítása sikertelen"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Kapcsolat megtartása kilépéskor",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "A kapcsolat a háttérben megmarad, miután bezárod a NetBirdöt. Csak akkor szakad meg, ha te magad bontod.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Megjelenítési nyelv"
     },

client/ui/i18n/locales/it/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Modifica avvio automatico non riuscita"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Resta connesso dopo la chiusura",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "La connessione resta attiva in background dopo la chiusura di NetBird. Si interrompe solo quando la disconnetti tu.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Lingua dell'interfaccia"
     },

client/ui/i18n/locales/ja/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "自動起動の変更に失敗しました"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "終了後も接続を維持",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "NetBird を閉じたあとも接続はバックグラウンドで維持されます。自分で切断したときにだけ停止します。",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "表示言語"
     },

client/ui/i18n/locales/pt/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Falha ao alterar o início automático"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Permanecer conectado ao sair",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "A conexão continua ativa em segundo plano depois de fechar o NetBird. Ela só para quando você mesmo a desconecta.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Idioma de exibição"
     },

client/ui/i18n/locales/ru/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "Не удалось изменить автозапуск"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "Оставаться подключённым после выхода",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "Соединение остаётся активным в фоне после закрытия NetBird. Оно прервётся, только когда вы отключите его сами.",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "Язык интерфейса"
     },

client/ui/i18n/locales/zh-CN/common.json

@@ -551,14 +551,6 @@
     "settings.general.autostart.errorTitle": {
         "message": "更改自启动设置失败"
     },
-    "settings.general.keepConnectedOnQuit.label": {
-        "message": "退出后保持连接",
-        "description": "Toggle label: keep the VPN connection up after quitting the UI."
-    },
-    "settings.general.keepConnectedOnQuit.help": {
-        "message": "关闭 NetBird 后，连接会在后台保持。只有你自己断开时才会停止。",
-        "description": "Helper text for the stay-connected-after-quitting toggle."
-    },
     "settings.general.language.label": {
         "message": "显示语言"
     },

client/ui/main.go

@@ -95,10 +95,6 @@ func main() {
 		}
 	})
 
-	// Debug patch, not for release: dumps heap/goroutine profiles and the
-	// process tree to /tmp/nbgui for the memory consumption investigation.
-	startMemProfiler(app)
-
 	profiles := services.NewProfiles(conn)
 	// updater.Holder owns the typed update State; DaemonFeed feeds it and the
 	// Update service is a thin Wails-bound facade over it plus the install RPCs.
@@ -143,11 +139,13 @@ func main() {
 		prefStore:       prefStore,
 	})
 
-	windowManager := services.NewWindowManager(app, nil, bundle, prefStore, iconWindow)
-	windowManager.SetMainFactory(func() *application.WebviewWindow {
-		return newMainWindow(app, prefStore, windowManager)
-	})
-	registerDockReopenHook(app, windowManager)
+	window := newMainWindow(app, prefStore)
+
+	// Settings is created eagerly (hidden) so the first gear click paints
+	// instantly and React keeps per-tab state across reopens. The other
+	// auxiliary windows stay lazy + destroy-on-close so Wails's macOS
+	// dock-reopen handler can't resurrect them.
+	windowManager := services.NewWindowManager(app, window, bundle, prefStore, iconWindow)
 	// Minimal WMs (XEmbed-tray path) neither center small windows nor restore
 	// position across hide -> show, dropping them top-left. Gate Go-side
 	// re-centering on that environment; nil leaves placement to the WM on full
@@ -170,7 +168,7 @@ func main() {
 	// RegisterStatusNotifierItem hits a watcher we control.
 	startStatusNotifierWatcher()
 
-	tray = NewTray(app, nil, TrayServices{
+	tray = NewTray(app, window, TrayServices{
 		Connection:      connection,
 		Settings:        settings,
 		Profiles:        profiles,
@@ -182,7 +180,6 @@ func main() {
 		WindowManager:   windowManager,
 		Session:         authSession,
 		Localizer:       localizer,
-		Preferences:     prefStore,
 	})
 	listenForShowSignal(context.Background(), tray)
 
@@ -340,7 +337,9 @@ func registerServices(app *application.App, conn *Conn, s registeredServices) {
 	app.RegisterService(application.NewService(s.compat))
 }
 
-func newMainWindow(app *application.App, prefStore *preferences.Store, wm *services.WindowManager) *application.WebviewWindow {
+// newMainWindow creates the hidden main window, sized to the user's last view
+// mode, and installs the hide-on-close and macOS dock-reopen hooks.
+func newMainWindow(app *application.App, prefStore *preferences.Store) *application.WebviewWindow {
 	// Width matches the last view mode so Advanced-mode users don't see the
 	// window pop from 380px to 900px on launch. Height is mode-agnostic.
 	initialWidth := 380
@@ -368,25 +367,29 @@ func newMainWindow(app *application.App, prefStore *preferences.Store, wm *servi
 		},
 	})
 
-	window.RegisterHook(events.Common.WindowClosing, func(_ *application.WindowEvent) {
+	// Hide instead of quit on close; "really quit" is reached via tray -> Quit.
+	window.RegisterHook(events.Common.WindowClosing, func(e *application.WindowEvent) {
 		if services.ShuttingDown() {
 			return
 		}
-		wm.ForgetMain()
+		e.Cancel()
+		window.Hide()
 	})
 
+	// On macOS, Wails' default applicationShouldHandleReopen handler Show()s
+	// every hidden window on dock-icon click, resurrecting hide-on-close
+	// surfaces like Settings. Cancel it in a hook (hooks run before listeners)
+	// and show only the main window. No-op elsewhere — the event never fires.
+	if runtime.GOOS == "darwin" {
+		app.Event.RegisterApplicationEventHook(events.Mac.ApplicationShouldHandleReopen, func(e *application.ApplicationEvent) {
+			e.Cancel()
+			if e.Context().HasVisibleWindows() {
+				return
+			}
+			window.Show()
+			window.Focus()
+		})
+	}
+
 	return window
 }
-
-func registerDockReopenHook(app *application.App, wm *services.WindowManager) {
-	if runtime.GOOS != "darwin" {
-		return
-	}
-	app.Event.RegisterApplicationEventHook(events.Mac.ApplicationShouldHandleReopen, func(e *application.ApplicationEvent) {
-		e.Cancel()
-		if e.Context().HasVisibleWindows() {
-			return
-		}
-		wm.ShowMain()
-	})
-}

client/ui/memprof.go

@@ -1,319 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"bufio"
-	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
-	"runtime/pprof"
-	"strconv"
-	"strings"
-	"time"
-
-	"github.com/shirou/gopsutil/v4/process"
-	log "github.com/sirupsen/logrus"
-	"github.com/wailsapp/wails/v3/pkg/application"
-	"github.com/wailsapp/wails/v3/pkg/events"
-)
-
-// memProfOffsets are the snapshot times measured from application startup.
-var memProfOffsets = []time.Duration{0, 2 * time.Minute, 5 * time.Minute}
-
-// memProfMaxDepth bounds the child walk so a cycle in the reported parent links
-// cannot spin forever.
-const memProfMaxDepth = 4
-
-type memProfileSpec struct {
-	profile string
-	file    string
-	debug   int
-}
-
-var memProfileSpecs = []memProfileSpec{
-	{profile: "heap", file: "heap.pprof", debug: 0},
-	{profile: "heap", file: "heap.txt", debug: 1},
-	{profile: "goroutine", file: "goroutine.txt", debug: 1},
-	{profile: "threadcreate", file: "threadcreate.txt", debug: 1},
-}
-
-var memProfStart = time.Now()
-
-// startMemProfiler dumps a profile snapshot at every memProfOffsets mark, each
-// into its own timestamped directory under memProfBaseDir. The first runs once
-// the application is up so the window inventory sees the eagerly created
-// windows. Every failure is logged and never stops the GUI.
-func startMemProfiler(app *application.App) {
-	log.Infof("memory profiler enabled, writing to %s (snapshots at %v after startup)", memProfBaseDir(), memProfOffsets)
-
-	app.Event.OnApplicationEvent(events.Common.ApplicationStarted, func(*application.ApplicationEvent) {
-		go func() {
-			started := time.Now()
-			for _, offset := range memProfOffsets {
-				if wait := time.Until(started.Add(offset)); wait > 0 {
-					time.Sleep(wait)
-				}
-				writeMemProfile(app)
-			}
-		}()
-	})
-}
-
-// memProfBaseDir returns the directory holding the snapshot directories.
-func memProfBaseDir() string {
-	if runtime.GOOS == "windows" {
-		return filepath.Join(os.TempDir(), "nbgui")
-	}
-	return "/tmp/nbgui"
-}
-
-// writeMemProfile creates a <timestamp>-<pid> directory and fills it with the
-// runtime profiles, the memory statistics summary and the process tree.
-func writeMemProfile(app *application.App) {
-	name := fmt.Sprintf("%s-%d", time.Now().Format("20060102-150405"), os.Getpid())
-	dir := filepath.Join(memProfBaseDir(), name)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		log.Warnf("create memory profile dir %s: %v", dir, err)
-		return
-	}
-
-	// The heap profile reports live objects as of the last collection, so force
-	// one to keep inuse_space from counting garbage that is already unreachable.
-	runtime.GC()
-
-	if err := writeMemStats(filepath.Join(dir, "memstats.txt"), app); err != nil {
-		log.Warnf("write memory statistics: %v", err)
-	}
-
-	if err := writeProcTree(filepath.Join(dir, "proctree.txt")); err != nil {
-		log.Warnf("write process tree: %v", err)
-	}
-
-	for _, spec := range memProfileSpecs {
-		if err := writeMemProfileFile(spec, filepath.Join(dir, spec.file)); err != nil {
-			log.Warnf("write %s profile: %v", spec.profile, err)
-		}
-	}
-
-	log.Infof("memory profile written to %s", dir)
-}
-
-// writeMemProfileFile writes a single runtime profile to path.
-func writeMemProfileFile(spec memProfileSpec, path string) error {
-	p := pprof.Lookup(spec.profile)
-	if p == nil {
-		return fmt.Errorf("unknown profile %q", spec.profile)
-	}
-
-	f, err := os.Create(path)
-	if err != nil {
-		return fmt.Errorf("create %s: %w", path, err)
-	}
-	defer func() {
-		if err := f.Close(); err != nil {
-			log.Debugf("close %s: %v", path, err)
-		}
-	}()
-
-	if err := p.WriteTo(f, spec.debug); err != nil {
-		return fmt.Errorf("write %s: %w", path, err)
-	}
-	return nil
-}
-
-// writeMemStats dumps the runtime memory statistics next to the process
-// resident set size. A resident set much larger than Sys means the memory sits
-// outside the Go heap (webview, GTK, other cgo allocations), where the pprof
-// profiles cannot see it.
-func writeMemStats(path string, app *application.App) error {
-	var m runtime.MemStats
-	runtime.ReadMemStats(&m)
-
-	var b strings.Builder
-	fmt.Fprintf(&b, "time:           %s\n", time.Now().Format(time.RFC3339))
-	fmt.Fprintf(&b, "uptime:         %s\n", time.Since(memProfStart).Round(time.Second))
-	fmt.Fprintf(&b, "pid:            %d\n", os.Getpid())
-	fmt.Fprintf(&b, "\n")
-
-	rss, vms := processMemory()
-	fmt.Fprintf(&b, "process_rss:    %s\n", rss)
-	fmt.Fprintf(&b, "process_vms:    %s\n", vms)
-	fmt.Fprintf(&b, "\n")
-
-	fmt.Fprintf(&b, "sys:            %s\n", formatMemBytes(m.Sys))
-	fmt.Fprintf(&b, "heap_alloc:     %s\n", formatMemBytes(m.HeapAlloc))
-	fmt.Fprintf(&b, "heap_sys:       %s\n", formatMemBytes(m.HeapSys))
-	fmt.Fprintf(&b, "heap_inuse:     %s\n", formatMemBytes(m.HeapInuse))
-	fmt.Fprintf(&b, "heap_idle:      %s\n", formatMemBytes(m.HeapIdle))
-	fmt.Fprintf(&b, "heap_released:  %s\n", formatMemBytes(m.HeapReleased))
-	fmt.Fprintf(&b, "heap_objects:   %d\n", m.HeapObjects)
-	fmt.Fprintf(&b, "stack_inuse:    %s\n", formatMemBytes(m.StackInuse))
-	fmt.Fprintf(&b, "stack_sys:      %s\n", formatMemBytes(m.StackSys))
-	fmt.Fprintf(&b, "mspan_sys:      %s\n", formatMemBytes(m.MSpanSys))
-	fmt.Fprintf(&b, "mcache_sys:     %s\n", formatMemBytes(m.MCacheSys))
-	fmt.Fprintf(&b, "gc_sys:         %s\n", formatMemBytes(m.GCSys))
-	fmt.Fprintf(&b, "other_sys:      %s\n", formatMemBytes(m.OtherSys))
-	fmt.Fprintf(&b, "next_gc:        %s\n", formatMemBytes(m.NextGC))
-	fmt.Fprintf(&b, "num_gc:         %d\n", m.NumGC)
-	fmt.Fprintf(&b, "\n")
-
-	fmt.Fprintf(&b, "goroutines:     %d\n", runtime.NumGoroutine())
-	fmt.Fprintf(&b, "cgo_calls:      %d\n", runtime.NumCgoCall())
-	fmt.Fprintf(&b, "gomaxprocs:     %d\n", runtime.GOMAXPROCS(0))
-	fmt.Fprintf(&b, "\n")
-
-	writeWindowInventory(&b, app)
-
-	if err := os.WriteFile(path, []byte(b.String()), 0o644); err != nil {
-		return fmt.Errorf("write %s: %w", path, err)
-	}
-	return nil
-}
-
-// writeWindowInventory lists the live Wails windows. A window that exists holds
-// a webview process even while hidden, so this tells apart a leaked window (the
-// count grows) from windows whose content grew (the count stays put).
-func writeWindowInventory(b *strings.Builder, app *application.App) {
-	windows := app.Window.GetAll()
-	fmt.Fprintf(b, "windows:        %d\n", len(windows))
-	for _, w := range windows {
-		visible := "unknown"
-		if ww, ok := w.(*application.WebviewWindow); ok {
-			visible = strconv.FormatBool(ww.IsVisible())
-		}
-		fmt.Fprintf(b, "  id=%-3d name=%-20q visible=%-7s minimised=%-5t focused=%t\n",
-			w.ID(), w.Name(), visible, w.IsMinimised(), w.IsFocused())
-	}
-}
-
-// writeProcTree dumps this process and its descendants with their memory
-// footprint. The webview runs in child processes whose memory the Go runtime
-// profiles cannot see, so this is what attributes a footprint to a component.
-func writeProcTree(path string) error {
-	self, err := process.NewProcess(int32(os.Getpid()))
-	if err != nil {
-		return fmt.Errorf("open own process: %w", err)
-	}
-
-	var b strings.Builder
-	fmt.Fprintf(&b, "time: %s\n", time.Now().Format(time.RFC3339))
-	fmt.Fprintf(&b, "uptime: %s\n\n", time.Since(memProfStart).Round(time.Second))
-	fmt.Fprintf(&b, "%-8s %-8s %-28s %12s %12s %12s %12s\n", "PID", "PPID", "NAME", "RSS", "VMS", "PSS", "PRIV_DIRTY")
-
-	var totalRSS, totalPSS, totalPrivate uint64
-	walkProcTree(&b, self, 0, &totalRSS, &totalPSS, &totalPrivate)
-
-	fmt.Fprintf(&b, "\n%-8s %-8s %-28s %12s %12s %12s %12s\n", "", "", "TOTAL",
-		formatKB(totalRSS), "", formatKB(totalPSS), formatKB(totalPrivate))
-	fmt.Fprintf(&b, "\nPSS and PRIV_DIRTY come from /proc/<pid>/smaps_rollup and are Linux only.\n")
-
-	if err := os.WriteFile(path, []byte(b.String()), 0o644); err != nil {
-		return fmt.Errorf("write %s: %w", path, err)
-	}
-	return nil
-}
-
-// walkProcTree appends one line per process, depth-first, accumulating totals.
-func walkProcTree(b *strings.Builder, p *process.Process, depth int, totalRSS, totalPSS, totalPrivate *uint64) {
-	name, err := p.Name()
-	if err != nil {
-		name = "unknown"
-	}
-
-	var rss, vms uint64
-	if info, err := p.MemoryInfo(); err == nil {
-		rss, vms = info.RSS, info.VMS
-	}
-
-	pss, private := smapsRollup(p.Pid)
-	*totalRSS += rss
-	*totalPSS += pss
-	*totalPrivate += private
-
-	ppid, err := p.Ppid()
-	if err != nil {
-		ppid = -1
-	}
-
-	fmt.Fprintf(b, "%-8d %-8d %-28s %12s %12s %12s %12s\n", p.Pid, ppid,
-		strings.Repeat("  ", depth)+name, formatKB(rss), formatKB(vms), formatKB(pss), formatKB(private))
-
-	if depth >= memProfMaxDepth {
-		return
-	}
-
-	children, err := p.Children()
-	if err != nil {
-		return
-	}
-	for _, child := range children {
-		walkProcTree(b, child, depth+1, totalRSS, totalPSS, totalPrivate)
-	}
-}
-
-// smapsRollup returns the proportional set size and private dirty bytes of pid,
-// both zero on platforms without /proc.
-func smapsRollup(pid int32) (uint64, uint64) {
-	f, err := os.Open(fmt.Sprintf("/proc/%d/smaps_rollup", pid))
-	if err != nil {
-		return 0, 0
-	}
-	defer func() {
-		if err := f.Close(); err != nil {
-			log.Debugf("close smaps_rollup for %d: %v", pid, err)
-		}
-	}()
-
-	var pss, private uint64
-	scanner := bufio.NewScanner(f)
-	for scanner.Scan() {
-		fields := strings.Fields(scanner.Text())
-		if len(fields) < 2 {
-			continue
-		}
-		kb, err := strconv.ParseUint(fields[1], 10, 64)
-		if err != nil {
-			continue
-		}
-		switch fields[0] {
-		case "Pss:":
-			pss = kb * 1024
-		case "Private_Dirty:":
-			private = kb * 1024
-		}
-	}
-	return pss, private
-}
-
-// processMemory returns the formatted resident and virtual size of this process.
-func processMemory() (string, string) {
-	p, err := process.NewProcess(int32(os.Getpid()))
-	if err != nil {
-		unavailable := fmt.Sprintf("unavailable (%v)", err)
-		return unavailable, unavailable
-	}
-
-	info, err := p.MemoryInfo()
-	if err != nil {
-		unavailable := fmt.Sprintf("unavailable (%v)", err)
-		return unavailable, unavailable
-	}
-
-	return formatMemBytes(info.RSS), formatMemBytes(info.VMS)
-}
-
-// formatMemBytes renders a byte count as megabytes with the raw value kept.
-func formatMemBytes(n uint64) string {
-	return fmt.Sprintf("%8.1f MB (%d bytes)", float64(n)/(1024*1024), n)
-}
-
-// formatKB renders a byte count as megabytes for the process tree columns, and
-// a dash when the platform did not report the value.
-func formatKB(n uint64) string {
-	if n == 0 {
-		return "-"
-	}
-	return fmt.Sprintf("%.1f MB", float64(n)/(1024*1024))
-}

client/ui/preferences/store.go

@@ -58,10 +58,6 @@ type UIPreferences struct {
 	// decision has run for this OS user. It only ever transitions to true
 	// and is never reset, so the default-on flow runs at most once, ever.
 	AutostartInitialized bool `json:"autostartInitialized"`
-	// KeepConnectedOnQuit leaves the daemon connected when the GUI quits.
-	// Its false zero value preserves the historical disconnect-on-quit
-	// behaviour for preference files written before the field existed.
-	KeepConnectedOnQuit bool `json:"keepConnectedOnQuit"`
 }
 
 // LanguageValidator rejects SetLanguage inputs with no shipped bundle.
@@ -187,26 +183,6 @@ func (s *Store) SetAutostartInitialized(done bool) error {
 	return nil
 }
 
-// SetKeepConnectedOnQuit persists the disconnect-on-quit opt-out. No-op if unchanged.
-func (s *Store) SetKeepConnectedOnQuit(keep bool) error {
-	s.mu.Lock()
-	if s.current.KeepConnectedOnQuit == keep {
-		s.mu.Unlock()
-		return nil
-	}
-	next := s.current
-	next.KeepConnectedOnQuit = keep
-	if err := s.persistLocked(next); err != nil {
-		s.mu.Unlock()
-		return fmt.Errorf("persist preferences: %w", err)
-	}
-	s.current = next
-	s.mu.Unlock()
-
-	s.broadcast(next)
-	return nil
-}
-
 // SetLanguage validates, persists, and broadcasts. No-op if unchanged.
 func (s *Store) SetLanguage(lang i18n.LanguageCode) error {
 	if lang == "" {

client/ui/preferences/store_test.go

@@ -238,42 +238,6 @@ func TestStore_SetAutostartInitializedPersistsAcrossReload(t *testing.T) {
 	assert.True(t, reloaded.Get().AutostartInitialized, "marker must survive a reload from disk")
 }
 
-func TestStore_SetKeepConnectedOnQuitPersistsAcrossReload(t *testing.T) {
-	withTempConfigDir(t)
-	emitter := &recordingEmitter{}
-	s, err := NewStore(nil, emitter)
-	require.NoError(t, err)
-
-	assert.False(t, s.Get().KeepConnectedOnQuit, "quitting must disconnect by default")
-
-	require.NoError(t, s.SetKeepConnectedOnQuit(true))
-	assert.True(t, s.Get().KeepConnectedOnQuit, "Get should reflect the persisted opt-out")
-	require.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "first write should broadcast")
-
-	require.NoError(t, s.SetKeepConnectedOnQuit(true))
-	assert.Len(t, emitter.calledWith(EventPreferencesChanged), 1, "idempotent write should not broadcast again")
-
-	reloaded, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.True(t, reloaded.Get().KeepConnectedOnQuit, "opt-out must survive a reload from disk")
-}
-
-func TestStore_KeepConnectedOnQuitDefaultsFalseForPreExistingFile(t *testing.T) {
-	withTempConfigDir(t)
-
-	// A preferences file written before the field existed must keep the
-	// historical disconnect-on-quit behaviour rather than silently opting out.
-	path, err := preferencesPath()
-	require.NoError(t, err)
-	require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
-	require.NoError(t, os.WriteFile(path, []byte(`{"language":"en","viewMode":"default"}`), 0o600))
-
-	s, err := NewStore(nil, nil)
-	require.NoError(t, err)
-	assert.False(t, s.Get().KeepConnectedOnQuit, "a file predating the field must not opt out of disconnect-on-quit")
-	assert.True(t, s.ExistedAtLoad(), "the pre-existing file must be seen on disk")
-}
-
 func TestStore_ExistedAtLoad(t *testing.T) {
 	withTempConfigDir(t)
 

client/ui/services/cursor_linux.go

@@ -49,11 +49,5 @@ func getCursorPosition(app *application.App) (application.Point, bool) {
 	if app == nil || app.Screen == nil {
 		return p, true
 	}
-	// The wails GTK3 backend caches screens from the active window; a tray app
-	// has none at startup, so the cache is empty and PhysicalToDipPoint would
-	// dereference a nil nearest screen. Raw pixels are correct there anyway.
-	if app.Screen.ScreenNearestPhysicalPoint(p) == nil {
-		return p, true
-	}
 	return app.Screen.PhysicalToDipPoint(p), true
 }

client/ui/services/preferences.go

@@ -34,7 +34,3 @@ func (s *Preferences) SetViewMode(_ context.Context, mode preferences.ViewMode)
 func (s *Preferences) SetOnboardingCompleted(_ context.Context, done bool) error {
 	return s.store.SetOnboardingCompleted(done)
 }
-
-func (s *Preferences) SetKeepConnectedOnQuit(_ context.Context, keep bool) error {
-	return s.store.SetKeepConnectedOnQuit(keep)
-}

client/ui/services/windowmanager.go

@@ -8,7 +8,6 @@ import (
 	"sync"
 	"time"
 
-	log "github.com/sirupsen/logrus"
 	"github.com/wailsapp/wails/v3/pkg/application"
 	"github.com/wailsapp/wails/v3/pkg/events"
 
@@ -30,10 +29,6 @@ const EventBrowserLoginCancel = "browser-login:cancel"
 // EventSettingsOpen tells the mounted settings window which tab to show.
 const EventSettingsOpen = "netbird:settings:open"
 
-const EventWindowPainted = "netbird:window-painted"
-
-const paintedFallback = 2 * time.Second
-
 var WindowBackgroundColour = application.NewRGB(24, 26, 29) // bg-nb-gray-950
 
 // WindowHeight is shared by the main and Settings windows.
@@ -99,6 +94,9 @@ func DialogWindowOptions(name, title, url string, linuxIcon []byte) application.
 	}
 }
 
+// WindowManager owns the auxiliary windows (main is created in main.go). Settings is created
+// eagerly and hidden on close to keep React state; the rest are created on open, destroyed on
+// close, so the macOS dock-reopen handler finds no hidden window to resurrect.
 type WindowManager struct {
 	app               *application.App
 	mainWindow        *application.WebviewWindow
@@ -114,31 +112,15 @@ type WindowManager struct {
 	// hiddenForLogin holds windows hidden while the BrowserLogin popup is open, restored on close.
 	hiddenForLogin []application.Window
 	mu             sync.Mutex
-	newMain        func() *application.WebviewWindow
-	ready          map[uint]bool
-	showPending    map[uint]bool
-	showAsked      map[uint]time.Time
-	pendingTab     map[uint]string
-	fallbackTimers map[uint]*time.Timer
 	// recenterOnShow is set only on the minimal-WM/XEmbed path, where the WM neither centers nor
 	// restores position; nil on full desktops so re-centering can't fight a user-moved window.
 	recenterOnShow func() bool
 }
 
+// NewWindowManager wires the manager to the main app; translator/prefs may be nil (tests). The
+// Settings window is created here (hidden) so the first OpenSettings is instant.
 func NewWindowManager(app *application.App, mainWindow *application.WebviewWindow, translator ErrorTranslator, prefs LanguagePreference, linuxIcon []byte) *WindowManager {
-	s := &WindowManager{
-		app:            app,
-		mainWindow:     mainWindow,
-		translator:     translator,
-		prefs:          prefs,
-		linuxIcon:      linuxIcon,
-		ready:          map[uint]bool{},
-		showPending:    map[uint]bool{},
-		showAsked:      map[uint]time.Time{},
-		pendingTab:     map[uint]string{},
-		fallbackTimers: map[uint]*time.Timer{},
-	}
-	s.watchPainted()
+	s := &WindowManager{app: app, mainWindow: mainWindow, translator: translator, prefs: prefs, linuxIcon: linuxIcon}
 	// Re-title live windows on language flip. Wired internally so the binding generator
 	// doesn't try to expose the interface param.
 	if sub, ok := prefs.(LanguageSubscriber); ok && sub != nil {
@@ -154,11 +136,7 @@ func NewWindowManager(app *application.App, mainWindow *application.WebviewWindo
 			}
 		}()
 	}
-	return s
-}
-
-func (s *WindowManager) newSettingsWindow() *application.WebviewWindow {
-	w := s.app.Window.NewWithOptions(application.WebviewWindowOptions{
+	s.settings = app.Window.NewWithOptions(application.WebviewWindowOptions{
 		Name:                "settings",
 		Title:               s.title("window.title.settings"),
 		Width:               900,
@@ -172,15 +150,18 @@ func (s *WindowManager) newSettingsWindow() *application.WebviewWindow {
 		URL:                 "/#/settings",
 		Mac:                 AppleMacOSAppearanceOptions(),
 		Windows:             MicrosoftWindowsAppearanceOptions(),
-		Linux:               LinuxAppearanceOptions(s.linuxIcon),
+		Linux:               LinuxAppearanceOptions(linuxIcon),
 	})
-	w.RegisterHook(events.Common.WindowClosing, func(_ *application.WindowEvent) {
-		s.mu.Lock()
-		s.settings = nil
-		s.forgetWindowLocked(w)
-		s.mu.Unlock()
+	// Hide (not destroy) on close to keep React state; reset to General for a flash-free reopen.
+	s.settings.RegisterHook(events.Common.WindowClosing, func(e *application.WindowEvent) {
+		if ShuttingDown() {
+			return
+		}
+		e.Cancel()
+		s.app.Event.Emit(EventSettingsOpen, "general")
+		s.settings.Hide()
 	})
-	return w
+	return s
 }
 
 // OpenSettings shows the settings window on tab (empty → General), switching tab via
@@ -190,23 +171,11 @@ func (s *WindowManager) OpenSettings(tab string) {
 	if target == "" {
 		target = "general"
 	}
-
-	s.mu.Lock()
-	fresh := s.settings == nil
-	if fresh {
-		s.settings = s.newSettingsWindow()
-		s.armReady(s.settings)
-	}
-	w := s.settings
-	if fresh {
-		s.pendingTab[w.ID()] = target
-	}
-	s.mu.Unlock()
-
-	if !fresh {
-		s.app.Event.Emit(EventSettingsOpen, target)
-	}
-	s.showWhenReady(w)
+	s.app.Event.Emit(EventSettingsOpen, target)
+	s.settings.Show()
+	s.settings.Focus()
+	// Re-center (minimal-WM only; see centerWhenReady).
+	s.centerWhenReady(s.settings)
 }
 
 // OpenBrowserLogin shows the SSO popup, creating it on first use.
@@ -471,167 +440,13 @@ func (s *WindowManager) OpenMain() {
 // ShowMain brings the main window forward (re-centering on minimal WMs). The single entry
 // point every surface (tray, SIGUSR1, welcome) should use so centering applies uniformly.
 func (s *WindowManager) ShowMain() {
-	s.showWhenReady(s.MainWindow())
-}
-
-func (s *WindowManager) MainWindow() *application.WebviewWindow {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if s.mainWindow == nil && s.newMain != nil {
-		s.mainWindow = s.newMain()
-		s.armReady(s.mainWindow)
-	}
-	return s.mainWindow
-}
-
-func (s *WindowManager) armReady(w *application.WebviewWindow) {
-	if w == nil {
+	if s.mainWindow == nil {
 		return
 	}
-	created := time.Now()
-	w.RegisterHook(events.Common.WindowRuntimeReady, func(_ *application.WindowEvent) {
-		log.Infof("window %q runtime ready after %s", w.Name(), time.Since(created).Round(time.Millisecond))
-		timer := time.AfterFunc(paintedFallback, func() {
-			s.markReady(w, "fallback")
-		})
-		s.mu.Lock()
-		s.fallbackTimers[w.ID()] = timer
-		s.mu.Unlock()
-	})
-}
-
-func (s *WindowManager) watchPainted() {
-	s.app.Event.On(EventWindowPainted, func(e *application.CustomEvent) {
-		w := s.windowByName(e.Sender)
-		if w == nil {
-			log.Infof("painted event from unknown sender %q", e.Sender)
-			return
-		}
-		s.markReady(w, "painted")
-	})
-}
-
-func (s *WindowManager) forgetWindowLocked(w *application.WebviewWindow) {
-	if w == nil {
-		return
-	}
-
-	id := w.ID()
-	if timer := s.fallbackTimers[id]; timer != nil {
-		timer.Stop()
-	}
-	delete(s.fallbackTimers, id)
-	delete(s.ready, id)
-	delete(s.showPending, id)
-	delete(s.showAsked, id)
-	delete(s.pendingTab, id)
-
-	kept := s.hiddenForLogin[:0]
-	for _, hidden := range s.hiddenForLogin {
-		if hidden != application.Window(w) {
-			kept = append(kept, hidden)
-		}
-	}
-	s.hiddenForLogin = kept
-}
-
-func (s *WindowManager) windowByName(name string) *application.WebviewWindow {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	switch name {
-	case "main":
-		return s.mainWindow
-	case "settings":
-		return s.settings
-	default:
-		return nil
-	}
-}
-
-func (s *WindowManager) markReady(w *application.WebviewWindow, source string) {
-	id := w.ID()
-	s.mu.Lock()
-	already := s.ready[id]
-	s.ready[id] = true
-	wanted := s.showPending[id]
-	asked := s.showAsked[id]
-	tab, hasTab := s.pendingTab[id]
-	if timer := s.fallbackTimers[id]; timer != nil {
-		timer.Stop()
-		delete(s.fallbackTimers, id)
-	}
-	delete(s.showPending, id)
-	delete(s.showAsked, id)
-	delete(s.pendingTab, id)
-	s.mu.Unlock()
-
-	if already {
-		return
-	}
-
-	if hasTab {
-		s.app.Event.Emit(EventSettingsOpen, tab)
-	}
-
-	waited := "no show waiting"
-	if wanted && !asked.IsZero() {
-		waited = time.Since(asked).Round(time.Millisecond).String()
-	}
-	log.Infof("window %q ready via %s, show waited %s", w.Name(), source, waited)
-
-	if wanted {
-		s.showNow(w)
-	}
-}
-
-func (s *WindowManager) showWhenReady(w *application.WebviewWindow) {
-	if w == nil {
-		return
-	}
-
-	id := w.ID()
-	s.mu.Lock()
-	ready := s.ready[id]
-	if !ready {
-		s.showPending[id] = true
-		s.showAsked[id] = time.Now()
-	}
-	s.mu.Unlock()
-
-	if ready {
-		log.Infof("window %q already ready, showing now", w.Name())
-		s.showNow(w)
-		return
-	}
-	log.Infof("window %q not ready yet, deferring show", w.Name())
-}
-
-func (s *WindowManager) showNow(w *application.WebviewWindow) {
-	w.Show()
-	w.Focus()
-	s.centerWhenReady(w)
-}
-
-func (s *WindowManager) ShowMainAt(url string) {
-	w := s.MainWindow()
-	if w == nil {
-		return
-	}
-	w.SetURL(url)
-	s.showWhenReady(w)
-}
-
-func (s *WindowManager) SetMainFactory(f func() *application.WebviewWindow) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.newMain = f
-}
-
-func (s *WindowManager) ForgetMain() {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.forgetWindowLocked(s.mainWindow)
-	s.mainWindow = nil
+	s.mainWindow.Show()
+	s.mainWindow.Focus()
+	// Re-center (minimal-WM only; see centerWhenReady).
+	s.centerWhenReady(s.mainWindow)
 }
 
 // SetRecenterOnShow installs the recenterOnShow predicate (see the field).

client/ui/tray.go

@@ -16,7 +16,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/ui/authsession"
 	"github.com/netbirdio/netbird/client/ui/i18n"
-	"github.com/netbirdio/netbird/client/ui/preferences"
 	"github.com/netbirdio/netbird/client/ui/services"
 	"github.com/netbirdio/netbird/version"
 )
@@ -51,9 +50,8 @@ type TrayServices struct {
 	WindowManager   *services.WindowManager
 	// Session is bound to authsession directly because the services wrapper
 	// only re-exposes the React subset.
-	Session     *authsession.Session
-	Localizer   *Localizer
-	Preferences *preferences.Store
+	Session   *authsession.Session
+	Localizer *Localizer
 }
 
 type Tray struct {
@@ -174,7 +172,7 @@ func NewTray(app *application.App, window *application.WebviewWindow, svc TraySe
 		// in the right locale — no English flash then re-paint.
 		loc: svc.Localizer,
 	}
-	t.updater = newTrayUpdater(app, t.showMainAt, svc.Update, svc.Notifier, t.loc, func() { t.applyIcon() }, func() { t.relayoutMenu() })
+	t.updater = newTrayUpdater(app, window, svc.Update, svc.Notifier, t.loc, func() { t.applyIcon() }, func() { t.relayoutMenu() })
 	t.tray = app.SystemTray.New()
 	// Seed panel-theme detection before the first paint so the initial icon
 	// matches the panel's light/dark scheme (Linux only).
@@ -241,6 +239,9 @@ func (t *Tray) ShowWindow() {
 		w.Focus()
 		return
 	}
+	if t.window == nil {
+		return
+	}
 	// Route through WindowManager so the main window is centered on first
 	// show — minimal WMs (fluxbox, the XEmbed tray path) otherwise drop it in
 	// the top-left corner.
@@ -248,40 +249,8 @@ func (t *Tray) ShowWindow() {
 		t.svc.WindowManager.ShowMain()
 		return
 	}
-	if w := t.mainWindow(); w != nil {
-		w.Show()
-		w.Focus()
-	}
-}
-
-func (t *Tray) mainWindow() *application.WebviewWindow {
-	if t.svc.WindowManager == nil {
-		return t.window
-	}
-	return t.svc.WindowManager.MainWindow()
-}
-
-func (t *Tray) showMain() {
-	if t.svc.WindowManager != nil {
-		t.svc.WindowManager.ShowMain()
-		return
-	}
-	if w := t.mainWindow(); w != nil {
-		w.Show()
-		w.Focus()
-	}
-}
-
-func (t *Tray) showMainAt(url string) {
-	if t.svc.WindowManager != nil {
-		t.svc.WindowManager.ShowMainAt(url)
-		return
-	}
-	if w := t.mainWindow(); w != nil {
-		w.SetURL(url)
-		w.Show()
-		w.Focus()
-	}
+	t.window.Show()
+	t.window.Focus()
 }
 
 // applyLanguage re-renders every translated surface in the Localizer's current
@@ -492,12 +461,10 @@ func (t *Tray) handleQuit() {
 	t.profileMu.Unlock()
 	t.svc.DaemonFeed.CancelProfileSwitch()
 
-	if t.svc.Preferences == nil || !t.svc.Preferences.Get().KeepConnectedOnQuit {
-		ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
-		defer cancel()
-		if err := t.svc.Connection.Down(ctx); err != nil {
-			log.Errorf("disconnect on quit: %v", err)
-		}
+	ctx, cancel := context.WithTimeout(context.Background(), quitDownTimeout)
+	defer cancel()
+	if err := t.svc.Connection.Down(ctx); err != nil {
+		log.Errorf("disconnect on quit: %v", err)
 	}
 	t.app.Quit()
 }

client/ui/tray_session.go

@@ -30,7 +30,10 @@ const (
 // handleSessionExpired notifies and brings the window forward so the user can reconnect.
 func (t *Tray) handleSessionExpired() {
 	t.notify(t.loc.T("notify.sessionExpired.title"), t.loc.T("notify.sessionExpired.body"), notifyIDSessionExpired)
-	t.showMain()
+	if t.window != nil {
+		t.window.Show()
+		t.window.Focus()
+	}
 }
 
 // applySessionExpiry refreshes the cached SSO deadline and reports whether it changed.
@@ -304,7 +307,6 @@ func (t *Tray) openSessionExtendFlow() {
 	}
 	seconds := int(time.Until(deadline).Seconds())
 	if seconds <= 0 {
-		t.showMain()
 		t.app.Event.Emit(services.EventTriggerLogin)
 		return
 	}

client/ui/tray_update.go

@@ -19,7 +19,7 @@ import (
 // trayUpdater owns the tray UI that reacts to auto-update. Composed inside Tray.
 type trayUpdater struct {
 	app          *application.App
-	showMainAt   func(url string)
+	window       *application.WebviewWindow
 	update       *services.Update
 	notifier     *Notifier
 	loc          *Localizer
@@ -36,10 +36,10 @@ type trayUpdater struct {
 	progressWindowOpen bool
 }
 
-func newTrayUpdater(app *application.App, showMainAt func(url string), update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
+func newTrayUpdater(app *application.App, window *application.WebviewWindow, update *services.Update, notifier *Notifier, loc *Localizer, onIconChange func(), onMenuChange func()) *trayUpdater {
 	u := &trayUpdater{
 		app:          app,
-		showMainAt:   showMainAt,
+		window:       window,
 		update:       update,
 		notifier:     notifier,
 		loc:          loc,
@@ -185,12 +185,14 @@ func (u *trayUpdater) sendUpdateNotification(st updater.State) {
 // openProgressWindow points the main window at the /update progress page and
 // brings it forward.
 func (u *trayUpdater) openProgressWindow(version string) {
-	if u.showMainAt == nil {
+	if u.window == nil {
 		return
 	}
 	url := "/#/update"
 	if version != "" {
 		url += "?version=" + version
 	}
-	u.showMainAt(url)
+	u.window.SetURL(url)
+	u.window.Show()
+	u.window.Focus()
 }

client/ui/xembed_host_gtk3_linux.go

@@ -1,40 +0,0 @@
-//go:build linux && gtk3 && !(linux && 386)
-
-package main
-
-import (
-	"errors"
-
-	"github.com/godbus/dbus/v5"
-)
-
-// The legacy GTK3 / WebKit2GTK 4.1 build (-tags gtk3) drops the in-process
-// XEmbed StatusNotifierWatcher entirely. The real implementation
-// (xembed_host_linux.go + xembed_tray_linux.c) links GTK4 and uses GTK4-only
-// popup-menu APIs that have no drop-in GTK3 equivalent, so rather than port the
-// C layer we stub the host out on gtk3 builds. The tray still works on every
-// desktop that ships its own StatusNotifierWatcher (KDE, GNOME+AppIndicator,
-// Cinnamon/xapp, XFCE, …); only the minimal-WM fallback (Fluxbox/OpenBox/i3/
-// dwm/vanilla GNOME) is unavailable on gtk3 packages. See LINUX-TRAY.md.
-
-// xembedHost is a placeholder so the package compiles on gtk3 builds; the real
-// type (with X11/GTK4 state) lives in xembed_host_linux.go. It is never
-// instantiated here because xembedTrayAvailable always reports false.
-type xembedHost struct{}
-
-// run satisfies the call in tray_watcher_linux.go; unreachable on gtk3 because
-// newXembedHost never returns a non-nil host.
-func (*xembedHost) run() {}
-
-// xembedTrayAvailable always reports false on gtk3 builds, so the watcher probe
-// loop in startStatusNotifierWatcher exits immediately and newXembedHost is
-// never reached. recenter_linux.go's predicate becomes a harmless no-op too.
-func xembedTrayAvailable() bool {
-	return false
-}
-
-// newXembedHost exists only to satisfy the reference in tray_watcher_linux.go;
-// it is unreachable because xembedTrayAvailable returns false on gtk3.
-func newXembedHost(conn *dbus.Conn, busName string, objPath dbus.ObjectPath) (*xembedHost, error) {
-	return nil, errors.New("xembed host unsupported on gtk3 build")
-}

client/ui/xembed_host_linux.go

@@ -1,4 +1,4 @@
-//go:build linux && !gtk3 && !(linux && 386)
+//go:build linux && !(linux && 386)
 
 package main
 

client/ui/xembed_tray_linux.c

@@ -1,5 +1,3 @@
-//go:build linux && !gtk3 && !(linux && 386)
-
 #include "xembed_tray_linux.h"
 
 #include <X11/Xatom.h>

go.mod

@@ -340,4 +340,4 @@ replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-2
 
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
 
-replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701
+replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4

go.sum

@@ -490,8 +490,8 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701 h1:QL9nupfRom0L9jcY7N9l/Bc6QK2PtC6pHzC+ftpTqpw=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4 h1:UKztc3QjWvzU5DZk+uYaOWN0x62NSe/pkxuPvzqZIy4=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260803205919-ad21e92381f4/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=

infrastructure_files/getting-started-enterprise.sh

@@ -12,7 +12,10 @@ SED_STRIP_PADDING='s/=//g'
 NETBIRD_EULA_URL="https://netbird.io/self-hosted-EULA"
 
 # Static IP for Traefik inside the compose bridge network. The management
-# server trusts X-Forwarded-* headers from this address only.
+# server trusts X-Forwarded-* headers from this address only, so all three
+# values derive from the same /24. Override with NETBIRD_DOCKER_SUBNET.
+DOCKER_SUBNET="172.30.0.0/24"
+DOCKER_GATEWAY="172.30.0.1"
 TRAEFIK_IP="172.30.0.10"
 
 check_docker_compose() {
@@ -43,6 +46,90 @@ rand_b64_key() {
   openssl rand -base64 32
 }
 
+# ------------------------------------------------------------------
+# Docker network subnet override and conflict check
+# (kept in sync with getting-started.sh; only the compose network
+# name differs)
+# ------------------------------------------------------------------
+
+ip_to_int() {
+  local a b c d
+  IFS=. read -r a b c d <<< "$1"
+  echo $(( (10#$a << 24) + (10#$b << 16) + (10#$c << 8) + 10#$d ))
+}
+
+# cidrs_overlap <cidr> <cidr> — succeeds if the networks overlap
+cidrs_overlap() {
+  local net1="${1%/*}" len1="${1#*/}" net2="${2%/*}" len2="${2#*/}"
+  local min_len=$(( len1 < len2 ? len1 : len2 ))
+  local mask=0
+  if [[ "$min_len" -gt 0 ]]; then
+    mask=$(( (0xFFFFFFFF << (32 - min_len)) & 0xFFFFFFFF ))
+  fi
+  [[ $(( $(ip_to_int "$net1") & mask )) -eq $(( $(ip_to_int "$net2") & mask )) ]]
+}
+
+# valid_ipv4_slash24 <cidr> — accepts a unicast IPv4 /24 like 10.123.45.0/24
+valid_ipv4_slash24() {
+  local octet='(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])'
+  local re="^${octet}\.${octet}\.${octet}\.0/24$"
+  [[ "$1" =~ $re ]] || return 1
+  # Reject non-unicast/reserved ranges: 0/8, loopback, link-local, 224+
+  case "$1" in
+    0.*|127.*|169.254.*|22[4-9].*|2[34][0-9].*|25[0-5].*) return 1 ;;
+  esac
+  return 0
+}
+
+# Apply NETBIRD_DOCKER_SUBNET and derive the gateway (.1) and Traefik IP (.10)
+apply_docker_subnet_override() {
+  if [[ -n "${NETBIRD_DOCKER_SUBNET:-}" ]]; then
+    if ! valid_ipv4_slash24 "$NETBIRD_DOCKER_SUBNET"; then
+      echo "NETBIRD_DOCKER_SUBNET must be a unicast IPv4 /24 network like 10.123.45.0/24 (0/8, 127/8, 169.254/16, and 224+ are not allowed), got: $NETBIRD_DOCKER_SUBNET" > /dev/stderr
+      exit 1
+    fi
+    DOCKER_SUBNET="$NETBIRD_DOCKER_SUBNET"
+  fi
+  local base="${DOCKER_SUBNET%.0/24}"
+  DOCKER_GATEWAY="${base}.1"
+  TRAEFIK_IP="${base}.10"
+  return 0
+}
+
+# check_docker_subnet_conflicts <compose network name>
+# Fail early if an existing Docker network overlaps DOCKER_SUBNET, instead
+# of letting "docker compose up" fail later. Host routes are not checked;
+# NETBIRD_DOCKER_SUBNET covers those cases.
+check_docker_subnet_conflicts() {
+  local expected_network="$1"
+  command -v docker &> /dev/null || return 0
+
+  local name subnets subnet
+  while IFS='|' read -r name subnets; do
+    for subnet in $subnets; do
+      [[ "$subnet" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/[0-9]+$ ]] || continue
+      if [[ "$name" == "$expected_network" ]]; then
+        # Our own leftover network: compose reuses it as-is, so its subnet
+        # must match the one we render
+        if [[ "$subnet" != "$DOCKER_SUBNET" ]]; then
+          echo "ERROR: the Docker network '$name', left over from a previous NetBird install, uses $subnet instead of $DOCKER_SUBNET." > /dev/stderr
+          echo "docker compose would reuse it as-is, and the generated configuration would not match it." > /dev/stderr
+          echo "Remove it and run this script again:" > /dev/stderr
+          echo "  docker network rm $name" > /dev/stderr
+          exit 1
+        fi
+      elif cidrs_overlap "$DOCKER_SUBNET" "$subnet"; then
+        echo "ERROR: the existing Docker network '$name' ($subnet) overlaps $DOCKER_SUBNET, the subnet NetBird would use." > /dev/stderr
+        echo "That network is not managed by this script and is left untouched." > /dev/stderr
+        echo "Pick a free /24 for NetBird instead and run this script again:" > /dev/stderr
+        echo "  NETBIRD_DOCKER_SUBNET=10.123.45.0/24 ./getting-started-enterprise.sh" > /dev/stderr
+        exit 1
+      fi
+    done
+  done < <(docker network inspect --format '{{.Name}}|{{range .IPAM.Config}}{{.Subnet}} {{end}}' $(docker network ls -q 2>/dev/null) 2>/dev/null || true)
+  return 0
+}
+
 check_nb_domain() {
   local domain="$1"
   if [[ -z "$domain" ]]; then
@@ -224,6 +311,9 @@ wait_postgres() {
 init_environment() {
   check_openssl
   DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
+  # Settle the subnet (and fail on conflicts) before the EULA and prompts
+  apply_docker_subnet_override
+  check_docker_subnet_conflicts "netbird"
 
   if [[ -f .env ]] || [[ -f docker-compose.yml ]] || [[ -f config.yaml ]]; then
     echo "Generated files already exist in $(pwd)."
@@ -262,7 +352,6 @@ init_environment() {
   POSTGRES_DB="netbird"
   POSTGRES_PASSWORD=$(rand_secret)
   NETBIRD_ENCRYPTION_KEY=$(rand_b64_key)
-  NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY=$(rand_b64_key)
   NETBIRD_RELAY_AUTH_SECRET=$(rand_secret)
 
   POSTGRES_DSN="host=postgres user=${POSTGRES_USER} password=${POSTGRES_PASSWORD} dbname=${POSTGRES_DB} port=5432 sslmode=disable TimeZone=UTC"
@@ -273,6 +362,7 @@ init_environment() {
   echo "  Traffic flow: ${NETBIRD_TRAFFIC_FLOW}"
   echo "  Domain:       ${NETBIRD_DOMAIN}"
   echo "  ACME email:   ${NETBIRD_LETSENCRYPT_EMAIL}"
+  echo "  Subnet:       ${DOCKER_SUBNET} (Traefik at ${TRAEFIK_IP})"
   echo ""
   echo "Rendering files into $(pwd) ..."
   install -m 600 /dev/null .env
@@ -334,7 +424,12 @@ NETBIRD_DOMAIN=${NETBIRD_DOMAIN}
 # Reverse proxy (Traefik)
 NETBIRD_LETSENCRYPT_EMAIL=${NETBIRD_LETSENCRYPT_EMAIL}
 NETBIRD_TRAEFIK_TAG=${NETBIRD_TRAEFIK_TAG:-v3.6}
+# These three must stay in step with the /32 trust pins in config.yaml
+# (reverseProxy.trustedPeers/trustedHTTPProxies). Shell env vars override
+# this file at compose time.
 NETBIRD_TRAEFIK_IP=${TRAEFIK_IP}
+NETBIRD_NETWORK_SUBNET=${DOCKER_SUBNET}
+NETBIRD_NETWORK_GATEWAY=${DOCKER_GATEWAY}
 
 # Image tags. Default to "latest"
 NETBIRD_DASHBOARD_TAG=${NETBIRD_DASHBOARD_TAG:-latest}
@@ -417,6 +512,9 @@ render_compose_common() {
     networks:
       netbird:
         ipv4_address: ${NETBIRD_TRAEFIK_IP}
+        # Resolve the public domain inside this network (avoids hairpin NAT)
+        aliases:
+          - "${NETBIRD_DOMAIN}"
     command:
       # Logging
       - "--log.level=INFO"
@@ -660,8 +758,8 @@ networks:
     driver: bridge
     ipam:
       config:
-        - subnet: 172.30.0.0/24
-          gateway: 172.30.0.1
+        - subnet: ${NETBIRD_NETWORK_SUBNET}
+          gateway: ${NETBIRD_NETWORK_GATEWAY}
 EOF
 }
 
@@ -697,7 +795,6 @@ server:
     issuer: "https://${NETBIRD_DOMAIN}/oauth2"
     localAuthDisabled: false
     signKeyRefreshEnabled: false
-    sessionCookieEncryptionKey: "${NETBIRD_SESSION_COOKIE_ENCRYPTION_KEY}"
     dashboardRedirectURIs:
       - "https://${NETBIRD_DOMAIN}/nb-auth"
       - "https://${NETBIRD_DOMAIN}/nb-silent-auth"

infrastructure_files/getting-started.sh

@@ -108,6 +108,14 @@ check_nb_domain() {
     echo "The NETBIRD_DOMAIN cannot be netbird.example.com" > /dev/stderr
     return 1
   fi
+
+  # Letters, digits, dots, and hyphens only; the domain is embedded in
+  # generated YAML and env files
+  local re='^[A-Za-z0-9]([A-Za-z0-9.-]*[A-Za-z0-9])?$'
+  if [[ "$DOMAIN" != "use-ip" ]] && [[ ! "$DOMAIN" =~ $re ]]; then
+    echo "The NETBIRD_DOMAIN may only contain letters, digits, dots, and hyphens." > /dev/stderr
+    return 1
+  fi
   return 0
 }
 
@@ -337,6 +345,103 @@ wait_management_direct() {
   return 0
 }
 
+############################################
+# Docker Network Subnet Override and Conflict Check
+############################################
+
+ip_to_int() {
+  local a b c d
+  IFS=. read -r a b c d <<< "$1"
+  echo $(( (10#$a << 24) + (10#$b << 16) + (10#$c << 8) + 10#$d ))
+}
+
+# cidrs_overlap <cidr> <cidr> — succeeds if the networks overlap
+cidrs_overlap() {
+  local net1="${1%/*}" len1="${1#*/}" net2="${2%/*}" len2="${2#*/}"
+  local min_len=$(( len1 < len2 ? len1 : len2 ))
+  local mask=0
+  if [[ "$min_len" -gt 0 ]]; then
+    mask=$(( (0xFFFFFFFF << (32 - min_len)) & 0xFFFFFFFF ))
+  fi
+  [[ $(( $(ip_to_int "$net1") & mask )) -eq $(( $(ip_to_int "$net2") & mask )) ]]
+}
+
+# valid_ipv4_slash24 <cidr> — accepts a unicast IPv4 /24 like 10.123.45.0/24
+valid_ipv4_slash24() {
+  local octet='(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])'
+  local re="^${octet}\.${octet}\.${octet}\.0/24$"
+  [[ "$1" =~ $re ]] || return 1
+  # Reject non-unicast/reserved ranges: 0/8, loopback, link-local, 224+
+  case "$1" in
+    0.*|127.*|169.254.*|22[4-9].*|2[34][0-9].*|25[0-5].*) return 1 ;;
+  esac
+  return 0
+}
+
+# Apply NETBIRD_DOCKER_SUBNET and derive the gateway (.1) and Traefik IP (.10)
+apply_docker_subnet_override() {
+  if [[ -n "${NETBIRD_DOCKER_SUBNET:-}" ]]; then
+    if ! valid_ipv4_slash24 "$NETBIRD_DOCKER_SUBNET"; then
+      echo "NETBIRD_DOCKER_SUBNET must be a unicast IPv4 /24 network like 10.123.45.0/24 (0/8, 127/8, 169.254/16, and 224+ are not allowed), got: $NETBIRD_DOCKER_SUBNET" > /dev/stderr
+      exit 1
+    fi
+    DOCKER_SUBNET="$NETBIRD_DOCKER_SUBNET"
+  fi
+  local base="${DOCKER_SUBNET%.0/24}"
+  DOCKER_GATEWAY="${base}.1"
+  TRAEFIK_IP="${base}.10"
+  return 0
+}
+
+# check_docker_subnet_conflicts <compose network name>
+# Fail early if an existing Docker network overlaps DOCKER_SUBNET, instead
+# of letting "docker compose up" fail later. Host routes are not checked;
+# NETBIRD_DOCKER_SUBNET covers those cases.
+check_docker_subnet_conflicts() {
+  local expected_network="$1"
+  command -v docker &> /dev/null || return 0
+
+  local name subnets subnet
+  while IFS='|' read -r name subnets; do
+    for subnet in $subnets; do
+      [[ "$subnet" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/[0-9]+$ ]] || continue
+      if [[ "$name" == "$expected_network" ]]; then
+        # Our own leftover network: compose reuses it as-is, so its subnet
+        # must match the one we render
+        if [[ "$subnet" != "$DOCKER_SUBNET" ]]; then
+          echo "ERROR: the Docker network '$name', left over from a previous NetBird install, uses $subnet instead of $DOCKER_SUBNET." > /dev/stderr
+          echo "docker compose would reuse it as-is, and the generated configuration would not match it." > /dev/stderr
+          echo "Remove it and run this script again:" > /dev/stderr
+          echo "  docker network rm $name" > /dev/stderr
+          exit 1
+        fi
+      elif cidrs_overlap "$DOCKER_SUBNET" "$subnet"; then
+        echo "ERROR: the existing Docker network '$name' ($subnet) overlaps $DOCKER_SUBNET, the subnet NetBird would use." > /dev/stderr
+        echo "That network is not managed by this script and is left untouched." > /dev/stderr
+        echo "Pick a free /24 for NetBird instead and run this script again:" > /dev/stderr
+        echo "  NETBIRD_DOCKER_SUBNET=10.123.45.0/24 ./getting-started.sh" > /dev/stderr
+        exit 1
+      fi
+    done
+  done < <(docker network inspect --format '{{.Name}}|{{range .IPAM.Config}}{{.Subnet}} {{end}}' $(docker network ls -q 2>/dev/null) 2>/dev/null || true)
+  return 0
+}
+
+configure_docker_subnet() {
+  # Only the built-in Traefik mode pins a subnet; other modes let Docker pick
+  if [[ "$REVERSE_PROXY_TYPE" != "0" ]]; then
+    return 0
+  fi
+
+  # Skip our own network (<project>_netbird) in the conflict check;
+  # normalization matches compose-go's NormalizeProjectName
+  local project
+  project="${COMPOSE_PROJECT_NAME:-$(basename "$PWD")}"
+  project=$(echo "$project" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9_-]//g; s/^[_-]*//')
+  check_docker_subnet_conflicts "${project}_netbird"
+  return 0
+}
+
 ############################################
 # Initialization and Configuration
 ############################################
@@ -348,7 +453,6 @@ initialize_default_values() {
   NETBIRD_RELAY_AUTH_SECRET=$(openssl rand -base64 32 | sed "$SED_STRIP_PADDING")
   # Note: DataStoreEncryptionKey must keep base64 padding (=) for Go's base64.StdEncoding
   DATASTORE_ENCRYPTION_KEY=$(openssl rand -base64 32)
-  SESSION_COOKIE_ENCRYPTION_KEY=$(openssl rand -base64 32)
   NETBIRD_STUN_PORT=3478
 
   # Docker images
@@ -369,7 +473,11 @@ initialize_default_values() {
   BIND_LOCALHOST_ONLY="true"
   EXTERNAL_PROXY_NETWORK=""
 
-  # Traefik static IP within the internal bridge network
+  # Internal bridge network. Management and proxy trust forwarded headers
+  # from TRAEFIK_IP only, so all three values derive from the same /24.
+  # Override with NETBIRD_DOCKER_SUBNET.
+  DOCKER_SUBNET="172.30.0.0/24"
+  DOCKER_GATEWAY="172.30.0.1"
   TRAEFIK_IP="172.30.0.10"
 
   # NetBird Proxy configuration
@@ -528,8 +636,7 @@ generate_configuration_files() {
 
   # Common files for all configurations
   render_dashboard_env > dashboard.env
-  install -m 600 /dev/null config.yaml
-  render_combined_yaml >> config.yaml
+  render_combined_yaml > config.yaml
   return 0
 }
 
@@ -665,8 +772,10 @@ init_environment() {
   check_docker_sock_perms
 
   initialize_default_values
+  apply_docker_subnet_override
   configure_domain
   configure_reverse_proxy
+  configure_docker_subnet
 
   check_jq
 
@@ -688,6 +797,7 @@ render_docker_compose_traefik_builtin() {
   local crowdsec_volumes=""
   local traefik_file_provider=""
   local traefik_dynamic_volume=""
+
   if [[ "$ENABLE_PROXY" == "true" ]]; then
     traefik_file_provider='      - "--providers.file.filename=/etc/traefik/dynamic.yaml"'
     traefik_dynamic_volume="      - ./traefik-dynamic.yaml:/etc/traefik/dynamic.yaml:ro"
@@ -886,8 +996,8 @@ networks:
     driver: bridge
     ipam:
       config:
-        - subnet: 172.30.0.0/24
-          gateway: 172.30.0.1
+        - subnet: $DOCKER_SUBNET
+          gateway: $DOCKER_GATEWAY
 EOF
   return 0
 }
@@ -913,7 +1023,6 @@ server:
   auth:
     issuer: "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/oauth2"
     signKeyRefreshEnabled: true
-    sessionCookieEncryptionKey: "$SESSION_COOKIE_ENCRYPTION_KEY"
     dashboardRedirectURIs:
       - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-auth"
       - "$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN/nb-silent-auth"

release_files/darwin_pkg/preinstall

@@ -4,67 +4,9 @@ set -x
 
 LOG_FILE=/var/log/netbird/client_pre_install.log
 AGENT=/usr/local/bin/netbird
-UI_PROCESS=netbird-ui
 
 mkdir -p /var/log/netbird/
 
-# wait_for_ui_exit polls for up to $1 seconds, returning 0 as soon as no UI
-# process is left and 1 if one is still running when the time is up.
-wait_for_ui_exit() {
-    waited=0
-    while [ "$waited" -lt "$1" ]; do
-        pgrep -x "$UI_PROCESS" > /dev/null 2>&1 || return 0
-        sleep 1
-        waited=$((waited + 1))
-    done
-    return 1
-}
-
-# request_ui_quit asks the UI to quit from inside the console user's session and
-# reports whether the request could be sent at all. The installer runs as root
-# outside that session, so a quit Apple event sent straight from here always
-# fails with -600.
-request_ui_quit() {
-    console_user=$(stat -f%Su /dev/console 2>/dev/null)
-    case "$console_user" in
-        ""|root|loginwindow|_mbsetupuser)
-            echo "No active GUI user session (console user: '${console_user:-none}'); skipping the quit request."
-            return 1
-            ;;
-    esac
-
-    uid=$(id -u "$console_user" 2>/dev/null)
-    if [ -z "$uid" ]; then
-        echo "Could not resolve uid for console user '$console_user'; skipping the quit request."
-        return 1
-    fi
-
-    echo "Asking the NetBird UI to quit as console user $console_user (uid $uid)."
-    launchctl asuser "$uid" sudo -u "$console_user" -H osascript -e 'quit app "NetBird"' || true
-}
-
-# quit_ui stops a running UI so the app bundle can be replaced underneath it. A
-# UI process that survives the install keeps serving the old binary until it is
-# quit by hand, so anything still running once the quit request is out of the
-# way is signalled. Waiting for a graceful exit only makes sense when a quit
-# request was actually sent.
-quit_ui() {
-    if request_ui_quit && wait_for_ui_exit 10; then
-        return 0
-    fi
-
-    pgrep -x "$UI_PROCESS" > /dev/null 2>&1 || return 0
-
-    echo "NetBird UI still running; terminating it."
-    pkill -x "$UI_PROCESS" || true
-    if wait_for_ui_exit 3; then
-        return 0
-    fi
-
-    echo "NetBird UI ignored SIGTERM; killing it."
-    pkill -KILL -x "$UI_PROCESS" || true
-}
-
 {
     # check if it was installed with brew
     brew list --formula | grep netbird
@@ -73,9 +15,10 @@ quit_ui() {
         echo "NetBird has been installed with Brew. Please use Brew to update the package."
         exit 1
     fi
-    quit_ui
+    osascript -e 'quit app "Netbird"' || true
     $AGENT service stop || true
 
     echo "Preinstall complete"
     exit 0 # all good
 } &> $LOG_FILE
+