[client,management] Feature/client service expose (#5411)

CLI: new expose command to publish a local port with flags for PIN, password, user groups, custom domain, name prefix and protocol (HTTP default).
Management/API: create/renew/stop expose sessions (streamed status), automatic naming/domain, TTL renewals, background expiration, new management RPCs and client methods.
UI/API: account settings now include peer_expose_enabled and peer_expose_groups; new activity codes for peer expose events.

shared/management/client/client.go

@@ -11,6 +11,7 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
+// Client is the interface for the management service client.
 type Client interface {
 	io.Closer
 	Sync(ctx context.Context, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error
@@ -24,4 +25,7 @@ type Client interface {
 	IsHealthy() bool
 	SyncMeta(sysInfo *system.Info) error
 	Logout() error
+	CreateExpose(ctx context.Context, req ExposeRequest) (*ExposeResponse, error)
+	RenewExpose(ctx context.Context, domain string) error
+	StopExpose(ctx context.Context, domain string) error
 }

shared/management/client/grpc.go

@@ -48,6 +48,22 @@ type GrpcClient struct {
 	connStateCallbackLock sync.RWMutex
 }
 
+type ExposeRequest struct {
+	NamePrefix string
+	Domain     string
+	Port       uint16
+	Protocol   int
+	Pin        string
+	Password   string
+	UserGroups []string
+}
+
+type ExposeResponse struct {
+	ServiceName string
+	Domain      string
+	ServiceURL  string
+}
+
 // NewClient creates a new client to Management service
 func NewClient(ctx context.Context, addr string, ourPrivateKey wgtypes.Key, tlsEnabled bool) (*GrpcClient, error) {
 	var conn *grpc.ClientConn
@@ -690,6 +706,123 @@ func (c *GrpcClient) Logout() error {
 	return nil
 }
 
+// CreateExpose calls the management server to create a new expose service.
+func (c *GrpcClient) CreateExpose(ctx context.Context, req ExposeRequest) (*ExposeResponse, error) {
+	serverPubKey, err := c.GetServerPublicKey()
+	if err != nil {
+		return nil, err
+	}
+
+	protoReq, err := toProtoExposeServiceRequest(req)
+	if err != nil {
+		return nil, err
+	}
+
+	encReq, err := encryption.EncryptMessage(*serverPubKey, c.key, protoReq)
+	if err != nil {
+		return nil, fmt.Errorf("encrypt create expose request: %w", err)
+	}
+
+	mgmCtx, cancel := context.WithTimeout(ctx, ConnectTimeout)
+	defer cancel()
+
+	resp, err := c.realClient.CreateExpose(mgmCtx, &proto.EncryptedMessage{
+		WgPubKey: c.key.PublicKey().String(),
+		Body:     encReq,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	exposeResp := &proto.ExposeServiceResponse{}
+	if err := encryption.DecryptMessage(*serverPubKey, c.key, resp.Body, exposeResp); err != nil {
+		return nil, fmt.Errorf("decrypt create expose response: %w", err)
+	}
+
+	return fromProtoExposeResponse(exposeResp), nil
+}
+
+// RenewExpose extends the TTL of an active expose session on the management server.
+func (c *GrpcClient) RenewExpose(ctx context.Context, domain string) error {
+	serverPubKey, err := c.GetServerPublicKey()
+	if err != nil {
+		return err
+	}
+
+	req := &proto.RenewExposeRequest{Domain: domain}
+	encReq, err := encryption.EncryptMessage(*serverPubKey, c.key, req)
+	if err != nil {
+		return fmt.Errorf("encrypt renew expose request: %w", err)
+	}
+
+	mgmCtx, cancel := context.WithTimeout(ctx, ConnectTimeout)
+	defer cancel()
+
+	_, err = c.realClient.RenewExpose(mgmCtx, &proto.EncryptedMessage{
+		WgPubKey: c.key.PublicKey().String(),
+		Body:     encReq,
+	})
+	return err
+}
+
+// StopExpose terminates an active expose session on the management server.
+func (c *GrpcClient) StopExpose(ctx context.Context, domain string) error {
+	serverPubKey, err := c.GetServerPublicKey()
+	if err != nil {
+		return err
+	}
+
+	req := &proto.StopExposeRequest{Domain: domain}
+	encReq, err := encryption.EncryptMessage(*serverPubKey, c.key, req)
+	if err != nil {
+		return fmt.Errorf("encrypt stop expose request: %w", err)
+	}
+
+	mgmCtx, cancel := context.WithTimeout(ctx, ConnectTimeout)
+	defer cancel()
+
+	_, err = c.realClient.StopExpose(mgmCtx, &proto.EncryptedMessage{
+		WgPubKey: c.key.PublicKey().String(),
+		Body:     encReq,
+	})
+	return err
+}
+
+func fromProtoExposeResponse(resp *proto.ExposeServiceResponse) *ExposeResponse {
+	return &ExposeResponse{
+		ServiceName: resp.ServiceName,
+		Domain:      resp.Domain,
+		ServiceURL:  resp.ServiceUrl,
+	}
+}
+
+func toProtoExposeServiceRequest(req ExposeRequest) (*proto.ExposeServiceRequest, error) {
+	var protocol proto.ExposeProtocol
+
+	switch req.Protocol {
+	case int(proto.ExposeProtocol_EXPOSE_HTTP):
+		protocol = proto.ExposeProtocol_EXPOSE_HTTP
+	case int(proto.ExposeProtocol_EXPOSE_HTTPS):
+		protocol = proto.ExposeProtocol_EXPOSE_HTTPS
+	case int(proto.ExposeProtocol_EXPOSE_TCP):
+		protocol = proto.ExposeProtocol_EXPOSE_TCP
+	case int(proto.ExposeProtocol_EXPOSE_UDP):
+		protocol = proto.ExposeProtocol_EXPOSE_UDP
+	default:
+		return nil, fmt.Errorf("invalid expose protocol: %d", req.Protocol)
+	}
+
+	return &proto.ExposeServiceRequest{
+		NamePrefix: req.NamePrefix,
+		Domain:     req.Domain,
+		Port:       uint32(req.Port),
+		Protocol:   protocol,
+		Pin:        req.Pin,
+		Password:   req.Password,
+		UserGroups: req.UserGroups,
+	}, nil
+}
+
 func infoToMetaData(info *system.Info) *proto.PeerSystemMeta {
 	if info == nil {
 		return nil

shared/management/client/mock.go

@@ -10,6 +10,7 @@ import (
 	"github.com/netbirdio/netbird/shared/management/proto"
 )
 
+// MockClient is a mock implementation of the Client interface for testing.
 type MockClient struct {
 	CloseFunc                      func() error
 	SyncFunc                       func(ctx context.Context, sysInfo *system.Info, msgHandler func(msg *proto.SyncResponse) error) error
@@ -21,6 +22,9 @@ type MockClient struct {
 	SyncMetaFunc                   func(sysInfo *system.Info) error
 	LogoutFunc                     func() error
 	JobFunc                        func(ctx context.Context, msgHandler func(msg *proto.JobRequest) *proto.JobResponse) error
+	CreateExposeFunc               func(ctx context.Context, req ExposeRequest) (*ExposeResponse, error)
+	RenewExposeFunc                func(ctx context.Context, domain string) error
+	StopExposeFunc                 func(ctx context.Context, domain string) error
 }
 
 func (m *MockClient) IsHealthy() bool {
@@ -80,10 +84,10 @@ func (m *MockClient) GetPKCEAuthorizationFlow(serverKey wgtypes.Key) (*proto.PKC
 	if m.GetPKCEAuthorizationFlowFunc == nil {
 		return nil, nil
 	}
-	return m.GetPKCEAuthorizationFlow(serverKey)
+	return m.GetPKCEAuthorizationFlowFunc(serverKey)
 }
 
-// GetNetworkMap mock implementation of GetNetworkMap from mgm.Client interface
+// GetNetworkMap mock implementation of GetNetworkMap from Client interface.
 func (m *MockClient) GetNetworkMap(_ *system.Info) (*proto.NetworkMap, error) {
 	return nil, nil
 }
@@ -101,3 +105,24 @@ func (m *MockClient) Logout() error {
 	}
 	return m.LogoutFunc()
 }
+
+func (m *MockClient) CreateExpose(ctx context.Context, req ExposeRequest) (*ExposeResponse, error) {
+	if m.CreateExposeFunc == nil {
+		return nil, nil
+	}
+	return m.CreateExposeFunc(ctx, req)
+}
+
+func (m *MockClient) RenewExpose(ctx context.Context, domain string) error {
+	if m.RenewExposeFunc == nil {
+		return nil
+	}
+	return m.RenewExposeFunc(ctx, domain)
+}
+
+func (m *MockClient) StopExpose(ctx context.Context, domain string) error {
+	if m.StopExposeFunc == nil {
+		return nil
+	}
+	return m.StopExposeFunc(ctx, domain)
+}

shared/management/http/api/openapi.yml

@@ -326,6 +326,16 @@ components:
           type: string
           format: cidr
           example: 100.64.0.0/16
+        peer_expose_enabled:
+          description: Enables or disables peer expose. If enabled, peers can expose local services through the reverse proxy using the CLI.
+          type: boolean
+          example: false
+        peer_expose_groups:
+          description: Limits which peer groups are allowed to expose services. If empty, all peers are allowed when peer expose is enabled.
+          type: array
+          items:
+            type: string
+            example: ch8i4ug6lnn4g9hqv7m0
         extra:
           $ref: '#/components/schemas/AccountExtraSettings'
         lazy_connection_enabled:
@@ -353,6 +363,8 @@ components:
         - peer_inactivity_expiration_enabled
         - peer_inactivity_expiration
         - regular_users_view_blocked
+        - peer_expose_enabled
+        - peer_expose_groups
     AccountExtraSettings:
       type: object
       properties:

shared/management/http/api/types.gen.go

@@ -512,6 +512,12 @@ type AccountSettings struct {
 	// NetworkRange Allows to define a custom network range for the account in CIDR format
 	NetworkRange *string `json:"network_range,omitempty"`
 
+	// PeerExposeEnabled Enables or disables peer expose. If enabled, peers can expose local services through the reverse proxy using the CLI.
+	PeerExposeEnabled bool `json:"peer_expose_enabled"`
+
+	// PeerExposeGroups Limits which peer groups are allowed to expose services. If empty, all peers are allowed when peer expose is enabled.
+	PeerExposeGroups []string `json:"peer_expose_groups"`
+
 	// PeerInactivityExpiration Period of time of inactivity after which peer session expires (seconds).
 	PeerInactivityExpiration int `json:"peer_inactivity_expiration"`
 

shared/management/proto/management.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v6.33.0
+// 	protoc        v6.33.3
 // source: management.proto
 
 package proto
@@ -221,6 +221,58 @@ func (RuleAction) EnumDescriptor() ([]byte, []int) {
 	return file_management_proto_rawDescGZIP(), []int{3}
 }
 
+type ExposeProtocol int32
+
+const (
+	ExposeProtocol_EXPOSE_HTTP  ExposeProtocol = 0
+	ExposeProtocol_EXPOSE_HTTPS ExposeProtocol = 1
+	ExposeProtocol_EXPOSE_TCP   ExposeProtocol = 2
+	ExposeProtocol_EXPOSE_UDP   ExposeProtocol = 3
+)
+
+// Enum value maps for ExposeProtocol.
+var (
+	ExposeProtocol_name = map[int32]string{
+		0: "EXPOSE_HTTP",
+		1: "EXPOSE_HTTPS",
+		2: "EXPOSE_TCP",
+		3: "EXPOSE_UDP",
+	}
+	ExposeProtocol_value = map[string]int32{
+		"EXPOSE_HTTP":  0,
+		"EXPOSE_HTTPS": 1,
+		"EXPOSE_TCP":   2,
+		"EXPOSE_UDP":   3,
+	}
+)
+
+func (x ExposeProtocol) Enum() *ExposeProtocol {
+	p := new(ExposeProtocol)
+	*p = x
+	return p
+}
+
+func (x ExposeProtocol) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ExposeProtocol) Descriptor() protoreflect.EnumDescriptor {
+	return file_management_proto_enumTypes[4].Descriptor()
+}
+
+func (ExposeProtocol) Type() protoreflect.EnumType {
+	return &file_management_proto_enumTypes[4]
+}
+
+func (x ExposeProtocol) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ExposeProtocol.Descriptor instead.
+func (ExposeProtocol) EnumDescriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{4}
+}
+
 type HostConfig_Protocol int32
 
 const (
@@ -260,11 +312,11 @@ func (x HostConfig_Protocol) String() string {
 }
 
 func (HostConfig_Protocol) Descriptor() protoreflect.EnumDescriptor {
-	return file_management_proto_enumTypes[4].Descriptor()
+	return file_management_proto_enumTypes[5].Descriptor()
 }
 
 func (HostConfig_Protocol) Type() protoreflect.EnumType {
-	return &file_management_proto_enumTypes[4]
+	return &file_management_proto_enumTypes[5]
 }
 
 func (x HostConfig_Protocol) Number() protoreflect.EnumNumber {
@@ -303,11 +355,11 @@ func (x DeviceAuthorizationFlowProvider) String() string {
 }
 
 func (DeviceAuthorizationFlowProvider) Descriptor() protoreflect.EnumDescriptor {
-	return file_management_proto_enumTypes[5].Descriptor()
+	return file_management_proto_enumTypes[6].Descriptor()
 }
 
 func (DeviceAuthorizationFlowProvider) Type() protoreflect.EnumType {
-	return &file_management_proto_enumTypes[5]
+	return &file_management_proto_enumTypes[6]
 }
 
 func (x DeviceAuthorizationFlowProvider) Number() protoreflect.EnumNumber {
@@ -3983,6 +4035,334 @@ func (x *ForwardingRule) GetTranslatedPort() *PortInfo {
 	return nil
 }
 
+type ExposeServiceRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Port       uint32         `protobuf:"varint,1,opt,name=port,proto3" json:"port,omitempty"`
+	Protocol   ExposeProtocol `protobuf:"varint,2,opt,name=protocol,proto3,enum=management.ExposeProtocol" json:"protocol,omitempty"`
+	Pin        string         `protobuf:"bytes,3,opt,name=pin,proto3" json:"pin,omitempty"`
+	Password   string         `protobuf:"bytes,4,opt,name=password,proto3" json:"password,omitempty"`
+	UserGroups []string       `protobuf:"bytes,5,rep,name=user_groups,json=userGroups,proto3" json:"user_groups,omitempty"`
+	Domain     string         `protobuf:"bytes,6,opt,name=domain,proto3" json:"domain,omitempty"`
+	NamePrefix string         `protobuf:"bytes,7,opt,name=name_prefix,json=namePrefix,proto3" json:"name_prefix,omitempty"`
+}
+
+func (x *ExposeServiceRequest) Reset() {
+	*x = ExposeServiceRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[47]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExposeServiceRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExposeServiceRequest) ProtoMessage() {}
+
+func (x *ExposeServiceRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[47]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExposeServiceRequest.ProtoReflect.Descriptor instead.
+func (*ExposeServiceRequest) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{47}
+}
+
+func (x *ExposeServiceRequest) GetPort() uint32 {
+	if x != nil {
+		return x.Port
+	}
+	return 0
+}
+
+func (x *ExposeServiceRequest) GetProtocol() ExposeProtocol {
+	if x != nil {
+		return x.Protocol
+	}
+	return ExposeProtocol_EXPOSE_HTTP
+}
+
+func (x *ExposeServiceRequest) GetPin() string {
+	if x != nil {
+		return x.Pin
+	}
+	return ""
+}
+
+func (x *ExposeServiceRequest) GetPassword() string {
+	if x != nil {
+		return x.Password
+	}
+	return ""
+}
+
+func (x *ExposeServiceRequest) GetUserGroups() []string {
+	if x != nil {
+		return x.UserGroups
+	}
+	return nil
+}
+
+func (x *ExposeServiceRequest) GetDomain() string {
+	if x != nil {
+		return x.Domain
+	}
+	return ""
+}
+
+func (x *ExposeServiceRequest) GetNamePrefix() string {
+	if x != nil {
+		return x.NamePrefix
+	}
+	return ""
+}
+
+type ExposeServiceResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ServiceName string `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	ServiceUrl  string `protobuf:"bytes,2,opt,name=service_url,json=serviceUrl,proto3" json:"service_url,omitempty"`
+	Domain      string `protobuf:"bytes,3,opt,name=domain,proto3" json:"domain,omitempty"`
+}
+
+func (x *ExposeServiceResponse) Reset() {
+	*x = ExposeServiceResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[48]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExposeServiceResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExposeServiceResponse) ProtoMessage() {}
+
+func (x *ExposeServiceResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[48]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExposeServiceResponse.ProtoReflect.Descriptor instead.
+func (*ExposeServiceResponse) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{48}
+}
+
+func (x *ExposeServiceResponse) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *ExposeServiceResponse) GetServiceUrl() string {
+	if x != nil {
+		return x.ServiceUrl
+	}
+	return ""
+}
+
+func (x *ExposeServiceResponse) GetDomain() string {
+	if x != nil {
+		return x.Domain
+	}
+	return ""
+}
+
+type RenewExposeRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Domain string `protobuf:"bytes,1,opt,name=domain,proto3" json:"domain,omitempty"`
+}
+
+func (x *RenewExposeRequest) Reset() {
+	*x = RenewExposeRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[49]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RenewExposeRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RenewExposeRequest) ProtoMessage() {}
+
+func (x *RenewExposeRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[49]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RenewExposeRequest.ProtoReflect.Descriptor instead.
+func (*RenewExposeRequest) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{49}
+}
+
+func (x *RenewExposeRequest) GetDomain() string {
+	if x != nil {
+		return x.Domain
+	}
+	return ""
+}
+
+type RenewExposeResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *RenewExposeResponse) Reset() {
+	*x = RenewExposeResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[50]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RenewExposeResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RenewExposeResponse) ProtoMessage() {}
+
+func (x *RenewExposeResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[50]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RenewExposeResponse.ProtoReflect.Descriptor instead.
+func (*RenewExposeResponse) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{50}
+}
+
+type StopExposeRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Domain string `protobuf:"bytes,1,opt,name=domain,proto3" json:"domain,omitempty"`
+}
+
+func (x *StopExposeRequest) Reset() {
+	*x = StopExposeRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[51]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StopExposeRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StopExposeRequest) ProtoMessage() {}
+
+func (x *StopExposeRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[51]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StopExposeRequest.ProtoReflect.Descriptor instead.
+func (*StopExposeRequest) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{51}
+}
+
+func (x *StopExposeRequest) GetDomain() string {
+	if x != nil {
+		return x.Domain
+	}
+	return ""
+}
+
+type StopExposeResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *StopExposeResponse) Reset() {
+	*x = StopExposeResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_management_proto_msgTypes[52]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StopExposeResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StopExposeResponse) ProtoMessage() {}
+
+func (x *StopExposeResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_management_proto_msgTypes[52]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StopExposeResponse.ProtoReflect.Descriptor instead.
+func (*StopExposeResponse) Descriptor() ([]byte, []int) {
+	return file_management_proto_rawDescGZIP(), []int{52}
+}
+
 type PortInfo_Range struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -3995,7 +4375,7 @@ type PortInfo_Range struct {
 func (x *PortInfo_Range) Reset() {
 	*x = PortInfo_Range{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_management_proto_msgTypes[48]
+		mi := &file_management_proto_msgTypes[54]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -4008,7 +4388,7 @@ func (x *PortInfo_Range) String() string {
 func (*PortInfo_Range) ProtoMessage() {}
 
 func (x *PortInfo_Range) ProtoReflect() protoreflect.Message {
-	mi := &file_management_proto_msgTypes[48]
+	mi := &file_management_proto_msgTypes[54]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -4616,62 +4996,113 @@ var file_management_proto_rawDesc = []byte{
 	0x64, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6d, 0x61,
 	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x49, 0x6e, 0x66,
 	0x6f, 0x52, 0x0e, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x50, 0x6f, 0x72,
-	0x74, 0x2a, 0x3a, 0x0a, 0x09, 0x4a, 0x6f, 0x62, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x12,
-	0x0a, 0x0e, 0x75, 0x6e, 0x6b, 0x6e, 0x6f, 0x77, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x73, 0x75, 0x63, 0x63, 0x65, 0x65, 0x64, 0x65, 0x64, 0x10,
-	0x01, 0x12, 0x0a, 0x0a, 0x06, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x10, 0x02, 0x2a, 0x4c, 0x0a,
-	0x0c, 0x52, 0x75, 0x6c, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x0b, 0x0a,
-	0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x41, 0x4c,
-	0x4c, 0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x43, 0x50, 0x10, 0x02, 0x12, 0x07, 0x0a, 0x03,
-	0x55, 0x44, 0x50, 0x10, 0x03, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x43, 0x4d, 0x50, 0x10, 0x04, 0x12,
-	0x0a, 0x0a, 0x06, 0x43, 0x55, 0x53, 0x54, 0x4f, 0x4d, 0x10, 0x05, 0x2a, 0x20, 0x0a, 0x0d, 0x52,
-	0x75, 0x6c, 0x65, 0x44, 0x69, 0x72, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x06, 0x0a, 0x02,
-	0x49, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x4f, 0x55, 0x54, 0x10, 0x01, 0x2a, 0x22, 0x0a,
-	0x0a, 0x52, 0x75, 0x6c, 0x65, 0x41, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0a, 0x0a, 0x06, 0x41,
-	0x43, 0x43, 0x45, 0x50, 0x54, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x44, 0x52, 0x4f, 0x50, 0x10,
-	0x01, 0x32, 0x96, 0x05, 0x0a, 0x11, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x45, 0x0a, 0x05, 0x4c, 0x6f, 0x67, 0x69, 0x6e,
-	0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e,
-	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72,
-	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x46,
-	0x0a, 0x04, 0x53, 0x79, 0x6e, 0x63, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x74, 0x22, 0xea, 0x01, 0x0a, 0x14, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f,
+	0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x36,
+	0x0a, 0x08, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x1a, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x78,
+	0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x08, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x6e, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73,
+	0x77, 0x6f, 0x72, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f,
+	0x75, 0x70, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x75, 0x73, 0x65, 0x72, 0x47,
+	0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18,
+	0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x12, 0x1f, 0x0a,
+	0x0b, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x07, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x22, 0x73,
+	0x0a, 0x15, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0a, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x55, 0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x64,
+	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x22, 0x2c, 0x0a, 0x12, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f,
+	0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x22, 0x15, 0x0a, 0x13, 0x52, 0x65, 0x6e, 0x65, 0x77, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x2b, 0x0a, 0x11, 0x53, 0x74, 0x6f, 0x70,
+	0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x16, 0x0a,
+	0x06, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64,
+	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x22, 0x14, 0x0a, 0x12, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70,
+	0x6f, 0x73, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2a, 0x3a, 0x0a, 0x09, 0x4a,
+	0x6f, 0x62, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x12, 0x0a, 0x0e, 0x75, 0x6e, 0x6b, 0x6e,
+	0x6f, 0x77, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09,
+	0x73, 0x75, 0x63, 0x63, 0x65, 0x65, 0x64, 0x65, 0x64, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x66,
+	0x61, 0x69, 0x6c, 0x65, 0x64, 0x10, 0x02, 0x2a, 0x4c, 0x0a, 0x0c, 0x52, 0x75, 0x6c, 0x65, 0x50,
+	0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f,
+	0x57, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x41, 0x4c, 0x4c, 0x10, 0x01, 0x12, 0x07, 0x0a,
+	0x03, 0x54, 0x43, 0x50, 0x10, 0x02, 0x12, 0x07, 0x0a, 0x03, 0x55, 0x44, 0x50, 0x10, 0x03, 0x12,
+	0x08, 0x0a, 0x04, 0x49, 0x43, 0x4d, 0x50, 0x10, 0x04, 0x12, 0x0a, 0x0a, 0x06, 0x43, 0x55, 0x53,
+	0x54, 0x4f, 0x4d, 0x10, 0x05, 0x2a, 0x20, 0x0a, 0x0d, 0x52, 0x75, 0x6c, 0x65, 0x44, 0x69, 0x72,
+	0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x06, 0x0a, 0x02, 0x49, 0x4e, 0x10, 0x00, 0x12, 0x07,
+	0x0a, 0x03, 0x4f, 0x55, 0x54, 0x10, 0x01, 0x2a, 0x22, 0x0a, 0x0a, 0x52, 0x75, 0x6c, 0x65, 0x41,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x0a, 0x0a, 0x06, 0x41, 0x43, 0x43, 0x45, 0x50, 0x54, 0x10,
+	0x00, 0x12, 0x08, 0x0a, 0x04, 0x44, 0x52, 0x4f, 0x50, 0x10, 0x01, 0x2a, 0x53, 0x0a, 0x0e, 0x45,
+	0x78, 0x70, 0x6f, 0x73, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x0f, 0x0a,
+	0x0b, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x10, 0x00, 0x12, 0x10,
+	0x0a, 0x0c, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x48, 0x54, 0x54, 0x50, 0x53, 0x10, 0x01,
+	0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x54, 0x43, 0x50, 0x10, 0x02,
+	0x12, 0x0e, 0x0a, 0x0a, 0x45, 0x58, 0x50, 0x4f, 0x53, 0x45, 0x5f, 0x55, 0x44, 0x50, 0x10, 0x03,
+	0x32, 0xfd, 0x06, 0x0a, 0x11, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x53,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x45, 0x0a, 0x05, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12,
+	0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63,
+	0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e,
+	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79,
+	0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x46, 0x0a,
+	0x04, 0x53, 0x79, 0x6e, 0x63, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
+	0x65, 0x22, 0x00, 0x30, 0x01, 0x12, 0x42, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x4b, 0x65, 0x79, 0x12, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
+	0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
+	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x33, 0x0a, 0x09, 0x69, 0x73, 0x48,
+	0x65, 0x61, 0x6c, 0x74, 0x68, 0x79, 0x12, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x5a,
+	0x0a, 0x1a, 0x47, 0x65, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x6f,
+	0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x1c, 0x2e, 0x6d,
+	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70,
+	0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e,
+	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65,
+	0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x18, 0x47, 0x65,
+	0x74, 0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
 	0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73,
 	0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
 	0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x22, 0x00, 0x30, 0x01, 0x12, 0x42, 0x0a, 0x0c, 0x47, 0x65, 0x74, 0x53, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x4b, 0x65, 0x79, 0x12, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
-	0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1d, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4b, 0x65, 0x79,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x33, 0x0a, 0x09, 0x69, 0x73,
-	0x48, 0x65, 0x61, 0x6c, 0x74, 0x68, 0x79, 0x12, 0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x11, 0x2e, 0x6d, 0x61, 0x6e,
-	0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12,
-	0x5a, 0x0a, 0x1a, 0x47, 0x65, 0x74, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68,
-	0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x1c, 0x2e,
+	0x67, 0x65, 0x22, 0x00, 0x12, 0x3d, 0x0a, 0x08, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x65, 0x74, 0x61,
+	0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e,
+	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x11,
+	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74,
+	0x79, 0x22, 0x00, 0x12, 0x3b, 0x0a, 0x06, 0x4c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x12, 0x1c, 0x2e,
 	0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79,
-	0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61,
-	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74,
-	0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x58, 0x0a, 0x18, 0x47,
-	0x65, 0x74, 0x50, 0x4b, 0x43, 0x45, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x46, 0x6c, 0x6f, 0x77, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x11, 0x2e, 0x6d, 0x61,
+	0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00,
+	0x12, 0x47, 0x0a, 0x03, 0x4a, 0x6f, 0x62, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
 	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
 	0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65,
 	0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73,
-	0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x3d, 0x0a, 0x08, 0x53, 0x79, 0x6e, 0x63, 0x4d, 0x65, 0x74,
-	0x61, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45,
-	0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a,
-	0x11, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70,
-	0x74, 0x79, 0x22, 0x00, 0x12, 0x3b, 0x0a, 0x06, 0x4c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x12, 0x1c,
-	0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72,
-	0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x11, 0x2e, 0x6d,
-	0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22,
-	0x00, 0x12, 0x47, 0x0a, 0x03, 0x4a, 0x6f, 0x62, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d,
-	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
+	0x61, 0x67, 0x65, 0x22, 0x00, 0x28, 0x01, 0x30, 0x01, 0x12, 0x4c, 0x0a, 0x0c, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64,
+	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65,
+	0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x12, 0x4b, 0x0a, 0x0b, 0x52, 0x65, 0x6e, 0x65, 0x77,
+	0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d,
 	0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73,
-	0x73, 0x61, 0x67, 0x65, 0x22, 0x00, 0x28, 0x01, 0x30, 0x01, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x73, 0x61, 0x67, 0x65, 0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x2e, 0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x22, 0x00, 0x12, 0x4a, 0x0a, 0x0a, 0x53, 0x74, 0x6f, 0x70, 0x45, 0x78, 0x70, 0x6f,
+	0x73, 0x65, 0x12, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x45, 0x6e, 0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x1a, 0x1c, 0x2e, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x45, 0x6e,
+	0x63, 0x72, 0x79, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x22, 0x00,
+	0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
 }
 
 var (
@@ -4686,152 +5117,166 @@ func file_management_proto_rawDescGZIP() []byte {
 	return file_management_proto_rawDescData
 }
 
-var file_management_proto_enumTypes = make([]protoimpl.EnumInfo, 6)
-var file_management_proto_msgTypes = make([]protoimpl.MessageInfo, 49)
+var file_management_proto_enumTypes = make([]protoimpl.EnumInfo, 7)
+var file_management_proto_msgTypes = make([]protoimpl.MessageInfo, 55)
 var file_management_proto_goTypes = []interface{}{
 	(JobStatus)(0),                         // 0: management.JobStatus
 	(RuleProtocol)(0),                      // 1: management.RuleProtocol
 	(RuleDirection)(0),                     // 2: management.RuleDirection
 	(RuleAction)(0),                        // 3: management.RuleAction
-	(HostConfig_Protocol)(0),               // 4: management.HostConfig.Protocol
-	(DeviceAuthorizationFlowProvider)(0),   // 5: management.DeviceAuthorizationFlow.provider
-	(*EncryptedMessage)(nil),               // 6: management.EncryptedMessage
-	(*JobRequest)(nil),                     // 7: management.JobRequest
-	(*JobResponse)(nil),                    // 8: management.JobResponse
-	(*BundleParameters)(nil),               // 9: management.BundleParameters
-	(*BundleResult)(nil),                   // 10: management.BundleResult
-	(*SyncRequest)(nil),                    // 11: management.SyncRequest
-	(*SyncResponse)(nil),                   // 12: management.SyncResponse
-	(*SyncMetaRequest)(nil),                // 13: management.SyncMetaRequest
-	(*LoginRequest)(nil),                   // 14: management.LoginRequest
-	(*PeerKeys)(nil),                       // 15: management.PeerKeys
-	(*Environment)(nil),                    // 16: management.Environment
-	(*File)(nil),                           // 17: management.File
-	(*Flags)(nil),                          // 18: management.Flags
-	(*PeerSystemMeta)(nil),                 // 19: management.PeerSystemMeta
-	(*LoginResponse)(nil),                  // 20: management.LoginResponse
-	(*ServerKeyResponse)(nil),              // 21: management.ServerKeyResponse
-	(*Empty)(nil),                          // 22: management.Empty
-	(*NetbirdConfig)(nil),                  // 23: management.NetbirdConfig
-	(*HostConfig)(nil),                     // 24: management.HostConfig
-	(*RelayConfig)(nil),                    // 25: management.RelayConfig
-	(*FlowConfig)(nil),                     // 26: management.FlowConfig
-	(*JWTConfig)(nil),                      // 27: management.JWTConfig
-	(*ProtectedHostConfig)(nil),            // 28: management.ProtectedHostConfig
-	(*PeerConfig)(nil),                     // 29: management.PeerConfig
-	(*AutoUpdateSettings)(nil),             // 30: management.AutoUpdateSettings
-	(*NetworkMap)(nil),                     // 31: management.NetworkMap
-	(*SSHAuth)(nil),                        // 32: management.SSHAuth
-	(*MachineUserIndexes)(nil),             // 33: management.MachineUserIndexes
-	(*RemotePeerConfig)(nil),               // 34: management.RemotePeerConfig
-	(*SSHConfig)(nil),                      // 35: management.SSHConfig
-	(*DeviceAuthorizationFlowRequest)(nil), // 36: management.DeviceAuthorizationFlowRequest
-	(*DeviceAuthorizationFlow)(nil),        // 37: management.DeviceAuthorizationFlow
-	(*PKCEAuthorizationFlowRequest)(nil),   // 38: management.PKCEAuthorizationFlowRequest
-	(*PKCEAuthorizationFlow)(nil),          // 39: management.PKCEAuthorizationFlow
-	(*ProviderConfig)(nil),                 // 40: management.ProviderConfig
-	(*Route)(nil),                          // 41: management.Route
-	(*DNSConfig)(nil),                      // 42: management.DNSConfig
-	(*CustomZone)(nil),                     // 43: management.CustomZone
-	(*SimpleRecord)(nil),                   // 44: management.SimpleRecord
-	(*NameServerGroup)(nil),                // 45: management.NameServerGroup
-	(*NameServer)(nil),                     // 46: management.NameServer
-	(*FirewallRule)(nil),                   // 47: management.FirewallRule
-	(*NetworkAddress)(nil),                 // 48: management.NetworkAddress
-	(*Checks)(nil),                         // 49: management.Checks
-	(*PortInfo)(nil),                       // 50: management.PortInfo
-	(*RouteFirewallRule)(nil),              // 51: management.RouteFirewallRule
-	(*ForwardingRule)(nil),                 // 52: management.ForwardingRule
-	nil,                                    // 53: management.SSHAuth.MachineUsersEntry
-	(*PortInfo_Range)(nil),                 // 54: management.PortInfo.Range
-	(*timestamppb.Timestamp)(nil),          // 55: google.protobuf.Timestamp
-	(*durationpb.Duration)(nil),            // 56: google.protobuf.Duration
+	(ExposeProtocol)(0),                    // 4: management.ExposeProtocol
+	(HostConfig_Protocol)(0),               // 5: management.HostConfig.Protocol
+	(DeviceAuthorizationFlowProvider)(0),   // 6: management.DeviceAuthorizationFlow.provider
+	(*EncryptedMessage)(nil),               // 7: management.EncryptedMessage
+	(*JobRequest)(nil),                     // 8: management.JobRequest
+	(*JobResponse)(nil),                    // 9: management.JobResponse
+	(*BundleParameters)(nil),               // 10: management.BundleParameters
+	(*BundleResult)(nil),                   // 11: management.BundleResult
+	(*SyncRequest)(nil),                    // 12: management.SyncRequest
+	(*SyncResponse)(nil),                   // 13: management.SyncResponse
+	(*SyncMetaRequest)(nil),                // 14: management.SyncMetaRequest
+	(*LoginRequest)(nil),                   // 15: management.LoginRequest
+	(*PeerKeys)(nil),                       // 16: management.PeerKeys
+	(*Environment)(nil),                    // 17: management.Environment
+	(*File)(nil),                           // 18: management.File
+	(*Flags)(nil),                          // 19: management.Flags
+	(*PeerSystemMeta)(nil),                 // 20: management.PeerSystemMeta
+	(*LoginResponse)(nil),                  // 21: management.LoginResponse
+	(*ServerKeyResponse)(nil),              // 22: management.ServerKeyResponse
+	(*Empty)(nil),                          // 23: management.Empty
+	(*NetbirdConfig)(nil),                  // 24: management.NetbirdConfig
+	(*HostConfig)(nil),                     // 25: management.HostConfig
+	(*RelayConfig)(nil),                    // 26: management.RelayConfig
+	(*FlowConfig)(nil),                     // 27: management.FlowConfig
+	(*JWTConfig)(nil),                      // 28: management.JWTConfig
+	(*ProtectedHostConfig)(nil),            // 29: management.ProtectedHostConfig
+	(*PeerConfig)(nil),                     // 30: management.PeerConfig
+	(*AutoUpdateSettings)(nil),             // 31: management.AutoUpdateSettings
+	(*NetworkMap)(nil),                     // 32: management.NetworkMap
+	(*SSHAuth)(nil),                        // 33: management.SSHAuth
+	(*MachineUserIndexes)(nil),             // 34: management.MachineUserIndexes
+	(*RemotePeerConfig)(nil),               // 35: management.RemotePeerConfig
+	(*SSHConfig)(nil),                      // 36: management.SSHConfig
+	(*DeviceAuthorizationFlowRequest)(nil), // 37: management.DeviceAuthorizationFlowRequest
+	(*DeviceAuthorizationFlow)(nil),        // 38: management.DeviceAuthorizationFlow
+	(*PKCEAuthorizationFlowRequest)(nil),   // 39: management.PKCEAuthorizationFlowRequest
+	(*PKCEAuthorizationFlow)(nil),          // 40: management.PKCEAuthorizationFlow
+	(*ProviderConfig)(nil),                 // 41: management.ProviderConfig
+	(*Route)(nil),                          // 42: management.Route
+	(*DNSConfig)(nil),                      // 43: management.DNSConfig
+	(*CustomZone)(nil),                     // 44: management.CustomZone
+	(*SimpleRecord)(nil),                   // 45: management.SimpleRecord
+	(*NameServerGroup)(nil),                // 46: management.NameServerGroup
+	(*NameServer)(nil),                     // 47: management.NameServer
+	(*FirewallRule)(nil),                   // 48: management.FirewallRule
+	(*NetworkAddress)(nil),                 // 49: management.NetworkAddress
+	(*Checks)(nil),                         // 50: management.Checks
+	(*PortInfo)(nil),                       // 51: management.PortInfo
+	(*RouteFirewallRule)(nil),              // 52: management.RouteFirewallRule
+	(*ForwardingRule)(nil),                 // 53: management.ForwardingRule
+	(*ExposeServiceRequest)(nil),           // 54: management.ExposeServiceRequest
+	(*ExposeServiceResponse)(nil),          // 55: management.ExposeServiceResponse
+	(*RenewExposeRequest)(nil),             // 56: management.RenewExposeRequest
+	(*RenewExposeResponse)(nil),            // 57: management.RenewExposeResponse
+	(*StopExposeRequest)(nil),              // 58: management.StopExposeRequest
+	(*StopExposeResponse)(nil),             // 59: management.StopExposeResponse
+	nil,                                    // 60: management.SSHAuth.MachineUsersEntry
+	(*PortInfo_Range)(nil),                 // 61: management.PortInfo.Range
+	(*timestamppb.Timestamp)(nil),          // 62: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),            // 63: google.protobuf.Duration
 }
 var file_management_proto_depIdxs = []int32{
-	9,  // 0: management.JobRequest.bundle:type_name -> management.BundleParameters
+	10, // 0: management.JobRequest.bundle:type_name -> management.BundleParameters
 	0,  // 1: management.JobResponse.status:type_name -> management.JobStatus
-	10, // 2: management.JobResponse.bundle:type_name -> management.BundleResult
-	19, // 3: management.SyncRequest.meta:type_name -> management.PeerSystemMeta
-	23, // 4: management.SyncResponse.netbirdConfig:type_name -> management.NetbirdConfig
-	29, // 5: management.SyncResponse.peerConfig:type_name -> management.PeerConfig
-	34, // 6: management.SyncResponse.remotePeers:type_name -> management.RemotePeerConfig
-	31, // 7: management.SyncResponse.NetworkMap:type_name -> management.NetworkMap
-	49, // 8: management.SyncResponse.Checks:type_name -> management.Checks
-	19, // 9: management.SyncMetaRequest.meta:type_name -> management.PeerSystemMeta
-	19, // 10: management.LoginRequest.meta:type_name -> management.PeerSystemMeta
-	15, // 11: management.LoginRequest.peerKeys:type_name -> management.PeerKeys
-	48, // 12: management.PeerSystemMeta.networkAddresses:type_name -> management.NetworkAddress
-	16, // 13: management.PeerSystemMeta.environment:type_name -> management.Environment
-	17, // 14: management.PeerSystemMeta.files:type_name -> management.File
-	18, // 15: management.PeerSystemMeta.flags:type_name -> management.Flags
-	23, // 16: management.LoginResponse.netbirdConfig:type_name -> management.NetbirdConfig
-	29, // 17: management.LoginResponse.peerConfig:type_name -> management.PeerConfig
-	49, // 18: management.LoginResponse.Checks:type_name -> management.Checks
-	55, // 19: management.ServerKeyResponse.expiresAt:type_name -> google.protobuf.Timestamp
-	24, // 20: management.NetbirdConfig.stuns:type_name -> management.HostConfig
-	28, // 21: management.NetbirdConfig.turns:type_name -> management.ProtectedHostConfig
-	24, // 22: management.NetbirdConfig.signal:type_name -> management.HostConfig
-	25, // 23: management.NetbirdConfig.relay:type_name -> management.RelayConfig
-	26, // 24: management.NetbirdConfig.flow:type_name -> management.FlowConfig
-	4,  // 25: management.HostConfig.protocol:type_name -> management.HostConfig.Protocol
-	56, // 26: management.FlowConfig.interval:type_name -> google.protobuf.Duration
-	24, // 27: management.ProtectedHostConfig.hostConfig:type_name -> management.HostConfig
-	35, // 28: management.PeerConfig.sshConfig:type_name -> management.SSHConfig
-	30, // 29: management.PeerConfig.autoUpdate:type_name -> management.AutoUpdateSettings
-	29, // 30: management.NetworkMap.peerConfig:type_name -> management.PeerConfig
-	34, // 31: management.NetworkMap.remotePeers:type_name -> management.RemotePeerConfig
-	41, // 32: management.NetworkMap.Routes:type_name -> management.Route
-	42, // 33: management.NetworkMap.DNSConfig:type_name -> management.DNSConfig
-	34, // 34: management.NetworkMap.offlinePeers:type_name -> management.RemotePeerConfig
-	47, // 35: management.NetworkMap.FirewallRules:type_name -> management.FirewallRule
-	51, // 36: management.NetworkMap.routesFirewallRules:type_name -> management.RouteFirewallRule
-	52, // 37: management.NetworkMap.forwardingRules:type_name -> management.ForwardingRule
-	32, // 38: management.NetworkMap.sshAuth:type_name -> management.SSHAuth
-	53, // 39: management.SSHAuth.machine_users:type_name -> management.SSHAuth.MachineUsersEntry
-	35, // 40: management.RemotePeerConfig.sshConfig:type_name -> management.SSHConfig
-	27, // 41: management.SSHConfig.jwtConfig:type_name -> management.JWTConfig
-	5,  // 42: management.DeviceAuthorizationFlow.Provider:type_name -> management.DeviceAuthorizationFlow.provider
-	40, // 43: management.DeviceAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
-	40, // 44: management.PKCEAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
-	45, // 45: management.DNSConfig.NameServerGroups:type_name -> management.NameServerGroup
-	43, // 46: management.DNSConfig.CustomZones:type_name -> management.CustomZone
-	44, // 47: management.CustomZone.Records:type_name -> management.SimpleRecord
-	46, // 48: management.NameServerGroup.NameServers:type_name -> management.NameServer
+	11, // 2: management.JobResponse.bundle:type_name -> management.BundleResult
+	20, // 3: management.SyncRequest.meta:type_name -> management.PeerSystemMeta
+	24, // 4: management.SyncResponse.netbirdConfig:type_name -> management.NetbirdConfig
+	30, // 5: management.SyncResponse.peerConfig:type_name -> management.PeerConfig
+	35, // 6: management.SyncResponse.remotePeers:type_name -> management.RemotePeerConfig
+	32, // 7: management.SyncResponse.NetworkMap:type_name -> management.NetworkMap
+	50, // 8: management.SyncResponse.Checks:type_name -> management.Checks
+	20, // 9: management.SyncMetaRequest.meta:type_name -> management.PeerSystemMeta
+	20, // 10: management.LoginRequest.meta:type_name -> management.PeerSystemMeta
+	16, // 11: management.LoginRequest.peerKeys:type_name -> management.PeerKeys
+	49, // 12: management.PeerSystemMeta.networkAddresses:type_name -> management.NetworkAddress
+	17, // 13: management.PeerSystemMeta.environment:type_name -> management.Environment
+	18, // 14: management.PeerSystemMeta.files:type_name -> management.File
+	19, // 15: management.PeerSystemMeta.flags:type_name -> management.Flags
+	24, // 16: management.LoginResponse.netbirdConfig:type_name -> management.NetbirdConfig
+	30, // 17: management.LoginResponse.peerConfig:type_name -> management.PeerConfig
+	50, // 18: management.LoginResponse.Checks:type_name -> management.Checks
+	62, // 19: management.ServerKeyResponse.expiresAt:type_name -> google.protobuf.Timestamp
+	25, // 20: management.NetbirdConfig.stuns:type_name -> management.HostConfig
+	29, // 21: management.NetbirdConfig.turns:type_name -> management.ProtectedHostConfig
+	25, // 22: management.NetbirdConfig.signal:type_name -> management.HostConfig
+	26, // 23: management.NetbirdConfig.relay:type_name -> management.RelayConfig
+	27, // 24: management.NetbirdConfig.flow:type_name -> management.FlowConfig
+	5,  // 25: management.HostConfig.protocol:type_name -> management.HostConfig.Protocol
+	63, // 26: management.FlowConfig.interval:type_name -> google.protobuf.Duration
+	25, // 27: management.ProtectedHostConfig.hostConfig:type_name -> management.HostConfig
+	36, // 28: management.PeerConfig.sshConfig:type_name -> management.SSHConfig
+	31, // 29: management.PeerConfig.autoUpdate:type_name -> management.AutoUpdateSettings
+	30, // 30: management.NetworkMap.peerConfig:type_name -> management.PeerConfig
+	35, // 31: management.NetworkMap.remotePeers:type_name -> management.RemotePeerConfig
+	42, // 32: management.NetworkMap.Routes:type_name -> management.Route
+	43, // 33: management.NetworkMap.DNSConfig:type_name -> management.DNSConfig
+	35, // 34: management.NetworkMap.offlinePeers:type_name -> management.RemotePeerConfig
+	48, // 35: management.NetworkMap.FirewallRules:type_name -> management.FirewallRule
+	52, // 36: management.NetworkMap.routesFirewallRules:type_name -> management.RouteFirewallRule
+	53, // 37: management.NetworkMap.forwardingRules:type_name -> management.ForwardingRule
+	33, // 38: management.NetworkMap.sshAuth:type_name -> management.SSHAuth
+	60, // 39: management.SSHAuth.machine_users:type_name -> management.SSHAuth.MachineUsersEntry
+	36, // 40: management.RemotePeerConfig.sshConfig:type_name -> management.SSHConfig
+	28, // 41: management.SSHConfig.jwtConfig:type_name -> management.JWTConfig
+	6,  // 42: management.DeviceAuthorizationFlow.Provider:type_name -> management.DeviceAuthorizationFlow.provider
+	41, // 43: management.DeviceAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
+	41, // 44: management.PKCEAuthorizationFlow.ProviderConfig:type_name -> management.ProviderConfig
+	46, // 45: management.DNSConfig.NameServerGroups:type_name -> management.NameServerGroup
+	44, // 46: management.DNSConfig.CustomZones:type_name -> management.CustomZone
+	45, // 47: management.CustomZone.Records:type_name -> management.SimpleRecord
+	47, // 48: management.NameServerGroup.NameServers:type_name -> management.NameServer
 	2,  // 49: management.FirewallRule.Direction:type_name -> management.RuleDirection
 	3,  // 50: management.FirewallRule.Action:type_name -> management.RuleAction
 	1,  // 51: management.FirewallRule.Protocol:type_name -> management.RuleProtocol
-	50, // 52: management.FirewallRule.PortInfo:type_name -> management.PortInfo
-	54, // 53: management.PortInfo.range:type_name -> management.PortInfo.Range
+	51, // 52: management.FirewallRule.PortInfo:type_name -> management.PortInfo
+	61, // 53: management.PortInfo.range:type_name -> management.PortInfo.Range
 	3,  // 54: management.RouteFirewallRule.action:type_name -> management.RuleAction
 	1,  // 55: management.RouteFirewallRule.protocol:type_name -> management.RuleProtocol
-	50, // 56: management.RouteFirewallRule.portInfo:type_name -> management.PortInfo
+	51, // 56: management.RouteFirewallRule.portInfo:type_name -> management.PortInfo
 	1,  // 57: management.ForwardingRule.protocol:type_name -> management.RuleProtocol
-	50, // 58: management.ForwardingRule.destinationPort:type_name -> management.PortInfo
-	50, // 59: management.ForwardingRule.translatedPort:type_name -> management.PortInfo
-	33, // 60: management.SSHAuth.MachineUsersEntry.value:type_name -> management.MachineUserIndexes
-	6,  // 61: management.ManagementService.Login:input_type -> management.EncryptedMessage
-	6,  // 62: management.ManagementService.Sync:input_type -> management.EncryptedMessage
-	22, // 63: management.ManagementService.GetServerKey:input_type -> management.Empty
-	22, // 64: management.ManagementService.isHealthy:input_type -> management.Empty
-	6,  // 65: management.ManagementService.GetDeviceAuthorizationFlow:input_type -> management.EncryptedMessage
-	6,  // 66: management.ManagementService.GetPKCEAuthorizationFlow:input_type -> management.EncryptedMessage
-	6,  // 67: management.ManagementService.SyncMeta:input_type -> management.EncryptedMessage
-	6,  // 68: management.ManagementService.Logout:input_type -> management.EncryptedMessage
-	6,  // 69: management.ManagementService.Job:input_type -> management.EncryptedMessage
-	6,  // 70: management.ManagementService.Login:output_type -> management.EncryptedMessage
-	6,  // 71: management.ManagementService.Sync:output_type -> management.EncryptedMessage
-	21, // 72: management.ManagementService.GetServerKey:output_type -> management.ServerKeyResponse
-	22, // 73: management.ManagementService.isHealthy:output_type -> management.Empty
-	6,  // 74: management.ManagementService.GetDeviceAuthorizationFlow:output_type -> management.EncryptedMessage
-	6,  // 75: management.ManagementService.GetPKCEAuthorizationFlow:output_type -> management.EncryptedMessage
-	22, // 76: management.ManagementService.SyncMeta:output_type -> management.Empty
-	22, // 77: management.ManagementService.Logout:output_type -> management.Empty
-	6,  // 78: management.ManagementService.Job:output_type -> management.EncryptedMessage
-	70, // [70:79] is the sub-list for method output_type
-	61, // [61:70] is the sub-list for method input_type
-	61, // [61:61] is the sub-list for extension type_name
-	61, // [61:61] is the sub-list for extension extendee
-	0,  // [0:61] is the sub-list for field type_name
+	51, // 58: management.ForwardingRule.destinationPort:type_name -> management.PortInfo
+	51, // 59: management.ForwardingRule.translatedPort:type_name -> management.PortInfo
+	4,  // 60: management.ExposeServiceRequest.protocol:type_name -> management.ExposeProtocol
+	34, // 61: management.SSHAuth.MachineUsersEntry.value:type_name -> management.MachineUserIndexes
+	7,  // 62: management.ManagementService.Login:input_type -> management.EncryptedMessage
+	7,  // 63: management.ManagementService.Sync:input_type -> management.EncryptedMessage
+	23, // 64: management.ManagementService.GetServerKey:input_type -> management.Empty
+	23, // 65: management.ManagementService.isHealthy:input_type -> management.Empty
+	7,  // 66: management.ManagementService.GetDeviceAuthorizationFlow:input_type -> management.EncryptedMessage
+	7,  // 67: management.ManagementService.GetPKCEAuthorizationFlow:input_type -> management.EncryptedMessage
+	7,  // 68: management.ManagementService.SyncMeta:input_type -> management.EncryptedMessage
+	7,  // 69: management.ManagementService.Logout:input_type -> management.EncryptedMessage
+	7,  // 70: management.ManagementService.Job:input_type -> management.EncryptedMessage
+	7,  // 71: management.ManagementService.CreateExpose:input_type -> management.EncryptedMessage
+	7,  // 72: management.ManagementService.RenewExpose:input_type -> management.EncryptedMessage
+	7,  // 73: management.ManagementService.StopExpose:input_type -> management.EncryptedMessage
+	7,  // 74: management.ManagementService.Login:output_type -> management.EncryptedMessage
+	7,  // 75: management.ManagementService.Sync:output_type -> management.EncryptedMessage
+	22, // 76: management.ManagementService.GetServerKey:output_type -> management.ServerKeyResponse
+	23, // 77: management.ManagementService.isHealthy:output_type -> management.Empty
+	7,  // 78: management.ManagementService.GetDeviceAuthorizationFlow:output_type -> management.EncryptedMessage
+	7,  // 79: management.ManagementService.GetPKCEAuthorizationFlow:output_type -> management.EncryptedMessage
+	23, // 80: management.ManagementService.SyncMeta:output_type -> management.Empty
+	23, // 81: management.ManagementService.Logout:output_type -> management.Empty
+	7,  // 82: management.ManagementService.Job:output_type -> management.EncryptedMessage
+	7,  // 83: management.ManagementService.CreateExpose:output_type -> management.EncryptedMessage
+	7,  // 84: management.ManagementService.RenewExpose:output_type -> management.EncryptedMessage
+	7,  // 85: management.ManagementService.StopExpose:output_type -> management.EncryptedMessage
+	74, // [74:86] is the sub-list for method output_type
+	62, // [62:74] is the sub-list for method input_type
+	62, // [62:62] is the sub-list for extension type_name
+	62, // [62:62] is the sub-list for extension extendee
+	0,  // [0:62] is the sub-list for field type_name
 }
 
 func init() { file_management_proto_init() }
@@ -5404,7 +5849,79 @@ func file_management_proto_init() {
 				return nil
 			}
 		}
+		file_management_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExposeServiceRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 		file_management_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExposeServiceResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RenewExposeRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RenewExposeResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[51].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StopExposeRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[52].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StopExposeResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_management_proto_msgTypes[54].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*PortInfo_Range); i {
 			case 0:
 				return &v.state
@@ -5432,8 +5949,8 @@ func file_management_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_management_proto_rawDesc,
-			NumEnums:      6,
-			NumMessages:   49,
+			NumEnums:      7,
+			NumMessages:   55,
 			NumExtensions: 0,
 			NumServices:   1,
 		},

shared/management/proto/management.proto

@@ -51,6 +51,15 @@ service ManagementService {
 
   // Executes a job on a target peer (e.g., debug bundle)
   rpc Job(stream EncryptedMessage) returns (stream EncryptedMessage) {}
+
+  // CreateExpose creates a temporary reverse proxy service for a peer
+  rpc CreateExpose(EncryptedMessage) returns (EncryptedMessage) {}
+
+  // RenewExpose extends the TTL of an active expose session
+  rpc RenewExpose(EncryptedMessage) returns (EncryptedMessage) {}
+
+  // StopExpose terminates an active expose session
+  rpc StopExpose(EncryptedMessage) returns (EncryptedMessage) {}
 }
 
 message EncryptedMessage {
@@ -637,3 +646,38 @@ message ForwardingRule {
   // Translated port information, where the traffic should be forwarded to
   PortInfo translatedPort = 4;
 }
+
+enum ExposeProtocol {
+  EXPOSE_HTTP = 0;
+  EXPOSE_HTTPS = 1;
+  EXPOSE_TCP = 2;
+  EXPOSE_UDP = 3;
+}
+
+message ExposeServiceRequest {
+  uint32 port = 1;
+  ExposeProtocol protocol = 2;
+  string pin = 3;
+  string password = 4;
+  repeated string user_groups = 5;
+  string domain = 6;
+  string name_prefix = 7;
+}
+
+message ExposeServiceResponse {
+  string service_name = 1;
+  string service_url = 2;
+  string domain = 3;
+}
+
+message RenewExposeRequest {
+  string domain = 1;
+}
+
+message RenewExposeResponse {}
+
+message StopExposeRequest {
+  string domain = 1;
+}
+
+message StopExposeResponse {}

shared/management/proto/management_grpc.pb.go

@@ -52,6 +52,12 @@ type ManagementServiceClient interface {
 	Logout(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*Empty, error)
 	// Executes a job on a target peer (e.g., debug bundle)
 	Job(ctx context.Context, opts ...grpc.CallOption) (ManagementService_JobClient, error)
+	// CreateExpose creates a temporary reverse proxy service for a peer
+	CreateExpose(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error)
+	// RenewExpose extends the TTL of an active expose session
+	RenewExpose(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error)
+	// StopExpose terminates an active expose session
+	StopExpose(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error)
 }
 
 type managementServiceClient struct {
@@ -188,6 +194,33 @@ func (x *managementServiceJobClient) Recv() (*EncryptedMessage, error) {
 	return m, nil
 }
 
+func (c *managementServiceClient) CreateExpose(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error) {
+	out := new(EncryptedMessage)
+	err := c.cc.Invoke(ctx, "/management.ManagementService/CreateExpose", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *managementServiceClient) RenewExpose(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error) {
+	out := new(EncryptedMessage)
+	err := c.cc.Invoke(ctx, "/management.ManagementService/RenewExpose", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *managementServiceClient) StopExpose(ctx context.Context, in *EncryptedMessage, opts ...grpc.CallOption) (*EncryptedMessage, error) {
+	out := new(EncryptedMessage)
+	err := c.cc.Invoke(ctx, "/management.ManagementService/StopExpose", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // ManagementServiceServer is the server API for ManagementService service.
 // All implementations must embed UnimplementedManagementServiceServer
 // for forward compatibility
@@ -226,6 +259,12 @@ type ManagementServiceServer interface {
 	Logout(context.Context, *EncryptedMessage) (*Empty, error)
 	// Executes a job on a target peer (e.g., debug bundle)
 	Job(ManagementService_JobServer) error
+	// CreateExpose creates a temporary reverse proxy service for a peer
+	CreateExpose(context.Context, *EncryptedMessage) (*EncryptedMessage, error)
+	// RenewExpose extends the TTL of an active expose session
+	RenewExpose(context.Context, *EncryptedMessage) (*EncryptedMessage, error)
+	// StopExpose terminates an active expose session
+	StopExpose(context.Context, *EncryptedMessage) (*EncryptedMessage, error)
 	mustEmbedUnimplementedManagementServiceServer()
 }
 
@@ -260,6 +299,15 @@ func (UnimplementedManagementServiceServer) Logout(context.Context, *EncryptedMe
 func (UnimplementedManagementServiceServer) Job(ManagementService_JobServer) error {
 	return status.Errorf(codes.Unimplemented, "method Job not implemented")
 }
+func (UnimplementedManagementServiceServer) CreateExpose(context.Context, *EncryptedMessage) (*EncryptedMessage, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateExpose not implemented")
+}
+func (UnimplementedManagementServiceServer) RenewExpose(context.Context, *EncryptedMessage) (*EncryptedMessage, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method RenewExpose not implemented")
+}
+func (UnimplementedManagementServiceServer) StopExpose(context.Context, *EncryptedMessage) (*EncryptedMessage, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method StopExpose not implemented")
+}
 func (UnimplementedManagementServiceServer) mustEmbedUnimplementedManagementServiceServer() {}
 
 // UnsafeManagementServiceServer may be embedded to opt out of forward compatibility for this service.
@@ -446,6 +494,60 @@ func (x *managementServiceJobServer) Recv() (*EncryptedMessage, error) {
 	return m, nil
 }
 
+func _ManagementService_CreateExpose_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(EncryptedMessage)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).CreateExpose(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/management.ManagementService/CreateExpose",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).CreateExpose(ctx, req.(*EncryptedMessage))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ManagementService_RenewExpose_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(EncryptedMessage)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).RenewExpose(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/management.ManagementService/RenewExpose",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).RenewExpose(ctx, req.(*EncryptedMessage))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ManagementService_StopExpose_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(EncryptedMessage)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ManagementServiceServer).StopExpose(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/management.ManagementService/StopExpose",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ManagementServiceServer).StopExpose(ctx, req.(*EncryptedMessage))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // ManagementService_ServiceDesc is the grpc.ServiceDesc for ManagementService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -481,6 +583,18 @@ var ManagementService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "Logout",
 			Handler:    _ManagementService_Logout_Handler,
 		},
+		{
+			MethodName: "CreateExpose",
+			Handler:    _ManagementService_CreateExpose_Handler,
+		},
+		{
+			MethodName: "RenewExpose",
+			Handler:    _ManagementService_RenewExpose_Handler,
+		},
+		{
+			MethodName: "StopExpose",
+			Handler:    _ManagementService_StopExpose_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
 		{

shared/management/proto/proxy_service.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v6.33.0
+// 	protoc        v6.33.3
 // source: proxy_service.proto
 
 package proto