Batch wireguard update operations

.github/workflows/golang-test-linux.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-22.04
     outputs:
       management: ${{ steps.filter.outputs.management }}
-    steps:
+    steps:        
       - name: Checkout code
         uses: actions/checkout@v4
 
@@ -24,8 +24,8 @@ jobs:
         id: filter
         with:
           filters: |
-            management:
-              - 'management/**'
+              management:
+                - 'management/**'
 
       - name: Install Go
         uses: actions/setup-go@v5
@@ -148,7 +148,7 @@ jobs:
 
   test_client_on_docker:
     name: "Client (Docker) / Unit"
-    needs: [ build-cache ]
+    needs: [build-cache]
     runs-on: ubuntu-22.04
     steps:
       - name: Install Go
@@ -181,7 +181,6 @@ jobs:
         env:
           HOST_GOCACHE: ${{ steps.go-env.outputs.cache_dir }}
           HOST_GOMODCACHE: ${{ steps.go-env.outputs.modcache_dir }}
-          CONTAINER: "true"
         run: |
           CONTAINER_GOCACHE="/root/.cache/go-build"
           CONTAINER_GOMODCACHE="/go/pkg/mod"
@@ -199,7 +198,6 @@ jobs:
             -e GOARCH=${GOARCH_TARGET} \
             -e GOCACHE=${CONTAINER_GOCACHE} \
             -e GOMODCACHE=${CONTAINER_GOMODCACHE} \
-            -e CONTAINER=${CONTAINER} \
             golang:1.23-alpine \
             sh -c ' \
               apk update; apk add --no-cache \
@@ -217,7 +215,7 @@ jobs:
           - arch: "386"
             raceFlag: ""
           - arch: "amd64"
-            raceFlag: ""
+            raceFlag: "-race"
     runs-on: ubuntu-22.04
     steps:
       - name: Install Go

client/cmd/root.go

@@ -67,6 +67,7 @@ var (
 	interfaceName           string
 	wireguardPort           uint16
 	networkMonitor          bool
+	serviceName             string
 	autoConnectDisabled     bool
 	extraIFaceBlackList     []string
 	anonymizeFlag           bool
@@ -115,9 +116,15 @@ func init() {
 		defaultDaemonAddr = "tcp://127.0.0.1:41731"
 	}
 
+	defaultServiceName := "netbird"
+	if runtime.GOOS == "windows" {
+		defaultServiceName = "Netbird"
+	}
+
 	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp]://[path|host:port]")
 	rootCmd.PersistentFlags().StringVarP(&managementURL, "management-url", "m", "", fmt.Sprintf("Management Service URL [http|https]://[host]:[port] (default \"%s\")", internal.DefaultManagementURL))
 	rootCmd.PersistentFlags().StringVar(&adminURL, "admin-url", "", fmt.Sprintf("Admin Panel URL [http|https]://[host]:[port] (default \"%s\")", internal.DefaultAdminURL))
+	rootCmd.PersistentFlags().StringVarP(&serviceName, "service", "s", defaultServiceName, "Netbird system service name")
 	rootCmd.PersistentFlags().StringVarP(&configPath, "config", "c", defaultConfigPath, "Netbird config file location")
 	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "l", "info", "sets Netbird log level")
 	rootCmd.PersistentFlags().StringVar(&logFile, "log-file", defaultLogFile, "sets Netbird log path. If console is specified the log will be output to stdout. If syslog is specified the log will be sent to syslog daemon.")
@@ -128,6 +135,7 @@ func init() {
 	rootCmd.PersistentFlags().StringVarP(&hostName, "hostname", "n", "", "Sets a custom hostname for the device")
 	rootCmd.PersistentFlags().BoolVarP(&anonymizeFlag, "anonymize", "A", false, "anonymize IP addresses and non-netbird.io domains in logs and status output")
 
+	rootCmd.AddCommand(serviceCmd)
 	rootCmd.AddCommand(upCmd)
 	rootCmd.AddCommand(downCmd)
 	rootCmd.AddCommand(statusCmd)
@@ -138,6 +146,9 @@ func init() {
 	rootCmd.AddCommand(forwardingRulesCmd)
 	rootCmd.AddCommand(debugCmd)
 
+	serviceCmd.AddCommand(runCmd, startCmd, stopCmd, restartCmd) // service control commands are subcommands of service
+	serviceCmd.AddCommand(installCmd, uninstallCmd)              // service installer commands are subcommands of service
+
 	networksCMD.AddCommand(routesListCmd)
 	networksCMD.AddCommand(routesSelectCmd, routesDeselectCmd)
 
@@ -175,13 +186,14 @@ func SetupCloseHandler(ctx context.Context, cancel context.CancelFunc) {
 	termCh := make(chan os.Signal, 1)
 	signal.Notify(termCh, os.Interrupt, syscall.SIGINT, syscall.SIGTERM)
 	go func() {
-		defer cancel()
+		done := ctx.Done()
 		select {
-		case <-ctx.Done():
+		case <-done:
 		case <-termCh:
 		}
 
 		log.Info("shutdown signal received")
+		cancel()
 	}()
 }
 

client/cmd/service.go

@@ -1,15 +1,12 @@
-//go:build !ios && !android
-
 package cmd
 
 import (
 	"context"
-	"fmt"
 	"runtime"
-	"strings"
 	"sync"
 
 	"github.com/kardianos/service"
+	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
 
@@ -17,16 +14,6 @@ import (
 	"github.com/netbirdio/netbird/client/server"
 )
 
-var serviceCmd = &cobra.Command{
-	Use:   "service",
-	Short: "manages Netbird service",
-}
-
-var (
-	serviceName    string
-	serviceEnvVars []string
-)
-
 type program struct {
 	ctx              context.Context
 	cancel           context.CancelFunc
@@ -35,31 +22,12 @@ type program struct {
 	serverInstanceMu sync.Mutex
 }
 
-func init() {
-	defaultServiceName := "netbird"
-	if runtime.GOOS == "windows" {
-		defaultServiceName = "Netbird"
-	}
-
-	serviceCmd.AddCommand(runCmd, startCmd, stopCmd, restartCmd, svcStatusCmd, installCmd, uninstallCmd, reconfigureCmd)
-
-	rootCmd.PersistentFlags().StringVarP(&serviceName, "service", "s", defaultServiceName, "Netbird system service name")
-	serviceEnvDesc := `Sets extra environment variables for the service. ` +
-		`You can specify a comma-separated list of KEY=VALUE pairs. ` +
-		`E.g. --service-env LOG_LEVEL=debug,CUSTOM_VAR=value`
-
-	installCmd.Flags().StringSliceVar(&serviceEnvVars, "service-env", nil, serviceEnvDesc)
-	reconfigureCmd.Flags().StringSliceVar(&serviceEnvVars, "service-env", nil, serviceEnvDesc)
-
-	rootCmd.AddCommand(serviceCmd)
-}
-
 func newProgram(ctx context.Context, cancel context.CancelFunc) *program {
 	ctx = internal.CtxInitState(ctx)
 	return &program{ctx: ctx, cancel: cancel}
 }
 
-func newSVCConfig() (*service.Config, error) {
+func newSVCConfig() *service.Config {
 	config := &service.Config{
 		Name:        serviceName,
 		DisplayName: "Netbird",
@@ -68,47 +36,23 @@ func newSVCConfig() (*service.Config, error) {
 		EnvVars:     make(map[string]string),
 	}
 
-	if len(serviceEnvVars) > 0 {
-		extraEnvs, err := parseServiceEnvVars(serviceEnvVars)
-		if err != nil {
-			return nil, fmt.Errorf("parse service environment variables: %w", err)
-		}
-		config.EnvVars = extraEnvs
-	}
-
 	if runtime.GOOS == "linux" {
 		config.EnvVars["SYSTEMD_UNIT"] = serviceName
 	}
 
-	return config, nil
+	return config
 }
 
 func newSVC(prg *program, conf *service.Config) (service.Service, error) {
-	return service.New(prg, conf)
-}
-
-func parseServiceEnvVars(envVars []string) (map[string]string, error) {
-	envMap := make(map[string]string)
-
-	for _, env := range envVars {
-		if env == "" {
-			continue
-		}
-
-		parts := strings.SplitN(env, "=", 2)
-		if len(parts) != 2 {
-			return nil, fmt.Errorf("invalid environment variable format: %s (expected KEY=VALUE)", env)
-		}
-
-		key := strings.TrimSpace(parts[0])
-		value := strings.TrimSpace(parts[1])
-
-		if key == "" {
-			return nil, fmt.Errorf("empty environment variable key in: %s", env)
-		}
-
-		envMap[key] = value
+	s, err := service.New(prg, conf)
+	if err != nil {
+		log.Fatal(err)
+		return nil, err
 	}
-
-	return envMap, nil
+	return s, nil
+}
+
+var serviceCmd = &cobra.Command{
+	Use:   "service",
+	Short: "manages Netbird service",
 }

client/cmd/service_controller.go

@@ -1,5 +1,3 @@
-//go:build !ios && !android
-
 package cmd
 
 import (
@@ -49,13 +47,14 @@ func (p *program) Start(svc service.Service) error {
 
 	listen, err := net.Listen(split[0], split[1])
 	if err != nil {
-		return fmt.Errorf("listen daemon interface: %w", err)
+		return fmt.Errorf("failed to listen daemon interface: %w", err)
 	}
 	go func() {
 		defer listen.Close()
 
 		if split[0] == "unix" {
-			if err := os.Chmod(split[1], 0666); err != nil {
+			err = os.Chmod(split[1], 0666)
+			if err != nil {
 				log.Errorf("failed setting daemon permissions: %v", split[1])
 				return
 			}
@@ -101,49 +100,37 @@ func (p *program) Stop(srv service.Service) error {
 	return nil
 }
 
-// Common setup for service control commands
-func setupServiceControlCommand(cmd *cobra.Command, ctx context.Context, cancel context.CancelFunc) (service.Service, error) {
-	SetFlagsFromEnvVars(rootCmd)
-	SetFlagsFromEnvVars(serviceCmd)
-
-	cmd.SetOut(cmd.OutOrStdout())
-
-	if err := handleRebrand(cmd); err != nil {
-		return nil, err
-	}
-
-	if err := util.InitLog(logLevel, logFile); err != nil {
-		return nil, fmt.Errorf("init log: %w", err)
-	}
-
-	cfg, err := newSVCConfig()
-	if err != nil {
-		return nil, fmt.Errorf("create service config: %w", err)
-	}
-
-	s, err := newSVC(newProgram(ctx, cancel), cfg)
-	if err != nil {
-		return nil, err
-	}
-
-	return s, nil
-}
-
 var runCmd = &cobra.Command{
 	Use:   "run",
 	Short: "runs Netbird as service",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx, cancel := context.WithCancel(cmd.Context())
+		SetFlagsFromEnvVars(rootCmd)
 
-		SetupCloseHandler(ctx, cancel)
-		SetupDebugHandler(ctx, nil, nil, nil, logFile)
+		cmd.SetOut(cmd.OutOrStdout())
 
-		s, err := setupServiceControlCommand(cmd, ctx, cancel)
+		err := handleRebrand(cmd)
 		if err != nil {
 			return err
 		}
 
-		return s.Run()
+		err = util.InitLog(logLevel, logFile)
+		if err != nil {
+			return fmt.Errorf("failed initializing log %v", err)
+		}
+
+		ctx, cancel := context.WithCancel(cmd.Context())
+		SetupCloseHandler(ctx, cancel)
+		SetupDebugHandler(ctx, nil, nil, nil, logFile)
+
+		s, err := newSVC(newProgram(ctx, cancel), newSVCConfig())
+		if err != nil {
+			return err
+		}
+		err = s.Run()
+		if err != nil {
+			return err
+		}
+		return nil
 	},
 }
 
@@ -151,14 +138,31 @@ var startCmd = &cobra.Command{
 	Use:   "start",
 	Short: "starts Netbird service",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx, cancel := context.WithCancel(cmd.Context())
-		s, err := setupServiceControlCommand(cmd, ctx, cancel)
+		SetFlagsFromEnvVars(rootCmd)
+
+		cmd.SetOut(cmd.OutOrStdout())
+
+		err := handleRebrand(cmd)
 		if err != nil {
 			return err
 		}
 
-		if err := s.Start(); err != nil {
-			return fmt.Errorf("start service: %w", err)
+		err = util.InitLog(logLevel, logFile)
+		if err != nil {
+			return err
+		}
+
+		ctx, cancel := context.WithCancel(cmd.Context())
+
+		s, err := newSVC(newProgram(ctx, cancel), newSVCConfig())
+		if err != nil {
+			cmd.PrintErrln(err)
+			return err
+		}
+		err = s.Start()
+		if err != nil {
+			cmd.PrintErrln(err)
+			return err
 		}
 		cmd.Println("Netbird service has been started")
 		return nil
@@ -169,14 +173,29 @@ var stopCmd = &cobra.Command{
 	Use:   "stop",
 	Short: "stops Netbird service",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx, cancel := context.WithCancel(cmd.Context())
-		s, err := setupServiceControlCommand(cmd, ctx, cancel)
+		SetFlagsFromEnvVars(rootCmd)
+
+		cmd.SetOut(cmd.OutOrStdout())
+
+		err := handleRebrand(cmd)
 		if err != nil {
 			return err
 		}
 
-		if err := s.Stop(); err != nil {
-			return fmt.Errorf("stop service: %w", err)
+		err = util.InitLog(logLevel, logFile)
+		if err != nil {
+			return fmt.Errorf("failed initializing log %v", err)
+		}
+
+		ctx, cancel := context.WithCancel(cmd.Context())
+
+		s, err := newSVC(newProgram(ctx, cancel), newSVCConfig())
+		if err != nil {
+			return err
+		}
+		err = s.Stop()
+		if err != nil {
+			return err
 		}
 		cmd.Println("Netbird service has been stopped")
 		return nil
@@ -187,48 +206,31 @@ var restartCmd = &cobra.Command{
 	Use:   "restart",
 	Short: "restarts Netbird service",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx, cancel := context.WithCancel(cmd.Context())
-		s, err := setupServiceControlCommand(cmd, ctx, cancel)
+		SetFlagsFromEnvVars(rootCmd)
+
+		cmd.SetOut(cmd.OutOrStdout())
+
+		err := handleRebrand(cmd)
 		if err != nil {
 			return err
 		}
 
-		if err := s.Restart(); err != nil {
-			return fmt.Errorf("restart service: %w", err)
+		err = util.InitLog(logLevel, logFile)
+		if err != nil {
+			return fmt.Errorf("failed initializing log %v", err)
+		}
+
+		ctx, cancel := context.WithCancel(cmd.Context())
+
+		s, err := newSVC(newProgram(ctx, cancel), newSVCConfig())
+		if err != nil {
+			return err
+		}
+		err = s.Restart()
+		if err != nil {
+			return err
 		}
 		cmd.Println("Netbird service has been restarted")
 		return nil
 	},
 }
-
-var svcStatusCmd = &cobra.Command{
-	Use:   "status",
-	Short: "shows Netbird service status",
-	RunE: func(cmd *cobra.Command, args []string) error {
-		ctx, cancel := context.WithCancel(cmd.Context())
-		s, err := setupServiceControlCommand(cmd, ctx, cancel)
-		if err != nil {
-			return err
-		}
-
-		status, err := s.Status()
-		if err != nil {
-			return fmt.Errorf("get service status: %w", err)
-		}
-
-		var statusText string
-		switch status {
-		case service.StatusRunning:
-			statusText = "Running"
-		case service.StatusStopped:
-			statusText = "Stopped"
-		case service.StatusUnknown:
-			statusText = "Unknown"
-		default:
-			statusText = fmt.Sprintf("Unknown (%d)", status)
-		}
-
-		cmd.Printf("Netbird service status: %s\n", statusText)
-		return nil
-	},
-}

client/cmd/service_installer.go

@@ -1,121 +1,87 @@
-//go:build !ios && !android
-
 package cmd
 
 import (
 	"context"
-	"errors"
-	"fmt"
 	"os"
 	"path/filepath"
 	"runtime"
 
-	"github.com/kardianos/service"
 	"github.com/spf13/cobra"
 )
 
-var ErrGetServiceStatus = fmt.Errorf("failed to get service status")
-
-// Common service command setup
-func setupServiceCommand(cmd *cobra.Command) error {
-	SetFlagsFromEnvVars(rootCmd)
-	SetFlagsFromEnvVars(serviceCmd)
-	cmd.SetOut(cmd.OutOrStdout())
-	return handleRebrand(cmd)
-}
-
-// Build service arguments for install/reconfigure
-func buildServiceArguments() []string {
-	args := []string{
-		"service",
-		"run",
-		"--config",
-		configPath,
-		"--log-level",
-		logLevel,
-		"--daemon-addr",
-		daemonAddr,
-	}
-
-	if managementURL != "" {
-		args = append(args, "--management-url", managementURL)
-	}
-
-	if logFile != "" {
-		args = append(args, "--log-file", logFile)
-	}
-
-	return args
-}
-
-// Configure platform-specific service settings
-func configurePlatformSpecificSettings(svcConfig *service.Config) error {
-	if runtime.GOOS == "linux" {
-		// Respected only by systemd systems
-		svcConfig.Dependencies = []string{"After=network.target syslog.target"}
-
-		if logFile != "console" {
-			setStdLogPath := true
-			dir := filepath.Dir(logFile)
-
-			if _, err := os.Stat(dir); err != nil {
-				if err = os.MkdirAll(dir, 0750); err != nil {
-					setStdLogPath = false
-				}
-			}
-
-			if setStdLogPath {
-				svcConfig.Option["LogOutput"] = true
-				svcConfig.Option["LogDirectory"] = dir
-			}
-		}
-	}
-
-	if runtime.GOOS == "windows" {
-		svcConfig.Option["OnFailure"] = "restart"
-	}
-
-	return nil
-}
-
-// Create fully configured service config for install/reconfigure
-func createServiceConfigForInstall() (*service.Config, error) {
-	svcConfig, err := newSVCConfig()
-	if err != nil {
-		return nil, fmt.Errorf("create service config: %w", err)
-	}
-
-	svcConfig.Arguments = buildServiceArguments()
-	if err = configurePlatformSpecificSettings(svcConfig); err != nil {
-		return nil, fmt.Errorf("configure platform-specific settings: %w", err)
-	}
-
-	return svcConfig, nil
-}
-
 var installCmd = &cobra.Command{
 	Use:   "install",
 	Short: "installs Netbird service",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		if err := setupServiceCommand(cmd); err != nil {
+		SetFlagsFromEnvVars(rootCmd)
+
+		cmd.SetOut(cmd.OutOrStdout())
+
+		err := handleRebrand(cmd)
+		if err != nil {
 			return err
 		}
 
-		svcConfig, err := createServiceConfigForInstall()
-		if err != nil {
-			return err
+		svcConfig := newSVCConfig()
+
+		svcConfig.Arguments = []string{
+			"service",
+			"run",
+			"--config",
+			configPath,
+			"--log-level",
+			logLevel,
+			"--daemon-addr",
+			daemonAddr,
+		}
+
+		if managementURL != "" {
+			svcConfig.Arguments = append(svcConfig.Arguments, "--management-url", managementURL)
+		}
+
+		if logFile != "" {
+			svcConfig.Arguments = append(svcConfig.Arguments, "--log-file", logFile)
+		}
+
+		if runtime.GOOS == "linux" {
+			// Respected only by systemd systems
+			svcConfig.Dependencies = []string{"After=network.target syslog.target"}
+
+			if logFile != "console" {
+				setStdLogPath := true
+				dir := filepath.Dir(logFile)
+
+				_, err := os.Stat(dir)
+				if err != nil {
+					err = os.MkdirAll(dir, 0750)
+					if err != nil {
+						setStdLogPath = false
+					}
+				}
+
+				if setStdLogPath {
+					svcConfig.Option["LogOutput"] = true
+					svcConfig.Option["LogDirectory"] = dir
+				}
+			}
+		}
+
+		if runtime.GOOS == "windows" {
+			svcConfig.Option["OnFailure"] = "restart"
 		}
 
 		ctx, cancel := context.WithCancel(cmd.Context())
-		defer cancel()
 
 		s, err := newSVC(newProgram(ctx, cancel), svcConfig)
 		if err != nil {
+			cmd.PrintErrln(err)
 			return err
 		}
 
-		if err := s.Install(); err != nil {
-			return fmt.Errorf("install service: %w", err)
+		err = s.Install()
+		if err != nil {
+			cmd.PrintErrln(err)
+			return err
 		}
 
 		cmd.Println("Netbird service has been installed")
@@ -127,109 +93,27 @@ var uninstallCmd = &cobra.Command{
 	Use:   "uninstall",
 	Short: "uninstalls Netbird service from system",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		if err := setupServiceCommand(cmd); err != nil {
-			return err
-		}
+		SetFlagsFromEnvVars(rootCmd)
 
-		cfg, err := newSVCConfig()
+		cmd.SetOut(cmd.OutOrStdout())
+
+		err := handleRebrand(cmd)
 		if err != nil {
-			return fmt.Errorf("create service config: %w", err)
+			return err
 		}
 
 		ctx, cancel := context.WithCancel(cmd.Context())
-		defer cancel()
 
-		s, err := newSVC(newProgram(ctx, cancel), cfg)
+		s, err := newSVC(newProgram(ctx, cancel), newSVCConfig())
 		if err != nil {
 			return err
 		}
 
-		if err := s.Uninstall(); err != nil {
-			return fmt.Errorf("uninstall service: %w", err)
+		err = s.Uninstall()
+		if err != nil {
+			return err
 		}
-
 		cmd.Println("Netbird service has been uninstalled")
 		return nil
 	},
 }
-
-var reconfigureCmd = &cobra.Command{
-	Use:   "reconfigure",
-	Short: "reconfigures Netbird service with new settings",
-	Long: `Reconfigures the Netbird service with new settings without manual uninstall/install.
-This command will temporarily stop the service, update its configuration, and restart it if it was running.`,
-	RunE: func(cmd *cobra.Command, args []string) error {
-		if err := setupServiceCommand(cmd); err != nil {
-			return err
-		}
-
-		wasRunning, err := isServiceRunning()
-		if err != nil && !errors.Is(err, ErrGetServiceStatus) {
-			return fmt.Errorf("check service status: %w", err)
-		}
-
-		svcConfig, err := createServiceConfigForInstall()
-		if err != nil {
-			return err
-		}
-
-		ctx, cancel := context.WithCancel(cmd.Context())
-		defer cancel()
-
-		s, err := newSVC(newProgram(ctx, cancel), svcConfig)
-		if err != nil {
-			return fmt.Errorf("create service: %w", err)
-		}
-
-		if wasRunning {
-			cmd.Println("Stopping Netbird service...")
-			if err := s.Stop(); err != nil {
-				cmd.Printf("Warning: failed to stop service: %v\n", err)
-			}
-		}
-
-		cmd.Println("Removing existing service configuration...")
-		if err := s.Uninstall(); err != nil {
-			return fmt.Errorf("uninstall existing service: %w", err)
-		}
-
-		cmd.Println("Installing service with new configuration...")
-		if err := s.Install(); err != nil {
-			return fmt.Errorf("install service with new config: %w", err)
-		}
-
-		if wasRunning {
-			cmd.Println("Starting Netbird service...")
-			if err := s.Start(); err != nil {
-				return fmt.Errorf("start service after reconfigure: %w", err)
-			}
-			cmd.Println("Netbird service has been reconfigured and started")
-		} else {
-			cmd.Println("Netbird service has been reconfigured")
-		}
-
-		return nil
-	},
-}
-
-func isServiceRunning() (bool, error) {
-	cfg, err := newSVCConfig()
-	if err != nil {
-		return false, err
-	}
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	s, err := newSVC(newProgram(ctx, cancel), cfg)
-	if err != nil {
-		return false, err
-	}
-
-	status, err := s.Status()
-	if err != nil {
-		return false, fmt.Errorf("%w: %w", ErrGetServiceStatus, err)
-	}
-
-	return status == service.StatusRunning, nil
-}

client/cmd/service_test.go

@@ -1,263 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"runtime"
-	"testing"
-	"time"
-
-	"github.com/kardianos/service"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-const (
-	serviceStartTimeout = 10 * time.Second
-	serviceStopTimeout  = 5 * time.Second
-	statusPollInterval  = 500 * time.Millisecond
-)
-
-// waitForServiceStatus waits for service to reach expected status with timeout
-func waitForServiceStatus(expectedStatus service.Status, timeout time.Duration) (bool, error) {
-	cfg, err := newSVCConfig()
-	if err != nil {
-		return false, err
-	}
-
-	ctxSvc, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	s, err := newSVC(newProgram(ctxSvc, cancel), cfg)
-	if err != nil {
-		return false, err
-	}
-
-	ctx, timeoutCancel := context.WithTimeout(context.Background(), timeout)
-	defer timeoutCancel()
-
-	ticker := time.NewTicker(statusPollInterval)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			return false, fmt.Errorf("timeout waiting for service status %v", expectedStatus)
-		case <-ticker.C:
-			status, err := s.Status()
-			if err != nil {
-				// Continue polling on transient errors
-				continue
-			}
-			if status == expectedStatus {
-				return true, nil
-			}
-		}
-	}
-}
-
-// TestServiceLifecycle tests the complete service lifecycle
-func TestServiceLifecycle(t *testing.T) {
-	// TODO: Add support for Windows and macOS
-	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
-		t.Skipf("Skipping service lifecycle test on unsupported OS: %s", runtime.GOOS)
-	}
-
-	if os.Getenv("CONTAINER") == "true" {
-		t.Skip("Skipping service lifecycle test in container environment")
-	}
-
-	originalServiceName := serviceName
-	serviceName = "netbirdtest" + fmt.Sprintf("%d", time.Now().Unix())
-	defer func() {
-		serviceName = originalServiceName
-	}()
-
-	tempDir := t.TempDir()
-	configPath = fmt.Sprintf("%s/netbird-test-config.json", tempDir)
-	logLevel = "info"
-	daemonAddr = fmt.Sprintf("unix://%s/netbird-test.sock", tempDir)
-
-	ctx := context.Background()
-
-	t.Run("Install", func(t *testing.T) {
-		installCmd.SetContext(ctx)
-		err := installCmd.RunE(installCmd, []string{})
-		require.NoError(t, err)
-
-		cfg, err := newSVCConfig()
-		require.NoError(t, err)
-
-		ctxSvc, cancel := context.WithCancel(context.Background())
-		defer cancel()
-
-		s, err := newSVC(newProgram(ctxSvc, cancel), cfg)
-		require.NoError(t, err)
-
-		status, err := s.Status()
-		assert.NoError(t, err)
-		assert.NotEqual(t, service.StatusUnknown, status)
-	})
-
-	t.Run("Start", func(t *testing.T) {
-		startCmd.SetContext(ctx)
-		err := startCmd.RunE(startCmd, []string{})
-		require.NoError(t, err)
-
-		running, err := waitForServiceStatus(service.StatusRunning, serviceStartTimeout)
-		require.NoError(t, err)
-		assert.True(t, running)
-	})
-
-	t.Run("Restart", func(t *testing.T) {
-		restartCmd.SetContext(ctx)
-		err := restartCmd.RunE(restartCmd, []string{})
-		require.NoError(t, err)
-
-		running, err := waitForServiceStatus(service.StatusRunning, serviceStartTimeout)
-		require.NoError(t, err)
-		assert.True(t, running)
-	})
-
-	t.Run("Reconfigure", func(t *testing.T) {
-		originalLogLevel := logLevel
-		logLevel = "debug"
-		defer func() {
-			logLevel = originalLogLevel
-		}()
-
-		reconfigureCmd.SetContext(ctx)
-		err := reconfigureCmd.RunE(reconfigureCmd, []string{})
-		require.NoError(t, err)
-
-		running, err := waitForServiceStatus(service.StatusRunning, serviceStartTimeout)
-		require.NoError(t, err)
-		assert.True(t, running)
-	})
-
-	t.Run("Stop", func(t *testing.T) {
-		stopCmd.SetContext(ctx)
-		err := stopCmd.RunE(stopCmd, []string{})
-		require.NoError(t, err)
-
-		stopped, err := waitForServiceStatus(service.StatusStopped, serviceStopTimeout)
-		require.NoError(t, err)
-		assert.True(t, stopped)
-	})
-
-	t.Run("Uninstall", func(t *testing.T) {
-		uninstallCmd.SetContext(ctx)
-		err := uninstallCmd.RunE(uninstallCmd, []string{})
-		require.NoError(t, err)
-
-		cfg, err := newSVCConfig()
-		require.NoError(t, err)
-
-		ctxSvc, cancel := context.WithCancel(context.Background())
-		defer cancel()
-
-		s, err := newSVC(newProgram(ctxSvc, cancel), cfg)
-		require.NoError(t, err)
-
-		_, err = s.Status()
-		assert.Error(t, err)
-	})
-}
-
-// TestServiceEnvVars tests environment variable parsing
-func TestServiceEnvVars(t *testing.T) {
-	tests := []struct {
-		name      string
-		envVars   []string
-		expected  map[string]string
-		expectErr bool
-	}{
-		{
-			name:    "Valid single env var",
-			envVars: []string{"LOG_LEVEL=debug"},
-			expected: map[string]string{
-				"LOG_LEVEL": "debug",
-			},
-		},
-		{
-			name:    "Valid multiple env vars",
-			envVars: []string{"LOG_LEVEL=debug", "CUSTOM_VAR=value"},
-			expected: map[string]string{
-				"LOG_LEVEL":  "debug",
-				"CUSTOM_VAR": "value",
-			},
-		},
-		{
-			name:    "Env var with spaces",
-			envVars: []string{" KEY = value "},
-			expected: map[string]string{
-				"KEY": "value",
-			},
-		},
-		{
-			name:      "Invalid format - no equals",
-			envVars:   []string{"INVALID"},
-			expectErr: true,
-		},
-		{
-			name:      "Invalid format - empty key",
-			envVars:   []string{"=value"},
-			expectErr: true,
-		},
-		{
-			name:    "Empty value is valid",
-			envVars: []string{"KEY="},
-			expected: map[string]string{
-				"KEY": "",
-			},
-		},
-		{
-			name:     "Empty slice",
-			envVars:  []string{},
-			expected: map[string]string{},
-		},
-		{
-			name:     "Empty string in slice",
-			envVars:  []string{"", "KEY=value", ""},
-			expected: map[string]string{"KEY": "value"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result, err := parseServiceEnvVars(tt.envVars)
-
-			if tt.expectErr {
-				assert.Error(t, err)
-			} else {
-				require.NoError(t, err)
-				assert.Equal(t, tt.expected, result)
-			}
-		})
-	}
-}
-
-// TestServiceConfigWithEnvVars tests service config creation with env vars
-func TestServiceConfigWithEnvVars(t *testing.T) {
-	originalServiceName := serviceName
-	originalServiceEnvVars := serviceEnvVars
-	defer func() {
-		serviceName = originalServiceName
-		serviceEnvVars = originalServiceEnvVars
-	}()
-
-	serviceName = "test-service"
-	serviceEnvVars = []string{"TEST_VAR=test_value", "ANOTHER_VAR=another_value"}
-
-	cfg, err := newSVCConfig()
-	require.NoError(t, err)
-
-	assert.Equal(t, "test-service", cfg.Name)
-	assert.Equal(t, "test_value", cfg.EnvVars["TEST_VAR"])
-	assert.Equal(t, "another_value", cfg.EnvVars["ANOTHER_VAR"])
-
-	if runtime.GOOS == "linux" {
-		assert.Equal(t, "test-service", cfg.EnvVars["SYSTEMD_UNIT"])
-	}
-}

client/iface/batcher.go

@@ -0,0 +1,338 @@
+package iface
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"net/netip"
+	"os"
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/hashicorp/go-multierror"
+	log "github.com/sirupsen/logrus"
+	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	nberrors "github.com/netbirdio/netbird/client/errors"
+	"github.com/netbirdio/netbird/client/iface/configurer"
+	"github.com/netbirdio/netbird/client/iface/device"
+)
+
+const (
+	// DefaultBatchFlushInterval is the default maximum time to wait before flushing batched operations
+	DefaultBatchFlushInterval = 300 * time.Millisecond
+	// DefaultBatchSizeThreshold is the default number of operations to trigger an immediate flush
+	DefaultBatchSizeThreshold = 100
+
+	// AllowedIPOpAdd represents an add operation
+	AllowedIPOpAdd = "add"
+	// AllowedIPOpRemove represents a remove operation
+	AllowedIPOpRemove = "remove"
+
+	EnvDisableWGBatching      = "NB_DISABLE_WG_BATCHING"
+	EnvWGBatchFlushIntervalMS = "NB_WG_BATCH_FLUSH_INTERVAL_MS"
+	EnvWGBatchSizeThreshold   = "NB_WG_BATCH_SIZE_THRESHOLD"
+)
+
+// AllowedIPOperation represents a pending allowed IP operation
+type AllowedIPOperation struct {
+	PeerKey   string
+	Prefix    netip.Prefix
+	Operation string
+}
+
+// PeerUpdateOperation represents a pending peer update operation
+type PeerUpdateOperation struct {
+	PeerKey      string
+	AllowedIPs   []netip.Prefix
+	KeepAlive    time.Duration
+	Endpoint     *net.UDPAddr
+	PreSharedKey *wgtypes.Key
+}
+
+// WGBatcher batches WireGuard configuration updates to reduce syscall overhead
+type WGBatcher struct {
+	configurer device.WGConfigurer
+	mu         sync.Mutex
+
+	allowedIPOps []AllowedIPOperation
+	peerUpdates  map[string]*PeerUpdateOperation
+
+	flushTimer *time.Timer
+	flushChan  chan struct{}
+	ctx        context.Context
+	cancel     context.CancelFunc
+	wg         sync.WaitGroup
+
+	batchFlushInterval time.Duration
+	batchSizeThreshold int
+}
+
+// NewWGBatcher creates a new WireGuard operation batcher
+func NewWGBatcher(configurer device.WGConfigurer) *WGBatcher {
+	if os.Getenv(EnvDisableWGBatching) != "" {
+		log.Infof("WireGuard allowed IP batching disabled via %s", EnvDisableWGBatching)
+		return nil
+	}
+
+	flushInterval := DefaultBatchFlushInterval
+	sizeThreshold := DefaultBatchSizeThreshold
+
+	if intervalMs := os.Getenv(EnvWGBatchFlushIntervalMS); intervalMs != "" {
+		if ms, err := strconv.Atoi(intervalMs); err == nil && ms > 0 {
+			flushInterval = time.Duration(ms) * time.Millisecond
+			log.Infof("WireGuard batch flush interval set to %v", flushInterval)
+		}
+	}
+
+	if threshold := os.Getenv(EnvWGBatchSizeThreshold); threshold != "" {
+		if size, err := strconv.Atoi(threshold); err == nil && size > 0 {
+			sizeThreshold = size
+			log.Infof("WireGuard batch size threshold set to %d", sizeThreshold)
+		}
+	}
+
+	log.Info("WireGuard allowed IP batching enabled")
+
+	ctx, cancel := context.WithCancel(context.Background())
+	b := &WGBatcher{
+		configurer:         configurer,
+		peerUpdates:        make(map[string]*PeerUpdateOperation),
+		flushChan:          make(chan struct{}, 1),
+		ctx:                ctx,
+		cancel:             cancel,
+		batchFlushInterval: flushInterval,
+		batchSizeThreshold: sizeThreshold,
+	}
+
+	b.wg.Add(1)
+	go b.flushLoop()
+
+	return b
+}
+
+// Close stops the batcher and flushes any pending operations
+func (b *WGBatcher) Close() error {
+	b.mu.Lock()
+	if b.flushTimer != nil {
+		b.flushTimer.Stop()
+	}
+	b.mu.Unlock()
+
+	b.cancel()
+
+	if err := b.Flush(); err != nil {
+		log.Errorf("failed to flush pending operations on close: %v", err)
+	}
+
+	b.wg.Wait()
+
+	return nil
+}
+
+// UpdatePeer batches a peer update operation
+func (b *WGBatcher) UpdatePeer(peerKey string, allowedIPs []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	b.peerUpdates[peerKey] = &PeerUpdateOperation{
+		PeerKey:      peerKey,
+		AllowedIPs:   allowedIPs,
+		KeepAlive:    keepAlive,
+		Endpoint:     endpoint,
+		PreSharedKey: preSharedKey,
+	}
+
+	b.scheduleFlush()
+	return nil
+}
+
+// AddAllowedIP batches an allowed IP addition
+func (b *WGBatcher) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	b.allowedIPOps = append(b.allowedIPOps, AllowedIPOperation{
+		PeerKey:   peerKey,
+		Prefix:    allowedIP,
+		Operation: AllowedIPOpAdd,
+	})
+
+	b.scheduleFlush()
+	return nil
+}
+
+// RemoveAllowedIP batches an allowed IP removal
+func (b *WGBatcher) RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	b.allowedIPOps = append(b.allowedIPOps, AllowedIPOperation{
+		PeerKey:   peerKey,
+		Prefix:    allowedIP,
+		Operation: AllowedIPOpRemove,
+	})
+
+	b.scheduleFlush()
+	return nil
+}
+
+// Flush immediately processes all batched operations
+func (b *WGBatcher) Flush() error {
+	b.mu.Lock()
+
+	if b.flushTimer != nil {
+		b.flushTimer.Stop()
+		b.flushTimer = nil
+	}
+
+	peerUpdates := b.peerUpdates
+	allowedIPOps := b.allowedIPOps
+
+	b.peerUpdates = make(map[string]*PeerUpdateOperation)
+	b.allowedIPOps = nil
+
+	b.mu.Unlock()
+
+	return b.processBatch(peerUpdates, allowedIPOps)
+}
+
+// scheduleFlush schedules a batch flush if not already scheduled
+func (b *WGBatcher) scheduleFlush() {
+	shouldFlushNow := len(b.allowedIPOps)+len(b.peerUpdates) >= b.batchSizeThreshold
+
+	if shouldFlushNow {
+		select {
+		case b.flushChan <- struct{}{}:
+		default:
+		}
+		return
+	}
+
+	if b.flushTimer == nil {
+		b.flushTimer = time.AfterFunc(b.batchFlushInterval, func() {
+			select {
+			case b.flushChan <- struct{}{}:
+			default:
+			}
+		})
+	}
+}
+
+// flushLoop handles periodic flushing of batched operations
+func (b *WGBatcher) flushLoop() {
+	defer b.wg.Done()
+
+	for {
+		select {
+		case <-b.flushChan:
+			if err := b.Flush(); err != nil {
+				log.Errorf("Error flushing WireGuard operations: %v", err)
+			}
+		case <-b.ctx.Done():
+			return
+		}
+	}
+}
+
+// processBatch processes a batch of operations
+func (b *WGBatcher) processBatch(peerUpdates map[string]*PeerUpdateOperation, allowedIPOps []AllowedIPOperation) error {
+	if len(peerUpdates) == 0 && len(allowedIPOps) == 0 {
+		return nil
+	}
+
+	start := time.Now()
+	defer func() {
+		duration := time.Since(start)
+		log.Debugf("Processed batch of %d peer updates and %d allowed IP operations in %v",
+			len(peerUpdates), len(allowedIPOps), duration)
+	}()
+
+	var merr *multierror.Error
+
+	if err := b.processPeerUpdates(peerUpdates); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
+	if err := b.processAllowedIPOps(allowedIPOps); err != nil {
+		merr = multierror.Append(merr, err)
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// processPeerUpdates processes peer update operations
+func (b *WGBatcher) processPeerUpdates(peerUpdates map[string]*PeerUpdateOperation) error {
+	var merr *multierror.Error
+	for _, update := range peerUpdates {
+		if err := b.configurer.UpdatePeer(
+			update.PeerKey,
+			update.AllowedIPs,
+			update.KeepAlive,
+			update.Endpoint,
+			update.PreSharedKey,
+		); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("update peer %s: %w", update.PeerKey, err))
+		}
+	}
+	return nberrors.FormatErrorOrNil(merr)
+}
+
+// processAllowedIPOps processes allowed IP add/remove operations
+func (b *WGBatcher) processAllowedIPOps(allowedIPOps []AllowedIPOperation) error {
+	peerChanges := b.groupAllowedIPChanges(allowedIPOps)
+	return b.applyAllowedIPChanges(peerChanges)
+}
+
+// groupAllowedIPChanges groups allowed IP operations by peer
+func (b *WGBatcher) groupAllowedIPChanges(allowedIPOps []AllowedIPOperation) map[string]struct {
+	toAdd    []netip.Prefix
+	toRemove []netip.Prefix
+} {
+	peerChanges := make(map[string]struct {
+		toAdd    []netip.Prefix
+		toRemove []netip.Prefix
+	})
+
+	for _, op := range allowedIPOps {
+		changes := peerChanges[op.PeerKey]
+		if op.Operation == AllowedIPOpAdd {
+			changes.toAdd = append(changes.toAdd, op.Prefix)
+		} else {
+			changes.toRemove = append(changes.toRemove, op.Prefix)
+		}
+		peerChanges[op.PeerKey] = changes
+	}
+
+	return peerChanges
+}
+
+// applyAllowedIPChanges applies allowed IP changes for each peer
+func (b *WGBatcher) applyAllowedIPChanges(peerChanges map[string]struct {
+	toAdd    []netip.Prefix
+	toRemove []netip.Prefix
+}) error {
+	var merr *multierror.Error
+
+	for peerKey, changes := range peerChanges {
+		for _, prefix := range changes.toRemove {
+			if err := b.configurer.RemoveAllowedIP(peerKey, prefix); err != nil {
+				if errors.Is(err, configurer.ErrPeerNotFound) || errors.Is(err, configurer.ErrAllowedIPNotFound) {
+					log.Debugf("remove allowed IP %s for peer %s: %v", prefix, peerKey, err)
+				} else {
+					merr = multierror.Append(merr, fmt.Errorf("remove allowed IP %s for peer %s: %w", prefix, peerKey, err))
+				}
+			}
+		}
+
+		for _, prefix := range changes.toAdd {
+			if err := b.configurer.AddAllowedIP(peerKey, prefix); err != nil {
+				merr = multierror.Append(merr, fmt.Errorf("add allowed IP %s for peer %s: %w", prefix, peerKey, err))
+			}
+		}
+	}
+
+	return nberrors.FormatErrorOrNil(merr)
+}

client/iface/bind/ice_bind.go

@@ -154,7 +154,7 @@ func (s *ICEBind) createIPv4ReceiverFn(pc *ipv4.PacketConn, conn *net.UDPConn, r
 
 	s.udpMux = NewUniversalUDPMuxDefault(
 		UniversalUDPMuxParams{
-			UDPConn:   nbnet.WrapPacketConn(conn),
+			UDPConn:   nbnet.WrapUDPConn(conn),
 			Net:       s.transportNet,
 			FilterFn:  s.filterFn,
 			WGAddress: s.address,

client/iface/bind/udp_mux_generic.go

@@ -7,16 +7,15 @@ import (
 )
 
 func (m *UDPMuxDefault) notifyAddressRemoval(addr string) {
-	// Kernel mode: direct nbnet.PacketConn (SharedSocket wrapped with nbnet)
-	if conn, ok := m.params.UDPConn.(*nbnet.PacketConn); ok {
-		conn.RemoveAddress(addr)
+	wrapped, ok := m.params.UDPConn.(*UDPConn)
+	if !ok {
 		return
 	}
 
-	// Userspace mode: UDPConn wrapper around nbnet.PacketConn
-	if wrapped, ok := m.params.UDPConn.(*UDPConn); ok {
-		if conn, ok := wrapped.GetPacketConn().(*nbnet.PacketConn); ok {
-			conn.RemoveAddress(addr)
-		}
+	nbnetConn, ok := wrapped.GetPacketConn().(*nbnet.UDPConn)
+	if !ok {
+		return
 	}
+
+	nbnetConn.RemoveAddress(addr)
 }

client/iface/bind/udp_mux_ios.go

@@ -4,4 +4,4 @@ package bind
 
 func (m *UDPMuxDefault) notifyAddressRemoval(addr string) {
 	// iOS doesn't support nbnet hooks, so this is a no-op
-}
+}

client/iface/device/device_kernel_unix.go

@@ -16,7 +16,6 @@ import (
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/sharedsock"
-	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 type TunKernelDevice struct {
@@ -100,14 +99,8 @@ func (t *TunKernelDevice) Up() (*bind.UniversalUDPMuxDefault, error) {
 	if err != nil {
 		return nil, err
 	}
-
-	var udpConn net.PacketConn = rawSock
-	if !nbnet.AdvancedRouting() {
-		udpConn = nbnet.WrapPacketConn(rawSock)
-	}
-
 	bindParams := bind.UniversalUDPMuxParams{
-		UDPConn:   udpConn,
+		UDPConn:   rawSock,
 		Net:       t.transportNet,
 		FilterFn:  t.filterFn,
 		WGAddress: t.address,

client/iface/iface.go

@@ -59,6 +59,7 @@ type WGIface struct {
 	mu            sync.Mutex
 
 	configurer     device.WGConfigurer
+	batcher        *WGBatcher
 	filter         device.PacketFilter
 	wgProxyFactory wgProxyFactory
 }
@@ -128,6 +129,12 @@ func (w *WGIface) UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAliv
 	}
 
 	log.Debugf("updating interface %s peer %s, endpoint %s, allowedIPs %v", w.tun.DeviceName(), peerKey, endpoint, allowedIps)
+
+	if endpoint != nil && w.batcher != nil {
+		if err := w.batcher.Flush(); err != nil {
+			log.Warnf("failed to flush batched operations: %v", err)
+		}
+	}
 	return w.configurer.UpdatePeer(peerKey, allowedIps, keepAlive, endpoint, preSharedKey)
 }
 
@@ -152,6 +159,10 @@ func (w *WGIface) AddAllowedIP(peerKey string, allowedIP netip.Prefix) error {
 	}
 
 	log.Debugf("Adding allowed IP to interface %s and peer %s: allowed IP %s ", w.tun.DeviceName(), peerKey, allowedIP)
+
+	if w.batcher != nil {
+		return w.batcher.AddAllowedIP(peerKey, allowedIP)
+	}
 	return w.configurer.AddAllowedIP(peerKey, allowedIP)
 }
 
@@ -164,6 +175,10 @@ func (w *WGIface) RemoveAllowedIP(peerKey string, allowedIP netip.Prefix) error
 	}
 
 	log.Debugf("Removing allowed IP from interface %s and peer %s: allowed IP %s ", w.tun.DeviceName(), peerKey, allowedIP)
+
+	if w.batcher != nil {
+		return w.batcher.RemoveAllowedIP(peerKey, allowedIP)
+	}
 	return w.configurer.RemoveAllowedIP(peerKey, allowedIP)
 }
 
@@ -174,6 +189,12 @@ func (w *WGIface) Close() error {
 
 	var result *multierror.Error
 
+	if w.batcher != nil {
+		if err := w.batcher.Close(); err != nil {
+			result = multierror.Append(result, fmt.Errorf("failed to close WireGuard batcher: %w", err))
+		}
+	}
+
 	if err := w.wgProxyFactory.Free(); err != nil {
 		result = multierror.Append(result, fmt.Errorf("failed to free WireGuard proxy: %w", err))
 	}

client/iface/iface_create.go

@@ -17,6 +17,7 @@ func (w *WGIface) Create() error {
 	}
 
 	w.configurer = cfgr
+	w.batcher = NewWGBatcher(cfgr)
 	return nil
 }
 

client/iface/iface_create_android.go

@@ -1,8 +1,6 @@
 package iface
 
-import (
-	"fmt"
-)
+import "fmt"
 
 // CreateOnAndroid creates a new Wireguard interface, sets a given IP and brings it up.
 // Will reuse an existing one.
@@ -15,6 +13,7 @@ func (w *WGIface) CreateOnAndroid(routes []string, dns string, searchDomains []s
 		return err
 	}
 	w.configurer = cfgr
+	w.batcher = NewWGBatcher(cfgr)
 	return nil
 }
 

client/iface/iface_create_darwin.go

@@ -29,6 +29,7 @@ func (w *WGIface) Create() error {
 			return err
 		}
 		w.configurer = cfgr
+		w.batcher = NewWGBatcher(cfgr)
 		return nil
 	}
 

client/internal/lazyconn/activity/manager_test.go

@@ -33,15 +33,6 @@ func (m MocWGIface) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAd
 
 }
 
-// Add this method to the Manager struct
-func (m *Manager) GetPeerListener(peerConnID peerid.ConnID) (*Listener, bool) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	listener, exists := m.peers[peerConnID]
-	return listener, exists
-}
-
 func TestManager_MonitorPeerActivity(t *testing.T) {
 	mocWgInterface := &MocWGIface{}
 
@@ -60,12 +51,7 @@ func TestManager_MonitorPeerActivity(t *testing.T) {
 		t.Fatalf("failed to monitor peer activity: %v", err)
 	}
 
-	listener, exists := mgr.GetPeerListener(peerCfg1.PeerConnID)
-	if !exists {
-		t.Fatalf("peer listener not found")
-	}
-
-	if err := trigger(listener.conn.LocalAddr().String()); err != nil {
+	if err := trigger(mgr.peers[peerCfg1.PeerConnID].conn.LocalAddr().String()); err != nil {
 		t.Fatalf("failed to trigger activity: %v", err)
 	}
 
@@ -142,21 +128,11 @@ func TestManager_MultiPeerActivity(t *testing.T) {
 		t.Fatalf("failed to monitor peer activity: %v", err)
 	}
 
-	listener, exists := mgr.GetPeerListener(peerCfg1.PeerConnID)
-	if !exists {
-		t.Fatalf("peer listener for peer1 not found")
-	}
-
-	if err := trigger(listener.conn.LocalAddr().String()); err != nil {
+	if err := trigger(mgr.peers[peerCfg1.PeerConnID].conn.LocalAddr().String()); err != nil {
 		t.Fatalf("failed to trigger activity: %v", err)
 	}
 
-	listener, exists = mgr.GetPeerListener(peerCfg2.PeerConnID)
-	if !exists {
-		t.Fatalf("peer listener for peer2 not found")
-	}
-
-	if err := trigger(listener.conn.LocalAddr().String()); err != nil {
+	if err := trigger(mgr.peers[peerCfg2.PeerConnID].conn.LocalAddr().String()); err != nil {
 		t.Fatalf("failed to trigger activity: %v", err)
 	}
 

client/proto/daemon.pb.go

@@ -1330,6 +1330,13 @@ func (x *PeerState) GetRelayAddress() string {
 	return ""
 }
 
+func (x *PeerState) GetConnectionType() string {
+	if x.Relayed {
+		return "Relayed"
+	}
+	return "P2P"
+}
+
 // LocalPeerState contains the latest state of the local peer
 type LocalPeerState struct {
 	state               protoimpl.MessageState `protogen:"open.v1"`

client/status/status.go

@@ -203,18 +203,13 @@ func mapPeers(
 		localICEEndpoint := ""
 		remoteICEEndpoint := ""
 		relayServerAddress := ""
-		connType := "P2P"
+		connType := ""
 		lastHandshake := time.Time{}
 		transferReceived := int64(0)
 		transferSent := int64(0)
 
 		isPeerConnected := pbPeerState.ConnStatus == peer.StatusConnected.String()
-
-		if pbPeerState.Relayed {
-			connType = "Relayed"
-		}
-
-		if skipDetailByFilters(pbPeerState, pbPeerState.ConnStatus, statusFilter, prefixNamesFilter, prefixNamesFilterMap, ipsFilter, connectionTypeFilter, connType) {
+		if skipDetailByFilters(pbPeerState, pbPeerState.ConnStatus, statusFilter, prefixNamesFilter, prefixNamesFilterMap, ipsFilter, connectionTypeFilter) {
 			continue
 		}
 		if isPeerConnected {
@@ -224,6 +219,7 @@ func mapPeers(
 			remoteICE = pbPeerState.GetRemoteIceCandidateType()
 			localICEEndpoint = pbPeerState.GetLocalIceCandidateEndpoint()
 			remoteICEEndpoint = pbPeerState.GetRemoteIceCandidateEndpoint()
+			connType = pbPeerState.GetConnectionType()
 			relayServerAddress = pbPeerState.GetRelayAddress()
 			lastHandshake = pbPeerState.GetLastWireguardHandshake().AsTime().Local()
 			transferReceived = pbPeerState.GetBytesRx()
@@ -544,7 +540,7 @@ func parsePeers(peers PeersStateOutput, rosenpassEnabled, rosenpassPermissive bo
 	return peersString
 }
 
-func skipDetailByFilters(peerState *proto.PeerState, peerStatus string, statusFilter string, prefixNamesFilter []string, prefixNamesFilterMap map[string]struct{}, ipsFilter map[string]struct{}, connectionTypeFilter, connType string) bool {
+func skipDetailByFilters(peerState *proto.PeerState, peerStatus string, statusFilter string, prefixNamesFilter []string, prefixNamesFilterMap map[string]struct{}, ipsFilter map[string]struct{}, connectionTypeFilter string) bool {
 	statusEval := false
 	ipEval := false
 	nameEval := true
@@ -573,7 +569,7 @@ func skipDetailByFilters(peerState *proto.PeerState, peerStatus string, statusFi
 	} else {
 		nameEval = false
 	}
-	if connectionTypeFilter != "" && !strings.EqualFold(connType, connectionTypeFilter) {
+	if connectionTypeFilter != "" && !strings.EqualFold(peerState.GetConnectionType(), connectionTypeFilter) {
 		connectionTypeEval = true
 	}
 

go.mod

@@ -63,7 +63,7 @@ require (
 	github.com/miekg/dns v1.1.59
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/nadoo/ipset v0.5.0
-	github.com/netbirdio/management-integrations/integrations v0.0.0-20250724151510-c007bc6b392c
+	github.com/netbirdio/management-integrations/integrations v0.0.0-20250718071730-f4d133556ff5
 	github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250514131221-a464fd5f30cb
 	github.com/okta/okta-sdk-golang/v2 v2.18.0
 	github.com/oschwald/maxminddb-golang v1.12.0

go.sum

@@ -503,8 +503,8 @@ github.com/netbirdio/go-netroute v0.0.0-20240611143515-f59b0e1d3944 h1:TDtJKmM6S
 github.com/netbirdio/go-netroute v0.0.0-20240611143515-f59b0e1d3944/go.mod h1:sHA6TRxjQ6RLbnI+3R4DZo2Eseg/iKiPRfNmcuNySVQ=
 github.com/netbirdio/ice/v3 v3.0.0-20240315174635-e72a50fcb64e h1:PURA50S8u4mF6RrkYYCAvvPCixhqqEiEy3Ej6avh04c=
 github.com/netbirdio/ice/v3 v3.0.0-20240315174635-e72a50fcb64e/go.mod h1:YMLU7qbKfVjmEv7EoZPIVEI+kNYxWCdPK3VS0BU+U4Q=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20250724151510-c007bc6b392c h1:OtX903X0FKEE+fcsp/P2701md7X/xbi/W/ojWIJNKSk=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20250724151510-c007bc6b392c/go.mod h1:Gi9raplYzCCyh07Olw/DVfCJTFgpr1WCXJ/Q+8TSA9Q=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20250718071730-f4d133556ff5 h1:Zfn8d83OVyELCdxgprcyXR3D8uqoxHtXE9PUxVXDx/w=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20250718071730-f4d133556ff5/go.mod h1:Gi9raplYzCCyh07Olw/DVfCJTFgpr1WCXJ/Q+8TSA9Q=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9axERMVN63dqyFqnvuD+EMJHzM7mNGON8=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250514131221-a464fd5f30cb h1:Cr6age+ePALqlSvtp7wc6lYY97XN7rkD1K4XEDmY+TU=

infrastructure_files/docker-compose.yml.tmpl

@@ -1,16 +1,8 @@
-x-default: &default
-  restart: 'unless-stopped'
-  logging:
-    driver: 'json-file'
-    options:
-      max-size: '500m'
-      max-file: '2'
-
 services:
   # UI dashboard
   dashboard:
-    <<: *default
     image: netbirdio/dashboard:$NETBIRD_DASHBOARD_TAG
+    restart: unless-stopped
     ports:
       - 80:80
       - 443:443
@@ -35,11 +27,16 @@ services:
       - LETSENCRYPT_EMAIL=$NETBIRD_LETSENCRYPT_EMAIL
     volumes:
       - $LETSENCRYPT_VOLUMENAME:/etc/letsencrypt/
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
 
   # Signal
   signal:
-    <<: *default
     image: netbirdio/signal:$NETBIRD_SIGNAL_TAG
+    restart: unless-stopped
     volumes:
       - $SIGNAL_VOLUMENAME:/var/lib/netbird
     ports:
@@ -47,11 +44,16 @@ services:
   #      # port and command for Let's Encrypt validation
   #      - 443:443
   #    command: ["--letsencrypt-domain", "$NETBIRD_LETSENCRYPT_DOMAIN", "--log-file", "console"]
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
 
   # Relay
   relay:
-    <<: *default
     image: netbirdio/relay:$NETBIRD_RELAY_TAG
+    restart: unless-stopped
     environment:
     - NB_LOG_LEVEL=info
     - NB_LISTEN_ADDRESS=:$NETBIRD_RELAY_PORT
@@ -60,11 +62,16 @@ services:
     - NB_AUTH_SECRET=$NETBIRD_RELAY_AUTH_SECRET
     ports:
       - $NETBIRD_RELAY_PORT:$NETBIRD_RELAY_PORT
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
 
   # Management
   management:
-    <<: *default
     image: netbirdio/management:$NETBIRD_MANAGEMENT_TAG
+    restart: unless-stopped
     depends_on:
       - dashboard
     volumes:
@@ -83,14 +90,19 @@ services:
       "--single-account-mode-domain=$NETBIRD_MGMT_SINGLE_ACCOUNT_MODE_DOMAIN",
       "--dns-domain=$NETBIRD_MGMT_DNS_DOMAIN"
       ]
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
     environment:
       - NETBIRD_STORE_ENGINE_POSTGRES_DSN=$NETBIRD_STORE_ENGINE_POSTGRES_DSN
       - NETBIRD_STORE_ENGINE_MYSQL_DSN=$NETBIRD_STORE_ENGINE_MYSQL_DSN
       
   # Coturn
   coturn:
-    <<: *default
     image: coturn/coturn:$COTURN_TAG
+    restart: unless-stopped
     #domainname: $TURN_DOMAIN # only needed when TLS is enabled
     volumes:
       - ./turnserver.conf:/etc/turnserver.conf:ro
@@ -99,6 +111,11 @@ services:
     network_mode: host
     command:
       - -c /etc/turnserver.conf
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
 
 volumes:
   $MGMT_VOLUMENAME:

infrastructure_files/docker-compose.yml.tmpl.traefik

@@ -1,16 +1,8 @@
-x-default: &default
-  restart: 'unless-stopped'
-  logging:
-    driver: 'json-file'
-    options:
-      max-size: '500m'
-      max-file: '2'
-
 services:
   # UI dashboard
   dashboard:
-    <<: *default
     image: netbirdio/dashboard:$NETBIRD_DASHBOARD_TAG
+    restart: unless-stopped
     environment:
       # Endpoints
       - NETBIRD_MGMT_API_ENDPOINT=$NETBIRD_MGMT_API_ENDPOINT
@@ -36,11 +28,16 @@ services:
     - traefik.enable=true
     - traefik.http.routers.netbird-dashboard.rule=Host(`$NETBIRD_DOMAIN`)
     - traefik.http.services.netbird-dashboard.loadbalancer.server.port=80
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
 
   # Signal
   signal:
-    <<: *default
     image: netbirdio/signal:$NETBIRD_SIGNAL_TAG
+    restart: unless-stopped
     volumes:
       - $SIGNAL_VOLUMENAME:/var/lib/netbird
     labels:
@@ -48,17 +45,27 @@ services:
     - traefik.http.routers.netbird-signal.rule=Host(`$NETBIRD_DOMAIN`) && PathPrefix(`/signalexchange.SignalExchange/`)
     - traefik.http.services.netbird-signal.loadbalancer.server.port=10000
     - traefik.http.services.netbird-signal.loadbalancer.server.scheme=h2c
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
 
   # Relay
   relay:
-    <<: *default
     image: netbirdio/relay:$NETBIRD_RELAY_TAG
+    restart: unless-stopped
     environment:
     - NB_LOG_LEVEL=info
     - NB_LISTEN_ADDRESS=:33080
     - NB_EXPOSED_ADDRESS=$NETBIRD_RELAY_ENDPOINT
     # todo: change to a secure secret
     - NB_AUTH_SECRET=$NETBIRD_RELAY_AUTH_SECRET
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
     labels:
     - traefik.enable=true
     - traefik.http.routers.netbird-relay.rule=Host(`$NETBIRD_DOMAIN`) && PathPrefix(`/relay`)
@@ -66,8 +73,8 @@ services:
 
   # Management
   management:
-    <<: *default
     image: netbirdio/management:$NETBIRD_MANAGEMENT_TAG
+    restart: unless-stopped
     depends_on:
       - dashboard
     volumes:
@@ -92,20 +99,30 @@ services:
     - traefik.http.routers.netbird-management.service=netbird-management
     - traefik.http.services.netbird-management.loadbalancer.server.port=33073
     - traefik.http.services.netbird-management.loadbalancer.server.scheme=h2c
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
     environment:
       - NETBIRD_STORE_ENGINE_POSTGRES_DSN=$NETBIRD_STORE_ENGINE_POSTGRES_DSN
       - NETBIRD_STORE_ENGINE_MYSQL_DSN=$NETBIRD_STORE_ENGINE_MYSQL_DSN
       
   # Coturn
   coturn:
-    <<: *default
     image: coturn/coturn:$COTURN_TAG
+    restart: unless-stopped
     domainname: $TURN_DOMAIN
     volumes:
       - ./turnserver.conf:/etc/turnserver.conf:ro
     network_mode: host
     command:
       - -c /etc/turnserver.conf
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "500m"
+        max-file: "2"
 
 volumes:
   $MGMT_VOLUMENAME:

infrastructure_files/getting-started-with-zitadel.sh

@@ -780,6 +780,7 @@ EOF
 
 renderDockerCompose() {
   cat <<EOF
+version: "3.4"
 services:
   # Caddy reverse proxy
   caddy:

management/server/account/manager.go

@@ -101,7 +101,7 @@ type Manager interface {
 	DeletePostureChecks(ctx context.Context, accountID, postureChecksID, userID string) error
 	ListPostureChecks(ctx context.Context, accountID, userID string) ([]*posture.Checks, error)
 	GetIdpManager() idp.Manager
-	UpdateIntegratedValidator(ctx context.Context, accountID, userID, validator string, groups []string) error
+	UpdateIntegratedValidatorGroups(ctx context.Context, accountID string, userID string, groups []string) error
 	GroupValidation(ctx context.Context, accountId string, groups []string) (bool, error)
 	GetValidatedPeers(ctx context.Context, accountID string) (map[string]struct{}, error)
 	SyncAndMarkPeer(ctx context.Context, accountID string, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, error)

management/server/integrated_validator.go

@@ -3,7 +3,6 @@ package server
 import (
 	"context"
 	"errors"
-	"fmt"
 
 	log "github.com/sirupsen/logrus"
 
@@ -13,44 +12,34 @@ import (
 	"github.com/netbirdio/netbird/management/server/types"
 )
 
-// UpdateIntegratedValidator updates the integrated validator groups for a specified account.
+// UpdateIntegratedValidatorGroups updates the integrated validator groups for a specified account.
 // It retrieves the account associated with the provided userID, then updates the integrated validator groups
 // with the provided list of group ids. The updated account is then saved.
 //
 // Parameters:
 //   - accountID: The ID of the account for which integrated validator groups are to be updated.
 //   - userID: The ID of the user whose account is being updated.
-//   - validator: The validator type to use, or empty to remove.
 //   - groups: A slice of strings representing the ids of integrated validator groups to be updated.
 //
 // Returns:
 //   - error: An error if any occurred during the process, otherwise returns nil
-func (am *DefaultAccountManager) UpdateIntegratedValidator(ctx context.Context, accountID, userID, validator string, groups []string) error {
-	if validator != "" && len(groups) == 0 {
-		return fmt.Errorf("at least one group must be specified for validator")
+func (am *DefaultAccountManager) UpdateIntegratedValidatorGroups(ctx context.Context, accountID string, userID string, groups []string) error {
+	ok, err := am.GroupValidation(ctx, accountID, groups)
+	if err != nil {
+		log.WithContext(ctx).Debugf("error validating groups: %s", err.Error())
+		return err
 	}
 
-	if validator != "" {
-		ok, err := am.GroupValidation(ctx, accountID, groups)
-		if err != nil {
-			log.WithContext(ctx).Debugf("error validating groups: %s", err.Error())
-			return err
-		}
-
-		if !ok {
-			log.WithContext(ctx).Debugf("invalid groups")
-			return errors.New("invalid groups")
-		}
-	} else {
-		// ensure groups is empty
-		groups = []string{}
+	if !ok {
+		log.WithContext(ctx).Debugf("invalid groups")
+		return errors.New("invalid groups")
 	}
 
 	unlock := am.Store.AcquireWriteLockByUID(ctx, accountID)
 	defer unlock()
 
 	return am.Store.ExecuteInTransaction(ctx, func(transaction store.Store) error {
-		a, err := transaction.GetAccount(ctx, accountID)
+		a, err := transaction.GetAccountByUser(ctx, userID)
 		if err != nil {
 			return err
 		}
@@ -63,8 +52,6 @@ func (am *DefaultAccountManager) UpdateIntegratedValidator(ctx context.Context,
 			extra = &types.ExtraSettings{}
 			a.Settings.Extra = extra
 		}
-
-		extra.IntegratedValidator = validator
 		extra.IntegratedValidatorGroups = groups
 		return transaction.SaveAccount(ctx, a)
 	})
@@ -112,7 +99,7 @@ func (am *DefaultAccountManager) GetValidatedPeers(ctx context.Context, accountI
 		return nil, err
 	}
 
-	return am.integratedPeerValidator.GetValidatedPeers(ctx, accountID, groups, peers, settings.Extra)
+	return am.integratedPeerValidator.GetValidatedPeers(accountID, groups, peers, settings.Extra)
 }
 
 type MockIntegratedValidator struct {
@@ -131,7 +118,7 @@ func (a MockIntegratedValidator) ValidatePeer(_ context.Context, update *nbpeer.
 	return update, false, nil
 }
 
-func (a MockIntegratedValidator) GetValidatedPeers(_ context.Context, accountID string, groups []*types.Group, peers []*nbpeer.Peer, extraSettings *types.ExtraSettings) (map[string]struct{}, error) {
+func (a MockIntegratedValidator) GetValidatedPeers(accountID string, groups []*types.Group, peers []*nbpeer.Peer, extraSettings *types.ExtraSettings) (map[string]struct{}, error) {
 	validatedPeers := make(map[string]struct{})
 	for _, peer := range peers {
 		validatedPeers[peer.ID] = struct{}{}
@@ -147,7 +134,7 @@ func (MockIntegratedValidator) IsNotValidPeer(_ context.Context, accountID strin
 	return false, false, nil
 }
 
-func (MockIntegratedValidator) PeerDeleted(_ context.Context, _, _ string, extraSettings *types.ExtraSettings) error {
+func (MockIntegratedValidator) PeerDeleted(_ context.Context, _, _ string) error {
 	return nil
 }
 

management/server/integrations/integrated_validator/interface.go

@@ -14,8 +14,8 @@ type IntegratedValidator interface {
 	ValidatePeer(ctx context.Context, update *nbpeer.Peer, peer *nbpeer.Peer, userID string, accountID string, dnsDomain string, peersGroup []string, extraSettings *types.ExtraSettings) (*nbpeer.Peer, bool, error)
 	PreparePeer(ctx context.Context, accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *types.ExtraSettings) *nbpeer.Peer
 	IsNotValidPeer(ctx context.Context, accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *types.ExtraSettings) (bool, bool, error)
-	GetValidatedPeers(ctx context.Context, accountID string, groups []*types.Group, peers []*nbpeer.Peer, extraSettings *types.ExtraSettings) (map[string]struct{}, error)
-	PeerDeleted(ctx context.Context, accountID, peerID string, extraSettings *types.ExtraSettings) error
+	GetValidatedPeers(accountID string, groups []*types.Group, peers []*nbpeer.Peer, extraSettings *types.ExtraSettings) (map[string]struct{}, error)
+	PeerDeleted(ctx context.Context, accountID, peerID string) error
 	SetPeerInvalidationListener(fn func(accountID string))
 	Stop(ctx context.Context)
 	ValidateFlowResponse(ctx context.Context, peerKey string, flowResponse *proto.PKCEAuthorizationFlow) *proto.PKCEAuthorizationFlow

management/server/mock_server/account_mock.go

@@ -102,7 +102,7 @@ type MockAccountManager struct {
 	DeletePostureChecksFunc               func(ctx context.Context, accountID, postureChecksID, userID string) error
 	ListPostureChecksFunc                 func(ctx context.Context, accountID, userID string) ([]*posture.Checks, error)
 	GetIdpManagerFunc                     func() idp.Manager
-	UpdateIntegratedValidatorFunc         func(ctx context.Context, accountID, userID, validator string, groups []string) error
+	UpdateIntegratedValidatorGroupsFunc   func(ctx context.Context, accountID string, userID string, groups []string) error
 	GroupValidationFunc                   func(ctx context.Context, accountId string, groups []string) (bool, error)
 	SyncPeerMetaFunc                      func(ctx context.Context, peerPubKey string, meta nbpeer.PeerSystemMeta) error
 	FindExistingPostureCheckFunc          func(accountID string, checks *posture.ChecksDefinition) (*posture.Checks, error)
@@ -769,10 +769,10 @@ func (am *MockAccountManager) GetIdpManager() idp.Manager {
 	return nil
 }
 
-// UpdateIntegratedValidator mocks UpdateIntegratedApprovalGroups of the AccountManager interface
-func (am *MockAccountManager) UpdateIntegratedValidator(ctx context.Context, accountID, userID, validator string, groups []string) error {
-	if am.UpdateIntegratedValidatorFunc != nil {
-		return am.UpdateIntegratedValidatorFunc(ctx, accountID, userID, validator, groups)
+// UpdateIntegratedValidatorGroups mocks UpdateIntegratedApprovalGroups of the AccountManager interface
+func (am *MockAccountManager) UpdateIntegratedValidatorGroups(ctx context.Context, accountID string, userID string, groups []string) error {
+	if am.UpdateIntegratedValidatorGroupsFunc != nil {
+		return am.UpdateIntegratedValidatorGroupsFunc(ctx, accountID, userID, groups)
 	}
 	return status.Errorf(codes.Unimplemented, "method UpdateIntegratedValidatorGroups is not implemented")
 }

management/server/peer.go

@@ -23,7 +23,6 @@ import (
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
-	"github.com/netbirdio/netbird/util"
 
 	"github.com/netbirdio/netbird/management/server/posture"
 	"github.com/netbirdio/netbird/management/server/store"
@@ -88,7 +87,7 @@ func (am *DefaultAccountManager) getUserAccessiblePeers(ctx context.Context, acc
 		return nil, err
 	}
 
-	approvedPeersMap, err := am.integratedPeerValidator.GetValidatedPeers(ctx, accountID, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
+	approvedPeersMap, err := am.integratedPeerValidator.GetValidatedPeers(accountID, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
 		return nil, err
 	}
@@ -413,7 +412,7 @@ func (am *DefaultAccountManager) GetNetworkMap(ctx context.Context, peerID strin
 		groups[groupID] = group.Peers
 	}
 
-	validatedPeers, err := am.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
+	validatedPeers, err := am.integratedPeerValidator.GetValidatedPeers(account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
 		return nil, err
 	}
@@ -1037,7 +1036,7 @@ func (am *DefaultAccountManager) getValidatedPeerWithMap(ctx context.Context, is
 		return nil, nil, nil, err
 	}
 
-	approvedPeersMap, err := am.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
+	approvedPeersMap, err := am.integratedPeerValidator.GetValidatedPeers(account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
 		return nil, nil, nil, err
 	}
@@ -1157,7 +1156,7 @@ func (am *DefaultAccountManager) checkIfUserOwnsPeer(ctx context.Context, accoun
 		return nil, err
 	}
 
-	approvedPeersMap, err := am.integratedPeerValidator.GetValidatedPeers(ctx, accountID, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
+	approvedPeersMap, err := am.integratedPeerValidator.GetValidatedPeers(accountID, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
 		return nil, err
 	}
@@ -1184,8 +1183,6 @@ func (am *DefaultAccountManager) checkIfUserOwnsPeer(ctx context.Context, accoun
 // UpdateAccountPeers updates all peers that belong to an account.
 // Should be called when changes have to be synced to peers.
 func (am *DefaultAccountManager) UpdateAccountPeers(ctx context.Context, accountID string) {
-	log.WithContext(ctx).Tracef("updating peers for account %s from %s", accountID, util.GetCallerName())
-
 	account, err := am.requestBuffer.GetAccountWithBackpressure(ctx, accountID)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to send out updates to peers. failed to get account: %v", err)
@@ -1207,7 +1204,7 @@ func (am *DefaultAccountManager) UpdateAccountPeers(ctx context.Context, account
 		return
 	}
 
-	approvedPeersMap, err := am.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
+	approvedPeersMap, err := am.integratedPeerValidator.GetValidatedPeers(account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to send out updates to peers, failed to get validate peers: %v", err)
 		return
@@ -1291,8 +1288,6 @@ type bufferUpdate struct {
 }
 
 func (am *DefaultAccountManager) BufferUpdateAccountPeers(ctx context.Context, accountID string) {
-	log.WithContext(ctx).Tracef("buffer updating peers for account %s from %s", accountID, util.GetCallerName())
-
 	bufUpd, _ := am.accountUpdateLocks.LoadOrStore(accountID, &bufferUpdate{})
 	b := bufUpd.(*bufferUpdate)
 
@@ -1342,7 +1337,7 @@ func (am *DefaultAccountManager) UpdateAccountPeer(ctx context.Context, accountI
 		return
 	}
 
-	approvedPeersMap, err := am.integratedPeerValidator.GetValidatedPeers(ctx, account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
+	approvedPeersMap, err := am.integratedPeerValidator.GetValidatedPeers(account.Id, maps.Values(account.Groups), maps.Values(account.Peers), account.Settings.Extra)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to send update to peer %s, failed to validate peers: %v", peerId, err)
 		return
@@ -1576,7 +1571,7 @@ func deletePeers(ctx context.Context, am *DefaultAccountManager, transaction sto
 			}
 		}
 
-		if err := am.integratedPeerValidator.PeerDeleted(ctx, accountID, peer.ID, settings.Extra); err != nil {
+		if err := am.integratedPeerValidator.PeerDeleted(ctx, accountID, peer.ID); err != nil {
 			return nil, err
 		}
 

management/server/scheduler.go

@@ -11,17 +11,14 @@ import (
 // Scheduler is an interface which implementations can schedule and cancel jobs
 type Scheduler interface {
 	Cancel(ctx context.Context, IDs []string)
-	CancelAll(ctx context.Context)
 	Schedule(ctx context.Context, in time.Duration, ID string, job func() (nextRunIn time.Duration, reschedule bool))
 	IsSchedulerRunning(ID string) bool
 }
 
 // MockScheduler is a mock implementation of  Scheduler
 type MockScheduler struct {
-	CancelFunc             func(ctx context.Context, IDs []string)
-	CancelAllFunc          func(ctx context.Context)
-	ScheduleFunc           func(ctx context.Context, in time.Duration, ID string, job func() (nextRunIn time.Duration, reschedule bool))
-	IsSchedulerRunningFunc func(ID string) bool
+	CancelFunc   func(ctx context.Context, IDs []string)
+	ScheduleFunc func(ctx context.Context, in time.Duration, ID string, job func() (nextRunIn time.Duration, reschedule bool))
 }
 
 // Cancel mocks the Cancel function of the Scheduler interface
@@ -33,15 +30,6 @@ func (mock *MockScheduler) Cancel(ctx context.Context, IDs []string) {
 	log.WithContext(ctx).Warnf("MockScheduler doesn't have Cancel function defined ")
 }
 
-// CancelAll mocks the CancelAll function of the Scheduler interface
-func (mock *MockScheduler) CancelAll(ctx context.Context) {
-	if mock.CancelAllFunc != nil {
-		mock.CancelAllFunc(ctx)
-		return
-	}
-	log.WithContext(ctx).Warnf("MockScheduler doesn't have CancelAll function defined ")
-}
-
 // Schedule mocks the Schedule function of the Scheduler interface
 func (mock *MockScheduler) Schedule(ctx context.Context, in time.Duration, ID string, job func() (nextRunIn time.Duration, reschedule bool)) {
 	if mock.ScheduleFunc != nil {
@@ -52,9 +40,7 @@ func (mock *MockScheduler) Schedule(ctx context.Context, in time.Duration, ID st
 }
 
 func (mock *MockScheduler) IsSchedulerRunning(ID string) bool {
-	if mock.IsSchedulerRunningFunc != nil {
-		return mock.IsSchedulerRunningFunc(ID)
-	}
+	// MockScheduler does not implement IsSchedulerRunning, so we return false
 	log.Warnf("MockScheduler doesn't have IsSchedulerRunning function defined")
 	return false
 }
@@ -66,15 +52,6 @@ type DefaultScheduler struct {
 	mu   *sync.Mutex
 }
 
-func (wm *DefaultScheduler) CancelAll(ctx context.Context) {
-	wm.mu.Lock()
-	defer wm.mu.Unlock()
-
-	for id := range wm.jobs {
-		wm.cancel(ctx, id)
-	}
-}
-
 // NewDefaultScheduler creates an instance of a DefaultScheduler
 func NewDefaultScheduler() *DefaultScheduler {
 	return &DefaultScheduler{

management/server/scheduler_test.go

@@ -75,38 +75,6 @@ func TestScheduler_Cancel(t *testing.T) {
 	assert.NotNil(t, scheduler.jobs[jobID2])
 }
 
-func TestScheduler_CancelAll(t *testing.T) {
-	jobID1 := "test-scheduler-job-1"
-	jobID2 := "test-scheduler-job-2"
-	scheduler := NewDefaultScheduler()
-	tChan := make(chan struct{})
-	p := []string{jobID1, jobID2}
-	scheduletime := 2 * time.Millisecond
-	sleepTime := 4 * time.Millisecond
-	if runtime.GOOS == "windows" {
-		// sleep and ticker are slower on windows see https://github.com/golang/go/issues/44343
-		sleepTime = 20 * time.Millisecond
-	}
-
-	scheduler.Schedule(context.Background(), scheduletime, jobID1, func() (nextRunIn time.Duration, reschedule bool) {
-		tt := p[0]
-		<-tChan
-		t.Logf("job %s", tt)
-		return scheduletime, true
-	})
-	scheduler.Schedule(context.Background(), scheduletime, jobID2, func() (nextRunIn time.Duration, reschedule bool) {
-		return scheduletime, true
-	})
-
-	time.Sleep(sleepTime)
-	assert.Len(t, scheduler.jobs, 2)
-	scheduler.CancelAll(context.Background())
-	close(tChan)
-	p = []string{}
-	time.Sleep(sleepTime)
-	assert.Len(t, scheduler.jobs, 0)
-}
-
 func TestScheduler_Schedule(t *testing.T) {
 	jobID := "test-scheduler-job-1"
 	scheduler := NewDefaultScheduler()

management/server/types/settings.go

@@ -77,8 +77,6 @@ type ExtraSettings struct {
 	// PeerApprovalEnabled enables or disables the need for peers bo be approved by an administrator
 	PeerApprovalEnabled bool
 
-	// IntegratedValidator is the string enum for the integrated validator type
-	IntegratedValidator string
 	// IntegratedValidatorGroups list of group IDs to be used with integrated approval configurations
 	IntegratedValidatorGroups []string `gorm:"serializer:json"`
 
@@ -95,10 +93,5 @@ func (e *ExtraSettings) Copy() *ExtraSettings {
 	return &ExtraSettings{
 		PeerApprovalEnabled:       e.PeerApprovalEnabled,
 		IntegratedValidatorGroups: append(cpGroup, e.IntegratedValidatorGroups...),
-		IntegratedValidator:       e.IntegratedValidator,
-		FlowEnabled:               e.FlowEnabled,
-		FlowPacketCounterEnabled:  e.FlowPacketCounterEnabled,
-		FlowENCollectionEnabled:   e.FlowENCollectionEnabled,
-		FlowDnsCollectionEnabled:  e.FlowDnsCollectionEnabled,
 	}
 }

management/server/updatechannel.go

@@ -51,8 +51,6 @@ func (p *PeersUpdateManager) SendUpdate(ctx context.Context, peerID string, upda
 		}
 	}()
 
-	log.WithContext(ctx).Debugf("sending update to peer %s, checks: %s", peerID, update.Update.Checks)
-
 	if channel, ok := p.peerChannels[peerID]; ok {
 		found = true
 		select {

util/net/listener_listen.go

@@ -120,8 +120,17 @@ func (c *UDPConn) Close() error {
 	return closeConn(c.ID, c.UDPConn)
 }
 
+// WrapUDPConn wraps an existing *net.UDPConn with nbnet functionality
+func WrapUDPConn(conn *net.UDPConn) *UDPConn {
+	return &UDPConn{
+		UDPConn:   conn,
+		ID:        GenerateConnID(),
+		seenAddrs: &sync.Map{},
+	}
+}
+
 // RemoveAddress removes an address from the seen cache and triggers removal hooks.
-func (c *PacketConn) RemoveAddress(addr string) {
+func (c *UDPConn) RemoveAddress(addr string) {
 	if _, exists := c.seenAddrs.LoadAndDelete(addr); !exists {
 		return
 	}
@@ -150,16 +159,6 @@ func (c *PacketConn) RemoveAddress(addr string) {
 	}
 }
 
-
-// WrapPacketConn wraps an existing net.PacketConn with nbnet functionality
-func WrapPacketConn(conn net.PacketConn) *PacketConn {
-	return &PacketConn{
-		PacketConn: conn,
-		ID:         GenerateConnID(),
-		seenAddrs:  &sync.Map{},
-	}
-}
-
 func callWriteHooks(id ConnectionID, seenAddrs *sync.Map, b []byte, addr net.Addr) {
 	// Lookup the address in the seenAddrs map to avoid calling the hooks for every write
 	if _, loaded := seenAddrs.LoadOrStore(addr.String(), true); !loaded {

util/net/listener_listen_ios.go

@@ -4,7 +4,7 @@ import (
 	"net"
 )
 
-// WrapPacketConn on iOS just returns the original connection since iOS handles its own networking
-func WrapPacketConn(conn *net.UDPConn) *net.UDPConn {
+// WrapUDPConn on iOS just returns the original connection since iOS handles its own networking
+func WrapUDPConn(conn *net.UDPConn) *net.UDPConn {
 	return conn
 }

util/runtime.go

@@ -1,15 +0,0 @@
-package util
-
-import "runtime"
-
-func GetCallerName() string {
-	pc, _, _, ok := runtime.Caller(2)
-	if !ok {
-		return "unknown"
-	}
-	fn := runtime.FuncForPC(pc)
-	if fn == nil {
-		return "unknown"
-	}
-	return fn.Name()
-}