change restart site toast text

Make migration idempotent

.github/workflows/cicd.yml

@@ -266,7 +266,7 @@ jobs:
             - name: Install Go
               uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
               with:
-                  go-version: 1.25
+                  go-version: 1.26
 
             - name: Update version in package.json
               run: |

.github/workflows/linting.yml

@@ -26,7 +26,10 @@ jobs:
             - name: Set up Node.js
               uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
               with:
-                node-version: '24'
+                # Match the version the app ships on (Dockerfile /
+                # Dockerfile.dev both use 24.18.1) rather than floating
+                # to the latest 24.x.
+                node-version: '24.18.1'
 
             - name: Install dependencies
               run: npm ci

.github/workflows/test.yml

@@ -19,7 +19,13 @@ jobs:
       - name: Install Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '24'
+          # Pin to the version the app actually ships on (Dockerfile /
+          # Dockerfile.dev both use 24.18.1; .nvmrc pins the 24 major).
+          # A bare '24' floats to the latest 24.x; Node >= 24.19.0 added
+          # node::ObjectWrap cleanup hooks that crash better-sqlite3 on teardown
+          # ("Assertion failed: (env) != nullptr" in RemoveEnvironmentCleanupHook),
+          # which intermittently kills `npm run dev` in the step below.
+          node-version: '24.18.1'
 
       - name: Copy config file
         run: cp config/config.example.yml config/config.yml
@@ -43,19 +49,34 @@ jobs:
         run: npx tsc --noEmit
 
       - name: Start app in background
-        run: nohup npm run dev &
+        run: |
+          nohup npm run dev > app.log 2>&1 &
+          echo $! > app.pid
 
       - name: Wait for app availability
         run: |
+          print_log() {
+            if [ -f app.log ]; then cat app.log; else echo "(app.log not found)"; fi
+          }
           for i in {1..5}; do
             if curl --silent --fail http://localhost:3002/auth/login; then
               echo "App is up"
               exit 0
             fi
+            # Fail fast (and show why) if the process is gone. Read the PID
+            # safely: if it's missing/empty (e.g. nohup never started), treat
+            # that as "not running" instead of passing a bad arg to kill.
+            pid="$(cat app.pid 2>/dev/null || true)"
+            if [ -z "$pid" ] || ! kill -0 "$pid" 2>/dev/null; then
+              echo "App process exited before becoming available. Output:"
+              print_log
+              exit 1
+            fi
             echo "Waiting for the app... attempt $i"
             sleep 5
           done
-          echo "App failed to start"
+          echo "App failed to start. Output:"
+          print_log
           exit 1
 
   build-sqlite:

.npmrc

@@ -0,0 +1,4 @@
+# typescript-eslint@8.70.0 declares a peer range of typescript "<6.1.0" and
+# hasn't caught up to typescript@7.x yet, even though it works fine against it
+# in practice. Without this, `npm install`/`npm ci` fail with ERESOLVE.
+legacy-peer-deps=true

Dockerfile

@@ -5,7 +5,7 @@ WORKDIR /app
 
 RUN apt-get update && apt-get install -y python3 make g++ && rm -rf /var/lib/apt/lists/*
 
-COPY package*.json ./
+COPY package*.json .npmrc ./
 
 FROM base AS builder-dev
 

Dockerfile.dev

@@ -4,7 +4,7 @@ WORKDIR /app
 
 RUN apk add --no-cache python3 make g++
 
-COPY package*.json ./
+COPY package*.json .npmrc ./
 
 # Install dependencies
 RUN npm ci

README.md

@@ -142,6 +142,7 @@ Give users a landing page to quickly find and open the resources they can access
 * Create reusable views for common access patterns
 
 <img src="public/screenshots/resource-launcher.png" alt="Resource Launcher" width="100%" />
+<img src="public/screenshots/resource-launcher-expanded.png" alt="Resource Launcher Details Panel" width="100%" />
 
 ## Download Clients
 

config/ha-reference/README.md

@@ -1,3 +1,3 @@
 ## Example Docker Reference HA Deployment
 
-This directory contains basic config for a highly available deployment of Pangolin with two nodes. For more information [refer to the docs](/self-host/clustering/understanding-clustering).
+This directory contains a basic reference config for a highly available deployment of Pangolin with two nodes. For more information [refer to the docs](https://docs.pangolin.net/self-host/clustering/understanding-clustering).

install/go.mod

@@ -1,11 +1,11 @@
 module installer
 
-go 1.25.0
+go 1.26.0
 
 require (
 	github.com/charmbracelet/huh v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	golang.org/x/term v0.45.0
+	golang.org/x/term v0.46.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -33,6 +33,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 )

install/go.sum

@@ -69,10 +69,10 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=

messages/bg-BG.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Няма намерени сайтове.",
     "pangolinServerAdmin": "Администратор на сървър - Панголин",
     "licenseTierProfessional": "Професионален лиценз",
-    "licenseTierEnterprise": "Предприятие лиценз",
+    "licenseTierEnterprise": "Предприятие",
-    "licenseTierPersonal": "Персонален лиценз",
+    "licenseTierPersonal": "Личен",
+    "licenseTierTier1": "Начален",
+    "licenseTierTier2": "Мащаб",
     "licensed": "Лицензиран",
     "yes": "Да",
     "no": "Не",

messages/cs-CZ.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Nebyly nalezeny žádné stránky.",
     "pangolinServerAdmin": "Správce serveru - Pangolin",
     "licenseTierProfessional": "Profesionální licence",
-    "licenseTierEnterprise": "Podniková licence",
+    "licenseTierEnterprise": "Podniky",
-    "licenseTierPersonal": "Osobní licence",
+    "licenseTierPersonal": "Osobní",
+    "licenseTierTier1": "Počáteční",
+    "licenseTierTier2": "Měřítko",
     "licensed": "Licencováno",
     "yes": "Ano",
     "no": "Ne",
@@ -3979,7 +3981,7 @@
     "tpmAvailable": "TPM k dispozici",
     "windowsAntivirusEnabled": "Antivirus povolen",
     "macosSipEnabled": "Ochrana systémové integrity (SIP)",
-    "macosGatekeeperEnabled": "Gatekeeper",
+    "macosGatekeeperEnabled": "Strážce",
     "macosFirewallStealthMode": "Režim neviditelnosti firewallu",
     "linuxAppArmorEnabled": "Pancíř aplikace",
     "linuxSELinuxEnabled": "SELinux",

messages/da-DK.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Ingen sites fundet.",
     "pangolinServerAdmin": "Serveradmin - Pangolin",
     "licenseTierProfessional": "Professionel licens",
-    "licenseTierEnterprise": "Enterprise-licens",
+    "licenseTierEnterprise": "Bedrift",
-    "licenseTierPersonal": "Personlig licens",
+    "licenseTierPersonal": "Personlig",
+    "licenseTierTier1": "Begynder",
+    "licenseTierTier2": "Skala",
     "licensed": "Licenseret",
     "yes": "Ja",
     "no": "Nej",
@@ -2068,7 +2070,7 @@
     "aiUsageFilterNotFound": "Ingen valg fundet",
     "aiUsageResetFilters": "Nulstil Filtre",
     "aiUsageRefresh": "Opdater",
-    "aiUsageTokenTypePrompt": "Prompt",
+    "aiUsageTokenTypePrompt": "Vis",
     "aiUsageTokenTypeCacheRead": "Cache læs",
     "aiUsageTokenTypeCacheWrite": "Cache skriv",
     "aiUsageTokenTypeCompletion": "Komplettering",

messages/de-DE.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Keine Standorte gefunden.",
     "pangolinServerAdmin": "Server-Admin - Pangolin",
     "licenseTierProfessional": "Professional Lizenz",
-    "licenseTierEnterprise": "Enterprise Lizenz",
+    "licenseTierEnterprise": "Firma",
-    "licenseTierPersonal": "Persönliche Lizenz",
+    "licenseTierPersonal": "Persönlich",
+    "licenseTierTier1": "Starter",
+    "licenseTierTier2": "Maßstab",
     "licensed": "Lizenziert",
     "yes": "Ja",
     "no": "Nein",
@@ -3205,7 +3207,7 @@
     "idpAzureClientIdDescription2": "Azure App Registration Client ID",
     "idpAzureClientSecretDescription2": "Azure App Registration Client Geheimnis",
     "idpGoogleDescription": "Google OAuth2/OIDC Provider",
-    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC provider",
+    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC-Anbieter",
     "subnet": "Subnetz",
     "utilitySubnet": "Nutzsubnetz",
     "subnetDescription": "Das Subnetz für die Netzwerkkonfiguration dieser Organisation.",

messages/en-US.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Are you sure you want to restart the WireGuard tunnel for <b>{name}</b>? The site will briefly lose connectivity.",
     "siteRestartWarning": "The site will briefly disconnect while the tunnel restarts.",
     "siteRestarted": "Site restarted",
-    "siteRestartedDescription": "The WireGuard tunnel has been restarted.",
+    "siteRestartedDescription": "The site has been restarted.",
     "siteErrorRestart": "Failed to restart site",
     "siteErrorRestartDescription": "An error occurred while restarting the site.",
     "siteSettingDescription": "Configure the settings on the site",
@@ -234,6 +234,9 @@
     "clientResourceDescription": "Create and manage resources that are only accessible through a connected client",
     "privateResourcesBannerTitle": "Zero-Trust Private Access",
     "privateResourcesBannerDescription": "Private resources use zero-trust security, ensuring users and machines can only access resources you explicitly grant. Connect user devices or machine clients to access these resources over a secure virtual private network.",
+    "licenseBillingBannerTitle": "Manage License Billing",
+    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
+    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Search resources...",
     "resourceAdd": "Add Resource",
     "resourceErrorDelte": "Error deleting resource",
@@ -1118,8 +1121,10 @@
     "sitesNotFound": "No sites found.",
     "pangolinServerAdmin": "Server Admin - Pangolin",
     "licenseTierProfessional": "Professional License",
-    "licenseTierEnterprise": "Enterprise License",
+    "licenseTierEnterprise": "Enterprise",
-    "licenseTierPersonal": "Personal License",
+    "licenseTierPersonal": "Personal",
+    "licenseTierTier1": "Starter",
+    "licenseTierTier2": "Scale",
     "licensed": "Licensed",
     "yes": "Yes",
     "no": "No",

messages/es-ES.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Sitios no encontrados.",
     "pangolinServerAdmin": "Admin Servidor - Pangolin",
     "licenseTierProfessional": "Licencia profesional",
-    "licenseTierEnterprise": "Licencia Enterprise",
+    "licenseTierEnterprise": "Empresa",
-    "licenseTierPersonal": "Licencia personal",
+    "licenseTierPersonal": "Uso personal",
+    "licenseTierTier1": "Iniciador",
+    "licenseTierTier2": "Escala",
     "licensed": "Licenciado",
     "yes": "Sí",
     "no": "Nu",

messages/fr-FR.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Aucun site trouvé.",
     "pangolinServerAdmin": "Admin Serveur - Pangolin",
     "licenseTierProfessional": "Licence Professionnelle",
-    "licenseTierEnterprise": "Licence Entreprise",
+    "licenseTierEnterprise": "Entreprise",
-    "licenseTierPersonal": "Licence personnelle",
+    "licenseTierPersonal": "Personnel",
+    "licenseTierTier1": "Démarrage",
+    "licenseTierTier2": "Échelle",
     "licensed": "Sous licence",
     "yes": "Oui",
     "no": "Non",

messages/it-IT.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Nessun sito trovato.",
     "pangolinServerAdmin": "Server Admin - Pangolina",
     "licenseTierProfessional": "Licenza Professional",
-    "licenseTierEnterprise": "Licenza Enterprise",
+    "licenseTierEnterprise": "Impresa",
-    "licenseTierPersonal": "Licenza Personale",
+    "licenseTierPersonal": "Personale",
+    "licenseTierTier1": "Avviatore",
+    "licenseTierTier2": "Scala",
     "licensed": "Con Licenza",
     "yes": "Sì",
     "no": "No",

messages/ko-KR.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "사이트를 찾을 수 없습니다.",
     "pangolinServerAdmin": "서버 관리자 - 판골린",
     "licenseTierProfessional": "전문 라이센스",
-    "licenseTierEnterprise": "기업 라이선스",
+    "licenseTierEnterprise": "기업",
-    "licenseTierPersonal": "개인 라이선스",
+    "licenseTierPersonal": "개인",
+    "licenseTierTier1": "스타터",
+    "licenseTierTier2": "스케일",
     "licensed": "라이센스",
     "yes": "예",
     "no": "아니요",

messages/nb-NO.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Ingen områder funnet.",
     "pangolinServerAdmin": "Server Admin - Pangolin",
     "licenseTierProfessional": "Profesjonell lisens",
-    "licenseTierEnterprise": "Bedriftslisens",
+    "licenseTierEnterprise": "Bedrift",
-    "licenseTierPersonal": "Personlig lisens",
+    "licenseTierPersonal": "Personlig",
+    "licenseTierTier1": "Begynner",
+    "licenseTierTier2": "Skala",
     "licensed": "Lisensiert",
     "yes": "Ja",
     "no": "Nei",
@@ -2816,7 +2818,7 @@
     "roleTextImportPreview": "Forhåndsvisning",
     "roleTextImportItemCount": "{count, plural, =0 {Ingen elementer å importere} one {ett element å importere} other {# elementer å importere}}",
     "roleTextImportTotalCount": "{existing} eksisterende + {imported} importert = {total} totalt",
-    "roleTextImportConfirm": "Import",
+    "roleTextImportConfirm": "Importer",
     "roleTextImportInvalidFile": "Ustøttet filtype",
     "roleTextImportInvalidFileDescription": "Bare .txt og .csv filer er støttet.",
     "roleTextImportEmpty": "Ingen elementer funnet i filen",
@@ -3093,7 +3095,7 @@
     "regionAfrica": "Afrika",
     "regionNorthernAfrica": "[country name] Nord-Afrika",
     "regionEasternAfrica": "Øst-Afrika",
-    "regionMiddleAfrica": "Middle Africa",
+    "regionMiddleAfrica": "Midt-Afrika",
     "regionSouthernAfrica": "Sør-Afrika",
     "regionWesternAfrica": "[country name] Vest-Afrika",
     "regionAmericas": "Amerika",
@@ -3112,10 +3114,10 @@
     "regionNorthernEurope": "Nord-Europa",
     "regionSouthernEurope": "Sørlige Europa",
     "regionWesternEurope": "Vest-Europa",
-    "regionOceania": "Oceania",
+    "regionOceania": "Oseania",
     "regionAustraliaAndNewZealand": "Australia og New Zealand",
     "regionMelanesia": "Melanesia",
-    "regionMicronesia": "Micronesia",
+    "regionMicronesia": "Mikronesia",
     "regionPolynesia": "Polynesia",
     "managedSelfHosted": {
         "title": "Administrert selv-hostet",
@@ -3205,7 +3207,7 @@
     "idpAzureClientIdDescription2": "Azure App registrerings klient-ID",
     "idpAzureClientSecretDescription2": "Azure App Registrering Klient Hemmelig",
     "idpGoogleDescription": "Google OAuth2/OIDC leverandør",
-    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC provider",
+    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC-leverandør",
     "subnet": "Subnett",
     "utilitySubnet": "Nyttesubnett",
     "subnetDescription": "Undernettverket for denne organisasjonens nettverkskonfigurasjon.",
@@ -3220,7 +3222,7 @@
     "authPageBrandingRemoveTitle": "Fjern markedsføring for autentiseringsside",
     "authPageBrandingQuestionRemove": "Er du sikker på at du vil fjerne merkevarebyggingen for autentiseringssider?",
     "authPageBrandingDeleteConfirm": "Bekreft sletting av merkevarebygging",
-    "brandingLogoURL": "Logo URL",
+    "brandingLogoURL": "Logo-URL",
     "brandingLogoURLOrPath": "Logoen URL eller sti",
     "brandingLogoPathDescription": "Skriv inn en URL eller en lokal bane.",
     "brandingLogoURLDescription": "Skriv inn en offentlig tilgjengelig nettadresse til din logobilde.",
@@ -3360,7 +3362,7 @@
     "resourceHeaderAuthSetupTitleDescription": "Angi grunnleggende auth legitimasjon (brukernavn og passord) for å beskytte denne ressursen med HTTP Header autentisering. Tilgang til det ved hjelp av formatet https://username:password@resource.example.com",
     "resourceHeaderAuthSubmit": "Angi topptekst godkjenning",
     "actionSetResourceHeaderAuth": "Angi topptekst godkjenning",
-    "enterpriseEdition": "Enterprise Edition",
+    "enterpriseEdition": "Enterprise-utgave",
     "unlicensed": "Ikke lisensiert",
     "beta": "beta",
     "manageUserDevices": "Bruker Enheter",
@@ -3501,7 +3503,7 @@
     "priority": "Prioritet",
     "priorityDescription": "Høyere prioriterte ruter evalueres først. Prioritet = 100 betyr automatisk bestilling (systembeslutninger). Bruk et annet nummer til å håndheve manuell prioritet.",
     "instanceName": "Forekomst navn",
-    "clearInstanceName": "Reset Server Association",
+    "clearInstanceName": "Tilbakestill server-assosiasjon",
     "pathMatchModalTitle": "Konfigurere matching av sti",
     "pathMatchModalDescription": "Sett opp hvordan innkommende forespørsler skal matches basert på deres bane.",
     "pathMatchType": "Trefftype",
@@ -3557,11 +3559,11 @@
     "allowedByRule": "Tillatt etter regel",
     "allowedNoAuth": "Tillatt Ingen Auth",
     "validAccessToken": "Gyldig tilgangsnøkkel",
-    "validHeaderAuth": "Valid header auth",
+    "validHeaderAuth": "Gyldig header-autentisering",
     "validPincode": "Gyldig PIN-kode",
     "validPassword": "Gyldig passord",
-    "validEmail": "Valid email",
+    "validEmail": "Gyldig e-post",
-    "validSSO": "Valid SSO",
+    "validSSO": "Gyldig SSO",
     "validVirtualAPIKey": "Gyldig Virtuell API-nøkkel",
     "view": "Vis",
     "configManaged": "Konfigurasjon administrert",
@@ -3570,7 +3572,7 @@
     "droppedByRule": "Legg i regelen",
     "noSessions": "Ingen økter",
     "temporaryRequestToken": "Midlertidig forespørsel Token",
-    "noMoreAuthMethods": "No Valid Auth",
+    "noMoreAuthMethods": "Ingen gyldig autentisering",
     "ip": "IP",
     "reason": "Grunn",
     "requestLogs": "HTTP-forespørselslogger",
@@ -3784,14 +3786,14 @@
     "niceIdUpdateErrorDescription": "Det oppstod en feil under oppdatering av Nice ID.",
     "niceIdCannotBeEmpty": "God ID kan ikke være tom",
     "enterIdentifier": "Angi identifikator",
-    "identifier": "Identifier",
+    "identifier": "Identifikator",
     "deviceLoginUseDifferentAccount": "Ikke du? Bruk en annen konto.",
     "deviceLoginDeviceRequestingAccessToAccount": "En enhet ber om tilgang til denne kontoen.",
     "loginSelectAuthenticationMethod": "Velg en autentiseringsmetode for å fortsette.",
     "noData": "Ingen data",
     "machineClients": "Maskinklienter",
     "install": "Installer",
-    "downloadInstaller": "Download Installer",
+    "downloadInstaller": "Last ned installasjonsprogram",
     "run": "Kjør",
     "envFile": "Miljøfil",
     "serviceFile": "Tjenestefil",
@@ -3969,7 +3971,7 @@
     "kernelVersion": "Kjerne versjon",
     "deviceModel": "Enhets modell",
     "serialNumber": "Serienummer",
-    "hostname": "Hostname",
+    "hostname": "Vertsnavn",
     "firstSeen": "Først sett",
     "lastSeen": "Sist sett",
     "biometricsEnabled": "Biometri aktivert",
@@ -3999,7 +4001,7 @@
     "disconnected": "Frakoblet",
     "approvalsEmptyStateTitle": "Enhetsgodkjenninger er ikke aktivert",
     "approvalsEmptyStateDescription": "Aktivere godkjenninger av enheter for at roller må godkjennes av admin før brukere kan koble til nye enheter.",
-    "approvalsEmptyStateHowToTitle": "How to Enable",
+    "approvalsEmptyStateHowToTitle": "Hvordan aktivere",
     "approvalsEmptyStateStep1Title": "Gå til roller",
     "approvalsEmptyStateStep1Description": "Naviger til organisasjonens roller innstillinger for å konfigurere enhetsgodkjenninger.",
     "approvalsEmptyStateStep2Title": "Aktiver enhetsgodkjenninger",

messages/nl-NL.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Geen sites gevonden.",
     "pangolinServerAdmin": "Serverbeheer - Pangolin",
     "licenseTierProfessional": "Professionele licentie",
-    "licenseTierEnterprise": "Enterprise Licentie",
+    "licenseTierEnterprise": "Onderneming",
-    "licenseTierPersonal": "Persoonlijke licentie",
+    "licenseTierPersonal": "Persoonlijk",
+    "licenseTierTier1": "Beginner",
+    "licenseTierTier2": "Schaal",
     "licensed": "Gelicentieerd",
     "yes": "ja",
     "no": "Neen",
@@ -3205,7 +3207,7 @@
     "idpAzureClientIdDescription2": "Azure App registratie Client ID",
     "idpAzureClientSecretDescription2": "Azure App registratie client geheim",
     "idpGoogleDescription": "Algemene OAuth2/OIDC provider",
-    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC provider",
+    "idpAzureDescription": "Microsoft Azure OAuth2/OIDC-provider",
     "subnet": "Subnet",
     "utilitySubnet": "Hulpmiddel Subnet",
     "subnetDescription": "Het subnet van de netwerkconfiguratie van deze organisatie.",

messages/pl-PL.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Nie znaleziono witryn.",
     "pangolinServerAdmin": "Administrator serwera - Pangolin",
     "licenseTierProfessional": "Licencja Professional",
-    "licenseTierEnterprise": "Licencja Enterprise",
+    "licenseTierEnterprise": "Przedsiębiorstwo",
-    "licenseTierPersonal": "Licencja osobista",
+    "licenseTierPersonal": "Osobiste",
+    "licenseTierTier1": "Startowy",
+    "licenseTierTier2": "Skala",
     "licensed": "Licencjonowany",
     "yes": "Tak",
     "no": "Nie",
@@ -3791,7 +3793,7 @@
     "noData": "Brak danych",
     "machineClients": "Klienci maszyn",
     "install": "Zainstaluj",
-    "downloadInstaller": "Download Installer",
+    "downloadInstaller": "Pobierz instalator",
     "run": "Uruchom",
     "envFile": "Plik środowiska",
     "serviceFile": "Plik serwisu",
@@ -3999,7 +4001,7 @@
     "disconnected": "Rozłączony",
     "approvalsEmptyStateTitle": "Zatwierdzanie urządzenia nie włączone",
     "approvalsEmptyStateDescription": "Włącz zatwierdzanie urządzeń dla ról aby wymagać zgody administratora, zanim użytkownicy będą mogli podłączyć nowe urządzenia.",
-    "approvalsEmptyStateHowToTitle": "How to Enable",
+    "approvalsEmptyStateHowToTitle": "Jak włączyć",
     "approvalsEmptyStateStep1Title": "Przejdź do ról",
     "approvalsEmptyStateStep1Description": "Przejdź do ustawień ról swojej organizacji, aby skonfigurować zatwierdzenia urządzenia.",
     "approvalsEmptyStateStep2Title": "Włącz zatwierdzanie urządzenia",

messages/pt-PT.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Nenhum site encontrado.",
     "pangolinServerAdmin": "Administrador do Servidor - Pangolin",
     "licenseTierProfessional": "Licença Profissional",
-    "licenseTierEnterprise": "Licença Empresarial",
+    "licenseTierEnterprise": "Empresa",
-    "licenseTierPersonal": "Licença Pessoal",
+    "licenseTierPersonal": "Pessoal",
+    "licenseTierTier1": "Iniciante",
+    "licenseTierTier2": "Escala",
     "licensed": "Licenciado",
     "yes": "Sim",
     "no": "Não",

messages/ru-RU.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Сайты не найдены.",
     "pangolinServerAdmin": "Администратор сервера - Pangolin",
     "licenseTierProfessional": "Профессиональная лицензия",
-    "licenseTierEnterprise": "Корпоративная лицензия",
+    "licenseTierEnterprise": "Предприятие",
-    "licenseTierPersonal": "Личная лицензия",
+    "licenseTierPersonal": "Личное",
+    "licenseTierTier1": "Старт",
+    "licenseTierTier2": "Масштаб",
     "licensed": "Лицензировано",
     "yes": "Да",
     "no": "Нет",

messages/tr-TR.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "Site bulunamadı.",
     "pangolinServerAdmin": "Sunucu Yöneticisi - Pangolin",
     "licenseTierProfessional": "Profesyonel Lisans",
-    "licenseTierEnterprise": "Kurumsal Lisans",
+    "licenseTierEnterprise": "Kurumsal",
-    "licenseTierPersonal": "Kişisel Lisans",
+    "licenseTierPersonal": "Kişisel",
+    "licenseTierTier1": "Başlangıç",
+    "licenseTierTier2": "Ölçek",
     "licensed": "Lisanslı",
     "yes": "Evet",
     "no": "Hayır",

messages/zh-CN.json

@@ -1118,8 +1118,10 @@
     "sitesNotFound": "未找到站点。",
     "pangolinServerAdmin": "服务器管理 - Pangolin",
     "licenseTierProfessional": "专业许可证",
-    "licenseTierEnterprise": "企业许可证",
+    "licenseTierEnterprise": "企业",
-    "licenseTierPersonal": "个人许可证",
+    "licenseTierPersonal": "个人",
+    "licenseTierTier1": "启动器",
+    "licenseTierTier2": "扩展",
     "licensed": "已授权",
     "yes": "是",
     "no": "否",

package.json

@@ -33,13 +33,13 @@
     },
     "dependencies": {
         "@asteasolutions/zod-to-openapi": "9.1.0",
-        "@aws-sdk/client-s3": "3.1121.0",
+        "@aws-sdk/client-s3": "3.1131.0",
         "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
         "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.1.tgz",
         "@headlessui/react": "2.2.10",
         "@hookform/resolvers": "5.9.1",
         "@monaco-editor/react": "4.7.0",
-        "@node-rs/argon2": "2.2.0",
+        "@node-rs/argon2": "2.2.1",
         "@novnc/novnc": "^1.7.0",
         "@oslojs/crypto": "1.0.1",
         "@oslojs/encoding": "1.1.0",
@@ -65,8 +65,8 @@
         "@react-email/components": "1.0.12",
         "@react-email/render": "2.1.0",
         "@react-email/tailwind": "2.0.7",
-        "@simplewebauthn/browser": "13.3.0",
+        "@simplewebauthn/browser": "14.0.0",
-        "@simplewebauthn/server": "13.3.3",
+        "@simplewebauthn/server": "14.0.1",
         "@tailwindcss/forms": "0.5.11",
         "@tanstack/react-query": "5.102.8",
         "@tanstack/react-table": "8.21.3",
@@ -99,29 +99,29 @@
         "js-yaml": "5.4.1",
         "jsonwebtoken": "9.0.3",
         "lru-cache": "11.5.2",
-        "lucide-react": "1.38.0",
+        "lucide-react": "1.45.0",
         "maxmind": "5.0.7",
         "moment": "2.30.1",
-        "next": "16.3.3",
+        "next": "16.3.5",
-        "next-intl": "4.14.1",
+        "next-intl": "4.14.4",
         "next-themes": "0.4.6",
         "nextjs-toploader": "3.9.17",
-        "nodemailer": "9.1.0",
+        "nodemailer": "10.0.9",
         "oslo": "1.2.1",
         "pg": "8.23.0",
-        "posthog-node": "5.51.4",
+        "posthog-node": "5.52.1",
         "qrcode.react": "4.2.0",
-        "react": "19.2.8",
+        "react": "19.3.0",
-        "react-day-picker": "9.14.0",
+        "react-day-picker": "10.0.1",
-        "react-dom": "19.2.8",
+        "react-dom": "19.3.0",
         "react-easy-sort": "1.8.0",
-        "react-hook-form": "7.87.0",
+        "react-hook-form": "7.88.0",
         "react-icons": "5.7.0",
         "recharts": "3.10.1",
         "reodotdev": "1.1.0",
         "semver": "7.8.5",
         "sshpk": "1.18.0",
-        "stripe": "22.6.0",
+        "stripe": "22.6.2",
         "swagger-ui-express": "5.0.1",
         "tailwind-merge": "3.6.0",
         "topojson-client": "3.1.0",
@@ -133,15 +133,15 @@
         "winston": "3.19.0",
         "winston-daily-rotate-file": "5.0.0",
         "ws": "8.21.3",
-        "yaml": "2.9.0",
+        "yaml": "2.9.1",
         "yargs": "18.1.0",
-        "zod": "4.5.4",
+        "zod": "4.6.2",
         "zod-validation-error": "5.0.0"
     },
     "devDependencies": {
-        "@dotenvx/dotenvx": "2.23.0",
+        "@dotenvx/dotenvx": "2.24.1",
         "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/ui": "^6.9.3",
+        "@react-email/ui": "^6.9.5",
         "@tailwindcss/postcss": "4.3.3",
         "@tanstack/react-query-devtools": "5.102.8",
         "@types/better-sqlite3": "7.6.13",
@@ -155,12 +155,12 @@
         "@types/jmespath": "0.15.2",
         "@types/js-yaml": "4.0.9",
         "@types/jsonwebtoken": "9.0.10",
-        "@types/node": "26.4.0",
+        "@types/node": "26.5.1",
         "@types/nodemailer": "8.0.1",
         "@types/nprogress": "0.2.3",
         "@types/pg": "8.23.1",
-        "@types/react": "19.2.18",
+        "@types/react": "19.3.0",
-        "@types/react-dom": "19.2.5",
+        "@types/react-dom": "19.3.0",
         "@types/semver": "7.8.0",
         "@types/sshpk": "1.17.5",
         "@types/swagger-ui-express": "4.1.8",
@@ -171,20 +171,20 @@
         "drizzle-kit": "0.31.10",
         "esbuild": "0.28.2",
         "esbuild-node-externals": "2.0.0",
-        "eslint": "10.9.1",
+        "eslint": "10.10.0",
-        "eslint-config-next": "16.3.3",
+        "eslint-config-next": "16.3.5",
-        "postcss": "8.5.26",
+        "postcss": "8.5.28",
         "prettier": "3.9.6",
-        "react-email": "6.9.3",
+        "react-email": "6.9.5",
         "tailwindcss": "4.3.3",
-        "tsc-alias": "1.9.2",
+        "tsc-alias": "1.9.5",
         "tsx": "4.23.13",
-        "typescript": "6.0.3",
+        "typescript": "7.0.2",
-        "typescript-eslint": "8.68.0"
+        "typescript-eslint": "8.70.0"
     },
     "overrides": {
         "esbuild": "0.28.2",
         "dompurify": "3.4.0",
-        "postcss": "8.5.26"
+        "postcss": "8.5.28"
     }
 }

server/db/pg/driver.ts

@@ -1,5 +1,6 @@
 import { drizzle as DrizzlePostgres } from "drizzle-orm/node-postgres";
 import { readConfigFile } from "@server/lib/readConfigFile";
+import { readEnvOrFile } from "@server/lib/getEnvOrYaml";
 import { withReplicas } from "drizzle-orm/pg-core";
 import { createPool } from "./poolConfig";
 
@@ -7,17 +8,20 @@ function createDb() {
     const config = readConfigFile();
 
     // check the environment variables for postgres config first before the config file
-    if (process.env.POSTGRES_CONNECTION_STRING) {
+    const envConnectionString = readEnvOrFile("POSTGRES_CONNECTION_STRING");
+    if (envConnectionString) {
         config.postgres = {
-            connection_string: process.env.POSTGRES_CONNECTION_STRING
+            connection_string: envConnectionString
         };
-        if (process.env.POSTGRES_REPLICA_CONNECTION_STRINGS) {
+        const replicaConnectionStrings = readEnvOrFile(
-            const replicas =
+            "POSTGRES_REPLICA_CONNECTION_STRINGS"
-                process.env.POSTGRES_REPLICA_CONNECTION_STRINGS.split(",").map(
-                    (conn) => ({
-                        connection_string: conn.trim()
-                    })
         );
+        if (replicaConnectionStrings) {
+            const replicas = replicaConnectionStrings
+                .split(",")
+                .map((conn) => ({
+                    connection_string: conn.trim()
+                }));
             config.postgres.replicas = replicas;
         }
     }

server/db/pg/logsDriver.ts

@@ -1,5 +1,6 @@
 import { drizzle as DrizzlePostgres } from "drizzle-orm/node-postgres";
 import { readConfigFile } from "@server/lib/readConfigFile";
+import { readEnvOrFile } from "@server/lib/getEnvOrYaml";
 import { withReplicas } from "drizzle-orm/pg-core";
 import { build } from "@server/build";
 import { db as mainDb } from "./driver";
@@ -17,7 +18,7 @@ function createLogsDb() {
     const logsConfig = config.postgres_logs;
 
     // Check environment variable first
-    let connectionString = process.env.POSTGRES_LOGS_CONNECTION_STRING;
+    let connectionString = readEnvOrFile("POSTGRES_LOGS_CONNECTION_STRING");
     let replicaConnections: Array<{ connection_string: string }> = [];
 
     if (!connectionString && logsConfig) {
@@ -26,13 +27,15 @@ function createLogsDb() {
     }
 
     // If POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS is set, use it
-    if (process.env.POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS) {
+    const replicaConnectionStrings = readEnvOrFile(
-        replicaConnections =
+        "POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS"
-            process.env.POSTGRES_LOGS_REPLICA_CONNECTION_STRINGS.split(",").map(
-                (conn) => ({
-                    connection_string: conn.trim()
-                })
     );
+    if (replicaConnectionStrings) {
+        replicaConnections = replicaConnectionStrings
+            .split(",")
+            .map((conn) => ({
+                connection_string: conn.trim()
+            }));
     }
 
     // If no logs database is configured, fall back to main database

server/db/sqlite/driver.ts

@@ -6,6 +6,7 @@ import fs from "fs";
 import { APP_PATH } from "@server/lib/consts";
 import { existsSync, mkdirSync } from "fs";
 import logger from "@server/logger";
+import { readEnvOrFile } from "@server/lib/getEnvOrYaml";
 
 export const location = path.join(APP_PATH, "db", "db.sqlite");
 export const exists = checkFileExists(location);
@@ -19,7 +20,7 @@ function createDb() {
             : undefined;
     const sqlite = new Database(location, { verbose });
 
-    if (process.env.ENABLE_SQLITE_WAL_MODE == "true") {
+    if (readEnvOrFile("ENABLE_SQLITE_WAL_MODE") == "true") {
         // Enable WAL mode — allows concurrent readers + single writer, preventing
         // contention across subsystems (verifySession, Traefik, audit, ping).
         // NOTE: journal_mode persists in the DB file once set; unsetting this

server/emails/templates/EnterpriseEditionKeyGenerated.tsx

@@ -93,9 +93,8 @@ export const EnterpriseEditionKeyGenerated = ({
                         </EmailSection>
 
                         <EmailText>
-                            If you need to purchase additional license keys or
+                            For any questions or concerns regarding your license
-                            modify your existing license, please reach out to
+                            or billing, please reach out to support at{" "}
-                            our support team at{" "}
                             <a
                                 href="mailto:support@pangolin.net"
                                 className="text-primary font-medium"

server/lib/backupFileName.test.ts

@@ -0,0 +1,101 @@
+import { formatBackupTimestamp } from "./backupFileName";
+import { assertEquals } from "@test/assert";
+
+// Local-time constructors are used throughout, matching formatBackupTimestamp,
+// so these cases do not depend on the machine's timezone.
+
+function testMonthIsOneIndexed() {
+    console.log("Running month indexing tests...");
+
+    // The case from the report: a backup taken on 12 September 2026 was named
+    // db_2026-8-12_... because Date#getMonth is zero-indexed.
+    {
+        const result = formatBackupTimestamp(new Date(2026, 8, 12, 20, 35, 56));
+        assertEquals(
+            result,
+            "2026-09-12_20-35-56",
+            "September must render as 09, not 8"
+        );
+    }
+
+    // The other reported name, db_2026-0-23_..., was a January backup.
+    {
+        const result = formatBackupTimestamp(new Date(2026, 0, 23, 20, 25, 49));
+        assertEquals(
+            result,
+            "2026-01-23_20-25-49",
+            "January must render as 01, not 0"
+        );
+    }
+
+    {
+        const result = formatBackupTimestamp(new Date(2026, 11, 31, 23, 59, 59));
+        assertEquals(
+            result,
+            "2026-12-31_23-59-59",
+            "December must render as 12"
+        );
+    }
+}
+
+function testEveryFieldIsZeroPadded() {
+    console.log("Running zero padding tests...");
+
+    // db_2026-8-12_20-36-2 in the report: a single-digit second was not padded.
+    {
+        const result = formatBackupTimestamp(new Date(2026, 8, 12, 20, 36, 2));
+        assertEquals(
+            result,
+            "2026-09-12_20-36-02",
+            "Single-digit seconds must be padded"
+        );
+    }
+
+    {
+        const result = formatBackupTimestamp(new Date(2026, 0, 1, 0, 0, 0));
+        assertEquals(
+            result,
+            "2026-01-01_00-00-00",
+            "Midnight on the first of the month must pad every field"
+        );
+    }
+}
+
+function testNamesSortChronologically() {
+    console.log("Running sort order tests...");
+
+    // Zero padding means a plain lexicographic sort of the backups directory
+    // lists the backups in the order they were taken.
+    const taken = [
+        new Date(2026, 8, 12, 20, 36, 2),
+        new Date(2026, 0, 23, 20, 25, 49),
+        new Date(2026, 8, 12, 20, 35, 56),
+        new Date(2026, 11, 31, 23, 59, 59)
+    ];
+
+    const sorted = taken
+        .map((date) => formatBackupTimestamp(date))
+        .sort();
+
+    assertEquals(
+        sorted.join(","),
+        [
+            "2026-01-23_20-25-49",
+            "2026-09-12_20-35-56",
+            "2026-09-12_20-36-02",
+            "2026-12-31_23-59-59"
+        ].join(","),
+        "Backup names must sort into the order the backups were taken"
+    );
+}
+
+// Run all tests
+try {
+    testMonthIsOneIndexed();
+    testEveryFieldIsZeroPadded();
+    testNamesSortChronologically();
+    console.log("All tests passed successfully!");
+} catch (error) {
+    console.error("Test failed:", error);
+    process.exit(1);
+}

server/lib/backupFileName.ts

@@ -0,0 +1,28 @@
+/**
+ * Builds the timestamp segment of a database backup file name.
+ *
+ * `Date#getMonth` is zero-indexed, so building this inline produced names like
+ * `db_2026-8-12_...` for a backup taken on 12 September 2026. Every field is
+ * also zero-padded, which keeps the names unambiguous and makes them sort
+ * lexicographically in the order they were taken.
+ *
+ * @param date The moment the backup is being taken. Defaults to now.
+ * @returns A timestamp of the form `YYYY-MM-DD_HH-MM-SS`.
+ */
+export function formatBackupTimestamp(date: Date = new Date()): string {
+    const pad = (value: number): string => String(value).padStart(2, "0");
+
+    const datePart = [
+        date.getFullYear(),
+        pad(date.getMonth() + 1),
+        pad(date.getDate())
+    ].join("-");
+
+    const timePart = [
+        pad(date.getHours()),
+        pad(date.getMinutes()),
+        pad(date.getSeconds())
+    ].join("-");
+
+    return `${datePart}_${timePart}`;
+}

server/lib/billing/licenses.ts

@@ -1,6 +1,6 @@
 export enum LicenseId {
-    SMALL_LICENSE = "small_license",
+    TIER1 = "tier1",
-    BIG_LICENSE = "big_license"
+    TIER2 = "tier2"
 }
 
 export type LicensePriceSet = {
@@ -9,15 +9,15 @@ export type LicensePriceSet = {
 
 export const licensePriceSet: LicensePriceSet = {
     // Free license matches the freeLimitSet
-    [LicenseId.SMALL_LICENSE]: "price_1TMJzmD3Ee2Ir7Wm05NlGImT",
+    [LicenseId.TIER1]: "price_1TMJzmD3Ee2Ir7Wm05NlGImT",
-    [LicenseId.BIG_LICENSE]: "price_1TMJzzD3Ee2Ir7WmzJw9TerS"
+    [LicenseId.TIER2]: "price_1TMJzzD3Ee2Ir7WmzJw9TerS"
 };
 
 export const licensePriceSetSandbox: LicensePriceSet = {
     // Free license matches the freeLimitSet
     // when matching license the keys closer to 0 index are matched first so list the licenses in descending order of value
-    [LicenseId.SMALL_LICENSE]: "price_1SxDwuDCpkOb237Bz0yTiOgN",
+    [LicenseId.TIER1]: "price_1SxDwuDCpkOb237Bz0yTiOgN",
-    [LicenseId.BIG_LICENSE]: "price_1SxDy0DCpkOb237BWJxrxYkl"
+    [LicenseId.TIER2]: "price_1SxDy0DCpkOb237BWJxrxYkl"
 };
 
 export function getLicensePriceSet(

server/lib/getEnvOrYaml.ts

@@ -1,3 +1,37 @@
-export const getEnvOrYaml = (envVar: string) => (valFromYaml: any) => {
+import fs from "fs";
-    return process.env[envVar] ?? valFromYaml;
+
+// Resolves an environment variable, also honoring a `<envVar>_FILE` variant
+// that points to a file whose (trimmed) contents should be used as the
+// value. This is the common convention for consuming Docker/Swarm secrets
+// (e.g. mounted at /run/secrets/...) without putting the raw value in the
+// container's environment.
+export const readEnvOrFile = (envVar: string): string | undefined => {
+    const fileEnvVar = `${envVar}_FILE`;
+    const filePath = process.env[fileEnvVar];
+
+    if (filePath) {
+        if (process.env[envVar]) {
+            throw new Error(
+                `Both ${envVar} and ${fileEnvVar} are set. Please set only one.`
+            );
+        }
+
+        try {
+            return fs.readFileSync(filePath, "utf8").trim();
+        } catch (error) {
+            throw new Error(
+                `Failed to read ${fileEnvVar} (${filePath}): ${
+                    error instanceof Error ? error.message : error
+                }`
+            );
+        }
+    }
+
+    return process.env[envVar];
 };
+
+export const getEnvOrYaml =
+    (envVar: string) =>
+    (valFromYaml: string | undefined): string | undefined => {
+        return readEnvOrFile(envVar) ?? valFromYaml;
+    };

server/lib/readConfigFile.ts

@@ -3,7 +3,7 @@ import * as yaml from "js-yaml";
 import { configFilePath1, configFilePath2 } from "./consts";
 import { z } from "zod";
 import stoi from "./stoi";
-import { getEnvOrYaml } from "./getEnvOrYaml";
+import { getEnvOrYaml, readEnvOrFile } from "./getEnvOrYaml";
 
 const portSchema = z.number().positive().gt(0).lte(65535);
 
@@ -26,14 +26,12 @@ export const configSchema = z
                     .object({
                         anonymous_usage: z.boolean().optional().default(true)
                     })
-                    .optional()
                     .prefault({}),
                 notifications: z
                     .object({
                         product_updates: z.boolean().optional().default(true),
                         new_releases: z.boolean().optional().default(true)
                     })
-                    .optional()
                     .prefault({})
             })
             .optional()
@@ -109,7 +107,6 @@ export const configSchema = z
                         id: z.string().optional().default("P-Access-Token-Id"),
                         token: z.string().optional().default("P-Access-Token")
                     })
-                    .optional()
                     .prefault({}),
                 remote_headers: z
                     .object({
@@ -126,7 +123,6 @@ export const configSchema = z
                         name: z.string().optional().default("Remote-Name"),
                         role: z.string().optional().default("Remote-Role")
                     })
-                    .optional()
                     .prefault({}),
                 resource_session_request_param: z
                     .string()
@@ -164,14 +160,17 @@ export const configSchema = z
                     .boolean()
                     .optional()
                     .default(false)
-                    .transform((val) =>
+                    .transform((val) => {
-                        process.env.ENABLE_AI_GATEWAY_CLIENT_IP_HEADER !==
+                        const envVal = readEnvOrFile(
-                        undefined
+                            "ENABLE_AI_GATEWAY_CLIENT_IP_HEADER"
-                            ? process.env.ENABLE_AI_GATEWAY_CLIENT_IP_HEADER ===
+                        );
-                              "true"
+                        return envVal !== undefined ? envVal === "true" : val;
-                            : val
+                    }),
-                    ),
+                secret: z
-                secret: z.string().pipe(z.string().min(8)).optional(),
+                    .string()
+                    .pipe(z.string().min(8))
+                    .optional()
+                    .transform(getEnvOrYaml("SERVER_SECRET")),
                 maxmind_db_path: z.string().optional(),
                 maxmind_asn_path: z.string().optional()
             })
@@ -202,7 +201,8 @@ export const configSchema = z
                 dashboard_session_length_hours: 720,
                 resource_session_length_hours: 720,
                 trust_proxy: 1,
-                enable_ai_gateway_client_ip_header: false
+                enable_ai_gateway_client_ip_header: false,
+                secret: undefined
             }),
         postgres: z
             .object({
@@ -238,7 +238,6 @@ export const configSchema = z
                             .default(5000),
                         jit_mode: z.boolean().default(true)
                     })
-                    .optional()
                     .prefault({})
             })
             .optional(),
@@ -278,7 +277,6 @@ export const configSchema = z
                             .optional()
                             .default(5000)
                     })
-                    .optional()
                     .prefault({})
             })
             .optional(),
@@ -325,10 +323,8 @@ export const configSchema = z
                             .optional()
                             .default(50)
                     })
-                    .optional()
                     .prefault({})
             })
-            .optional()
             .prefault({}),
         gerbil: z
             .object({
@@ -357,7 +353,6 @@ export const configSchema = z
                     .optional()
                     .default(30)
             })
-            .optional()
             .prefault({}),
         orgs: z
             .object({
@@ -391,7 +386,6 @@ export const configSchema = z
                             .optional()
                             .default(500)
                     })
-                    .optional()
                     .prefault({}),
                 auth: z
                     .object({
@@ -408,10 +402,8 @@ export const configSchema = z
                             .optional()
                             .default(500)
                     })
-                    .optional()
                     .prefault({})
             })
-            .optional()
             .prefault({}),
         email: z
             .object({
@@ -489,10 +481,8 @@ export const configSchema = z
                             .optional()
                             .default(12)
                     })
-                    .optional()
                     .prefault({})
             })
-            .optional()
             .prefault({})
     })
     .refine(
@@ -513,10 +503,7 @@ export const configSchema = z
     )
     .refine(
         (data) => {
-            // If hybrid is not defined, server secret must be defined. If its not defined already then pull it from env
+            // If hybrid is not defined, server secret must be defined
-            if (data.server?.secret === undefined) {
-                data.server.secret = process.env.SERVER_SECRET;
-            }
             return (
                 data.server?.secret !== undefined &&
                 data.server.secret.length > 0

server/lib/traefik/TraefikConfigManager.ts

@@ -14,6 +14,7 @@ import { getTraefikConfig } from "#dynamic/lib/traefik";
 import { getValidCertificatesForDomains } from "@server/lib/certificates";
 import { sendToExitNode } from "#dynamic/lib/exitNodes";
 import { build } from "@server/build";
+import license from "#dynamic/license/license";
 
 export class TraefikConfigManager {
     private intervalId: NodeJS.Timeout | null = null;
@@ -357,7 +358,11 @@ export class TraefikConfigManager {
                 this.lastActiveDomains = new Set(domains);
             }
 
-            if (process.env.CERT_MODE === "pangolin" && build != "oss") {
+            if (
+                process.env.CERT_MODE === "pangolin" &&
+                build != "oss" &&
+                (await license.hasTier(["personal", "tier2", "enterprise"]))
+            ) {
                 // Scan current local certificate state
                 this.lastLocalCertificateState =
                     await this.scanLocalCertificateState();
@@ -717,10 +722,9 @@ export class TraefikConfigManager {
         }
         if (shouldWrite) {
             try {
-                fs.writeFileSync(
+                this.atomicWriteFileSync(
                     traefikDynamicConfigPath,
-                    yaml.dump(traefikConfig, { noRefs: true }),
+                    yaml.dump(traefikConfig, { noRefs: true })
-                    "utf8"
                 );
                 logger.info("Traefik dynamic config updated");
             } catch (err) {
@@ -822,7 +826,7 @@ export class TraefikConfigManager {
         // Only write the config if it has changed
         const newConfigYaml = yaml.dump(dynamicConfig, { noRefs: true });
         if (newConfigYaml !== originalConfigYaml) {
-            fs.writeFileSync(dynamicConfigPath, newConfigYaml, "utf8");
+            this.atomicWriteFileSync(dynamicConfigPath, newConfigYaml);
             logger.info("Dynamic cert config updated from local certificates");
         }
     }
@@ -900,26 +904,23 @@ export class TraefikConfigManager {
                         `Processing certificate for domain: ${cert.domain}`
                     );
 
-                    fs.writeFileSync(certPath, cert.certFile, "utf8");
+                    // Write atomically (temp file + rename) so Traefik's
-                    fs.writeFileSync(keyPath, cert.keyFile, "utf8");
+                    // file watcher never observes a partially written
-
+                    // cert/key and fails with "failed to find any PEM data".
-                    // Set appropriate permissions (readable by owner only for key file)
+                    this.atomicWriteFileSync(certPath, cert.certFile, 0o644);
-                    fs.chmodSync(certPath, 0o644);
+                    this.atomicWriteFileSync(keyPath, cert.keyFile, 0o600);
-                    fs.chmodSync(keyPath, 0o600);
 
                     // Write/update .last_update file with current timestamp
-                    fs.writeFileSync(
+                    this.atomicWriteFileSync(
                         lastUpdatePath,
-                        new Date().toISOString(),
+                        new Date().toISOString()
-                        "utf8"
                     );
 
                     // Check if this is a wildcard certificate and store it
                     const wildcardPath = path.join(domainDir, ".wildcard");
-                    fs.writeFileSync(
+                    this.atomicWriteFileSync(
                         wildcardPath,
-                        cert.wildcard ? "true" : "false",
+                        cert.wildcard ? "true" : "false"
-                        "utf8"
                     );
 
                     logger.info(
@@ -931,10 +932,9 @@ export class TraefikConfigManager {
                 // even if the cert content didn't change
                 if (cert.expiresAt) {
                     const expiresAtPath = path.join(domainDir, ".expires_at");
-                    fs.writeFileSync(
+                    this.atomicWriteFileSync(
                         expiresAtPath,
-                        cert.expiresAt.toString(),
+                        cert.expiresAt.toString()
-                        "utf8"
                     );
                 }
 
@@ -970,7 +970,7 @@ export class TraefikConfigManager {
         // Only write the config if it has changed
         const newConfigYaml = yaml.dump(dynamicConfig, { noRefs: true });
         if (newConfigYaml !== originalConfigYaml) {
-            fs.writeFileSync(dynamicConfigPath, newConfigYaml, "utf8");
+            this.atomicWriteFileSync(dynamicConfigPath, newConfigYaml);
             logger.info("Dynamic cert config updated");
         }
     }
@@ -1141,10 +1141,9 @@ export class TraefikConfigManager {
 
             if (configChanged) {
                 try {
-                    fs.writeFileSync(
+                    this.atomicWriteFileSync(
                         dynamicConfigPath,
-                        yaml.dump(dynamicConfig, { noRefs: true }),
+                        yaml.dump(dynamicConfig, { noRefs: true })
-                        "utf8"
                     );
                     logger.info("Dynamic config updated after cleanup");
                 } catch (err) {
@@ -1171,6 +1170,36 @@ export class TraefikConfigManager {
         }
     }
 
+    /**
+     * Write a file atomically by writing to a temp file in the same
+     * directory and renaming it into place. This avoids Traefik (which
+     * watches these files/directories) picking up a partially written
+     * file and failing to parse it (e.g. "failed to find any PEM data").
+     */
+    private atomicWriteFileSync(
+        filePath: string,
+        data: string,
+        mode?: number
+    ): void {
+        const dir = path.dirname(filePath);
+        const tmpPath = path.join(
+            dir,
+            `.${path.basename(filePath)}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2)}`
+        );
+        try {
+            fs.writeFileSync(tmpPath, data, "utf8");
+            if (mode !== undefined) {
+                fs.chmodSync(tmpPath, mode);
+            }
+            fs.renameSync(tmpPath, filePath);
+        } catch (error) {
+            try {
+                fs.rmSync(tmpPath, { force: true });
+            } catch {}
+            throw error;
+        }
+    }
+
     /**
      * Check if file exists
      */

server/license/license.ts

@@ -4,7 +4,7 @@ import { setHostMeta } from "@server/lib/hostMeta";
 const keyTypes = ["host"] as const;
 export type LicenseKeyType = (typeof keyTypes)[number];
 
-const keyTiers = ["personal", "enterprise"] as const;
+const keyTiers = ["personal", "enterprise", "tier1", "tier2"] as const;
 export type LicenseKeyTier = (typeof keyTiers)[number];
 
 export type LicenseStatus = {
@@ -33,7 +33,7 @@ export type LicenseKeyCache = {
 export class License {
     private serverSecret!: string;
 
-    constructor(private hostMeta: HostMeta) { }
+    constructor(private hostMeta: HostMeta) {}
 
     public async check(): Promise<LicenseStatus> {
         return {
@@ -50,6 +50,10 @@ export class License {
     public async isUnlocked() {
         return false;
     }
+
+    public async hasTier(tier: LicenseKeyTier[]) {
+        return false;
+    }
 }
 
 await setHostMeta();

server/private/lib/certificates/scheduler.ts

@@ -45,9 +45,9 @@ export class JobScheduler {
         label: string
     ): () => Promise<void> {
         return async () => {
-            if (!(await license.isUnlocked())) {
+            if (!(await license.hasTier(["personal", "tier2", "enterprise"]))) {
                 logger.debug(
-                    `Skipping ${label} tick - license is not subscribed`
+                    `Skipping ${label} tick - requires a tier2 license`
                 );
                 return;
             }

server/private/lib/dns/server.ts

@@ -63,10 +63,11 @@ export class AuthoritativeDNSServer {
     private allDomains: Set<string> = new Set();
     private domainRefreshInterval: NodeJS.Timeout | null = null;
 
-    // Cached license/subscription status. license.isUnlocked() does a DB
+    // Cached license/plan status - only a tier2 license unlocks the DNS
-    // round-trip on every call, so it can't be checked per-query on a UDP
+    // server. license.hasPlan() does a DB round-trip on every call, so it
-    // server that may see very high query volume - instead it's polled on
+    // can't be checked per-query on a UDP server that may see very high
-    // the same cadence as the domain set refresh and read from memory here.
+    // query volume - instead it's polled on the same cadence as the domain
+    // set refresh and read from memory here.
     private isLicensed: boolean = false;
     private licenseRefreshInterval: NodeJS.Timeout | null = null;
 
@@ -128,7 +129,7 @@ export class AuthoritativeDNSServer {
         }
 
         if (!this.isLicensed) {
-            logger.debug("Refusing DNS query - license is not subscribed");
+            logger.debug("Refusing DNS query - requires a tier2 license");
             // REFUSED (rcode=5) indicates a policy refusal by this nameserver.
             this.sendResponse(packet, [], rinfo, false, 5, []);
             return;
@@ -1042,7 +1043,11 @@ export class AuthoritativeDNSServer {
 
     private async refreshLicenseStatus(): Promise<void> {
         try {
-            this.isLicensed = await license.isUnlocked();
+            this.isLicensed = await license.hasTier([
+                "personal",
+                "tier2",
+                "enterprise"
+            ]);
         } catch (error) {
             logger.error("Failed to refresh license status:", error);
             this.isLicensed = false;

server/private/lib/readConfigFile.ts

@@ -48,7 +48,6 @@ export const privateConfigSchema = z
                     .optional()
                     .transform(getEnvOrYaml("FOSSORIAL_API_KEY"))
             })
-            .optional()
             .prefault({}),
         redis: z
             .object({
@@ -166,7 +165,6 @@ export const privateConfigSchema = z
                     .optional()
                     .default("http://gerbil:3004")
             })
-            .optional()
             .prefault({}),
         flags: z
             .object({
@@ -187,7 +185,6 @@ export const privateConfigSchema = z
                 // (server/private/lib/config.ts).
                 disable_private_http_placeholder: z.boolean().optional()
             })
-            .optional()
             .prefault({}),
         acme: z
             .object({

server/private/lib/traefik/getTraefikConfig.ts

@@ -54,6 +54,7 @@ import {
     getValidCertificatesForDomains
 } from "@server/lib/certificates";
 import { build } from "@server/build";
+import license from "#private/license/license";
 import regionalCache from "#private/lib/cache";
 import { TargetWithSite } from "@server/lib/traefik/types";
 import { buildWildcardTls } from "@server/lib/traefik/certResolver";
@@ -395,8 +396,15 @@ export async function getTraefikConfig(
             )
         );
 
+    // Pangolin-managed DNS-01/ACME cert mode requires either a tier1
+    // license (self-hosted) or a saas build - otherwise fall back to
+    // Traefik's own cert resolvers (buildWildcardTls) throughout.
+    const pangolinCertModeEnabled =
+        privateConfig.getRawPrivateConfig().acme?.cert_mode == "pangolin" &&
+        (await license.hasTier(["personal", "tier2", "enterprise"]));
+
     let validCerts: CertificateResult[] = [];
-    if (privateConfig.getRawPrivateConfig().acme?.cert_mode == "pangolin") {
+    if (pangolinCertModeEnabled) {
         // create a list of all domains to get certs for
         const domains = new Set<string>();
         for (const resource of resourcesMap.values()) {
@@ -522,10 +530,7 @@ export async function getTraefikConfig(
             );
 
             let tls = {};
-            if (
+            if (!pangolinCertModeEnabled) {
-                privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                "pangolin"
-            ) {
                 tls = buildWildcardTls({
                     fullDomain,
                     hasSubdomain: !!resource.subdomain,
@@ -546,6 +551,30 @@ export async function getTraefikConfig(
                 }
             }
 
+            config_output.http.services![serviceName] = {
+                loadBalancer: {
+                    servers: buildHttpLoadBalancerServers(targets),
+                    ...(resource.stickySession
+                        ? buildStickySessionCookie(resource.ssl)
+                        : {})
+                }
+            };
+
+            if (resource.tlsServerName) {
+                if (!config_output.http.serversTransports) {
+                    config_output.http.serversTransports = {};
+                }
+                config_output.http.serversTransports![transportName] = {
+                    serverName: resource.tlsServerName,
+                    //unfortunately the following needs to be set. traefik doesn't merge the default serverTransport settings
+                    // if defined in the static config and here. if not set, self-signed certs won't work
+                    insecureSkipVerify: true
+                };
+                config_output.http.services![
+                    serviceName
+                ].loadBalancer.serversTransport = transportName;
+            }
+
             if (resource.ssl) {
                 config_output.http.routers![routerName + "-redirect"] = {
                     entryPoints: [
@@ -710,31 +739,6 @@ export async function getTraefikConfig(
                 priority: priority,
                 ...(resource.ssl ? { tls } : {})
             };
-
-            config_output.http.services![serviceName] = {
-                loadBalancer: {
-                    servers: buildHttpLoadBalancerServers(targets),
-                    ...(resource.stickySession
-                        ? buildStickySessionCookie(resource.ssl)
-                        : {})
-                }
-            };
-
-            // Add the serversTransport if TLS server name is provided
-            if (resource.tlsServerName) {
-                if (!config_output.http.serversTransports) {
-                    config_output.http.serversTransports = {};
-                }
-                config_output.http.serversTransports![transportName] = {
-                    serverName: resource.tlsServerName,
-                    //unfortunately the following needs to be set. traefik doesn't merge the default serverTransport settings
-                    // if defined in the static config and here. if not set, self-signed certs won't work
-                    insecureSkipVerify: true
-                };
-                config_output.http.services![
-                    serviceName
-                ].loadBalancer.serversTransport = transportName;
-            }
         } else if (resource.mode == "tcp" || resource.mode == "udp") {
             // Non-HTTP (TCP/UDP) configuration
             if (!resource.enableProxy) {
@@ -791,10 +795,7 @@ export async function getTraefikConfig(
                 domainCertResolver,
                 preferWildcardCert
             }) => {
-                if (
+                if (!pangolinCertModeEnabled) {
-                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                    "pangolin"
-                ) {
                     return buildWildcardTls({
                         fullDomain,
                         hasSubdomain,
@@ -835,10 +836,7 @@ export async function getTraefikConfig(
             maintenancePageUiUrl,
             redirectHttpsMiddlewareName,
             resolveTls: (fullDomain) => {
-                if (
+                if (!pangolinCertModeEnabled) {
-                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                    "pangolin"
-                ) {
                     // siteResource aliases don't have a per-domain cert
                     // resolver stored, so always fall back to the global
                     // defaults.
@@ -929,10 +927,7 @@ export async function getTraefikConfig(
             const rule = buildHostRule(fullDomain, ir.wildcard);
 
             let tls: any = {};
-            if (
+            if (!pangolinCertModeEnabled) {
-                privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                "pangolin"
-            ) {
                 tls = buildWildcardTls({
                     fullDomain,
                     hasSubdomain: !!ir.subdomain,
@@ -1012,10 +1007,7 @@ export async function getTraefikConfig(
                 const rule = `Host(\`${fullDomain}\`) && ClientIP(\`${exitNode.address}\`)`; // restrict to coming from the exit node ip range that the client is connected to
 
                 let tls: any = {};
-                if (
+                if (!pangolinCertModeEnabled) {
-                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                    "pangolin"
-                ) {
                     // siteResource aliases don't have a per-domain cert
                     // resolver stored, so always fall back to the global
                     // defaults.
@@ -1089,7 +1081,7 @@ export async function getTraefikConfig(
             .where(eq(exitNodes.exitNodeId, exitNodeId));
 
         let validCertsLoginPages: CertificateResult[] = [];
-        if (privateConfig.getRawPrivateConfig().acme?.cert_mode == "pangolin") {
+        if (pangolinCertModeEnabled) {
             // create a list of all domains to get certs for
             const domains = new Set<string>();
             for (const lp of exitNodeLoginPages) {
@@ -1134,10 +1126,7 @@ export async function getTraefikConfig(
                 }
 
                 const tls = {};
-                if (
+                if (!pangolinCertModeEnabled) {
-                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                    "pangolin"
-                ) {
                     // TODO: we need to add the wildcard logic here too
                 } else {
                     // find a cert that matches the full domain, if not continue

server/private/license/license.ts

@@ -26,6 +26,7 @@ import {
     LicenseStatus
 } from "@server/license/license";
 import { setHostMeta } from "@server/lib/hostMeta";
+import { build } from "@server/build";
 
 type ActivateLicenseKeyAPIResponse = {
     data: {
@@ -119,6 +120,9 @@ LQIDAQAB
     }
 
     public async isUnlocked(): Promise<boolean> {
+        if (build == "saas") {
+            return true;
+        }
         const status = await this.check();
         if (status.isHostLicensed) {
             if (status.isLicenseValid) {
@@ -128,6 +132,20 @@ LQIDAQAB
         return false;
     }
 
+    public async hasTier(tier: LicenseKeyTier[]): Promise<boolean> {
+        if (build == "saas") {
+            return true;
+        }
+        const status = await this.check();
+        if (status.isHostLicensed && status.isLicenseValid) {
+            return (
+                status.tier !== undefined &&
+                tier.includes(status.tier as LicenseKeyTier)
+            );
+        }
+        return false;
+    }
+
     public async check(): Promise<LicenseStatus> {
         // If a check is already in progress, return the last known status
         if (this.checkInProgress) {
@@ -135,8 +153,7 @@ LQIDAQAB
                 "License check already in progress, returning last known status"
             );
             const lastStatus = this.statusCache.get(this.statusKey) as
-                | LicenseStatus
+                LicenseStatus | undefined;
-                | undefined;
             if (lastStatus) {
                 return lastStatus;
             }

server/private/routers/auditLogs/queryAccessAuditLog.ts

@@ -54,7 +54,6 @@ export const queryAccessAuditLogsQuery = z.object({
             error: "timeEnd must be a valid ISO date string"
         })
         .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
         .prefault(() => new Date().toISOString())
         .openapi({
             type: "string",

server/private/routers/auditLogs/queryActionAuditLog.ts

@@ -47,7 +47,6 @@ export const queryActionAuditLogsQuery = z.object({
             error: "timeEnd must be a valid ISO date string"
         })
         .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
         .prefault(() => new Date().toISOString())
         .openapi({
             type: "string",

server/private/routers/auditLogs/queryConnectionAuditLog.ts

@@ -55,7 +55,6 @@ export const queryConnectionAuditLogsQuery = z.object({
             error: "timeEnd must be a valid ISO date string"
         })
         .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
         .prefault(() => new Date().toISOString())
         .openapi({
             type: "string",

server/private/routers/billing/hooks/handleSubscriptionCreated.ts

@@ -222,15 +222,16 @@ export async function handleSubscriptionCreated(
 
                 let numUsers: number;
                 let numSites: number;
+                let tier = "enterprise";
 
-                if (subscriptionPriceId === priceSet[LicenseId.SMALL_LICENSE]) {
+                if (subscriptionPriceId === priceSet[LicenseId.TIER1]) {
                     numUsers = 25;
                     numSites = 25;
-                } else if (
+                    tier = "tier1";
-                    subscriptionPriceId === priceSet[LicenseId.BIG_LICENSE]
+                } else if (subscriptionPriceId === priceSet[LicenseId.TIER2]) {
-                ) {
                     numUsers = 50;
                     numSites = 100;
+                    tier = "tier2";
                 } else {
                     logger.error(
                         `Unknown price ID ${subscriptionPriceId} for subscription ${subscription.id}`
@@ -242,6 +243,14 @@ export async function handleSubscriptionCreated(
                     `License type determined: ${numUsers} users, ${numSites} sites for subscription ${subscription.id}`
                 );
 
+                // Grace period of 5 days added on top of the current billing
+                // period end (usually ~1 year out) before the license expires
+                const currentPeriodEnd =
+                    fullSubscription.items.data[0]?.current_period_end;
+                const expiresAt =
+                    (currentPeriodEnd ?? subscription.created) +
+                    5 * 24 * 60 * 60;
+
                 const response = await fetch(
                     `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/paid-for`,
                     {
@@ -256,7 +265,9 @@ export async function handleSubscriptionCreated(
                             licenseId: parseInt(licenseId),
                             paidFor: true,
                             users: numUsers,
-                            sites: numSites
+                            sites: numSites,
+                            tier: tier,
+                            expiresAt: expiresAt
                         })
                     }
                 );
@@ -265,6 +276,13 @@ export async function handleSubscriptionCreated(
 
                 logger.debug(`Fossorial API response: ${JSON.stringify(data)}`);
 
+                if (!response.ok || !data.success) {
+                    logger.error(
+                        `Fossorial API returned ${response.status} when setting paid-for for orgId ${customer.orgId} and subscription ID ${subscription.id}: ${JSON.stringify(data)}`
+                    );
+                    return;
+                }
+
                 if (customer.email) {
                     logger.debug(
                         `Sending license key email to ${customer.email} for subscription ${subscription.id}`

server/private/routers/billing/hooks/handleSubscriptionDeleted.ts

@@ -125,9 +125,7 @@ export async function handleSubscriptionDeleted(
                 `Handling license subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}`
             );
             try {
-                // WARNING:
+                const invalidateResponse = await fetch(
-                // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId
-                await fetch(
                     `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/invalidate`,
                     {
                         method: "POST",
@@ -139,9 +137,18 @@ export async function handleSubscriptionDeleted(
                         },
                         body: JSON.stringify({
                             orgId: customer.orgId,
+                            licenseKeyId: parseInt(
+                                subscription.metadata.licenseKeyId
+                            )
                         })
                     }
                 );
+
+                if (!invalidateResponse.ok) {
+                    logger.error(
+                        `Fossorial API returned ${invalidateResponse.status} when invalidating license for orgId ${customer.orgId} and subscription ID ${subscription.id}: ${await invalidateResponse.text()}`
+                    );
+                }
             } catch (error) {
                 logger.error(
                     `Error notifying Fossorial API of license subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}:`,

server/private/routers/billing/hooks/handleSubscriptionUpdated.ts

@@ -23,7 +23,10 @@ import {
 } from "@server/db";
 import { eq, and } from "drizzle-orm";
 import logger from "@server/logger";
-import { getFeatureIdByMetricId, getFeatureIdByPriceId } from "@server/lib/billing/features";
+import {
+    getFeatureIdByMetricId,
+    getFeatureIdByPriceId
+} from "@server/lib/billing/features";
 import stripe from "#private/lib/stripe";
 import { handleSubscriptionLifesycle } from "../subscriptionLifecycle";
 import { getSubType, SubscriptionType } from "./getSubType";
@@ -66,7 +69,8 @@ export async function handleSubscriptionUpdated(
             .limit(1);
 
         const type = getSubType(fullSubscription);
-        const previousType = existingSubscription.type as SubscriptionType | null;
+        const previousType =
+            existingSubscription.type as SubscriptionType | null;
 
         // If the subscription has been manually overridden, we lock the
         // status down so Stripe webhooks can no longer change it.
@@ -100,7 +104,11 @@ export async function handleSubscriptionUpdated(
             logger.info(
                 `Tier change detected for org ${customer.orgId}: ${previousType} -> ${type}`
             );
-            await handleTierChange(customer.orgId, type, previousType ?? undefined);
+            await handleTierChange(
+                customer.orgId,
+                type,
+                previousType ?? undefined
+            );
         }
 
         // Upsert subscription items
@@ -113,7 +121,8 @@ export async function handleSubscriptionUpdated(
 
             const itemsToUpsert = fullSubscription.items.data.map((item) => {
                 // Try to get featureId from price
-                let featureId: string | null = getFeatureIdByPriceId(item.price.id) || null;
+                let featureId: string | null =
+                    getFeatureIdByPriceId(item.price.id) || null;
 
                 // If no match, try to preserve existing featureId
                 if (!featureId) {
@@ -302,14 +311,20 @@ export async function handleSubscriptionUpdated(
                     logger.info(
                         `Subscription ${subscription.id} for org ${customer.orgId} is ${effectiveStatus}, disabling paid features`
                     );
-                    await handleTierChange(customer.orgId, null, previousType ?? undefined);
+                    await handleTierChange(
+                        customer.orgId,
+                        null,
+                        previousType ?? undefined
+                    );
                 }
             } else if (type === "license") {
-                if (effectiveStatus === "canceled" || effectiveStatus == "unpaid" || effectiveStatus == "incomplete_expired") {
+                if (
+                    effectiveStatus === "canceled" ||
+                    effectiveStatus == "unpaid" ||
+                    effectiveStatus == "incomplete_expired"
+                ) {
                     try {
-                        // WARNING:
+                        const invalidateResponse = await fetch(
-                        // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId
-                        await fetch(
                             `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/invalidate`,
                             {
                                 method: "POST",
@@ -320,16 +335,95 @@ export async function handleSubscriptionUpdated(
                                     "Content-Type": "application/json"
                                 },
                                 body: JSON.stringify({
-                                    orgId: customer.orgId
+                                    orgId: customer.orgId,
+                                    licenseKeyId: parseInt(
+                                        subscription.metadata.licenseKeyId
+                                    )
                                 })
                             }
                         );
+
+                        if (!invalidateResponse.ok) {
+                            logger.error(
+                                `Fossorial API returned ${invalidateResponse.status} when invalidating license for orgId ${customer.orgId} and subscription ID ${subscription.id}: ${await invalidateResponse.text()}`
+                            );
+                        }
                     } catch (error) {
                         logger.error(
                             `Error notifying Fossorial API of license subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}:`,
                             error
                         );
                     }
+                } else if (effectiveStatus === "active" && previousAttributes) {
+                    // Detect a successful renewal: the billing period rolled
+                    // forward (the invoice was paid and the new period began
+                    // right where the previous one ended).
+                    const currentItem = fullSubscription.items.data[0];
+                    const prevItems = previousAttributes.items?.data;
+                    const prevItem = Array.isArray(prevItems)
+                        ? prevItems.find(
+                              (pi: any) => pi.id === currentItem?.id
+                          )
+                        : undefined;
+
+                    const renewed =
+                        currentItem &&
+                        prevItem?.current_period_end &&
+                        currentItem.current_period_start ===
+                            prevItem.current_period_end &&
+                        currentItem.current_period_start >
+                            prevItem.current_period_start;
+
+                    if (renewed) {
+                        const licenseKeyId =
+                            subscription.metadata.licenseKeyId;
+
+                        if (!licenseKeyId) {
+                            logger.error(
+                                `No licenseKeyId in metadata for subscription ${subscription.id}, cannot extend license.`
+                            );
+                        } else {
+                            // Grace period of 5 days added on top of the new
+                            // billing period end (usually ~1 year out)
+                            const expiresAt =
+                                currentItem.current_period_end +
+                                5 * 24 * 60 * 60;
+
+                            try {
+                                const extendResponse = await fetch(
+                                    `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/extend`,
+                                    {
+                                        method: "POST",
+                                        headers: {
+                                            "api-key":
+                                                privateConfig.getRawPrivateConfig()
+                                                    .server.fossorial_api_key!,
+                                            "Content-Type": "application/json"
+                                        },
+                                        body: JSON.stringify({
+                                            licenseId: parseInt(licenseKeyId),
+                                            expiresAt: expiresAt
+                                        })
+                                    }
+                                );
+
+                                if (!extendResponse.ok) {
+                                    logger.error(
+                                        `Fossorial API returned ${extendResponse.status} when extending license ${licenseKeyId} for subscription ${subscription.id}: ${await extendResponse.text()}`
+                                    );
+                                } else {
+                                    logger.info(
+                                        `Extended license ${licenseKeyId} for subscription ${subscription.id} to expire at ${expiresAt}.`
+                                    );
+                                }
+                            } catch (error) {
+                                logger.error(
+                                    `Error notifying Fossorial API of license renewal for subscription ${subscription.id}:`,
+                                    error
+                                );
+                            }
+                        }
+                    }
                 }
             }
         }

server/private/routers/generatedLicense/generateNewEnterpriseLicense.ts

@@ -64,14 +64,11 @@ export async function generateNewEnterpriseLicense(
 
         const licenseData = req.body;
 
-        if (
+        if (licenseData.tier != "tier2" && licenseData.tier != "tier1") {
-            licenseData.tier != "big_license" &&
-            licenseData.tier != "small_license"
-        ) {
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,
-                    "Invalid tier specified. Must be either 'big_license' or 'small_license'."
+                    "Invalid tier specified. Must be either 'tier2' or 'tier1'."
                 )
             );
         }
@@ -99,6 +96,8 @@ export async function generateNewEnterpriseLicense(
             );
         }
 
+        const licenseKeyValue = apiResponse?.data?.licenseKey?.licenseKey;
+
         // check if we already have a customer for this org
         const [customer] = await db
             .select()
@@ -118,9 +117,7 @@ export async function generateNewEnterpriseLicense(
         }
 
         const tier =
-            licenseData.tier === "big_license"
+            licenseData.tier === "tier2" ? LicenseId.TIER2 : LicenseId.TIER1;
-                ? LicenseId.BIG_LICENSE
-                : LicenseId.SMALL_LICENSE;
         const tierPrice = getLicensePriceSet()[tier];
 
         const session = await stripe!.checkout.sessions.create({
@@ -134,6 +131,16 @@ export async function generateNewEnterpriseLicense(
             ], // Start with the standard feature set that matches the free limits
             customer: customer.customerId,
             mode: "subscription",
+            subscription_data: {
+                description: licenseKeyValue
+                    ? `License ${licenseKeyValue}`
+                    : `License key ID ${keyId}`,
+                metadata: {
+                    licenseKeyId: keyId.toString(),
+                    licenseKey: licenseKeyValue ?? "",
+                    tier: licenseData.tier
+                }
+            },
             allow_promotion_codes: true,
             success_url: `${config.getRawConfig().app.dashboard_url}/${orgId}/settings/license?success=true&session_id={CHECKOUT_SESSION_ID}`,
             cancel_url: `${config.getRawConfig().app.dashboard_url}/${orgId}/settings/license?canceled=true`

server/routers/auditLogs/queryAiSessionLog.ts

@@ -47,7 +47,6 @@ export const queryAiSessionLogsQuery = z.strictObject({
             error: "timeEnd must be a valid ISO date string"
         })
         .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
         .prefault(() => new Date().toISOString())
         .openapi({
             type: "string",

server/routers/auditLogs/queryRequestAnalytics.ts

@@ -20,7 +20,6 @@ const queryAccessAuditLogsQuery = z.object({
             error: "timeStart must be a valid ISO date string"
         })
         .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
         .prefault(() => getSevenDaysAgo().toISOString())
         .openapi({
             type: "string",
@@ -34,7 +33,6 @@ const queryAccessAuditLogsQuery = z.object({
             error: "timeEnd must be a valid ISO date string"
         })
         .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
         .prefault(() => new Date().toISOString())
         .openapi({
             type: "string",

server/routers/auditLogs/queryRequestAuditLog.ts

@@ -41,7 +41,6 @@ export const queryAccessAuditLogsQuery = z.strictObject({
             error: "timeEnd must be a valid ISO date string"
         })
         .transform((val) => Math.floor(new Date(val).getTime() / 1000))
-        .optional()
         .prefault(() => new Date().toISOString())
         .openapi({
             type: "string",

server/routers/auth/securityKey.ts

@@ -17,7 +17,7 @@ import {
 import type {
     GenerateRegistrationOptionsOpts,
     GenerateAuthenticationOptionsOpts,
-    AuthenticatorTransportFuture
+    AuthenticatorTransport
 } from "@simplewebauthn/server";
 import { isoBase64URL } from "@simplewebauthn/server/helpers";
 import config from "@server/lib/config";
@@ -221,7 +221,7 @@ export async function startRegistration(
         const excludeCredentials = existingSecurityKeys.map((key) => ({
             id: key.credentialId,
             transports: key.transports
-                ? (JSON.parse(key.transports) as AuthenticatorTransportFuture[])
+                ? (JSON.parse(key.transports) as AuthenticatorTransport[])
                 : undefined
         }));
 
@@ -571,7 +571,7 @@ export async function startAuthentication(
                 transports: key.transports
                     ? (JSON.parse(
                           key.transports
-                      ) as AuthenticatorTransportFuture[])
+                      ) as AuthenticatorTransport[])
                     : undefined
             }));
         }
@@ -702,7 +702,7 @@ export async function verifyAuthentication(
                 transports: securityKey.transports
                     ? (JSON.parse(
                           securityKey.transports
-                      ) as AuthenticatorTransportFuture[])
+                      ) as AuthenticatorTransport[])
                     : undefined
             },
             requireUserVerification: false

server/routers/newt/error.ts

@@ -0,0 +1,24 @@
+import { sendToClient } from "#dynamic/routers/ws";
+
+// Error codes for registration failures
+export const NewtErrorCodes = {
+    NO_AVAILABLE_SUBNET: {
+        code: "NO_AVAILABLE_SUBNET",
+        message:
+            "No available subnet could be assigned to this site on its exit node. Please contact your administrator to increase the available address space for this exit node's subnet."
+    }
+} as const;
+
+// Helper function to send registration error
+export async function sendNewtError(
+    error: (typeof NewtErrorCodes)[keyof typeof NewtErrorCodes],
+    newtId: string
+) {
+    sendToClient(newtId, {
+        type: "newt/error",
+        data: {
+            code: error.code,
+            message: error.message
+        }
+    });
+}

server/routers/newt/handleNewtRegisterMessage.ts

@@ -14,6 +14,7 @@ import { getUniqueSubnetForExitNode } from "@server/lib/exitNodes";
 import { fetchContainers } from "./dockerSocket";
 import { buildTargetConfigurationForNewtClient } from "./buildConfiguration";
 import { canCompress } from "@server/lib/clientVersionChecks";
+import { NewtErrorCodes, sendNewtError } from "./error";
 
 export const handleNewtRegisterMessage: MessageHandler = async (context) => {
     const { message, client, sendToClient } = context;
@@ -116,6 +117,7 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
             logger.error(
                 `No available subnets found for the new exit node id ${exitNodeId} and site id ${siteId}`
             );
+            sendNewtError(NewtErrorCodes.NO_AVAILABLE_SUBNET, newt.newtId);
             return;
         }
 

server/routers/olm/error.ts

@@ -94,6 +94,11 @@ export const OlmErrorCodes = {
     HOLEPUNCH_MISSING: {
         code: "HOLEPUNCH_MISSING",
         message: `Unable to coordinate client P2P connection. Please ensure your client can reach the server on UDP port ${udpPort} and try registering again.`
+    },
+    NO_AVAILABLE_SUBNET: {
+        code: "NO_AVAILABLE_SUBNET",
+        message:
+            "No available subnet could be assigned to this client on the selected exit node. Please contact your administrator to increase the available address space for this exit node's subnet."
     }
 } as const;
 

server/routers/olm/handleOlmRegisterMessage.ts

@@ -347,6 +347,7 @@ export const handleOlmRegisterMessage: MessageHandler = async (context) => {
                 `[handleOlmRegisterMessage] No available subnets found for exit node id ${exitNodeId} and client id ${client.clientId}`,
                 { orgId: client.orgId, clientId: client.clientId }
             );
+            sendOlmError(OlmErrorCodes.NO_AVAILABLE_SUBNET, olm.olmId);
             return;
         }
 

server/routers/target/handleHealthcheckStatusMessage.ts

@@ -43,7 +43,7 @@ export const handleHealthcheckStatusMessage: MessageHandler = async (
     const { message, client: c } = context;
     const newt = c as Newt;
 
-    logger.info("Handling healthcheck status message");
+    logger.debug("Handling healthcheck status message");
 
     if (!newt) {
         logger.warn("Newt not found");

server/setup/migrationsSqlite.ts

@@ -5,6 +5,7 @@ import path from "path";
 import semver from "semver";
 import { versionMigrations } from "../db/sqlite";
 import { __DIRNAME, APP_PATH, APP_VERSION } from "@server/lib/consts";
+import { formatBackupTimestamp } from "@server/lib/backupFileName";
 import { SqliteError } from "better-sqlite3";
 import fs from "fs";
 import { build } from "@server/build";
@@ -121,7 +122,7 @@ function backupDb() {
     // copy the db.sqlite file to backups
     // add the date to the filename
     const date = new Date();
-    const dateString = `${date.getFullYear()}-${date.getMonth()}-${date.getDate()}_${date.getHours()}-${date.getMinutes()}-${date.getSeconds()}`;
+    const dateString = formatBackupTimestamp(date);
     const dbPath = path.join(dbDir, "db.sqlite");
     const backupPath = path.join(backupsDir, `db_${dateString}.sqlite`);
     fs.copyFileSync(dbPath, backupPath);

server/setup/scriptsPg/1.23.0.ts

@@ -3,8 +3,6 @@ import { sql } from "drizzle-orm";
 
 const version = "1.23.0";
 
-await migration();
-
 export default async function migration() {
     console.log(`Running setup script ${version}...`);
 
@@ -12,11 +10,11 @@ export default async function migration() {
         await db.execute(sql`BEGIN`);
 
         await db.execute(sql`
-            ALTER TABLE "newt" ADD COLUMN "agent" varchar;
+            ALTER TABLE "newt" ADD COLUMN IF NOT EXISTS "agent" varchar;
         `);
 
         await db.execute(sql`
-            ALTER TABLE "newt" ADD COLUMN "agentVersion" varchar;
+            ALTER TABLE "newt" ADD COLUMN IF NOT EXISTS "agentVersion" varchar;
         `);
 
         await db.execute(sql`COMMIT`);

server/setup/scriptsSqlite/1.0.0-beta9.ts

@@ -10,6 +10,7 @@ import {
     users
 } from "../../db/sqlite";
 import { APP_PATH, configFilePath1, configFilePath2 } from "@server/lib/consts";
+import { formatBackupTimestamp } from "@server/lib/backupFileName";
 import { eq, sql } from "drizzle-orm";
 import fs from "fs";
 import * as yaml from "js-yaml";
@@ -34,7 +35,7 @@ export default async function migration() {
     // copy the db.sqlite file to backups
     // add the date to the filename
     const date = new Date();
-    const dateString = `${date.getFullYear()}-${date.getMonth()}-${date.getDate()}_${date.getHours()}-${date.getMinutes()}-${date.getSeconds()}`;
+    const dateString = formatBackupTimestamp(date);
     const dbPath = path.join(dbDir, "db.sqlite");
     const backupPath = path.join(backupsDir, `db_${dateString}.sqlite`);
     fs.copyFileSync(dbPath, backupPath);

server/setup/scriptsSqlite/1.23.0.ts

@@ -16,13 +16,13 @@ export default async function migration() {
         db.transaction(() => {
             db.prepare(
                 `
-            ALTER TABLE 'newt' ADD 'agent' text;
+            ALTER TABLE 'newt' ADD COLUMN 'agent' text;
                 `
             ).run();
 
             db.prepare(
                 `
-            ALTER TABLE 'newt' ADD 'agentVersion' text;
+            ALTER TABLE 'newt' ADD COLUMN 'agentVersion' text;
                 `
             ).run();
         })();

src/app/[orgId]/settings/(private)/billing/page.tsx

@@ -749,12 +749,6 @@ export default function BillingPage() {
         return 0;
     };
 
-    // Get license key count
-    const getLicenseKeyCount = (): number => {
-        if (!licenseSubscription?.items) return 0;
-        return licenseSubscription.items.length;
-    };
-
     // Check if downgrading to a tier would violate current usage limits
     const checkLimitViolations = (
         targetTier: Tier | "basic"
@@ -1545,7 +1539,7 @@ export default function BillingPage() {
             </SettingsSection>
 
             {/* Paid License Keys Section */}
-            {(licenseSubscription || getLicenseKeyCount() > 0) && (
+            {licenseSubscription && (
                 <SettingsSection>
                     <SettingsSectionHeader>
                         <SettingsSectionTitle>
@@ -1561,22 +1555,6 @@ export default function BillingPage() {
                             <SettingsFormGrid>
                                 <SettingsFormCell span="full">
                                     <div className="flex flex-col md:flex-row items-start md:items-center justify-between gap-4 border rounded-lg p-4">
-                                        <div>
-                                            <div className="text-sm text-muted-foreground mb-1">
-                                                {t("billingCurrentKeys") ||
-                                                    "Current Keys"}
-                                            </div>
-                                            <div className="flex items-baseline gap-2">
-                                                <span className="text-3xl font-semibold">
-                                                    {getLicenseKeyCount()}
-                                                </span>
-                                                <span className="text-lg">
-                                                    {getLicenseKeyCount() === 1
-                                                        ? "key"
-                                                        : "keys"}
-                                                </span>
-                                            </div>
-                                        </div>
                                         <Button
                                             variant="outline"
                                             onClick={handleModifySubscription}

src/app/[orgId]/settings/(private)/license/page.tsx

@@ -1,4 +1,5 @@
 import GenerateLicenseKeysTable from "@app/components/GenerateLicenseKeysTable";
+import LicenseBillingBanner from "@app/components/LicenseBillingBanner";
 import { internal } from "@app/lib/api";
 import { authCookieHeader } from "@app/lib/api/cookies";
 import { ListGeneratedLicenseKeysResponse } from "@server/routers/generatedLicense/types";
@@ -26,5 +27,16 @@ export default async function Page({ params }: Props) {
         licenseKeys = data.data.data;
     } catch {}
 
-    return <GenerateLicenseKeysTable licenseKeys={licenseKeys} orgId={orgId} />;
+    const hasNonPersonalLicenseKey = licenseKeys.some(
+        (key) => key.tier !== "personal"
+    );
+
+    return (
+        <>
+            {hasNonPersonalLicenseKey && (
+                <LicenseBillingBanner orgId={orgId} />
+            )}
+            <GenerateLicenseKeysTable licenseKeys={licenseKeys} orgId={orgId} />
+        </>
+    );
 }

src/app/[orgId]/settings/resources/private/[niceId]/ai-gateway/page.tsx

@@ -76,11 +76,13 @@ export default function PrivateResourceInferencePage() {
                     })
                 ),
                 httpConfigSubdomain: z.string().nullish(),
-                httpConfigDomainId: z.string().nullish(),
+                httpConfigDomainId: z
+                    .string()
+                    .min(1, { message: t("domainRequired") }),
                 httpConfigFullDomain: z.string().nullish(),
                 ssl: z.boolean().optional()
             }),
-        []
+        [t]
     );
     type FormValues = z.infer<typeof formSchema>;
 
@@ -103,7 +105,7 @@ export default function PrivateResourceInferencePage() {
         defaultValues: {
             providers: [],
             httpConfigSubdomain: siteResource.subdomain ?? null,
-            httpConfigDomainId: siteResource.domainId ?? null,
+            httpConfigDomainId: siteResource.domainId ?? "",
             httpConfigFullDomain: siteResource.fullDomain ?? null,
             ssl: siteResource.ssl ?? false
         }
@@ -289,22 +291,33 @@ export default function PrivateResourceInferencePage() {
                                         </SettingsSubsectionHeader>
                                     </SettingsFormCell>
                                     <SettingsFormCell span="full">
+                                        <FormField
+                                            control={form.control}
+                                            name="httpConfigDomainId"
+                                            render={() => (
+                                                <FormItem>
                                                     <DomainPicker
                                                         key={`inference-domain-${siteResource.id}`}
-                                            orgId={siteResource.orgId}
+                                                        orgId={
+                                                            siteResource.orgId
+                                                        }
                                                         cols={2}
                                                         hideFreeDomain
                                                         defaultSubdomain={
-                                                httpConfigSubdomain ?? undefined
+                                                            httpConfigSubdomain ??
+                                                            undefined
                                                         }
                                                         defaultDomainId={
-                                                httpConfigDomainId ?? undefined
+                                                            httpConfigDomainId ??
+                                                            undefined
                                                         }
                                                         defaultFullDomain={
                                                             httpConfigFullDomain ??
                                                             undefined
                                                         }
-                                            onDomainChange={(res) => {
+                                                        onDomainChange={(
+                                                            res
+                                                        ) => {
                                                             if (res === null) {
                                                                 form.setValue(
                                                                     "httpConfigSubdomain",
@@ -312,7 +325,11 @@ export default function PrivateResourceInferencePage() {
                                                                 );
                                                                 form.setValue(
                                                                     "httpConfigDomainId",
-                                                        null
+                                                                    "",
+                                                                    {
+                                                                        shouldValidate:
+                                                                            true
+                                                                    }
                                                                 );
                                                                 form.setValue(
                                                                     "httpConfigFullDomain",
@@ -322,11 +339,16 @@ export default function PrivateResourceInferencePage() {
                                                             }
                                                             form.setValue(
                                                                 "httpConfigSubdomain",
-                                                    res.subdomain ?? null
+                                                                res.subdomain ??
+                                                                    null
                                                             );
                                                             form.setValue(
                                                                 "httpConfigDomainId",
-                                                    res.domainId
+                                                                res.domainId,
+                                                                {
+                                                                    shouldValidate:
+                                                                        true
+                                                                }
                                                             );
                                                             form.setValue(
                                                                 "httpConfigFullDomain",
@@ -334,6 +356,10 @@ export default function PrivateResourceInferencePage() {
                                                             );
                                                         }}
                                                     />
+                                                    <FormMessage />
+                                                </FormItem>
+                                            )}
+                                        />
                                     </SettingsFormCell>
                                     <SettingsFormCell span="half">
                                         <FormField

src/app/[orgId]/settings/resources/public/[niceId]/general/page.tsx

@@ -139,6 +139,22 @@ export default function GeneralForm() {
                     : "Port number should not be set for HTTP resources",
                 path: ["proxyPort"]
             }
+        )
+        .refine(
+            (data) => {
+                if (
+                    ["http", "ssh", "rdp", "vnc", "inference"].includes(
+                        resource.mode
+                    )
+                ) {
+                    return !!data.domainId;
+                }
+                return true;
+            },
+            {
+                message: t("domainRequired"),
+                path: ["domainId"]
+            }
         );
 
     type GeneralFormValues = z.infer<typeof GeneralFormSchema>;
@@ -434,6 +450,11 @@ export default function GeneralForm() {
                                             resource.mode
                                         ) && (
                                             <SettingsFormCell span="full">
+                                                <FormField
+                                                    control={form.control}
+                                                    name="domainId"
+                                                    render={() => (
+                                                        <FormItem>
                                                             <div id="resource-domain-picker">
                                                                 <DomainPicker
                                                                     allowWildcard={
@@ -443,17 +464,21 @@ export default function GeneralForm() {
                                                                     key={
                                                                         resource.resourceId
                                                                     }
-                                                        orgId={orgId as string}
+                                                                    orgId={
+                                                                        orgId as string
+                                                                    }
                                                                     cols={2}
                                                                     defaultSubdomain={
                                                                         form.watch(
                                                                             "subdomain"
-                                                            ) ?? undefined
+                                                                        ) ??
+                                                                        undefined
                                                                     }
                                                                     defaultDomainId={
                                                                         form.watch(
                                                                             "domainId"
-                                                            ) ?? undefined
+                                                                        ) ??
+                                                                        undefined
                                                                     }
                                                                     defaultFullDomain={
                                                                         resourceFullDomainName ||
@@ -462,10 +487,17 @@ export default function GeneralForm() {
                                                                     onDomainChange={(
                                                                         res
                                                                     ) => {
-                                                            if (res === null) {
+                                                                        if (
+                                                                            res ===
+                                                                            null
+                                                                        ) {
                                                                             form.setValue(
                                                                                 "domainId",
-                                                                    undefined
+                                                                                undefined,
+                                                                                {
+                                                                                    shouldValidate:
+                                                                                        true
+                                                                                }
                                                                             );
                                                                             form.setValue(
                                                                                 "subdomain",
@@ -478,7 +510,11 @@ export default function GeneralForm() {
                                                                         }
                                                                         form.setValue(
                                                                             "domainId",
-                                                                res.domainId
+                                                                            res.domainId,
+                                                                            {
+                                                                                shouldValidate:
+                                                                                    true
+                                                                            }
                                                                         );
                                                                         form.setValue(
                                                                             "subdomain",
@@ -491,6 +527,10 @@ export default function GeneralForm() {
                                                                     }}
                                                                 />
                                                             </div>
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
                                             </SettingsFormCell>
                                         )}
                                         {!["tcp", "udp", "inference"].includes(

src/components/GenerateLicenseKeyForm.tsx

@@ -252,9 +252,10 @@ export default function GenerateLicenseKeyForm({
         try {
             // Check if this is a business/enterprise license request
             if (payload.useCaseType === "business") {
-                const response = await api.put<
+                const response = await api.put<AxiosResponse<string>>(
-                    AxiosResponse<string>
+                    `/org/${orgId}/license/enterprise`,
-                    >(`/org/${orgId}/license/enterprise`, { ...payload, tier: "big_license" } );
+                    { ...payload, tier: "tier2" }
+                );
 
                 console.log("Checkout session response:", response.data);
                 const checkoutUrl = response.data.data;

src/components/GenerateLicenseKeysTable.tsx

@@ -201,9 +201,16 @@ export default function GenerateLicenseKeysTable({
             },
             cell: ({ row }) => {
                 const tier = row.original.tier;
-                return tier === "enterprise"
+                switch (tier) {
-                    ? t("licenseTierEnterprise")
+                    case "enterprise":
-                    : t("licenseTierPersonal");
+                        return t("licenseTierEnterprise");
+                    case "tier1":
+                        return t("licenseTierTier1");
+                    case "tier2":
+                        return t("licenseTierTier2");
+                    default:
+                        return t("licenseTierPersonal");
+                }
             }
         },
         {

src/components/LicenseBillingBanner.tsx

@@ -0,0 +1,39 @@
+"use client";
+
+import { Globe, CreditCard, ArrowRight } from "lucide-react";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+import { Button } from "@app/components/ui/button";
+import DismissableBanner from "./DismissableBanner";
+
+type LicenseBillingBannerProps = {
+    orgId: string;
+};
+
+export const LicenseBillingBanner = ({ orgId }: LicenseBillingBannerProps) => {
+    const t = useTranslations();
+
+    return (
+        <DismissableBanner
+            storageKey="license-billing-banner-dismissed"
+            version={1}
+            title={t("licenseBillingBannerTitle")}
+            titleIcon={<Globe className="w-5 h-5 text-primary" />}
+            description={t("licenseBillingBannerDescription")}
+        >
+            <Link href={`/${orgId}/settings/billing`}>
+                <Button
+                    variant="outline"
+                    size="sm"
+                    className="gap-2 hover:bg-primary/10 hover:border-primary/50 transition-colors"
+                >
+                    <CreditCard className="w-4 h-4" />
+                    {t("licenseBillingBannerButton")}
+                    <ArrowRight className="w-4 h-4" />
+                </Button>
+            </Link>
+        </DismissableBanner>
+    );
+};
+
+export default LicenseBillingBanner;

src/components/LicenseKeysDataTable.tsx

@@ -100,9 +100,16 @@ export function LicenseKeysDataTable({
             },
             cell: ({ row }) => {
                 const tier = row.original.tier;
-                return tier === "enterprise"
+                switch (tier) {
-                    ? t("licenseTierEnterprise")
+                    case "enterprise":
-                    : t("licenseTierPersonal");
+                        return t("licenseTierEnterprise");
+                    case "tier1":
+                        return t("licenseTierTier1");
+                    case "tier2":
+                        return t("licenseTierTier2");
+                    default:
+                        return t("licenseTierPersonal");
+                }
             }
         },
         {

src/components/NewPricingLicenseForm.tsx

@@ -40,8 +40,8 @@ import { InfoIcon } from "lucide-react";
 import { useUserContext } from "@app/hooks/useUserContext";
 
 const TIER_TO_LICENSE_ID = {
-    starter: "small_license",
+    starter: "tier1",
-    scale: "big_license"
+    scale: "tier2"
 } as const;
 
 type FormProps = {
@@ -330,7 +330,7 @@ export default function NewPricingLicenseForm({
                                             cols={2}
                                         />
                                         <a
-                                            href="https://pangolin.net/pricing"
+                                            href="https://pangolin.net/pricing#Self-Hosted"
                                             target="_blank"
                                             rel="noopener noreferrer"
                                             className="text-sm text-primary hover:underline"

src/components/SiteInfoCard.tsx

@@ -63,6 +63,12 @@ export default function SiteInfoCard({}: SiteInfoCardProps) {
     ) : null;
 
     if (site.type === "newt") {
+        // agent and agentVersion were added after newtVersion, so a
+        // site still running an older Newt reports only newtVersion.
+        // Without these fallbacks the badge renders with no label and
+        // no version at all.
+        const agentLabel = site.agent == "cli" ? "Pangolin CLI" : "Newt";
+        const agentVersion = site.agentVersion ?? site.newtVersion;
         return (
             <Alert>
                 <AlertDescription>
@@ -79,13 +85,12 @@ export default function SiteInfoCard({}: SiteInfoCardProps) {
                         <InfoSection>
                             <InfoSectionTitle>{t("agent")}</InfoSectionTitle>
                             <InfoSectionContent>
-                                {site.agent == "newt" ? "Newt" : null}
+                                <div className="flex items-center space-x-1">
-                                {site.agent == "cli"
+                                    <span>{agentLabel}</span>
-                                    ? "Pangolin CLI"
+                                    {agentVersion && (
-                                    : null}{" "}
+                                        <span>v{agentVersion}</span>
-                                {site.agentVersion
+                                    )}
-                                    ? `v${site.agentVersion}`
+                                </div>
-                                    : "-"}
                             </InfoSectionContent>
                         </InfoSection>
                         {endpointSection}

src/components/SitesTable.tsx

@@ -373,7 +373,7 @@ export default function SitesTable({
                 accessorKey: "type",
                 friendlyName: t("agent"),
                 header: () => {
-                    return <span className="p-3">{t("type")}</span>;
+                    return <span className="p-3">{t("agent")}</span>;
                 },
                 cell: ({ row }) => {
                     const originalRow = row.original;
@@ -386,25 +386,27 @@ export default function SitesTable({
                     );
 
                     if (originalRow.type === "newt") {
-                        if (!originalRow.agent) {
+                        if (!originalRow.agent && !originalRow.newtVersion) {
+                            // it has not checked in yet
                             return <span>-</span>;
                         }
+                        // agent and agentVersion were added after newtVersion, so a
+                        // site still running an older Newt reports only newtVersion.
+                        // Without these fallbacks the badge renders with no label and
+                        // no version at all.
+                        const agentLabel =
+                            originalRow.agent == "cli"
+                                ? "Pangolin CLI"
+                                : "Newt";
+                        const agentVersion =
+                            originalRow.agentVersion ?? originalRow.newtVersion;
                         return (
                             <div className="flex items-center space-x-1">
                                 <Badge variant="secondary">
                                     <div className="flex items-center space-x-1">
-                                        <span>
+                                        <span>{agentLabel}</span>
-                                            {originalRow.agent == "newt"
+                                        {agentVersion && (
-                                                ? "Newt"
+                                            <span>v{agentVersion}</span>
-                                                : null}
-                                            {originalRow.agent == "cli"
-                                                ? "Pangolin CLI"
-                                                : null}
-                                        </span>
-                                        {originalRow.agentVersion && (
-                                            <span>
-                                                v{originalRow.agentVersion}
-                                            </span>
                                         )}
                                     </div>
                                 </Badge>

src/components/newt-install-commands.tsx

@@ -150,7 +150,7 @@ Type=simple
 User=root
 Group=root
 EnvironmentFile=/etc/pangolin/pangolin-site.env
-ExecStart=/home/owen/fossorial/cli/bin/pangolin up site
+ExecStart=/usr/local/bin/pangolin up site
 Restart=always
 RestartSec=2
 UMask=0077

src/components/ui/calendar.tsx

@@ -87,7 +87,7 @@ function Calendar({
                         : "[&>svg]:text-muted-foreground flex h-8 items-center gap-1 rounded-md pl-2 pr-1 text-sm [&>svg]:size-3.5",
                     defaultClassNames.caption_label
                 ),
-                table: "w-full border-collapse",
+                month_grid: "w-full border-collapse",
                 weekdays: cn("flex", defaultClassNames.weekdays),
                 weekday: cn(
                     "text-muted-foreground flex-1 select-none rounded-md text-[0.8rem] font-normal",

src/lib/privateResourceForm.ts

@@ -523,6 +523,13 @@ export function createCreateFormSchema(t: TranslateFn) {
                     });
                 }
             }
+            if (data.mode === "inference" && !data.httpConfigDomainId) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: t("domainRequired"),
+                    path: ["httpConfigDomainId"]
+                });
+            }
         });
 }