Moving to mode replacing http and protocol fields

messages/bg-BG.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Метод",
     "editInternalResourceDialogEnableSsl": "Активирайте TLS",
     "editInternalResourceDialogEnableSslDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целта.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Метод",
     "createInternalResourceDialogScheme": "Метод",
     "createInternalResourceDialogEnableSsl": "Активирайте TLS",

messages/cs-CZ.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Schéma",
     "editInternalResourceDialogEnableSsl": "Povolit SSL",
     "editInternalResourceDialogEnableSslDescription": "Povolit šifrování SSL/TLS pro zabezpečené HTTPS připojení k cíli.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Schéma",
     "createInternalResourceDialogScheme": "Schéma",
     "createInternalResourceDialogEnableSsl": "Povolit SSL",

messages/de-DE.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Schema",
     "editInternalResourceDialogEnableSsl": "TLS aktivieren",
     "editInternalResourceDialogEnableSslDescription": "SSL/TLS-Verschlüsselung für sichere HTTPS-Verbindungen zum Ziel aktivieren.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Schema",
     "createInternalResourceDialogScheme": "Schema",
     "createInternalResourceDialogEnableSsl": "TLS aktivieren",

messages/en-US.json

@@ -2004,7 +2004,6 @@
     "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
     "destination": "Destination",
     "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
-    "sshAccess": "SSH Access",
     "roleAllowSsh": "Allow SSH",
     "roleAllowSshAllow": "Allow",
     "roleAllowSshDisallow": "Disallow",
@@ -2110,6 +2109,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Scheme",
     "editInternalResourceDialogEnableSsl": "Enable TLS",
     "editInternalResourceDialogEnableSslDescription": "Enable SSL/TLS encryption for secure HTTPS connections to the destination.",
@@ -2159,6 +2159,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Scheme",
     "createInternalResourceDialogScheme": "Scheme",
     "createInternalResourceDialogEnableSsl": "Enable TLS",

messages/es-ES.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Esquema",
     "editInternalResourceDialogEnableSsl": "Activar TLS",
     "editInternalResourceDialogEnableSslDescription": "Habilitar cifrado SSL/TLS para conexiones HTTPS seguras al destino.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Esquema",
     "createInternalResourceDialogScheme": "Esquema",
     "createInternalResourceDialogEnableSsl": "Activar TLS",

messages/fr-FR.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Méthode HTTP",
     "editInternalResourceDialogEnableSsl": "Activer TLS",
     "editInternalResourceDialogEnableSslDescription": "Activer le cryptage SSL/TLS pour des connexions HTTPS sécurisées vers la destination.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Méthode HTTP",
     "createInternalResourceDialogScheme": "Méthode HTTP",
     "createInternalResourceDialogEnableSsl": "Activer TLS",

messages/it-IT.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Metodo HTTP",
     "editInternalResourceDialogEnableSsl": "Abilitare TLS",
     "editInternalResourceDialogEnableSslDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alla destinazione.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Metodo HTTP",
     "createInternalResourceDialogScheme": "Metodo HTTP",
     "createInternalResourceDialogEnableSsl": "Abilitare TLS",

messages/ko-KR.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "스킴",
     "editInternalResourceDialogEnableSsl": "TLS 활성화",
     "editInternalResourceDialogEnableSslDescription": "목적지로의 안전한 HTTPS 연결을 위한 SSL/TLS 암호화 활성화.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "스킴",
     "createInternalResourceDialogScheme": "스킴",
     "createInternalResourceDialogEnableSsl": "TLS 활성화",

messages/nb-NO.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Skjema",
     "editInternalResourceDialogEnableSsl": "Aktiver TLS",
     "editInternalResourceDialogEnableSslDescription": "Aktiver SSL/TLS-kryptering for sikre HTTPS-tilkoblinger til destinasjonen.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Skjema",
     "createInternalResourceDialogScheme": "Skjema",
     "createInternalResourceDialogEnableSsl": "Aktiver TLS",

messages/nl-NL.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Schema",
     "editInternalResourceDialogEnableSsl": "TLS inschakelen",
     "editInternalResourceDialogEnableSslDescription": "Schakel SSL/TLS-encryptie in voor beveiligde HTTPS-verbindingen met de bestemming.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Schema",
     "createInternalResourceDialogScheme": "Schema",
     "createInternalResourceDialogEnableSsl": "TLS inschakelen",

messages/pl-PL.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Schemat",
     "editInternalResourceDialogEnableSsl": "Włącz TLS",
     "editInternalResourceDialogEnableSslDescription": "Włącz szyfrowanie SSL/TLS dla bezpiecznych połączeń HTTPS z miejscem docelowym.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Schemat",
     "createInternalResourceDialogScheme": "Schemat",
     "createInternalResourceDialogEnableSsl": "Włącz TLS",

messages/pt-PT.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Esquema",
     "editInternalResourceDialogEnableSsl": "Ativar TLS",
     "editInternalResourceDialogEnableSslDescription": "Ativar criptografia SSL/TLS para conexões HTTPS seguras com o destino.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Esquema",
     "createInternalResourceDialogScheme": "Esquema",
     "createInternalResourceDialogEnableSsl": "Ativar TLS",

messages/ru-RU.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "СИДР",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Схема",
     "editInternalResourceDialogEnableSsl": "Включить TLS",
     "editInternalResourceDialogEnableSslDescription": "Включите шифрование SSL/TLS для защищенных HTTPS соединений с конечной точкой.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "СИДР",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Схема",
     "createInternalResourceDialogScheme": "Схема",
     "createInternalResourceDialogEnableSsl": "Включить TLS",

messages/tr-TR.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Şema",
     "editInternalResourceDialogEnableSsl": "TLS Etkinleştir",
     "editInternalResourceDialogEnableSslDescription": "Hedefe güvenli HTTPS bağlantıları için SSL/TLS şifrelemeyi etkinleştirin.",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Şema",
     "createInternalResourceDialogScheme": "Şema",
     "createInternalResourceDialogEnableSsl": "TLS'yi Etkinleştir",

messages/zh-CN.json

@@ -2049,6 +2049,7 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "方案",
     "editInternalResourceDialogEnableSsl": "启用 TLS",
     "editInternalResourceDialogEnableSslDescription": "为目标的安全 HTTPS 连接启用 SSL/TLS 加密。",
@@ -2098,6 +2099,7 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "方案",
     "createInternalResourceDialogScheme": "方案",
     "createInternalResourceDialogEnableSsl": "启用 TLS",

server/db/pg/schema/schema.ts

@@ -129,8 +129,6 @@ export const resources = pgTable("resources", {
     ssl: boolean("ssl").notNull().default(false),
     blockAccess: boolean("blockAccess").notNull().default(false),
     sso: boolean("sso").notNull().default(true),
-    http: boolean("http").notNull().default(true),
-    protocol: varchar("protocol").notNull(),
     proxyPort: integer("proxyPort"),
     emailWhitelistEnabled: boolean("emailWhitelistEnabled")
         .notNull()
@@ -159,7 +157,7 @@ export const resources = pgTable("resources", {
     postAuthPath: text("postAuthPath"),
     health: varchar("health").default("unknown"), // "healthy", "unhealthy", "unknown"
     wildcard: boolean("wildcard").notNull().default(false),
-    browserAccessType: text("browserAccessType").default("http"), // rdp, ssh, http, vnc
+    mode: text("mode").default("http").notNull(), // rdp, ssh, http, vnc
     pamMode: varchar("pamMode", { length: 32 })
         .$type<"passthrough" | "push">()
         .default("passthrough"),
@@ -346,11 +344,11 @@ export const siteResources = pgTable("siteResources", {
     niceId: varchar("niceId").notNull(),
     name: varchar("name").notNull(),
     ssl: boolean("ssl").notNull().default(false),
-    mode: varchar("mode").$type<"host" | "cidr" | "http">().notNull(), // "host" | "cidr" | "http"
+    mode: varchar("mode").$type<"host" | "cidr" | "http" | "ssh">().notNull(), // "host" | "cidr" | "http"
     scheme: varchar("scheme").$type<"http" | "https">(), // only for when we are doing https or http mode
     proxyPort: integer("proxyPort"), // only for port mode
     destinationPort: integer("destinationPort"), // only for port mode
-    destination: varchar("destination").notNull(), // ip, cidr, hostname; validate against the mode
+    destination: varchar("destination"), // ip, cidr, hostname; validate against the mode
     enabled: boolean("enabled").notNull().default(true),
     alias: varchar("alias"),
     aliasAddress: varchar("aliasAddress"),

server/db/sqlite/schema/schema.ts

@@ -142,8 +142,6 @@ export const resources = sqliteTable("resources", {
         .notNull()
         .default(false),
     sso: integer("sso", { mode: "boolean" }).notNull().default(true),
-    http: integer("http", { mode: "boolean" }).notNull().default(true),
-    protocol: text("protocol").notNull(),
     proxyPort: integer("proxyPort"),
     emailWhitelistEnabled: integer("emailWhitelistEnabled", { mode: "boolean" })
         .notNull()
@@ -166,7 +164,6 @@ export const resources = sqliteTable("resources", {
         .notNull()
         .default(false),
     proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
-
     maintenanceModeEnabled: integer("maintenanceModeEnabled", {
         mode: "boolean"
     })
@@ -181,7 +178,7 @@ export const resources = sqliteTable("resources", {
     postAuthPath: text("postAuthPath"),
     health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
     wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false),
-    browserAccessType: text("browserAccessType").default("http"), // rdp, ssh, http, vnc
+    mode: text("mode").default("http").notNull(), // rdp, ssh, http, vnc
     pamMode: text("pamMode")
         .$type<"passthrough" | "push">()
         .default("passthrough"),
@@ -380,11 +377,11 @@ export const siteResources = sqliteTable("siteResources", {
     niceId: text("niceId").notNull(),
     name: text("name").notNull(),
     ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
-    mode: text("mode").$type<"host" | "cidr" | "http">().notNull(), // "host" | "cidr" | "http"
+    mode: text("mode").$type<"host" | "cidr" | "http" | "ssh">().notNull(), // "host" | "cidr" | "http"
     scheme: text("scheme").$type<"http" | "https">(), // only for when we are doing https or http mode
     proxyPort: integer("proxyPort"), // only for port mode
     destinationPort: integer("destinationPort"), // only for port mode
-    destination: text("destination").notNull(), // ip, cidr, hostname
+    destination: text("destination"), // ip, cidr, hostname
     enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
     alias: text("alias"),
     aliasAddress: text("aliasAddress"),

server/lib/ip.ts

@@ -475,6 +475,8 @@ export function generateRemoteSubnets(
 ): string[] {
     const remoteSubnets = allSiteResources
         .filter((sr) => {
+            if (!sr.destination) return false;
+
             if (sr.mode === "cidr") {
                 // check if its a valid CIDR using zod
                 const cidrSchema = z.union([z.cidrv4(), z.cidrv6()]);
@@ -496,7 +498,7 @@ export function generateRemoteSubnets(
             }
             return ""; // This should never be reached due to filtering, but satisfies TypeScript
         })
-        .filter((subnet) => subnet !== ""); // Remove empty strings just to be safe
+        .filter((subnet): subnet is string => subnet !== "" && subnet !== null); // Remove invalid values just to be safe
     // remove duplicates
     return Array.from(new Set(remoteSubnets));
 }
@@ -581,7 +583,7 @@ export function generateSubnetProxyTargets(
                 targets.push({
                     sourcePrefix: clientPrefix,
                     destPrefix: `${siteResource.aliasAddress}/32`,
-                    rewriteTo: destination,
+                    rewriteTo: destination!,
                     portRange,
                     disableIcmp
                 });
@@ -589,7 +591,7 @@ export function generateSubnetProxyTargets(
         } else if (siteResource.mode == "cidr") {
             targets.push({
                 sourcePrefix: clientPrefix,
-                destPrefix: siteResource.destination,
+                destPrefix: siteResource.destination!,
                 portRange,
                 disableIcmp
             });
@@ -671,7 +673,7 @@ export async function generateSubnetProxyTargetV2(
             targets.push({
                 sourcePrefixes: [],
                 destPrefix: `${siteResource.aliasAddress}/32`,
-                rewriteTo: destination,
+                rewriteTo: destination!,
                 portRange,
                 disableIcmp,
                 resourceId: siteResource.siteResourceId
@@ -680,7 +682,7 @@ export async function generateSubnetProxyTargetV2(
     } else if (siteResource.mode == "cidr") {
         targets.push({
             sourcePrefixes: [],
-            destPrefix: siteResource.destination,
+            destPrefix: siteResource.destination!,
             portRange,
             disableIcmp,
             resourceId: siteResource.siteResourceId
@@ -738,7 +740,7 @@ export async function generateSubnetProxyTargetV2(
             protocol: siteResource.ssl ? "https" : "http",
             httpTargets: [
                 {
-                    destAddr: siteResource.destination,
+                    destAddr: siteResource.destination!,
                     destPort: siteResource.destinationPort,
                     scheme: siteResource.scheme
                 }

server/lib/rebuildClientAssociations.ts

@@ -823,6 +823,9 @@ async function handleSubnetProxyTargetUpdates(
                 }
 
                 for (const client of removedClients) {
+                    if (!siteResource.destination) {
+                        continue;
+                    }
                     // Check if this client still has access to another resource
                     // on this specific site with the same destination. We scope
                     // by siteId (via siteNetworks) rather than networkId because
@@ -1457,6 +1460,9 @@ async function handleMessagesForClientResources(
                 }
 
                 try {
+                    if (!resource.destination) {
+                        continue;
+                    }
                     // Check if this client still has access to another resource
                     // on this specific site with the same destination. We scope
                     // by siteId (via siteNetworks) rather than networkId because

server/private/lib/traefik/getTraefikConfig.ts

@@ -96,9 +96,7 @@ export async function getTraefikConfig(
             resourceName: resources.name,
             fullDomain: resources.fullDomain,
             ssl: resources.ssl,
-            http: resources.http,
             proxyPort: resources.proxyPort,
-            protocol: resources.protocol,
             subdomain: resources.subdomain,
             domainId: resources.domainId,
             enabled: resources.enabled,
@@ -110,6 +108,7 @@ export async function getTraefikConfig(
             proxyProtocol: resources.proxyProtocol,
             proxyProtocolVersion: resources.proxyProtocolVersion,
             wildcard: resources.wildcard,
+            mode: resources.mode,
 
             maintenanceModeEnabled: resources.maintenanceModeEnabled,
             maintenanceModeType: resources.maintenanceModeType,
@@ -172,8 +171,8 @@ export async function getTraefikConfig(
                 ),
                 inArray(sites.type, siteTypes),
                 allowRawResources
-                    ? isNotNull(resources.http) // ignore the http check if allow_raw_resources is true
-                    : eq(resources.http, true)
+                    ? inArray(resources.mode, ["http", "udp", "tcp"]) // allow all three
+                    : eq(resources.mode, "http")
             )
         )
         .orderBy(desc(targets.priority), targets.targetId); // stable ordering
@@ -227,9 +226,8 @@ export async function getTraefikConfig(
                 key: key,
                 fullDomain: row.fullDomain,
                 ssl: row.ssl,
-                http: row.http,
                 proxyPort: row.proxyPort,
-                protocol: row.protocol,
+                mode: row.mode,
                 subdomain: row.subdomain,
                 domainId: row.domainId,
                 enabled: row.enabled,
@@ -390,7 +388,7 @@ export async function getTraefikConfig(
     let siteResourcesWithFullDomain: {
         siteResourceId: number;
         fullDomain: string | null;
-        mode: "http" | "host" | "cidr";
+        mode: "http" | "host" | "cidr" | "ssh";
     }[] = [];
     if (build == "enterprise") {
         // we dont want to do this on the cloud

server/private/routers/ssh/signSshKey.ts

@@ -546,7 +546,7 @@ export async function signSshKey(
             if (resource.alias && resource.alias != "") {
                 sshHost = resource.alias;
             } else {
-                sshHost = resource.destination;
+                sshHost = resource.destination || ""; // TODO: IF WE HAVE THE NATIVE SSH MODE WHAT SHOULD WE DO HERE?
             }
         } else if (resource.authDaemonMode === "native") {
             if (siteIds.length > 1) {

server/routers/resource/createResource.ts

@@ -35,16 +35,54 @@ const createResourceParamsSchema = z.strictObject({
     orgId: z.string()
 });
 
+function resolveModeFromLegacyFields(data: {
+    mode?: "http" | "ssh" | "rdp" | "vnc" | "tcp" | "udp";
+    http?: boolean;
+    protocol?: "tcp" | "udp";
+}): {
+    mode?: "http" | "ssh" | "rdp" | "vnc" | "tcp" | "udp";
+    error?: string;
+} {
+    if (data.mode) {
+        return { mode: data.mode };
+    }
+
+    if (typeof data.http === "boolean" && data.protocol) {
+        if (data.http && data.protocol === "tcp") {
+            return { mode: "http" };
+        }
+        if (!data.http && data.protocol === "tcp") {
+            return { mode: "tcp" };
+        }
+        if (!data.http && data.protocol === "udp") {
+            return { mode: "udp" };
+        }
+        return {
+            error: "Invalid deprecated http/protocol combination"
+        };
+    }
+
+    return { mode: undefined };
+}
+
 const createHttpResourceSchema = z
     .strictObject({
         name: z.string().min(1).max(255),
         subdomain: z.string().nullable().optional(),
-        http: z.boolean(),
-        protocol: z.enum(["tcp", "udp"]),
+        http: z.boolean().optional().openapi({
+            deprecated: true,
+            description:
+                "Deprecated. Use `mode` instead. Legacy compatibility only."
+        }),
+        protocol: z.enum(["tcp", "udp"]).optional().openapi({
+            deprecated: true,
+            description:
+                "Deprecated. Use `mode` instead. Legacy compatibility only."
+        }),
         domainId: z.string(),
         stickySession: z.boolean().optional(),
         postAuthPath: z.string().nullable().optional(),
-        browserAccessType: z.enum(["http", "ssh", "rdp", "vnc"]).optional(),
+        mode: z.enum(["http", "ssh", "rdp", "vnc", "tcp", "udp"]).optional(),
         // SSH Settings
         pamMode: z.enum(["passthrough", "push"]).optional(),
         authDaemonPort: z.int().positive().optional(),
@@ -68,13 +106,27 @@ const createHttpResourceSchema = z
 const createRawResourceSchema = z
     .strictObject({
         name: z.string().min(1).max(255),
-        http: z.boolean(),
-        protocol: z.enum(["tcp", "udp"]),
+        http: z.boolean().optional().openapi({
+            deprecated: true,
+            description:
+                "Deprecated. Use `mode` instead. Legacy compatibility only."
+        }),
+        protocol: z.enum(["tcp", "udp"]).optional().openapi({
+            deprecated: true,
+            description:
+                "Deprecated. Use `mode` instead. Legacy compatibility only."
+        }),
+        mode: z.enum(["tcp", "udp"]).optional(),
         proxyPort: z.int().min(1).max(65535)
         // enableProxy: z.boolean().default(true) // always true now
     })
     .refine(
         (data) => {
+            const resolved = resolveModeFromLegacyFields(data);
+            if (resolved.error || !resolved.mode) {
+                return false;
+            }
+
             if (!config.getRawConfig().flags?.allow_raw_resources) {
                 if (data.proxyPort !== undefined) {
                     return false;
@@ -151,17 +203,18 @@ export async function createResource(
             );
         }
 
-        if (typeof req.body.http !== "boolean") {
+        const resolvedMode = resolveModeFromLegacyFields(req.body);
+        if (resolvedMode.error) {
             return next(
-                createHttpError(HttpCode.BAD_REQUEST, "http field is required")
+                createHttpError(HttpCode.BAD_REQUEST, resolvedMode.error)
             );
         }
 
-        const { http } = req.body;
+        if (resolvedMode.mode) {
+            req.body.mode = resolvedMode.mode;
+        }
 
-        if (http) {
-            return await createHttpResource({ req, res, next }, { orgId });
-        } else {
+        if (typeof req.body.proxyPort === "number") {
             if (
                 !config.getRawConfig().flags?.allow_raw_resources &&
                 build == "oss"
@@ -175,6 +228,17 @@ export async function createResource(
             }
             return await createRawResource({ req, res, next }, { orgId });
         }
+
+        if (req.body.mode) {
+            return await createHttpResource({ req, res, next }, { orgId });
+        } else {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "mode is required when deprecated fields are not provided"
+                )
+            );
+        }
     } catch (error) {
         logger.error(error);
         return next(
@@ -210,7 +274,7 @@ async function createHttpResource(
         name,
         domainId,
         postAuthPath,
-        browserAccessType,
+        mode,
         authDaemonPort,
         authDaemonMode,
         pamMode
@@ -338,12 +402,10 @@ async function createHttpResource(
                 orgId,
                 name,
                 subdomain: finalSubdomain,
-                http: true,
-                browserAccessType: browserAccessType,
+                mode: mode,
                 pamMode: pamMode,
                 authDaemonMode: authDaemonMode,
                 authDaemonPort: authDaemonPort,
-                protocol: "tcp",
                 ssl: true,
                 stickySession: stickySession,
                 postAuthPath: postAuthPath,
@@ -425,7 +487,17 @@ async function createRawResource(
         );
     }
 
-    const { name, http, protocol, proxyPort } = parsedBody.data;
+    const { name, proxyPort } = parsedBody.data;
+    const resolvedMode = resolveModeFromLegacyFields(parsedBody.data);
+    if (resolvedMode.error || !resolvedMode.mode) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                resolvedMode.error ||
+                    "mode is required when deprecated fields are not provided"
+            )
+        );
+    }
 
     let resource: Resource | undefined;
 
@@ -438,9 +510,8 @@ async function createRawResource(
                 niceId,
                 orgId,
                 name,
-                http,
-                protocol,
-                proxyPort
+                proxyPort,
+                mode: resolvedMode.mode
                 // enableProxy
             })
             .returning();

server/routers/resource/listResources.ts

@@ -137,8 +137,6 @@ export type ResourceWithTargets = {
     sso: boolean;
     pincodeId: number | null;
     whitelist: boolean;
-    http: boolean;
-    protocol: string;
     proxyPort: number | null;
     enabled: boolean;
     domainId: string | null;
@@ -146,7 +144,7 @@ export type ResourceWithTargets = {
     headerAuthId: number | null;
     wildcard: boolean;
     health: string | null;
-    browserAccessType: string | null;
+    mode: string | null;
     targets: Array<{
         targetId: number;
         ip: string;
@@ -175,8 +173,6 @@ function queryResourcesBase() {
             sso: resources.sso,
             pincodeId: resourcePincode.pincodeId,
             whitelist: resources.emailWhitelistEnabled,
-            http: resources.http,
-            protocol: resources.protocol,
             proxyPort: resources.proxyPort,
             enabled: resources.enabled,
             domainId: resources.domainId,
@@ -186,7 +182,7 @@ function queryResourcesBase() {
             headerAuthExtendedCompatibilityId:
                 resourceHeaderAuthExtendedCompatibility.headerAuthExtendedCompatibilityId,
             health: resources.health,
-            browserAccessType: resources.browserAccessType
+            mode: resources.mode
         })
         .from(resources)
         .leftJoin(
@@ -346,7 +342,9 @@ export async function listResources(
         if (typeof authState !== "undefined") {
             switch (authState) {
                 case "none":
-                    conditions.push(eq(resources.http, false));
+                    conditions.push(
+                        or(eq(resources.mode, "tcp"), eq(resources.mode, "udp"))
+                    );
                     break;
                 case "protected":
                     conditions.push(
@@ -525,11 +523,9 @@ export async function listResources(
                     sso: row.sso,
                     pincodeId: row.pincodeId,
                     whitelist: row.whitelist,
-                    http: row.http,
-                    protocol: row.protocol,
                     proxyPort: row.proxyPort,
                     wildcard: row.wildcard,
-                    browserAccessType: row.browserAccessType,
+                    mode: row.mode,
                     enabled: row.enabled,
                     domainId: row.domainId,
                     headerAuthId: row.headerAuthId,

server/routers/resource/updateResource.ts

@@ -72,7 +72,6 @@ const updateHttpResourceBodySchema = z
         maintenanceMessage: z.string().max(2000).nullable().optional(),
         maintenanceEstimatedTime: z.string().max(100).nullable().optional(),
         postAuthPath: z.string().nullable().optional(),
-        browserAccessType: z.enum(["http", "ssh", "rdp", "vnc"]).optional(),
         // SSH settings
         pamMode: z.enum(["passthrough", "push"]).optional(),
         authDaemonMode: z.enum(["site", "remote", "native"]).optional(),

server/routers/siteResource/createSiteResource.ts

@@ -44,14 +44,14 @@ const createSiteResourceSchema = z
         name: z.string().min(1).max(255),
         niceId: z.string().optional(),
         // protocol: z.enum(["tcp", "udp"]).optional(),
-        mode: z.enum(["host", "cidr", "http"]),
+        mode: z.enum(["host", "cidr", "http", "ssh"]),
         ssl: z.boolean().optional(), // only used for http mode
         scheme: z.enum(["http", "https"]).optional(),
         siteIds: z.array(z.int()).optional(),
         siteId: z.number().int().positive().optional(), // DEPRECATED: for backward compatibility, we will convert this to siteIds array if provided
         // proxyPort: z.int().positive().optional(),
         destinationPort: z.int().positive().optional(),
-        destination: z.string().min(1),
+        destination: z.string().min(1).optional(),
         enabled: z.boolean().default(true),
         alias: z
             .string()
@@ -67,7 +67,7 @@ const createSiteResourceSchema = z
         udpPortRangeString: portRangeStringSchema,
         disableIcmp: z.boolean().optional(),
         authDaemonPort: z.int().positive().optional(),
-        authDaemonMode: z.enum(["site", "remote"]).optional(),
+        authDaemonMode: z.enum(["site", "remote", "native"]).optional(),
         pamMode: z.enum(["passthrough", "push"]).optional(),
         domainId: z.string().optional(), // only used for http mode, we need this to verify the alias is unique within the org
         subdomain: z.string().optional() // only used for http mode, we need this to verify the alias is unique within the org
@@ -75,7 +75,10 @@ const createSiteResourceSchema = z
     .strict()
     .refine(
         (data) => {
-            if (data.mode === "host") {
+            if (
+                (data.mode === "host" || data.mode === "ssh") &&
+                data.destination
+            ) {
                 // Check if it's a valid IP address using zod (v4 or v6)
                 const isValidIP = z
                     // .union([z.ipv4(), z.ipv6()])
@@ -117,19 +120,45 @@ const createSiteResourceSchema = z
     )
     .refine(
         (data) => {
-            if (data.mode !== "http") return true;
-            return (
-                data.scheme !== undefined &&
-                data.destinationPort !== undefined &&
-                data.destinationPort >= 1 &&
-                data.destinationPort <= 65535
-            );
+            if (data.mode === "http") {
+                return (
+                    data.scheme !== undefined &&
+                    data.scheme !== null &&
+                    data.destinationPort !== undefined &&
+                    data.destinationPort !== null &&
+                    data.destinationPort >= 1 &&
+                    data.destinationPort <= 65535
+                );
+            } else if (data.mode === "ssh") {
+                // just check the destinationPort
+                return (
+                    data.destinationPort === undefined ||
+                    (data.destinationPort !== null &&
+                        data.destinationPort >= 1 &&
+                        data.destinationPort <= 65535)
+                );
+            }
         },
         {
             message:
                 "HTTP mode requires scheme (http or https) and a valid destination port"
         }
     )
+    .refine(
+        (data) => {
+            // destination is only optional for ssh mode with native authDaemonMode
+            if (data.mode === "ssh" && data.authDaemonMode === "native") {
+                return true;
+            }
+            return (
+                data.destination !== undefined && data.destination.trim() !== ""
+            );
+        },
+        {
+            message:
+                "Destination is required unless mode is ssh with authDaemonMode native"
+        }
+    )
     .refine(
         (data) => {
             return (
@@ -213,6 +242,7 @@ export async function createSiteResource(
             disableIcmp,
             authDaemonPort,
             authDaemonMode,
+            pamMode,
             domainId,
             subdomain
         } = parsedBody.data;
@@ -277,8 +307,8 @@ export async function createSiteResource(
             .safeParse(destination).success;
         if (
             isIp &&
-            (isIpInCidr(destination, org.subnet) ||
-                isIpInCidr(destination, org.utilitySubnet))
+            (isIpInCidr(destination!, org.subnet) ||
+                isIpInCidr(destination!, org.utilitySubnet))
         ) {
             return next(
                 createHttpError(
@@ -390,6 +420,15 @@ export async function createSiteResource(
                 );
             }
 
+            let tcpPortRangeStringAdjusted = tcpPortRangeString;
+            if (mode === "http") {
+                tcpPortRangeStringAdjusted = "443,80";
+            } else if (mode === "ssh") {
+                tcpPortRangeStringAdjusted = destinationPort
+                    ? destinationPort.toString()
+                    : "22";
+            }
+
             // Create the site resource
             const insertValues: typeof siteResources.$inferInsert = {
                 niceId: updatedNiceId!,
@@ -398,16 +437,18 @@ export async function createSiteResource(
                 mode,
                 ssl,
                 networkId: network.networkId,
-                destination,
+                destination: destination, // the ssh can be null
                 scheme,
                 destinationPort,
                 enabled,
                 alias: alias ? alias.trim() : null,
                 aliasAddress,
-                tcpPortRangeString:
-                    mode == "http" ? "443,80" : tcpPortRangeString,
-                udpPortRangeString: mode == "http" ? "" : udpPortRangeString,
-                disableIcmp: disableIcmp || (mode == "http" ? true : false), // default to true for http resources, otherwise false
+                tcpPortRangeString: tcpPortRangeStringAdjusted,
+                udpPortRangeString:
+                    mode == "http" || mode == "ssh" ? "" : udpPortRangeString,
+                disableIcmp:
+                    disableIcmp ||
+                    (mode == "http" || mode == "ssh" ? true : false), // default to true for http resources, otherwise false
                 domainId,
                 subdomain: finalSubdomain,
                 fullDomain
@@ -417,6 +458,7 @@ export async function createSiteResource(
                     insertValues.authDaemonPort = authDaemonPort;
                 if (authDaemonMode !== undefined)
                     insertValues.authDaemonMode = authDaemonMode;
+                if (pamMode !== undefined) insertValues.pamMode = pamMode;
             }
             [newSiteResource] = await trx
                 .insert(siteResources)

server/routers/siteResource/updateSiteResource.ts

@@ -56,7 +56,7 @@ const updateSiteResourceSchema = z
             )
             .optional(),
         // mode: z.enum(["host", "cidr", "port"]).optional(),
-        mode: z.enum(["host", "cidr", "http"]).optional(),
+        mode: z.enum(["host", "cidr", "http", "ssh"]).optional(),
         ssl: z.boolean().optional(),
         scheme: z.enum(["http", "https"]).nullish(),
         // proxyPort: z.int().positive().nullish(),
@@ -77,14 +77,18 @@ const updateSiteResourceSchema = z
         udpPortRangeString: portRangeStringSchema,
         disableIcmp: z.boolean().optional(),
         authDaemonPort: z.int().positive().nullish(),
-        authDaemonMode: z.enum(["site", "remote"]).optional(),
+        authDaemonMode: z.enum(["site", "remote", "native"]).optional(),
+        pamMode: z.enum(["passthrough", "push"]).optional(),
         domainId: z.string().optional(),
         subdomain: z.string().optional()
     })
     .strict()
     .refine(
         (data) => {
-            if (data.mode === "host" && data.destination) {
+            if (
+                (data.mode === "host" || data.mode == "ssh") &&
+                data.destination
+            ) {
                 const isValidIP = z
                     // .union([z.ipv4(), z.ipv6()])
                     .union([z.ipv4()]) // for now lets just do ipv4 until we verify ipv6 works everywhere
@@ -125,21 +129,45 @@ const updateSiteResourceSchema = z
     )
     .refine(
         (data) => {
-            if (data.mode !== "http") return true;
-            return (
-                data.scheme !== undefined &&
-                data.scheme !== null &&
-                data.destinationPort !== undefined &&
-                data.destinationPort !== null &&
-                data.destinationPort >= 1 &&
-                data.destinationPort <= 65535
-            );
+            if (data.mode === "http") {
+                return (
+                    data.scheme !== undefined &&
+                    data.scheme !== null &&
+                    data.destinationPort !== undefined &&
+                    data.destinationPort !== null &&
+                    data.destinationPort >= 1 &&
+                    data.destinationPort <= 65535
+                );
+            } else if (data.mode === "ssh") {
+                // just check the destinationPort
+                return (
+                    data.destinationPort === undefined ||
+                    (data.destinationPort !== null &&
+                        data.destinationPort >= 1 &&
+                        data.destinationPort <= 65535)
+                );
+            }
         },
         {
             message:
                 "HTTP mode requires scheme (http or https) and a valid destination port"
         }
     )
+    .refine(
+        (data) => {
+            // destination is only optional for ssh mode with native authDaemonMode
+            if (data.mode === "ssh" && data.authDaemonMode === "native") {
+                return true;
+            }
+            return (
+                data.destination !== undefined && data.destination.trim() !== ""
+            );
+        },
+        {
+            message:
+                "Destination is required unless mode is ssh with authDaemonMode native"
+        }
+    )
     .refine(
         (data) => {
             return (
@@ -222,6 +250,7 @@ export async function updateSiteResource(
             disableIcmp,
             authDaemonPort,
             authDaemonMode,
+            pamMode,
             domainId,
             subdomain
         } = parsedBody.data;
@@ -430,16 +459,30 @@ export async function updateSiteResource(
                 const sshPamSet =
                     isLicensedSshPam &&
                     (authDaemonPort !== undefined ||
-                        authDaemonMode !== undefined)
+                        authDaemonMode !== undefined ||
+                        pamMode !== undefined)
                         ? {
                               ...(authDaemonPort !== undefined && {
                                   authDaemonPort
                               }),
                               ...(authDaemonMode !== undefined && {
                                   authDaemonMode
+                              }),
+                              ...(pamMode !== undefined && {
+                                  pamMode
                               })
                           }
                         : {};
+
+                let tcpPortRangeStringAdjusted = tcpPortRangeString;
+                if (mode === "http") {
+                    tcpPortRangeStringAdjusted = "443,80";
+                } else if (mode === "ssh") {
+                    tcpPortRangeStringAdjusted = destinationPort
+                        ? destinationPort.toString()
+                        : "22";
+                }
+
                 [updatedSiteResource] = await trx
                     .update(siteResources)
                     .set({
@@ -452,12 +495,14 @@ export async function updateSiteResource(
                         destinationPort,
                         enabled,
                         alias: alias ? alias.trim() : null,
-                        tcpPortRangeString:
-                            mode == "http" ? "443,80" : tcpPortRangeString,
+                        tcpPortRangeString: tcpPortRangeStringAdjusted,
                         udpPortRangeString:
-                            mode == "http" ? "" : udpPortRangeString,
+                            mode == "http" || mode == "ssh"
+                                ? ""
+                                : udpPortRangeString,
                         disableIcmp:
-                            disableIcmp || (mode == "http" ? true : false), // default to true for http resources, otherwise false
+                            disableIcmp ||
+                            (mode == "http" || mode == "ssh" ? true : false), // default to true for http resources, otherwise false
                         domainId,
                         subdomain: finalSubdomain,
                         fullDomain,
@@ -554,13 +599,17 @@ export async function updateSiteResource(
                 const sshPamSet =
                     isLicensedSshPam &&
                     (authDaemonPort !== undefined ||
-                        authDaemonMode !== undefined)
+                        authDaemonMode !== undefined ||
+                        pamMode !== undefined)
                         ? {
                               ...(authDaemonPort !== undefined && {
                                   authDaemonPort
                               }),
                               ...(authDaemonMode !== undefined && {
                                   authDaemonMode
+                              }),
+                              ...(pamMode !== undefined && {
+                                  pamMode
                               })
                           }
                         : {};
@@ -832,6 +881,10 @@ export async function handleMessagingForUpdatedSiteResource(
             for (const client of mergedAllClients) {
                 // does this client have access to another resource on this site that has the same destination still? if so we dont want to remove it from their olm yet
                 // todo: optimize this query if needed
+                if (!existingSiteResource.destination) {
+                    continue;
+                }
+
                 const oldDestinationStillInUseSites = await trx
                     .select()
                     .from(siteResources)

src/app/[orgId]/settings/resources/client/page.tsx

@@ -56,7 +56,9 @@ export default async function ClientResourcesPage(
         pagination = responseData.pagination;
     } catch (e) {}
 
-    const siteIdParam = parsePositiveInt(searchParams.get("siteId") ?? undefined);
+    const siteIdParam = parsePositiveInt(
+        searchParams.get("siteId") ?? undefined
+    );
 
     let initialFilterSite: {
         siteId: number;
@@ -106,7 +108,10 @@ export default async function ClientResourcesPage(
                     siteNiceId: siteResource.siteNiceIds[idx],
                     online: siteResource.siteOnlines[idx]
                 })),
-                mode: siteResource.mode,
+                mode:
+                    siteResource.pamMode && siteResource.mode === "host"
+                        ? "ssh"
+                        : siteResource.mode,
                 scheme: siteResource.scheme,
                 ssl: siteResource.ssl,
                 siteNames: siteResource.siteNames,
@@ -115,7 +120,7 @@ export default async function ClientResourcesPage(
                 // proxyPort: siteResource.proxyPort,
                 siteIds: siteResource.siteIds,
                 destination: siteResource.destination,
-                httpHttpsPort: siteResource.destinationPort ?? null,
+                destinationPort: siteResource.destinationPort ?? null,
                 alias: siteResource.alias || null,
                 aliasAddress: siteResource.aliasAddress || null,
                 siteNiceIds: siteResource.siteNiceIds,
@@ -125,6 +130,7 @@ export default async function ClientResourcesPage(
                 disableIcmp: siteResource.disableIcmp || false,
                 authDaemonMode: siteResource.authDaemonMode ?? null,
                 authDaemonPort: siteResource.authDaemonPort ?? null,
+                pamMode: siteResource.pamMode ?? null,
                 subdomain: siteResource.subdomain ?? null,
                 domainId: siteResource.domainId ?? null,
                 fullDomain: siteResource.fullDomain ?? null,

src/app/[orgId]/settings/resources/proxy/[niceId]/general/page.tsx

@@ -559,7 +559,7 @@ export default function GeneralForm() {
             <SettingsContainer>
                 {resource?.resourceId &&
                     resource?.orgId &&
-                    resource.browserAccessType == "http" && (
+                    resource.mode == "http" && (
                         <UptimeAlertSection
                             orgId={resource.orgId}
                             resourceId={resource.resourceId}

src/app/[orgId]/settings/resources/proxy/[niceId]/layout.tsx

@@ -86,8 +86,8 @@ export default async function ResourceLayout(props: ResourceLayoutProps) {
             href: `/{orgId}/settings/resources/proxy/{niceId}/general`
         },
         {
-            title: t(`${resource.browserAccessType}Settings`),
-            href: `/{orgId}/settings/resources/proxy/{niceId}/${resource.browserAccessType}`
+            title: t(`${resource.mode}Settings`),
+            href: `/{orgId}/settings/resources/proxy/{niceId}/${resource.mode}`
         }
     ];
 

src/app/[orgId]/settings/resources/proxy/[niceId]/rules/page.tsx

@@ -149,10 +149,7 @@ export default function ResourceRules(props: {
         resolver: zodResolver(addRuleSchema),
         defaultValues: {
             action: "ACCEPT",
-            match:
-                resource.http && resource.browserAccessType == "http"
-                    ? "PATH"
-                    : "IP",
+            match: resource.http && resource.mode == "http" ? "PATH" : "IP",
             value: ""
         }
     });
@@ -580,12 +577,11 @@ export default function ResourceRules(props: {
                         <SelectValue />
                     </SelectTrigger>
                     <SelectContent>
-                        {resource.http &&
-                            resource.browserAccessType == "http" && (
-                                <SelectItem value="PATH">
-                                    {RuleMatch.PATH}
-                                </SelectItem>
-                            )}
+                        {resource.http && resource.mode == "http" && (
+                            <SelectItem value="PATH">
+                                {RuleMatch.PATH}
+                            </SelectItem>
+                        )}
                         <SelectItem value="IP">{RuleMatch.IP}</SelectItem>
                         <SelectItem value="CIDR">{RuleMatch.CIDR}</SelectItem>
                         {isMaxmindAvailable && (
@@ -1042,7 +1038,7 @@ export default function ResourceRules(props: {
                                                         </SelectTrigger>
                                                         <SelectContent>
                                                             {resource.http &&
-                                                                resource.browserAccessType ==
+                                                                resource.mode ==
                                                                     "http" && (
                                                                     <SelectItem value="PATH">
                                                                         {

src/app/[orgId]/settings/resources/proxy/create/page.tsx

@@ -423,7 +423,7 @@ export default function Page() {
                         : undefined,
                     domainId: httpData.domainId,
                     protocol: "tcp",
-                    browserAccessType: resourceType,
+                    mode: resourceType,
                     pamMode,
                     authDaemonMode: effectiveMode,
                     authDaemonPort: effectivePort

src/app/[orgId]/settings/resources/proxy/page.tsx

@@ -126,7 +126,7 @@ export default async function ProxyResourcesPage(
             fullDomain: resource.fullDomain ?? null,
             ssl: resource.ssl,
             wildcard: resource.wildcard,
-            browserAccessType: resource.browserAccessType,
+            mode: resource.mode,
             targets: resource.targets?.map((target) => ({
                 targetId: target.targetId,
                 ip: target.ip,

src/app/rdp/page.tsx

@@ -15,7 +15,7 @@ export default async function RdpPage() {
     const host = headersList.get("host") || "";
     const hostname = host.split(":")[0];
 
-    let target: { ip: string; port: number; authToken: string } | null = null;
+    let target: GetBrowserTargetResponse | null = null;
     let error: string | null = null;
 
     try {

src/components/ClientResourcesTable.tsx

@@ -77,21 +77,22 @@ export type InternalResourceRow = {
     siteIds: number[];
     siteNiceIds: string[];
     // mode: "host" | "cidr" | "port";
-    mode: "host" | "cidr" | "http";
+    mode: "host" | "cidr" | "http" | "ssh";
     scheme: "http" | "https" | null;
     ssl: boolean;
     // protocol: string | null;
     // proxyPort: number | null;
-    destination: string;
-    httpHttpsPort: number | null;
+    destination: string | null;
+    destinationPort: number | null;
     alias: string | null;
     aliasAddress: string | null;
     niceId: string;
     tcpPortRangeString: string | null;
     udpPortRangeString: string | null;
     disableIcmp: boolean;
-    authDaemonMode?: "site" | "remote" | null;
+    authDaemonMode?: "site" | "remote" | "native" | null;
     authDaemonPort?: number | null;
+    pamMode?: "passthrough" | "push" | null;
     subdomain?: string | null;
     domainId?: string | null;
     fullDomain?: string | null;
@@ -106,7 +107,7 @@ function formatDestinationDisplay(row: InternalResourceRow): string {
     return formatSiteResourceDestinationDisplay({
         mode: row.mode,
         destination: row.destination,
-        httpHttpsPort: row.httpHttpsPort,
+        destinationPort: row.destinationPort,
         scheme: row.scheme
     });
 }
@@ -410,6 +411,10 @@ export default function ClientResourcesTable({
                             {
                                 value: "http",
                                 label: t("editInternalResourceDialogModeHttp")
+                            },
+                            {
+                                value: "ssh",
+                                label: t("editInternalResourceDialogModeSsh")
                             }
                         ]}
                         selectedValue={searchParams.get("mode") ?? undefined}
@@ -425,13 +430,14 @@ export default function ClientResourcesTable({
                 cell: ({ row }) => {
                     const resourceRow = row.original;
                     const modeLabels: Record<
-                        "host" | "cidr" | "port" | "http",
+                        "host" | "cidr" | "port" | "http" | "ssh",
                         string
                     > = {
                         host: t("editInternalResourceDialogModeHost"),
                         cidr: t("editInternalResourceDialogModeCidr"),
                         port: t("editInternalResourceDialogModePort"),
-                        http: t("editInternalResourceDialogModeHttp")
+                        http: t("editInternalResourceDialogModeHttp"),
+                        ssh: t("editInternalResourceDialogModeSsh")
                     };
                     return <span>{modeLabels[resourceRow.mode]}</span>;
                 }

src/components/CreateInternalResourceDialog.tsx

@@ -47,31 +47,36 @@ export default function CreateInternalResourceDialog({
             try {
                 let data = { ...values };
                 if (
-                    (data.mode === "host" || data.mode === "http") &&
+                    (data.mode === "host" ||
+                        data.mode === "http" ||
+                        data.mode === "ssh") &&
                     isHostname(data.destination)
                 ) {
                     const currentAlias = data.alias?.trim() || "";
                     if (!currentAlias) {
                         let aliasValue = data.destination;
-                        if (data.destination.toLowerCase() === "localhost") {
+                        if (data.destination?.toLowerCase() === "localhost") {
                             aliasValue = `${cleanForFQDN(data.name)}.internal`;
                         }
                         data = { ...data, alias: aliasValue };
                     }
                 }
 
+                // "ssh" mode maps to "host" in the backend with SSH settings
+                const backendMode = data.mode === "ssh" ? "host" : data.mode;
+
                 await api.put<
                     AxiosResponse<{ data: { siteResourceId: number } }>
                 >(`/org/${orgId}/site-resource`, {
                     name: data.name,
                     siteIds: data.siteIds,
-                    mode: data.mode,
+                    mode: backendMode,
                     destination: data.destination,
                     enabled: true,
                     ...(data.mode === "http" && {
                         scheme: data.scheme,
                         ssl: data.ssl ?? false,
-                        destinationPort: data.httpHttpsPort ?? undefined,
+                        destinationPort: data.destinationPort ?? undefined,
                         domainId: data.httpConfigDomainId
                             ? data.httpConfigDomainId
                             : undefined,
@@ -94,7 +99,25 @@ export default function CreateInternalResourceDialog({
                                 authDaemonPort: data.authDaemonPort
                             })
                     }),
-                    ...((data.mode === "host" || data.mode == "cidr") && {
+                    ...(data.mode === "ssh" && {
+                        alias:
+                            data.alias &&
+                            typeof data.alias === "string" &&
+                            data.alias.trim()
+                                ? data.alias
+                                : undefined,
+                        pamMode: data.pamMode ?? undefined,
+                        ...(data.authDaemonMode != null && {
+                            authDaemonMode: data.authDaemonMode
+                        }),
+                        ...(data.authDaemonMode === "remote" &&
+                            data.authDaemonPort != null && {
+                                authDaemonPort: data.authDaemonPort
+                            })
+                    }),
+                    ...((data.mode === "host" ||
+                        data.mode === "ssh" ||
+                        data.mode === "cidr") && {
                         tcpPortRangeString: data.tcpPortRangeString,
                         udpPortRangeString: data.udpPortRangeString,
                         disableIcmp: data.disableIcmp ?? false

src/components/EditInternalResourceDialog.tsx

@@ -51,29 +51,34 @@ export default function EditInternalResourceDialog({
         try {
             let data = { ...values };
             if (
-                (data.mode === "host" || data.mode === "http") &&
+                (data.mode === "host" ||
+                    data.mode === "http" ||
+                    data.mode === "ssh") &&
                 isHostname(data.destination)
             ) {
                 const currentAlias = data.alias?.trim() || "";
                 if (!currentAlias) {
                     let aliasValue = data.destination;
-                    if (data.destination.toLowerCase() === "localhost") {
+                    if (data.destination?.toLowerCase() === "localhost") {
                         aliasValue = `${cleanForFQDN(data.name)}.internal`;
                     }
                     data = { ...data, alias: aliasValue };
                 }
             }
 
+            // "ssh" mode maps to "host" in the backend with SSH settings
+            const backendMode = data.mode === "ssh" ? "host" : data.mode;
+
             await api.post(`/site-resource/${resource.id}`, {
                 name: data.name,
                 siteIds: data.siteIds,
-                mode: data.mode,
+                mode: backendMode,
                 niceId: data.niceId,
                 destination: data.destination,
                 ...(data.mode === "http" && {
                     scheme: data.scheme,
                     ssl: data.ssl ?? false,
-                    destinationPort: data.httpHttpsPort ?? null,
+                    destinationPort: data.destinationPort ?? null,
                     domainId: data.httpConfigDomainId
                         ? data.httpConfigDomainId
                         : undefined,
@@ -95,7 +100,24 @@ export default function EditInternalResourceDialog({
                         authDaemonPort: data.authDaemonPort || null
                     })
                 }),
-                ...((data.mode === "host" || data.mode === "cidr") && {
+                ...(data.mode === "ssh" && {
+                    alias:
+                        data.alias &&
+                        typeof data.alias === "string" &&
+                        data.alias.trim()
+                            ? data.alias
+                            : null,
+                    pamMode: data.pamMode ?? undefined,
+                    ...(data.authDaemonMode != null && {
+                        authDaemonMode: data.authDaemonMode
+                    }),
+                    ...(data.authDaemonMode === "remote" && {
+                        authDaemonPort: data.authDaemonPort || null
+                    })
+                }),
+                ...((data.mode === "host" ||
+                    data.mode === "ssh" ||
+                    data.mode === "cidr") && {
                     tcpPortRangeString: data.tcpPortRangeString,
                     udpPortRangeString: data.udpPortRangeString,
                     disableIcmp: data.disableIcmp ?? false

src/components/ProxyResourcesTable.tsx

@@ -88,7 +88,7 @@ export type ResourceRow = {
     name: string;
     orgId: string;
     domain: string;
-    browserAccessType: string | null;
+    mode: string | null;
     authState: string;
     http: boolean;
     protocol: string;
@@ -412,10 +412,7 @@ export default function ProxyResourcesTable({
                 ),
                 cell: ({ row }) => {
                     const resourceRow = row.original;
-                    if (
-                        !resourceRow.http ||
-                        resourceRow.browserAccessType !== "http"
-                    ) {
+                    if (!resourceRow.http || resourceRow.mode !== "http") {
                         return <span>-</span>;
                     }
                     return (
@@ -446,10 +443,7 @@ export default function ProxyResourcesTable({
                 header: () => <span className="p-3">{t("uptime30d")}</span>,
                 cell: ({ row }) => {
                     const resourceRow = row.original;
-                    if (
-                        !resourceRow.http ||
-                        resourceRow.browserAccessType !== "http"
-                    ) {
+                    if (!resourceRow.http || resourceRow.mode !== "http") {
                         return <span>-</span>;
                     }
                     return (

src/components/ResourceInfoBox.tsx

@@ -36,9 +36,9 @@ export default function ResourceInfoBox({}: ResourceInfoBoxType) {
         resource.fullDomain &&
         build != "oss"
     );
-    const showType = !!(resource.http && resource.browserAccessType);
+    const showType = !!(resource.http && resource.mode);
     const showHealth =
-        !["ssh", "rdp", "vnc"].includes(resource.browserAccessType || "") &&
+        !["ssh", "rdp", "vnc"].includes(resource.mode || "") &&
         !!resource.health &&
         resource.health !== "unknown";
     const showVisibility = !resource.enabled;
@@ -88,7 +88,7 @@ export default function ResourceInfoBox({}: ResourceInfoBoxType) {
                                     </InfoSectionTitle>
                                     <InfoSectionContent>
                                         <span className="inline-flex items-center">
-                                            {resource.browserAccessType!.toUpperCase()}
+                                            {resource.mode!.toUpperCase()}
                                         </span>
                                     </InfoSectionContent>
                                 </InfoSection>

src/components/SiteResourcesOverview.tsx

@@ -68,12 +68,13 @@ function PrivateResourceMeta({ row }: { row: SiteResourceRow }) {
     const modeLabel: Record<SiteResourceRow["mode"], string> = {
         host: t("editInternalResourceDialogModeHost"),
         cidr: t("editInternalResourceDialogModeCidr"),
-        http: t("editInternalResourceDialogModeHttp")
+        http: t("editInternalResourceDialogModeHttp"),
+        ssh: t("editInternalResourceDialogModeSsh")
     };
     const dest = formatSiteResourceDestinationDisplay({
         mode: row.mode,
         destination: row.destination,
-        httpHttpsPort: row.destinationPort ?? null,
+        destinationPort: row.destinationPort ?? null,
         scheme: row.scheme
     });
     return (
@@ -149,7 +150,7 @@ function PrivateAccessMethod({ row }: { row: SiteResourceRow }) {
     const dest = formatSiteResourceDestinationDisplay({
         mode: row.mode,
         destination: row.destination,
-        httpHttpsPort: row.destinationPort,
+        destinationPort: row.destinationPort,
         scheme: row.scheme
     });
     return (

src/lib/formatSiteResourceAccess.ts

@@ -1,16 +1,16 @@
 export type SiteResourceDestinationInput = {
-    mode: "host" | "cidr" | "http";
-    destination: string;
-    httpHttpsPort: number | null;
+    mode: "host" | "cidr" | "http" | "ssh";
+    destination: string | null;
+    destinationPort: number | null;
     scheme: "http" | "https" | null;
 };
 
 export function resolveHttpHttpsDisplayPort(
     mode: "http",
-    httpHttpsPort: number | null
+    destinationPort: number | null
 ): number {
-    if (httpHttpsPort != null) {
-        return httpHttpsPort;
+    if (destinationPort != null) {
+        return destinationPort;
     }
     return 80;
 }
@@ -18,11 +18,14 @@ export function resolveHttpHttpsDisplayPort(
 export function formatSiteResourceDestinationDisplay(
     row: SiteResourceDestinationInput
 ): string {
-    const { mode, destination, httpHttpsPort, scheme } = row;
+    if (!row.destination) {
+        return "";
+    }
+    const { mode, destination, destinationPort, scheme } = row;
     if (mode !== "http") {
         return destination;
     }
-    const port = resolveHttpHttpsDisplayPort(mode, httpHttpsPort);
+    const port = resolveHttpHttpsDisplayPort(mode, destinationPort);
     const downstreamScheme = scheme ?? "http";
     const hostPart =
         destination.includes(":") && !destination.startsWith("[")