Make the destination optional

Add auth daemon to blueprints
Complete removal of http and protocol from public
2026-09-06 19:23:26 +02:00 · 2026-05-27 17:52:04 -07:00 · 2026-05-27 17:29:19 -07:00 · 2026-05-27 17:19:04 -07:00 · 2026-05-27 14:58:36 -07:00 · 2026-05-27 12:04:00 -07:00
186 changed files with 13329 additions and 9639 deletions
@@ -14,13 +14,12 @@ body:
          label: Environment
          description: Please fill out the relevant details below for your environment.
          value: |
-              - OS Type & Version:
+              - OS Type & Version: (e.g., Ubuntu 22.04)
              - Pangolin Version:
-              - Edition (Community or Enterprise):
              - Gerbil Version:
              - Traefik Version:
              - Newt Version:
-              - Client Version:
+              - Olm Version: (if applicable)
      validations:
          required: true

@@ -0,0 +1,110 @@
+git push origin -d 1.11.0-s.0
+git push origin -d 1.11.0-s.1
+git push origin -d 1.11.0-s.2
+git push origin -d 1.11.0-s.3
+git push origin -d 1.11.0-s.4
+git push origin -d 1.11.0-s.5
+git push origin -d 1.11.1-s.0
+git push origin -d 1.12.0-s.0
+git push origin -d 1.12.2-s.0
+git push origin -d 1.12.2-s.1
+git push origin -d 1.12.2-s.2
+git push origin -d 1.12.2-s.3
+git push origin -d 1.12.2-s.4
+git push origin -d 1.12.2-s.5
+git push origin -d 1.13.0.s.0
+git push origin -d 1.13.1-s.0
+git push origin -d 1.14.0-s.2
+git push origin -d 1.14.1-s.0
+git push origin -d 1.14.1-s.1
+git push origin -d 1.14.1-s.2
+git push origin -d 1.14.1-s.3
+git push origin -d 1.15.0-s.0
+git push origin -d 1.15.0-s.1
+git push origin -d 1.15.0-s.2
+git push origin -d 1.15.0-s.3
+git push origin -d 1.15.0-s.4
+git push origin -d 1.15.0-s.5
+git push origin -d 1.15.1-s.0
+git push origin -d 1.15.1-s.1
+git push origin -d 1.15.3-s.0
+git push origin -d 1.15.3-s.1
+git push origin -d 1.15.4-s.0
+git push origin -d 1.15.4-s.1
+git push origin -d 1.15.4-s.10
+git push origin -d 1.15.4-s.2
+git push origin -d 1.15.4-s.3
+git push origin -d 1.15.4-s.4
+git push origin -d 1.15.4-s.5
+git push origin -d 1.15.4-s.6
+git push origin -d 1.15.4-s.7
+git push origin -d 1.15.4-s.8
+git push origin -d 1.15.4-s.9
+git push origin -d 1.16.0-s.0
+git push origin -d 1.16.0-s.1
+git push origin -d 1.16.1-s.0
+git push origin -d 1.16.1-s.1
+git push origin -d 1.16.2-s.0
+git push origin -d 1.16.2-s.1
+git push origin -d 1.16.2-s.10
+git push origin -d 1.16.2-s.11
+git push origin -d 1.16.2-s.12
+git push origin -d 1.16.2-s.13
+git push origin -d 1.16.2-s.14
+git push origin -d 1.16.2-s.15
+git push origin -d 1.16.2-s.16
+git push origin -d 1.16.2-s.17
+git push origin -d 1.16.2-s.18
+git push origin -d 1.16.2-s.19
+git push origin -d 1.16.2-s.2
+git push origin -d 1.16.2-s.20
+git push origin -d 1.16.2-s.21
+git push origin -d 1.16.2-s.22
+git push origin -d 1.16.2-s.3
+git push origin -d 1.16.2-s.4
+git push origin -d 1.16.2-s.5
+git push origin -d 1.16.2-s.6
+git push origin -d 1.16.2-s.7
+git push origin -d 1.16.2-s.8
+git push origin -d 1.16.2-s.9
+git push origin -d 1.17.0-s.0
+git push origin -d 1.17.0-s.1
+git push origin -d 1.17.0-s.2
+git push origin -d 1.17.0-s.3
+git push origin -d 1.17.0-s.4
+git push origin -d 1.17.1-s.0
+git push origin -d 1.17.1-s.1
+git push origin -d 1.17.1-s.2
+git push origin -d 1.17.1-s.3
+git push origin -d 1.17.1-s.4
+git push origin -d 1.17.1-s.5
+git push origin -d 1.17.1-s.6
+git push origin -d 1.17.1-s.7
+git push origin -d 1.18.0-s.0
+git push origin -d 1.18.0-s.1
+git push origin -d 1.18.0-s.2
+git push origin -d 1.18.1-s.0
+git push origin -d 1.18.1-s.1
+git push origin -d 1.18.1-s.2
+git push origin -d 1.18.1-s.3
+git push origin -d 1.18.1-s.4
+git push origin -d 1.18.1-s.5
+git push origin -d 1.18.1-s.6
+git push origin -d 1.18.1-s.7
+git push origin -d 1.18.2-s.0
+git push origin -d 1.18.2-s.1
+git push origin -d 1.18.2-s.2
+git push origin -d 1.18.2-s.3
+git push origin -d 1.18.2-s.4
+git push origin -d 1.18.2-s.5
+git push origin -d 1.18.3-s.0
+git push origin -d 1.18.3-s.1
+git push origin -d 1.18.3-s.2
+git push origin -d 1.18.3-s.3
+git push origin -d 1.18.4-s.0
+git push origin -d 1.18.4-s.1
+git push origin -d 1.18.4-s.2
+git push origin -d 1.18.4-s.3
+git push origin -d 1.18.4-s.4
+git push origin -d 1.18.4-s.5
+git push origin -d 1.18.4-s.6
@@ -1,4 +1,4 @@
-import { APP_PATH } from "./server/lib/consts";
+import { APP_PATH } from "@server/lib/consts";
 import { defineConfig } from "drizzle-kit";
 import path from "path";

@@ -5,7 +5,7 @@ go 1.25.0
 require (
 	github.com/charmbracelet/huh v1.0.0
 	github.com/charmbracelet/lipgloss v1.1.0
-	golang.org/x/term v0.43.0
+	golang.org/x/term v0.42.0
 	gopkg.in/yaml.v3 v3.0.1
 )

@@ -33,6 +33,6 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
 	golang.org/x/text v0.23.0 // indirect
 )
@@ -69,10 +69,10 @@ golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
 golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
+golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Метод",
    "editInternalResourceDialogEnableSsl": "Активирайте TLS",
    "editInternalResourceDialogEnableSslDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целта.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Метод",
    "createInternalResourceDialogScheme": "Метод",
    "createInternalResourceDialogEnableSsl": "Активирайте TLS",
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Schéma",
    "editInternalResourceDialogEnableSsl": "Povolit SSL",
    "editInternalResourceDialogEnableSslDescription": "Povolit šifrování SSL/TLS pro zabezpečené HTTPS připojení k cíli.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Schéma",
    "createInternalResourceDialogScheme": "Schéma",
    "createInternalResourceDialogEnableSsl": "Povolit SSL",
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Schema",
    "editInternalResourceDialogEnableSsl": "TLS aktivieren",
    "editInternalResourceDialogEnableSslDescription": "SSL/TLS-Verschlüsselung für sichere HTTPS-Verbindungen zum Ziel aktivieren.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Schema",
    "createInternalResourceDialogScheme": "Schema",
    "createInternalResourceDialogEnableSsl": "TLS aktivieren",
@@ -220,8 +220,9 @@
    "resourceRawDescriptionCloud": "Proxy requests over raw TCP/UDP using a port number. Requires sites to connect to a remote node.",
    "resourceCreate": "Create Resource",
    "resourceCreateDescription": "Follow the steps below to create a new resource",
+    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
    "resourceSeeAll": "See All Resources",
-    "resourceInfo": "Resource Information",
+    "resourceCreateGeneral": "General",
    "resourceNameDescription": "This is the display name for the resource.",
    "siteSelect": "Select site",
    "siteSearch": "Search site",
@@ -231,12 +232,15 @@
    "noCountryFound": "No country found.",
    "siteSelectionDescription": "This site will provide connectivity to the target.",
    "resourceType": "Resource Type",
-    "resourceTypeDescription": "Determine how to access the resource",
+    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
+    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
    "resourceHTTPSSettings": "HTTPS Settings",
    "resourceHTTPSSettingsDescription": "Configure how the resource will be accessed over HTTPS",
+    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
    "domainType": "Domain Type",
    "subdomain": "Subdomain",
    "baseDomain": "Base Domain",
+    "configure": "Configure",
    "subdomnainDescription": "The subdomain where the resource will be accessible.",
    "resourceRawSettings": "TCP/UDP Settings",
    "resourceRawSettingsDescription": "Configure how the resource will be accessed over TCP/UDP",
@@ -1164,9 +1168,6 @@
    "siteLabelsDescription": "Manage labels associated with this site.",
    "labelsNotFound": "Labels not found",
    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
    "selectColor": "Select color",
    "createNewLabel": "Create new org label \"{label}\"",
    "inviteInvalidDescription": "The invite link is invalid.",
@@ -1354,29 +1355,6 @@
    "otpAuthBack": "Back to Password",
    "navbar": "Navigation Menu",
    "navbarDescription": "Main navigation menu for the application",
-    "commandPaletteTitle": "Command palette",
-    "commandPaletteDescription": "Search for pages, organizations, resources, and actions",
-    "commandPaletteSearchPlaceholder": "Search pages, resources, actions...",
-    "commandPaletteNoResults": "No results found.",
-    "commandPaletteSearching": "Searching...",
-    "commandPaletteNavigation": "Navigation",
-    "commandPaletteOrganizations": "Organizations",
-    "commandPaletteSites": "Sites",
-    "commandPaletteResources": "Resources",
-    "commandPaletteUsers": "Users",
-    "commandPaletteClients": "Machine clients",
-    "commandPaletteActions": "Actions",
-    "commandPaletteCreateSite": "Create site",
-    "commandPaletteCreateProxyResource": "Create public resource",
-    "commandPaletteCreateUser": "Create user",
-    "commandPaletteCreateApiKey": "Create API key",
-    "commandPaletteCreateMachineClient": "Create machine client",
-    "commandPaletteCreateAlertRule": "Create alert rule",
-    "commandPaletteCreateIdentityProvider": "Create identity provider",
-    "commandPaletteToggleTheme": "Toggle theme",
-    "commandPaletteChooseOrganization": "Choose organization",
-    "commandPaletteShortcutMac": "⌘K",
-    "commandPaletteShortcutWindows": "Ctrl K",
    "navbarDocsLink": "Documentation",
    "otpErrorEnable": "Unable to enable 2FA",
    "otpErrorEnableDescription": "An error occurred while enabling 2FA",
@@ -1672,7 +1650,6 @@
    "certificateStatus": "Certificate",
    "certificateStatusAutoRefreshHint": "Status refreshes automatically.",
    "loading": "Loading",
-    "loadingEllipsis": "Loading...",
    "loadingAnalytics": "Loading Analytics",
    "restart": "Restart",
    "domains": "Domains",
@@ -1899,6 +1876,7 @@
    "billingManageLicenseSubscription": "Manage your subscription for paid self-hosted license keys",
    "billingCurrentKeys": "Current Keys",
    "billingModifyCurrentPlan": "Modify Current Plan",
+    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
    "billingConfirmUpgrade": "Confirm Upgrade",
    "billingConfirmDowngrade": "Confirm Downgrade",
    "billingConfirmUpgradeDescription": "You are about to upgrade your plan. Review the new limits and pricing below.",
@@ -1996,7 +1974,36 @@
    "timeIsInSeconds": "Time is in seconds",
    "requireDeviceApproval": "Require Device Approvals",
    "requireDeviceApprovalDescription": "Users with this role need new devices approved by an admin before they can connect and access resources.",
-    "sshAccess": "SSH Access",
+    "sshSettings": "SSH Settings",
+    "rdpSettings": "RDP Settings",
+    "vncSettings": "VNC Settings",
+    "sshServer": "SSH Server",
+    "rdpServer": "RDP Server",
+    "vncServer": "VNC Server",
+    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
+    "rdpServerDescription": "Configure the destination and port of the RDP server",
+    "vncServerDescription": "Configure the destination and port of the VNC server",
+    "sshServerMode": "Mode",
+    "sshServerModeStandard": "Standard SSH Server",
+    "sshServerModePangolin": "Pangolin SSH",
+    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
+    "sshServerModeNative": "Native SSH Server",
+    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
+    "sshAuthenticationMethod": "Authentication Method",
+    "sshAuthMethodManual": "Manual Authentication",
+    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
+    "sshAuthMethodAutomated": "Automated Provisioning",
+    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
+    "sshAuthDaemonLocation": "Auth Daemon Location",
+    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
+    "sshDaemonLocationRemote": "On Remote Host",
+    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
+    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
+    "sshDaemonPort": "Daemon Port",
+    "sshServerDestination": "Server Destination",
+    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
+    "destination": "Destination",
+    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
    "roleAllowSsh": "Allow SSH",
    "roleAllowSshAllow": "Allow",
    "roleAllowSshDisallow": "Disallow",
@@ -2102,6 +2109,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Scheme",
    "editInternalResourceDialogEnableSsl": "Enable TLS",
    "editInternalResourceDialogEnableSslDescription": "Enable SSL/TLS encryption for secure HTTPS connections to the destination.",
@@ -2151,6 +2159,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Scheme",
    "createInternalResourceDialogScheme": "Scheme",
    "createInternalResourceDialogEnableSsl": "Enable TLS",
@@ -2990,7 +2999,7 @@
    "learnMore": "Learn more",
    "backToHome": "Go back to home",
    "needToSignInToOrg": "Need to use your organization's identity provider?",
-    "maintenanceMode": "Maintenance Mode",
+    "maintenanceMode": "Maintenance Page",
    "maintenanceModeDescription": "Display a maintenance page to visitors",
    "maintenanceModeType": "Maintenance Mode Type",
    "showMaintenancePage": "Show a maintenance page to visitors",
@@ -3020,6 +3029,7 @@
    "maintenanceScreenEstimatedCompletion": "Estimated Completion:",
    "createInternalResourceDialogDestinationRequired": "Destination is required",
    "available": "Available",
+    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
    "archived": "Archived",
    "noArchivedDevices": "No archived devices found",
    "deviceArchived": "Device archived",
@@ -3349,5 +3359,6 @@
    "memberPortalResourceDisabled": "Resource Disabled",
    "memberPortalShowingResources": "Showing {start}-{end} of {total} resources",
    "memberPortalPrevious": "Previous",
-    "memberPortalNext": "Next"
+    "memberPortalNext": "Next",
+    "httpSettings": "HTTP Settings"
 }
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Esquema",
    "editInternalResourceDialogEnableSsl": "Activar TLS",
    "editInternalResourceDialogEnableSslDescription": "Habilitar cifrado SSL/TLS para conexiones HTTPS seguras al destino.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Esquema",
    "createInternalResourceDialogScheme": "Esquema",
    "createInternalResourceDialogEnableSsl": "Activar TLS",
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Méthode HTTP",
    "editInternalResourceDialogEnableSsl": "Activer TLS",
    "editInternalResourceDialogEnableSslDescription": "Activer le cryptage SSL/TLS pour des connexions HTTPS sécurisées vers la destination.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Méthode HTTP",
    "createInternalResourceDialogScheme": "Méthode HTTP",
    "createInternalResourceDialogEnableSsl": "Activer TLS",
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Metodo HTTP",
    "editInternalResourceDialogEnableSsl": "Abilitare TLS",
    "editInternalResourceDialogEnableSslDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alla destinazione.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Metodo HTTP",
    "createInternalResourceDialogScheme": "Metodo HTTP",
    "createInternalResourceDialogEnableSsl": "Abilitare TLS",
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "스킴",
    "editInternalResourceDialogEnableSsl": "TLS 활성화",
    "editInternalResourceDialogEnableSslDescription": "목적지로의 안전한 HTTPS 연결을 위한 SSL/TLS 암호화 활성화.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "스킴",
    "createInternalResourceDialogScheme": "스킴",
    "createInternalResourceDialogEnableSsl": "TLS 활성화",
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Skjema",
    "editInternalResourceDialogEnableSsl": "Aktiver TLS",
    "editInternalResourceDialogEnableSslDescription": "Aktiver SSL/TLS-kryptering for sikre HTTPS-tilkoblinger til destinasjonen.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Skjema",
    "createInternalResourceDialogScheme": "Skjema",
    "createInternalResourceDialogEnableSsl": "Aktiver TLS",
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Schema",
    "editInternalResourceDialogEnableSsl": "TLS inschakelen",
    "editInternalResourceDialogEnableSslDescription": "Schakel SSL/TLS-encryptie in voor beveiligde HTTPS-verbindingen met de bestemming.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Schema",
    "createInternalResourceDialogScheme": "Schema",
    "createInternalResourceDialogEnableSsl": "TLS inschakelen",
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Schemat",
    "editInternalResourceDialogEnableSsl": "Włącz TLS",
    "editInternalResourceDialogEnableSslDescription": "Włącz szyfrowanie SSL/TLS dla bezpiecznych połączeń HTTPS z miejscem docelowym.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Schemat",
    "createInternalResourceDialogScheme": "Schemat",
    "createInternalResourceDialogEnableSsl": "Włącz TLS",
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Esquema",
    "editInternalResourceDialogEnableSsl": "Ativar TLS",
    "editInternalResourceDialogEnableSslDescription": "Ativar criptografia SSL/TLS para conexões HTTPS seguras com o destino.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Esquema",
    "createInternalResourceDialogScheme": "Esquema",
    "createInternalResourceDialogEnableSsl": "Ativar TLS",
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "СИДР",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Схема",
    "editInternalResourceDialogEnableSsl": "Включить TLS",
    "editInternalResourceDialogEnableSslDescription": "Включите шифрование SSL/TLS для защищенных HTTPS соединений с конечной точкой.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "СИДР",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Схема",
    "createInternalResourceDialogScheme": "Схема",
    "createInternalResourceDialogEnableSsl": "Включить TLS",
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "Şema",
    "editInternalResourceDialogEnableSsl": "TLS Etkinleştir",
    "editInternalResourceDialogEnableSslDescription": "Hedefe güvenli HTTPS bağlantıları için SSL/TLS şifrelemeyi etkinleştirin.",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "Şema",
    "createInternalResourceDialogScheme": "Şema",
    "createInternalResourceDialogEnableSsl": "TLS'yi Etkinleştir",
@@ -2049,6 +2049,7 @@
    "editInternalResourceDialogModeCidr": "CIDR",
    "editInternalResourceDialogModeHttp": "HTTP",
    "editInternalResourceDialogModeHttps": "HTTPS",
+    "editInternalResourceDialogModeSsh": "SSH",
    "editInternalResourceDialogScheme": "方案",
    "editInternalResourceDialogEnableSsl": "启用 TLS",
    "editInternalResourceDialogEnableSslDescription": "为目标的安全 HTTPS 连接启用 SSL/TLS 加密。",
@@ -2098,6 +2099,7 @@
    "createInternalResourceDialogModeCidr": "CIDR",
    "createInternalResourceDialogModeHttp": "HTTP",
    "createInternalResourceDialogModeHttps": "HTTPS",
+    "createInternalResourceDialogModeSsh": "SSH",
    "scheme": "方案",
    "createInternalResourceDialogScheme": "方案",
    "createInternalResourceDialogEnableSsl": "启用 TLS",
@@ -5,7 +5,13 @@ const withNextIntl = createNextIntlPlugin();

 const nextConfig: NextConfig = {
    reactStrictMode: false,
-    reactCompiler: true,
+    transpilePackages: ["@novnc/novnc"],
+    eslint: {
+        ignoreDuringBuilds: true
+    },
+    experimental: {
+        reactCompiler: true
+    },
    output: "standalone"
 };

@@ -32,13 +32,16 @@
        "format": "prettier --write ."
    },
    "dependencies": {
-        "@asteasolutions/zod-to-openapi": "8.5.0",
-        "@aws-sdk/client-s3": "3.1047.0",
-        "@faker-js/faker": "10.4.0",
-        "@headlessui/react": "2.2.10",
+        "@asteasolutions/zod-to-openapi": "8.4.1",
+        "@aws-sdk/client-s3": "3.1011.0",
+        "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
+        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
+        "@faker-js/faker": "10.3.0",
+        "@headlessui/react": "2.2.9",
        "@hookform/resolvers": "5.2.2",
        "@monaco-editor/react": "4.7.0",
        "@node-rs/argon2": "2.0.2",
+        "@novnc/novnc": "^1.7.0",
        "@oslojs/crypto": "1.0.1",
        "@oslojs/encoding": "1.1.0",
        "@radix-ui/react-avatar": "1.1.11",
@@ -59,17 +62,19 @@
        "@radix-ui/react-tabs": "1.1.13",
        "@radix-ui/react-toast": "1.2.15",
        "@radix-ui/react-tooltip": "1.2.8",
-        "@react-email/body": "0.3.0",
-        "@react-email/components": "1.0.12",
-        "@react-email/render": "2.0.8",
-        "@react-email/tailwind": "2.0.7",
+        "@react-email/components": "1.0.8",
+        "@react-email/render": "2.0.4",
+        "@react-email/tailwind": "2.0.5",
        "@simplewebauthn/browser": "13.3.0",
        "@simplewebauthn/server": "13.3.0",
        "@tailwindcss/forms": "0.5.11",
-        "@tanstack/react-query": "5.100.10",
+        "@tanstack/react-query": "5.90.21",
        "@tanstack/react-table": "8.21.3",
+        "@xterm/addon-fit": "^0.11.0",
+        "@xterm/addon-web-links": "^0.12.0",
+        "@xterm/xterm": "^6.0.0",
        "arctic": "3.7.0",
-        "axios": "1.16.1",
+        "axios": "1.15.0",
        "better-sqlite3": "11.9.1",
        "canvas-confetti": "1.9.4",
        "class-variance-authority": "0.7.1",
@@ -81,76 +86,76 @@
        "d3": "7.9.0",
        "drizzle-orm": "0.45.2",
        "express": "5.2.1",
-        "express-rate-limit": "8.5.2",
+        "express-rate-limit": "8.3.0",
        "glob": "13.0.6",
        "helmet": "8.1.0",
        "http-errors": "2.0.1",
        "input-otp": "1.4.2",
-        "ioredis": "5.10.1",
+        "ioredis": "5.10.0",
        "jmespath": "0.16.0",
        "js-yaml": "4.1.1",
        "jsonwebtoken": "9.0.3",
        "lucide-react": "0.577.0",
-        "maxmind": "5.0.6",
+        "maxmind": "5.0.5",
        "moment": "2.30.1",
-        "next": "16.2.6",
-        "next-intl": "4.12.0",
+        "next": "15.5.15",
+        "next-intl": "4.8.3",
        "next-themes": "0.4.6",
        "nextjs-toploader": "3.9.17",
        "node-cache": "5.1.2",
-        "nodemailer": "8.0.7",
+        "nodemailer": "8.0.5",
        "oslo": "1.2.1",
        "pg": "8.20.0",
-        "posthog-node": "5.34.1",
+        "posthog-node": "5.28.0",
        "qrcode.react": "4.2.0",
-        "react": "19.2.6",
+        "react": "19.2.4",
        "react-day-picker": "9.14.0",
-        "react-dom": "19.2.6",
+        "react-dom": "19.2.4",
        "react-easy-sort": "1.8.0",
-        "react-hook-form": "7.75.0",
+        "react-hook-form": "7.71.2",
        "react-icons": "5.6.0",
-        "recharts": "3.8.1",
+        "recharts": "2.15.4",
        "reodotdev": "1.1.0",
-        "resend": "6.12.3",
-        "semver": "7.8.0",
+        "resend": "6.9.2",
+        "semver": "7.7.4",
        "sshpk": "1.18.0",
        "stripe": "20.4.1",
        "swagger-ui-express": "5.0.1",
-        "tailwind-merge": "3.6.0",
+        "tailwind-merge": "3.5.0",
        "topojson-client": "3.1.0",
        "tw-animate-css": "1.4.0",
-        "use-debounce": "10.1.1",
-        "uuid": "14.0.0",
+        "use-debounce": "10.1.0",
+        "uuid": "13.0.0",
        "vaul": "1.1.2",
        "visionscarto-world-atlas": "1.0.0",
        "winston": "3.19.0",
        "winston-daily-rotate-file": "5.0.0",
-        "ws": "8.20.1",
-        "yaml": "2.9.0",
+        "ws": "8.19.0",
+        "yaml": "2.8.3",
        "yargs": "18.0.0",
-        "zod": "4.4.3",
+        "zod": "4.3.6",
        "zod-validation-error": "5.0.0"
    },
    "devDependencies": {
-        "@dotenvx/dotenvx": "1.66.0",
+        "@dotenvx/dotenvx": "1.54.1",
        "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/ui": "^6.1.4",
-        "@tailwindcss/postcss": "4.3.0",
-        "@tanstack/react-query-devtools": "5.100.10",
+        "@react-email/preview-server": "5.2.10",
+        "@tailwindcss/postcss": "4.2.2",
+        "@tanstack/react-query-devtools": "5.91.3",
        "@types/better-sqlite3": "7.6.13",
        "@types/cookie-parser": "1.4.10",
        "@types/cors": "2.8.19",
        "@types/crypto-js": "4.2.2",
        "@types/d3": "7.4.3",
        "@types/express": "5.0.6",
-        "@types/express-session": "1.19.0",
+        "@types/express-session": "1.18.2",
        "@types/jmespath": "0.15.2",
        "@types/js-yaml": "4.0.9",
        "@types/jsonwebtoken": "9.0.10",
-        "@types/node": "25.8.0",
-        "@types/nodemailer": "8.0.0",
+        "@types/node": "25.3.5",
+        "@types/nodemailer": "7.0.11",
        "@types/nprogress": "0.2.3",
-        "@types/pg": "8.20.0",
+        "@types/pg": "8.18.0",
        "@types/react": "19.2.14",
        "@types/react-dom": "19.2.3",
        "@types/semver": "7.7.1",
@@ -161,22 +166,21 @@
        "@types/yargs": "17.0.35",
        "babel-plugin-react-compiler": "1.0.0",
        "drizzle-kit": "0.31.10",
-        "esbuild": "0.28.0",
-        "esbuild-node-externals": "1.22.0",
-        "eslint": "10.3.0",
-        "eslint-config-next": "16.2.6",
-        "postcss": "8.5.14",
-        "prettier": "3.8.3",
-        "react-email": "6.1.4",
-        "tailwindcss": "4.3.0",
-        "tsc-alias": "1.8.17",
-        "tsx": "4.22.0",
-        "typescript": "6.0.3",
-        "typescript-eslint": "8.59.3"
+        "esbuild": "0.27.4",
+        "esbuild-node-externals": "1.20.1",
+        "eslint": "10.0.3",
+        "eslint-config-next": "16.1.7",
+        "postcss": "8.5.8",
+        "prettier": "3.8.1",
+        "react-email": "5.2.10",
+        "tailwindcss": "4.2.2",
+        "tsc-alias": "1.8.16",
+        "tsx": "4.21.0",
+        "typescript": "5.9.3",
+        "typescript-eslint": "8.56.1"
    },
    "overrides": {
-        "esbuild": "0.28.0",
-        "dompurify": "3.4.0",
-        "postcss": "8.5.14"
+        "esbuild": "0.27.4",
+        "dompurify": "3.3.2"
    }
 }
@@ -158,7 +158,12 @@ export enum ActionsEnum {
    createHealthCheck = "createHealthCheck",
    updateHealthCheck = "updateHealthCheck",
    deleteHealthCheck = "deleteHealthCheck",
-    listHealthChecks = "listHealthChecks"
+    listHealthChecks = "listHealthChecks",
+    createBrowserGatewayTarget = "createBrowserGatewayTarget",
+    updateBrowserGatewayTarget = "updateBrowserGatewayTarget",
+    deleteBrowserGatewayTarget = "deleteBrowserGatewayTarget",
+    getBrowserGatewayTarget = "getBrowserGatewayTarget",
+    listBrowserGatewayTargets = "listBrowserGatewayTargets"
 }

 export async function checkUserActionPermission(
@@ -580,6 +580,24 @@ export const trialNotifications = pgTable("trialNotifications", {
    sentAt: bigint("sentAt", { mode: "number" }).notNull()
 });

+export const browserGatewayTarget = pgTable("browserGatewayTarget", {
+    browserGatewayTargetId: serial("browserGatewayTargetId").primaryKey(),
+    resourceId: integer("resourceId")
+        .references(() => resources.resourceId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    siteId: integer("siteId")
+        .references(() => sites.siteId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    authToken: varchar("authToken").notNull(),
+    type: varchar("type").notNull(), // "ssh", "rdp", "vnc"
+    destination: varchar("destination").notNull(),
+    destinationPort: integer("destinationPort").notNull()
+});
+
 export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
@@ -627,3 +645,6 @@ export type AlertEmailRecipients = InferSelectModel<
 >;
 export type AlertWebhookActions = InferSelectModel<typeof alertWebhookActions>;
 export type TrialNotification = InferSelectModel<typeof trialNotifications>;
+export type BrowserGatewayTarget = InferSelectModel<
+    typeof browserGatewayTarget
+>;
@@ -129,8 +129,6 @@ export const resources = pgTable("resources", {
    ssl: boolean("ssl").notNull().default(false),
    blockAccess: boolean("blockAccess").notNull().default(false),
    sso: boolean("sso").notNull().default(true),
-    http: boolean("http").notNull().default(true),
-    protocol: varchar("protocol").notNull(),
    proxyPort: integer("proxyPort"),
    emailWhitelistEnabled: boolean("emailWhitelistEnabled")
        .notNull()
@@ -147,7 +145,6 @@ export const resources = pgTable("resources", {
    headers: text("headers"), // comma-separated list of headers to add to the request
    proxyProtocol: boolean("proxyProtocol").notNull().default(false),
    proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
-
    maintenanceModeEnabled: boolean("maintenanceModeEnabled")
        .notNull()
        .default(false),
@@ -159,7 +156,15 @@ export const resources = pgTable("resources", {
    maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
    postAuthPath: text("postAuthPath"),
    health: varchar("health").default("unknown"), // "healthy", "unhealthy", "unknown"
-    wildcard: boolean("wildcard").notNull().default(false)
+    wildcard: boolean("wildcard").notNull().default(false),
+    mode: text("mode").default("http").notNull(), // rdp, ssh, http, vnc
+    pamMode: varchar("pamMode", { length: 32 })
+        .$type<"passthrough" | "push">()
+        .default("passthrough"),
+    authDaemonMode: varchar("authDaemonMode", { length: 32 })
+        .$type<"site" | "remote" | "native">()
+        .default("site"),
+    authDaemonPort: integer("authDaemonPort").default(22123)
 });

 export const labels = pgTable("labels", {
@@ -339,11 +344,11 @@ export const siteResources = pgTable("siteResources", {
    niceId: varchar("niceId").notNull(),
    name: varchar("name").notNull(),
    ssl: boolean("ssl").notNull().default(false),
-    mode: varchar("mode").$type<"host" | "cidr" | "http">().notNull(), // "host" | "cidr" | "http"
+    mode: varchar("mode").$type<"host" | "cidr" | "http" | "ssh">().notNull(), // "host" | "cidr" | "http"
    scheme: varchar("scheme").$type<"http" | "https">(), // only for when we are doing https or http mode
    proxyPort: integer("proxyPort"), // only for port mode
    destinationPort: integer("destinationPort"), // only for port mode
-    destination: varchar("destination").notNull(), // ip, cidr, hostname; validate against the mode
+    destination: varchar("destination"), // ip, cidr, hostname; validate against the mode
    enabled: boolean("enabled").notNull().default(true),
    alias: varchar("alias"),
    aliasAddress: varchar("aliasAddress"),
@@ -351,8 +356,11 @@ export const siteResources = pgTable("siteResources", {
    udpPortRangeString: varchar("udpPortRangeString").notNull().default("*"),
    disableIcmp: boolean("disableIcmp").notNull().default(false),
    authDaemonPort: integer("authDaemonPort").default(22123),
+    pamMode: varchar("pamMode", { length: 32 })
+        .$type<"passthrough" | "push">()
+        .default("passthrough"),
    authDaemonMode: varchar("authDaemonMode", { length: 32 })
-        .$type<"site" | "remote">()
+        .$type<"site" | "remote" | "native">()
        .default("site"),
    domainId: varchar("domainId").references(() => domains.domainId, {
        onDelete: "set null"
@@ -588,6 +588,26 @@ export const trialNotifications = sqliteTable("trialNotifications", {
    sentAt: integer("sentAt").notNull()
 });

+export const browserGatewayTarget = sqliteTable("browserGatewayTarget", {
+    browserGatewayTargetId: integer("browserGatewayTargetId").primaryKey({
+        autoIncrement: true
+    }),
+    resourceId: integer("resourceId")
+        .references(() => resources.resourceId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    siteId: integer("siteId")
+        .references(() => sites.siteId, {
+            onDelete: "cascade"
+        })
+        .notNull(),
+    authToken: text("authToken").notNull(),
+    type: text("type").notNull(), // "ssh", "rdp", "vnc"
+    destination: text("destination").notNull(),
+    destinationPort: integer("destinationPort").notNull()
+});
+
 export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
@@ -627,3 +647,6 @@ export type AlertEmailAction = InferSelectModel<typeof alertEmailActions>;
 export type AlertEmailRecipient = InferSelectModel<typeof alertEmailRecipients>;
 export type AlertWebhookAction = InferSelectModel<typeof alertWebhookActions>;
 export type TrialNotification = InferSelectModel<typeof trialNotifications>;
+export type BrowserGatewayTarget = InferSelectModel<
+    typeof browserGatewayTarget
+>;
@@ -142,8 +142,6 @@ export const resources = sqliteTable("resources", {
        .notNull()
        .default(false),
    sso: integer("sso", { mode: "boolean" }).notNull().default(true),
-    http: integer("http", { mode: "boolean" }).notNull().default(true),
-    protocol: text("protocol").notNull(),
    proxyPort: integer("proxyPort"),
    emailWhitelistEnabled: integer("emailWhitelistEnabled", { mode: "boolean" })
        .notNull()
@@ -166,7 +164,6 @@ export const resources = sqliteTable("resources", {
        .notNull()
        .default(false),
    proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
-
    maintenanceModeEnabled: integer("maintenanceModeEnabled", {
        mode: "boolean"
    })
@@ -180,7 +177,15 @@ export const resources = sqliteTable("resources", {
    maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
    postAuthPath: text("postAuthPath"),
    health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
-    wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false)
+    wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false),
+    mode: text("mode").default("http").notNull(), // rdp, ssh, http, vnc
+    pamMode: text("pamMode")
+        .$type<"passthrough" | "push">()
+        .default("passthrough"),
+    authDaemonMode: text("authDaemonMode")
+        .$type<"site" | "remote" | "native">()
+        .default("site"),
+    authDaemonPort: integer("authDaemonPort").default(22123)
 });

 export const labels = sqliteTable("labels", {
@@ -372,11 +377,11 @@ export const siteResources = sqliteTable("siteResources", {
    niceId: text("niceId").notNull(),
    name: text("name").notNull(),
    ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
-    mode: text("mode").$type<"host" | "cidr" | "http">().notNull(), // "host" | "cidr" | "http"
+    mode: text("mode").$type<"host" | "cidr" | "http" | "ssh">().notNull(), // "host" | "cidr" | "http"
    scheme: text("scheme").$type<"http" | "https">(), // only for when we are doing https or http mode
    proxyPort: integer("proxyPort"), // only for port mode
    destinationPort: integer("destinationPort"), // only for port mode
-    destination: text("destination").notNull(), // ip, cidr, hostname
+    destination: text("destination"), // ip, cidr, hostname
    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
    alias: text("alias"),
    aliasAddress: text("aliasAddress"),
@@ -386,8 +391,11 @@ export const siteResources = sqliteTable("siteResources", {
        .notNull()
        .default(false),
    authDaemonPort: integer("authDaemonPort").default(22123),
+    pamMode: text("pamMode")
+        .$type<"passthrough" | "push">()
+        .default("passthrough"),
    authDaemonMode: text("authDaemonMode")
-        .$type<"site" | "remote">()
+        .$type<"site" | "remote" | "native">()
        .default("site"),
    domainId: text("domainId").references(() => domains.domainId, {
        onDelete: "set null"
@@ -1,5 +1,5 @@
 #! /usr/bin/env node
-import "./extendZod";
+import "./extendZod.ts";

 import { runSetupFunctions } from "./setup";
 import { createApiServer } from "./apiServer";
@@ -106,7 +106,7 @@ export async function applyBlueprint({
                            site.newt.newtId,
                            [target],
                            matchingHealthcheck ? [matchingHealthcheck] : [],
-                            result.proxyResource.protocol,
+                            result.proxyResource.mode === "udp" ? "udp" : "tcp",
                            site.newt.version
                        );
                    }
@@ -225,7 +225,11 @@ export async function updateClientResources(
                            : resourceData["udp-ports"],
                    fullDomain: resourceData["full-domain"] || null,
                    subdomain: domainInfo ? domainInfo.subdomain : null,
-                    domainId: domainInfo ? domainInfo.domainId : null
+                    domainId: domainInfo ? domainInfo.domainId : null,
+                    pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
+                    authDaemonMode:
+                        resourceData["auth-daemon"]?.mode || "native",
+                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
                })
                .where(
                    eq(
@@ -415,7 +419,11 @@ export async function updateClientResources(
                            : resourceData["udp-ports"],
                    fullDomain: resourceData["full-domain"] || null,
                    subdomain: domainInfo ? domainInfo.subdomain : null,
-                    domainId: domainInfo ? domainInfo.domainId : null
+                    domainId: domainInfo ? domainInfo.domainId : null,
+                    pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
+                    authDaemonMode:
+                        resourceData["auth-daemon"]?.mode || "native",
+                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
                })
                .returning();

@@ -36,6 +36,7 @@ import { isValidRegionId } from "@server/db/regions";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { fireHealthCheckUnknownAlert } from "@server/lib/alerts";
 import { tierMatrix } from "../billing/tierMatrix";
+import { http } from "winston";

 export type ProxyResourcesResults = {
    proxyResource: Resource;
@@ -198,9 +199,6 @@ export async function updateProxyResources(
            )
            .limit(1);

-        const http = resourceData.protocol == "http";
-        const protocol =
-            resourceData.protocol == "http" ? "tcp" : resourceData.protocol;
        const resourceEnabled =
            resourceData.enabled == undefined || resourceData.enabled == null
                ? true
@@ -216,7 +214,9 @@ export async function updateProxyResources(

        if (existingResource) {
            let domain;
-            if (http) {
+            if (
+                ["http", "ssh", "rdp", "vnc"].includes(resourceData.mode || "")
+            ) {
                domain = await getDomain(
                    existingResource.resourceId,
                    resourceData["full-domain"]!,
@@ -246,10 +246,17 @@ export async function updateProxyResources(
                    .update(resources)
                    .set({
                        name: resourceData.name || "Unnamed Resource",
-                        protocol: protocol || "tcp",
-                        http: http,
-                        proxyPort: http ? null : resourceData["proxy-port"],
-                        fullDomain: http ? resourceData["full-domain"] : null,
+                        mode: resourceData.mode,
+                        proxyPort: ["http", "ssh", "rdp", "vnc"].includes(
+                            resourceData.mode || ""
+                        )
+                            ? null
+                            : resourceData["proxy-port"],
+                        fullDomain: ["http", "ssh", "rdp", "vnc"].includes(
+                            resourceData.mode || ""
+                        )
+                            ? resourceData["full-domain"]
+                            : null,
                        subdomain: domain ? domain.subdomain : null,
                        domainId: domain ? domain.domainId : null,
                        wildcard: domain ? domain.wildcard : false,
@@ -268,6 +275,12 @@ export async function updateProxyResources(
                        headers: headers || null,
                        applyRules:
                            resourceData.rules && resourceData.rules.length > 0,
+                        pamMode:
+                            resourceData["auth-daemon"]?.pam || "passthrough",
+                        authDaemonMode:
+                            resourceData["auth-daemon"]?.mode || "native",
+                        authDaemonPort:
+                            resourceData["auth-daemon"]?.port || 22123,
                        maintenanceModeEnabled:
                            resourceData.maintenance?.enabled,
                        maintenanceModeType: resourceData.maintenance?.type,
@@ -466,7 +479,10 @@ export async function updateProxyResources(
                        .set({
                            siteId: site.siteId,
                            ip: targetData.hostname,
-                            method: http ? targetData.method : null,
+                            method:
+                                resourceData.mode == "http" // the other types of ssh, rdp, and vnc use the browser gateway targets and not this one so this is okay
+                                    ? targetData.method
+                                    : null,
                            port: targetData.port,
                            enabled: targetData.enabled,
                            path: targetData.path,
@@ -687,7 +703,9 @@ export async function updateProxyResources(
        } else {
            // create a brand new resource
            let domain;
-            if (http) {
+            if (
+                ["http", "ssh", "rdp", "vnc"].includes(resourceData.mode || "")
+            ) {
                domain = await getDomain(
                    undefined,
                    resourceData["full-domain"]!,
@@ -711,10 +729,17 @@ export async function updateProxyResources(
                    orgId,
                    niceId: resourceNiceId,
                    name: resourceData.name || "Unnamed Resource",
-                    protocol: protocol || "tcp",
-                    http: http,
-                    proxyPort: http ? null : resourceData["proxy-port"],
-                    fullDomain: http ? resourceData["full-domain"] : null,
+                    mode: resourceData.mode,
+                    proxyPort: ["http", "ssh", "rdp", "vnc"].includes(
+                        resourceData.mode || ""
+                    )
+                        ? null
+                        : resourceData["proxy-port"],
+                    fullDomain: ["http", "ssh", "rdp", "vnc"].includes(
+                        resourceData.mode || ""
+                    )
+                        ? resourceData["full-domain"]
+                        : null,
                    subdomain: domain ? domain.subdomain : null,
                    domainId: domain ? domain.domainId : null,
                    wildcard: domain ? domain.wildcard : false,
@@ -727,6 +752,10 @@ export async function updateProxyResources(
                    headers: headers || null,
                    applyRules:
                        resourceData.rules && resourceData.rules.length > 0,
+                    pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
+                    authDaemonMode:
+                        resourceData["auth-daemon"]?.mode || "native",
+                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123,
                    maintenanceModeEnabled: resourceData.maintenance?.enabled,
                    maintenanceModeType: resourceData.maintenance?.type,
                    maintenanceTitle: resourceData.maintenance?.title,
@@ -161,11 +161,33 @@ export const HeaderSchema = z.object({
    value: z.string().min(1)
 });

+export const AuthDaemonSchema = z
+    .object({
+        pam: z.enum(["passthrough", "push"]).optional().default("passthrough"),
+        mode: z.enum(["site", "remote", "native"]).optional().default("site"),
+        port: z.int().min(1).max(65535).optional()
+    })
+    .refine(
+        (data) => {
+            if (data.mode === "remote") {
+                return data.port !== undefined;
+            }
+            return true;
+        },
+        {
+            path: ["port"],
+            message: "port is required when auth-daemon mode is 'remote'"
+        }
+    );
+
 // Schema for individual resource
-export const ResourceSchema = z
+export const PublicResourceSchema = z
    .object({
        name: z.string().optional(),
-        protocol: z.enum(["http", "tcp", "udp"]).optional(),
+        protocol: z
+            .enum(["http", "tcp", "udp", "ssh", "rdp", "vnc"])
+            .optional(), // this was the old one and is now DEPRECATED in favor of the mode
+        mode: z.enum(["http", "tcp", "udp", "ssh", "rdp", "vnc"]).optional(),
        ssl: z.boolean().optional(),
        scheme: z.enum(["http", "https"]).optional(),
        "full-domain": z.string().optional(),
@@ -177,7 +199,8 @@ export const ResourceSchema = z
        "tls-server-name": z.string().optional(),
        headers: z.array(HeaderSchema).optional(),
        rules: z.array(RuleSchema).optional(),
-        maintenance: MaintenanceSchema.optional()
+        maintenance: MaintenanceSchema.optional(),
+        "auth-daemon": AuthDaemonSchema.optional()
    })
    .refine(
        (resource) => {
@@ -185,9 +208,10 @@ export const ResourceSchema = z
                return true;
            }

-            // Otherwise, require name and protocol for full resource definition
+            // Otherwise, require name and protocol/mode for full resource definition
            return (
-                resource.name !== undefined && resource.protocol !== undefined
+                resource.name !== undefined &&
+                (resource.mode !== undefined || resource.protocol !== undefined)
            );
        },
        {
@@ -201,8 +225,8 @@ export const ResourceSchema = z
                return true;
            }

-            // If protocol is http, all targets must have method field
-            if (resource.protocol === "http") {
+            // If protocol/mode is http, all targets must have method field
+            if ((resource.mode ?? resource.protocol) === "http") {
                return resource.targets.every(
                    (target) => target == null || target.method !== undefined
                );
@@ -220,8 +244,9 @@ export const ResourceSchema = z
                return true;
            }

-            // If protocol is tcp or udp, no target should have method field
-            if (resource.protocol === "tcp" || resource.protocol === "udp") {
+            // If protocol/mode is tcp or udp, no target should have method field
+            const effectiveProtocol1 = resource.mode ?? resource.protocol;
+            if (effectiveProtocol1 === "tcp" || effectiveProtocol1 === "udp") {
                return resource.targets.every(
                    (target) => target == null || target.method === undefined
                );
@@ -239,8 +264,8 @@ export const ResourceSchema = z
                return true;
            }

-            // If protocol is http, it must have a full-domain
-            if (resource.protocol === "http") {
+            // If protocol/mode is http, it must have a full-domain
+            if ((resource.mode ?? resource.protocol) === "http") {
                return (
                    resource["full-domain"] !== undefined &&
                    resource["full-domain"].length > 0
@@ -259,8 +284,9 @@ export const ResourceSchema = z
                return true;
            }

-            // If protocol is tcp or udp, it must have both proxy-port
-            if (resource.protocol === "tcp" || resource.protocol === "udp") {
+            // If protocol/mode is tcp or udp, it must have both proxy-port
+            const effectiveProtocol2 = resource.mode ?? resource.protocol;
+            if (effectiveProtocol2 === "tcp" || effectiveProtocol2 === "udp") {
                return resource["proxy-port"] !== undefined;
            }
            return true;
@@ -277,8 +303,9 @@ export const ResourceSchema = z
                return true;
            }

-            // If protocol is tcp or udp, it must not have auth
-            if (resource.protocol === "tcp" || resource.protocol === "udp") {
+            // If protocol/mode is tcp or udp, it must not have auth
+            const effectiveProtocol3 = resource.mode ?? resource.protocol;
+            if (effectiveProtocol3 === "tcp" || effectiveProtocol3 === "udp") {
                return resource.auth === undefined;
            }
            return true;
@@ -340,7 +367,8 @@ export const ResourceSchema = z
            if (parts.includes("*", 1)) return false; // no further wildcards
            if (parts.length < 3) return false; // need at least *.label.tld

-            const labelRegex = /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$|^[a-zA-Z0-9]$/;
+            const labelRegex =
+                /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$|^[a-zA-Z0-9]$/;
            return parts.slice(1).every((label) => labelRegex.test(label));
        },
        {
@@ -348,22 +376,29 @@ export const ResourceSchema = z
            message:
                'Wildcard full-domain must have "*" as the leftmost label only, followed by at least two valid hostname labels (e.g. "*.example.com" or "*.level1.example.com"). Patterns like "*example.com" or "level2.*.example.com" are not supported.'
        }
-    );
+    )
+    .transform((resource) => {
+        // Normalize: prefer mode, fall back to protocol for backwards compatibility
+        if (resource.mode === undefined && resource.protocol !== undefined) {
+            resource.mode = resource.protocol;
+        }
+        return resource;
+    });

 export function isTargetsOnlyResource(resource: any): boolean {
    return Object.keys(resource).length === 1 && resource.targets;
 }

-export const ClientResourceSchema = z
+export const PrivateResourceSchema = z
    .object({
        name: z.string().min(1).max(255),
-        mode: z.enum(["host", "cidr", "http"]),
+        mode: z.enum(["host", "cidr", "http", "ssh"]),
        site: z.string().optional(), // DEPRECATED IN FAVOR OF sites
        sites: z.array(z.string()).optional().default([]),
        // protocol: z.enum(["tcp", "udp"]).optional(),
        // proxyPort: z.int().positive().optional(),
        "destination-port": z.int().positive().optional(),
-        destination: z.string().min(1),
+        destination: z.string().min(1).optional(),
        // enabled: z.boolean().default(true),
        "tcp-ports": portRangeStringSchema.optional().default("*"),
        "udp-ports": portRangeStringSchema.optional().default("*"),
@@ -386,11 +421,31 @@ export const ClientResourceSchema = z
                error: "Admin role cannot be included in roles"
            }),
        users: z.array(z.string()).optional().default([]),
-        machines: z.array(z.string()).optional().default([])
+        machines: z.array(z.string()).optional().default([]),
+        "auth-daemon": AuthDaemonSchema.optional()
    })
+    .refine(
+        (data) => {
+            // destination is optional only for ssh+native; required for everything else
+            const isNativeSSH =
+                data.mode === "ssh" &&
+                (data["auth-daemon"] === undefined ||
+                    data["auth-daemon"].mode === "native");
+            if (!isNativeSSH && !data.destination) {
+                return false;
+            }
+            return true;
+        },
+        {
+            path: ["destination"],
+            message:
+                "destination is required unless mode is 'ssh' with auth-daemon mode 'native'"
+        }
+    )
    .refine(
        (data) => {
            if (data.mode === "host") {
+                if (!data.destination) return true; // caught by the destination-required refine
                // Check if it's a valid IP address using zod (v4 or v6)
                const isValidIP = z
                    .union([z.ipv4(), z.ipv6()])
@@ -418,6 +473,7 @@ export const ClientResourceSchema = z
    .refine(
        (data) => {
            if (data.mode === "cidr") {
+                if (!data.destination) return true; // caught by the destination-required refine
                // Check if it's a valid CIDR (v4 or v6)
                const isValidCIDR = z
                    .union([z.cidrv4(), z.cidrv6()])
@@ -435,19 +491,19 @@ export const ClientResourceSchema = z
 export const ConfigSchema = z
    .object({
        "proxy-resources": z
-            .record(z.string(), ResourceSchema)
+            .record(z.string(), PublicResourceSchema)
            .optional()
            .prefault({}),
        "public-resources": z
-            .record(z.string(), ResourceSchema)
+            .record(z.string(), PublicResourceSchema)
            .optional()
            .prefault({}),
        "client-resources": z
-            .record(z.string(), ClientResourceSchema)
+            .record(z.string(), PrivateResourceSchema)
            .optional()
            .prefault({}),
        "private-resources": z
-            .record(z.string(), ClientResourceSchema)
+            .record(z.string(), PrivateResourceSchema)
            .optional()
            .prefault({}),
        sites: z.record(z.string(), SiteSchema).optional().prefault({})
@@ -472,10 +528,13 @@ export const ConfigSchema = z
        }

        return data as {
-            "proxy-resources": Record<string, z.infer<typeof ResourceSchema>>;
+            "proxy-resources": Record<
+                string,
+                z.infer<typeof PublicResourceSchema>
+            >;
            "client-resources": Record<
                string,
-                z.infer<typeof ClientResourceSchema>
+                z.infer<typeof PrivateResourceSchema>
            >;
            sites: Record<string, z.infer<typeof SiteSchema>>;
        };
@@ -614,5 +673,5 @@ export const ConfigSchema = z
 // Type inference from the schema
 export type Site = z.infer<typeof SiteSchema>;
 export type Target = z.infer<typeof TargetSchema>;
-export type Resource = z.infer<typeof ResourceSchema>;
+export type Resource = z.infer<typeof PublicResourceSchema>;
 export type Config = z.infer<typeof ConfigSchema>;
@@ -154,19 +154,8 @@ class AdaptiveCache {
    keys(): string[] {
        return localCache.keys();
    }
-
-    /**
-     * Get keys with a specific prefix
-     * @param prefix - Key prefix to match
-     * @returns Array of matching keys
-     */
-    async keysWithPrefix(prefix: string): Promise<string[]> {
-        const allKeys = localCache.keys();
-        return allKeys.filter((key) => key.startsWith(prefix));
-    }
 }

 // Export singleton instance
 export const cache = new AdaptiveCache();
-export const regionalCache = cache; // Alias for compatability with the private version
 export default cache;
@@ -475,6 +475,8 @@ export function generateRemoteSubnets(
 ): string[] {
    const remoteSubnets = allSiteResources
        .filter((sr) => {
+            if (!sr.destination) return false;
+
            if (sr.mode === "cidr") {
                // check if its a valid CIDR using zod
                const cidrSchema = z.union([z.cidrv4(), z.cidrv6()]);
@@ -496,7 +498,7 @@ export function generateRemoteSubnets(
            }
            return ""; // This should never be reached due to filtering, but satisfies TypeScript
        })
-        .filter((subnet) => subnet !== ""); // Remove empty strings just to be safe
+        .filter((subnet): subnet is string => subnet !== "" && subnet !== null); // Remove invalid values just to be safe
    // remove duplicates
    return Array.from(new Set(remoteSubnets));
 }
@@ -581,7 +583,7 @@ export function generateSubnetProxyTargets(
                targets.push({
                    sourcePrefix: clientPrefix,
                    destPrefix: `${siteResource.aliasAddress}/32`,
-                    rewriteTo: destination,
+                    rewriteTo: destination!,
                    portRange,
                    disableIcmp
                });
@@ -589,7 +591,7 @@ export function generateSubnetProxyTargets(
        } else if (siteResource.mode == "cidr") {
            targets.push({
                sourcePrefix: clientPrefix,
-                destPrefix: siteResource.destination,
+                destPrefix: siteResource.destination!,
                portRange,
                disableIcmp
            });
@@ -671,7 +673,7 @@ export async function generateSubnetProxyTargetV2(
            targets.push({
                sourcePrefixes: [],
                destPrefix: `${siteResource.aliasAddress}/32`,
-                rewriteTo: destination,
+                rewriteTo: destination!,
                portRange,
                disableIcmp,
                resourceId: siteResource.siteResourceId
@@ -680,7 +682,7 @@ export async function generateSubnetProxyTargetV2(
    } else if (siteResource.mode == "cidr") {
        targets.push({
            sourcePrefixes: [],
-            destPrefix: siteResource.destination,
+            destPrefix: siteResource.destination!,
            portRange,
            disableIcmp,
            resourceId: siteResource.siteResourceId
@@ -738,7 +740,7 @@ export async function generateSubnetProxyTargetV2(
            protocol: siteResource.ssl ? "https" : "http",
            httpTargets: [
                {
-                    destAddr: siteResource.destination,
+                    destAddr: siteResource.destination!,
                    destPort: siteResource.destinationPort,
                    scheme: siteResource.scheme
                }
@@ -18,7 +18,7 @@ import {
    userOrgRoles,
    userSiteResources
 } from "@server/db";
-import { and, count, eq, inArray, ne } from "drizzle-orm";
+import { and, eq, inArray, ne } from "drizzle-orm";

 import { deletePeer as newtDeletePeer } from "@server/routers/newt/peers";
 import {
@@ -39,11 +39,6 @@ import {
    removePeerData,
    removeTargets as removeSubnetProxyTargets
 } from "@server/routers/client/targets";
-import { lockManager } from "#dynamic/lib/lock";
-
-// TTL for rebuild-association locks. These functions can fan out into many
-// peer/proxy updates, so give them a generous window.
-const REBUILD_ASSOCIATIONS_LOCK_TTL_MS = 120000;

 export async function getClientSiteResourceAccess(
    siteResource: SiteResource,
@@ -166,23 +161,6 @@ export async function rebuildClientAssociationsFromSiteResource(
        pubKey: string | null;
        subnet: string | null;
    }[];
-}> {
-    return await lockManager.withLock(
-        `rebuild-client-associations:site-resource:${siteResource.siteResourceId}`,
-        () => rebuildClientAssociationsFromSiteResourceImpl(siteResource, trx),
-        REBUILD_ASSOCIATIONS_LOCK_TTL_MS
-    );
-}
-
-async function rebuildClientAssociationsFromSiteResourceImpl(
-    siteResource: SiteResource,
-    trx: Transaction | typeof db = db
-): Promise<{
-    mergedAllClients: {
-        clientId: number;
-        pubKey: string | null;
-        subnet: string | null;
-    }[];
 }> {
    logger.debug(
        `rebuildClientAssociations: [rebuildClientAssociationsFromSiteResource] START siteResourceId=${siteResource.siteResourceId} networkId=${siteResource.networkId} orgId=${siteResource.orgId}`
@@ -561,29 +539,6 @@ async function handleMessagesForSiteClients(
        }
    }

-    // get the number of sites on each of these clients so we can log it and make decisions about whether to send messages based on it
-    const clientSiteCounts: Record<number, number> = {};
-    if (clientsToProcess.size > 0) {
-        const clientIdsToProcess = Array.from(clientsToProcess.keys());
-        const siteCounts = await trx
-            .select({
-                clientId: clientSitesAssociationsCache.clientId,
-                siteCount: count(clientSitesAssociationsCache.siteId)
-            })
-            .from(clientSitesAssociationsCache)
-            .where(
-                inArray(
-                    clientSitesAssociationsCache.clientId,
-                    clientIdsToProcess
-                )
-            )
-            .groupBy(clientSitesAssociationsCache.clientId);
-
-        for (const row of siteCounts) {
-            clientSiteCounts[row.clientId] = Number(row.siteCount);
-        }
-    }
-
    for (const client of clientsToProcess.values()) {
        // UPDATE THE NEWT
        if (!client.subnet || !client.pubKey) {
@@ -627,14 +582,7 @@ async function handleMessagesForSiteClients(
        }

        if (isAdd) {
-            if (clientSiteCounts[client.clientId] > 250) {
-                // skip adding the peer if we have more than 250 sites because we are in jit mode anyway
-                logger.info(
-                    `rebuildClientAssociations: Client ${client.clientId} has ${clientSiteCounts[client.clientId]} sites so skipping adding peer to newt and olm because it is likely in jit mode`
-                );
-                continue;
-            }
-
+            // TODO: if we are in jit mode here should we really be sending this?
            await initPeerAddHandshake(
                // this will kick off the add peer process for the client
                client.clientId,
@@ -652,24 +600,9 @@ async function handleMessagesForSiteClients(
        exitNodeJobs.push(updateClientSiteDestinations(client, trx));
    }

-    Promise.all(exitNodeJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating client site destinations for site ${site.siteId}:`,
-            error
-        );
-    });
-    Promise.all(newtJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating Newt peers for site ${site.siteId}:`,
-            error
-        );
-    });
-    Promise.all(olmJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating Olm peers for site ${site.siteId}:`,
-            error
-        );
-    });
+    await Promise.all(exitNodeJobs);
+    await Promise.all(newtJobs); // do the servers first to make sure they are ready?
+    await Promise.all(olmJobs);
 }

 interface PeerDestination {
@@ -890,6 +823,9 @@ async function handleSubnetProxyTargetUpdates(
                }

                for (const client of removedClients) {
+                    if (!siteResource.destination) {
+                        continue;
+                    }
                    // Check if this client still has access to another resource
                    // on this specific site with the same destination. We scope
                    // by siteId (via siteNetworks) rather than networkId because
@@ -952,17 +888,6 @@ async function handleSubnetProxyTargetUpdates(
 export async function rebuildClientAssociationsFromClient(
    client: Client,
    trx: Transaction | typeof db = db
-): Promise<void> {
-    return await lockManager.withLock(
-        `rebuild-client-associations:client:${client.clientId}`,
-        () => rebuildClientAssociationsFromClientImpl(client, trx),
-        REBUILD_ASSOCIATIONS_LOCK_TTL_MS
-    );
-}
-
-async function rebuildClientAssociationsFromClientImpl(
-    client: Client,
-    trx: Transaction | typeof db = db
 ): Promise<void> {
    let newSiteResourceIds: number[] = [];

@@ -1235,12 +1160,6 @@ async function handleMessagesForClientSites(
    const olmJobs: Promise<any>[] = [];
    const exitNodeJobs: Promise<any>[] = [];

-    const totalSitesOnClient = await trx
-        .select({ count: count(clientSitesAssociationsCache.siteId) })
-        .from(clientSitesAssociationsCache)
-        .where(eq(clientSitesAssociationsCache.clientId, client.clientId))
-        .then((rows) => Number(rows[0].count));
-
    for (const siteData of sitesData) {
        const site = siteData.sites;
        const exitNode = siteData.exitNodes;
@@ -1301,14 +1220,7 @@ async function handleMessagesForClientSites(
                continue;
            }

-            if (totalSitesOnClient > 250) {
-                // skip adding the site if we have more than 250 because we are in jit mode anyway
-                logger.info(
-                    `rebuildClientAssociations: Client ${client.clientId} has ${totalSitesOnClient} sites so skipping adding peer to newt and olm because it is likely in jit mode`
-                );
-                continue;
-            }
-
+            // TODO: if we are in jit mode here should we really be sending this?
            await initPeerAddHandshake(
                // this will kick off the add peer process for the client
                client.clientId,
@@ -1336,24 +1248,9 @@ async function handleMessagesForClientSites(
        );
    }

-    Promise.all(exitNodeJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating client site destinations for client ${client.clientId}:`,
-            error
-        );
-    });
-    Promise.all(newtJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating Newt peers for client ${client.clientId}:`,
-            error
-        );
-    });
-    Promise.all(olmJobs).catch((error) => {
-        logger.error(
-            `rebuildClientAssociations: Error updating Olm peers for client ${client.clientId}:`,
-            error
-        );
-    });
+    await Promise.all(exitNodeJobs);
+    await Promise.all(newtJobs);
+    await Promise.all(olmJobs);
 }

 async function handleMessagesForClientResources(
@@ -1563,6 +1460,9 @@ async function handleMessagesForClientResources(
                }

                try {
+                    if (!resource.destination) {
+                        continue;
+                    }
                    // Check if this client still has access to another resource
                    // on this specific site with the same destination. We scope
                    // by siteId (via siteNetworks) rather than networkId because
@@ -1634,195 +1534,3 @@ async function handleMessagesForClientResources(

    await Promise.all([...proxyJobs, ...olmJobs]);
 }
-
-export type ClientAssociationsCacheVerification = {
-    clientId: number;
-    consistent: boolean;
-    // What permissions say the cache should contain
-    expectedSiteResourceIds: number[];
-    expectedSiteIds: number[];
-    // What the cache currently contains
-    actualSiteResourceIds: number[];
-    actualSiteIds: number[];
-    // Diff
-    missingSiteResourceIds: number[]; // present in expected, missing from cache
-    extraSiteResourceIds: number[]; // present in cache, not in expected
-    missingSiteIds: number[];
-    extraSiteIds: number[];
-};
-
-// verifyClientAssociationsCache walks the same permission-derivation logic as
-// rebuildClientAssociationsFromClient but does NOT modify the database. It
-// returns the expected vs actual cache contents and a boolean indicating
-// whether the cache is in sync with what permissions imply.
-export async function verifyClientAssociationsCache(
-    client: Client,
-    trx: Transaction | typeof db = db
-): Promise<ClientAssociationsCacheVerification> {
-    let newSiteResourceIds: number[] = [];
-
-    // 1. Direct client associations
-    const directSiteResources = await trx
-        .select({ siteResourceId: clientSiteResources.siteResourceId })
-        .from(clientSiteResources)
-        .innerJoin(
-            siteResources,
-            eq(siteResources.siteResourceId, clientSiteResources.siteResourceId)
-        )
-        .where(
-            and(
-                eq(clientSiteResources.clientId, client.clientId),
-                eq(siteResources.orgId, client.orgId)
-            )
-        );
-
-    newSiteResourceIds.push(
-        ...directSiteResources.map((r) => r.siteResourceId)
-    );
-
-    // 2. User-based and role-based access (if client has a userId)
-    if (client.userId) {
-        const userSiteResourceIds = await trx
-            .select({ siteResourceId: userSiteResources.siteResourceId })
-            .from(userSiteResources)
-            .innerJoin(
-                siteResources,
-                eq(
-                    siteResources.siteResourceId,
-                    userSiteResources.siteResourceId
-                )
-            )
-            .where(
-                and(
-                    eq(userSiteResources.userId, client.userId),
-                    eq(siteResources.orgId, client.orgId)
-                )
-            );
-
-        newSiteResourceIds.push(
-            ...userSiteResourceIds.map((r) => r.siteResourceId)
-        );
-
-        const roleIds = await trx
-            .select({ roleId: userOrgRoles.roleId })
-            .from(userOrgRoles)
-            .where(
-                and(
-                    eq(userOrgRoles.userId, client.userId),
-                    eq(userOrgRoles.orgId, client.orgId)
-                )
-            )
-            .then((rows) => rows.map((row) => row.roleId));
-
-        if (roleIds.length > 0) {
-            const roleSiteResourceIds = await trx
-                .select({ siteResourceId: roleSiteResources.siteResourceId })
-                .from(roleSiteResources)
-                .innerJoin(
-                    siteResources,
-                    eq(
-                        siteResources.siteResourceId,
-                        roleSiteResources.siteResourceId
-                    )
-                )
-                .where(
-                    and(
-                        inArray(roleSiteResources.roleId, roleIds),
-                        eq(siteResources.orgId, client.orgId)
-                    )
-                );
-
-            newSiteResourceIds.push(
-                ...roleSiteResourceIds.map((r) => r.siteResourceId)
-            );
-        }
-    }
-
-    newSiteResourceIds = Array.from(new Set(newSiteResourceIds));
-
-    const newSiteResources =
-        newSiteResourceIds.length > 0
-            ? await trx
-                  .select()
-                  .from(siteResources)
-                  .where(
-                      inArray(siteResources.siteResourceId, newSiteResourceIds)
-                  )
-            : [];
-
-    const networkIds = Array.from(
-        new Set(
-            newSiteResources
-                .map((sr) => sr.networkId)
-                .filter((id): id is number => id !== null)
-        )
-    );
-    const newSiteIds =
-        networkIds.length > 0
-            ? await trx
-                  .select({ siteId: siteNetworks.siteId })
-                  .from(siteNetworks)
-                  .where(inArray(siteNetworks.networkId, networkIds))
-                  .then((rows) =>
-                      Array.from(new Set(rows.map((r) => r.siteId)))
-                  )
-            : [];
-
-    // Read the existing cache state
-    const existingResourceAssociations = await trx
-        .select({
-            siteResourceId: clientSiteResourcesAssociationsCache.siteResourceId
-        })
-        .from(clientSiteResourcesAssociationsCache)
-        .where(
-            eq(clientSiteResourcesAssociationsCache.clientId, client.clientId)
-        );
-    const existingSiteResourceIds = existingResourceAssociations.map(
-        (r) => r.siteResourceId
-    );
-
-    const existingSiteAssociations = await trx
-        .select({ siteId: clientSitesAssociationsCache.siteId })
-        .from(clientSitesAssociationsCache)
-        .where(eq(clientSitesAssociationsCache.clientId, client.clientId));
-    const existingSiteIds = existingSiteAssociations.map((s) => s.siteId);
-
-    const expectedSiteResourceSet = new Set(newSiteResourceIds);
-    const actualSiteResourceSet = new Set(existingSiteResourceIds);
-    const expectedSiteSet = new Set(newSiteIds);
-    const actualSiteSet = new Set(existingSiteIds);
-
-    const missingSiteResourceIds = newSiteResourceIds.filter(
-        (id) => !actualSiteResourceSet.has(id)
-    );
-    const extraSiteResourceIds = existingSiteResourceIds.filter(
-        (id) => !expectedSiteResourceSet.has(id)
-    );
-    const missingSiteIds = newSiteIds.filter((id) => !actualSiteSet.has(id));
-    const extraSiteIds = existingSiteIds.filter(
-        (id) => !expectedSiteSet.has(id)
-    );
-
-    const consistent =
-        missingSiteResourceIds.length === 0 &&
-        extraSiteResourceIds.length === 0 &&
-        missingSiteIds.length === 0 &&
-        extraSiteIds.length === 0;
-
-    return {
-        clientId: client.clientId,
-        consistent,
-        expectedSiteResourceIds: Array.from(expectedSiteResourceSet).sort(
-            (a, b) => a - b
-        ),
-        expectedSiteIds: Array.from(expectedSiteSet).sort((a, b) => a - b),
-        actualSiteResourceIds: Array.from(actualSiteResourceSet).sort(
-            (a, b) => a - b
-        ),
-        actualSiteIds: Array.from(actualSiteSet).sort((a, b) => a - b),
-        missingSiteResourceIds: missingSiteResourceIds.sort((a, b) => a - b),
-        extraSiteResourceIds: extraSiteResourceIds.sort((a, b) => a - b),
-        missingSiteIds: missingSiteIds.sort((a, b) => a - b),
-        extraSiteIds: extraSiteIds.sort((a, b) => a - b)
-    };
-}
@@ -1,11 +0,0 @@
-export function getFirstString(value: unknown): string | undefined {
-    if (typeof value === "string") {
-        return value;
-    }
-
-    if (Array.isArray(value) && typeof value[0] === "string") {
-        return value[0];
-    }
-
-    return undefined;
-}
@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { db, logsDb, statusHistory } from "@server/db";
 import { and, eq, gte, asc } from "drizzle-orm";
-import { regionalCache as cache } from "#dynamic/lib/cache";
+import cache from "@server/lib/cache";

 const STATUS_HISTORY_CACHE_TTL = 60; // seconds

@@ -66,7 +66,7 @@ export async function invalidateStatusHistoryCache(
    entityId: number
 ): Promise<void> {
    const prefix = `statusHistory:${entityType}:${entityId}:`;
-    const keys = await cache.keysWithPrefix(prefix);
+    const keys = cache.keys().filter((k) => k.startsWith(prefix));
    if (keys.length > 0) {
        await cache.del(keys);
    }
@@ -2,7 +2,14 @@ import { PostHog } from "posthog-node";
 import config from "./config";
 import { getHostMeta } from "./hostMeta";
 import logger from "@server/logger";
-import { alertRules, apiKeys, blueprints, db, roles, siteResources } from "@server/db";
+import {
+    alertRules,
+    apiKeys,
+    blueprints,
+    db,
+    roles,
+    siteResources
+} from "@server/db";
 import { sites, users, orgs, resources, clients, idp } from "@server/db";
 import { eq, count, notInArray, and, isNotNull, isNull } from "drizzle-orm";
 import { APP_VERSION } from "./consts";
@@ -143,8 +150,7 @@ class TelemetryClient {
                .select({
                    name: resources.name,
                    sso: resources.sso,
-                    protocol: resources.protocol,
-                    http: resources.http
+                    mode: resources.mode
                })
                .from(resources);

@@ -311,7 +317,7 @@ class TelemetryClient {
                        (r) => r.sso
                    ).length,
                    num_resources_non_http: stats.resources.filter(
-                        (r) => !r.http
+                        (r) => r.mode !== "http"
                    ).length,
                    num_newt_sites: stats.sites.filter((s) => s.type === "newt")
                        .length,
@@ -55,9 +55,7 @@ export async function getTraefikConfig(
            resourceName: resources.name,
            fullDomain: resources.fullDomain,
            ssl: resources.ssl,
-            http: resources.http,
            proxyPort: resources.proxyPort,
-            protocol: resources.protocol,
            subdomain: resources.subdomain,
            domainId: resources.domainId,
            enabled: resources.enabled,
@@ -68,6 +66,7 @@ export async function getTraefikConfig(
            headers: resources.headers,
            proxyProtocol: resources.proxyProtocol,
            proxyProtocolVersion: resources.proxyProtocolVersion,
+            mode: resources.mode,

            // Target fields
            targetId: targets.targetId,
@@ -115,8 +114,8 @@ export async function getTraefikConfig(
                ),
                inArray(sites.type, siteTypes),
                allowRawResources
-                    ? isNotNull(resources.http) // ignore the http check if allow_raw_resources is true
-                    : eq(resources.http, true)
+                    ? inArray(resources.mode, ["http", "udp", "tcp"]) // allow all three
+                    : eq(resources.mode, "http")
            )
        )
        .orderBy(desc(targets.priority), targets.targetId); // stable ordering
@@ -166,9 +165,8 @@ export async function getTraefikConfig(
                key: key,
                fullDomain: row.fullDomain,
                ssl: row.ssl,
-                http: row.http,
+                mode: row.mode,
                proxyPort: row.proxyPort,
-                protocol: row.protocol,
                subdomain: row.subdomain,
                domainId: row.domainId,
                enabled: row.enabled,
@@ -580,7 +578,7 @@ export async function getTraefikConfig(
                continue;
            }

-            const protocol = resource.protocol.toLowerCase();
+            const protocol = resource.mode === "udp" ? "udp" : "tcp"; // all of the other ones are tcp
            const port = resource.proxyPort;

            if (!port) {
@@ -4,7 +4,6 @@ import { resourceAccessToken, resources, apiKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyAccessTokenAccess(
    req: Request,
@@ -13,7 +12,7 @@ export async function verifyApiKeyAccessTokenAccess(
 ) {
    try {
        const apiKey = req.apiKey;
-        const accessTokenId = getFirstString(req.params.accessTokenId);
+        const accessTokenId = req.params.accessTokenId;

        if (!apiKey) {
            return next(
@@ -21,12 +20,6 @@ export async function verifyApiKeyAccessTokenAccess(
            );
        }

-        if (!accessTokenId) {
-            return next(
-                createHttpError(HttpCode.BAD_REQUEST, "Invalid access token ID")
-            );
-        }
-
        const [accessToken] = await db
            .select()
            .from(resourceAccessToken)
@@ -4,7 +4,6 @@ import { apiKeys, apiKeyOrg } from "@server/db";
 import { and, eq, or } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyApiKeyAccess(
    req: Request,
@@ -15,10 +14,8 @@ export async function verifyApiKeyApiKeyAccess(
        const { apiKey: callerApiKey } = req;

        const apiKeyId =
-            getFirstString(req.params.apiKeyId) ||
-            getFirstString(req.body.apiKeyId) ||
-            getFirstString(req.query.apiKeyId);
-        const orgId = getFirstString(req.params.orgId);
+            req.params.apiKeyId || req.body.apiKeyId || req.query.apiKeyId;
+        const orgId = req.params.orgId;

        if (!callerApiKey) {
            return next(
@@ -3,7 +3,6 @@ import { db, domains, orgDomains, apiKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyDomainAccess(
    req: Request,
@@ -13,10 +12,8 @@ export async function verifyApiKeyDomainAccess(
    try {
        const apiKey = req.apiKey;
        const domainId =
-            getFirstString(req.params.domainId) ||
-            getFirstString(req.body.domainId) ||
-            getFirstString(req.query.domainId);
-        const orgId = getFirstString(req.params.orgId);
+            req.params.domainId || req.body.domainId || req.query.domainId;
+        const orgId = req.params.orgId;

        if (!apiKey) {
            return next(
@@ -30,12 +27,6 @@ export async function verifyApiKeyDomainAccess(
            );
        }

-        if (!orgId) {
-            return next(
-                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
-            );
-        }
-
        if (apiKey.isRoot) {
            // Root keys can access any domain in any org
            return next();
@@ -4,7 +4,6 @@ import { idp, idpOrg, apiKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyIdpAccess(
    req: Request,
@@ -13,12 +12,8 @@ export async function verifyApiKeyIdpAccess(
 ) {
    try {
        const apiKey = req.apiKey;
-        const idpIdRaw =
-            getFirstString(req.params.idpId) ||
-            getFirstString(req.body.idpId) ||
-            getFirstString(req.query.idpId);
-        const idpId = Number.parseInt(idpIdRaw ?? "", 10);
-        const orgId = getFirstString(req.params.orgId);
+        const idpId = req.params.idpId || req.body.idpId || req.query.idpId;
+        const orgId = req.params.orgId;

        if (!apiKey) {
            return next(
@@ -32,7 +27,7 @@ export async function verifyApiKeyIdpAccess(
            );
        }

-        if (Number.isNaN(idpId)) {
+        if (!idpId) {
            return next(
                createHttpError(HttpCode.BAD_REQUEST, "Invalid IDP ID")
            );
@@ -4,7 +4,6 @@ import { apiKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyOrgAccess(
    req: Request,
@@ -13,7 +12,7 @@ export async function verifyApiKeyOrgAccess(
 ) {
    try {
        const apiKeyId = req.apiKey?.apiKeyId;
-        const orgId = getFirstString(req.params.orgId);
+        const orgId = req.params.orgId;

        if (!apiKeyId) {
            return next(
@@ -46,7 +45,7 @@ export async function verifyApiKeyOrgAccess(
        }

        if (!req.apiKeyOrg) {
-            return next(
+            next(
                createHttpError(
                    HttpCode.FORBIDDEN,
                    "Key does not have access to this organization"
@@ -4,7 +4,6 @@ import { siteResources, apiKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeySiteResourceAccess(
    req: Request,
@@ -13,8 +12,7 @@ export async function verifyApiKeySiteResourceAccess(
 ) {
    try {
        const apiKey = req.apiKey;
-        const siteResourceIdRaw = getFirstString(req.params.siteResourceId);
-        const siteResourceId = Number.parseInt(siteResourceIdRaw ?? "", 10);
+        const siteResourceId = parseInt(req.params.siteResourceId);

        if (!apiKey) {
            return next(
@@ -22,7 +20,7 @@ export async function verifyApiKeySiteResourceAccess(
            );
        }

-        if (Number.isNaN(siteResourceId)) {
+        if (!siteResourceId) {
            return next(
                createHttpError(
                    HttpCode.BAD_REQUEST,
@@ -4,7 +4,6 @@ import { resources, targets, apiKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyTargetAccess(
    req: Request,
@@ -13,8 +12,7 @@ export async function verifyApiKeyTargetAccess(
 ) {
    try {
        const apiKey = req.apiKey;
-        const targetIdRaw = getFirstString(req.params.targetId);
-        const targetId = Number.parseInt(targetIdRaw ?? "", 10);
+        const targetId = parseInt(req.params.targetId);

        if (!apiKey) {
            return next(
@@ -22,7 +20,7 @@ export async function verifyApiKeyTargetAccess(
            );
        }

-        if (Number.isNaN(targetId)) {
+        if (isNaN(targetId)) {
            return next(
                createHttpError(HttpCode.BAD_REQUEST, "Invalid target ID")
            );
@@ -7,7 +7,6 @@ import HttpCode from "@server/types/HttpCode";
 import { canUserAccessResource } from "@server/auth/canUserAccessResource";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyAccessTokenAccess(
    req: Request,
@@ -15,7 +14,7 @@ export async function verifyAccessTokenAccess(
    next: NextFunction
 ) {
    const userId = req.user!.userId;
-    const accessTokenId = getFirstString(req.params.accessTokenId);
+    const accessTokenId = req.params.accessTokenId;

    if (!userId) {
        return next(
@@ -23,12 +22,6 @@ export async function verifyAccessTokenAccess(
        );
    }

-    if (!accessTokenId) {
-        return next(
-            createHttpError(HttpCode.BAD_REQUEST, "Invalid access token ID")
-        );
-    }
-
    const [accessToken] = await db
        .select()
        .from(resourceAccessToken)
@@ -94,7 +87,7 @@ export async function verifyAccessTokenAccess(
        }

        if (!req.userOrg) {
-            return next(
+            next(
                createHttpError(
                    HttpCode.FORBIDDEN,
                    "User does not have access to this organization"
@@ -6,7 +6,6 @@ import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyApiKeyAccess(
    req: Request,
@@ -15,24 +14,9 @@ export async function verifyApiKeyAccess(
 ) {
    try {
        const userId = req.user!.userId;
-        const apiKeyIdFromParams = getFirstString(req.params?.apiKeyId);
-        const apiKeyIdFromBody = getFirstString(req.body?.apiKeyId);
-
-        if (
-            apiKeyIdFromParams &&
-            apiKeyIdFromBody &&
-            apiKeyIdFromParams !== apiKeyIdFromBody
-        ) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "API key ID provided in both URL and body with different values"
-                )
-            );
-        }
-
-        const apiKeyId = apiKeyIdFromParams || apiKeyIdFromBody;
-        const orgId = getFirstString(req.params.orgId);
+        const apiKeyId =
+            req.params.apiKeyId || req.body.apiKeyId || req.query.apiKeyId;
+        const orgId = req.params.orgId;

        if (!userId) {
            return next(
@@ -120,7 +104,10 @@ export async function verifyApiKeyAccess(
            }
        }

-        req.userOrgRoleIds = await getUserOrgRoleIds(req.userOrg.userId, orgId);
+        req.userOrgRoleIds = await getUserOrgRoleIds(
+            req.userOrg.userId,
+            orgId
+        );

        return next();
    } catch (error) {
@@ -6,7 +6,6 @@ import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyDomainAccess(
    req: Request,
@@ -15,8 +14,9 @@ export async function verifyDomainAccess(
 ) {
    try {
        const userId = req.user!.userId;
-        const domainId = getFirstString(req.params.domainId);
-        const orgId = getFirstString(req.params.orgId);
+        const domainId =
+            req.params.domainId;
+        const orgId = req.params.orgId;

        if (!userId) {
            return next(
@@ -62,7 +62,10 @@ export async function verifyDomainAccess(
                .select()
                .from(userOrgs)
                .where(
-                    and(eq(userOrgs.userId, userId), eq(userOrgs.orgId, orgId))
+                    and(
+                        eq(userOrgs.userId, userId),
+                        eq(userOrgs.orgId, orgId)
+                    )
                )
                .limit(1);
            req.userOrg = userOrgRole[0];
@@ -3,7 +3,6 @@ import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { usageService } from "@server/lib/billing/usageService";
 import { build } from "@server/build";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyLimits(
    req: Request,
@@ -14,10 +13,7 @@ export async function verifyLimits(
        return next();
    }

-    const orgId =
-        req.userOrgId ||
-        req.apiKeyOrg?.orgId ||
-        getFirstString(req.params.orgId);
+    const orgId = req.userOrgId || req.apiKeyOrg?.orgId || req.params.orgId;

    if (!orgId) {
        return next(); // its fine if we silently fail here because this is not critical to operation or security and its better user experience if we dont fail
@@ -6,7 +6,6 @@ import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyOrgAccess(
    req: Request,
@@ -14,7 +13,7 @@ export async function verifyOrgAccess(
    next: NextFunction
 ) {
    const userId = req.user!.userId;
-    const orgId = getFirstString(req.params.orgId);
+    const orgId = req.params.orgId;

    if (!userId) {
        return next(
@@ -1,16 +1,10 @@
 import { Request, Response, NextFunction } from "express";
-import {
-    db,
-    userOrgs,
-    siteProvisioningKeys,
-    siteProvisioningKeyOrg
-} from "@server/db";
+import { db, userOrgs, siteProvisioningKeys, siteProvisioningKeyOrg } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifySiteProvisioningKeyAccess(
    req: Request,
@@ -19,10 +13,8 @@ export async function verifySiteProvisioningKeyAccess(
 ) {
    try {
        const userId = req.user!.userId;
-        const siteProvisioningKeyId = getFirstString(
-            req.params.siteProvisioningKeyId
-        );
-        const orgId = getFirstString(req.params.orgId);
+        const siteProvisioningKeyId = req.params.siteProvisioningKeyId;
+        const orgId = req.params.orgId;

        if (!userId) {
            return next(
@@ -88,7 +80,10 @@ export async function verifySiteProvisioningKeyAccess(
                .where(
                    and(
                        eq(userOrgs.userId, userId),
-                        eq(userOrgs.orgId, row.siteProvisioningKeyOrg.orgId)
+                        eq(
+                            userOrgs.orgId,
+                            row.siteProvisioningKeyOrg.orgId
+                        )
                    )
                )
                .limit(1);
@@ -7,7 +7,6 @@ import HttpCode from "@server/types/HttpCode";
 import { canUserAccessResource } from "../auth/canUserAccessResource";
 import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyTargetAccess(
    req: Request,
@@ -15,8 +14,7 @@ export async function verifyTargetAccess(
    next: NextFunction
 ) {
    const userId = req.user!.userId;
-    const targetIdRaw = getFirstString(req.params.targetId);
-    const targetId = Number.parseInt(targetIdRaw ?? "", 10);
+    const targetId = parseInt(req.params.targetId);

    if (!userId) {
        return next(
@@ -4,7 +4,6 @@ import { userOrgs } from "@server/db";
 import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyUserIsOrgOwner(
    req: Request,
@@ -12,7 +11,7 @@ export async function verifyUserIsOrgOwner(
    next: NextFunction
 ) {
    const userId = req.user!.userId;
-    const orgId = getFirstString(req.params.orgId);
+    const orgId = req.params.orgId;

    if (!userId) {
        return next(
@@ -780,9 +780,9 @@ async function syncAcmeCerts(acmeJsonPath: string): Promise<void> {
            }
        }

-        logger.debug(
-            `acmeCertSync: cert for ${mainDomain} covers ${allDomains.size} domain(s): ${[...allDomains].join(", ")}`
-        );
+        // logger.debug(
+        //     `acmeCertSync: cert for ${mainDomain} covers ${allDomains.size} domain(s): ${[...allDomains].join(", ")}`
+        // );

        for (const domain of allDomains) {
            try {
@@ -13,7 +13,7 @@

 import NodeCache from "node-cache";
 import logger from "@server/logger";
-import { redisManager, regionalRedisManager } from "@server/private/lib/redis";
+import { redisManager } from "@server/private/lib/redis";

 // Create local cache with maxKeys limit to prevent memory leaks
 // With ~10k requests/day and 5min TTL, 10k keys should be more than sufficient
@@ -298,147 +298,3 @@ class AdaptiveCache {
 // Export singleton instance
 export const cache = new AdaptiveCache();
 export default cache;
-
-/**
- * Regional adaptive cache backed by the in-cluster Redis instance.
- * Falls back to a local NodeCache when the regional Redis is unavailable.
- * Use this for data that is regional in nature (e.g. status history) so
- * reads are served from the same cluster the user is hitting.
- */
-const regionalLocalCache = new NodeCache({
-    stdTTL: 3600,
-    checkperiod: 120,
-    maxKeys: 10000
-});
-
-class RegionalAdaptiveCache {
-    private useRedis(): boolean {
-        return (
-            regionalRedisManager.isRedisEnabled() &&
-            regionalRedisManager.getHealthStatus().isHealthy
-        );
-    }
-
-    async set(key: string, value: any, ttl?: number): Promise<boolean> {
-        const effectiveTtl = ttl === 0 ? undefined : ttl;
-        const redisTtl = ttl === 0 ? undefined : (ttl ?? 3600);
-
-        if (this.useRedis()) {
-            try {
-                const serialized = JSON.stringify(value);
-                const success = await regionalRedisManager.set(
-                    key,
-                    serialized,
-                    redisTtl
-                );
-                if (success) {
-                    logger.debug(`[regional] Set key in Redis: ${key}`);
-                    return true;
-                }
-            } catch (error) {
-                logger.error(
-                    `[regional] Redis set error for key ${key}:`,
-                    error
-                );
-            }
-        }
-
-        const success = regionalLocalCache.set(key, value, effectiveTtl || 0);
-        if (success) logger.debug(`[regional] Set key in local cache: ${key}`);
-        return success;
-    }
-
-    async get<T = any>(key: string): Promise<T | undefined> {
-        if (this.useRedis()) {
-            try {
-                const value = await regionalRedisManager.get(key);
-                if (value !== null) {
-                    logger.debug(`[regional] Cache hit in Redis: ${key}`);
-                    return JSON.parse(value) as T;
-                }
-                logger.debug(`[regional] Cache miss in Redis: ${key}`);
-                return undefined;
-            } catch (error) {
-                logger.error(
-                    `[regional] Redis get error for key ${key}:`,
-                    error
-                );
-            }
-        }
-
-        const value = regionalLocalCache.get<T>(key);
-        if (value !== undefined) {
-            logger.debug(`[regional] Cache hit in local cache: ${key}`);
-        } else {
-            logger.debug(`[regional] Cache miss in local cache: ${key}`);
-        }
-        return value;
-    }
-
-    async del(key: string | string[]): Promise<number> {
-        const keys = Array.isArray(key) ? key : [key];
-        let deletedCount = 0;
-
-        if (this.useRedis()) {
-            try {
-                for (const k of keys) {
-                    const success = await regionalRedisManager.del(k);
-                    if (success) {
-                        deletedCount++;
-                        logger.debug(`[regional] Deleted key from Redis: ${k}`);
-                    }
-                }
-                if (deletedCount === keys.length) return deletedCount;
-                deletedCount = 0;
-            } catch (error) {
-                logger.error(`[regional] Redis del error:`, error);
-                deletedCount = 0;
-            }
-        }
-
-        for (const k of keys) {
-            const count = regionalLocalCache.del(k);
-            if (count > 0) {
-                deletedCount++;
-                logger.debug(`[regional] Deleted key from local cache: ${k}`);
-            }
-        }
-        return deletedCount;
-    }
-
-    async has(key: string): Promise<boolean> {
-        if (this.useRedis()) {
-            try {
-                const value = await regionalRedisManager.get(key);
-                return value !== null;
-            } catch (error) {
-                logger.error(
-                    `[regional] Redis has error for key ${key}:`,
-                    error
-                );
-            }
-        }
-        return regionalLocalCache.has(key);
-    }
-
-    /**
-     * Returns keys matching the given prefix from whichever backend is active.
-     * Redis uses a KEYS scan; local cache filters in-memory keys.
-     */
-    async keysWithPrefix(prefix: string): Promise<string[]> {
-        if (this.useRedis()) {
-            try {
-                return await regionalRedisManager.keys(`${prefix}*`);
-            } catch (error) {
-                logger.error(`[regional] Redis keys error:`, error);
-            }
-        }
-        return regionalLocalCache.keys().filter((k) => k.startsWith(prefix));
-    }
-
-    getCurrentBackend(): "redis" | "local" {
-        return this.useRedis() ? "redis" : "local";
-    }
-}
-
-export const regionalCache = new RegionalAdaptiveCache();
@@ -36,8 +36,6 @@ export async function getValidCertificatesForDomains(
    domains: Set<string>,
    useCache: boolean = true
 ): Promise<Array<CertificateResult>> {
-
-
    const finalResults: CertificateResult[] = [];
    const domainsToQuery = new Set<string>();

@@ -49,7 +47,26 @@ export async function getValidCertificatesForDomains(
            if (cachedCert) {
                finalResults.push(cachedCert); // Valid cache hit
            } else {
-                domainsToQuery.add(domain); // Cache miss or expired
+                // Also check for a wildcard cache entry covering this domain's parent
+                const parts = domain.split(".");
+                let wildcardHit = false;
+                if (parts.length > 1) {
+                    const parentDomain = parts.slice(1).join(".");
+                    const wildcardCacheKey = `cert:*.${parentDomain}`;
+                    const cachedWildcard =
+                        await cache.get<CertificateResult>(wildcardCacheKey);
+                    if (cachedWildcard) {
+                        // Re-stamp queriedDomain so callers see the originally requested domain
+                        finalResults.push({
+                            ...cachedWildcard,
+                            queriedDomain: domain
+                        });
+                        wildcardHit = true;
+                    }
+                }
+                if (!wildcardHit) {
+                    domainsToQuery.add(domain); // Cache miss or expired
+                }
            }
        }
    } else {
@@ -59,7 +76,10 @@ export async function getValidCertificatesForDomains(

    // 2. If all domains were resolved from the cache, return early
    if (domainsToQuery.size === 0) {
-        const decryptedResults = decryptFinalResults(finalResults, config.getRawConfig().server.secret!);
+        const decryptedResults = decryptFinalResults(
+            finalResults,
+            config.getRawConfig().server.secret!
+        );
        return decryptedResults;
    }

@@ -78,7 +98,8 @@ export async function getValidCertificatesForDomains(
    const parentDomainsArray = Array.from(parentDomainsToQuery);

    // Build wildcard variants: for each parent domain "example.com", also query "*.example.com"
-    const wildcardPrefixedArray = build != "saas" ? parentDomainsArray.map((d) => `*.${d}`) : [];
+    const wildcardPrefixedArray =
+        build != "saas" ? parentDomainsArray.map((d) => `*.${d}`) : [];

    // 4. Build and execute a single, efficient Drizzle query
    // This query fetches all potential exact and wildcard matches in one database round-trip.
@@ -172,11 +193,24 @@ export async function getValidCertificatesForDomains(
            if (useCache) {
                const cacheKey = `cert:${domain}`;
                await cache.set(cacheKey, resultCert, 180);
+
+                // Also cache wildcard certs under a pattern key so other subdomains
+                // can find them without a DB round-trip
+                if (resultCert.wildcard) {
+                    const normalizedCertDomain = normalizeWildcardDomain(
+                        resultCert.domain
+                    );
+                    const wildcardCacheKey = `cert:*.${normalizedCertDomain}`;
+                    await cache.set(wildcardCacheKey, resultCert, 180);
+                }
            }
        }
    }

-    const decryptedResults = decryptFinalResults(finalResults, config.getRawConfig().server.secret!);
+    const decryptedResults = decryptFinalResults(
+        finalResults,
+        config.getRawConfig().server.secret!
+    );
    return decryptedResults;
 }

@@ -73,25 +73,6 @@ export const privateConfigSchema = z
                    .object({
                        rejectUnauthorized: z.boolean().optional().default(true)
                    })
-                    .optional(),
-                regional_redis: z
-                    .object({
-                        host: z.string(),
-                        port: portSchema,
-                        password: z
-                            .string()
-                            .optional()
-                            .transform(getEnvOrYaml("REGIONAL_REDIS_PASSWORD")),
-                        db: z.int().nonnegative().optional().default(0),
-                        tls: z
-                            .object({
-                                rejectUnauthorized: z
-                                    .boolean()
-                                    .optional()
-                                    .default(true)
-                            })
-                            .optional()
-                    })
                    .optional()
            })
            .optional(),
@@ -109,14 +109,14 @@ class RedisManager {
            password: redisConfig.password,
            db: redisConfig.db
        };
-
+        
        // Enable TLS if configured (required for AWS ElastiCache in-transit encryption)
        if (redisConfig.tls) {
            opts.tls = {
                rejectUnauthorized: redisConfig.tls.rejectUnauthorized ?? true
            };
        }
-
+        
        return opts;
    }

@@ -135,14 +135,14 @@ class RedisManager {
            password: replica.password,
            db: replica.db || redisConfig.db
        };
-
+        
        // Enable TLS if configured (required for AWS ElastiCache in-transit encryption)
        if (redisConfig.tls) {
            opts.tls = {
                rejectUnauthorized: redisConfig.tls.rejectUnauthorized ?? true
            };
        }
-
+        
        return opts;
    }

@@ -855,163 +855,3 @@ class RedisManager {
 export const redisManager = new RedisManager();
 export const redis = redisManager.getClient();
 export default redisManager;
-
-/**
- * Lightweight Redis manager for the regional (in-cluster) Redis instance.
- * Connects only when `redis.regional_redis` is present in the private config
- * and `flags.enable_redis` is true. No pub/sub — designed for low-latency
- * caching of regionally-scoped data.
- */
-class RegionalRedisManager {
-    private writeClient: Redis | null = null;
-    private readClient: Redis | null = null;
-    private isEnabled: boolean = false;
-    private isHealthy: boolean = false;
-    private connectionTimeout: number = 5000;
-    private commandTimeout: number = 5000;
-
-    constructor() {
-        if (build === "oss") return;
-
-        const cfg = privateConfig.getRawPrivateConfig();
-        if (!cfg.flags.enable_redis || !cfg.redis?.regional_redis) return;
-
-        this.isEnabled = true;
-        this.initializeClients();
-    }
-
-    private getConfig(): RedisOptions {
-        const r = privateConfig.getRawPrivateConfig().redis!.regional_redis!;
-        const opts: RedisOptions = {
-            host: r.host,
-            port: r.port,
-            password: r.password,
-            db: r.db
-        };
-        if (r.tls) {
-            opts.tls = { rejectUnauthorized: r.tls.rejectUnauthorized ?? true };
-        }
-        return opts;
-    }
-
-    private initializeClients(): void {
-        const cfg = this.getConfig();
-        const baseOpts = {
-            ...cfg,
-            enableReadyCheck: false,
-            maxRetriesPerRequest: 3,
-            keepAlive: 10000,
-            connectTimeout: this.connectionTimeout,
-            commandTimeout: this.commandTimeout
-        };
-
-        try {
-            this.writeClient = new Redis(baseOpts);
-            // redis-1 (replica) handles reads; fall back to primary if not resolvable
-            this.readClient = new Redis({
-                ...baseOpts,
-                host: cfg.host!.replace(/^(.*?)(\.\S+)$/, (_, h, rest) => {
-                    // Derive replica hostname from the headless service pattern:
-                    // redis.redis.svc.cluster.local -> redis-1.redis-headless.redis.svc.cluster.local
-                    // If it doesn't look like a k8s service, just use the same host
-                    return h + rest;
-                })
-            });
-
-            // For simplicity use same host for both; callers can always read from primary
-            // The real replica routing is handled by the StatefulSet headless service
-            this.readClient = this.writeClient;
-
-            this.writeClient.on("ready", () => {
-                logger.info("Regional Redis client ready");
-                this.isHealthy = true;
-            });
-            this.writeClient.on("error", (err) => {
-                logger.error("Regional Redis client error:", err);
-                this.isHealthy = false;
-            });
-            this.writeClient.on("reconnecting", () => {
-                logger.info("Regional Redis client reconnecting...");
-                this.isHealthy = false;
-            });
-
-            logger.info("Regional Redis client initialized");
-        } catch (error) {
-            logger.error("Failed to initialize regional Redis client:", error);
-            this.isEnabled = false;
-        }
-    }
-
-    public isRedisEnabled(): boolean {
-        return this.isEnabled && this.writeClient !== null && this.isHealthy;
-    }
-
-    public getHealthStatus() {
-        return { isEnabled: this.isEnabled, isHealthy: this.isHealthy };
-    }
-
-    public async set(
-        key: string,
-        value: string,
-        ttl?: number
-    ): Promise<boolean> {
-        if (!this.isRedisEnabled() || !this.writeClient) return false;
-        try {
-            if (ttl) {
-                await this.writeClient.setex(key, ttl, value);
-            } else {
-                await this.writeClient.set(key, value);
-            }
-            return true;
-        } catch (error) {
-            logger.error("Regional Redis SET error:", error);
-            return false;
-        }
-    }
-
-    public async get(key: string): Promise<string | null> {
-        if (!this.isRedisEnabled() || !this.readClient) return null;
-        try {
-            return await this.readClient.get(key);
-        } catch (error) {
-            logger.error("Regional Redis GET error:", error);
-            return null;
-        }
-    }
-
-    public async del(key: string): Promise<boolean> {
-        if (!this.isRedisEnabled() || !this.writeClient) return false;
-        try {
-            await this.writeClient.del(key);
-            return true;
-        } catch (error) {
-            logger.error("Regional Redis DEL error:", error);
-            return false;
-        }
-    }
-
-    public async keys(pattern: string): Promise<string[]> {
-        if (!this.isRedisEnabled() || !this.readClient) return [];
-        try {
-            return await this.readClient.keys(pattern);
-        } catch (error) {
-            logger.error("Regional Redis KEYS error:", error);
-            return [];
-        }
-    }
-
-    public async disconnect(): Promise<void> {
-        try {
-            if (this.writeClient) {
-                await this.writeClient.quit();
-                this.writeClient = null;
-            }
-            this.readClient = null;
-            logger.info("Regional Redis client disconnected");
-        } catch (error) {
-            logger.error("Error disconnecting regional Redis client:", error);
-        }
-    }
-}
-
-export const regionalRedisManager = new RegionalRedisManager();
@@ -12,6 +12,7 @@
 */

 import {
+    browserGatewayTarget,
    certificates,
    db,
    domainNamespaces,
@@ -95,9 +96,7 @@ export async function getTraefikConfig(
            resourceName: resources.name,
            fullDomain: resources.fullDomain,
            ssl: resources.ssl,
-            http: resources.http,
            proxyPort: resources.proxyPort,
-            protocol: resources.protocol,
            subdomain: resources.subdomain,
            domainId: resources.domainId,
            enabled: resources.enabled,
@@ -109,6 +108,7 @@ export async function getTraefikConfig(
            proxyProtocol: resources.proxyProtocol,
            proxyProtocolVersion: resources.proxyProtocolVersion,
            wildcard: resources.wildcard,
+            mode: resources.mode,

            maintenanceModeEnabled: resources.maintenanceModeEnabled,
            maintenanceModeType: resources.maintenanceModeType,
@@ -171,8 +171,8 @@ export async function getTraefikConfig(
                ),
                inArray(sites.type, siteTypes),
                allowRawResources
-                    ? isNotNull(resources.http) // ignore the http check if allow_raw_resources is true
-                    : eq(resources.http, true)
+                    ? inArray(resources.mode, ["http", "udp", "tcp"]) // allow all three
+                    : eq(resources.mode, "http")
            )
        )
        .orderBy(desc(targets.priority), targets.targetId); // stable ordering
@@ -226,9 +226,8 @@ export async function getTraefikConfig(
                key: key,
                fullDomain: row.fullDomain,
                ssl: row.ssl,
-                http: row.http,
                proxyPort: row.proxyPort,
-                protocol: row.protocol,
+                mode: row.mode,
                subdomain: row.subdomain,
                domainId: row.domainId,
                enabled: row.enabled,
@@ -277,10 +276,119 @@ export async function getTraefikConfig(
        });
    });

+    // Query browser gateway targets for this exit node
+    const browserGatewayRows = await db
+        .select({
+            // Resource fields
+            resourceId: resources.resourceId,
+            resourceName: resources.name,
+            fullDomain: resources.fullDomain,
+            ssl: resources.ssl,
+            subdomain: resources.subdomain,
+            domainId: resources.domainId,
+            enabled: resources.enabled,
+            wildcard: resources.wildcard,
+            domainCertResolver: domains.certResolver,
+            preferWildcardCert: domains.preferWildcardCert,
+            domainNamespaceId: domainNamespaces.domainNamespaceId,
+            // Browser gateway target fields
+            browserGatewayTargetId: browserGatewayTarget.browserGatewayTargetId,
+            bgType: browserGatewayTarget.type,
+            // Site fields
+            siteId: sites.siteId,
+            siteType: sites.type,
+            siteOnline: sites.online,
+            subnet: sites.subnet,
+            siteExitNodeId: sites.exitNodeId
+        })
+        .from(browserGatewayTarget)
+        .innerJoin(sites, eq(sites.siteId, browserGatewayTarget.siteId))
+        .innerJoin(
+            resources,
+            eq(resources.resourceId, browserGatewayTarget.resourceId)
+        )
+        .leftJoin(domains, eq(domains.domainId, resources.domainId))
+        .leftJoin(
+            domainNamespaces,
+            eq(domainNamespaces.domainId, resources.domainId)
+        )
+        .where(
+            and(
+                eq(resources.enabled, true),
+                or(
+                    eq(sites.exitNodeId, exitNodeId),
+                    and(
+                        isNull(sites.exitNodeId),
+                        sql`(${siteTypes.includes("local") ? 1 : 0} = 1)`,
+                        eq(sites.type, "local"),
+                        sql`(${build != "saas" ? 1 : 0} = 1)`
+                    )
+                ),
+                inArray(sites.type, siteTypes)
+            )
+        );
+
+    // Group browser gateway targets by resource
+    type BrowserGatewayResourceEntry = {
+        resourceId: number;
+        name: string;
+        fullDomain: string | null;
+        ssl: boolean | null;
+        subdomain: string | null;
+        domainId: string | null;
+        enabled: boolean | null;
+        wildcard: boolean | null;
+        domainCertResolver: string | null;
+        preferWildcardCert: boolean | null;
+        targets: {
+            browserGatewayTargetId: number;
+            bgType: string;
+            siteId: number;
+            siteType: string;
+            siteOnline: boolean | null;
+            subnet: string | null;
+            siteExitNodeId: number | null;
+        }[];
+    };
+    const browserGatewayResourcesMap = new Map<
+        number,
+        BrowserGatewayResourceEntry
+    >();
+
+    for (const row of browserGatewayRows) {
+        if (filterOutNamespaceDomains && row.domainNamespaceId) {
+            continue;
+        }
+        if (!browserGatewayResourcesMap.has(row.resourceId)) {
+            browserGatewayResourcesMap.set(row.resourceId, {
+                resourceId: row.resourceId,
+                name: sanitize(row.resourceName) || "",
+                fullDomain: row.fullDomain,
+                ssl: row.ssl,
+                subdomain: row.subdomain,
+                domainId: row.domainId,
+                enabled: row.enabled,
+                wildcard: row.wildcard,
+                domainCertResolver: row.domainCertResolver,
+                preferWildcardCert: row.preferWildcardCert,
+                targets: []
+            });
+        }
+        browserGatewayResourcesMap.get(row.resourceId)!.targets.push({
+            browserGatewayTargetId: row.browserGatewayTargetId,
+            bgType: row.bgType,
+            siteId: row.siteId,
+            siteType: row.siteType,
+            siteOnline: row.siteOnline,
+            subnet: row.subnet,
+            siteExitNodeId: row.siteExitNodeId
+        });
+    }
+
    let siteResourcesWithFullDomain: {
        siteResourceId: number;
        fullDomain: string | null;
-        mode: "http" | "host" | "cidr";
+        mode: "http" | "host" | "cidr" | "ssh";
    }[] = [];
    if (build == "enterprise") {
        // we dont want to do this on the cloud
@@ -324,6 +432,12 @@ export async function getTraefikConfig(
                domains.add(sr.fullDomain);
            }
        }
+        // Include browser gateway resource domains
+        for (const bgResource of browserGatewayResourcesMap.values()) {
+            if (bgResource.enabled && bgResource.ssl && bgResource.fullDomain) {
+                domains.add(bgResource.fullDomain);
+            }
+        }
        // get the valid certs for these domains
        validCerts = await getValidCertificatesForDomains(domains, true); // we are caching here because this is called often
        // logger.debug(`Valid certs for domains: ${JSON.stringify(validCerts)}`);
@@ -589,7 +703,7 @@ export async function getTraefikConfig(
                            resource.ssl ? entrypointHttps : entrypointHttp
                        ],
                        service: maintenanceServiceName,
-                        rule: `${rule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`))`,
+                        rule: `${rule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`)) `,
                        priority: 2001,
                        ...(resource.ssl ? { tls } : {})
                    };
@@ -830,7 +944,7 @@ export async function getTraefikConfig(
                continue;
            }

-            const protocol = resource.protocol.toLowerCase();
+            const protocol = resource.mode == "udp" ? "udp" : "tcp";
            const port = resource.proxyPort;

            if (!port) {
@@ -925,6 +1039,185 @@ export async function getTraefikConfig(
        }
    }

+    // Generate Traefik config for browser gateway resources
+    const browserGatewayPort = 39999;
+    for (const [, bgResource] of browserGatewayResourcesMap.entries()) {
+        if (!bgResource.enabled) continue;
+        if (!bgResource.domainId) continue;
+        if (!bgResource.fullDomain) continue;
+
+        if (!config_output.http.routers) config_output.http.routers = {};
+        if (!config_output.http.services) config_output.http.services = {};
+
+        const fullDomain = bgResource.fullDomain;
+        const additionalMiddlewares =
+            config.getRawConfig().traefik.additional_middlewares || [];
+        const routerMiddlewares = [
+            badgerMiddlewareName,
+            ...additionalMiddlewares
+        ];
+
+        const hostRule = `Host(\`${fullDomain}\`)`;
+
+        // Build TLS config
+        let tls = {};
+        if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
+            const domainParts = fullDomain.split(".");
+            let wildCard: string;
+            if (domainParts.length <= 2) {
+                wildCard = `*.${domainParts.join(".")}`;
+            } else {
+                wildCard = `*.${domainParts.slice(1).join(".")}`;
+            }
+            if (!bgResource.subdomain) {
+                wildCard = fullDomain;
+            }
+
+            const globalDefaultResolver =
+                config.getRawConfig().traefik.cert_resolver;
+            const globalDefaultPreferWildcard =
+                config.getRawConfig().traefik.prefer_wildcard_cert;
+            const resolverName = bgResource.domainCertResolver
+                ? bgResource.domainCertResolver.trim()
+                : globalDefaultResolver;
+            const preferWildcard =
+                bgResource.preferWildcardCert !== undefined &&
+                bgResource.preferWildcardCert !== null
+                    ? bgResource.preferWildcardCert
+                    : globalDefaultPreferWildcard;
+
+            tls = {
+                certResolver: resolverName,
+                ...(preferWildcard ? { domains: [{ main: wildCard }] } : {})
+            };
+        } else {
+            const matchingCert = validCerts.find(
+                (cert) => cert.queriedDomain === fullDomain
+            );
+            if (!matchingCert) {
+                logger.debug(
+                    `No matching certificate found for browser gateway domain: ${fullDomain}`
+                );
+                continue;
+            }
+        }
+
+        const bgUiServiceName = `bg-r${bgResource.resourceId}-ui-service`;
+
+        if (bgResource.ssl) {
+            const redirectRouterName = `bg-r${bgResource.resourceId}-redirect`;
+            config_output.http.routers![redirectRouterName] = {
+                entryPoints: [config.getRawConfig().traefik.http_entrypoint],
+                middlewares: [redirectHttpsMiddlewareName],
+                service: bgUiServiceName,
+                rule: hostRule,
+                priority: 100
+            };
+        }
+
+        // Collect online sites for this resource (for any type)
+        const anySiteOnline = bgResource.targets.some((t) => t.siteOnline);
+
+        // Group targets by type and generate per-type websocket routers and services
+        const typeMap = new Map<string, typeof bgResource.targets>();
+        for (const t of bgResource.targets) {
+            if (!typeMap.has(t.bgType)) typeMap.set(t.bgType, []);
+            typeMap.get(t.bgType)!.push(t);
+        }
+
+        for (const [bgType, typedTargets] of typeMap.entries()) {
+            const bgKey = `bg-r${bgResource.resourceId}-${bgType}`;
+            const bgRouterName = `${bgKey}-router`;
+            const bgServiceName = `${bgKey}-service`;
+            const bgRule = `${hostRule} && PathPrefix(\`/gateway/${bgType}\`)`;
+
+            const servers = typedTargets
+                .filter((t) => {
+                    if (!t.siteOnline && anySiteOnline) return false;
+                    if (t.siteType === "newt") return !!t.subnet;
+                    return false; // browser gateway only supported on newt sites
+                })
+                .map((t) => ({
+                    url: `http://${t.subnet!.split("/")[0]}:${browserGatewayPort}`
+                }))
+                .filter((v, i, a) => a.findIndex((u) => u.url === v.url) === i);
+
+            config_output.http.routers![bgRouterName] = {
+                entryPoints: [
+                    bgResource.ssl
+                        ? config.getRawConfig().traefik.https_entrypoint
+                        : config.getRawConfig().traefik.http_entrypoint
+                ],
+                middlewares: routerMiddlewares,
+                service: bgServiceName,
+                rule: bgRule,
+                priority: 110, // highest - websocket path takes precedence
+                ...(bgResource.ssl ? { tls } : {})
+            };
+
+            config_output.http.services![bgServiceName] = {
+                loadBalancer: {
+                    servers
+                }
+            };
+        }
+
+        // UI: serve the browser gateway page from the internal pangolin instance.
+        // The primary type is used for the path rewrite (e.g. /rdp), mirroring
+        // how the maintenance page rewrites everything to /maintenance-screen.
+        const primaryType = typeMap.keys().next().value as string;
+        const internalHost = config.getRawConfig().server.internal_hostname;
+        const internalPort = config.getRawConfig().server.next_port;
+        const uiRewriteMiddlewareName = `bg-r${bgResource.resourceId}-ui-rewrite`;
+        const entrypoint = bgResource.ssl
+            ? config.getRawConfig().traefik.https_entrypoint
+            : config.getRawConfig().traefik.http_entrypoint;
+
+        if (!config_output.http.middlewares) {
+            config_output.http.middlewares = {};
+        }
+
+        config_output.http.middlewares![uiRewriteMiddlewareName] = {
+            replacePathRegex: {
+                regex: "^/(.*)",
+                replacement: `/${primaryType}`
+            }
+        };
+
+        config_output.http.services![bgUiServiceName] = {
+            loadBalancer: {
+                servers: [
+                    {
+                        url: `http://${internalHost}:${internalPort}`
+                    }
+                ]
+            }
+        };
+
+        // Assets router at higher priority so /_next files load without rewrite
+        config_output.http.routers![
+            `bg-r${bgResource.resourceId}-assets-router`
+        ] = {
+            entryPoints: [entrypoint],
+            middlewares: routerMiddlewares,
+            service: bgUiServiceName,
+            rule: `${hostRule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
+            priority: 101,
+            ...(bgResource.ssl ? { tls } : {})
+        };
+
+        // Catch-all router rewrites everything on the domain to /{primaryType}
+        config_output.http.routers![`bg-r${bgResource.resourceId}-ui-router`] =
+            {
+                entryPoints: [entrypoint],
+                middlewares: [...routerMiddlewares, uiRewriteMiddlewareName],
+                service: bgUiServiceName,
+                rule: hostRule,
+                priority: 100,
+                ...(bgResource.ssl ? { tls } : {})
+            };
+    }
+
    // Add Traefik routes for siteResource aliases (HTTP mode + SSL) so that
    // Traefik generates TLS certificates for those domains even when no
    // matching resource exists yet.
@@ -1040,7 +1333,7 @@ export async function getTraefikConfig(
            config_output.http.routers[`${siteResourceRouterName}-assets`] = {
                entryPoints: [config.getRawConfig().traefik.https_entrypoint],
                service: siteResourceServiceName,
-                rule: `Host(\`${fullDomain}\`) && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`))`,
+                rule: `Host(\`${fullDomain}\`) && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
                priority: 101,
                tls
            };
@@ -1143,7 +1436,7 @@ export async function getTraefikConfig(
                        config.getRawConfig().traefik.https_entrypoint
                    ],
                    service: "landing-service",
-                    rule: `Host(\`${fullDomain}\`) && (PathRegexp(\`^/auth/resource/[^/]+$\`) || PathRegexp(\`^/auth/idp/[0-9]+/oidc/callback\`) || PathPrefix(\`/_next\`) || Path(\`/auth/org\`) || PathRegexp(\`^/__nextjs*\`))`,
+                    rule: `Host(\`${fullDomain}\`) && (PathRegexp(\`^/auth/resource/[^/]+$\`) || PathRegexp(\`^/auth/idp/[0-9]+/oidc/callback\`) || PathPrefix(\`/_next\`) || Path(\`/auth/org\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
                    priority: 203,
                    tls: tls
                };
@@ -19,7 +19,6 @@ import { eq, and } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import logger from "@server/logger";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyCertificateAccess(
    req: Request,
@@ -28,43 +27,11 @@ export async function verifyCertificateAccess(
 ) {
    try {
        // Assume user/org access is already verified
-        const orgId = getFirstString(req.params.orgId);
-
-        const certIdFromParams = getFirstString(req.params?.certId);
-        const certIdFromBody = getFirstString(req.body?.certId);
-
-        if (
-            certIdFromParams &&
-            certIdFromBody &&
-            certIdFromParams !== certIdFromBody
-        ) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Certificate ID provided in both URL and body with different values"
-                )
-            );
-        }
-
-        const certId = certIdFromParams || certIdFromBody;
-
-        const domainIdFromParams = getFirstString(req.params?.domainId);
-        const domainIdFromBody = getFirstString(req.body?.domainId);
-
-        if (
-            domainIdFromParams &&
-            domainIdFromBody &&
-            domainIdFromParams !== domainIdFromBody
-        ) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Domain ID provided in both URL and body with different values"
-                )
-            );
-        }
-
-        let domainId = domainIdFromParams || domainIdFromBody;
+        const orgId = req.params.orgId;
+        const certId =
+            req.params.certId || req.body?.certId || req.query?.certId;
+        let domainId =
+            req.params.domainId || req.body?.domainId || req.query?.domainId;

        if (!orgId) {
            return next(
@@ -98,7 +65,7 @@ export async function verifyCertificateAccess(
                );
            }

-            domainId = cert.domainId ?? undefined;
+            domainId = cert.domainId;
            if (!domainId) {
                return next(
                    createHttpError(
@@ -17,7 +17,6 @@ import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyIdpAccess(
    req: Request,
@@ -26,12 +25,8 @@ export async function verifyIdpAccess(
 ) {
    try {
        const userId = req.user!.userId;
-        const idpIdRaw =
-            getFirstString(req.params.idpId) ||
-            getFirstString(req.body?.idpId) ||
-            getFirstString(req.query?.idpId);
-        const idpId = Number.parseInt(idpIdRaw ?? "", 10);
-        const orgId = getFirstString(req.params.orgId);
+        const idpId = req.params.idpId || req.body.idpId || req.query.idpId;
+        const orgId = req.params.orgId;

        if (!userId) {
            return next(
@@ -45,7 +40,7 @@ export async function verifyIdpAccess(
            );
        }

-        if (Number.isNaN(idpId)) {
+        if (!idpId) {
            return next(
                createHttpError(HttpCode.BAD_REQUEST, "Invalid key ID")
            );
@@ -18,7 +18,6 @@ import { and, eq } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import { getFirstString } from "@server/lib/requestParams";

 export async function verifyRemoteExitNodeAccess(
    req: Request,
@@ -26,11 +25,11 @@ export async function verifyRemoteExitNodeAccess(
    next: NextFunction
 ) {
    const userId = req.user!.userId; // Assuming you have user information in the request
-    const orgId = getFirstString(req.params.orgId);
+    const orgId = req.params.orgId;
    const remoteExitNodeId =
-        getFirstString(req.params.remoteExitNodeId) ||
-        getFirstString(req.body?.remoteExitNodeId) ||
-        getFirstString(req.query?.remoteExitNodeId);
+        req.params.remoteExitNodeId ||
+        req.body.remoteExitNodeId ||
+        req.query.remoteExitNodeId;

    if (!userId) {
        return next(
@@ -38,15 +37,6 @@ export async function verifyRemoteExitNodeAccess(
        );
    }

-    if (!orgId || !remoteExitNodeId) {
-        return next(
-            createHttpError(
-                HttpCode.BAD_REQUEST,
-                "Invalid organization or remote exit node ID"
-            )
-        );
-    }
-
    try {
        const [remoteExitNode] = await db
            .select()
@@ -0,0 +1,187 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import {
+    browserGatewayTarget,
+    BrowserGatewayTarget,
+    db,
+    newts,
+    resources,
+    sites
+} from "@server/db";
+import { eq, and } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { encrypt } from "@server/lib/crypto";
+import config from "@server/lib/config";
+import { sendBrowserGatewayTargets } from "@server/routers/newt/targets";
+import { generateId } from "@server/auth/sessions/app";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    resourceId: z.string().transform(Number).pipe(z.number().int().positive())
+});
+
+const bodySchema = z.strictObject({
+    siteId: z.number().int().positive(),
+    type: z.enum(["ssh", "rdp", "vnc"]),
+    destination: z.string().nonempty(),
+    destinationPort: z.number().int().min(1).max(65535)
+});
+
+export type CreateBrowserGatewayTargetResponse = BrowserGatewayTarget;
+
+registry.registerPath({
+    method: "put",
+    path: "/org/{orgId}/resource/{resourceId}/browser-gateway-target",
+    description: "Create a browser gateway target for a resource.",
+    tags: [OpenAPITags.Org],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+export async function createBrowserGatewayTarget(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, resourceId } = parsedParams.data;
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { siteId, type, destination, destinationPort } = parsedBody.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(
+                and(
+                    eq(resources.resourceId, resourceId),
+                    eq(resources.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found in organization ${orgId}`
+                )
+            );
+        }
+
+        const [site] = await db
+            .select()
+            .from(sites)
+            .where(and(eq(sites.siteId, siteId), eq(sites.orgId, orgId)))
+            .limit(1);
+
+        if (!site) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Site with ID ${siteId} not found in organization ${orgId}`
+                )
+            );
+        }
+
+        const plainToken = generateId(48);
+        const encryptedToken = encrypt(
+            plainToken,
+            config.getRawConfig().server.secret!
+        );
+
+        const [record] = await db
+            .insert(browserGatewayTarget)
+            .values({
+                resourceId,
+                siteId,
+                type,
+                destination,
+                destinationPort,
+                authToken: encryptedToken
+            })
+            .returning();
+
+        if (site.type === "newt") {
+            const [newt] = await db
+                .select()
+                .from(newts)
+                .where(eq(newts.siteId, siteId))
+                .limit(1);
+
+            if (newt) {
+                await sendBrowserGatewayTargets(
+                    newt.newtId,
+                    [record],
+                    newt.version
+                );
+            }
+        }
+
+        logger.info(
+            `Created browser gateway target ${record.browserGatewayTargetId} for resource ${resourceId}`
+        );
+
+        return response<CreateBrowserGatewayTargetResponse>(res, {
+            data: record,
+            success: true,
+            error: false,
+            message: "Browser gateway target created successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Failed to create browser gateway target"
+            )
+        );
+    }
+}
@@ -0,0 +1,130 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { browserGatewayTarget, db, newts, sites } from "@server/db";
+import { eq, and } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { removeBrowserGatewayTarget } from "@server/routers/newt/targets";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    browserGatewayTargetId: z
+        .string()
+        .transform(Number)
+        .pipe(z.number().int().positive())
+});
+
+registry.registerPath({
+    method: "delete",
+    path: "/org/{orgId}/browser-gateway-target/{browserGatewayTargetId}",
+    description: "Delete a browser gateway target.",
+    tags: [OpenAPITags.Org],
+    request: {
+        params: paramsSchema
+    },
+    responses: {}
+});
+
+export async function deleteBrowserGatewayTarget(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, browserGatewayTargetId } = parsedParams.data;
+
+        const [existing] = await db
+            .select({ bgt: browserGatewayTarget, site: sites })
+            .from(browserGatewayTarget)
+            .innerJoin(sites, eq(sites.siteId, browserGatewayTarget.siteId))
+            .where(
+                and(
+                    eq(
+                        browserGatewayTarget.browserGatewayTargetId,
+                        browserGatewayTargetId
+                    ),
+                    eq(sites.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        if (!existing) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Browser gateway target with ID ${browserGatewayTargetId} not found`
+                )
+            );
+        }
+
+        await db
+            .delete(browserGatewayTarget)
+            .where(
+                eq(
+                    browserGatewayTarget.browserGatewayTargetId,
+                    browserGatewayTargetId
+                )
+            );
+
+        if (existing.site.type === "newt") {
+            const [newt] = await db
+                .select()
+                .from(newts)
+                .where(eq(newts.siteId, existing.bgt.siteId))
+                .limit(1);
+
+            if (newt) {
+                await removeBrowserGatewayTarget(
+                    newt.newtId,
+                    browserGatewayTargetId,
+                    newt.version
+                );
+            }
+        }
+
+        logger.info(`Deleted browser gateway target ${browserGatewayTargetId}`);
+
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Browser gateway target deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Failed to delete browser gateway target"
+            )
+        );
+    }
+}
@@ -0,0 +1,109 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import {
+    browserGatewayTarget,
+    BrowserGatewayTarget,
+    db,
+    sites
+} from "@server/db";
+import { eq, and } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    browserGatewayTargetId: z
+        .string()
+        .transform(Number)
+        .pipe(z.number().int().positive())
+});
+
+export type GetBrowserGatewayTargetResponse = BrowserGatewayTarget;
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/browser-gateway-target/{browserGatewayTargetId}",
+    description: "Get a browser gateway target.",
+    tags: [OpenAPITags.Org],
+    request: {
+        params: paramsSchema
+    },
+    responses: {}
+});
+
+export async function getBrowserGatewayTarget(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, browserGatewayTargetId } = parsedParams.data;
+
+        const [result] = await db
+            .select({ bgt: browserGatewayTarget })
+            .from(browserGatewayTarget)
+            .innerJoin(sites, eq(sites.siteId, browserGatewayTarget.siteId))
+            .where(
+                and(
+                    eq(
+                        browserGatewayTarget.browserGatewayTargetId,
+                        browserGatewayTargetId
+                    ),
+                    eq(sites.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        if (!result) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Browser gateway target with ID ${browserGatewayTargetId} not found`
+                )
+            );
+        }
+
+        return response<GetBrowserGatewayTargetResponse>(res, {
+            data: result.bgt,
+            success: true,
+            error: false,
+            message: "Browser gateway target retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Failed to retrieve browser gateway target"
+            )
+        );
+    }
+}
@@ -0,0 +1,18 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+export * from "./createBrowserGatewayTarget";
+export * from "./updateBrowserGatewayTarget";
+export * from "./deleteBrowserGatewayTarget";
+export * from "./getBrowserGatewayTarget";
+export * from "./listBrowserGatewayTargets";
@@ -0,0 +1,148 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import {
+    browserGatewayTarget,
+    BrowserGatewayTarget,
+    db,
+    resources,
+    sites
+} from "@server/db";
+import { eq, and } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    resourceId: z.string().transform(Number).pipe(z.number().int().positive())
+});
+
+const querySchema = z.object({
+    limit: z
+        .string()
+        .optional()
+        .default("1000")
+        .transform(Number)
+        .pipe(z.number().int().positive()),
+    offset: z
+        .string()
+        .optional()
+        .default("0")
+        .transform(Number)
+        .pipe(z.number().int().nonnegative())
+});
+
+export type ListBrowserGatewayTargetsResponse = {
+    targets: BrowserGatewayTarget[];
+    total: number;
+    limit: number;
+    offset: number;
+};
+
+registry.registerPath({
+    method: "get",
+    path: "/org/{orgId}/resource/{resourceId}/browser-gateway-targets",
+    description: "List browser gateway targets for a resource.",
+    tags: [OpenAPITags.Org],
+    request: {
+        params: paramsSchema,
+        query: querySchema
+    },
+    responses: {}
+});
+
+export async function listBrowserGatewayTargets(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, resourceId } = parsedParams.data;
+
+        const parsedQuery = querySchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error).toString()
+                )
+            );
+        }
+
+        const { limit, offset } = parsedQuery.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(
+                and(
+                    eq(resources.resourceId, resourceId),
+                    eq(resources.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Resource with ID ${resourceId} not found in organization ${orgId}`
+                )
+            );
+        }
+
+        const targets = await db
+            .select()
+            .from(browserGatewayTarget)
+            .where(eq(browserGatewayTarget.resourceId, resourceId))
+            .limit(limit)
+            .offset(offset);
+
+        return response<ListBrowserGatewayTargetsResponse>(res, {
+            data: {
+                targets: targets,
+                total: targets.length,
+                limit,
+                offset
+            },
+            success: true,
+            error: false,
+            message: "Browser gateway targets retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Failed to list browser gateway targets"
+            )
+        );
+    }
+}
@@ -0,0 +1,180 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import {
+    browserGatewayTarget,
+    BrowserGatewayTarget,
+    db,
+    newts,
+    sites
+} from "@server/db";
+import { eq, and } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { sendBrowserGatewayTargets } from "@server/routers/newt/targets";
+
+const paramsSchema = z.strictObject({
+    orgId: z.string().nonempty(),
+    browserGatewayTargetId: z
+        .string()
+        .transform(Number)
+        .pipe(z.number().int().positive())
+});
+
+const bodySchema = z.strictObject({
+    siteId: z.number().int().positive().optional(),
+    type: z.enum(["ssh", "rdp", "vnc"]).optional(),
+    destination: z.string().nonempty().optional(),
+    destinationPort: z.number().int().min(1).max(65535).optional()
+});
+
+export type UpdateBrowserGatewayTargetResponse = BrowserGatewayTarget;
+
+registry.registerPath({
+    method: "post",
+    path: "/org/{orgId}/browser-gateway-target/{browserGatewayTargetId}",
+    description: "Update a browser gateway target.",
+    tags: [OpenAPITags.Org],
+    request: {
+        params: paramsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: bodySchema
+                }
+            }
+        }
+    },
+    responses: {}
+});
+
+export async function updateBrowserGatewayTarget(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = paramsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { orgId, browserGatewayTargetId } = parsedParams.data;
+
+        const parsedBody = bodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { siteId, type, destination, destinationPort } = parsedBody.data;
+
+        const [existing] = await db
+            .select({ bgt: browserGatewayTarget, site: sites })
+            .from(browserGatewayTarget)
+            .innerJoin(sites, eq(sites.siteId, browserGatewayTarget.siteId))
+            .where(
+                and(
+                    eq(
+                        browserGatewayTarget.browserGatewayTargetId,
+                        browserGatewayTargetId
+                    ),
+                    eq(sites.orgId, orgId)
+                )
+            )
+            .limit(1);
+
+        if (!existing) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Browser gateway target with ID ${browserGatewayTargetId} not found`
+                )
+            );
+        }
+
+        const updateValues: Partial<BrowserGatewayTarget> = {};
+        if (siteId !== undefined) updateValues.siteId = siteId;
+        if (type !== undefined) updateValues.type = type;
+        if (destination !== undefined) updateValues.destination = destination;
+        if (destinationPort !== undefined)
+            updateValues.destinationPort = destinationPort;
+
+        const [updated] = await db
+            .update(browserGatewayTarget)
+            .set(updateValues)
+            .where(
+                eq(
+                    browserGatewayTarget.browserGatewayTargetId,
+                    browserGatewayTargetId
+                )
+            )
+            .returning();
+
+        const targetSiteId = siteId ?? existing.bgt.siteId;
+        const [site] = await db
+            .select()
+            .from(sites)
+            .where(eq(sites.siteId, targetSiteId))
+            .limit(1);
+
+        if (site && site.type === "newt") {
+            const [newt] = await db
+                .select()
+                .from(newts)
+                .where(eq(newts.siteId, targetSiteId))
+                .limit(1);
+
+            if (newt) {
+                await sendBrowserGatewayTargets(
+                    newt.newtId,
+                    [updated],
+                    newt.version
+                );
+            }
+        }
+
+        logger.info(`Updated browser gateway target ${browserGatewayTargetId}`);
+
+        return response<UpdateBrowserGatewayTargetResponse>(res, {
+            data: updated,
+            success: true,
+            error: false,
+            message: "Browser gateway target updated successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "Failed to update browser gateway target"
+            )
+        );
+    }
+}
@@ -31,8 +31,8 @@ import * as siteProvisioning from "#private/routers/siteProvisioning";
 import * as eventStreamingDestination from "#private/routers/eventStreamingDestination";
 import * as alertRule from "#private/routers/alertRule";
 import * as healthChecks from "#private/routers/healthChecks";
+import * as browserGatewayTarget from "#private/routers/browserGatewayTarget";
 import * as labels from "#private/routers/labels";
-import * as client from "@server/routers/client";

 import {
    verifyOrgAccess,
@@ -831,14 +831,47 @@ authenticated.get(
    healthChecks.getHealthCheckStatusHistory
 );

+authenticated.put(
+    "/org/:orgId/resource/:resourceId/browser-gateway-target",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyLimits,
+    verifyUserHasAction(ActionsEnum.createBrowserGatewayTarget),
+    logActionAudit(ActionsEnum.createBrowserGatewayTarget),
+    browserGatewayTarget.createBrowserGatewayTarget
+);
+
 authenticated.get(
-    "/client/:clientId/verify-associations-cache",
-    verifyClientAccess,
-    client.verifyClientAssociationsCache
+    "/org/:orgId/resource/:resourceId/browser-gateway-targets",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.listBrowserGatewayTargets),
+    browserGatewayTarget.listBrowserGatewayTargets
+);
+
+authenticated.get(
+    "/org/:orgId/browser-gateway-target/:browserGatewayTargetId",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.getBrowserGatewayTarget),
+    browserGatewayTarget.getBrowserGatewayTarget
 );

 authenticated.post(
-    "/client/:clientId/rebuild-associations-cache",
-    verifyClientAccess,
-    client.rebuildClientAssociationsCacheRoute
+    "/org/:orgId/browser-gateway-target/:browserGatewayTargetId",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyLimits,
+    verifyUserHasAction(ActionsEnum.updateBrowserGatewayTarget),
+    logActionAudit(ActionsEnum.updateBrowserGatewayTarget),
+    browserGatewayTarget.updateBrowserGatewayTarget
+);
+
+authenticated.delete(
+    "/org/:orgId/browser-gateway-target/:browserGatewayTargetId",
+    verifyValidLicense,
+    verifyOrgAccess,
+    verifyUserHasAction(ActionsEnum.deleteBrowserGatewayTarget),
+    logActionAudit(ActionsEnum.deleteBrowserGatewayTarget),
+    browserGatewayTarget.deleteBrowserGatewayTarget
 );
@@ -16,44 +16,40 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { response as sendResponse } from "@server/lib/response";
-import { getFirstString } from "@server/lib/requestParams";
 import privateConfig from "#private/lib/config";
 import { GenerateNewLicenseResponse } from "@server/routers/generatedLicense/types";

 export interface CreateNewLicenseResponse {
-    data: Data;
-    success: boolean;
-    error: boolean;
-    message: string;
-    status: number;
+  data: Data
+  success: boolean
+  error: boolean
+  message: string
+  status: number
 }

 export interface Data {
-    licenseKey: LicenseKey;
+  licenseKey: LicenseKey
 }

 export interface LicenseKey {
-    id: number;
-    instanceName: any;
-    instanceId: string;
-    licenseKey: string;
-    tier: string;
-    type: string;
-    quantity: number;
-    quantity_2: number;
-    isValid: boolean;
-    updatedAt: string;
-    createdAt: string;
-    expiresAt: string;
-    paidFor: boolean;
-    orgId: string;
-    metadata: string;
+  id: number
+  instanceName: any
+  instanceId: string
+  licenseKey: string
+  tier: string
+  type: string
+  quantity: number
+  quantity_2: number
+  isValid: boolean
+  updatedAt: string
+  createdAt: string
+  expiresAt: string
+  paidFor: boolean
+  orgId: string
+  metadata: string
 }

-export async function createNewLicense(
-    orgId: string,
-    licenseData: any
-): Promise<CreateNewLicenseResponse> {
+export async function createNewLicense(orgId: string, licenseData: any): Promise<CreateNewLicenseResponse> {
    try {
        const response = await fetch(
            `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/${orgId}/create`, // this says enterprise but it does both
@@ -84,7 +80,7 @@ export async function generateNewLicense(
    next: NextFunction
 ): Promise<any> {
    try {
-        const orgId = getFirstString(req.params.orgId);
+        const { orgId } = req.params;

        if (!orgId) {
            return next(
@@ -16,7 +16,6 @@ import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { response as sendResponse } from "@server/lib/response";
-import { getFirstString } from "@server/lib/requestParams";
 import privateConfig from "#private/lib/config";
 import {
    GeneratedLicenseKey,
@@ -56,7 +55,7 @@ export async function listSaasLicenseKeys(
    next: NextFunction
 ): Promise<any> {
    try {
-        const orgId = getFirstString(req.params.orgId);
+        const { orgId } = req.params;

        if (!orgId) {
            return next(
@@ -16,6 +16,7 @@ import * as org from "#private/routers/org";
 import * as logs from "#private/routers/auditLogs";
 import * as alertEvents from "#private/routers/alertEvents";
 import * as certificates from "#private/routers/certificates";
+import * as browserGatewayTarget from "#private/routers/browserGatewayTarget";

 import {
    verifyApiKeyHasAction,
@@ -215,3 +216,43 @@ authenticated.delete(
    logActionAudit(ActionsEnum.removeUserRole),
    user.removeUserRole
 );
+
+authenticated.put(
+    "/org/:orgId/resource/:resourceId/browser-gateway-target",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.createBrowserGatewayTarget),
+    logActionAudit(ActionsEnum.createBrowserGatewayTarget),
+    browserGatewayTarget.createBrowserGatewayTarget
+);
+
+authenticated.get(
+    "/org/:orgId/resource/:resourceId/browser-gateway-targets",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.listBrowserGatewayTargets),
+    browserGatewayTarget.listBrowserGatewayTargets
+);
+
+authenticated.get(
+    "/org/:orgId/browser-gateway-target/:browserGatewayTargetId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.getBrowserGatewayTarget),
+    browserGatewayTarget.getBrowserGatewayTarget
+);
+
+authenticated.post(
+    "/org/:orgId/browser-gateway-target/:browserGatewayTargetId",
+    verifyApiKeyOrgAccess,
+    verifyLimits,
+    verifyApiKeyHasAction(ActionsEnum.updateBrowserGatewayTarget),
+    logActionAudit(ActionsEnum.updateBrowserGatewayTarget),
+    browserGatewayTarget.updateBrowserGatewayTarget
+);
+
+authenticated.delete(
+    "/org/:orgId/browser-gateway-target/:browserGatewayTargetId",
+    verifyApiKeyOrgAccess,
+    verifyApiKeyHasAction(ActionsEnum.deleteBrowserGatewayTarget),
+    logActionAudit(ActionsEnum.deleteBrowserGatewayTarget),
+    browserGatewayTarget.deleteBrowserGatewayTarget
+);
@@ -26,6 +26,7 @@ import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { eq, InferInsertModel } from "drizzle-orm";
 import { build } from "@server/build";
+import { validateLocalPath } from "@app/lib/validateLocalPath";
 import config from "#private/lib/config";

 const paramsSchema = z.strictObject({
@@ -34,9 +35,78 @@ const paramsSchema = z.strictObject({

 const bodySchema = z.strictObject({
    logoUrl: z
-        .string()
-        .optional()
-        .transform((val) => (val === "" ? null : val)),
+        .union([
+            z.literal(""),
+            z
+                .string()
+                .superRefine(async (urlOrPath, ctx) => {
+                    const parseResult = z.url().safeParse(urlOrPath);
+                    if (!parseResult.success) {
+                        if (build !== "enterprise") {
+                            ctx.addIssue({
+                                code: "custom",
+                                message: "Must be a valid URL"
+                            });
+                            return;
+                        } else {
+                            try {
+                                validateLocalPath(urlOrPath);
+                            } catch (error) {
+                                ctx.addIssue({
+                                    code: "custom",
+                                    message: "Must be either a valid image URL or a valid pathname starting with `/` and not containing query parameters, `..` or `*`"
+                                });
+                            } finally {
+                                return;
+                            }
+                        }
+                    }
+
+                    try {
+                        const response = await fetch(urlOrPath, {
+                            method: "HEAD"
+                        }).catch(() => {
+                            // If HEAD fails (CORS or method not allowed), try GET
+                            return fetch(urlOrPath, { method: "GET" });
+                        });
+
+                        if (response.status !== 200) {
+                            ctx.addIssue({
+                                code: "custom",
+                                message: `Failed to load image. Please check that the URL is accessible.`
+                            });
+                            return;
+                        }
+
+                        const contentType =
+                            response.headers.get("content-type") ?? "";
+                        if (!contentType.startsWith("image/")) {
+                            ctx.addIssue({
+                                code: "custom",
+                                message: `URL does not point to an image. Please provide a URL to an image file (e.g., .png, .jpg, .svg).`
+                            });
+                            return;
+                        }
+                    } catch (error) {
+                        let errorMessage =
+                            "Unable to verify image URL. Please check that the URL is accessible and points to an image file.";
+
+                        if (error instanceof TypeError && error.message.includes("fetch")) {
+                            errorMessage =
+                                "Network error: Unable to reach the URL. Please check your internet connection and verify the URL is correct.";
+                        } else if (error instanceof Error) {
+                            errorMessage = `Error verifying URL: ${error.message}`;
+                        }
+
+                        ctx.addIssue({
+                            code: "custom",
+                            message: errorMessage
+                        });
+                    }
+                })
+        ])
+        .transform((val) => (val === "" ? null : val))
+        .nullish(),
    logoWidth: z.coerce.number<number>().min(1),
    logoHeight: z.coerce.number<number>().min(1),
    resourceTitle: z.string(),
@@ -23,7 +23,8 @@ import {
    roundTripMessageTracker,
    siteResources,
    siteNetworks,
-    userOrgs
+    userOrgs,
+    sites
 } from "@server/db";
 import { logAccessAudit } from "#private/lib/logAccessAudit";
 import { isLicensedOrSubscribed } from "#private/lib/isLicencedOrSubscribed";
@@ -48,7 +49,8 @@ const bodySchema = z
    .strictObject({
        publicKey: z.string().nonempty(),
        resourceId: z.number().int().positive().optional(),
-        resource: z.string().nonempty().optional() // this is either the nice id or the alias
+        resource: z.string().nonempty().optional(), // this is either the nice id or the alias
+        username: z.string().nonempty().optional()
    })
    .refine(
        (data) => {
@@ -63,19 +65,19 @@ const bodySchema = z
    );

 export type SignSshKeyResponse = {
-    certificate: string;
+    certificate?: string;
    messageIds: number[];
-    messageId: number;
+    messageId?: number;
    sshUsername: string;
    sshHost: string;
    resourceId: number;
    siteIds: number[];
    siteId: number;
-    keyId: string;
-    validPrincipals: string[];
-    validAfter: string;
-    validBefore: string;
-    expiresIn: number;
+    keyId?: string;
+    validPrincipals?: string[];
+    validAfter?: string;
+    validBefore?: string;
+    expiresIn?: number;
 };

 // registry.registerPath({
@@ -126,7 +128,8 @@ export async function signSshKey(
        const {
            publicKey,
            resourceId,
-            resource: resourceQueryString
+            resource: resourceQueryString,
+            username
        } = parsedBody.data;
        const userId = req.user?.userId;
        const roleIds = req.userOrgRoleIds ?? [];
@@ -174,101 +177,6 @@ export async function signSshKey(
            );
        }

-        let usernameToUse;
-        if (!userOrg.pamUsername) {
-            if (req.user?.email) {
-                // Extract username from email (first part before @)
-                usernameToUse = req.user?.email
-                    .split("@")[0]
-                    .replace(/[^a-zA-Z0-9_-]/g, "");
-                if (!usernameToUse) {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "Unable to extract username from email"
-                        )
-                    );
-                }
-            } else if (req.user?.username) {
-                usernameToUse = req.user.username;
-                // We need to clean out any spaces or special characters from the username to ensure it's valid for SSH certificates
-                usernameToUse = usernameToUse.replace(/[^a-zA-Z0-9_-]/g, "-");
-                if (!usernameToUse) {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "Username is not valid for SSH certificate"
-                        )
-                    );
-                }
-            } else {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "User does not have a valid email or username for SSH certificate"
-                    )
-                );
-            }
-
-            // prefix with p-
-            usernameToUse = `p-${usernameToUse}`;
-
-            // check if we have a existing user in this org with the same
-            const [existingUserWithSameName] = await db
-                .select()
-                .from(userOrgs)
-                .where(
-                    and(
-                        eq(userOrgs.orgId, orgId),
-                        eq(userOrgs.pamUsername, usernameToUse)
-                    )
-                )
-                .limit(1);
-
-            if (existingUserWithSameName) {
-                let foundUniqueUsername = false;
-                for (let attempt = 0; attempt < 20; attempt++) {
-                    const randomNum = Math.floor(Math.random() * 101); // 0 to 100
-                    const candidateUsername = `${usernameToUse}${randomNum}`;
-
-                    const [existingUser] = await db
-                        .select()
-                        .from(userOrgs)
-                        .where(
-                            and(
-                                eq(userOrgs.orgId, orgId),
-                                eq(userOrgs.pamUsername, candidateUsername)
-                            )
-                        )
-                        .limit(1);
-
-                    if (!existingUser) {
-                        usernameToUse = candidateUsername;
-                        foundUniqueUsername = true;
-                        break;
-                    }
-                }
-
-                if (!foundUniqueUsername) {
-                    return next(
-                        createHttpError(
-                            HttpCode.CONFLICT,
-                            "Unable to generate a unique username for SSH certificate"
-                        )
-                    );
-                }
-            }
-
-            await db
-                .update(userOrgs)
-                .set({ pamUsername: usernameToUse })
-                .where(
-                    and(eq(userOrgs.orgId, orgId), eq(userOrgs.userId, userId))
-                );
-        } else {
-            usernameToUse = userOrg.pamUsername;
-        }
-
        // Get and decrypt the org's CA keys
        const caKeys = await getOrgCAKeys(
            orgId,
@@ -361,90 +269,303 @@ export async function signSshKey(
            );
        }

-        const roleRows = await db
-            .select({
-                sshSudoCommands: roles.sshSudoCommands,
-                sshUnixGroups: roles.sshUnixGroups,
-                sshCreateHomeDir: roles.sshCreateHomeDir,
-                sshSudoMode: roles.sshSudoMode
-            })
-            .from(roles)
-            .innerJoin(
-                roleSiteResources,
-                eq(roleSiteResources.roleId, roles.roleId)
-            )
-            .where(
-                and(
-                    inArray(roles.roleId, roleIds),
-                    eq(
-                        roleSiteResources.siteResourceId,
-                        resource.siteResourceId
-                    )
-                )
-            );
-
-        const parsedSudoCommands: string[] = [];
-        const parsedGroupsSet = new Set<string>();
-        let homedir: boolean | null = null;
-        const sudoModeOrder = { none: 0, commands: 1, full: 2 };
-        let sudoMode: "none" | "commands" | "full" = "none";
-        for (const roleRow of roleRows) {
-            try {
-                const cmds = JSON.parse(roleRow?.sshSudoCommands ?? "[]");
-                if (Array.isArray(cmds)) parsedSudoCommands.push(...cmds);
-            } catch {
-                // skip
-            }
-            try {
-                const grps = JSON.parse(roleRow?.sshUnixGroups ?? "[]");
-                if (Array.isArray(grps))
-                    grps.forEach((g: string) => parsedGroupsSet.add(g));
-            } catch {
-                // skip
-            }
-            if (roleRow?.sshCreateHomeDir === true) homedir = true;
-            const m = roleRow?.sshSudoMode ?? "none";
-            if (
-                sudoModeOrder[m as keyof typeof sudoModeOrder] >
-                sudoModeOrder[sudoMode]
-            ) {
-                sudoMode = m as "none" | "commands" | "full";
-            }
-        }
-        const parsedGroups = Array.from(parsedGroupsSet);
-        if (homedir === null && roleRows.length > 0) {
-            homedir = roleRows[0].sshCreateHomeDir ?? null;
-        }
-
-        const sites = await db
+        const sitesFromNetworks = await db
            .select({ siteId: siteNetworks.siteId })
            .from(siteNetworks)
            .where(eq(siteNetworks.networkId, resource.networkId!));

-        const siteIds = sites.map((site) => site.siteId);
+        const siteIds = sitesFromNetworks.map((site) => site.siteId);

-        // Sign the public key
-        const now = BigInt(Math.floor(Date.now() / 1000));
-        // only valid for 5 minutes
-        const validFor = 300n;
+        let expiresIn: number | undefined;
+        let messageIds: number[] = [];
+        let cert:
+            | {
+                  certificate: string;
+                  keyId: string;
+                  validPrincipals: string[];
+                  validAfter: Date;
+                  validBefore: Date;
+              }
+            | undefined;
+        // if the pam mode is push then we generate the user's pam username and use that or pull it from the userOrgs table
+        // if the mode is passthrough then just use what was provided because the user will log in themselves
+        let usernameToUse;
+        if (resource.pamMode === "push") {
+            if (!userOrg.pamUsername) {
+                if (req.user?.email) {
+                    // Extract username from email (first part before @)
+                    usernameToUse = req.user?.email
+                        .split("@")[0]
+                        .replace(/[^a-zA-Z0-9_-]/g, "");
+                    if (!usernameToUse) {
+                        return next(
+                            createHttpError(
+                                HttpCode.BAD_REQUEST,
+                                "Unable to extract username from email"
+                            )
+                        );
+                    }
+                } else if (req.user?.username) {
+                    usernameToUse = req.user.username;
+                    // We need to clean out any spaces or special characters from the username to ensure it's valid for SSH certificates
+                    usernameToUse = usernameToUse.replace(
+                        /[^a-zA-Z0-9_-]/g,
+                        "-"
+                    );
+                    if (!usernameToUse) {
+                        return next(
+                            createHttpError(
+                                HttpCode.BAD_REQUEST,
+                                "Username is not valid for SSH certificate"
+                            )
+                        );
+                    }
+                } else {
+                    return next(
+                        createHttpError(
+                            HttpCode.BAD_REQUEST,
+                            "User does not have a valid email or username for SSH certificate"
+                        )
+                    );
+                }

-        const cert = signPublicKey(caKeys.privateKeyPem, publicKey, {
-            keyId: `${usernameToUse}@${resource.niceId}`,
-            validPrincipals: [usernameToUse, resource.niceId],
-            validAfter: now - 60n, // Start 1 min ago for clock skew
-            validBefore: now + validFor
-        });
+                // prefix with p-
+                usernameToUse = `p-${usernameToUse}`;
+
+                // check if we have a existing user in this org with the same
+                const [existingUserWithSameName] = await db
+                    .select()
+                    .from(userOrgs)
+                    .where(
+                        and(
+                            eq(userOrgs.orgId, orgId),
+                            eq(userOrgs.pamUsername, usernameToUse)
+                        )
+                    )
+                    .limit(1);
+
+                if (existingUserWithSameName) {
+                    let foundUniqueUsername = false;
+                    for (let attempt = 0; attempt < 20; attempt++) {
+                        const randomNum = Math.floor(Math.random() * 101); // 0 to 100
+                        const candidateUsername = `${usernameToUse}${randomNum}`;
+
+                        const [existingUser] = await db
+                            .select()
+                            .from(userOrgs)
+                            .where(
+                                and(
+                                    eq(userOrgs.orgId, orgId),
+                                    eq(userOrgs.pamUsername, candidateUsername)
+                                )
+                            )
+                            .limit(1);
+
+                        if (!existingUser) {
+                            usernameToUse = candidateUsername;
+                            foundUniqueUsername = true;
+                            break;
+                        }
+                    }
+
+                    if (!foundUniqueUsername) {
+                        return next(
+                            createHttpError(
+                                HttpCode.CONFLICT,
+                                "Unable to generate a unique username for SSH certificate"
+                            )
+                        );
+                    }
+                }
+
+                await db
+                    .update(userOrgs)
+                    .set({ pamUsername: usernameToUse })
+                    .where(
+                        and(
+                            eq(userOrgs.orgId, orgId),
+                            eq(userOrgs.userId, userId)
+                        )
+                    );
+            } else {
+                usernameToUse = userOrg.pamUsername;
+            }
+
+            const roleRows = await db
+                .select({
+                    sshSudoCommands: roles.sshSudoCommands,
+                    sshUnixGroups: roles.sshUnixGroups,
+                    sshCreateHomeDir: roles.sshCreateHomeDir,
+                    sshSudoMode: roles.sshSudoMode
+                })
+                .from(roles)
+                .innerJoin(
+                    roleSiteResources,
+                    eq(roleSiteResources.roleId, roles.roleId)
+                )
+                .where(
+                    and(
+                        inArray(roles.roleId, roleIds),
+                        eq(
+                            roleSiteResources.siteResourceId,
+                            resource.siteResourceId
+                        )
+                    )
+                );
+
+            const parsedSudoCommands: string[] = [];
+            const parsedGroupsSet = new Set<string>();
+            let homedir: boolean | null = null;
+            const sudoModeOrder = { none: 0, commands: 1, full: 2 };
+            let sudoMode: "none" | "commands" | "full" = "none";
+            for (const roleRow of roleRows) {
+                try {
+                    const cmds = JSON.parse(roleRow?.sshSudoCommands ?? "[]");
+                    if (Array.isArray(cmds)) parsedSudoCommands.push(...cmds);
+                } catch {
+                    // skip
+                }
+                try {
+                    const grps = JSON.parse(roleRow?.sshUnixGroups ?? "[]");
+                    if (Array.isArray(grps))
+                        grps.forEach((g: string) => parsedGroupsSet.add(g));
+                } catch {
+                    // skip
+                }
+                if (roleRow?.sshCreateHomeDir === true) homedir = true;
+                const m = roleRow?.sshSudoMode ?? "none";
+                if (
+                    sudoModeOrder[m as keyof typeof sudoModeOrder] >
+                    sudoModeOrder[sudoMode]
+                ) {
+                    sudoMode = m as "none" | "commands" | "full";
+                }
+            }
+            const parsedGroups = Array.from(parsedGroupsSet);
+            if (homedir === null && roleRows.length > 0) {
+                homedir = roleRows[0].sshCreateHomeDir ?? null;
+            }
+
+            // Sign the public key
+            const now = BigInt(Math.floor(Date.now() / 1000));
+            // only valid for 5 minutes
+            const validFor = 300n;
+            expiresIn = Number(validFor); // seconds
+
+            const cert = signPublicKey(caKeys.privateKeyPem, publicKey, {
+                keyId: `${usernameToUse}@${resource.niceId}`,
+                validPrincipals: [usernameToUse, resource.niceId],
+                validAfter: now - 60n, // Start 1 min ago for clock skew
+                validBefore: now + validFor
+            });
+
+            const messageIds: number[] = [];
+            for (const siteId of siteIds) {
+                // get the site
+                const [newt] = await db
+                    .select()
+                    .from(newts)
+                    .where(eq(newts.siteId, siteId))
+                    .limit(1);
+
+                if (!newt) {
+                    return next(
+                        createHttpError(
+                            HttpCode.INTERNAL_SERVER_ERROR,
+                            "Site associated with resource not found"
+                        )
+                    );
+                }
+
+                const [message] = await db
+                    .insert(roundTripMessageTracker)
+                    .values({
+                        wsClientId: newt.newtId,
+                        messageType: `newt/pam/connection`,
+                        sentAt: Math.floor(Date.now() / 1000)
+                    })
+                    .returning();
+
+                if (!message) {
+                    return next(
+                        createHttpError(
+                            HttpCode.INTERNAL_SERVER_ERROR,
+                            "Failed to create message tracker entry"
+                        )
+                    );
+                }
+
+                messageIds.push(message.messageId);
+
+                await sendToClient(newt.newtId, {
+                    type: `newt/pam/connection`,
+                    data: {
+                        messageId: message.messageId,
+                        orgId: orgId,
+                        agentPort: resource.authDaemonPort ?? 22123,
+                        authDaemonMode: resource.authDaemonMode, // site, remote, native where native is the pty mode
+                        externalAuthDaemon:
+                            resource.authDaemonMode === "remote", // keep this for backward compatibility but new newts are using the authDaemonMode field
+                        agentHost: resource.destination,
+                        caCert: caKeys.publicKeyOpenSSH,
+                        username: usernameToUse,
+                        niceId: resource.niceId,
+                        metadata: {
+                            sudoMode: sudoMode,
+                            sudoCommands: parsedSudoCommands,
+                            homedir: homedir,
+                            groups: parsedGroups
+                        }
+                    }
+                });
+            }
+        } else if (resource.pamMode === "passthrough") {
+            usernameToUse = username;
+            if (!usernameToUse) {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "Username must be provided when PAM mode is passthrough"
+                    )
+                );
+            }
+        } else {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Invalid PAM mode configured for resource"
+                )
+            );
+        }
+
+        let sshHost: string | undefined;
+        if (
+            resource.authDaemonMode === "site" ||
+            resource.authDaemonMode === "remote"
+        ) {
+            if (resource.alias && resource.alias != "") {
+                sshHost = resource.alias;
+            } else {
+                sshHost = resource.destination || ""; // TODO: IF WE HAVE THE NATIVE SSH MODE WHAT SHOULD WE DO HERE?
+            }
+        } else if (resource.authDaemonMode === "native") {
+            if (siteIds.length > 1) {
+                return next(
+                    createHttpError(
+                        HttpCode.INTERNAL_SERVER_ERROR,
+                        "Multiple sites associated with resource, unable to determine SSH host when in native mode"
+                    )
+                );
+            }

-        const messageIds: number[] = [];
-        for (const siteId of siteIds) {
            // get the site
-            const [newt] = await db
+            const [site] = await db
                .select()
-                .from(newts)
-                .where(eq(newts.siteId, siteId))
+                .from(sites)
+                .where(eq(sites.siteId, siteIds[0]))
                .limit(1);

-            if (!newt) {
+            if (!site) {
                return next(
                    createHttpError(
                        HttpCode.INTERNAL_SERVER_ERROR,
@@ -453,54 +574,26 @@ export async function signSshKey(
                );
            }

-            const [message] = await db
-                .insert(roundTripMessageTracker)
-                .values({
-                    wsClientId: newt.newtId,
-                    messageType: `newt/pam/connection`,
-                    sentAt: Math.floor(Date.now() / 1000)
-                })
-                .returning();
-
-            if (!message) {
+            if (!site.address) {
                return next(
                    createHttpError(
                        HttpCode.INTERNAL_SERVER_ERROR,
-                        "Failed to create message tracker entry"
+                        "Site address not configured, unable to determine SSH host when in native mode"
                    )
                );
            }

-            messageIds.push(message.messageId);
-
-            await sendToClient(newt.newtId, {
-                type: `newt/pam/connection`,
-                data: {
-                    messageId: message.messageId,
-                    orgId: orgId,
-                    agentPort: resource.authDaemonPort ?? 22123,
-                    externalAuthDaemon: resource.authDaemonMode === "remote",
-                    agentHost: resource.destination,
-                    caCert: caKeys.publicKeyOpenSSH,
-                    username: usernameToUse,
-                    niceId: resource.niceId,
-                    metadata: {
-                        sudoMode: sudoMode,
-                        sudoCommands: parsedSudoCommands,
-                        homedir: homedir,
-                        groups: parsedGroups
-                    }
-                }
-            });
+            // its the address but split off the cidr if there is one
+            sshHost = site.address.split("/")[0];
        }

-        const expiresIn = Number(validFor); // seconds
-
-        let sshHost;
-        if (resource.alias && resource.alias != "") {
-            sshHost = resource.alias;
-        } else {
-            sshHost = resource.destination;
+        if (!sshHost) {
+            return next(
+                createHttpError(
+                    HttpCode.INTERNAL_SERVER_ERROR,
+                    "Unable to determine SSH host for the resource"
+                )
+            );
        }

        await logsDb.insert(actionAuditLog).values({
@@ -527,7 +620,7 @@ export async function signSshKey(
                : undefined,
            metadata: {
                resourceName: resource.name,
-                siteId: siteIds[0],
+                siteIds: siteIds,
                sshUsername: usernameToUse,
                sshHost: sshHost
            },
@@ -537,18 +630,18 @@ export async function signSshKey(

        return response<SignSshKeyResponse>(res, {
            data: {
-                certificate: cert.certificate,
+                certificate: cert?.certificate,
                messageIds: messageIds,
-                messageId: messageIds[0], // just pick the first one for backward compatibility
+                messageId: messageIds[0], // just pick the first one for backward compatibility with older olms
                sshUsername: usernameToUse,
-                sshHost: sshHost,
+                sshHost: sshHost, // just pick the first one for backward compatibility with older olms
                resourceId: resource.siteResourceId,
                siteIds: siteIds,
-                siteId: siteIds[0], // just pick the first one for backward compatibility
-                keyId: cert.keyId,
-                validPrincipals: cert.validPrincipals,
-                validAfter: cert.validAfter.toISOString(),
-                validBefore: cert.validBefore.toISOString(),
+                siteId: siteIds[0], // just pick the first one for backward compatibility with older olms
+                keyId: cert?.keyId,
+                validPrincipals: cert?.validPrincipals,
+                validAfter: cert?.validAfter.toISOString(),
+                validBefore: cert?.validBefore.toISOString(),
                expiresIn
            },
            success: true,
@@ -25,7 +25,6 @@ import { UserType } from "@server/types/UserTypes";
 import { verifyPassword } from "@server/auth/password";
 import { unauthorized } from "@server/auth/unauthorizedResponse";
 import { verifyTotpCode } from "@server/auth/totp";
-import { getFirstString } from "@server/lib/requestParams";

 // The RP ID is the domain name of your application
 const rpID = (() => {
@@ -407,12 +406,7 @@ export async function deleteSecurityKey(
    res: Response,
    next: NextFunction
 ): Promise<any> {
-    const encodedCredentialId = getFirstString(req.params.credentialId);
-    if (!encodedCredentialId) {
-        return next(
-            createHttpError(HttpCode.BAD_REQUEST, "Invalid credential ID")
-        );
-    }
+    const { credentialId: encodedCredentialId } = req.params;
    const credentialId = decodeURIComponent(encodedCredentialId);
    const user = req.user as User;

@@ -10,5 +10,3 @@ export * from "./listUserDevices";
 export * from "./updateClient";
 export * from "./getClient";
 export * from "./createUserClient";
-export * from "./verifyClientAssociationsCache";
-export * from "./rebuildClientAssociationsCacheRoute";
@@ -118,27 +118,7 @@ const listClientsSchema = z.object({
                description:
                    "Filter by client status. Can be a comma-separated list of values. Defaults to 'active'."
            })
-    ),
-    labels: z
-        .preprocess((val) => {
-            if (val === undefined || val === null || val === "") {
-                return undefined;
-            }
-            if (Array.isArray(val)) {
-                return val;
-            }
-            // the array is returned as this
-            if (typeof val === "string") {
-                return val.split(",");
-            }
-            return undefined;
-        }, z.array(z.string()))
-        .optional()
-        .catch([])
-        .openapi({
-            type: "array",
-            description: "Filter by client labels"
-        })
+    )
 });

 function queryClientsBase() {
@@ -230,16 +210,8 @@ export async function listClients(
                )
            );
        }
-        const {
-            page,
-            pageSize,
-            online,
-            query,
-            status,
-            sort_by,
-            order,
-            labels: labelFilter
-        } = parsedQuery.data;
+        const { page, pageSize, online, query, status, sort_by, order } =
+            parsedQuery.data;

        const parsedParams = listClientsParamsSchema.safeParse(req.params);
        if (!parsedParams.success) {
@@ -326,22 +298,6 @@ export async function listClients(
            conditions.push(or(...filterAggregates));
        }

-        if (isLabelFeatureEnabled && labelFilter && labelFilter.length > 0) {
-            conditions.push(
-                inArray(
-                    clients.clientId,
-                    db
-                        .select({ id: clientLabels.clientId })
-                        .from(clientLabels)
-                        .innerJoin(
-                            labels,
-                            eq(labels.labelId, clientLabels.labelId)
-                        )
-                        .where(inArray(labels.name, labelFilter))
-                )
-            );
-        }
-
        if (query) {
            const q = "%" + query.toLowerCase() + "%";
            const queryList = [
@@ -1,81 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import { clients } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { rebuildClientAssociationsFromClient } from "@server/lib/rebuildClientAssociations";
-
-const paramsSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/client/{clientId}/rebuild-associations-cache",
-    description:
-        "Rebuild the client's site/site-resource association cache based on current permissions.",
-    tags: [OpenAPITags.Client],
-    request: {
-        params: paramsSchema
-    },
-    responses: {}
-});
-
-export async function rebuildClientAssociationsCacheRoute(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { clientId } = parsedParams.data;
-
-        const [client] = await db
-            .select()
-            .from(clients)
-            .where(eq(clients.clientId, clientId))
-            .limit(1);
-
-        if (!client) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Client with ID ${clientId} not found`
-                )
-            );
-        }
-
-        await rebuildClientAssociationsFromClient(client);
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Client association cache rebuilt successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to rebuild client association cache"
-            )
-        );
-    }
-}
@@ -1,83 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import { clients } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { verifyClientAssociationsCache as verifyClientAssociationsCacheLib } from "@server/lib/rebuildClientAssociations";
-
-const paramsSchema = z.strictObject({
-    clientId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/client/{clientId}/verify-associations-cache",
-    description:
-        "Read-only check of whether the client's site/site-resource association cache matches what the current permissions imply.",
-    tags: [OpenAPITags.Client],
-    request: {
-        params: paramsSchema
-    },
-    responses: {}
-});
-
-export async function verifyClientAssociationsCache(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { clientId } = parsedParams.data;
-
-        const [client] = await db
-            .select()
-            .from(clients)
-            .where(eq(clients.clientId, clientId))
-            .limit(1);
-
-        if (!client) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Client with ID ${clientId} not found`
-                )
-            );
-        }
-
-        const report = await verifyClientAssociationsCacheLib(client);
-
-        return response(res, {
-            data: report,
-            success: true,
-            error: false,
-            message: report.consistent
-                ? "Client association cache is consistent"
-                : "Client association cache is INCONSISTENT",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to verify client association cache"
-            )
-        );
-    }
-}
@@ -8,6 +8,7 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
+import { domain } from "zod/v4/core/regexes";

 const getDomainSchema = z.strictObject({
    domainId: z.string().optional(),
@@ -42,6 +42,8 @@ internalRouter.get("/idp", idp.listIdps);

 internalRouter.get("/idp/:idpId", idp.getIdp);

+internalRouter.get("/resource/browser-target", resource.getBrowserTarget);
+
 // Gerbil routes
 const gerbilRouter = Router();
 internalRouter.use("/gerbil", gerbilRouter);
@@ -1,4 +1,6 @@
 import {
+    browserGatewayTarget,
+    BrowserGatewayTarget,
    clients,
    clientSiteResourcesAssociationsCache,
    clientSitesAssociationsCache,
@@ -16,6 +18,7 @@ import logger from "@server/logger";
 import { initPeerAddHandshake, updatePeer } from "../olm/peers";
 import { eq, and } from "drizzle-orm";
 import config from "@server/lib/config";
+import { decrypt } from "@server/lib/crypto";
 import {
    formatEndpoint,
    generateSubnetProxyTargetV2,
@@ -194,7 +197,7 @@ export async function buildTargetConfigurationForNewtClient(
    siteId: number,
    version?: string | null
 ) {
-    // Get all enabled targets with their resource protocol information
+    // Get all enabled targets with their resource mode information
    const allTargets = await db
        .select({
            resourceId: targets.resourceId,
@@ -204,7 +207,7 @@ export async function buildTargetConfigurationForNewtClient(
            port: targets.port,
            internalPort: targets.internalPort,
            enabled: targets.enabled,
-            protocol: resources.protocol
+            mode: resources.mode
        })
        .from(targets)
        .innerJoin(resources, eq(targets.resourceId, resources.resourceId))
@@ -233,6 +236,11 @@ export async function buildTargetConfigurationForNewtClient(
        .from(targetHealthCheck)
        .where(eq(targetHealthCheck.siteId, siteId));

+    const allBrowserGatewayTargets = await db
+        .select()
+        .from(browserGatewayTarget)
+        .where(eq(browserGatewayTarget.siteId, siteId));
+
    const { tcpTargets, udpTargets } = allTargets.reduce(
        (acc, target) => {
            // Filter out invalid targets
@@ -244,10 +252,11 @@ export async function buildTargetConfigurationForNewtClient(
            const formattedTarget = `${target.internalPort}:${formatEndpoint(target.ip, target.port)}`;

            // Add to the appropriate protocol array
-            if (target.protocol === "tcp") {
-                acc.tcpTargets.push(formattedTarget);
-            } else {
+            if (target.mode === "udp") {
                acc.udpTargets.push(formattedTarget);
+            } else {
+                // all other modes are tcp
+                acc.tcpTargets.push(formattedTarget);
            }

            return acc;
@@ -304,9 +313,22 @@ export async function buildTargetConfigurationForNewtClient(
        (target) => target !== null
    );

+    const serverSecret = config.getRawConfig().server.secret!;
+    const browserGatewayTargets = allBrowserGatewayTargets.map((t) => {
+        const decryptAuthToken = decrypt(t.authToken, serverSecret);
+        return {
+            id: t.browserGatewayTargetId,
+            type: t.type,
+            destination: t.destination,
+            destinationPort: t.destinationPort,
+            authToken: decryptAuthToken
+        };
+    });
+
    return {
        validHealthCheckTargets,
        tcpTargets,
-        udpTargets
+        udpTargets,
+        browserGatewayTargets
    };
 }
@@ -43,8 +43,13 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {

    const siteId = newt.siteId;

-    const { publicKey, pingResults, newtVersion, backwardsCompatible, chainId } =
-        message.data;
+    const {
+        publicKey,
+        pingResults,
+        newtVersion,
+        backwardsCompatible,
+        chainId
+    } = message.data;
    if (!publicKey) {
        logger.warn("Public key not provided");
        return;
@@ -191,8 +196,12 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
            .where(eq(newts.newtId, newt.newtId));
    }

-    const { tcpTargets, udpTargets, validHealthCheckTargets } =
-        await buildTargetConfigurationForNewtClient(siteId, newtVersion);
+    const {
+        tcpTargets,
+        udpTargets,
+        validHealthCheckTargets,
+        browserGatewayTargets
+    } = await buildTargetConfigurationForNewtClient(siteId, newtVersion);

    logger.debug(
        `Sending health check targets to newt ${newt.newtId}: ${JSON.stringify(validHealthCheckTargets)}`
@@ -212,6 +221,7 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
                    tcp: tcpTargets
                },
                healthCheckTargets: validHealthCheckTargets,
+                browserGatewayTargets: browserGatewayTargets,
                chainId: chainId
            }
        },
@@ -9,8 +9,12 @@ import {
 import { canCompress } from "@server/lib/clientVersionChecks";

 export async function sendNewtSyncMessage(newt: Newt, site: Site) {
-    const { tcpTargets, udpTargets, validHealthCheckTargets } =
-        await buildTargetConfigurationForNewtClient(site.siteId);
+    const {
+        tcpTargets,
+        udpTargets,
+        validHealthCheckTargets,
+        browserGatewayTargets
+    } = await buildTargetConfigurationForNewtClient(site.siteId);

    let exitNode: ExitNode | undefined;
    if (site.exitNodeId) {
@@ -36,7 +40,8 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
                },
                healthCheckTargets: validHealthCheckTargets,
                peers: peers,
-                clientTargets: targets
+                clientTargets: targets,
+                browserGatewayTargets: browserGatewayTargets
            }
        },
        {
@@ -1,7 +1,9 @@
-import { Target, TargetHealthCheck } from "@server/db";
+import { BrowserGatewayTarget, Target, TargetHealthCheck } from "@server/db";
 import { sendToClient } from "#dynamic/routers/ws";
 import logger from "@server/logger";
 import { canCompress } from "@server/lib/clientVersionChecks";
+import { decrypt } from "@server/lib/crypto";
+import config from "@server/lib/config";

 export async function addTargets(
    newtId: string,
@@ -239,3 +241,55 @@ export async function removeTargets(
        { incrementConfigVersion: true, compress: canCompress(version, "newt") }
    );
 }
+
+export async function sendBrowserGatewayTargets(
+    newtId: string,
+    targets: BrowserGatewayTarget[],
+    version?: string | null
+) {
+    if (targets.length === 0) return;
+
+    const payload = targets.map((t) => {
+        const decryptAuthToken = decrypt(
+            t.authToken,
+            config.getRawConfig().server.secret!
+        );
+        return {
+            id: t.browserGatewayTargetId,
+            resourceId: t.resourceId,
+            siteId: t.siteId,
+            type: t.type,
+            destination: t.destination,
+            destinationPort: t.destinationPort,
+            authToken: decryptAuthToken
+        };
+    });
+
+    await sendToClient(
+        newtId,
+        {
+            type: "newt/browsergateway/add",
+            data: {
+                targets: payload
+            }
+        },
+        { incrementConfigVersion: true, compress: canCompress(version, "newt") }
+    );
+}
+
+export async function removeBrowserGatewayTarget(
+    newtId: string,
+    browserGatewayTargetId: number,
+    version?: string | null
+) {
+    await sendToClient(
+        newtId,
+        {
+            type: "newt/browsergateway/remove",
+            data: {
+                ids: [browserGatewayTargetId]
+            }
+        },
+        { incrementConfigVersion: true, compress: canCompress(version, "newt") }
+    );
+}
@@ -23,7 +23,10 @@ import { OpenAPITags, registry } from "@server/openApi";
 import { build } from "@server/build";
 import { createCertificate } from "#dynamic/routers/certificates/createCertificate";
 import { getUniqueResourceName } from "@server/db/names";
-import { validateAndConstructDomain, checkWildcardDomainConflict } from "@server/lib/domainUtils";
+import {
+    validateAndConstructDomain,
+    checkWildcardDomainConflict
+} from "@server/lib/domainUtils";
 import { isSubscribed } from "#dynamic/lib/isSubscribed";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
@@ -32,15 +35,58 @@ const createResourceParamsSchema = z.strictObject({
    orgId: z.string()
 });

+function resolveModeFromLegacyFields(data: {
+    mode?: "http" | "ssh" | "rdp" | "vnc" | "tcp" | "udp";
+    http?: boolean;
+    protocol?: "tcp" | "udp";
+}): {
+    mode?: "http" | "ssh" | "rdp" | "vnc" | "tcp" | "udp";
+    error?: string;
+} {
+    if (data.mode) {
+        return { mode: data.mode };
+    }
+
+    if (typeof data.http === "boolean" && data.protocol) {
+        if (data.http && data.protocol === "tcp") {
+            return { mode: "http" };
+        }
+        if (!data.http && data.protocol === "tcp") {
+            return { mode: "tcp" };
+        }
+        if (!data.http && data.protocol === "udp") {
+            return { mode: "udp" };
+        }
+        return {
+            error: "Invalid deprecated http/protocol combination"
+        };
+    }
+
+    return { mode: undefined };
+}
+
 const createHttpResourceSchema = z
    .strictObject({
        name: z.string().min(1).max(255),
        subdomain: z.string().nullable().optional(),
-        http: z.boolean(),
-        protocol: z.enum(["tcp", "udp"]),
+        http: z.boolean().optional().openapi({
+            deprecated: true,
+            description:
+                "Deprecated. Use `mode` instead. Legacy compatibility only."
+        }),
+        protocol: z.enum(["tcp", "udp"]).optional().openapi({
+            deprecated: true,
+            description:
+                "Deprecated. Use `mode` instead. Legacy compatibility only."
+        }),
        domainId: z.string(),
        stickySession: z.boolean().optional(),
-        postAuthPath: z.string().nullable().optional()
+        postAuthPath: z.string().nullable().optional(),
+        mode: z.enum(["http", "ssh", "rdp", "vnc", "tcp", "udp"]).optional(),
+        // SSH Settings
+        pamMode: z.enum(["passthrough", "push"]).optional(),
+        authDaemonPort: z.int().positive().optional(),
+        authDaemonMode: z.enum(["site", "remote", "native"]).optional()
    })
    .refine(
        (data) => {
@@ -60,13 +106,27 @@ const createHttpResourceSchema = z
 const createRawResourceSchema = z
    .strictObject({
        name: z.string().min(1).max(255),
-        http: z.boolean(),
-        protocol: z.enum(["tcp", "udp"]),
+        http: z.boolean().optional().openapi({
+            deprecated: true,
+            description:
+                "Deprecated. Use `mode` instead. Legacy compatibility only."
+        }),
+        protocol: z.enum(["tcp", "udp"]).optional().openapi({
+            deprecated: true,
+            description:
+                "Deprecated. Use `mode` instead. Legacy compatibility only."
+        }),
+        mode: z.enum(["tcp", "udp"]).optional(),
        proxyPort: z.int().min(1).max(65535)
        // enableProxy: z.boolean().default(true) // always true now
    })
    .refine(
        (data) => {
+            const resolved = resolveModeFromLegacyFields(data);
+            if (resolved.error || !resolved.mode) {
+                return false;
+            }
+
            if (!config.getRawConfig().flags?.allow_raw_resources) {
                if (data.proxyPort !== undefined) {
                    return false;
@@ -143,17 +203,18 @@ export async function createResource(
            );
        }

-        if (typeof req.body.http !== "boolean") {
+        const resolvedMode = resolveModeFromLegacyFields(req.body);
+        if (resolvedMode.error) {
            return next(
-                createHttpError(HttpCode.BAD_REQUEST, "http field is required")
+                createHttpError(HttpCode.BAD_REQUEST, resolvedMode.error)
            );
        }

-        const { http } = req.body;
+        if (resolvedMode.mode) {
+            req.body.mode = resolvedMode.mode;
+        }

-        if (http) {
-            return await createHttpResource({ req, res, next }, { orgId });
-        } else {
+        if (typeof req.body.proxyPort === "number") {
            if (
                !config.getRawConfig().flags?.allow_raw_resources &&
                build == "oss"
@@ -167,6 +228,17 @@ export async function createResource(
            }
            return await createRawResource({ req, res, next }, { orgId });
        }
+
+        if (req.body.mode) {
+            return await createHttpResource({ req, res, next }, { orgId });
+        } else {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "mode is required when deprecated fields are not provided"
+                )
+            );
+        }
    } catch (error) {
        logger.error(error);
        return next(
@@ -198,7 +270,15 @@ async function createHttpResource(
        );
    }

-    const { name, domainId, postAuthPath } = parsedBody.data;
+    const {
+        name,
+        domainId,
+        postAuthPath,
+        mode,
+        authDaemonPort,
+        authDaemonMode,
+        pamMode
+    } = parsedBody.data;
    const subdomain = parsedBody.data.subdomain;
    const stickySession = parsedBody.data.stickySession;

@@ -322,8 +402,10 @@ async function createHttpResource(
                orgId,
                name,
                subdomain: finalSubdomain,
-                http: true,
-                protocol: "tcp",
+                mode: mode,
+                pamMode: pamMode,
+                authDaemonMode: authDaemonMode,
+                authDaemonPort: authDaemonPort,
                ssl: true,
                stickySession: stickySession,
                postAuthPath: postAuthPath,
@@ -405,7 +487,17 @@ async function createRawResource(
        );
    }

-    const { name, http, protocol, proxyPort } = parsedBody.data;
+    const { name, proxyPort } = parsedBody.data;
+    const resolvedMode = resolveModeFromLegacyFields(parsedBody.data);
+    if (resolvedMode.error || !resolvedMode.mode) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                resolvedMode.error ||
+                    "mode is required when deprecated fields are not provided"
+            )
+        );
+    }

    let resource: Resource | undefined;

@@ -418,9 +510,8 @@ async function createRawResource(
                niceId,
                orgId,
                name,
-                http,
-                protocol,
-                proxyPort
+                proxyPort,
+                mode: resolvedMode.mode
                // enableProxy
            })
            .returning();
@@ -94,7 +94,7 @@ export async function createResourceRule(
            );
        }

-        if (!resource.http) {
+        if (!["http", "ssh", "rdp", "vnc"].includes(resource.mode)) {
            return next(
                createHttpError(
                    HttpCode.BAD_REQUEST,
@@ -106,7 +106,7 @@ export async function deleteResource(
                        // [target],
                        [], // deleting the target from newt causes issues because we cant unbind the port. this needs to be fixed in newt before we can do this
                        healthChecksToBeRemoved,
-                        deletedResource.protocol,
+                        deletedResource.mode === "udp" ? "udp" : "tcp",
                        newt.version
                    );
                }
@@ -0,0 +1,109 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { browserGatewayTarget, db } from "@server/db";
+import { resources, targets } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { fromError } from "zod-validation-error";
+import logger from "@server/logger";
+import { decrypt } from "@server/lib/crypto";
+import config from "@server/lib/config";
+
+const getBrowserTargetSchema = z
+    .object({
+        fullDomain: z.string().min(1, "fullDomain is required")
+    })
+    .strict();
+
+export type GetBrowserTargetResponse = {
+    ip: string;
+    port: number;
+    authToken: string;
+    orgId: string;
+    resourceId: number;
+    niceId: string;
+    pamMode: "passthrough" | "push" | null;
+    authDaemonMode: "site" | "remote" | "native" | null;
+};
+
+export async function getBrowserTarget(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsed = getBrowserTargetSchema.safeParse(req.query);
+        if (!parsed.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsed.error).toString()
+                )
+            );
+        }
+
+        const { fullDomain } = parsed.data;
+
+        logger.info(`Retrieving browser target for domain: ${fullDomain}`);
+
+        const [browserTarget] = await db
+            .select({
+                destination: browserGatewayTarget.destination,
+                destinationPort: browserGatewayTarget.destinationPort,
+                authToken: browserGatewayTarget.authToken,
+                resourceId: resources.resourceId,
+                niceId: resources.niceId,
+                orgId: resources.orgId,
+                pamMode: resources.pamMode,
+                authDaemonMode: resources.authDaemonMode
+            })
+            .from(browserGatewayTarget)
+            .innerJoin(
+                resources,
+                eq(browserGatewayTarget.resourceId, resources.resourceId)
+            )
+            .where(eq(resources.fullDomain, fullDomain))
+            .limit(1);
+
+        const decryptedAuthToken = decrypt(
+            browserTarget.authToken,
+            config.getRawConfig().server.secret!
+        );
+
+        if (!browserTarget) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "No resource found for this domain"
+                )
+            );
+        }
+
+        return response<GetBrowserTargetResponse>(res, {
+            data: {
+                ip: browserTarget.destination,
+                port: browserTarget.destinationPort,
+                authToken: decryptedAuthToken,
+                pamMode: browserTarget.pamMode,
+                authDaemonMode: browserTarget.authDaemonMode,
+                orgId: browserTarget.orgId,
+                resourceId: browserTarget.resourceId,
+                niceId: browserTarget.niceId
+            },
+            success: true,
+            error: false,
+            message: "Browser target retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred while retrieving the browser target"
+            )
+        );
+    }
+}
@@ -19,7 +19,6 @@ import {
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { response } from "@server/lib/response";
-import { getFirstString } from "@server/lib/requestParams";

 export async function getUserResources(
    req: Request,
@@ -27,7 +26,7 @@ export async function getUserResources(
    next: NextFunction
 ): Promise<any> {
    try {
-        const orgId = getFirstString(req.params.orgId);
+        const { orgId } = req.params;
        const userId = req.user?.userId;

        if (!userId) {
@@ -36,12 +35,6 @@ export async function getUserResources(
            );
        }

-        if (!orgId) {
-            return next(
-                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
-            );
-        }
-
        // Check user is in organization and get their role IDs
        const [userOrg] = await db
            .select()
@@ -127,7 +120,7 @@ export async function getUserResources(
            ssl: boolean;
            enabled: boolean;
            sso: boolean;
-            protocol: string;
+            mode: string;
            emailWhitelistEnabled: boolean;
        }> = [];
        if (accessibleResourceIds.length > 0) {
@@ -139,7 +132,7 @@ export async function getUserResources(
                    ssl: resources.ssl,
                    enabled: resources.enabled,
                    sso: resources.sso,
-                    protocol: resources.protocol,
+                    mode: resources.mode,
                    emailWhitelistEnabled: resources.emailWhitelistEnabled
                })
                .from(resources)
@@ -323,7 +316,7 @@ export async function getUserResources(
                        hasPincode ||
                        hasWhitelist
                    ),
-                    protocol: resource.protocol,
+                    mode: resource.mode,
                    sso: resource.sso,
                    password: hasPassword,
                    pincode: hasPincode,
@@ -339,7 +332,6 @@ export async function getUserResources(
                name: siteResource.name,
                destination: siteResource.destination,
                mode: siteResource.mode,
-                protocol: siteResource.scheme,
                ssl: siteResource.ssl,
                fullDomain: siteResource.fullDomain,
                enabled: siteResource.enabled,
@@ -387,14 +379,13 @@ export type GetUserResourcesResponse = {
            domain: string;
            enabled: boolean;
            protected: boolean;
-            protocol: string;
+            mode: string;
        }>;
        siteResources: Array<{
            siteResourceId: number;
            name: string;
            destination: string;
            mode: string;
-            protocol: string | null;
            tcpPortRangeString: string | null;
            udpPortRangeString: string | null;
            disableIcmp: boolean | null;
@@ -33,3 +33,4 @@ export * from "./removeUserFromResource";
 export * from "./listAllResourceNames";
 export * from "./removeEmailFromResourceWhitelist";
 export * from "./getStatusHistory";
+export * from "./getBrowserTarget";
@@ -1,4 +1,5 @@
 import {
+    browserGatewayTarget,
    db,
    labels,
    resourceHeaderAuth,
@@ -71,7 +72,7 @@ const listResourcesSchema = z.object({
        }),
    query: z.string().optional(),
    sort_by: z
-        .literal("name")
+        .enum(["name"])
        .optional()
        .catch(undefined)
        .openapi({
@@ -123,27 +124,7 @@ const listResourcesSchema = z.object({
        type: "integer",
        description:
            "When set, only resources that have at least one target on this site are returned"
-    }),
-    labels: z
-        .preprocess((val) => {
-            if (val === undefined || val === null || val === "") {
-                return undefined;
-            }
-            if (Array.isArray(val)) {
-                return val;
-            }
-            // the array is returned as this
-            if (typeof val === "string") {
-                return val.split(",");
-            }
-            return undefined;
-        }, z.array(z.string()))
-        .optional()
-        .catch([])
-        .openapi({
-            type: "array",
-            description: "Filter by resource labels"
-        })
+    })
 });

 // grouped by resource with targets[])
@@ -156,8 +137,6 @@ export type ResourceWithTargets = {
    sso: boolean;
    pincodeId: number | null;
    whitelist: boolean;
-    http: boolean;
-    protocol: string;
    proxyPort: number | null;
    enabled: boolean;
    domainId: string | null;
@@ -165,6 +144,7 @@ export type ResourceWithTargets = {
    headerAuthId: number | null;
    wildcard: boolean;
    health: string | null;
+    mode: string | null;
    targets: Array<{
        targetId: number;
        ip: string;
@@ -193,8 +173,6 @@ function queryResourcesBase() {
            sso: resources.sso,
            pincodeId: resourcePincode.pincodeId,
            whitelist: resources.emailWhitelistEnabled,
-            http: resources.http,
-            protocol: resources.protocol,
            proxyPort: resources.proxyPort,
            enabled: resources.enabled,
            domainId: resources.domainId,
@@ -203,7 +181,8 @@ function queryResourcesBase() {
            headerAuthId: resourceHeaderAuth.headerAuthId,
            headerAuthExtendedCompatibilityId:
                resourceHeaderAuthExtendedCompatibility.headerAuthExtendedCompatibilityId,
-            health: resources.health
+            health: resources.health,
+            mode: resources.mode
        })
        .from(resources)
        .leftJoin(
@@ -281,8 +260,7 @@ export async function listResources(
            healthStatus,
            sort_by,
            order,
-            siteId,
-            labels: labelFilter
+            siteId
        } = parsedQuery.data;

        const parsedParams = listResourcesParamsSchema.safeParse(req.params);
@@ -364,7 +342,9 @@ export async function listResources(
        if (typeof authState !== "undefined") {
            switch (authState) {
                case "none":
-                    conditions.push(eq(resources.http, false));
+                    conditions.push(
+                        or(eq(resources.mode, "tcp"), eq(resources.mode, "udp"))
+                    );
                    break;
                case "protected":
                    conditions.push(
@@ -400,23 +380,6 @@ export async function listResources(
                .where(and(eq(sites.orgId, orgId), eq(sites.siteId, siteId)));
            conditions.push(inArray(resources.resourceId, resourcesWithSite));
        }
-
-        if (isLabelFeatureEnabled && labelFilter && labelFilter.length > 0) {
-            conditions.push(
-                inArray(
-                    resources.resourceId,
-                    db
-                        .select({ id: resourceLabels.resourceId })
-                        .from(resourceLabels)
-                        .innerJoin(
-                            labels,
-                            eq(labels.labelId, resourceLabels.labelId)
-                        )
-                        .where(inArray(labels.name, labelFilter))
-                )
-            );
-        }
-
        if (query) {
            const q = "%" + query.toLowerCase() + "%";
            const queryList = [
@@ -520,6 +483,30 @@ export async function listResources(
                      )
                      .leftJoin(sites, eq(targets.siteId, sites.siteId));

+        const allBgTargetSites =
+            resourceIdList.length === 0
+                ? []
+                : await db
+                      .select({
+                          resourceId: browserGatewayTarget.resourceId,
+                          siteId: browserGatewayTarget.siteId,
+                          siteName: sites.name,
+                          siteNiceId: sites.niceId,
+                          siteOnline: sites.online,
+                          siteType: sites.type
+                      })
+                      .from(browserGatewayTarget)
+                      .where(
+                          inArray(
+                              browserGatewayTarget.resourceId,
+                              resourceIdList
+                          )
+                      )
+                      .leftJoin(
+                          sites,
+                          eq(sites.siteId, browserGatewayTarget.siteId)
+                      );
+
        // avoids TS issues with reduce/never[]
        const map = new Map<number, ResourceWithTargets>();

@@ -536,10 +523,9 @@ export async function listResources(
                    sso: row.sso,
                    pincodeId: row.pincodeId,
                    whitelist: row.whitelist,
-                    http: row.http,
-                    protocol: row.protocol,
                    proxyPort: row.proxyPort,
                    wildcard: row.wildcard,
+                    mode: row.mode,
                    enabled: row.enabled,
                    domainId: row.domainId,
                    headerAuthId: row.headerAuthId,
@@ -583,6 +569,21 @@ export async function listResources(
                    online: isLocal ? undefined : Boolean(t.siteOnline)
                });
            }
+            const bgRaw = allBgTargetSites.filter(
+                (t) => t.resourceId === entry.resourceId
+            );
+            for (const t of bgRaw) {
+                if (typeof t.siteId !== "number" || siteById.has(t.siteId)) {
+                    continue;
+                }
+                const isLocal = t.siteType === "local";
+                siteById.set(t.siteId, {
+                    siteId: t.siteId,
+                    siteName: t.siteName ?? "",
+                    siteNiceId: t.siteNiceId ?? "",
+                    online: isLocal ? undefined : Boolean(t.siteOnline)
+                });
+            }
            entry.sites = Array.from(siteById.values());
        }

@@ -24,7 +24,10 @@ import {
 import { registry } from "@server/openApi";
 import { OpenAPITags } from "@server/openApi";
 import { createCertificate } from "#dynamic/routers/certificates/createCertificate";
-import { validateAndConstructDomain, checkWildcardDomainConflict } from "@server/lib/domainUtils";
+import {
+    validateAndConstructDomain,
+    checkWildcardDomainConflict
+} from "@server/lib/domainUtils";
 import { build } from "@server/build";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
@@ -68,7 +71,11 @@ const updateHttpResourceBodySchema = z
        maintenanceTitle: z.string().max(255).nullable().optional(),
        maintenanceMessage: z.string().max(2000).nullable().optional(),
        maintenanceEstimatedTime: z.string().max(100).nullable().optional(),
-        postAuthPath: z.string().nullable().optional()
+        postAuthPath: z.string().nullable().optional(),
+        // SSH settings
+        pamMode: z.enum(["passthrough", "push"]).optional(),
+        authDaemonMode: z.enum(["site", "remote", "native"]).optional(),
+        authDaemonPort: z.int().min(1).max(65535).nullable().optional()
    })
    .refine((data) => Object.keys(data).length > 0, {
        error: "At least one field must be provided for update"
@@ -240,7 +247,7 @@ export async function updateResource(
            );
        }

-        if (resource.http) {
+        if (["http", "ssh", "rdp", "vnc"].includes(resource.mode)) {
            // HANDLE UPDATING HTTP RESOURCES
            return await updateHttpResource(
                {
@@ -26,7 +26,9 @@ const updateResourceRuleParamsSchema = z.strictObject({
 const updateResourceRuleSchema = z
    .strictObject({
        action: z.enum(["ACCEPT", "DROP", "PASS"]).optional(),
-        match: z.enum(["CIDR", "IP", "PATH", "COUNTRY", "ASN", "REGION"]).optional(),
+        match: z
+            .enum(["CIDR", "IP", "PATH", "COUNTRY", "ASN", "REGION"])
+            .optional(),
        value: z.string().min(1).optional(),
        priority: z.int(),
        enabled: z.boolean().optional()
@@ -102,7 +104,7 @@ export async function updateResourceRule(
            );
        }

-        if (!resource.http) {
+        if (!["http", "ssh", "rdp", "vnc"].includes(resource.mode)) {
            return next(
                createHttpError(
                    HttpCode.BAD_REQUEST,
@@ -187,26 +187,6 @@ const listSitesSchema = z.object({
            type: "string",
            enum: ["pending", "approved"],
            description: "Filter by site status"
-        }),
-    labels: z
-        .preprocess((val) => {
-            if (val === undefined || val === null || val === "") {
-                return undefined;
-            }
-            if (Array.isArray(val)) {
-                return val;
-            }
-            // the array is returned as this
-            if (typeof val === "string") {
-                return val.split(",");
-            }
-            return undefined;
-        }, z.array(z.string()))
-        .optional()
-        .catch([])
-        .openapi({
-            type: "array",
-            description: "Filter by site labels"
        })
 });

@@ -339,16 +319,8 @@ export async function listSites(
            tierMatrix.labels
        );

-        const {
-            pageSize,
-            page,
-            query,
-            sort_by,
-            order,
-            online,
-            status,
-            labels: labelFilter
-        } = parsedQuery.data;
+        const { pageSize, page, query, sort_by, order, online, status } =
+            parsedQuery.data;

        const accessibleSiteIds = accessibleSites.map((site) => site.siteId);

@@ -365,23 +337,6 @@ export async function listSites(
        if (typeof status !== "undefined") {
            conditions.push(eq(sites.status, status));
        }
-
-        if (isLabelFeatureEnabled && labelFilter && labelFilter.length > 0) {
-            conditions.push(
-                inArray(
-                    sites.siteId,
-                    db
-                        .select({ id: siteLabels.siteId })
-                        .from(siteLabels)
-                        .innerJoin(
-                            labels,
-                            eq(labels.labelId, siteLabels.labelId)
-                        )
-                        .where(inArray(labels.name, labelFilter))
-                )
-            );
-        }
-
        if (query) {
            const q = "%" + query.toLowerCase() + "%";
            const queryList = [
@@ -411,9 +366,7 @@ export async function listSites(

        // we need to add `as` so that drizzle filters the result as a subquery
        const countQuery = db.$count(
-            querySitesBase()
-                .where(and(...conditions))
-                .as("filtered_sites")
+            querySitesBase().where(and(...conditions)).as("filtered_sites")
        );

        const siteListQuery = baseQuery
@@ -44,14 +44,14 @@ const createSiteResourceSchema = z
        name: z.string().min(1).max(255),
        niceId: z.string().optional(),
        // protocol: z.enum(["tcp", "udp"]).optional(),
-        mode: z.enum(["host", "cidr", "http"]),
+        mode: z.enum(["host", "cidr", "http", "ssh"]),
        ssl: z.boolean().optional(), // only used for http mode
        scheme: z.enum(["http", "https"]).optional(),
        siteIds: z.array(z.int()).optional(),
        siteId: z.number().int().positive().optional(), // DEPRECATED: for backward compatibility, we will convert this to siteIds array if provided
        // proxyPort: z.int().positive().optional(),
        destinationPort: z.int().positive().optional(),
-        destination: z.string().min(1),
+        destination: z.string().min(1).optional(),
        enabled: z.boolean().default(true),
        alias: z
            .string()
@@ -67,14 +67,18 @@ const createSiteResourceSchema = z
        udpPortRangeString: portRangeStringSchema,
        disableIcmp: z.boolean().optional(),
        authDaemonPort: z.int().positive().optional(),
-        authDaemonMode: z.enum(["site", "remote"]).optional(),
+        authDaemonMode: z.enum(["site", "remote", "native"]).optional(),
+        pamMode: z.enum(["passthrough", "push"]).optional(),
        domainId: z.string().optional(), // only used for http mode, we need this to verify the alias is unique within the org
        subdomain: z.string().optional() // only used for http mode, we need this to verify the alias is unique within the org
    })
    .strict()
    .refine(
        (data) => {
-            if (data.mode === "host") {
+            if (
+                (data.mode === "host" || data.mode === "ssh") &&
+                data.destination
+            ) {
                // Check if it's a valid IP address using zod (v4 or v6)
                const isValidIP = z
                    // .union([z.ipv4(), z.ipv6()])
@@ -116,19 +120,45 @@ const createSiteResourceSchema = z
    )
    .refine(
        (data) => {
-            if (data.mode !== "http") return true;
-            return (
-                data.scheme !== undefined &&
-                data.destinationPort !== undefined &&
-                data.destinationPort >= 1 &&
-                data.destinationPort <= 65535
-            );
+            if (data.mode === "http") {
+                return (
+                    data.scheme !== undefined &&
+                    data.scheme !== null &&
+                    data.destinationPort !== undefined &&
+                    data.destinationPort !== null &&
+                    data.destinationPort >= 1 &&
+                    data.destinationPort <= 65535
+                );
+            } else if (data.mode === "ssh") {
+                // just check the destinationPort
+                return (
+                    data.destinationPort === undefined ||
+                    (data.destinationPort !== null &&
+                        data.destinationPort >= 1 &&
+                        data.destinationPort <= 65535)
+                );
+            }
        },
        {
            message:
                "HTTP mode requires scheme (http or https) and a valid destination port"
        }
    )
+    .refine(
+        (data) => {
+            // destination is only optional for ssh mode with native authDaemonMode
+            if (data.mode === "ssh" && data.authDaemonMode === "native") {
+                return true;
+            }
+            return (
+                data.destination !== undefined && data.destination.trim() !== ""
+            );
+        },
+        {
+            message:
+                "Destination is required unless mode is ssh with authDaemonMode native"
+        }
+    )
    .refine(
        (data) => {
            return (
@@ -212,6 +242,7 @@ export async function createSiteResource(
            disableIcmp,
            authDaemonPort,
            authDaemonMode,
+            pamMode,
            domainId,
            subdomain
        } = parsedBody.data;
@@ -276,8 +307,8 @@ export async function createSiteResource(
            .safeParse(destination).success;
        if (
            isIp &&
-            (isIpInCidr(destination, org.subnet) ||
-                isIpInCidr(destination, org.utilitySubnet))
+            (isIpInCidr(destination!, org.subnet) ||
+                isIpInCidr(destination!, org.utilitySubnet))
        ) {
            return next(
                createHttpError(
@@ -389,6 +420,15 @@ export async function createSiteResource(
                );
            }

+            let tcpPortRangeStringAdjusted = tcpPortRangeString;
+            if (mode === "http") {
+                tcpPortRangeStringAdjusted = "443,80";
+            } else if (mode === "ssh") {
+                tcpPortRangeStringAdjusted = destinationPort
+                    ? destinationPort.toString()
+                    : "22";
+            }
+
            // Create the site resource
            const insertValues: typeof siteResources.$inferInsert = {
                niceId: updatedNiceId!,
@@ -397,16 +437,18 @@ export async function createSiteResource(
                mode,
                ssl,
                networkId: network.networkId,
-                destination,
+                destination: destination, // the ssh can be null
                scheme,
                destinationPort,
                enabled,
                alias: alias ? alias.trim() : null,
                aliasAddress,
-                tcpPortRangeString:
-                    mode == "http" ? "443,80" : tcpPortRangeString,
-                udpPortRangeString: mode == "http" ? "" : udpPortRangeString,
-                disableIcmp: disableIcmp || (mode == "http" ? true : false), // default to true for http resources, otherwise false
+                tcpPortRangeString: tcpPortRangeStringAdjusted,
+                udpPortRangeString:
+                    mode == "http" || mode == "ssh" ? "" : udpPortRangeString,
+                disableIcmp:
+                    disableIcmp ||
+                    (mode == "http" || mode == "ssh" ? true : false), // default to true for http resources, otherwise false
                domainId,
                subdomain: finalSubdomain,
                fullDomain
@@ -416,6 +458,7 @@ export async function createSiteResource(
                    insertValues.authDaemonPort = authDaemonPort;
                if (authDaemonMode !== undefined)
                    insertValues.authDaemonMode = authDaemonMode;
+                if (pamMode !== undefined) insertValues.pamMode = pamMode;
            }
            [newSiteResource] = await trx
                .insert(siteResources)
@@ -85,27 +85,7 @@ const listAllSiteResourcesByOrgQuerySchema = z.object({
        type: "integer",
        description:
            "When set, only site resources associated with this site (via network) are returned"
-    }),
-    labels: z
-        .preprocess((val) => {
-            if (val === undefined || val === null || val === "") {
-                return undefined;
-            }
-            if (Array.isArray(val)) {
-                return val;
-            }
-            // the array is returned as this
-            if (typeof val === "string") {
-                return val.split(",");
-            }
-            return undefined;
-        }, z.array(z.string()))
-        .optional()
-        .catch([])
-        .openapi({
-            type: "array",
-            description: "Filter by resource labels"
-        })
+    })
 });

 export type ListAllSiteResourcesByOrgResponse = PaginatedResponse<{
@@ -259,16 +239,8 @@ export async function listAllSiteResourcesByOrg(
        }

        const { orgId } = parsedParams.data;
-        const {
-            page,
-            pageSize,
-            query,
-            mode,
-            sort_by,
-            order,
-            siteId,
-            labels: labelFilter
-        } = parsedQuery.data;
+        const { page, pageSize, query, mode, sort_by, order, siteId } =
+            parsedQuery.data;

        const isLabelFeatureEnabled = await isLicensedOrSubscribed(
            orgId,
@@ -304,22 +276,6 @@ export async function listAllSiteResourcesByOrg(
            conditions.push(eq(siteResources.mode, mode));
        }

-        if (isLabelFeatureEnabled && labelFilter && labelFilter.length > 0) {
-            conditions.push(
-                inArray(
-                    siteResources.siteResourceId,
-                    db
-                        .select({ id: siteResourceLabels.siteResourceId })
-                        .from(siteResourceLabels)
-                        .innerJoin(
-                            labels,
-                            eq(labels.labelId, siteResourceLabels.labelId)
-                        )
-                        .where(inArray(labels.name, labelFilter))
-                )
-            );
-        }
-
        if (query) {
            const q = "%" + query.toLowerCase() + "%";
            const queryList = [
@@ -56,7 +56,7 @@ const updateSiteResourceSchema = z
            )
            .optional(),
        // mode: z.enum(["host", "cidr", "port"]).optional(),
-        mode: z.enum(["host", "cidr", "http"]).optional(),
+        mode: z.enum(["host", "cidr", "http", "ssh"]).optional(),
        ssl: z.boolean().optional(),
        scheme: z.enum(["http", "https"]).nullish(),
        // proxyPort: z.int().positive().nullish(),
@@ -77,14 +77,18 @@ const updateSiteResourceSchema = z
        udpPortRangeString: portRangeStringSchema,
        disableIcmp: z.boolean().optional(),
        authDaemonPort: z.int().positive().nullish(),
-        authDaemonMode: z.enum(["site", "remote"]).optional(),
+        authDaemonMode: z.enum(["site", "remote", "native"]).optional(),
+        pamMode: z.enum(["passthrough", "push"]).optional(),
        domainId: z.string().optional(),
        subdomain: z.string().optional()
    })
    .strict()
    .refine(
        (data) => {
-            if (data.mode === "host" && data.destination) {
+            if (
+                (data.mode === "host" || data.mode == "ssh") &&
+                data.destination
+            ) {
                const isValidIP = z
                    // .union([z.ipv4(), z.ipv6()])
                    .union([z.ipv4()]) // for now lets just do ipv4 until we verify ipv6 works everywhere
@@ -125,21 +129,45 @@ const updateSiteResourceSchema = z
    )
    .refine(
        (data) => {
-            if (data.mode !== "http") return true;
-            return (
-                data.scheme !== undefined &&
-                data.scheme !== null &&
-                data.destinationPort !== undefined &&
-                data.destinationPort !== null &&
-                data.destinationPort >= 1 &&
-                data.destinationPort <= 65535
-            );
+            if (data.mode === "http") {
+                return (
+                    data.scheme !== undefined &&
+                    data.scheme !== null &&
+                    data.destinationPort !== undefined &&
+                    data.destinationPort !== null &&
+                    data.destinationPort >= 1 &&
+                    data.destinationPort <= 65535
+                );
+            } else if (data.mode === "ssh") {
+                // just check the destinationPort
+                return (
+                    data.destinationPort === undefined ||
+                    (data.destinationPort !== null &&
+                        data.destinationPort >= 1 &&
+                        data.destinationPort <= 65535)
+                );
+            }
        },
        {
            message:
                "HTTP mode requires scheme (http or https) and a valid destination port"
        }
    )
+    .refine(
+        (data) => {
+            // destination is only optional for ssh mode with native authDaemonMode
+            if (data.mode === "ssh" && data.authDaemonMode === "native") {
+                return true;
+            }
+            return (
+                data.destination !== undefined && data.destination.trim() !== ""
+            );
+        },
+        {
+            message:
+                "Destination is required unless mode is ssh with authDaemonMode native"
+        }
+    )
    .refine(
        (data) => {
            return (
@@ -222,6 +250,7 @@ export async function updateSiteResource(
            disableIcmp,
            authDaemonPort,
            authDaemonMode,
+            pamMode,
            domainId,
            subdomain
        } = parsedBody.data;
@@ -430,16 +459,30 @@ export async function updateSiteResource(
                const sshPamSet =
                    isLicensedSshPam &&
                    (authDaemonPort !== undefined ||
-                        authDaemonMode !== undefined)
+                        authDaemonMode !== undefined ||
+                        pamMode !== undefined)
                        ? {
                              ...(authDaemonPort !== undefined && {
                                  authDaemonPort
                              }),
                              ...(authDaemonMode !== undefined && {
                                  authDaemonMode
+                              }),
+                              ...(pamMode !== undefined && {
+                                  pamMode
                              })
                          }
                        : {};
+
+                let tcpPortRangeStringAdjusted = tcpPortRangeString;
+                if (mode === "http") {
+                    tcpPortRangeStringAdjusted = "443,80";
+                } else if (mode === "ssh") {
+                    tcpPortRangeStringAdjusted = destinationPort
+                        ? destinationPort.toString()
+                        : "22";
+                }
+
                [updatedSiteResource] = await trx
                    .update(siteResources)
                    .set({
@@ -452,12 +495,14 @@ export async function updateSiteResource(
                        destinationPort,
                        enabled,
                        alias: alias ? alias.trim() : null,
-                        tcpPortRangeString:
-                            mode == "http" ? "443,80" : tcpPortRangeString,
+                        tcpPortRangeString: tcpPortRangeStringAdjusted,
                        udpPortRangeString:
-                            mode == "http" ? "" : udpPortRangeString,
+                            mode == "http" || mode == "ssh"
+                                ? ""
+                                : udpPortRangeString,
                        disableIcmp:
-                            disableIcmp || (mode == "http" ? true : false), // default to true for http resources, otherwise false
+                            disableIcmp ||
+                            (mode == "http" || mode == "ssh" ? true : false), // default to true for http resources, otherwise false
                        domainId,
                        subdomain: finalSubdomain,
                        fullDomain,
@@ -554,13 +599,17 @@ export async function updateSiteResource(
                const sshPamSet =
                    isLicensedSshPam &&
                    (authDaemonPort !== undefined ||
-                        authDaemonMode !== undefined)
+                        authDaemonMode !== undefined ||
+                        pamMode !== undefined)
                        ? {
                              ...(authDaemonPort !== undefined && {
                                  authDaemonPort
                              }),
                              ...(authDaemonMode !== undefined && {
                                  authDaemonMode
+                              }),
+                              ...(pamMode !== undefined && {
+                                  pamMode
                              })
                          }
                        : {};
@@ -832,6 +881,10 @@ export async function handleMessagingForUpdatedSiteResource(
            for (const client of mergedAllClients) {
                // does this client have access to another resource on this site that has the same destination still? if so we dont want to remove it from their olm yet
                // todo: optimize this query if needed
+                if (!existingSiteResource.destination) {
+                    continue;
+                }
+
                const oldDestinationStillInUseSites = await trx
                    .select()
                    .from(siteResources)
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Owen	cd9e56fdb7	Make the destination optional	2026-05-27 17:52:04 -07:00
Owen	1b6b112e92	Add auth daemon to blueprints	2026-05-27 17:29:19 -07:00
Owen	0ff0e83c9f	Complete removal of http and protocol from public	2026-05-27 17:19:04 -07:00
Owen	6d491b7bb9	Cache wildcard certs for easy lookup	2026-05-27 14:58:36 -07:00
Owen	06cc13c637	Moving to mode replacing http and protocol fields	2026-05-27 12:04:00 -07:00
Owen	464d4990df	Fix cascading errors	2026-05-27 11:34:34 -07:00
Owen	cb90672573	Trying to get these forms to work	2026-05-26 21:20:34 -07:00
Owen	e19b6ebc82	Hide the destination and the alias	2026-05-26 20:38:04 -07:00
Owen	5a6de12f74	Revert to the mode on top and make it 2 x 2	2026-05-26 20:30:33 -07:00
Owen	6e6c91a27c	Move site down	2026-05-26 20:16:54 -07:00
Owen	aa7004b2ff	Add new ssh config for private resources	2026-05-26 17:50:46 -07:00
Owen	eca87b66f0	Use the create api	2026-05-26 17:11:45 -07:00
Owen	cc8c89eeae	Cleaning up some react	2026-05-26 16:53:22 -07:00
Owen	6ea4aa1920	Suppoter key	2026-05-26 16:35:28 -07:00
Owen	f12451b8f9	Consolidate target components	2026-05-26 16:33:54 -07:00
Owen	0d4bb65a92	Adjusting the create ui	2026-05-26 16:10:06 -07:00
Owen	d47ad9ac40	Fix height problem	2026-05-26 16:08:52 -07:00
Owen	f81ae24ba7	Clean up the ui a bit	2026-05-26 15:05:30 -07:00
Owen	df1e28aabd	Pass one on the new create screen	2026-05-26 14:29:13 -07:00
Owen	4c1e1daf07	All page types are there and look mostly correct	2026-05-22 17:37:37 -07:00
Owen	7c54df7ed1	Rework page to be functional	2026-05-22 16:09:02 -07:00
Owen	9d77fcc457	Make the first ssh page and conditional http page	2026-05-22 15:12:37 -07:00
Owen	454449ec8a	Add support for push pam users	2026-05-22 12:12:55 -07:00
Owen	fe67e8e384	Clean up types	2026-05-22 12:12:46 -07:00
Owen	715b957660	Support not push ssh method	2026-05-22 11:19:35 -07:00
Owen	f1e4bf8d36	Add hint about invoices for the license key	2026-05-22 10:30:41 -07:00
Owen	23ca3efbf4	Merge branch 'dev' into rdp-ssh	2026-05-19 20:12:05 -07:00
Owen	0f9100fd3a	Merge branch 'rdp-ssh' of github.com:fosrl/pangolin into rdp-ssh	2026-05-19 20:06:48 -07:00
Owen	832d45e32b	Move pages back	2026-05-19 20:02:27 -07:00
Owen	69e3ac3cd4	Move login page locations	2026-05-19 20:02:27 -07:00
Owen	50865f4265	Remove terminate button	2026-05-19 20:02:27 -07:00
Owen	0d1a8d9695	Only switch if we are actually connected	2026-05-19 20:02:27 -07:00
Owen	5d8486dd7f	Sure up some things with browserAccessType	2026-05-19 20:02:27 -07:00
Owen	3c25932787	Adjust page to be editable	2026-05-19 20:02:27 -07:00
Owen	1d0e1eb126	Temp credential storage	2026-05-19 20:02:27 -07:00
Owen	57c0dc8618	Support private key	2026-05-19 20:02:27 -07:00
Owen	526a147570	Clean up toasts	2026-05-19 20:02:27 -07:00
Owen	0938997548	Add crud for browser targets	2026-05-19 20:02:27 -07:00
Owen	0876b482f8	Remove extra fields	2026-05-19 20:02:27 -07:00
Owen	d558c31f88	Standardize the ui	2026-05-19 20:02:26 -07:00
Owen	6010515da0	Pull in the destination from the api	2026-05-19 20:02:26 -07:00
Owen	868bcd8e34	USe right table	2026-05-19 20:02:26 -07:00
Owen	20c4904965	Add internal api get for proxy information	2026-05-19 20:02:26 -07:00
Owen	5a5536b38c	Reinstall packages	2026-05-19 20:02:26 -07:00
Owen	53e2296de8	Clean up forms a bit	2026-05-19 20:02:26 -07:00
Owen	d2423919e9	Add favicon passthrough	2026-05-19 20:02:26 -07:00
Owen	2250fcd177	Serve the resource from the right place	2026-05-19 20:02:26 -07:00
Owen	2a33256d17	Add gateway endpoints into the traefik config	2026-05-19 20:02:26 -07:00
Owen	117aa750f8	Working on new target type	2026-05-19 20:02:26 -07:00
Owen	15f161274f	Add browserGatewayTarget table	2026-05-19 20:02:26 -07:00
Owen	09779aca3e	Add basic vnc test	2026-05-19 20:02:25 -07:00
Owen	1d1f7cecf4	Support rdp	2026-05-19 20:02:25 -07:00
Owen	dc00668cbe	Add first iteration of ssh proxy	2026-05-19 20:02:25 -07:00
Owen	57701e13eb	Comment out some fields	2026-05-19 20:02:25 -07:00
Owen	46545cb003	Initial rdp working	2026-05-19 20:02:21 -07:00
Owen	987b5d580e	Sure up some things with browserAccessType	2026-05-15 17:26:58 -07:00
Owen	cb75ffc3b7	Adjust page to be editable	2026-05-15 16:46:43 -07:00
Owen	540f0a754d	Temp credential storage	2026-05-15 16:11:23 -07:00
Owen	0f9a6fd968	Support private key	2026-05-15 16:07:14 -07:00
Owen	82112abc34	Clean up toasts	2026-05-15 15:01:37 -07:00
Owen	75b5afd544	Add crud for browser targets	2026-05-15 14:09:33 -07:00
Owen	00e1675f7b	Remove extra fields	2026-05-15 12:08:40 -07:00
Owen	2ddbdf977b	Standardize the ui	2026-05-15 12:06:05 -07:00
Owen	4c8f0cc9ec	Pull in the destination from the api	2026-05-15 11:48:13 -07:00
Owen	e822b681cd	Merge branch 'dev' into rdp-ssh	2026-05-15 11:18:31 -07:00
Owen	e1583a58aa	USe right table	2026-05-14 11:33:42 -07:00
Owen	7d922ac95f	Add internal api get for proxy information	2026-05-13 21:54:58 -07:00
Owen	795a3d351e	Reinstall packages	2026-05-13 21:16:40 -07:00
Owen	4b4c86b4b7	Clean up forms a bit	2026-05-13 21:16:00 -07:00
Owen	013af49137	Add favicon passthrough	2026-05-13 21:11:25 -07:00
Owen	a6ae9290f2	Serve the resource from the right place	2026-05-13 18:01:36 -07:00
Owen	de70d72e0d	Add gateway endpoints into the traefik config	2026-05-13 17:33:16 -07:00
Owen	4e07e9c52c	Working on new target type	2026-05-13 11:56:23 -07:00
Owen	743621eb25	Add browserGatewayTarget table	2026-05-12 21:48:59 -07:00
Owen	943923ff4b	Add basic vnc test	2026-05-12 21:12:01 -07:00
Owen	3f17f1a468	Support rdp	2026-05-12 21:12:01 -07:00
Owen	436996a43d	Add first iteration of ssh proxy	2026-05-12 21:12:01 -07:00
Owen	d42b6076d2	Comment out some fields	2026-05-12 21:12:01 -07:00
Owen	89cc99f915	Initial rdp working	2026-05-12 21:12:00 -07:00