Bump the docker-dependencies group across 1 directory with 2 updates

Bumps the docker-dependencies group with 2 updates in the / directory: docker/library/node and node.


Updates `docker/library/node` from 24.18.1-slim to 26.9.0-slim

Updates `node` from 24.18.1-alpine to 26.9.0-alpine

---
updated-dependencies:
- dependency-name: docker/library/node
  dependency-version: 26.9.0-slim
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: docker-dependencies
- dependency-name: node
  dependency-version: 26.9.0-alpine
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: docker-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

Dockerfile

@@ -1,5 +1,5 @@
 # FROM node:24.18.1-slim AS base
-FROM public.ecr.aws/docker/library/node:24.18.1-slim AS base
+FROM public.ecr.aws/docker/library/node:26.9.0-slim AS base
 
 WORKDIR /app
 
@@ -33,7 +33,7 @@ FROM base AS builder
 RUN npm ci --omit=dev
 
 # FROM node:24.18.1-slim AS runner
-FROM public.ecr.aws/docker/library/node:24.18.1-slim AS runner
+FROM public.ecr.aws/docker/library/node:26.9.0-slim AS runner
 
 WORKDIR /app
 

Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM node:24.18.1-alpine
+FROM node:26.9.0-alpine
 
 WORKDIR /app
 

README.md

@@ -142,6 +142,7 @@ Give users a landing page to quickly find and open the resources they can access
 * Create reusable views for common access patterns
 
 <img src="public/screenshots/resource-launcher.png" alt="Resource Launcher" width="100%" />
+<img src="public/screenshots/resource-launcher-expanded.png" alt="Resource Launcher Details Panel" width="100%" />
 
 ## Download Clients
 

cli/index.ts

@@ -2,8 +2,8 @@
 
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
-import { setAdminCredentials } from "@cli/commands/setAdminCredentials";
-import { resetUserSecurityKeys } from "@cli/commands/resetUserSecurityKeys";
+import { setAdminCredentials } from "./commands/setAdminCredentials";
+import { resetUserSecurityKeys } from "./commands/resetUserSecurityKeys";
 import { clearExitNodes } from "./commands/clearExitNodes";
 import { rotateServerSecret } from "./commands/rotateServerSecret";
 import { clearLicenseKeys } from "./commands/clearLicenseKeys";

config/ha-reference/node1/docker-compose.yml

@@ -1,7 +1,7 @@
 name: pangolin
 services:
   pangolin:
-    image: docker.io/fosrl/pangolin:ee-latest
+    image: docker.io/fosrl/pangolin:ee-postgresql-latest
     container_name: pangolin
     restart: unless-stopped
     volumes:

config/ha-reference/node2/docker-compose.yml

@@ -1,7 +1,7 @@
 name: pangolin
 services:
   pangolin:
-    image: docker.io/fosrl/pangolin:ee-latest
+    image: docker.io/fosrl/pangolin:ee-postgresql-latest
     container_name: pangolin
     restart: unless-stopped
     volumes:

messages/bg-BG.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Сигурни ли сте, че искате да рестартирате WireGuard тунела за <b>{name}</b>? Сайтът ще изгуби връзка за кратко.",
     "siteRestartWarning": "Сайтът ще се изключи за кратко, докато тунелът се рестартира.",
     "siteRestarted": "Сайтът е рестартиран",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "WireGuard тунелът е рестартиран.",
     "siteErrorRestart": "Неуспешно рестартиране на сайта",
     "siteErrorRestartDescription": "Възникна грешка при рестартирането на сайта.",
     "siteSettingDescription": "Конфигурирайте настройките на сайта",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Създайте и управлявайте ресурси, които са достъпни само чрез свързан клиент.",
     "privateResourcesBannerTitle": "Достъп до частни ресурси с нулево доверие.",
     "privateResourcesBannerDescription": "Частните ресурси използват сигурност с нулево доверие, осигурявайки че потребителите и машините могат да имат само достъп до ресурси, които вие изрично предоставяте. Свържете потребителските устройства или машинните клиенти, за да получите достъп до тези ресурси чрез сигурна виртуална частна мрежа.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Търсене на ресурси...",
     "resourceAdd": "Добавете ресурс",
     "resourceErrorDelte": "Грешка при изтриване на ресурс",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Всяко правило трябва да има уникален номер на приоритет.",
     "rulesErrorValidation": "Невалидни правила",
     "rulesErrorValidationRuleDescription": "Правило {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Изберете валиден тип съвпадение (път, IP, CIDR, държава, регион или ASN).",
     "rulesErrorValueRequired": "Въведете стойност за това правило.",
     "rulesErrorInvalidCountry": "Невалидна държава",
     "rulesErrorInvalidCountryDescription": "Изберете валидна държава.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Опити за повторно",
     "expectedResponseCodes": "Очаквани кодове за отговор",
     "expectedResponseCodesDescription": "HTTP статус код, указващ здравословно състояние. Ако бъде оставено празно, между 200-300 се счита за здравословно.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Персонализирани заглавия",
+    "customHeadersDescription": "Add custom headers to be sent when proxying requests. One per line in the format Header-Name: value",
     "headersValidationError": "Заглавията трябва да бъдат във формат: Име на заглавието: стойност.",
     "saveHealthCheck": "Запазване на проверка на здравето",
     "healthCheckSaved": "Проверка на здравето е запазена",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Показване на лентата с инструменти",
     "sessionToolbarHide": "Скриване на лентата с инструменти",
     "actionUpdateSiteApprovals": "Обновяване на одобренията на сайта",
-    "check": "Проверка",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Проверка"
 }

messages/cs-CZ.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Opravdu chcete restartovat WireGuard tunel pro <b>{name}</b>? Lokalita krátce ztratí konektivitu.",
     "siteRestartWarning": "Lokalita bude krátce odpojena, zatímco se tunel restartuje.",
     "siteRestarted": "Lokalita restartována",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "Tunel WireGuard byl restartován.",
     "siteErrorRestart": "Nepodařilo se restartovat lokalitu",
     "siteErrorRestartDescription": "Při restartování lokality došlo k chybě.",
     "siteSettingDescription": "Konfigurace nastavení na webu",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Vytváření a správa zdrojů, které jsou přístupné pouze prostřednictvím připojeného klienta",
     "privateResourcesBannerTitle": "Zero-Trust soukromý přístup",
     "privateResourcesBannerDescription": "Soukromé prostředky používají zero-trust zabezpečení, což zajišťuje, že uživatelé a zařízení mohou získat přístup pouze k prostředkům, k nimž máte explicitní práva. Připojte zařízení uživatele nebo klientské stroje, abyste získali přístup k těmto prostředkům přes zabezpečenou virtuální soukromou síť.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Prohledat zdroje...",
     "resourceAdd": "Přidat zdroj",
     "resourceErrorDelte": "Chyba při odstraňování zdroje",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Každé pravidlo musí mít unikátní číslo priority.",
     "rulesErrorValidation": "Neplatná pravidla",
     "rulesErrorValidationRuleDescription": "Pravidlo {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Vyberte platný typ shody (cesta, IP, CIDR, země, oblast nebo ASN).",
     "rulesErrorValueRequired": "Zadejte hodnotu pro toto pravidlo.",
     "rulesErrorInvalidCountry": "Neplatná země",
     "rulesErrorInvalidCountryDescription": "Vyberte platnou zemi.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Opakovat pokusy",
     "expectedResponseCodes": "Očekávané kódy odezvy",
     "expectedResponseCodesDescription": "HTTP kód stavu, který označuje zdravý stav. Ponecháte-li prázdné, 200-300 je považováno za zdravé.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Vlastní záhlaví",
+    "customHeadersDescription": "Záhlaví oddělená nová řádka: hodnota",
     "headersValidationError": "Headers must be in the format: Header-Name: value.",
     "saveHealthCheck": "Uložit kontrolu stavu",
     "healthCheckSaved": "Kontrola stavu uložena",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Zobrazit panel nástrojů",
     "sessionToolbarHide": "Skrýt panel nástrojů",
     "actionUpdateSiteApprovals": "Aktualizovat schválení webu",
-    "check": "Zkontrolovat",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Zkontrolovat"
 }

messages/da-DK.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Er du sikker på, at du vil genstarte WireGuard-tunnelen for <b>{name}</b>? Sitet vil kortvarigt miste forbindelsen.",
     "siteRestartWarning": "Sitet vil kortvarigt afbryde forbindelse, mens tunnelen genstarter.",
     "siteRestarted": "Site genstartet",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "WireGuard-tunnelen er blevet genstartet.",
     "siteErrorRestart": "Kunne ikke genstarte site",
     "siteErrorRestartDescription": "En fejl opstod, mens sitet blev genstartet.",
     "siteSettingDescription": "Konfigurer indstillingerne for sitet",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Oprette og administrer ressourcer som kun er tilgængelige via en tilsluttet klient",
     "privateResourcesBannerTitle": "Zero-Trust privat adgang",
     "privateResourcesBannerDescription": "Private ressourcer bruger Zero-Trust-sikkerhed og sikrer, at brugere og maskiner kun kan få adgang til ressourcer, du eksplicit giver tilladelse til. Tilslut brugerenheder eller maskinklienter for at få adgang til disse ressourcer via et sikkert virtuelt privat netværk.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Søg i ressourcer...",
     "resourceAdd": "Tilføj ressource",
     "resourceErrorDelte": "Fejl ved sletning af ressource",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Hver regel skal have et unikt prioritetstall.",
     "rulesErrorValidation": "Ugyldige regler",
     "rulesErrorValidationRuleDescription": "Regel {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Vælg en gyldig matchtype (sti, IP, CIDR, land, region eller ASN).",
     "rulesErrorValueRequired": "Indtast en værdi for denne reglen.",
     "rulesErrorInvalidCountry": "Ugyldig land",
     "rulesErrorInvalidCountryDescription": "Vælg et gyldig land.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Forsøg igen",
     "expectedResponseCodes": "Forventede svarkoder",
     "expectedResponseCodesDescription": "HTTP-statuskode som indikerer sund status. Hvis den bliver stående tom, regnes 200-300 som sund.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Brugerdefinerede headers",
+    "customHeadersDescription": "Headers som er adskilt med linje: Overskriftsnavn: værdi",
     "headersValidationError": "Header skal være i formatet: header-navn: værdi.",
     "saveHealthCheck": "Gem Sundhedstjek",
     "healthCheckSaved": "Sundhedstjek Gemt",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Vis værktøjslinje",
     "sessionToolbarHide": "Skjul værktøjslinje",
     "actionUpdateSiteApprovals": "Opdater godkendelser på site",
-    "check": "Tjek",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Tjek"
 }

messages/de-DE.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Sind Sie sicher, dass Sie den WireGuard-Tunnel für <b>{name}</b> neu starten möchten? Der Standort wird kurzzeitig die Konnektivität verlieren.",
     "siteRestartWarning": "Der Standort wird kurzzeitig getrennt, während der Tunnel neu gestartet wird.",
     "siteRestarted": "Standort neu gestartet",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "Der WireGuard-Tunnel wurde neu gestartet.",
     "siteErrorRestart": "Fehler beim Neustart des Standorts",
     "siteErrorRestartDescription": "Ein Fehler ist aufgetreten, während der Standort neu gestartet wurde.",
     "siteSettingDescription": "Standorteinstellungen konfigurieren",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Erstelle und verwalte Ressourcen, die nur über einen verbundenen Client zugänglich sind",
     "privateResourcesBannerTitle": "Zero-Trust-Zugriff auf private Ressourcen",
     "privateResourcesBannerDescription": "Private Ressourcen nutzen Zero-Trust und stellen sicher, dass Benutzer und Maschinen nur auf Ressourcen zugreifen können, die Sie explizit gewähren. Verbinden Sie Benutzergeräte oder Maschinen-Clients, um auf diese Ressourcen über ein sicheres virtuelles privates Netzwerk zuzugreifen.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Suche Ressourcen...",
     "resourceAdd": "Ressource hinzufügen",
     "resourceErrorDelte": "Fehler beim Löschen der Ressource",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Jede Regel muss eine eindeutige Prioritätsnummer haben.",
     "rulesErrorValidation": "Ungültige Regeln",
     "rulesErrorValidationRuleDescription": "Regel {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Wählen Sie einen gültigen Vergleichstyp (Pfad, IP, CIDR, Land, Region oder ASN).",
     "rulesErrorValueRequired": "Geben Sie einen Wert für diese Regel ein.",
     "rulesErrorInvalidCountry": "Ungültiges Land",
     "rulesErrorInvalidCountryDescription": "Wählen Sie ein gültiges Land aus.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Wiederholungsversuche",
     "expectedResponseCodes": "Erwartete Antwortcodes",
     "expectedResponseCodesDescription": "HTTP-Statuscode, der einen gesunden Zustand anzeigt. Wenn leer gelassen, wird 200-300 als gesund angesehen.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Eigene Kopfzeilen",
+    "customHeadersDescription": "Header neue Zeile getrennt: Header-Name: Wert",
     "headersValidationError": "Header müssen im Format Header-Name: Wert sein.",
     "saveHealthCheck": "Gesundheits-Check speichern",
     "healthCheckSaved": "Gesundheits-Check gespeichert",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Werkzeugleiste zeigen",
     "sessionToolbarHide": "Werkzeugleiste ausblenden",
     "actionUpdateSiteApprovals": "Standortgenehmigungen aktualisieren",
-    "check": "Prüfen",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Prüfen"
 }

messages/en-US.json

@@ -234,6 +234,9 @@
     "clientResourceDescription": "Create and manage resources that are only accessible through a connected client",
     "privateResourcesBannerTitle": "Zero-Trust Private Access",
     "privateResourcesBannerDescription": "Private resources use zero-trust security, ensuring users and machines can only access resources you explicitly grant. Connect user devices or machine clients to access these resources over a secure virtual private network.",
+    "licenseBillingBannerTitle": "Manage License Billing",
+    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
+    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Search resources...",
     "resourceAdd": "Add Resource",
     "resourceErrorDelte": "Error deleting resource",

messages/es-ES.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "¿Estás seguro de que deseas reiniciar el túnel WireGuard para <b>{name}</b>? El sitio perderá conectividad brevemente.",
     "siteRestartWarning": "El sitio se desconectará brevemente mientras se reinicia el túnel.",
     "siteRestarted": "Sitio reiniciado",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "El túnel WireGuard ha sido reiniciado.",
     "siteErrorRestart": "Error al reiniciar el sitio",
     "siteErrorRestartDescription": "Se ha producido un error al reiniciar el sitio.",
     "siteSettingDescription": "Configurar los ajustes en el sitio",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Crear y administrar recursos que sólo son accesibles a través de un cliente conectado",
     "privateResourcesBannerTitle": "Acceso privado de confianza cero",
     "privateResourcesBannerDescription": "Los recursos privados usan seguridad de confianza cero, asegurando que usuarios y máquinas solo puedan acceder a los recursos que usted conceda explícitamente. Conecte dispositivos de usuario o clientes de máquinas para acceder a estos recursos a través de una red privada virtual segura.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Buscar recursos...",
     "resourceAdd": "Añadir Recurso",
     "resourceErrorDelte": "Error al eliminar el recurso",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Cada regla debe tener un número de prioridad único.",
     "rulesErrorValidation": "Reglas no válidas",
     "rulesErrorValidationRuleDescription": "Regla {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Selecciona un tipo de coincidencia válido (ruta, IP, CIDR, país, región o ASN).",
     "rulesErrorValueRequired": "Introduce un valor para esta regla.",
     "rulesErrorInvalidCountry": "País no válido",
     "rulesErrorInvalidCountryDescription": "Selecciona un país válido.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Intentos de Reintento",
     "expectedResponseCodes": "Códigos de respuesta esperados",
     "expectedResponseCodesDescription": "Código de estado HTTP que indica un estado saludable. Si se deja en blanco, se considera saludable de 200 a 300.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Cabeceras personalizadas",
+    "customHeadersDescription": "Nueva línea de cabeceras separada: Nombre de cabecera: valor",
     "headersValidationError": "Los encabezados deben estar en el formato: Nombre de cabecera: valor.",
     "saveHealthCheck": "Guardar Chequeo de Salud",
     "healthCheckSaved": "Chequeo de Salud Guardado",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Mostrar barra de herramientas",
     "sessionToolbarHide": "Ocultar barra de herramientas",
     "actionUpdateSiteApprovals": "Actualizar aprobaciones del sitio",
-    "check": "Comprobar",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Comprobar"
 }

messages/fr-FR.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Êtes-vous sûr de vouloir redémarrer le tunnel WireGuard pour <b>{name}</b>? Le site perdra brièvement sa connectivité.",
     "siteRestartWarning": "Le site sera brièvement déconnecté pendant le redémarrage du tunnel.",
     "siteRestarted": "Site redémarré",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "Le tunnel WireGuard a été redémarré.",
     "siteErrorRestart": "Échec du redémarrage du site",
     "siteErrorRestartDescription": "Une erreur s'est produite lors du redémarrage du site.",
     "siteSettingDescription": "Configurer les paramètres du site",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Créer et gérer des ressources qui ne sont accessibles que via un client connecté",
     "privateResourcesBannerTitle": "Accès privé sans confiance",
     "privateResourcesBannerDescription": "Les ressources privées utilisent la sécurité sans confiance, garantissant que les utilisateurs et les machines ne peuvent accéder qu'aux ressources que vous accordez explicitement. Connectez les appareils utilisateur ou les clients machines à ces ressources via un réseau privé virtuel sécurisé.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Chercher des ressources...",
     "resourceAdd": "Ajouter une ressource",
     "resourceErrorDelte": "Erreur lors de la de suppression de la ressource",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Chaque règle doit avoir un numéro de priorité unique.",
     "rulesErrorValidation": "Règles invalides",
     "rulesErrorValidationRuleDescription": "Règle {ruleNumber} : {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Sélectionnez un type de correspondance valide (chemin, IP, CIDR, pays, région ou ASN).",
     "rulesErrorValueRequired": "Entrez une valeur pour cette règle.",
     "rulesErrorInvalidCountry": "Pays invalide",
     "rulesErrorInvalidCountryDescription": "Sélectionnez un pays valide.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Tentatives de réessai",
     "expectedResponseCodes": "Codes de réponse attendus",
     "expectedResponseCodesDescription": "Code de statut HTTP indiquant un état de santé satisfaisant. Si non renseigné, 200-300 est considéré comme satisfaisant.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "En-têtes personnalisés",
+    "customHeadersDescription": "En-têtes séparés par une nouvelle ligne: En-nom: valeur",
     "headersValidationError": "Les entêtes doivent être au format : Header-Name: valeur.",
     "saveHealthCheck": "Sauvegarder la vérification de l'état de santé",
     "healthCheckSaved": "Vérification de l'état de santé enregistrée",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Afficher la barre d'outils",
     "sessionToolbarHide": "Masquer la barre d'outils",
     "actionUpdateSiteApprovals": "Mettre à jour les approbations de site",
-    "check": "Vérifier",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Vérifier"
 }

messages/it-IT.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Sei sicuro di voler riavviare il tunnel WireGuard per <b>{name}</b>? Il sito perderà brevemente la connettività.",
     "siteRestartWarning": "Il sito si disconnette brevemente mentre il tunnel si riavvia.",
     "siteRestarted": "Sito riavviato",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "Il tunnel WireGuard è stato riavviato.",
     "siteErrorRestart": "Impossibile riavviare il sito",
     "siteErrorRestartDescription": "Si è verificato un errore durante il riavvio del sito.",
     "siteSettingDescription": "Configura le impostazioni del sito",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Crea e gestisci risorse accessibili solo tramite un client connesso",
     "privateResourcesBannerTitle": "Accesso Privato Zero-Trust",
     "privateResourcesBannerDescription": "Le risorse private utilizzano la sicurezza zero-trust, assicurandosi che gli utenti e le macchine possano accedere solo alle risorse a cui hai concesso esplicitamente l'accesso. Collega i dispositivi utente o i client macchina per accedere a queste risorse tramite una rete privata virtuale sicura.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Cerca risorse...",
     "resourceAdd": "Aggiungi Risorsa",
     "resourceErrorDelte": "Errore nell'eliminare la risorsa",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Ogni regola deve avere un numero di priorità univoco.",
     "rulesErrorValidation": "Regole non valide",
     "rulesErrorValidationRuleDescription": "Regola {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Seleziona un tipo di corrispondenza valido (percorso, IP, CIDR, paese, regione o ASN).",
     "rulesErrorValueRequired": "Inserisci un valore per questa regola.",
     "rulesErrorInvalidCountry": "Nazione non valida",
     "rulesErrorInvalidCountryDescription": "Seleziona un paese valido.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Tentativi di Riprova",
     "expectedResponseCodes": "Codici di Risposta Attesi",
     "expectedResponseCodesDescription": "Codice di stato HTTP che indica lo stato di salute. Se lasciato vuoto, considerato sano è compreso tra 200-300.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Intestazioni Personalizzate",
+    "customHeadersDescription": "Intestazioni nuova riga separate: Intestazione-Nome: valore",
     "headersValidationError": "Le intestazioni devono essere nel formato: Intestazione-Nome: valore.",
     "saveHealthCheck": "Salva Controllo Salute",
     "healthCheckSaved": "Controllo Salute Salvato",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Mostra barra degli strumenti",
     "sessionToolbarHide": "Nascondi barra degli strumenti",
     "actionUpdateSiteApprovals": "Aggiorna Approvazioni del Sito",
-    "check": "Controlla",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Controlla"
 }

messages/ko-KR.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "<b>{name}</b>의 WireGuard 터널을 재시작하시겠습니까? 이 작업으로 인해 사이트의 연결이 일시적으로 중단될 수 있습니다.",
     "siteRestartWarning": "터널을 재시작하는 동안 사이트가 일시적으로 연결이 끊깁니다.",
     "siteRestarted": "사이트가 재시작되었습니다",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "WireGuard 터널이 재시작되었습니다.",
     "siteErrorRestart": "사이트 재시작 실패",
     "siteErrorRestartDescription": "사이트를 재시작하는 중 오류가 발생했습니다.",
     "siteSettingDescription": "사이트에서 설정을 구성하세요.",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "연결된 클라이언트를 통해서만 접근할 수 있는 리소스를 생성하고 관리하세요.",
     "privateResourcesBannerTitle": "제로 트러스트 개인 접근",
     "privateResourcesBannerDescription": "개인 리소스는 제로 트러스트 보안을 사용하여, 사용자와 장치가 명시적으로 허용된 리소스에만 접근할 수 있도록 보장합니다. 이러한 리소스에 접근하려면 안전한 가상 사설 네트워크를 통해 사용자 장치 또는 머신 클라이언트를 연결하십시오.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "리소스 검색...",
     "resourceAdd": "리소스 추가",
     "resourceErrorDelte": "리소스 삭제 중 오류 발생",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "각 규칙은 고유한 우선순위 번호를 가져야 합니다.",
     "rulesErrorValidation": "유효하지 않은 규칙",
     "rulesErrorValidationRuleDescription": "규칙 {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "유효한 매칭 유형을 선택하세요 (경로, IP, CIDR, 국가, 지역, 또는 ASN).",
     "rulesErrorValueRequired": "이 규칙에 대한 값을 입력하세요.",
     "rulesErrorInvalidCountry": "유효하지 않은 국가",
     "rulesErrorInvalidCountryDescription": "유효한 국가를 선택하세요.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "재시도 횟수",
     "expectedResponseCodes": "예상 응답 코드",
     "expectedResponseCodesDescription": "정상 상태를 나타내는 HTTP 상태 코드입니다. 비워 두면 200-300이 정상으로 간주됩니다.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "사용자 정의 헤더",
+    "customHeadersDescription": "헤더는 새 줄로 구분됨: Header-Name: value",
     "headersValidationError": "헤더는 형식이어야 합니다: 헤더명: 값.",
     "saveHealthCheck": "상태 확인 저장",
     "healthCheckSaved": "상태 확인이 저장되었습니다.",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "툴바 보기",
     "sessionToolbarHide": "툴바 숨기기",
     "actionUpdateSiteApprovals": "사이트 승인 업데이트",
-    "check": "확인",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "확인"
 }

messages/nb-NO.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Er du sikker på at du vil starte WireGuard-tunnelen for <b>{name}</b> på nytt? Området vil midlertidig miste tilkoblingen.",
     "siteRestartWarning": "Området vil kobles kort fra mens tunnelen starter om.",
     "siteRestarted": "Område startet på nytt",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "WireGuard-tunnelen er startet på nytt.",
     "siteErrorRestart": "Kan ikke starte område på nytt",
     "siteErrorRestartDescription": "En feil oppstod ved omstart av området.",
     "siteSettingDescription": "Konfigurere innstillingene på nettstedet",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Opprette og administrere ressurser som bare er tilgjengelige via en tilkoblet klient",
     "privateResourcesBannerTitle": "Zero-Trust privat tilgang",
     "privateResourcesBannerDescription": "Private ressurser bruker Zero-Trust-sikkerhet, og sikrer at brukere og maskiner kun kan få tilgang til ressurser du eksplisitt gir tillatelse til. Koble bruker-enheter eller maskinklienter for å få tilgang til disse ressursene via et sikkert virtuelt privat nettverk.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Søk i ressurser...",
     "resourceAdd": "Legg til ressurs",
     "resourceErrorDelte": "Feil ved sletting av ressurs",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Hver regel må ha et unikt prioritetstall.",
     "rulesErrorValidation": "Ugyldige regler",
     "rulesErrorValidationRuleDescription": "Regel {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Velg en gyldig samsvarstype (sti, IP, CIDR, land, region eller ASN).",
     "rulesErrorValueRequired": "Skriv inn en verdi for denne regelen.",
     "rulesErrorInvalidCountry": "Ugyldig land",
     "rulesErrorInvalidCountryDescription": "Velg et gyldig land.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Forsøk på nytt",
     "expectedResponseCodes": "Forventede svarkoder",
     "expectedResponseCodesDescription": "HTTP-statuskode som indikerer sunn status. Hvis den blir stående tom, regnes 200-300 som sunn.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Egendefinerte topptekster",
+    "customHeadersDescription": "Overskrifter som er adskilt med linje: Overskriftsnavn: verdi",
     "headersValidationError": "Topptekst må være i formatet: header-navn: verdi.",
     "saveHealthCheck": "Lagre Helsekontroll",
     "healthCheckSaved": "Helsekontroll Lagret",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Vis verktøylinje",
     "sessionToolbarHide": "Skjul verktøylinje",
     "actionUpdateSiteApprovals": "Oppdater Stedsgodkjenninger",
-    "check": "Sjekk",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Sjekk"
 }

messages/nl-NL.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Weet u zeker dat u de WireGuard-tunnel voor <b>{name}</b> wilt herstarten? De site zal tijdelijk geen connectiviteit hebben.",
     "siteRestartWarning": "De site zal kort worden losgekoppeld terwijl de tunnel opnieuw wordt gestart.",
     "siteRestarted": "Site herstart",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "De WireGuard-tunnel is opnieuw gestart.",
     "siteErrorRestart": "Site herstarten mislukt",
     "siteErrorRestartDescription": "Er is een fout opgetreden tijdens het herstarten van de site.",
     "siteSettingDescription": "Configureer de instellingen van de site",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Creëer en beheer bronnen die alleen toegankelijk zijn via een verbonden client",
     "privateResourcesBannerTitle": "Privébronnen via Zero Trust",
     "privateResourcesBannerDescription": "Privébronnen maken gebruik van zero trust beveiliging, wat ervoor zorgt dat gebruikers en machines alleen toegang kunnen krijgen tot resources die je specifiek toestaat. Verbind gebruikersapparaten of machines om deze middelen te benaderen via een veilig, virtueel privénetwerk.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Zoek bronnen...",
     "resourceAdd": "Bron toevoegen",
     "resourceErrorDelte": "Fout bij verwijderen document",
@@ -462,13 +459,13 @@
     "searchApiKeys": "API sleutels zoeken...",
     "apiKeysAdd": "API sleutel genereren",
     "apiKeysErrorDelete": "Fout bij verwijderen API sleutel",
-    "apiKeysErrorDeleteMessage": "Fout bij verwijderen API sleutel",
+    "apiKeysErrorDeleteMessage": "Fout bij verwijderen API- leutel",
     "apiKeysQuestionRemove": "Weet u zeker dat u de API sleutel van de organisatie wilt verwijderen?",
-    "apiKeysMessageRemove": "Eenmaal verwijderd, kan de API sleutel niet meer worden gebruikt.",
-    "apiKeysDeleteConfirm": "Bevestig Verwijderen API sleutel",
+    "apiKeysMessageRemove": "Eenmaal verwijderd, kan de APIsleutel niet meer worden gebruikt.",
+    "apiKeysDeleteConfirm": "Bevestig verwijderen API sleutel",
     "apiKeysDelete": "API sleutel verwijderen",
     "apiKeysManage": "API sleutels beheren",
-    "apiKeysDescription": "API sleutels worden gebruikt om toegang te verifiëren met de integratie API ",
+    "apiKeysDescription": "API sleutels worden gebruikt om te verifiëren met de integratie-API",
     "orgsManage": "Organisaties Beheren",
     "orgsDescription": "Bekijk en beheer alle organisaties op dit systeem",
     "provisioningKeysTitle": "Vertrekkende sleutel",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Elke regel moet een uniek prioriteitsnummer hebben.",
     "rulesErrorValidation": "Ongeldige regels",
     "rulesErrorValidationRuleDescription": "Regel {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Selecteer een geldig matchtype (pad, IP, CIDR, land, regio of ASN).",
     "rulesErrorValueRequired": "Voer een waarde in voor deze regel.",
     "rulesErrorInvalidCountry": "Ongeldig land",
     "rulesErrorInvalidCountryDescription": "Selecteer een geldig land.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Herhaal Pogingen",
     "expectedResponseCodes": "Verwachte Reactiecodes",
     "expectedResponseCodesDescription": "HTTP-statuscode die gezonde status aangeeft. Indien leeg wordt 200-300 als gezond beschouwd.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Aangepaste headers",
+    "customHeadersDescription": "Kopregeleinde: Header-Naam: waarde",
     "headersValidationError": "Headers moeten in het formaat zijn: Header-Naam: waarde.",
     "saveHealthCheck": "Opslaan Gezondheidscontrole",
     "healthCheckSaved": "Gezondheidscontrole Opgeslagen",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Toon werkbalk",
     "sessionToolbarHide": "Verberg werkbalk",
     "actionUpdateSiteApprovals": "Sitegoedkeuringen bijwerken",
-    "check": "Controleren",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Controleren"
 }

messages/pl-PL.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Czy na pewno chcesz uruchomić ponownie tunel WireGuard dla <b>{name}</b>? Strona tymczasowo straci łączność.",
     "siteRestartWarning": "Strona tymczasowo rozłączy się podczas ponownego uruchamiania tunelu.",
     "siteRestarted": "Strona zrestartowana",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "Tunel WireGuard został ponownie uruchomiony.",
     "siteErrorRestart": "Nie udało się zrestartować strony",
     "siteErrorRestartDescription": "Wystąpił błąd podczas ponownego uruchamiania strony.",
     "siteSettingDescription": "Skonfiguruj ustawienia na stronie",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Twórz i zarządzaj zasobami, które są dostępne tylko za pośrednictwem połączonego klienta",
     "privateResourcesBannerTitle": "Zero zaufania do prywatnego dostępu",
     "privateResourcesBannerDescription": "Zasoby prywatne korzystają z zabezpieczeń zero-trust, zapewniając dostęp do zasobów użytkownikom i maszynom, którym wyraźnie udzielasz dostępu. Połącz urządzenia użytkowników lub klientów maszyn z tymi zasobami przez bezpieczną prywatną sieć wirtualną.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Szukaj zasobów...",
     "resourceAdd": "Dodaj zasób",
     "resourceErrorDelte": "Błąd podczas usuwania zasobu",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Każda reguła musi mieć unikalny numer priorytetu.",
     "rulesErrorValidation": "Nieprawidłowe reguły",
     "rulesErrorValidationRuleDescription": "Reguła {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Wybierz poprawny typ dopasowania (ścieżka, IP, CIDR, kraj, region lub ASN).",
     "rulesErrorValueRequired": "Wprowadź wartość dla tej reguły.",
     "rulesErrorInvalidCountry": "Nieprawidłowy kraj",
     "rulesErrorInvalidCountryDescription": "Wybierz poprawny kraj.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Próby Ponowienia",
     "expectedResponseCodes": "Oczekiwane Kody Odpowiedzi",
     "expectedResponseCodesDescription": "Kod statusu HTTP, który wskazuje zdrowy status. Jeśli pozostanie pusty, uznaje się 200-300 za zdrowy.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Niestandardowe nagłówki",
+    "customHeadersDescription": "Nagłówki oddzielone: Nazwa nagłówka: wartość",
     "headersValidationError": "Nagłówki muszą być w formacie: Nazwa nagłówka: wartość.",
     "saveHealthCheck": "Zapisz Kontrolę Zdrowia",
     "healthCheckSaved": "Kontrola Zdrowia Zapisana",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Pokaż pasek narzędzi",
     "sessionToolbarHide": "Ukryj pasek narzędzi",
     "actionUpdateSiteApprovals": "Zaktualizuj zgody na stronę",
-    "check": "Sprawdź",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Sprawdź"
 }

messages/pt-PT.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Tem certeza de que deseja reiniciar o túnel WireGuard para <b>{name}</b>? O site perderá brevemente a conectividade.",
     "siteRestartWarning": "O site será desconectado brevemente enquanto o túnel reinicia.",
     "siteRestarted": "Site reiniciado",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "O túnel WireGuard foi reiniciado.",
     "siteErrorRestart": "Falha ao reiniciar o site",
     "siteErrorRestartDescription": "Ocorreu um erro ao reiniciar o site.",
     "siteSettingDescription": "Configurar as configurações no site",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Criar e gerenciar recursos que só são acessíveis por meio de um cliente conectado",
     "privateResourcesBannerTitle": "Acesso Privado com Confiança Zero",
     "privateResourcesBannerDescription": "Os recursos privados usam segurança de zero confiança, garantindo que usuários e máquinas possam acessar apenas os recursos que você concede explicitamente. Conecte dispositivos de usuários ou clientes de máquinas para acessar esses recursos por meio de uma rede privada virtual segura.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Procurar recursos...",
     "resourceAdd": "Adicionar Recurso",
     "resourceErrorDelte": "Erro ao apagar recurso",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Cada regra deve ter um número de prioridade único.",
     "rulesErrorValidation": "Regras inválidas",
     "rulesErrorValidationRuleDescription": "Regra {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Selecione um tipo de correspondência válido (caminho, IP, CIDR, país, região ou ASN).",
     "rulesErrorValueRequired": "Digite um valor para esta regra.",
     "rulesErrorInvalidCountry": "País inválido",
     "rulesErrorInvalidCountryDescription": "Selecione um país válido.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Tentativas de Repetição",
     "expectedResponseCodes": "Códigos de Resposta Esperados",
     "expectedResponseCodesDescription": "Código de status HTTP que indica estado saudável. Se deixado em branco, 200-300 é considerado saudável.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Cabeçalhos Personalizados",
+    "customHeadersDescription": "Separados por cabeçalhos da nova linha: Nome do Cabeçalho: valor",
     "headersValidationError": "Cabeçalhos devem estar no formato: Nome do Cabeçalho: valor.",
     "saveHealthCheck": "Salvar Verificação de Saúde",
     "healthCheckSaved": "Verificação de Saúde Salva",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Mostrar barra de ferramentas",
     "sessionToolbarHide": "Ocultar barra de ferramentas",
     "actionUpdateSiteApprovals": "Atualizar Aprovações do Site",
-    "check": "Verificar",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Verificar"
 }

messages/ru-RU.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "Вы уверены, что хотите перезапустить туннель WireGuard для <b>{name}</b>? Сайт кратковременно потеряет соединение.",
     "siteRestartWarning": "Сайт кратковременно отключится во время перезапуска туннеля.",
     "siteRestarted": "Сайт перезапущен",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "Туннель WireGuard был перезапущен.",
     "siteErrorRestart": "Не удалось перезапустить сайт",
     "siteErrorRestartDescription": "Произошла ошибка во время перезапуска сайта.",
     "siteSettingDescription": "Настройка параметров на сайте",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Создание и управление ресурсами, которые доступны только через подключенный клиент",
     "privateResourcesBannerTitle": "Частный доступ с нулевым доверием",
     "privateResourcesBannerDescription": "Частные ресурсы используют безопасность с нулевым доверием, обеспечивая доступ пользователей и устройств только к ресурсам, к которым вы явно предоставили доступ. Подключите пользовательские устройства или машинных клиентов, чтобы получить доступ к этим ресурсам через безопасную виртуальную частную сеть.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Поиск ресурсов...",
     "resourceAdd": "Добавить ресурс",
     "resourceErrorDelte": "Ошибка при удалении ресурса",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Каждое правило должно иметь уникальный номер приоритета.",
     "rulesErrorValidation": "Неверные правила",
     "rulesErrorValidationRuleDescription": "Правило {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Выберите действительный тип совпадения (путь, IP, CIDR, страна, регион или ASN).",
     "rulesErrorValueRequired": "Введите значение для этого правила.",
     "rulesErrorInvalidCountry": "Недействительная страна",
     "rulesErrorInvalidCountryDescription": "Выберите правильную страну.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Количество попыток повторного запроса",
     "expectedResponseCodes": "Ожидаемые коды ответов",
     "expectedResponseCodesDescription": "HTTP-код состояния, указывающий на здоровое состояние. Если оставить пустым, 200-300 считается здоровым.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Пользовательские заголовки",
+    "customHeadersDescription": "Заголовки новой строки, разделённые: название заголовка: значение",
     "headersValidationError": "Заголовки должны быть в формате: Название заголовка: значение.",
     "saveHealthCheck": "Сохранить проверку здоровья",
     "healthCheckSaved": "Проверка здоровья сохранена",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Показать панель инструментов",
     "sessionToolbarHide": "Скрыть панель инструментов",
     "actionUpdateSiteApprovals": "Обновить утверждения сайта",
-    "check": "Проверить",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Проверить"
 }

messages/tr-TR.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "<b>{name}</b> için WireGuard tünelini yeniden başlatmak istediğinizden emin misiniz? Site kısa süreliğine bağlantıyı kaybedecektir.",
     "siteRestartWarning": "Tünel yeniden başlatılırken site kısa süreliğine kesintiye uğrar.",
     "siteRestarted": "Site yeniden başlatıldı",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "WireGuard tüneli yeniden başlatıldı.",
     "siteErrorRestart": "Sitenin yeniden başlatılması başarısız oldu",
     "siteErrorRestartDescription": "Site yeniden başlatılırken bir hata oluştu.",
     "siteSettingDescription": "Sitenizdeki ayarları yapılandırın",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "Sadece bağlı bir istemci aracılığıyla erişilebilen kaynakları oluşturun ve yönetin",
     "privateResourcesBannerTitle": "Sıfır Güven Özel Erişim",
     "privateResourcesBannerDescription": "Özel kaynaklar sıfır güven güvenliği kullanır, kullanıcılar ve makinelerin yalnızca açıkça izin verdiğiniz kaynaklara erişmesini sağlar. Bu kaynaklara güvenli bir sanal özel ağ üzerinden erişmek için kullanıcı cihazlarını veya makine müşterilerini bağlayın.",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "Kaynakları ara...",
     "resourceAdd": "Kaynak Ekle",
     "resourceErrorDelte": "Kaynak silinirken hata",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "Her kuralın benzersiz bir öncelik numarası olmalıdır.",
     "rulesErrorValidation": "Geçersiz kurallar",
     "rulesErrorValidationRuleDescription": "Kural {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "Geçerli bir eşleşme türünü seçin (yol, IP, CIDR, ülke, bölge veya ASN).",
     "rulesErrorValueRequired": "Bu kural için bir değer girin.",
     "rulesErrorInvalidCountry": "Geçersiz ülke",
     "rulesErrorInvalidCountryDescription": "Geçerli bir ülke seçin.",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "Tekrar Deneme Girişimleri",
     "expectedResponseCodes": "Beklenen Yanıt Kodları",
     "expectedResponseCodesDescription": "Sağlıklı durumu gösteren HTTP durum kodu. Boş bırakılırsa, 200-300 arası sağlıklı kabul edilir.",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "Özel Başlıklar",
+    "customHeadersDescription": "Başlıklar yeni satırla ayrılmış: Başlık-Adı: değer",
     "headersValidationError": "Başlıklar şu formatta olmalıdır: Başlık-Adı: değer.",
     "saveHealthCheck": "Sağlık Kontrolünü Kaydet",
     "healthCheckSaved": "Sağlık Kontrolü Kaydedildi",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "Araç çubuğunu göster",
     "sessionToolbarHide": "Araç çubuğunu gizle",
     "actionUpdateSiteApprovals": "Site Onaylarını Güncelle",
-    "check": "Kontrol Et",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "Kontrol Et"
 }

messages/zh-CN.json

@@ -132,7 +132,7 @@
     "siteRestartDialogMessage": "确定要重启<b>{name}</b>的WireGuard隧道吗？站点将暂时断开连接。",
     "siteRestartWarning": "隧道重启时，站点将暂时断开连接。",
     "siteRestarted": "站点已重启",
-    "siteRestartedDescription": "The site has been restarted.",
+    "siteRestartedDescription": "WireGuard隧道已重启。",
     "siteErrorRestart": "重启站点失败",
     "siteErrorRestartDescription": "重启站点时发生错误。",
     "siteSettingDescription": "配置站点设置",
@@ -234,9 +234,6 @@
     "clientResourceDescription": "创建和管理只能通过连接客户端访问的资源",
     "privateResourcesBannerTitle": "零信任私有访问",
     "privateResourcesBannerDescription": "私有资源采用零信任安全机制，确保只有获得明确授权的用户和机器才能访问。用户设备或机器客户端连接后，即可通过安全的虚拟专用网络访问这些资源。",
-    "licenseBillingBannerTitle": "Manage License Billing",
-    "licenseBillingBannerDescription": "To manage billing for your license keys, including payment methods and invoices, visit the billing page.",
-    "licenseBillingBannerButton": "Go to Billing",
     "resourcesSearch": "搜索资源...",
     "resourceAdd": "添加资源",
     "resourceErrorDelte": "删除资源时出错",
@@ -834,7 +831,7 @@
     "rulesErrorDuplicatePriorityDescription": "每条规则必须拥有唯一的优先级号。",
     "rulesErrorValidation": "规则无效",
     "rulesErrorValidationRuleDescription": "规则 {ruleNumber}: {message}",
-    "rulesErrorInvalidMatchTypeDescription": "Select a valid match type (path, IP, CIDR, country, region, ASN, or method).",
+    "rulesErrorInvalidMatchTypeDescription": "选择有效的匹配类型（路径、IP、CIDR、国家、地区或 ASN）。",
     "rulesErrorValueRequired": "为此规则输入一个值。",
     "rulesErrorInvalidCountry": "国家无效",
     "rulesErrorInvalidCountryDescription": "选择一个有效的国家。",
@@ -2829,10 +2826,8 @@
     "retryAttempts": "重试次数",
     "expectedResponseCodes": "期望响应代码",
     "expectedResponseCodesDescription": "HTTP 状态码表示健康状态。如留空，200-300 被视为健康。",
-    "customRequestHeaders": "Custom Request Headers",
-    "customRequestHeadersDescription": "Request headers sent to the downstream targets. One per line: Header-Name: value",
-    "customResponseHeaders": "Custom Response Headers",
-    "customResponseHeadersDescription": "Response headers sent back to the client. One per line: Header-Name: value",
+    "customHeaders": "自定义标题",
+    "customHeadersDescription": "头部新行分隔：头部名称：值",
     "headersValidationError": "头部必须是格式：头部名称：值。",
     "saveHealthCheck": "保存健康检查",
     "healthCheckSaved": "健康检查已保存",
@@ -4402,8 +4397,5 @@
     "sessionToolbarShow": "显示工具栏",
     "sessionToolbarHide": "隐藏工具栏",
     "actionUpdateSiteApprovals": "更新站点审批",
-    "check": "检查",
-    "rulesErrorInvalidMethod": "Invalid HTTP method",
-    "rulesErrorInvalidMethodDescription": "Select at least one HTTP method.",
-    "rulesSelectMethods": "Select methods"
+    "check": "检查"
 }

server/emails/templates/EnterpriseEditionKeyGenerated.tsx

@@ -93,9 +93,8 @@ export const EnterpriseEditionKeyGenerated = ({
                         </EmailSection>
 
                         <EmailText>
-                            If you need to purchase additional license keys or
-                            modify your existing license, please reach out to
-                            our support team at{" "}
+                            For any questions or concerns regarding your license
+                            or billing, please reach out to support at{" "}
                             <a
                                 href="mailto:support@pangolin.net"
                                 className="text-primary font-medium"

server/lib/backupFileName.test.ts

@@ -0,0 +1,138 @@
+import { formatBackupFileName, formatBackupTimestamp } from "./backupFileName";
+import { assertEquals } from "@test/assert";
+
+// Local-time constructors are used throughout, matching formatBackupTimestamp,
+// so these cases do not depend on the machine's timezone.
+
+function testMonthIsOneIndexed() {
+    console.log("Running month indexing tests...");
+
+    // The case from the report: a backup taken on 12 September 2026 was named
+    // db_2026-8-12_... because Date#getMonth is zero-indexed.
+    {
+        const result = formatBackupTimestamp(new Date(2026, 8, 12, 20, 35, 56));
+        assertEquals(
+            result,
+            "2026-09-12_20-35-56",
+            "September must render as 09, not 8"
+        );
+    }
+
+    // The other reported name, db_2026-0-23_..., was a January backup.
+    {
+        const result = formatBackupTimestamp(new Date(2026, 0, 23, 20, 25, 49));
+        assertEquals(
+            result,
+            "2026-01-23_20-25-49",
+            "January must render as 01, not 0"
+        );
+    }
+
+    {
+        const result = formatBackupTimestamp(
+            new Date(2026, 11, 31, 23, 59, 59)
+        );
+        assertEquals(
+            result,
+            "2026-12-31_23-59-59",
+            "December must render as 12"
+        );
+    }
+}
+
+function testEveryFieldIsZeroPadded() {
+    console.log("Running zero padding tests...");
+
+    // db_2026-8-12_20-36-2 in the report: a single-digit second was not padded.
+    {
+        const result = formatBackupTimestamp(new Date(2026, 8, 12, 20, 36, 2));
+        assertEquals(
+            result,
+            "2026-09-12_20-36-02",
+            "Single-digit seconds must be padded"
+        );
+    }
+
+    {
+        const result = formatBackupTimestamp(new Date(2026, 0, 1, 0, 0, 0));
+        assertEquals(
+            result,
+            "2026-01-01_00-00-00",
+            "Midnight on the first of the month must pad every field"
+        );
+    }
+}
+
+function testNamesSortChronologically() {
+    console.log("Running sort order tests...");
+
+    // Zero padding means a plain lexicographic sort of the backups directory
+    // lists the backups in the order they were taken.
+    const taken = [
+        new Date(2026, 8, 12, 20, 36, 2),
+        new Date(2026, 0, 23, 20, 25, 49),
+        new Date(2026, 8, 12, 20, 35, 56),
+        new Date(2026, 11, 31, 23, 59, 59)
+    ];
+
+    const sorted = taken.map((date) => formatBackupTimestamp(date)).sort();
+
+    assertEquals(
+        sorted.join(","),
+        [
+            "2026-01-23_20-25-49",
+            "2026-09-12_20-35-56",
+            "2026-09-12_20-36-02",
+            "2026-12-31_23-59-59"
+        ].join(","),
+        "Backup names must sort into the order the backups were taken"
+    );
+}
+
+function testFormatBackupFileName() {
+    console.log("Running backup file name formatting tests...");
+
+    const date = new Date(2026, 8, 12, 20, 35, 56);
+
+    // With semver version string without leading 'v'
+    assertEquals(
+        formatBackupFileName("1.22.0", date),
+        "db_2026-09-12_20-35-56_v1.22.0.sqlite",
+        "Filename must include timestamp and prefixed version tag"
+    );
+
+    // With version string already containing 'v'
+    assertEquals(
+        formatBackupFileName("v1.22.0", date),
+        "db_2026-09-12_20-35-56_v1.22.0.sqlite",
+        "Filename must not duplicate 'v' prefix if already present"
+    );
+
+    // Without version (fallback/default)
+    assertEquals(
+        formatBackupFileName(undefined, date),
+        "db_2026-09-12_20-35-56.sqlite",
+        "Filename without version must match default timestamped format"
+    );
+
+    // Distinct versions within the exact same second do not collide
+    const sameSecondFile1 = formatBackupFileName("1.21.0", date);
+    const sameSecondFile2 = formatBackupFileName("1.22.0", date);
+    if (sameSecondFile1 === sameSecondFile2) {
+        throw new Error(
+            "Backup file names for different versions in the same second must not collide"
+        );
+    }
+}
+
+// Run all tests
+try {
+    testMonthIsOneIndexed();
+    testEveryFieldIsZeroPadded();
+    testNamesSortChronologically();
+    testFormatBackupFileName();
+    console.log("All tests passed successfully!");
+} catch (error) {
+    console.error("Test failed:", error);
+    process.exit(1);
+}

server/lib/backupFileName.ts

@@ -0,0 +1,51 @@
+/**
+ * Builds the timestamp segment of a database backup file name.
+ *
+ * `Date#getMonth` is zero-indexed, so building this inline produced names like
+ * `db_2026-8-12_...` for a backup taken on 12 September 2026. Every field is
+ * also zero-padded, which keeps the names unambiguous and makes them sort
+ * lexicographically in the order they were taken.
+ *
+ * @param date The moment the backup is being taken. Defaults to now.
+ * @returns A timestamp of the form `YYYY-MM-DD_HH-MM-SS`.
+ */
+export function formatBackupTimestamp(date: Date = new Date()): string {
+    const pad = (value: number): string => String(value).padStart(2, "0");
+
+    const datePart = [
+        date.getFullYear(),
+        pad(date.getMonth() + 1),
+        pad(date.getDate())
+    ].join("-");
+
+    const timePart = [
+        pad(date.getHours()),
+        pad(date.getMinutes()),
+        pad(date.getSeconds())
+    ].join("-");
+
+    return `${datePart}_${timePart}`;
+}
+
+/**
+ * Builds the full database backup file name, including timestamp and optional version tag.
+ *
+ * When a migration version is provided, the filename includes `_v<version>`,
+ * preventing collisions between multiple migrations running in the same second and making it easy
+ * to identify the migration state contained in the backup.
+ *
+ * @param version Optional migration version being run.
+ * @param date The moment the backup is being taken. Defaults to now.
+ * @returns A filename of the form `db_YYYY-MM-DD_HH-MM-SS_v<version>.sqlite` or `db_YYYY-MM-DD_HH-MM-SS.sqlite`.
+ */
+export function formatBackupFileName(
+    version?: string,
+    date: Date = new Date()
+): string {
+    const timestamp = formatBackupTimestamp(date);
+    if (version) {
+        const versionTag = version.startsWith("v") ? version : `v${version}`;
+        return `db_${timestamp}_${versionTag}.sqlite`;
+    }
+    return `db_${timestamp}.sqlite`;
+}

server/lib/pathMatch.ts

@@ -20,6 +20,11 @@ function getSegmentRegex(patternPart: string): RegExp {
 // resolves `.` / `..` segments, so a request like `/public%2F..%2Fadmin/`
 // or `/public/../admin/` is matched as `/admin/`, not as a literal segment
 // or a wildcard-swallowed sequence under `/public/*`.
+//
+// Applied to both the request path and the rule pattern: the pattern
+// validator only accepts spaces / non-ASCII in percent-encoded form, so a
+// rule like `/my%20docs/*` must be compared against the decoded segment
+// `my docs`, not the literal text `my%20docs`.
 function decodeAndResolvePath(p: string): string[] {
     const rawParts = p.split("/").filter(Boolean);
 
@@ -48,7 +53,7 @@ function decodeAndResolvePath(p: string): string[] {
 }
 
 export function isPathAllowed(pattern: string, path: string): boolean {
-    const patternParts = pattern.split("/").filter(Boolean);
+    const patternParts = decodeAndResolvePath(pattern);
     const pathParts = decodeAndResolvePath(path);
 
     function matchSegments(

server/middlewares/verifyApiKeyAccess.ts

@@ -70,13 +70,8 @@ export async function verifyApiKeyAccess(
             );
         }
 
-        if (!apiKeyOrg.orgId) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    `API key with ID ${apiKeyId} does not have an organization ID`
-                )
-            );
+        if (!apiKey.apiKeyOrg?.orgId) {
+            return next(createHttpError(HttpCode.INTERNAL_SERVER_ERROR, `API key with ID ${apiKeyId} does not have an organization ID`));
         }
 
         if (!req.userOrg) {
@@ -86,7 +81,7 @@ export async function verifyApiKeyAccess(
                 .where(
                     and(
                         eq(userOrgs.userId, userId),
-                        eq(userOrgs.orgId, apiKeyOrg.orgId)
+                        eq(userOrgs.orgId, apiKey.apiKeyOrg.orgId)
                     )
                 )
                 .limit(1);

server/private/routers/auditLogs/exportConnectionAuditLog.ts

@@ -97,7 +97,7 @@ export async function exportConnectionAuditLogs(
 
         const baseQuery = queryConnection(data);
 
-        const log = await baseQuery.limit(data.limit).offset(data.offset);
+        const log = await baseQuery.limit(MAX_EXPORT_LIMIT);
 
         const csvData = generateCSV(log);
 

server/private/routers/billing/hooks/handleSubscriptionCreated.ts

@@ -243,6 +243,14 @@ export async function handleSubscriptionCreated(
                     `License type determined: ${numUsers} users, ${numSites} sites for subscription ${subscription.id}`
                 );
 
+                // Grace period of 5 days added on top of the current billing
+                // period end (usually ~1 year out) before the license expires
+                const currentPeriodEnd =
+                    fullSubscription.items.data[0]?.current_period_end;
+                const expiresAt =
+                    (currentPeriodEnd ?? subscription.created) +
+                    5 * 24 * 60 * 60;
+
                 const response = await fetch(
                     `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/paid-for`,
                     {
@@ -258,7 +266,8 @@ export async function handleSubscriptionCreated(
                             paidFor: true,
                             users: numUsers,
                             sites: numSites,
-                            tier: tier
+                            tier: tier,
+                            expiresAt: expiresAt
                         })
                     }
                 );
@@ -267,6 +276,13 @@ export async function handleSubscriptionCreated(
 
                 logger.debug(`Fossorial API response: ${JSON.stringify(data)}`);
 
+                if (!response.ok || !data.success) {
+                    logger.error(
+                        `Fossorial API returned ${response.status} when setting paid-for for orgId ${customer.orgId} and subscription ID ${subscription.id}: ${JSON.stringify(data)}`
+                    );
+                    return;
+                }
+
                 if (customer.email) {
                     logger.debug(
                         `Sending license key email to ${customer.email} for subscription ${subscription.id}`

server/private/routers/billing/hooks/handleSubscriptionDeleted.ts

@@ -125,9 +125,7 @@ export async function handleSubscriptionDeleted(
                 `Handling license subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}`
             );
             try {
-                // WARNING:
-                // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId
-                await fetch(
+                const invalidateResponse = await fetch(
                     `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/invalidate`,
                     {
                         method: "POST",
@@ -139,9 +137,18 @@ export async function handleSubscriptionDeleted(
                         },
                         body: JSON.stringify({
                             orgId: customer.orgId,
+                            licenseKeyId: parseInt(
+                                subscription.metadata.licenseKeyId
+                            )
                         })
                     }
                 );
+
+                if (!invalidateResponse.ok) {
+                    logger.error(
+                        `Fossorial API returned ${invalidateResponse.status} when invalidating license for orgId ${customer.orgId} and subscription ID ${subscription.id}: ${await invalidateResponse.text()}`
+                    );
+                }
             } catch (error) {
                 logger.error(
                     `Error notifying Fossorial API of license subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}:`,

server/private/routers/billing/hooks/handleSubscriptionUpdated.ts

@@ -23,7 +23,10 @@ import {
 } from "@server/db";
 import { eq, and } from "drizzle-orm";
 import logger from "@server/logger";
-import { getFeatureIdByMetricId, getFeatureIdByPriceId } from "@server/lib/billing/features";
+import {
+    getFeatureIdByMetricId,
+    getFeatureIdByPriceId
+} from "@server/lib/billing/features";
 import stripe from "#private/lib/stripe";
 import { handleSubscriptionLifesycle } from "../subscriptionLifecycle";
 import { getSubType, SubscriptionType } from "./getSubType";
@@ -66,7 +69,8 @@ export async function handleSubscriptionUpdated(
             .limit(1);
 
         const type = getSubType(fullSubscription);
-        const previousType = existingSubscription.type as SubscriptionType | null;
+        const previousType =
+            existingSubscription.type as SubscriptionType | null;
 
         // If the subscription has been manually overridden, we lock the
         // status down so Stripe webhooks can no longer change it.
@@ -100,7 +104,11 @@ export async function handleSubscriptionUpdated(
             logger.info(
                 `Tier change detected for org ${customer.orgId}: ${previousType} -> ${type}`
             );
-            await handleTierChange(customer.orgId, type, previousType ?? undefined);
+            await handleTierChange(
+                customer.orgId,
+                type,
+                previousType ?? undefined
+            );
         }
 
         // Upsert subscription items
@@ -113,7 +121,8 @@ export async function handleSubscriptionUpdated(
 
             const itemsToUpsert = fullSubscription.items.data.map((item) => {
                 // Try to get featureId from price
-                let featureId: string | null = getFeatureIdByPriceId(item.price.id) || null;
+                let featureId: string | null =
+                    getFeatureIdByPriceId(item.price.id) || null;
 
                 // If no match, try to preserve existing featureId
                 if (!featureId) {
@@ -302,14 +311,20 @@ export async function handleSubscriptionUpdated(
                     logger.info(
                         `Subscription ${subscription.id} for org ${customer.orgId} is ${effectiveStatus}, disabling paid features`
                     );
-                    await handleTierChange(customer.orgId, null, previousType ?? undefined);
+                    await handleTierChange(
+                        customer.orgId,
+                        null,
+                        previousType ?? undefined
+                    );
                 }
             } else if (type === "license") {
-                if (effectiveStatus === "canceled" || effectiveStatus == "unpaid" || effectiveStatus == "incomplete_expired") {
+                if (
+                    effectiveStatus === "canceled" ||
+                    effectiveStatus == "unpaid" ||
+                    effectiveStatus == "incomplete_expired"
+                ) {
                     try {
-                        // WARNING:
-                        // this invalidates ALL OF THE ENTERPRISE LICENSES for this orgId
-                        await fetch(
+                        const invalidateResponse = await fetch(
                             `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/invalidate`,
                             {
                                 method: "POST",
@@ -320,16 +335,95 @@ export async function handleSubscriptionUpdated(
                                     "Content-Type": "application/json"
                                 },
                                 body: JSON.stringify({
-                                    orgId: customer.orgId
+                                    orgId: customer.orgId,
+                                    licenseKeyId: parseInt(
+                                        subscription.metadata.licenseKeyId
+                                    )
                                 })
                             }
                         );
+
+                        if (!invalidateResponse.ok) {
+                            logger.error(
+                                `Fossorial API returned ${invalidateResponse.status} when invalidating license for orgId ${customer.orgId} and subscription ID ${subscription.id}: ${await invalidateResponse.text()}`
+                            );
+                        }
                     } catch (error) {
                         logger.error(
                             `Error notifying Fossorial API of license subscription deletion for orgId ${customer.orgId} and subscription ID ${subscription.id}:`,
                             error
                         );
                     }
+                } else if (effectiveStatus === "active" && previousAttributes) {
+                    // Detect a successful renewal: the billing period rolled
+                    // forward (the invoice was paid and the new period began
+                    // right where the previous one ended).
+                    const currentItem = fullSubscription.items.data[0];
+                    const prevItems = previousAttributes.items?.data;
+                    const prevItem = Array.isArray(prevItems)
+                        ? prevItems.find(
+                              (pi: any) => pi.id === currentItem?.id
+                          )
+                        : undefined;
+
+                    const renewed =
+                        currentItem &&
+                        prevItem?.current_period_end &&
+                        currentItem.current_period_start ===
+                            prevItem.current_period_end &&
+                        currentItem.current_period_start >
+                            prevItem.current_period_start;
+
+                    if (renewed) {
+                        const licenseKeyId =
+                            subscription.metadata.licenseKeyId;
+
+                        if (!licenseKeyId) {
+                            logger.error(
+                                `No licenseKeyId in metadata for subscription ${subscription.id}, cannot extend license.`
+                            );
+                        } else {
+                            // Grace period of 5 days added on top of the new
+                            // billing period end (usually ~1 year out)
+                            const expiresAt =
+                                currentItem.current_period_end +
+                                5 * 24 * 60 * 60;
+
+                            try {
+                                const extendResponse = await fetch(
+                                    `${privateConfig.getRawPrivateConfig().server.fossorial_api}/api/v1/license-internal/enterprise/extend`,
+                                    {
+                                        method: "POST",
+                                        headers: {
+                                            "api-key":
+                                                privateConfig.getRawPrivateConfig()
+                                                    .server.fossorial_api_key!,
+                                            "Content-Type": "application/json"
+                                        },
+                                        body: JSON.stringify({
+                                            licenseId: parseInt(licenseKeyId),
+                                            expiresAt: expiresAt
+                                        })
+                                    }
+                                );
+
+                                if (!extendResponse.ok) {
+                                    logger.error(
+                                        `Fossorial API returned ${extendResponse.status} when extending license ${licenseKeyId} for subscription ${subscription.id}: ${await extendResponse.text()}`
+                                    );
+                                } else {
+                                    logger.info(
+                                        `Extended license ${licenseKeyId} for subscription ${subscription.id} to expire at ${expiresAt}.`
+                                    );
+                                }
+                            } catch (error) {
+                                logger.error(
+                                    `Error notifying Fossorial API of license renewal for subscription ${subscription.id}:`,
+                                    error
+                                );
+                            }
+                        }
+                    }
                 }
             }
         }

server/private/routers/generatedLicense/generateNewEnterpriseLicense.ts

@@ -96,6 +96,8 @@ export async function generateNewEnterpriseLicense(
             );
         }
 
+        const licenseKeyValue = apiResponse?.data?.licenseKey?.licenseKey;
+
         // check if we already have a customer for this org
         const [customer] = await db
             .select()
@@ -129,6 +131,16 @@ export async function generateNewEnterpriseLicense(
             ], // Start with the standard feature set that matches the free limits
             customer: customer.customerId,
             mode: "subscription",
+            subscription_data: {
+                description: licenseKeyValue
+                    ? `License ${licenseKeyValue}`
+                    : `License key ID ${keyId}`,
+                metadata: {
+                    licenseKeyId: keyId.toString(),
+                    licenseKey: licenseKeyValue ?? "",
+                    tier: licenseData.tier
+                }
+            },
             allow_promotion_codes: true,
             success_url: `${config.getRawConfig().app.dashboard_url}/${orgId}/settings/license?success=true&session_id={CHECKOUT_SESSION_ID}`,
             cancel_url: `${config.getRawConfig().app.dashboard_url}/${orgId}/settings/license?canceled=true`

server/routers/badger/verifySession.test.ts

@@ -386,6 +386,38 @@ function runSpecialCharacterTests() {
     console.log("All special character tests passed!");
 }
 
+function runEncodedPatternTests() {
+    console.log("\nRunning percent-encoded pattern tests...");
+
+    // isValidUrlGlobPattern accepts percent-encoded sequences and rejects
+    // raw spaces / non-ASCII, so `%20` and `%C3%A9` are the only way to write
+    // a PATH rule for such a path. Badger sends the request path already
+    // decoded (Go's req.URL.Path), and isPathAllowed decodes it again, so the
+    // rule pattern must be decoded the same way or it can never match.
+    assertEquals(
+        isPathAllowed("/my%20docs/*", "/my docs/report.pdf"),
+        true,
+        "Percent-encoded space in pattern should match decoded request path"
+    );
+    assertEquals(
+        isPathAllowed("/my%20docs/*", "/my%20docs/report.pdf"),
+        true,
+        "Percent-encoded space in pattern should match raw-encoded request path"
+    );
+    assertEquals(
+        isPathAllowed("/caf%C3%A9", "/café"),
+        true,
+        "Percent-encoded UTF-8 in pattern should match decoded request path"
+    );
+    assertEquals(
+        isPathAllowed("/my%20docs/*", "/my-docs/report.pdf"),
+        false,
+        "Decoded pattern must still reject a different path"
+    );
+
+    console.log("All percent-encoded pattern tests passed!");
+}
+
 function runRegionTests() {
     console.log("\nRunning isIpInRegion tests...");
 
@@ -446,6 +478,7 @@ function runRegionTests() {
 try {
     runTests();
     runSpecialCharacterTests();
+    runEncodedPatternTests();
     runRegionTests();
     console.log("\n✅ All tests passed!");
 } catch (error) {

server/routers/newt/peers.ts

@@ -31,7 +31,7 @@ export async function addPeer(
             .where(eq(newts.siteId, siteId))
             .limit(1);
         if (!newt) {
-            throw new Error(`Site found for site ${siteId}`);
+            throw new Error(`Newt not found for site ${siteId}`);
         }
         newtId = newt.newtId;
     }

server/routers/resource/updateResource.ts

@@ -500,7 +500,8 @@ async function updateHttpResource(
     }
 
     // catch when the resource policy changes or gets cleared
-    if (resource.resourcePolicyId != updateData.resourcePolicyId) {
+    if (updateData.resourcePolicyId !== undefined && 
+        resource.resourcePolicyId !== updateData.resourcePolicyId) {
         await clearResourceSpecificSettings(
             resource.resourceId,
             resource.orgId,

server/routers/site/createSite.ts

@@ -263,7 +263,7 @@ export async function createSite(
             const { value: newClientAddress, release } =
                 await getNextAvailableClientSubnet(orgId);
             releaseSubnetLock = release;
-            updatedAddress = newClientAddress.split("/")[0];
+            updatedAddress = `${newClientAddress.split("/")[0]}/${org.subnet ? org.subnet.split("/")[1] : "32"}`;
         }
 
         let newSite: Site | undefined;

server/routers/site/updateSite.ts

@@ -113,7 +113,7 @@ export async function updateSite(
                 .where(
                     and(
                         eq(sites.niceId, updateData.niceId),
-                        eq(sites.orgId, sites.orgId),
+                        eq(sites.orgId, existingSite.orgId),
                         ne(sites.siteId, siteId)
                     )
                 )

server/routers/siteResource/getSiteResource.test.ts

@@ -0,0 +1,58 @@
+import { assertEquals } from "@test/assert";
+import { getSiteResourceParamsSchema } from "./getSiteResource";
+
+function testSiteResourceIdOnlyParams() {
+    const result = getSiteResourceParamsSchema.safeParse({
+        siteResourceId: "42"
+    });
+
+    assertEquals(
+        result.success,
+        true,
+        "siteResourceId-only integration routes should pass validation"
+    );
+
+    if (result.success) {
+        assertEquals(
+            result.data.siteResourceId,
+            42,
+            "siteResourceId should be parsed as a number"
+        );
+        assertEquals(
+            result.data.orgId,
+            undefined,
+            "orgId should remain optional"
+        );
+    }
+}
+
+function testOrgScopedParamsRemainSupported() {
+    const result = getSiteResourceParamsSchema.safeParse({
+        siteResourceId: "42",
+        orgId: "org-id"
+    });
+
+    assertEquals(
+        result.success,
+        true,
+        "org-scoped routes should continue to pass validation"
+    );
+}
+
+function testInvalidSiteResourceId() {
+    const result = getSiteResourceParamsSchema.safeParse({
+        siteResourceId: "not-a-number"
+    });
+
+    assertEquals(
+        result.success,
+        false,
+        "non-numeric siteResourceIds should fail validation"
+    );
+}
+
+testSiteResourceIdOnlyParams();
+testOrgScopedParamsRemainSupported();
+testInvalidSiteResourceId();
+
+console.log("All getSiteResource parameter validation tests passed.");

server/routers/siteResource/getSiteResource.ts

@@ -10,7 +10,7 @@ import { fromError } from "zod-validation-error";
 import logger from "@server/logger";
 import { OpenAPITags, registry } from "@server/openApi";
 
-const getSiteResourceParamsSchema = z.strictObject({
+export const getSiteResourceParamsSchema = z.strictObject({
     siteResourceId: z
         .string()
         .optional()
@@ -22,15 +22,17 @@ const getSiteResourceParamsSchema = z.strictObject({
 });
 
 async function query(siteResourceId?: number, niceId?: string, orgId?: string) {
-    if (siteResourceId && orgId) {
+    if (siteResourceId) {
         const [siteResource] = await db
             .select()
             .from(siteResources)
             .where(
-                and(
-                    eq(siteResources.siteResourceId, siteResourceId),
-                    eq(siteResources.orgId, orgId)
-                )
+                orgId
+                    ? and(
+                          eq(siteResources.siteResourceId, siteResourceId),
+                          eq(siteResources.orgId, orgId)
+                      )
+                    : eq(siteResources.siteResourceId, siteResourceId)
             )
             .limit(1);
         return siteResource;

server/setup/migrationsSqlite.backup.test.ts

@@ -0,0 +1,342 @@
+import { execFileSync } from "child_process";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { fileURLToPath } from "url";
+import Database from "better-sqlite3";
+import { assertEquals } from "@test/assert";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const repoRoot = path.resolve(here, "..", "..");
+const migrationsScript = path.join(here, "migrationsSqlite.ts");
+
+const SEED_STATEMENTS = [
+    `CREATE TABLE versionMigrations (version TEXT PRIMARY KEY, executedAt INTEGER NOT NULL)`,
+    `INSERT INTO versionMigrations (version, executedAt) VALUES ('1.21.0', 1750000000000)`,
+    `CREATE TABLE sites (siteId INTEGER PRIMARY KEY AUTOINCREMENT, subnet TEXT)`,
+    `INSERT INTO sites (subnet) VALUES ('10.0.0.0/24')`,
+    `CREATE TABLE roles (roleId INTEGER PRIMARY KEY AUTOINCREMENT, orgId TEXT, isAdmin INTEGER DEFAULT 0, sshSudoMode TEXT DEFAULT 'none')`,
+    `INSERT INTO roles (orgId, isAdmin, sshSudoMode) VALUES ('org1', 0, 'none')`,
+    `CREATE TABLE licenseKey (licenseKeyId INTEGER PRIMARY KEY AUTOINCREMENT)`,
+    `CREATE TABLE targets (targetId INTEGER PRIMARY KEY AUTOINCREMENT, resourceId INTEGER, siteId INTEGER NOT NULL, ip TEXT NOT NULL, method TEXT, port INTEGER NOT NULL, internalPort INTEGER, enabled INTEGER DEFAULT 1, path TEXT, pathMatchType TEXT, rewritePath TEXT, rewritePathType TEXT, priority INTEGER DEFAULT 100, mode TEXT DEFAULT 'http', authToken TEXT)`,
+    `CREATE TABLE subscriptions (subscriptionId INTEGER PRIMARY KEY AUTOINCREMENT)`,
+    `CREATE TABLE clients (clientId INTEGER PRIMARY KEY AUTOINCREMENT)`,
+    `CREATE TABLE orgs (orgId TEXT PRIMARY KEY)`,
+    `INSERT INTO orgs (orgId) VALUES ('org1')`,
+    `CREATE TABLE siteResources (siteResourceId INTEGER PRIMARY KEY AUTOINCREMENT)`,
+    `CREATE TABLE eventStreamingDestinations (destinationId INTEGER PRIMARY KEY AUTOINCREMENT)`,
+    `CREATE TABLE roleActions (roleId INTEGER, actionId TEXT, orgId TEXT)`,
+    `CREATE TABLE newt (newtId INTEGER PRIMARY KEY AUTOINCREMENT)`
+];
+
+function seedDatabase(dbPath: string) {
+    const db = new Database(dbPath);
+    try {
+        for (const statement of SEED_STATEMENTS) {
+            db.exec(statement);
+        }
+    } finally {
+        db.close();
+    }
+}
+
+function tableColumns(dbPath: string, tableName: string): string[] {
+    const db = new Database(dbPath, { readonly: true });
+    try {
+        return (
+            db.prepare(`PRAGMA table_info(${tableName})`).all() as Array<{
+                name: unknown;
+            }>
+        ).map((row) => String(row.name));
+    } finally {
+        db.close();
+    }
+}
+
+function executedMigrationVersions(dbPath: string): string[] {
+    const db = new Database(dbPath, { readonly: true });
+    try {
+        return (
+            db.prepare(`SELECT version FROM versionMigrations`).all() as Array<{
+                version: unknown;
+            }>
+        ).map((row) => String(row.version));
+    } finally {
+        db.close();
+    }
+}
+
+function runMigrations(
+    workdir: string,
+    env: Record<string, string> = {}
+): {
+    exitCode: number;
+    output: string;
+} {
+    const tsconfig = ["tsconfig.json", "tsconfig.oss.json"]
+        .map((file) => path.join(repoRoot, file))
+        .find((file) => fs.existsSync(file));
+    if (!tsconfig) {
+        throw new Error("No tsconfig found for @server path aliases");
+    }
+    const tsxCli = path.join(
+        repoRoot,
+        "node_modules",
+        "tsx",
+        "dist",
+        "cli.mjs"
+    );
+    if (!fs.existsSync(tsxCli)) {
+        throw new Error("tsx is not installed; run npm ci first");
+    }
+    try {
+        const output = execFileSync(
+            process.execPath,
+            [tsxCli, "--tsconfig", tsconfig, migrationsScript],
+            {
+                cwd: workdir,
+                timeout: 120000,
+                encoding: "utf8",
+                env: { ...process.env, NODE_ENV: "test", ...env }
+            }
+        );
+        return { exitCode: 0, output };
+    } catch (error) {
+        const output =
+            error instanceof Error
+                ? (error as Error & { stdout?: unknown }).stdout
+                : "";
+        return { exitCode: 1, output: String(output ?? "") };
+    }
+}
+
+function createTestEnvironment(): string {
+    for (const generated of ["server/build.ts", "server/db/index.ts"]) {
+        if (!fs.existsSync(path.join(repoRoot, generated))) {
+            throw new Error(
+                `Missing ${generated}; run npm run set:oss && npm run set:sqlite first`
+            );
+        }
+    }
+    const workdir = fs.mkdtempSync(
+        path.join(os.tmpdir(), "pangolin-backup-test-")
+    );
+    fs.mkdirSync(path.join(workdir, "config", "db"), { recursive: true });
+    fs.copyFileSync(
+        path.join(repoRoot, "config", "config.example.yml"),
+        path.join(workdir, "config", "config.yml")
+    );
+    const traefikSrc = path.join(repoRoot, "config", "traefik");
+    if (fs.existsSync(traefikSrc)) {
+        fs.cpSync(traefikSrc, path.join(workdir, "config", "traefik"), {
+            recursive: true
+        });
+    }
+    fs.symlinkSync(
+        path.join(repoRoot, "server"),
+        path.join(workdir, "server"),
+        process.platform === "win32" ? "junction" : "dir"
+    );
+    return workdir;
+}
+
+function testMultipleSequentialMigrations() {
+    console.log("Running multiple sequential migrations test...");
+    const workdir = createTestEnvironment();
+    try {
+        seedDatabase(path.join(workdir, "config", "db", "db.sqlite"));
+        const result = runMigrations(workdir);
+        assertEquals(result.exitCode, 0, "Seeded migrations must run cleanly");
+        if (!result.output.includes("All migrations completed successfully")) {
+            throw new Error(
+                "Seeded migrations did not complete; the backup assertions below would be vacuous"
+            );
+        }
+
+        const backupsDir = path.join(workdir, "config", "db", "backups");
+        const backups = fs.existsSync(backupsDir)
+            ? fs
+                  .readdirSync(backupsDir)
+                  .filter((file) => file.endsWith(".sqlite"))
+            : [];
+
+        // Upgrading from 1.21.0 runs 1.22.0 and 1.23.0 -> produces 2 distinct backups
+        assertEquals(
+            backups.length,
+            2,
+            "Each migration must have its own distinct backup snapshot"
+        );
+
+        const v122Backup = backups.find((file) =>
+            file.includes("_v1.22.0.sqlite")
+        );
+        const v123Backup = backups.find((file) =>
+            file.includes("_v1.23.0.sqlite")
+        );
+
+        if (!v122Backup || !v123Backup) {
+            throw new Error(
+                `Expected backups for v1.22.0 and v1.23.0, found: ${backups.join(", ")}`
+            );
+        }
+
+        // Verify pre-1.22.0 snapshot state: sites has 'subnet' (not exitNodeSubnet), versions = [1.21.0]
+        const v122Columns = tableColumns(
+            path.join(backupsDir, v122Backup),
+            "sites"
+        );
+        assertEquals(
+            v122Columns.includes("subnet") &&
+                !v122Columns.includes("exitNodeSubnet"),
+            true,
+            "Backup before 1.22.0 must retain pre-1.22.0 schema (sites.subnet)"
+        );
+        const v122Versions = executedMigrationVersions(
+            path.join(backupsDir, v122Backup)
+        );
+        assertEquals(
+            v122Versions.includes("1.21.0") && !v122Versions.includes("1.22.0"),
+            true,
+            "Backup before 1.22.0 must only record version 1.21.0"
+        );
+
+        // Verify pre-1.23.0 snapshot state: sites has 'exitNodeSubnet' (1.22.0 applied), newt has no agent
+        const v123Columns = tableColumns(
+            path.join(backupsDir, v123Backup),
+            "sites"
+        );
+        assertEquals(
+            v123Columns.includes("exitNodeSubnet"),
+            true,
+            "Backup before 1.23.0 must contain successfully applied 1.22.0 schema (sites.exitNodeSubnet)"
+        );
+        const v123NewtCols = tableColumns(
+            path.join(backupsDir, v123Backup),
+            "newt"
+        );
+        assertEquals(
+            !v123NewtCols.includes("agent"),
+            true,
+            "Backup before 1.23.0 must not contain 1.23.0 schema changes yet"
+        );
+        const v123Versions = executedMigrationVersions(
+            path.join(backupsDir, v123Backup)
+        );
+        assertEquals(
+            v123Versions.includes("1.21.0") && v123Versions.includes("1.22.0"),
+            true,
+            "Backup before 1.23.0 must record both 1.21.0 and 1.22.0"
+        );
+    } finally {
+        fs.rmSync(workdir, { recursive: true, force: true });
+    }
+}
+
+function testFailureInLaterMigrationPreservesRestorePoints() {
+    console.log("Running failure in later migration test...");
+    const workdir = createTestEnvironment();
+    try {
+        const dbPath = path.join(workdir, "config", "db", "db.sqlite");
+        seedDatabase(dbPath);
+
+        // Intentionally drop table 'newt' so migration 1.23.0 fails on ALTER TABLE newt ADD COLUMN agent
+        const db = new Database(dbPath);
+        db.exec("DROP TABLE newt;");
+        db.close();
+
+        const result = runMigrations(workdir);
+        assertEquals(
+            result.exitCode,
+            1,
+            "Migration suite must fail when 1.23.0 errors"
+        );
+
+        const backupsDir = path.join(workdir, "config", "db", "backups");
+        const backups = fs.existsSync(backupsDir)
+            ? fs
+                  .readdirSync(backupsDir)
+                  .filter((file) => file.endsWith(".sqlite"))
+            : [];
+
+        // Both pre-1.22.0 and pre-1.23.0 backups must exist
+        assertEquals(
+            backups.length,
+            2,
+            "Backups for earlier successful migration and the failed migration must both exist"
+        );
+
+        const v122Backup = backups.find((file) =>
+            file.includes("_v1.22.0.sqlite")
+        );
+        const v123Backup = backups.find((file) =>
+            file.includes("_v1.23.0.sqlite")
+        );
+
+        if (!v122Backup || !v123Backup) {
+            throw new Error(
+                `Expected restore points for v1.22.0 and v1.23.0, found: ${backups.join(", ")}`
+            );
+        }
+
+        // Verify pre-1.23.0 backup is a valid restore point with 1.22.0 changes applied
+        const v123SitesCols = tableColumns(
+            path.join(backupsDir, v123Backup),
+            "sites"
+        );
+        assertEquals(
+            v123SitesCols.includes("exitNodeSubnet"),
+            true,
+            "Pre-failure restore point must have 1.22.0 changes intact"
+        );
+        const v123Versions = executedMigrationVersions(
+            path.join(backupsDir, v123Backup)
+        );
+        assertEquals(
+            v123Versions.includes("1.22.0"),
+            true,
+            "Pre-failure restore point must record successful 1.22.0 migration"
+        );
+    } finally {
+        fs.rmSync(workdir, { recursive: true, force: true });
+    }
+}
+
+function testDisableBackupOnMigration() {
+    console.log("Running DISABLE_BACKUP_ON_MIGRATION test...");
+    const workdir = createTestEnvironment();
+    try {
+        seedDatabase(path.join(workdir, "config", "db", "db.sqlite"));
+        const result = runMigrations(workdir, {
+            DISABLE_BACKUP_ON_MIGRATION: "1"
+        });
+        assertEquals(
+            result.exitCode,
+            0,
+            "Migrations must succeed with backups disabled"
+        );
+
+        const backupsDir = path.join(workdir, "config", "db", "backups");
+        const backups = fs.existsSync(backupsDir)
+            ? fs
+                  .readdirSync(backupsDir)
+                  .filter((file) => file.endsWith(".sqlite"))
+            : [];
+        assertEquals(
+            backups.length,
+            0,
+            "No backup files should be created when DISABLE_BACKUP_ON_MIGRATION is set"
+        );
+    } finally {
+        fs.rmSync(workdir, { recursive: true, force: true });
+    }
+}
+
+try {
+    testMultipleSequentialMigrations();
+    testFailureInLaterMigrationPreservesRestorePoints();
+    testDisableBackupOnMigration();
+    console.log("All backup migration regression tests passed successfully!");
+} catch (error) {
+    console.error("Test failed:", error);
+    process.exit(1);
+}

server/setup/migrationsSqlite.ts

@@ -5,6 +5,7 @@ import path from "path";
 import semver from "semver";
 import { versionMigrations } from "../db/sqlite";
 import { __DIRNAME, APP_PATH, APP_VERSION } from "@server/lib/consts";
+import { formatBackupFileName } from "@server/lib/backupFileName";
 import { SqliteError } from "better-sqlite3";
 import fs from "fs";
 import { build } from "@server/build";
@@ -106,7 +107,7 @@ async function run() {
     await runMigrations();
 }
 
-function backupDb() {
+function backupDb(version?: string) {
     // make dir config/db/backups
     const appPath = APP_PATH;
     const dbDir = path.join(appPath, "db");
@@ -119,11 +120,10 @@ function backupDb() {
     }
 
     // copy the db.sqlite file to backups
-    // add the date to the filename
-    const date = new Date();
-    const dateString = `${date.getFullYear()}-${date.getMonth()}-${date.getDate()}_${date.getHours()}-${date.getMinutes()}-${date.getSeconds()}`;
+    // add the date and migration version to the filename
+    const fileName = formatBackupFileName(version);
     const dbPath = path.join(dbDir, "db.sqlite");
-    const backupPath = path.join(backupsDir, `db_${dateString}.sqlite`);
+    const backupPath = path.join(backupsDir, fileName);
     fs.copyFileSync(dbPath, backupPath);
 }
 
@@ -162,6 +162,12 @@ export async function runMigrations() {
         }
     } catch (e) {
         console.error("Error running migrations:", e);
+        if (
+            process.env.NODE_ENV === "test" ||
+            process.env.ENVIRONMENT === "test"
+        ) {
+            throw e;
+        }
         await new Promise((resolve) =>
             setTimeout(resolve, 1000 * 60 * 60 * 24 * 1)
         );
@@ -196,7 +202,7 @@ async function executeScripts() {
             try {
                 if (!process.env.DISABLE_BACKUP_ON_MIGRATION) {
                     // Backup the database before running the migration
-                    backupDb();
+                    backupDb(migration.version);
                 }
 
                 await migration.run();

server/setup/scriptsPg/1.23.0.ts

@@ -3,8 +3,6 @@ import { sql } from "drizzle-orm";
 
 const version = "1.23.0";
 
-await migration();
-
 export default async function migration() {
     console.log(`Running setup script ${version}...`);
 
@@ -12,11 +10,11 @@ export default async function migration() {
         await db.execute(sql`BEGIN`);
 
         await db.execute(sql`
-            ALTER TABLE "newt" ADD COLUMN "agent" varchar;
+            ALTER TABLE "newt" ADD COLUMN IF NOT EXISTS "agent" varchar;
         `);
 
         await db.execute(sql`
-            ALTER TABLE "newt" ADD COLUMN "agentVersion" varchar;
+            ALTER TABLE "newt" ADD COLUMN IF NOT EXISTS "agentVersion" varchar;
         `);
 
         await db.execute(sql`COMMIT`);

server/setup/scriptsSqlite/1.0.0-beta9.ts

@@ -20,25 +20,6 @@ import { fromZodError } from "zod-validation-error";
 export default async function migration() {
     console.log("Running setup script 1.0.0-beta.9...");
 
-    // make dir config/db/backups
-    const appPath = APP_PATH;
-    const dbDir = path.join(appPath, "db");
-
-    const backupsDir = path.join(dbDir, "backups");
-
-    // check if the backups directory exists and create it if it doesn't
-    if (!fs.existsSync(backupsDir)) {
-        fs.mkdirSync(backupsDir, { recursive: true });
-    }
-
-    // copy the db.sqlite file to backups
-    // add the date to the filename
-    const date = new Date();
-    const dateString = `${date.getFullYear()}-${date.getMonth()}-${date.getDate()}_${date.getHours()}-${date.getMinutes()}-${date.getSeconds()}`;
-    const dbPath = path.join(dbDir, "db.sqlite");
-    const backupPath = path.join(backupsDir, `db_${dateString}.sqlite`);
-    fs.copyFileSync(dbPath, backupPath);
-
     await db.transaction(async (trx) => {
         try {
             // Determine which config file exists

server/setup/scriptsSqlite/1.23.0.ts

@@ -16,13 +16,13 @@ export default async function migration() {
         db.transaction(() => {
             db.prepare(
                 `
-            ALTER TABLE 'newt' ADD 'agent' text;
+            ALTER TABLE 'newt' ADD COLUMN 'agent' text;
                 `
             ).run();
 
             db.prepare(
                 `
-            ALTER TABLE 'newt' ADD 'agentVersion' text;
+            ALTER TABLE 'newt' ADD COLUMN 'agentVersion' text;
                 `
             ).run();
         })();

src/app/[orgId]/settings/(private)/billing/page.tsx

@@ -749,12 +749,6 @@ export default function BillingPage() {
         return 0;
     };
 
-    // Get license key count
-    const getLicenseKeyCount = (): number => {
-        if (!licenseSubscription?.items) return 0;
-        return licenseSubscription.items.length;
-    };
-
     // Check if downgrading to a tier would violate current usage limits
     const checkLimitViolations = (
         targetTier: Tier | "basic"
@@ -1545,7 +1539,7 @@ export default function BillingPage() {
             </SettingsSection>
 
             {/* Paid License Keys Section */}
-            {(licenseSubscription || getLicenseKeyCount() > 0) && (
+            {licenseSubscription && (
                 <SettingsSection>
                     <SettingsSectionHeader>
                         <SettingsSectionTitle>
@@ -1561,22 +1555,6 @@ export default function BillingPage() {
                             <SettingsFormGrid>
                                 <SettingsFormCell span="full">
                                     <div className="flex flex-col md:flex-row items-start md:items-center justify-between gap-4 border rounded-lg p-4">
-                                        <div>
-                                            <div className="text-sm text-muted-foreground mb-1">
-                                                {t("billingCurrentKeys") ||
-                                                    "Current Keys"}
-                                            </div>
-                                            <div className="flex items-baseline gap-2">
-                                                <span className="text-3xl font-semibold">
-                                                    {getLicenseKeyCount()}
-                                                </span>
-                                                <span className="text-lg">
-                                                    {getLicenseKeyCount() === 1
-                                                        ? "key"
-                                                        : "keys"}
-                                                </span>
-                                            </div>
-                                        </div>
                                         <Button
                                             variant="outline"
                                             onClick={handleModifySubscription}

src/app/[orgId]/settings/(private)/license/page.tsx

@@ -1,4 +1,5 @@
 import GenerateLicenseKeysTable from "@app/components/GenerateLicenseKeysTable";
+import LicenseBillingBanner from "@app/components/LicenseBillingBanner";
 import { internal } from "@app/lib/api";
 import { authCookieHeader } from "@app/lib/api/cookies";
 import { ListGeneratedLicenseKeysResponse } from "@server/routers/generatedLicense/types";
@@ -26,5 +27,16 @@ export default async function Page({ params }: Props) {
         licenseKeys = data.data.data;
     } catch {}
 
-    return <GenerateLicenseKeysTable licenseKeys={licenseKeys} orgId={orgId} />;
+    const hasNonPersonalLicenseKey = licenseKeys.some(
+        (key) => key.tier !== "personal"
+    );
+
+    return (
+        <>
+            {hasNonPersonalLicenseKey && (
+                <LicenseBillingBanner orgId={orgId} />
+            )}
+            <GenerateLicenseKeysTable licenseKeys={licenseKeys} orgId={orgId} />
+        </>
+    );
 }

src/app/[orgId]/settings/resources/private/[niceId]/ai-gateway/page.tsx

@@ -76,11 +76,13 @@ export default function PrivateResourceInferencePage() {
                     })
                 ),
                 httpConfigSubdomain: z.string().nullish(),
-                httpConfigDomainId: z.string().nullish(),
+                httpConfigDomainId: z
+                    .string()
+                    .min(1, { message: t("domainRequired") }),
                 httpConfigFullDomain: z.string().nullish(),
                 ssl: z.boolean().optional()
             }),
-        []
+        [t]
     );
     type FormValues = z.infer<typeof formSchema>;
 
@@ -103,7 +105,7 @@ export default function PrivateResourceInferencePage() {
         defaultValues: {
             providers: [],
             httpConfigSubdomain: siteResource.subdomain ?? null,
-            httpConfigDomainId: siteResource.domainId ?? null,
+            httpConfigDomainId: siteResource.domainId ?? "",
             httpConfigFullDomain: siteResource.fullDomain ?? null,
             ssl: siteResource.ssl ?? false
         }
@@ -289,50 +291,74 @@ export default function PrivateResourceInferencePage() {
                                         </SettingsSubsectionHeader>
                                     </SettingsFormCell>
                                     <SettingsFormCell span="full">
-                                        <DomainPicker
-                                            key={`inference-domain-${siteResource.id}`}
-                                            orgId={siteResource.orgId}
-                                            cols={2}
-                                            hideFreeDomain
-                                            defaultSubdomain={
-                                                httpConfigSubdomain ?? undefined
-                                            }
-                                            defaultDomainId={
-                                                httpConfigDomainId ?? undefined
-                                            }
-                                            defaultFullDomain={
-                                                httpConfigFullDomain ??
-                                                undefined
-                                            }
-                                            onDomainChange={(res) => {
-                                                if (res === null) {
-                                                    form.setValue(
-                                                        "httpConfigSubdomain",
-                                                        null
-                                                    );
-                                                    form.setValue(
-                                                        "httpConfigDomainId",
-                                                        null
-                                                    );
-                                                    form.setValue(
-                                                        "httpConfigFullDomain",
-                                                        null
-                                                    );
-                                                    return;
-                                                }
-                                                form.setValue(
-                                                    "httpConfigSubdomain",
-                                                    res.subdomain ?? null
-                                                );
-                                                form.setValue(
-                                                    "httpConfigDomainId",
-                                                    res.domainId
-                                                );
-                                                form.setValue(
-                                                    "httpConfigFullDomain",
-                                                    res.fullDomain
-                                                );
-                                            }}
+                                        <FormField
+                                            control={form.control}
+                                            name="httpConfigDomainId"
+                                            render={() => (
+                                                <FormItem>
+                                                    <DomainPicker
+                                                        key={`inference-domain-${siteResource.id}`}
+                                                        orgId={
+                                                            siteResource.orgId
+                                                        }
+                                                        cols={2}
+                                                        hideFreeDomain
+                                                        defaultSubdomain={
+                                                            httpConfigSubdomain ??
+                                                            undefined
+                                                        }
+                                                        defaultDomainId={
+                                                            httpConfigDomainId ??
+                                                            undefined
+                                                        }
+                                                        defaultFullDomain={
+                                                            httpConfigFullDomain ??
+                                                            undefined
+                                                        }
+                                                        onDomainChange={(
+                                                            res
+                                                        ) => {
+                                                            if (res === null) {
+                                                                form.setValue(
+                                                                    "httpConfigSubdomain",
+                                                                    null
+                                                                );
+                                                                form.setValue(
+                                                                    "httpConfigDomainId",
+                                                                    "",
+                                                                    {
+                                                                        shouldValidate:
+                                                                            true
+                                                                    }
+                                                                );
+                                                                form.setValue(
+                                                                    "httpConfigFullDomain",
+                                                                    null
+                                                                );
+                                                                return;
+                                                            }
+                                                            form.setValue(
+                                                                "httpConfigSubdomain",
+                                                                res.subdomain ??
+                                                                    null
+                                                            );
+                                                            form.setValue(
+                                                                "httpConfigDomainId",
+                                                                res.domainId,
+                                                                {
+                                                                    shouldValidate:
+                                                                        true
+                                                                }
+                                                            );
+                                                            form.setValue(
+                                                                "httpConfigFullDomain",
+                                                                res.fullDomain
+                                                            );
+                                                        }}
+                                                    />
+                                                    <FormMessage />
+                                                </FormItem>
+                                            )}
                                         />
                                     </SettingsFormCell>
                                     <SettingsFormCell span="half">

src/app/[orgId]/settings/resources/public/[niceId]/general/page.tsx

@@ -139,6 +139,22 @@ export default function GeneralForm() {
                     : "Port number should not be set for HTTP resources",
                 path: ["proxyPort"]
             }
+        )
+        .refine(
+            (data) => {
+                if (
+                    ["http", "ssh", "rdp", "vnc", "inference"].includes(
+                        resource.mode
+                    )
+                ) {
+                    return !!data.domainId;
+                }
+                return true;
+            },
+            {
+                message: t("domainRequired"),
+                path: ["domainId"]
+            }
         );
 
     type GeneralFormValues = z.infer<typeof GeneralFormSchema>;
@@ -434,63 +450,87 @@ export default function GeneralForm() {
                                             resource.mode
                                         ) && (
                                             <SettingsFormCell span="full">
-                                                <div id="resource-domain-picker">
-                                                    <DomainPicker
-                                                        allowWildcard={
-                                                            resource.mode !==
-                                                            "inference"
-                                                        }
-                                                        key={
-                                                            resource.resourceId
-                                                        }
-                                                        orgId={orgId as string}
-                                                        cols={2}
-                                                        defaultSubdomain={
-                                                            form.watch(
-                                                                "subdomain"
-                                                            ) ?? undefined
-                                                        }
-                                                        defaultDomainId={
-                                                            form.watch(
-                                                                "domainId"
-                                                            ) ?? undefined
-                                                        }
-                                                        defaultFullDomain={
-                                                            resourceFullDomainName ||
-                                                            undefined
-                                                        }
-                                                        onDomainChange={(
-                                                            res
-                                                        ) => {
-                                                            if (res === null) {
-                                                                form.setValue(
-                                                                    "domainId",
-                                                                    undefined
-                                                                );
-                                                                form.setValue(
-                                                                    "subdomain",
-                                                                    undefined
-                                                                );
-                                                                setResourceFullDomain(
-                                                                    `${resource.ssl ? "https" : "http"}://`
-                                                                );
-                                                                return;
-                                                            }
-                                                            form.setValue(
-                                                                "domainId",
-                                                                res.domainId
-                                                            );
-                                                            form.setValue(
-                                                                "subdomain",
-                                                                res.subdomain ??
-                                                                    undefined
-                                                            );
-                                                            setResourceFullDomain(
-                                                                `${resource.ssl ? "https" : "http"}://${toUnicode(res.fullDomain)}`
-                                                            );
-                                                        }}
-                                                    />
-                                                </div>
+                                                <FormField
+                                                    control={form.control}
+                                                    name="domainId"
+                                                    render={() => (
+                                                        <FormItem>
+                                                            <div id="resource-domain-picker">
+                                                                <DomainPicker
+                                                                    allowWildcard={
+                                                                        resource.mode !==
+                                                                        "inference"
+                                                                    }
+                                                                    key={
+                                                                        resource.resourceId
+                                                                    }
+                                                                    orgId={
+                                                                        orgId as string
+                                                                    }
+                                                                    cols={2}
+                                                                    defaultSubdomain={
+                                                                        form.watch(
+                                                                            "subdomain"
+                                                                        ) ??
+                                                                        undefined
+                                                                    }
+                                                                    defaultDomainId={
+                                                                        form.watch(
+                                                                            "domainId"
+                                                                        ) ??
+                                                                        undefined
+                                                                    }
+                                                                    defaultFullDomain={
+                                                                        resourceFullDomainName ||
+                                                                        undefined
+                                                                    }
+                                                                    onDomainChange={(
+                                                                        res
+                                                                    ) => {
+                                                                        if (
+                                                                            res ===
+                                                                            null
+                                                                        ) {
+                                                                            form.setValue(
+                                                                                "domainId",
+                                                                                undefined,
+                                                                                {
+                                                                                    shouldValidate:
+                                                                                        true
+                                                                                }
+                                                                            );
+                                                                            form.setValue(
+                                                                                "subdomain",
+                                                                                undefined
+                                                                            );
+                                                                            setResourceFullDomain(
+                                                                                `${resource.ssl ? "https" : "http"}://`
+                                                                            );
+                                                                            return;
+                                                                        }
+                                                                        form.setValue(
+                                                                            "domainId",
+                                                                            res.domainId,
+                                                                            {
+                                                                                shouldValidate:
+                                                                                    true
+                                                                            }
+                                                                        );
+                                                                        form.setValue(
+                                                                            "subdomain",
+                                                                            res.subdomain ??
+                                                                                undefined
+                                                                        );
+                                                                        setResourceFullDomain(
+                                                                            `${resource.ssl ? "https" : "http"}://${toUnicode(res.fullDomain)}`
+                                                                        );
+                                                                    }}
+                                                                />
+                                                            </div>
+                                                            <FormMessage />
+                                                        </FormItem>
+                                                    )}
+                                                />
                                             </SettingsFormCell>
                                         )}
                                         {!["tcp", "udp", "inference"].includes(

src/components/LicenseBillingBanner.tsx

@@ -0,0 +1,39 @@
+"use client";
+
+import { Globe, CreditCard, ArrowRight } from "lucide-react";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+import { Button } from "@app/components/ui/button";
+import DismissableBanner from "./DismissableBanner";
+
+type LicenseBillingBannerProps = {
+    orgId: string;
+};
+
+export const LicenseBillingBanner = ({ orgId }: LicenseBillingBannerProps) => {
+    const t = useTranslations();
+
+    return (
+        <DismissableBanner
+            storageKey="license-billing-banner-dismissed"
+            version={1}
+            title={t("licenseBillingBannerTitle")}
+            titleIcon={<Globe className="w-5 h-5 text-primary" />}
+            description={t("licenseBillingBannerDescription")}
+        >
+            <Link href={`/${orgId}/settings/billing`}>
+                <Button
+                    variant="outline"
+                    size="sm"
+                    className="gap-2 hover:bg-primary/10 hover:border-primary/50 transition-colors"
+                >
+                    <CreditCard className="w-4 h-4" />
+                    {t("licenseBillingBannerButton")}
+                    <ArrowRight className="w-4 h-4" />
+                </Button>
+            </Link>
+        </DismissableBanner>
+    );
+};
+
+export default LicenseBillingBanner;

src/components/NewPricingLicenseForm.tsx

@@ -330,7 +330,7 @@ export default function NewPricingLicenseForm({
                                             cols={2}
                                         />
                                         <a
-                                            href="https://pangolin.net/pricing"
+                                            href="https://pangolin.net/pricing#Self-Hosted"
                                             target="_blank"
                                             rel="noopener noreferrer"
                                             className="text-sm text-primary hover:underline"

src/components/SiteInfoCard.tsx

@@ -63,6 +63,12 @@ export default function SiteInfoCard({}: SiteInfoCardProps) {
     ) : null;
 
     if (site.type === "newt") {
+        // agent and agentVersion were added after newtVersion, so a
+        // site still running an older Newt reports only newtVersion.
+        // Without these fallbacks the badge renders with no label and
+        // no version at all.
+        const agentLabel = site.agent == "cli" ? "Pangolin CLI" : "Newt";
+        const agentVersion = site.agentVersion ?? site.newtVersion;
         return (
             <Alert>
                 <AlertDescription>
@@ -79,13 +85,12 @@ export default function SiteInfoCard({}: SiteInfoCardProps) {
                         <InfoSection>
                             <InfoSectionTitle>{t("agent")}</InfoSectionTitle>
                             <InfoSectionContent>
-                                {site.agent == "newt" ? "Newt" : null}
-                                {site.agent == "cli"
-                                    ? "Pangolin CLI"
-                                    : null}{" "}
-                                {site.agentVersion
-                                    ? `v${site.agentVersion}`
-                                    : "-"}
+                                <div className="flex items-center space-x-1">
+                                    <span>{agentLabel}</span>
+                                    {agentVersion && (
+                                        <span>v{agentVersion}</span>
+                                    )}
+                                </div>
                             </InfoSectionContent>
                         </InfoSection>
                         {endpointSection}

src/components/SitesTable.tsx

@@ -373,7 +373,7 @@ export default function SitesTable({
                 accessorKey: "type",
                 friendlyName: t("agent"),
                 header: () => {
-                    return <span className="p-3">{t("type")}</span>;
+                    return <span className="p-3">{t("agent")}</span>;
                 },
                 cell: ({ row }) => {
                     const originalRow = row.original;
@@ -386,25 +386,27 @@ export default function SitesTable({
                     );
 
                     if (originalRow.type === "newt") {
-                        if (!originalRow.agent) {
+                        if (!originalRow.agent && !originalRow.newtVersion) {
+                            // it has not checked in yet
                             return <span>-</span>;
                         }
+                        // agent and agentVersion were added after newtVersion, so a
+                        // site still running an older Newt reports only newtVersion.
+                        // Without these fallbacks the badge renders with no label and
+                        // no version at all.
+                        const agentLabel =
+                            originalRow.agent == "cli"
+                                ? "Pangolin CLI"
+                                : "Newt";
+                        const agentVersion =
+                            originalRow.agentVersion ?? originalRow.newtVersion;
                         return (
                             <div className="flex items-center space-x-1">
                                 <Badge variant="secondary">
                                     <div className="flex items-center space-x-1">
-                                        <span>
-                                            {originalRow.agent == "newt"
-                                                ? "Newt"
-                                                : null}
-                                            {originalRow.agent == "cli"
-                                                ? "Pangolin CLI"
-                                                : null}
-                                        </span>
-                                        {originalRow.agentVersion && (
-                                            <span>
-                                                v{originalRow.agentVersion}
-                                            </span>
+                                        <span>{agentLabel}</span>
+                                        {agentVersion && (
+                                            <span>v{agentVersion}</span>
                                         )}
                                     </div>
                                 </Badge>

src/components/newt-install-commands.tsx

@@ -150,7 +150,7 @@ Type=simple
 User=root
 Group=root
 EnvironmentFile=/etc/pangolin/pangolin-site.env
-ExecStart=/home/owen/fossorial/cli/bin/pangolin up site
+ExecStart=/usr/local/bin/pangolin up site
 Restart=always
 RestartSec=2
 UMask=0077

src/lib/privateResourceForm.ts

@@ -523,6 +523,13 @@ export function createCreateFormSchema(t: TranslateFn) {
                     });
                 }
             }
+            if (data.mode === "inference" && !data.httpConfigDomainId) {
+                ctx.addIssue({
+                    code: z.ZodIssueCode.custom,
+                    message: t("domainRequired"),
+                    path: ["httpConfigDomainId"]
+                });
+            }
         });
 }