Add global Ctrl+K command palette for navigation and search.

Provides quick access to sidebar destinations, org switching, server-filtered entity lookup, and common actions from anywhere in the authenticated layout.

.github/workflows/cicd.yml

@@ -77,7 +77,7 @@ jobs:
                   fi
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -149,7 +149,7 @@ jobs:
                   fi
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -204,7 +204,7 @@ jobs:
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
             - name: Log in to Docker Hub
-              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
               with:
                   registry: docker.io
                   username: ${{ secrets.DOCKER_HUB_USERNAME }}
@@ -407,7 +407,7 @@ jobs:
               shell: bash
 
             - name: Login to GitHub Container Registry (for cosign)
-              uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+              uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
               with:
                 registry: ghcr.io
                 username: ${{ github.actor }}

.github/workflows/linting.yml

@@ -24,7 +24,7 @@ jobs:
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
             - name: Set up Node.js
-              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
               with:
                 node-version: '24'
 

.github/workflows/mirror.yaml

@@ -23,7 +23,7 @@ jobs:
           skopeo --version
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
 
       - name: Input check
         run: |

.github/workflows/stale-bot.yml

@@ -14,7 +14,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           days-before-stale: 14
           days-before-close: 14

.github/workflows/test.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: '24'
 

.gitignore

@@ -17,9 +17,9 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 *.db
-*.sqlite*
+*.sqlite
 !Dockerfile.sqlite
-*.sqlite3*
+*.sqlite3
 *.log
 .machinelogs*.json
 *-audit.json
@@ -54,4 +54,3 @@ hydrateSaas.ts
 CLAUDE.md
 drizzle.config.ts
 server/setup/migrations.ts
-solo.yml

cloud

@@ -1,110 +0,0 @@
-git push origin -d 1.11.0-s.0
-git push origin -d 1.11.0-s.1
-git push origin -d 1.11.0-s.2
-git push origin -d 1.11.0-s.3
-git push origin -d 1.11.0-s.4
-git push origin -d 1.11.0-s.5
-git push origin -d 1.11.1-s.0
-git push origin -d 1.12.0-s.0
-git push origin -d 1.12.2-s.0
-git push origin -d 1.12.2-s.1
-git push origin -d 1.12.2-s.2
-git push origin -d 1.12.2-s.3
-git push origin -d 1.12.2-s.4
-git push origin -d 1.12.2-s.5
-git push origin -d 1.13.0.s.0
-git push origin -d 1.13.1-s.0
-git push origin -d 1.14.0-s.2
-git push origin -d 1.14.1-s.0
-git push origin -d 1.14.1-s.1
-git push origin -d 1.14.1-s.2
-git push origin -d 1.14.1-s.3
-git push origin -d 1.15.0-s.0
-git push origin -d 1.15.0-s.1
-git push origin -d 1.15.0-s.2
-git push origin -d 1.15.0-s.3
-git push origin -d 1.15.0-s.4
-git push origin -d 1.15.0-s.5
-git push origin -d 1.15.1-s.0
-git push origin -d 1.15.1-s.1
-git push origin -d 1.15.3-s.0
-git push origin -d 1.15.3-s.1
-git push origin -d 1.15.4-s.0
-git push origin -d 1.15.4-s.1
-git push origin -d 1.15.4-s.10
-git push origin -d 1.15.4-s.2
-git push origin -d 1.15.4-s.3
-git push origin -d 1.15.4-s.4
-git push origin -d 1.15.4-s.5
-git push origin -d 1.15.4-s.6
-git push origin -d 1.15.4-s.7
-git push origin -d 1.15.4-s.8
-git push origin -d 1.15.4-s.9
-git push origin -d 1.16.0-s.0
-git push origin -d 1.16.0-s.1
-git push origin -d 1.16.1-s.0
-git push origin -d 1.16.1-s.1
-git push origin -d 1.16.2-s.0
-git push origin -d 1.16.2-s.1
-git push origin -d 1.16.2-s.10
-git push origin -d 1.16.2-s.11
-git push origin -d 1.16.2-s.12
-git push origin -d 1.16.2-s.13
-git push origin -d 1.16.2-s.14
-git push origin -d 1.16.2-s.15
-git push origin -d 1.16.2-s.16
-git push origin -d 1.16.2-s.17
-git push origin -d 1.16.2-s.18
-git push origin -d 1.16.2-s.19
-git push origin -d 1.16.2-s.2
-git push origin -d 1.16.2-s.20
-git push origin -d 1.16.2-s.21
-git push origin -d 1.16.2-s.22
-git push origin -d 1.16.2-s.3
-git push origin -d 1.16.2-s.4
-git push origin -d 1.16.2-s.5
-git push origin -d 1.16.2-s.6
-git push origin -d 1.16.2-s.7
-git push origin -d 1.16.2-s.8
-git push origin -d 1.16.2-s.9
-git push origin -d 1.17.0-s.0
-git push origin -d 1.17.0-s.1
-git push origin -d 1.17.0-s.2
-git push origin -d 1.17.0-s.3
-git push origin -d 1.17.0-s.4
-git push origin -d 1.17.1-s.0
-git push origin -d 1.17.1-s.1
-git push origin -d 1.17.1-s.2
-git push origin -d 1.17.1-s.3
-git push origin -d 1.17.1-s.4
-git push origin -d 1.17.1-s.5
-git push origin -d 1.17.1-s.6
-git push origin -d 1.17.1-s.7
-git push origin -d 1.18.0-s.0
-git push origin -d 1.18.0-s.1
-git push origin -d 1.18.0-s.2
-git push origin -d 1.18.1-s.0
-git push origin -d 1.18.1-s.1
-git push origin -d 1.18.1-s.2
-git push origin -d 1.18.1-s.3
-git push origin -d 1.18.1-s.4
-git push origin -d 1.18.1-s.5
-git push origin -d 1.18.1-s.6
-git push origin -d 1.18.1-s.7
-git push origin -d 1.18.2-s.0
-git push origin -d 1.18.2-s.1
-git push origin -d 1.18.2-s.2
-git push origin -d 1.18.2-s.3
-git push origin -d 1.18.2-s.4
-git push origin -d 1.18.2-s.5
-git push origin -d 1.18.3-s.0
-git push origin -d 1.18.3-s.1
-git push origin -d 1.18.3-s.2
-git push origin -d 1.18.3-s.3
-git push origin -d 1.18.4-s.0
-git push origin -d 1.18.4-s.1
-git push origin -d 1.18.4-s.2
-git push origin -d 1.18.4-s.3
-git push origin -d 1.18.4-s.4
-git push origin -d 1.18.4-s.5
-git push origin -d 1.18.4-s.6

install/config/config.yml

@@ -22,8 +22,7 @@ server:
         methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]
         allowed_headers: ["X-CSRF-Token", "Content-Type"]
         credentials: false
-    {{if .EnableMaxMind}}maxmind_db_path: "./config/GeoLite2-Country.mmdb"{{end}}
-    {{if .EnableMaxMind}}maxmind_asn_path: "./config/GeoLite2-ASN.mmdb"{{end}}
+    {{if .EnableGeoblocking}}maxmind_db_path: "./config/GeoLite2-Country.mmdb"{{end}}
 {{if .EnableEmail}}
 email:
     smtp_host: "{{.EmailSMTPHost}}"

install/main.go

@@ -54,7 +54,7 @@ type Config struct {
 	InstallGerbil             bool
 	TraefikBouncerKey         string
 	DoCrowdsecInstall         bool
-	EnableMaxMind             bool
+	EnableGeoblocking         bool
 	Secret                    string
 	IsEnterprise              bool
 }
@@ -123,11 +123,11 @@ func main() {
 
 		fmt.Println("\nConfiguration files created successfully!")
 
-		// Download MaxMind Country / ASN database if requested
-		if config.EnableMaxMind {
-			fmt.Println("\n=== Downloading MaxMind Country and ASN Databases ===")
+		// Download MaxMind database if requested
+		if config.EnableGeoblocking {
+			fmt.Println("\n=== Downloading MaxMind Database ===")
 			if err := downloadMaxMindDatabase(); err != nil {
-				fmt.Printf("Error downloading MaxMind databases: %v\n", err)
+				fmt.Printf("Error downloading MaxMind database: %v\n", err)
 				fmt.Println("You can download it manually later if needed.")
 			}
 		}
@@ -188,15 +188,15 @@ func main() {
 		fmt.Println("\n=== MaxMind Database Update ===")
 		if _, err := os.Stat("config/GeoLite2-Country.mmdb"); err == nil {
 			fmt.Println("MaxMind GeoLite2 Country database found.")
-			if readBool("Would you like to update the MaxMind databases (Country and ASN) to the latest version?", false) {
+			if readBool("Would you like to update the MaxMind database to the latest version?", false) {
 				if err := downloadMaxMindDatabase(); err != nil {
 					fmt.Printf("Error updating MaxMind database: %v\n", err)
 					fmt.Println("You can try updating it manually later if needed.")
 				}
 			}
 		} else {
-			fmt.Println("MaxMind GeoLite2 Country and ASN databases not found.")
-			if readBool("Would you like to download the MaxMind GeoLite2 databases for blocking functionality?", false) {
+			fmt.Println("MaxMind GeoLite2 Country database not found.")
+			if readBool("Would you like to download the MaxMind GeoLite2 database for geoblocking functionality?", false) {
 				if err := downloadMaxMindDatabase(); err != nil {
 					fmt.Printf("Error downloading MaxMind database: %v\n", err)
 					fmt.Println("You can try downloading it manually later if needed.")
@@ -204,10 +204,8 @@ func main() {
 				// Now you need to update your config file accordingly to enable geoblocking
 				fmt.Print("Please remember to update your config/config.yml file to enable geoblocking! \n\n")
 				// add   maxmind_db_path: "./config/GeoLite2-Country.mmdb" under server
-				// add   maxmind_asn_path: "./config/GeoLite2-ASN.mmdb" under server
-				fmt.Println("Add the following lines under the 'server' section:")
+				fmt.Println("Add the following line under the 'server' section:")
 				fmt.Println("  maxmind_db_path: \"./config/GeoLite2-Country.mmdb\"")
-				fmt.Println("  maxmind_asn_path: \"./config/GeoLite2-ASN.mmdb\"")
 			}
 		}
 	}
@@ -529,7 +527,7 @@ func collectUserInput() Config {
 	fmt.Println("\n=== Advanced Configuration ===")
 
 	config.EnableIPv6 = readBool("Is your server IPv6 capable?", true)
-	config.EnableMaxMind = readBool("Do you want to download the MaxMind GeoLite2 Country and ADN databases for blocking functionality?", true)
+	config.EnableGeoblocking = readBool("Do you want to download the MaxMind GeoLite2 database for geoblocking functionality?", true)
 
 	if config.DashboardDomain == "" {
 		fmt.Println("Error: Dashboard Domain name is required")
@@ -782,42 +780,29 @@ func checkPortsAvailable(port int) error {
 }
 
 func downloadMaxMindDatabase() error {
-	fmt.Println("Downloading MaxMind GeoLite2 Country and ASN databases...")
+	fmt.Println("Downloading MaxMind GeoLite2 Country database...")
 
-	// Download the GeoLite2 Country databases
+	// Download the GeoLite2 Country database
 	if err := run("curl", "-L", "-o", "GeoLite2-Country.tar.gz",
 		"https://github.com/GitSquared/node-geolite2-redist/raw/refs/heads/master/redist/GeoLite2-Country.tar.gz"); err != nil {
-		return fmt.Errorf("failed to download GeoLite2 Country database: %v", err)
-	}
-	if err := run("curl", "-L", "-o", "GeoLite2-ASN.tar.gz",
-		"https://github.com/GitSquared/node-geolite2-redist/raw/refs/heads/master/redist/GeoLite2-ASN.tar.gz"); err != nil {
-		return fmt.Errorf("failed to download GeoLite2 ASN database: %v", err)
+		return fmt.Errorf("failed to download GeoLite2 database: %v", err)
 	}
 
-	// Extract the Country database
+	// Extract the database
 	if err := run("tar", "-xzf", "GeoLite2-Country.tar.gz"); err != nil {
-		return fmt.Errorf("failed to extract GeoLite2 Country database: %v", err)
-	}
-	if err := run("tar", "-xzf", "GeoLite2-ASN.tar.gz"); err != nil {
-		return fmt.Errorf("failed to extract GeoLite2 ASN database: %v", err)
+		return fmt.Errorf("failed to extract GeoLite2 database: %v", err)
 	}
 
 	// Find the .mmdb file and move it to the config directory
 	if err := run("bash", "-c", "mv GeoLite2-Country_*/GeoLite2-Country.mmdb config/"); err != nil {
-		return fmt.Errorf("failed to move GeoLite2 Country database to config directory: %v", err)
-	}
-	if err := run("bash", "-c", "mv GeoLite2-ASN_*/GeoLite2-ASN.mmdb config/"); err != nil {
-		return fmt.Errorf("failed to move GeoLite2 ASN database to config directory: %v", err)
+		return fmt.Errorf("failed to move GeoLite2 database to config directory: %v", err)
 	}
 
 	// Clean up the downloaded files
-	if err := run("sh", "-c", "rm -rf GeoLite2-Country.tar.gz GeoLite2-Country_*"); err != nil {
-		fmt.Printf("Warning: failed to clean up temporary country files: %v\n", err)
-	}
-	if err := run("sh", "-c", "rm -rf GeoLite2-ASN.tar.gz GeoLite2-ASN_*"); err != nil {
-		fmt.Printf("Warning: failed to clean up temporary ASN files: %v\n", err)
+	if err := run("rm", "-rf", "GeoLite2-Country.tar.gz", "GeoLite2-Country_*"); err != nil {
+		fmt.Printf("Warning: failed to clean up temporary files: %v\n", err)
 	}
 
-	fmt.Println("MaxMind GeoLite2 Country and ASN database downloaded successfully!")
+	fmt.Println("MaxMind GeoLite2 Country database downloaded successfully!")
 	return nil
 }

messages/bg-BG.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Търсене на ресурси...",
     "resourceAdd": "Добавете ресурс",
     "resourceErrorDelte": "Грешка при изтриване на ресурс",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Удостоверяване",
     "protected": "Защита",
     "notProtected": "Не защитен",
     "resourceMessageRemove": "След като се премахне, ресурсът няма повече да бъде достъпен. Всички цели, свързани с ресурса, също ще бъдат премахнати.",
     "resourceQuestionRemove": "Сигурни ли сте, че искате да премахнете ресурса от организацията?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "HTTPS ресурс",
     "resourceHTTPDescription": "Прокси заявки чрез HTTPS, използвайки напълно квалифицирано име на домейн.",
     "resourceRaw": "Суров TCP/UDP ресурс",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Получавайте заявки чрез суров TCP/UDP с използване на портен номер. Изисква се сайтовете да се свързват към отдалечен възел.",
     "resourceCreate": "Създайте ресурс",
     "resourceCreateDescription": "Следвайте стъпките по-долу, за да създадете нов ресурс",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Вижте всички ресурси",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Информация за ресурса",
     "resourceNameDescription": "Това е дисплейното име на ресурса.",
     "siteSelect": "Изберете сайт",
     "siteSearch": "Търсене на сайт",
@@ -254,15 +231,12 @@
     "noCountryFound": "Не е намерена държава.",
     "siteSelectionDescription": "Този сайт ще осигури свързаност до целта.",
     "resourceType": "Тип ресурс",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Определете как да се достъпи ресурсът",
     "resourceHTTPSSettings": "HTTPS настройки",
     "resourceHTTPSSettingsDescription": "Конфигурирайте как ресурсът ще бъде достъпен по HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Тип домейн",
     "subdomain": "Субдомейн",
     "baseDomain": "Базов домейн",
-    "configure": "Configure",
     "subdomnainDescription": "Поддомейнът, където ресурсът ще бъде достъпен.",
     "resourceRawSettings": "TCP/UDP настройки",
     "resourceRawSettingsDescription": "Конфигурирайте как ресурсът ще бъде достъпен чрез TCP/UDP",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "Научете как да конфигурирате TCP/UDP ресурси",
     "resourceBack": "Назад към ресурсите",
     "resourceGoTo": "Отидете към ресурса",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Изтрийте ресурс",
     "resourceDeleteConfirm": "Потвърдете изтриване на ресурс",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Видимост",
     "enabled": "Активиран",
     "disabled": "Деактивиран",
@@ -310,8 +265,6 @@
     "rules": "Правила",
     "resourceSettingDescription": "Конфигурирайте настройките на ресурса",
     "resourceSetting": "Настройки на {resourceName}",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Заобикаляне на Ауторизацията",
     "alwaysDeny": "Блокиране на Достъпа",
     "passToAuth": "Прехвърляне към удостоверяване",
@@ -677,7 +630,7 @@
     "createdAt": "Създаден на",
     "proxyErrorInvalidHeader": "Невалидна стойност за заглавие на хоста. Използвайте формат на име на домейн, или оставете празно поле за да премахнете персонализирано заглавие на хост.",
     "proxyErrorTls": "Невалидно име на TLS сървър. Използвайте формат на име на домейн, или оставете празно за да премахнете името на TLS сървъра.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "Активиране на TLS",
     "proxyEnableSSLDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целите.",
     "target": "Цел",
     "configureTarget": "Конфигуриране на цели",
@@ -794,16 +747,6 @@
     "rulesNoOne": "Няма правила. Добавете правило чрез формуляра.",
     "rulesOrder": "Правилата се оценяват по приоритет в нарастващ ред.",
     "rulesSubmit": "Запазване на правилата",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Грешка при създаване на ресурс",
     "resourceErrorCreateDescription": "Възникна грешка при създаването на ресурса",
     "resourceErrorCreateMessage": "Грешка при създаване на ресурс:",
@@ -867,16 +810,6 @@
     "pincodeAdd": "Добави ПИН код",
     "pincodeRemove": "Премахни ПИН код",
     "resourceAuthMethods": "Методи за автентикация",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Позволете достъп до ресурса чрез допълнителни методи за автентикация",
     "resourceAuthSettingsSave": "Запазено успешно",
     "resourceAuthSettingsSaveDescription": "Настройките за автентикация са запазени успешно",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "Задай ПИН код",
     "resourcePincodeSetupTitleDescription": "Задайте ПИН код, за да защитите този ресурс",
     "resourceRoleDescription": "Администраторите винаги могат да имат достъп до този ресурс.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Контроли за достъп",
     "resourceUsersRolesDescription": "Конфигурирайте кои потребители и роли могат да посещават този ресурс",
     "resourceUsersRolesSubmit": "Запазване на управлението на достъп.",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "Имаше проблем със свързването към {name}. Моля, свържете се с вашия администратор.",
     "idpErrorNotFound": "Не е намерен идентификационен доставчик",
     "inviteInvalid": "Невалидна покана",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "Линкът към поканата е невалиден.",
     "inviteErrorWrongUser": "Поканата не е за този потребител",
     "inviteErrorUserNotExists": "Потребителят не съществува. Моля, създайте акаунт първо.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "Ресурси",
     "sidebarProxyResources": "Публично",
     "sidebarClientResources": "Частно",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Контрол на достъпа",
     "sidebarLogsAndAnalytics": "Дневници и анализи",
     "sidebarTeam": "Екип",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "Сайт {id}",
     "standaloneHcFilterResourceIdFallback": "Ресурс {id}",
     "blueprints": "Чертежи",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Прилагайте декларативни конфигурации и преглеждайте предишни изпълнения",
     "blueprintAdd": "Добави Чертеж",
     "blueprintGoBack": "Виж всички Чертежи",
     "blueprintCreate": "Създай Чертеж",
@@ -1663,17 +1575,7 @@
     "contents": "Съдържание",
     "parsedContents": "Парсирано съдържание (само за четене)",
     "enableDockerSocket": "Активиране на Docker Чернова",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Активиране на Docker Socket маркировка за изтегляне на етикети на чернова. Пътят на гнездото трябва да бъде предоставен на Newt.",
     "viewDockerContainers": "Преглед на Docker контейнери",
     "containersIn": "Контейнери в {siteName}",
     "selectContainerDescription": "Изберете контейнер, който да ползвате като име на хост за целта. Натиснете порт, за да ползвате порт",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "Сертификат",
     "certificateStatusAutoRefreshHint": "Състоянието се опреснява автоматично.",
     "loading": "Зареждане",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Зареждане на анализи",
     "restart": "Рестарт",
     "domains": "Домейни",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "Управлявайте абонамента си за платени самостоятелно хоствани лицензионни ключове",
     "billingCurrentKeys": "Текущи ключове",
     "billingModifyCurrentPlan": "Промяна на текущия план",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Потвърдете повишаването",
     "billingConfirmDowngrade": "Потвърдете понижението",
     "billingConfirmUpgradeDescription": "Предстои ви да повишите плана си. Прегледайте новите ограничения и цени по-долу.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "Времето е в секунди",
     "requireDeviceApproval": "Изискват одобрение на устройства",
     "requireDeviceApprovalDescription": "Потребители с тази роля трябва да имат нови устройства одобрени от администратор преди да могат да се свържат и да имат достъп до ресурси.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "SSH достъп",
     "roleAllowSsh": "Разреши SSH",
     "roleAllowSshAllow": "Разреши",
     "roleAllowSshDisallow": "Забрани",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "Потребителят може да изпълнява само определени команди с sudo.",
     "sshSudo": "Разреши sudo",
     "sshSudoCommands": "Sudo команди",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Списък, разделен със запетаи, с команди, които потребителят е позволено да изпълнява с sudo.",
     "sshCreateHomeDir": "Създай начална директория",
     "sshUnixGroups": "Unix групи",
     "sshUnixGroupsDescription": "Списък, разделен със запетаи, с Unix групи, към които да се добави потребителят на целевия хост.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Метод",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "Активирайте TLS",
     "editInternalResourceDialogEnableSslDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целта.",
     "editInternalResourceDialogDestination": "Дестинация",
     "editInternalResourceDialogDestinationHostDescription": "IP адресът или името на хоста на ресурса в мрежата на сайта.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Метод",
     "createInternalResourceDialogScheme": "Метод",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "Активирайте TLS",
     "createInternalResourceDialogEnableSslDescription": "Активирайте SSL/TLS криптиране за сигурни HTTPS връзки към целта.",
     "createInternalResourceDialogDestination": "Дестинация",
     "createInternalResourceDialogDestinationHostDescription": "IP адресът или името на хоста на ресурса в мрежата на сайта.",
@@ -2364,7 +2233,7 @@
         "description": "По-надежден и по-нисък поддръжка на Самостоятелно-хостван Панголиин сървър с допълнителни екстри",
         "introTitle": "Управлявано Самостоятелно-хостван Панголиин",
         "introDescription": "е опция за внедряване, предназначена за хора, които искат простота и допълнителна надеждност, като същевременно запазят данните си частни и самостоятелно-хоствани.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "С тази опция все още управлявате свой собствен Панголиин възел - вашите тунели, TLS терминатора и трафик остават на вашия сървър. Разликата е, че управлението и мониторингът се обработват чрез нашия облачен панел за контрол, който отключва редица предимства:",
         "benefitSimplerOperations": {
             "title": "По-прости операции",
             "description": "Няма нужда да управлявате свой собствен имейл сървър или да настройвате сложни аларми. Ще получите проверки и предупреждения при прекъсване от самото начало."
@@ -3068,7 +2937,7 @@
     "learnMore": "Научете повече.",
     "backToHome": "Връщане към началната страница.",
     "needToSignInToOrg": "Трябва ли да използвате доставчика на идентичност на организацията си?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Режим на поддръжка.",
     "maintenanceModeDescription": "Показване на страницата за поддръжка на посетители.",
     "maintenanceModeType": "Тип режим на поддръжка.",
     "showMaintenancePage": "Показване на страницата за поддръжка на посетители.",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "Прогнозно завършване:",
     "createInternalResourceDialogDestinationRequired": "Дестинацията е задължителна.",
     "available": "Налично",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Архивирано",
     "noArchivedDevices": "Не са намерени архивирани устройства.",
     "deviceArchived": "Устройството е архивирано.",
@@ -3268,7 +3136,7 @@
     "httpDestNamePlaceholder": "Моята HTTP дестинация",
     "httpDestUrlLabel": "Дестинация URL",
     "httpDestUrlErrorHttpRequired": "URL адресът трябва да използва http или https",
-    "httpDestUrlErrorHttpsRequired": "SSL е необходимо за облачни инсталации",
+    "httpDestUrlErrorHttpsRequired": "HTTPS е необходимо за облачни инсталации",
     "httpDestUrlErrorInvalid": "Въведете валиден URL (напр. https://example.com/webhook)",
     "httpDestAuthTitle": "Удостоверяване",
     "httpDestAuthDescription": "Изберете как заявленията ви се удостоверяват.",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "Ресурсът е деактивиран",
     "memberPortalShowingResources": "Показва {start}-{end} от {total} ресурси",
     "memberPortalPrevious": "Предишен",
-    "memberPortalNext": "Следващ",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Следващ"
 }

messages/cs-CZ.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Prohledat zdroje...",
     "resourceAdd": "Přidat zdroj",
     "resourceErrorDelte": "Chyba při odstraňování zdroje",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Autentifikace",
     "protected": "Chráněno",
     "notProtected": "Nechráněno",
     "resourceMessageRemove": "Jakmile zdroj odstraníte, nebude dostupný. Všechny související služby a cíle budou také odstraněny.",
     "resourceQuestionRemove": "Jste si jisti, že chcete odstranit zdroj z organizace?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "Zdroj HTTPS",
     "resourceHTTPDescription": "Proxy požadavky přes HTTPS pomocí plně kvalifikovaného názvu domény.",
     "resourceRaw": "Surový TCP/UDP zdroj",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Proxy požadavky na syrové TCP/UDP pomocí čísla portu. Vyžaduje připojení stránek ke vzdálenému uzlu.",
     "resourceCreate": "Vytvořit zdroj",
     "resourceCreateDescription": "Postupujte podle níže uvedených kroků, abyste vytvořili a připojili nový zdroj",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Zobrazit všechny zdroje",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Informace o zdroji",
     "resourceNameDescription": "Toto je zobrazovaný název zdroje.",
     "siteSelect": "Vybrat lokalitu",
     "siteSearch": "Hledat lokalitu",
@@ -254,15 +231,12 @@
     "noCountryFound": "Nebyla nalezena žádná země.",
     "siteSelectionDescription": "Tato lokalita poskytne připojení k cíli.",
     "resourceType": "Typ zdroje",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Určete, jak přistupovat ke zdroji",
     "resourceHTTPSSettings": "Nastavení HTTPS",
     "resourceHTTPSSettingsDescription": "Nakonfigurujte, jak bude dokument přístupný přes HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Typ domény",
     "subdomain": "Subdoména",
     "baseDomain": "Základní doména",
-    "configure": "Configure",
     "subdomnainDescription": "Subdoména, kde bude zdroj přístupný.",
     "resourceRawSettings": "Nastavení TCP/UDP",
     "resourceRawSettingsDescription": "Nakonfigurujte, jak bude dokument přístupný přes TCP/UDP",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "Naučte se konfigurovat zdroje TCP/UDP",
     "resourceBack": "Zpět na zdroje",
     "resourceGoTo": "Přejít na dokument",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Odstranit dokument",
     "resourceDeleteConfirm": "Potvrdit odstranění dokumentu",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Viditelnost",
     "enabled": "Povoleno",
     "disabled": "Zakázáno",
@@ -310,8 +265,6 @@
     "rules": "Pravidla",
     "resourceSettingDescription": "Konfigurace nastavení na zdroji",
     "resourceSetting": "Nastavení {resourceName}",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Obejít Auth",
     "alwaysDeny": "Blokovat přístup",
     "passToAuth": "Předat k ověření",
@@ -677,7 +630,7 @@
     "createdAt": "Vytvořeno v",
     "proxyErrorInvalidHeader": "Neplatná hodnota hlavičky hostitele. Použijte formát názvu domény, nebo uložte prázdné pro zrušení vlastního hlavičky hostitele.",
     "proxyErrorTls": "Neplatné jméno TLS serveru. Použijte formát doménového jména nebo uložte prázdné pro odstranění názvu TLS serveru.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "Povolit TLS",
     "proxyEnableSSLDescription": "Povolit šifrování SSL/TLS pro zabezpečená připojení HTTPS k cílům.",
     "target": "Target",
     "configureTarget": "Konfigurace cílů",
@@ -794,16 +747,6 @@
     "rulesNoOne": "Žádná pravidla. Přidejte pravidlo pomocí formuláře.",
     "rulesOrder": "Pravidla jsou hodnocena podle priority vzestupně.",
     "rulesSubmit": "Uložit pravidla",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Chyba při vytváření zdroje",
     "resourceErrorCreateDescription": "Při vytváření zdroje došlo k chybě",
     "resourceErrorCreateMessage": "Chyba při vytváření zdroje:",
@@ -867,16 +810,6 @@
     "pincodeAdd": "Přidat PIN kód",
     "pincodeRemove": "Odstranit PIN kód",
     "resourceAuthMethods": "Metody ověřování",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Povolit přístup ke zdroji pomocí dodatečných metod autorizace",
     "resourceAuthSettingsSave": "Úspěšně uloženo",
     "resourceAuthSettingsSaveDescription": "Nastavení ověřování bylo uloženo",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "Nastavit anonymní kód",
     "resourcePincodeSetupTitleDescription": "Nastavit pincode pro ochranu tohoto zdroje",
     "resourceRoleDescription": "Administrátoři mají vždy přístup k tomuto zdroji.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Kontrola přístupu",
     "resourceUsersRolesDescription": "Nastavení, kteří uživatelé a role mohou navštívit tento zdroj",
     "resourceUsersRolesSubmit": "Uložit přístupové řízení",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "Při připojování k {name}došlo k chybě. Obraťte se na správce.",
     "idpErrorNotFound": "IdP nenalezen",
     "inviteInvalid": "Neplatná pozvánka",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "Odkaz pro pozvání je neplatný.",
     "inviteErrorWrongUser": "Pozvat není pro tohoto uživatele",
     "inviteErrorUserNotExists": "Uživatel neexistuje. Nejprve si vytvořte účet.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "Zdroje",
     "sidebarProxyResources": "Veřejnost",
     "sidebarClientResources": "Soukromé",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Kontrola přístupu",
     "sidebarLogsAndAnalytics": "Logy & Analytika",
     "sidebarTeam": "Tým",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "Stránka {id}",
     "standaloneHcFilterResourceIdFallback": "Zdroj {id}",
     "blueprints": "Plány",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Použít deklarativní konfigurace a zobrazit předchozí běhy",
     "blueprintAdd": "Přidat plán",
     "blueprintGoBack": "Zobrazit všechny plány",
     "blueprintCreate": "Vytvořit plán",
@@ -1663,17 +1575,7 @@
     "contents": "Obsah",
     "parsedContents": "Parsed content (Pouze pro čtení)",
     "enableDockerSocket": "Povolit Docker plán",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Povolte seškrábání štítků na Docker Socket pro popisky plánů. Nová cesta musí být k dispozici.",
     "viewDockerContainers": "Zobrazit kontejnery Dockeru",
     "containersIn": "Kontejnery v {siteName}",
     "selectContainerDescription": "Vyberte jakýkoli kontejner pro použití jako název hostitele pro tento cíl. Klikněte na port pro použití portu.",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "Certifikát",
     "certificateStatusAutoRefreshHint": "Stav se automaticky obnovuje.",
     "loading": "Načítání",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Načítání analytiky",
     "restart": "Restartovat",
     "domains": "Domény",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "Spravujte své předplatné za placené samohostované licenční klíče",
     "billingCurrentKeys": "Aktuální klíče",
     "billingModifyCurrentPlan": "Upravit aktuální tarif",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Potvrdit aktualizaci",
     "billingConfirmDowngrade": "Potvrdit downgrade",
     "billingConfirmUpgradeDescription": "Chystáte se povýšit svůj tarif. Přečtěte si nové limity a ceny.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "Čas je v sekundách",
     "requireDeviceApproval": "Vyžadovat schválení zařízení",
     "requireDeviceApprovalDescription": "Uživatelé s touto rolí potřebují nová zařízení schválená správcem, než se mohou připojit a přistupovat ke zdrojům.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "SSH přístup",
     "roleAllowSsh": "Povolit SSH",
     "roleAllowSshAllow": "Povolit",
     "roleAllowSshDisallow": "Zakázat",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "Uživatel může spustit pouze zadané příkazy s sudo.",
     "sshSudo": "Povolit sudo",
     "sshSudoCommands": "Sudo příkazy",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Čárkami oddělený seznam příkazů, které může uživatel spouštět s sudo.",
     "sshCreateHomeDir": "Vytvořit domovský adresář",
     "sshUnixGroups": "Unixové skupiny",
     "sshUnixGroupsDescription": "Čárkou oddělené skupiny Unix přidají uživatele do cílového hostitele.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Schéma",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "Povolit SSL",
     "editInternalResourceDialogEnableSslDescription": "Povolit šifrování SSL/TLS pro zabezpečené HTTPS připojení k cíli.",
     "editInternalResourceDialogDestination": "Místo určení",
     "editInternalResourceDialogDestinationHostDescription": "IP adresa nebo název hostitele zdroje v síti webu.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Schéma",
     "createInternalResourceDialogScheme": "Schéma",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "Povolit SSL",
     "createInternalResourceDialogEnableSslDescription": "Povolit šifrování SSL/TLS pro zabezpečené HTTPS připojení k cíli.",
     "createInternalResourceDialogDestination": "Místo určení",
     "createInternalResourceDialogDestinationHostDescription": "IP adresa nebo název hostitele zdroje v síti webu.",
@@ -2364,7 +2233,7 @@
         "description": "Spolehlivější a nízko udržovaný Pangolinův server s dalšími zvony a bičkami",
         "introTitle": "Spravovaný Pangolin",
         "introDescription": "je možnost nasazení určená pro lidi, kteří chtějí jednoduchost a spolehlivost při zachování soukromých a samoobslužných dat.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "Pomocí této volby stále provozujete vlastní uzel Pangolin - tunely, SSL terminály a provoz všech pobytů na vašem serveru. Rozdíl spočívá v tom, že řízení a monitorování se řeší prostřednictvím našeho cloudového panelu, který odemkne řadu výhod:",
         "benefitSimplerOperations": {
             "title": "Jednoduchý provoz",
             "description": "Není třeba spouštět svůj vlastní poštovní server nebo nastavit komplexní upozornění. Ze schránky dostanete upozornění na zdravotní kontrolu a výpadek."
@@ -3068,7 +2937,7 @@
     "learnMore": "Zjistit více",
     "backToHome": "Zpět na domovskou stránku",
     "needToSignInToOrg": "Potřebujete použít identitního poskytovatele vaší organizace?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Režim údržby",
     "maintenanceModeDescription": "Zobrazit stránku údržby návštěvníkům",
     "maintenanceModeType": "Typ režimu údržby",
     "showMaintenancePage": "Zobrazit stránku údržby návštěvníkům",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "Odhadované dokončení:",
     "createInternalResourceDialogDestinationRequired": "Cíl je povinný",
     "available": "Dostupné",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Archivováno",
     "noArchivedDevices": "Nebyla nalezena žádná archivovaná zařízení",
     "deviceArchived": "Zařízení archivováno",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "Zdroj je zakázán",
     "memberPortalShowingResources": "Zobrazeny {start}-{end} z {total} zdrojů",
     "memberPortalPrevious": "Předchozí",
-    "memberPortalNext": "Následující",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Následující"
 }

messages/de-DE.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Suche Ressourcen...",
     "resourceAdd": "Ressource hinzufügen",
     "resourceErrorDelte": "Fehler beim Löschen der Ressource",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Authentifizierung",
     "protected": "Geschützt",
     "notProtected": "Nicht geschützt",
     "resourceMessageRemove": "Einmal entfernt, wird die Ressource nicht mehr zugänglich sein. Alle mit der Ressource verbundenen Ziele werden ebenfalls entfernt.",
     "resourceQuestionRemove": "Sind Sie sicher, dass Sie die Ressource aus der Organisation entfernen möchten?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "HTTPS-Ressource",
     "resourceHTTPDescription": "Proxy-Anfragen über HTTPS mit einem voll qualifizierten Domain-Namen.",
     "resourceRaw": "Direkte TCP/UDP Ressource (raw)",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Proxy-Anfragen über rohe TCP/UDP mit Portnummer. Benötigt Sites, um sich mit einem entfernten Knoten zu verbinden.",
     "resourceCreate": "Ressource erstellen",
     "resourceCreateDescription": "Folgen Sie den Schritten unten, um eine neue Ressource zu erstellen",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Alle Ressourcen anzeigen",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Ressourcen-Informationen",
     "resourceNameDescription": "Dies ist der Anzeigename für die Ressource.",
     "siteSelect": "Standort auswählen",
     "siteSearch": "Standorte durchsuchen",
@@ -254,15 +231,12 @@
     "noCountryFound": "Kein Land gefunden.",
     "siteSelectionDescription": "Dieser Standort wird die Verbindung zum Ziel herstellen.",
     "resourceType": "Ressourcentyp",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Legen Sie fest, wie Sie auf die Ressource zugreifen",
     "resourceHTTPSSettings": "HTTPS-Einstellungen",
     "resourceHTTPSSettingsDescription": "Konfigurieren Sie den Zugriff auf die Ressource über HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Domain-Typ",
     "subdomain": "Subdomain",
     "baseDomain": "Basis-Domain",
-    "configure": "Configure",
     "subdomnainDescription": "Die Subdomäne, auf die die Ressource zugegriffen werden soll.",
     "resourceRawSettings": "TCP/UDP Einstellungen",
     "resourceRawSettingsDescription": "Konfigurieren, wie auf die Ressource über TCP/UDP zugegriffen wird",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "Lernen Sie, wie Sie TCP/UDP Ressourcen konfigurieren",
     "resourceBack": "Zurück zu den Ressourcen",
     "resourceGoTo": "Zu Ressource gehen",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Ressource löschen",
     "resourceDeleteConfirm": "Ressource löschen bestätigen",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Sichtbarkeit",
     "enabled": "Aktiviert",
     "disabled": "Deaktiviert",
@@ -310,8 +265,6 @@
     "rules": "Regeln",
     "resourceSettingDescription": "Einstellungen für die Ressource konfigurieren",
     "resourceSetting": "{resourceName} Einstellungen",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Authentifizierung umgehen",
     "alwaysDeny": "Zugriff blockieren",
     "passToAuth": "Weiterleiten zur Authentifizierung",
@@ -677,7 +630,7 @@
     "createdAt": "Erstellt am",
     "proxyErrorInvalidHeader": "Ungültiger benutzerdefinierter Host-Header-Wert. Verwenden Sie das Domain-Namensformat oder speichern Sie leer, um den benutzerdefinierten Host-Header zu deaktivieren.",
     "proxyErrorTls": "Ungültiger TLS-Servername. Verwenden Sie das Domain-Namensformat oder speichern Sie leer, um den TLS-Servernamen zu entfernen.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "TLS aktivieren",
     "proxyEnableSSLDescription": "Aktiviere SSL/TLS-Verschlüsselung für sichere HTTPS-Verbindungen zu den Zielen.",
     "target": "Ziel",
     "configureTarget": "Ziele konfigurieren",
@@ -794,16 +747,6 @@
     "rulesNoOne": "Keine Regeln. Fügen Sie eine Regel über das Formular hinzu.",
     "rulesOrder": "Regeln werden nach aufsteigender Priorität ausgewertet.",
     "rulesSubmit": "Regeln speichern",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Fehler beim Erstellen der Ressource",
     "resourceErrorCreateDescription": "Beim Erstellen der Ressource ist ein Fehler aufgetreten",
     "resourceErrorCreateMessage": "Fehler beim Erstellen der Ressource:",
@@ -867,16 +810,6 @@
     "pincodeAdd": "PIN-Code hinzufügen",
     "pincodeRemove": "PIN-Code entfernen",
     "resourceAuthMethods": "Authentifizierungsmethoden",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Ermöglichen Sie den Zugriff auf die Ressource über zusätzliche Authentifizierungsmethoden",
     "resourceAuthSettingsSave": "Erfolgreich gespeichert",
     "resourceAuthSettingsSaveDescription": "Authentifizierungseinstellungen wurden gespeichert",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "PIN-Code festlegen",
     "resourcePincodeSetupTitleDescription": "Legen Sie einen PIN-Code fest, um diese Ressource zu schützen",
     "resourceRoleDescription": "Administratoren haben immer Zugriff auf diese Ressource.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Zugriffskontrolle",
     "resourceUsersRolesDescription": "Konfigurieren Sie, welche Benutzer und Rollen diese Ressource besuchen können",
     "resourceUsersRolesSubmit": "Zugriffskontrollen speichern",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "Es gab ein Problem bei der Verbindung zu {name}. Bitte kontaktieren Sie Ihren Administrator.",
     "idpErrorNotFound": "IdP nicht gefunden",
     "inviteInvalid": "Ungültige Einladung",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "Der Einladungslink ist ungültig.",
     "inviteErrorWrongUser": "Einladung ist nicht für diesen Benutzer",
     "inviteErrorUserNotExists": "Benutzer existiert nicht. Bitte erstelle zuerst ein Konto.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "Ressourcen",
     "sidebarProxyResources": "Öffentlich",
     "sidebarClientResources": "Privat",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Zugriffskontrolle",
     "sidebarLogsAndAnalytics": "Protokolle & Analysen",
     "sidebarTeam": "Team",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "Standort {id}",
     "standaloneHcFilterResourceIdFallback": "Ressource {id}",
     "blueprints": "Blaupausen",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Deklarative Konfigurationen anwenden und vorherige Abläufe anzeigen",
     "blueprintAdd": "Blueprint hinzufügen",
     "blueprintGoBack": "Alle Blueprints ansehen",
     "blueprintCreate": "Blueprint erstellen",
@@ -1663,17 +1575,7 @@
     "contents": "Inhalt",
     "parsedContents": "Analysierte Inhalte (Nur lesen)",
     "enableDockerSocket": "Docker Blueprint aktivieren",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Aktiviere Docker-Socket-Label-Scraping für Blueprintbeschriftungen. Der Socket-Pfad muss neu angegeben werden.",
     "viewDockerContainers": "Docker Container anzeigen",
     "containersIn": "Container in {siteName}",
     "selectContainerDescription": "Wählen Sie einen Container, der als Hostname für dieses Ziel verwendet werden soll. Klicken Sie auf einen Port, um einen Port zu verwenden.",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "Zertifikat",
     "certificateStatusAutoRefreshHint": "Der Status wird automatisch aktualisiert.",
     "loading": "Laden",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Analytik wird geladen",
     "restart": "Neustart",
     "domains": "Domänen",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "Verwalten Sie Ihr Abonnement für kostenpflichtige selbstgehostete Lizenzschlüssel",
     "billingCurrentKeys": "Aktuelle Tasten",
     "billingModifyCurrentPlan": "Aktuelles Paket ändern",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Upgrade bestätigen",
     "billingConfirmDowngrade": "Downgrade bestätigen",
     "billingConfirmUpgradeDescription": "Sie sind dabei, Ihr Paket zu aktualisieren. Schauen Sie sich die neuen Limits und Preise unten an.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "Zeit ist in Sekunden",
     "requireDeviceApproval": "Gerätegenehmigungen erforderlich",
     "requireDeviceApprovalDescription": "Benutzer mit dieser Rolle benötigen neue Geräte, die von einem Administrator genehmigt wurden, bevor sie sich verbinden und auf Ressourcen zugreifen können.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "SSH-Zugriff",
     "roleAllowSsh": "SSH erlauben",
     "roleAllowSshAllow": "Erlauben",
     "roleAllowSshDisallow": "Nicht zulassen",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "Benutzer kann nur die angegebenen Befehle mit sudo ausführen.",
     "sshSudo": "sudo erlauben",
     "sshSudoCommands": "Sudo-Befehle",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Kommagetrennte Liste von Befehlen, die der Benutzer mit sudo ausführen darf.",
     "sshCreateHomeDir": "Home-Verzeichnis erstellen",
     "sshUnixGroups": "Unix-Gruppen",
     "sshUnixGroupsDescription": "Durch Komma getrennte Unix-Gruppen, um den Benutzer auf dem Zielhost hinzuzufügen.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Schema",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "TLS aktivieren",
     "editInternalResourceDialogEnableSslDescription": "SSL/TLS-Verschlüsselung für sichere HTTPS-Verbindungen zum Ziel aktivieren.",
     "editInternalResourceDialogDestination": "Ziel",
     "editInternalResourceDialogDestinationHostDescription": "Die IP-Adresse oder der Hostname der Ressource im Netzwerk der Website.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Schema",
     "createInternalResourceDialogScheme": "Schema",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "TLS aktivieren",
     "createInternalResourceDialogEnableSslDescription": "SSL/TLS-Verschlüsselung für sichere HTTPS-Verbindungen zum Ziel aktivieren.",
     "createInternalResourceDialogDestination": "Ziel",
     "createInternalResourceDialogDestinationHostDescription": "Die IP-Adresse oder der Hostname der Ressource im Netzwerk der Website.",
@@ -2364,7 +2233,7 @@
         "description": "Zuverlässiger und wartungsarmer Pangolin Server mit zusätzlichen Glocken und Pfeifen",
         "introTitle": "Verwalteter selbstgehosteter Pangolin",
         "introDescription": "ist eine Deployment-Option, die für Personen konzipiert wurde, die Einfachheit und zusätzliche Zuverlässigkeit wünschen, während sie ihre Daten privat und selbstgehostet halten.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "Mit dieser Option haben Sie immer noch Ihren eigenen Pangolin-Knoten – Ihre Tunnel, TLS-Terminierung und Traffic bleiben auf Ihrem Server. Der Unterschied besteht darin, dass Verwaltung und Überwachung über unser Cloud-Dashboard abgewickelt werden, das eine Reihe von Vorteilen freischaltet:",
         "benefitSimplerOperations": {
             "title": "Einfachere Operationen",
             "description": "Sie brauchen keinen eigenen Mail-Server auszuführen oder komplexe Warnungen einzurichten. Sie erhalten Gesundheitschecks und Ausfallwarnungen aus dem Box."
@@ -3068,7 +2937,7 @@
     "learnMore": "Mehr erfahren",
     "backToHome": "Zurück zur Startseite",
     "needToSignInToOrg": "Benötigen Sie den Identitätsanbieter Ihres Unternehmens?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Wartungsmodus",
     "maintenanceModeDescription": "Eine Wartungsseite für Besucher anzeigen",
     "maintenanceModeType": "Art des Wartungsmodus",
     "showMaintenancePage": "Eine Wartungsseite für Besucher anzeigen",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "Geschätzter Abschluss:",
     "createInternalResourceDialogDestinationRequired": "Ziel ist erforderlich",
     "available": "Verfügbar",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Archiviert",
     "noArchivedDevices": "Keine archivierten Geräte gefunden",
     "deviceArchived": "Gerät archiviert",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "Ressource deaktiviert",
     "memberPortalShowingResources": "Zeige {start}-{end} von {total} Ressourcen",
     "memberPortalPrevious": "Vorherige",
-    "memberPortalNext": "Nächste",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Nächste"
 }

messages/en-US.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Search resources...",
     "resourceAdd": "Add Resource",
     "resourceErrorDelte": "Error deleting resource",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Authentication",
     "protected": "Protected",
     "notProtected": "Not Protected",
     "resourceMessageRemove": "Once removed, the resource will no longer be accessible. All targets associated with the resource will also be removed.",
     "resourceQuestionRemove": "Are you sure you want to remove the resource from the organization?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "HTTPS Resource",
     "resourceHTTPDescription": "Proxy requests over HTTPS using a fully qualified domain name.",
     "resourceRaw": "Raw TCP/UDP Resource",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Proxy requests over raw TCP/UDP using a port number. Requires sites to connect to a remote node.",
     "resourceCreate": "Create Resource",
     "resourceCreateDescription": "Follow the steps below to create a new resource",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "See All Resources",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Resource Information",
     "resourceNameDescription": "This is the display name for the resource.",
     "siteSelect": "Select site",
     "siteSearch": "Search site",
@@ -254,15 +231,12 @@
     "noCountryFound": "No country found.",
     "siteSelectionDescription": "This site will provide connectivity to the target.",
     "resourceType": "Resource Type",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Determine how to access the resource",
     "resourceHTTPSSettings": "HTTPS Settings",
     "resourceHTTPSSettingsDescription": "Configure how the resource will be accessed over HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Domain Type",
     "subdomain": "Subdomain",
     "baseDomain": "Base Domain",
-    "configure": "Configure",
     "subdomnainDescription": "The subdomain where the resource will be accessible.",
     "resourceRawSettings": "TCP/UDP Settings",
     "resourceRawSettingsDescription": "Configure how the resource will be accessed over TCP/UDP",
@@ -279,8 +253,6 @@
     "resourceLearnRaw": "Learn how to configure TCP/UDP resources",
     "resourceBack": "Back to Resources",
     "resourceGoTo": "Go to Resource",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Delete Resource",
     "resourceDeleteConfirm": "Confirm Delete Resource",
     "labelDelete": "Delete Label",
@@ -310,8 +282,6 @@
     "rules": "Rules",
     "resourceSettingDescription": "Configure the settings on the resource",
     "resourceSetting": "{resourceName} Settings",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Bypass Auth",
     "alwaysDeny": "Block Access",
     "passToAuth": "Pass to Auth",
@@ -794,16 +764,6 @@
     "rulesNoOne": "No rules. Add a rule using the form.",
     "rulesOrder": "Rules are evaluated by priority in ascending order.",
     "rulesSubmit": "Save Rules",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Error creating resource",
     "resourceErrorCreateDescription": "An error occurred when creating the resource",
     "resourceErrorCreateMessage": "Error creating resource:",
@@ -867,16 +827,6 @@
     "pincodeAdd": "Add PIN Code",
     "pincodeRemove": "Remove PIN Code",
     "resourceAuthMethods": "Authentication Methods",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Allow access to the resource via additional auth methods",
     "resourceAuthSettingsSave": "Saved successfully",
     "resourceAuthSettingsSaveDescription": "Authentication settings have been saved",
@@ -912,12 +862,6 @@
     "resourcePincodeSetupTitle": "Set Pincode",
     "resourcePincodeSetupTitleDescription": "Set a pincode to protect this resource",
     "resourceRoleDescription": "Admins can always access this resource.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Access Controls",
     "resourceUsersRolesDescription": "Configure which users and roles can visit this resource",
     "resourceUsersRolesSubmit": "Save Access Controls",
@@ -1410,6 +1354,29 @@
     "otpAuthBack": "Back to Password",
     "navbar": "Navigation Menu",
     "navbarDescription": "Main navigation menu for the application",
+    "commandPaletteTitle": "Command palette",
+    "commandPaletteDescription": "Search for pages, organizations, resources, and actions",
+    "commandPaletteSearchPlaceholder": "Search pages, resources, actions...",
+    "commandPaletteNoResults": "No results found.",
+    "commandPaletteSearching": "Searching...",
+    "commandPaletteNavigation": "Navigation",
+    "commandPaletteOrganizations": "Organizations",
+    "commandPaletteSites": "Sites",
+    "commandPaletteResources": "Resources",
+    "commandPaletteUsers": "Users",
+    "commandPaletteClients": "Machine clients",
+    "commandPaletteActions": "Actions",
+    "commandPaletteCreateSite": "Create site",
+    "commandPaletteCreateProxyResource": "Create public resource",
+    "commandPaletteCreateUser": "Create user",
+    "commandPaletteCreateApiKey": "Create API key",
+    "commandPaletteCreateMachineClient": "Create machine client",
+    "commandPaletteCreateAlertRule": "Create alert rule",
+    "commandPaletteCreateIdentityProvider": "Create identity provider",
+    "commandPaletteToggleTheme": "Toggle theme",
+    "commandPaletteChooseOrganization": "Choose organization",
+    "commandPaletteShortcutMac": "⌘K",
+    "commandPaletteShortcutWindows": "Ctrl K",
     "navbarDocsLink": "Documentation",
     "otpErrorEnable": "Unable to enable 2FA",
     "otpErrorEnableDescription": "An error occurred while enabling 2FA",
@@ -1459,8 +1426,6 @@
     "sidebarResources": "Resources",
     "sidebarProxyResources": "Public",
     "sidebarClientResources": "Private",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Access Control",
     "sidebarLogsAndAnalytics": "Logs & Analytics",
     "sidebarTeam": "Team",
@@ -1644,8 +1609,7 @@
     "standaloneHcFilterSiteIdFallback": "Site {id}",
     "standaloneHcFilterResourceIdFallback": "Resource {id}",
     "blueprints": "Blueprints",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Apply declarative configurations and view previous runs",
     "blueprintAdd": "Add Blueprint",
     "blueprintGoBack": "See all Blueprints",
     "blueprintCreate": "Create Blueprint",
@@ -1663,17 +1627,7 @@
     "contents": "Contents",
     "parsedContents": "Parsed Contents (Read Only)",
     "enableDockerSocket": "Enable Docker Blueprint",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to Newt. Read about how this works in <docsLink>the documentation</docsLink>.",
     "viewDockerContainers": "View Docker Containers",
     "containersIn": "Containers in {siteName}",
     "selectContainerDescription": "Select any container to use as a hostname for this target. Click a port to use a port.",
@@ -1945,7 +1899,6 @@
     "billingManageLicenseSubscription": "Manage your subscription for paid self-hosted license keys",
     "billingCurrentKeys": "Current Keys",
     "billingModifyCurrentPlan": "Modify Current Plan",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Confirm Upgrade",
     "billingConfirmDowngrade": "Confirm Downgrade",
     "billingConfirmUpgradeDescription": "You are about to upgrade your plan. Review the new limits and pricing below.",
@@ -2043,36 +1996,7 @@
     "timeIsInSeconds": "Time is in seconds",
     "requireDeviceApproval": "Require Device Approvals",
     "requireDeviceApprovalDescription": "Users with this role need new devices approved by an admin before they can connect and access resources.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "SSH Access",
     "roleAllowSsh": "Allow SSH",
     "roleAllowSshAllow": "Allow",
     "roleAllowSshDisallow": "Disallow",
@@ -2086,7 +2010,7 @@
     "sshSudoModeCommandsDescription": "User can run only the specified commands with sudo.",
     "sshSudo": "Allow sudo",
     "sshSudoCommands": "Sudo Commands",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo.",
     "sshCreateHomeDir": "Create Home Directory",
     "sshUnixGroups": "Unix Groups",
     "sshUnixGroupsDescription": "Comma separated Unix groups to add the user to on the target host.",
@@ -2178,7 +2102,6 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Scheme",
     "editInternalResourceDialogEnableSsl": "Enable TLS",
     "editInternalResourceDialogEnableSslDescription": "Enable SSL/TLS encryption for secure HTTPS connections to the destination.",
@@ -2228,7 +2151,6 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Scheme",
     "createInternalResourceDialogScheme": "Scheme",
     "createInternalResourceDialogEnableSsl": "Enable TLS",
@@ -3068,7 +2990,7 @@
     "learnMore": "Learn more",
     "backToHome": "Go back to home",
     "needToSignInToOrg": "Need to use your organization's identity provider?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Maintenance Mode",
     "maintenanceModeDescription": "Display a maintenance page to visitors",
     "maintenanceModeType": "Maintenance Mode Type",
     "showMaintenancePage": "Show a maintenance page to visitors",
@@ -3098,7 +3020,6 @@
     "maintenanceScreenEstimatedCompletion": "Estimated Completion:",
     "createInternalResourceDialogDestinationRequired": "Destination is required",
     "available": "Available",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Archived",
     "noArchivedDevices": "No archived devices found",
     "deviceArchived": "Device archived",
@@ -3428,6 +3349,5 @@
     "memberPortalResourceDisabled": "Resource Disabled",
     "memberPortalShowingResources": "Showing {start}-{end} of {total} resources",
     "memberPortalPrevious": "Previous",
-    "memberPortalNext": "Next",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Next"
 }

messages/es-ES.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Buscar recursos...",
     "resourceAdd": "Añadir Recurso",
     "resourceErrorDelte": "Error al eliminar el recurso",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Autenticación",
     "protected": "Protegido",
     "notProtected": "No protegido",
     "resourceMessageRemove": "Una vez eliminado, el recurso ya no será accesible. Todos los objetivos asociados con el recurso también serán eliminados.",
     "resourceQuestionRemove": "¿Está seguro que desea eliminar el recurso de la organización?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "HTTPS Recurso",
     "resourceHTTPDescription": "Proxy proporciona solicitudes sobre HTTPS usando un nombre de dominio completamente calificado.",
     "resourceRaw": "Recurso TCP/UDP sin procesar",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Las peticiones de proxy sobre TCP/UDP crudas usando un número de puerto. Requiere que los sitios se conecten a un nodo remoto.",
     "resourceCreate": "Crear Recurso",
     "resourceCreateDescription": "Siga los siguientes pasos para crear un nuevo recurso",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Ver todos los recursos",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Información del recurso",
     "resourceNameDescription": "Este es el nombre para mostrar el recurso.",
     "siteSelect": "Seleccionar sitio",
     "siteSearch": "Buscar sitio",
@@ -254,15 +231,12 @@
     "noCountryFound": "Ningún país encontrado.",
     "siteSelectionDescription": "Este sitio proporcionará conectividad al objetivo.",
     "resourceType": "Tipo de recurso",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Determina cómo acceder al recurso",
     "resourceHTTPSSettings": "Configuración HTTPS",
     "resourceHTTPSSettingsDescription": "Configurar cómo se accederá al recurso a través de HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Tipo de dominio",
     "subdomain": "Subdominio",
     "baseDomain": "Dominio base",
-    "configure": "Configure",
     "subdomnainDescription": "El subdominio al que el recurso será accesible.",
     "resourceRawSettings": "Configuración TCP/UDP",
     "resourceRawSettingsDescription": "Configurar cómo se accederá al recurso a través de TCP/UDP",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "Aprende cómo configurar los recursos TCP/UDP",
     "resourceBack": "Volver a Recursos",
     "resourceGoTo": "Ir a Recurso",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Eliminar Recurso",
     "resourceDeleteConfirm": "Confirmar Borrar Recurso",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Visibilidad",
     "enabled": "Activado",
     "disabled": "Deshabilitado",
@@ -310,8 +265,6 @@
     "rules": "Reglas",
     "resourceSettingDescription": "Configurar la configuración del recurso",
     "resourceSetting": "Ajustes {resourceName}",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Autorización Bypass",
     "alwaysDeny": "Bloquear acceso",
     "passToAuth": "Pasar a Autenticación",
@@ -677,7 +630,7 @@
     "createdAt": "Creado el",
     "proxyErrorInvalidHeader": "Valor de cabecera de host personalizado no válido. Utilice el formato de nombre de dominio, o guarde en blanco para desestablecer cabecera de host personalizada.",
     "proxyErrorTls": "Nombre de servidor TLS inválido. Utilice el formato de nombre de dominio o guarde en blanco para eliminar el nombre de servidor TLS.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "Activar TLS",
     "proxyEnableSSLDescription": "Habilita el cifrado SSL/TLS para conexiones seguras HTTPS a los objetivos.",
     "target": "Target",
     "configureTarget": "Configurar objetivos",
@@ -794,16 +747,6 @@
     "rulesNoOne": "No hay reglas. Agregue una regla usando el formulario.",
     "rulesOrder": "Las reglas son evaluadas por prioridad en orden ascendente.",
     "rulesSubmit": "Guardar Reglas",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Error al crear recurso",
     "resourceErrorCreateDescription": "Se ha producido un error al crear el recurso",
     "resourceErrorCreateMessage": "Error al crear el recurso:",
@@ -867,16 +810,6 @@
     "pincodeAdd": "Añadir código PIN",
     "pincodeRemove": "Eliminar código PIN",
     "resourceAuthMethods": "Métodos de autenticación",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Permitir el acceso al recurso a través de métodos de autenticación adicionales",
     "resourceAuthSettingsSave": "Guardado correctamente",
     "resourceAuthSettingsSaveDescription": "Se han guardado los ajustes de autenticación",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "Definir Pincode",
     "resourcePincodeSetupTitleDescription": "Establecer un pincode para proteger este recurso",
     "resourceRoleDescription": "Los administradores siempre pueden acceder a este recurso.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Controles de acceso",
     "resourceUsersRolesDescription": "Configurar qué usuarios y roles pueden visitar este recurso",
     "resourceUsersRolesSubmit": "Guardar controles de acceso",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "Hubo un problema al conectar con {name}. Por favor, póngase en contacto con su administrador.",
     "idpErrorNotFound": "IdP no encontrado",
     "inviteInvalid": "Invitación inválida",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "El enlace de invitación no es válido.",
     "inviteErrorWrongUser": "La invitación no es para este usuario",
     "inviteErrorUserNotExists": "El usuario no existe. Por favor, cree una cuenta primero.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "Recursos",
     "sidebarProxyResources": "Público",
     "sidebarClientResources": "Privado",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Control de acceso",
     "sidebarLogsAndAnalytics": "Registros y análisis",
     "sidebarTeam": "Equipo",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "Sitio {id}",
     "standaloneHcFilterResourceIdFallback": "Recurso {id}",
     "blueprints": "Planos",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Aplicar configuraciones declarativas y ver ejecuciones anteriores",
     "blueprintAdd": "Añadir plano",
     "blueprintGoBack": "Ver todos los Planos",
     "blueprintCreate": "Crear Plano",
@@ -1663,17 +1575,7 @@
     "contents": "Contenido",
     "parsedContents": "Contenido analizado (Sólo lectura)",
     "enableDockerSocket": "Habilitar Plano Docker",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Activar el raspado de etiquetas de Socket Docker para etiquetas de planos. La ruta del Socket debe proporcionarse a Newt.",
     "viewDockerContainers": "Ver contenedores Docker",
     "containersIn": "Contenedores en {siteName}",
     "selectContainerDescription": "Seleccione cualquier contenedor para usar como nombre de host para este objetivo. Haga clic en un puerto para usar un puerto.",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "Certificado",
     "certificateStatusAutoRefreshHint": "El estado se actualiza automáticamente.",
     "loading": "Cargando",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Cargando analíticas",
     "restart": "Reiniciar",
     "domains": "Dominios",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "Administra tu suscripción para las claves de licencia autoalojadas pagadas",
     "billingCurrentKeys": "Claves actuales",
     "billingModifyCurrentPlan": "Modificar plan actual",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Confirmar actualización",
     "billingConfirmDowngrade": "Confirmar descenso",
     "billingConfirmUpgradeDescription": "Estás a punto de actualizar tu plan. Revisa los nuevos límites y precios a continuación.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "El tiempo está en segundos",
     "requireDeviceApproval": "Requiere aprobaciones del dispositivo",
     "requireDeviceApprovalDescription": "Los usuarios con este rol necesitan nuevos dispositivos aprobados por un administrador antes de poder conectarse y acceder a los recursos.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "Acceso a SSH",
     "roleAllowSsh": "Permitir SSH",
     "roleAllowSshAllow": "Permitir",
     "roleAllowSshDisallow": "Rechazar",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "El usuario sólo puede ejecutar los comandos especificados con sudo.",
     "sshSudo": "Permitir sudo",
     "sshSudoCommands": "Comandos Sudo",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Lista separada por comas de comandos que el usuario puede ejecutar con sudo.",
     "sshCreateHomeDir": "Crear directorio principal",
     "sshUnixGroups": "Grupos Unix",
     "sshUnixGroupsDescription": "Grupos Unix separados por comas para agregar el usuario en el host de destino.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Esquema",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "Activar TLS",
     "editInternalResourceDialogEnableSslDescription": "Habilitar cifrado SSL/TLS para conexiones HTTPS seguras al destino.",
     "editInternalResourceDialogDestination": "Destino",
     "editInternalResourceDialogDestinationHostDescription": "La dirección IP o nombre de host del recurso en la red del sitio.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Esquema",
     "createInternalResourceDialogScheme": "Esquema",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "Activar TLS",
     "createInternalResourceDialogEnableSslDescription": "Habilitar cifrado SSL/TLS para conexiones HTTPS seguras al destino.",
     "createInternalResourceDialogDestination": "Destino",
     "createInternalResourceDialogDestinationHostDescription": "La dirección IP o nombre de host del recurso en la red del sitio.",
@@ -2364,7 +2233,7 @@
         "description": "Servidor Pangolin autoalojado más fiable y de bajo mantenimiento con campanas y silbidos extra",
         "introTitle": "Pangolin autogestionado",
         "introDescription": "es una opción de despliegue diseñada para personas que quieren simplicidad y fiabilidad extra mientras mantienen sus datos privados y autoalojados.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "Con esta opción, todavía ejecuta su propio nodo Pangolin, sus túneles, terminación TLS y tráfico permanecen en su servidor. La diferencia es que la gestión y el control se gestionan a través de nuestro panel de control en la nube, que desbloquea una serie de ventajas:",
         "benefitSimplerOperations": {
             "title": "Operaciones simples",
             "description": "No necesitas ejecutar tu propio servidor de correo o configurar alertas complejas. Recibirás cheques de salud y alertas de tiempo de inactividad."
@@ -3068,7 +2937,7 @@
     "learnMore": "Más información",
     "backToHome": "Volver a inicio",
     "needToSignInToOrg": "¿Necesita usar el proveedor de identidad de su organización?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Modo de mantenimiento",
     "maintenanceModeDescription": "Muestra una página de mantenimiento a los visitantes",
     "maintenanceModeType": "Tipo de modo de mantenimiento",
     "showMaintenancePage": "Mostrar página de mantenimiento a los visitantes",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "Estimado completado:",
     "createInternalResourceDialogDestinationRequired": "Se requiere destino",
     "available": "Disponible",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Archivado",
     "noArchivedDevices": "No se encontraron dispositivos archivados",
     "deviceArchived": "Dispositivo archivado",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "Recurso Deshabilitado",
     "memberPortalShowingResources": "Mostrando {start}-{end} de {total} recursos",
     "memberPortalPrevious": "Anterior",
-    "memberPortalNext": "Siguiente",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Siguiente"
 }

messages/fr-FR.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Chercher des ressources...",
     "resourceAdd": "Ajouter une ressource",
     "resourceErrorDelte": "Erreur lors de la de suppression de la ressource",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Authentification",
     "protected": "Protégé",
     "notProtected": "Non Protégé",
     "resourceMessageRemove": "Une fois supprimée, la ressource ne sera plus accessible. Toutes les cibles associées à la ressource seront également supprimées.",
     "resourceQuestionRemove": "Êtes-vous sûr de vouloir retirer la ressource de l'organisation ?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "Ressource HTTPS",
     "resourceHTTPDescription": "Proxy les demandes sur HTTPS en utilisant un nom de domaine entièrement qualifié.",
     "resourceRaw": "Ressource TCP/UDP brute",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Requêtes de proxy sur TCP/UDP brute en utilisant un numéro de port. Nécessite des sites pour se connecter à un noeud distant.",
     "resourceCreate": "Créer une ressource",
     "resourceCreateDescription": "Suivez les étapes ci-dessous pour créer une nouvelle ressource",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Voir toutes les ressources",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Informations sur la ressource",
     "resourceNameDescription": "Ceci est le nom d'affichage de la ressource.",
     "siteSelect": "Sélectionnez un nœud",
     "siteSearch": "Chercher un nœud",
@@ -254,15 +231,12 @@
     "noCountryFound": "Aucun pays trouvé.",
     "siteSelectionDescription": "Ce site fournira la connectivité à la cible.",
     "resourceType": "Type de ressource",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Déterminer comment accéder à la ressource",
     "resourceHTTPSSettings": "Paramètres HTTPS",
     "resourceHTTPSSettingsDescription": "Configurer comment la ressource sera accédée via HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Type de domaine",
     "subdomain": "Sous-domaine",
     "baseDomain": "Domaine racine",
-    "configure": "Configure",
     "subdomnainDescription": "Le sous-domaine où la ressource sera accessible.",
     "resourceRawSettings": "Paramètres TCP/UDP",
     "resourceRawSettingsDescription": "Configurer comment la ressource sera accédée via TCP/UDP",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "Apprenez à configurer les ressources TCP/UDP",
     "resourceBack": "Retour aux ressources",
     "resourceGoTo": "Aller à la ressource",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Supprimer la ressource",
     "resourceDeleteConfirm": "Confirmer la suppression de la ressource",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Visibilité",
     "enabled": "Activé",
     "disabled": "Désactivé",
@@ -310,8 +265,6 @@
     "rules": "Règles",
     "resourceSettingDescription": "Configurer les paramètres de la ressource",
     "resourceSetting": "Réglages de {resourceName}",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Outrepasser l'authentification",
     "alwaysDeny": "Bloquer l'accès",
     "passToAuth": "Passer à l'authentification",
@@ -677,7 +630,7 @@
     "createdAt": "Créé le",
     "proxyErrorInvalidHeader": "Valeur d'en-tête Host personnalisée invalide. Utilisez le format de nom de domaine, ou laissez vide pour désactiver l'en-tête Host personnalisé.",
     "proxyErrorTls": "Nom de serveur TLS invalide. Utilisez le format de nom de domaine, ou laissez vide pour supprimer le nom de serveur TLS.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "Activer TLS",
     "proxyEnableSSLDescription": "Activer le cryptage SSL/TLS pour des connexions HTTPS sécurisées vers les cibles.",
     "target": "Cible",
     "configureTarget": "Configurer les cibles",
@@ -794,16 +747,6 @@
     "rulesNoOne": "Aucune règle. Ajoutez une règle en utilisant le formulaire.",
     "rulesOrder": "Les règles sont évaluées par priorité dans l'ordre croissant.",
     "rulesSubmit": "Enregistrer les règles",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Erreur lors de la création de la ressource",
     "resourceErrorCreateDescription": "Une erreur s'est produite lors de la création de la ressource",
     "resourceErrorCreateMessage": "Erreur lors de la création de la ressource :",
@@ -867,16 +810,6 @@
     "pincodeAdd": "Ajouter un code PIN",
     "pincodeRemove": "Supprimer le code PIN",
     "resourceAuthMethods": "Méthodes d'authentification",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Permettre l'accès à la ressource via des méthodes d'authentification supplémentaires",
     "resourceAuthSettingsSave": "Enregistré avec succès",
     "resourceAuthSettingsSaveDescription": "Les paramètres d'authentification ont été enregistrés",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "Définir le code PIN",
     "resourcePincodeSetupTitleDescription": "Définir un code PIN pour protéger cette ressource",
     "resourceRoleDescription": "Les administrateurs peuvent toujours accéder à cette ressource.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Contrôles d'accès",
     "resourceUsersRolesDescription": "Configurer quels utilisateurs et rôles peuvent visiter cette ressource",
     "resourceUsersRolesSubmit": "Enregistrer les contrôles d'accès",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "Un problème est survenu lors de la connexion à {name}. Veuillez contacter votre administrateur.",
     "idpErrorNotFound": "IdP introuvable",
     "inviteInvalid": "Invitation invalide",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "Le lien d'invitation n'est pas valide.",
     "inviteErrorWrongUser": "L'invitation n'est pas pour cet utilisateur",
     "inviteErrorUserNotExists": "L'utilisateur n'existe pas. Veuillez d'abord créer un compte.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "Ressource",
     "sidebarProxyResources": "Publique",
     "sidebarClientResources": "Privé",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Contrôle d'accès",
     "sidebarLogsAndAnalytics": "Journaux & Analytiques",
     "sidebarTeam": "Equipe",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "Site {id}",
     "standaloneHcFilterResourceIdFallback": "Ressource {id}",
     "blueprints": "Configs",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Appliquer les configurations déclaratives et afficher les exécutions précédentes",
     "blueprintAdd": "Ajouter une Config",
     "blueprintGoBack": "Voir toutes les Configs",
     "blueprintCreate": "Créer une Config",
@@ -1663,17 +1575,7 @@
     "contents": "Contenus",
     "parsedContents": "Contenu analysé (lecture seule)",
     "enableDockerSocket": "Activer la Config Docker",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Activer le ramassage d'étiquettes de socket Docker pour les étiquettes de plan. Le chemin de socket doit être fourni à Newt.",
     "viewDockerContainers": "Voir les conteneurs Docker",
     "containersIn": "Conteneurs en {siteName}",
     "selectContainerDescription": "Sélectionnez n'importe quel conteneur à utiliser comme nom d'hôte pour cette cible. Cliquez sur un port pour utiliser un port.",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "Certificat",
     "certificateStatusAutoRefreshHint": "L'état se rafraîchit automatiquement.",
     "loading": "Chargement",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Chargement de l'analyse",
     "restart": "Redémarrer",
     "domains": "Domaines",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "Gérer votre abonnement pour les clés de licence auto-hébergées payantes",
     "billingCurrentKeys": "Clés actuelles",
     "billingModifyCurrentPlan": "Modifier le plan actuel",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Confirmer la mise à niveau",
     "billingConfirmDowngrade": "Confirmer la rétrogradation",
     "billingConfirmUpgradeDescription": "Vous êtes sur le point de mettre à niveau votre offre. Examinez les nouvelles limites et les nouveaux prix ci-dessous.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "Le temps est exprimé en secondes",
     "requireDeviceApproval": "Exiger les autorisations de l'appareil",
     "requireDeviceApprovalDescription": "Les utilisateurs ayant ce rôle ont besoin de nouveaux périphériques approuvés par un administrateur avant de pouvoir se connecter et accéder aux ressources.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "Accès SSH",
     "roleAllowSsh": "Autoriser SSH",
     "roleAllowSshAllow": "Autoriser",
     "roleAllowSshDisallow": "Interdire",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "L'utilisateur ne peut exécuter que les commandes spécifiées avec sudo.",
     "sshSudo": "Autoriser sudo",
     "sshSudoCommands": "Commandes Sudo",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Liste des commandes séparées par des virgules que l'utilisateur est autorisé à exécuter avec sudo.",
     "sshCreateHomeDir": "Créer un répertoire personnel",
     "sshUnixGroups": "Groupes Unix",
     "sshUnixGroupsDescription": "Groupes Unix séparés par des virgules pour ajouter l'utilisateur sur l'hôte cible.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Méthode HTTP",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "Activer TLS",
     "editInternalResourceDialogEnableSslDescription": "Activer le cryptage SSL/TLS pour des connexions HTTPS sécurisées vers la destination.",
     "editInternalResourceDialogDestination": "Destination",
     "editInternalResourceDialogDestinationHostDescription": "L'adresse IP ou le nom d'hôte de la ressource sur le réseau du site.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Méthode HTTP",
     "createInternalResourceDialogScheme": "Méthode HTTP",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "Activer TLS",
     "createInternalResourceDialogEnableSslDescription": "Activer le cryptage SSL/TLS pour des connexions HTTPS sécurisées vers la destination.",
     "createInternalResourceDialogDestination": "Destination",
     "createInternalResourceDialogDestinationHostDescription": "L'adresse IP ou le nom d'hôte de la ressource sur le réseau du site.",
@@ -2364,7 +2233,7 @@
         "description": "Serveur Pangolin auto-hébergé avec des cloches et des sifflets supplémentaires",
         "introTitle": "Pangolin auto-hébergé géré",
         "introDescription": "est une option de déploiement conçue pour les personnes qui veulent de la simplicité et de la fiabilité tout en gardant leurs données privées et auto-hébergées.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "Avec cette option, vous exécutez toujours votre propre nœud Pangolin - vos tunnels, la terminaison TLS et le trafic restent sur votre serveur. La différence est que la gestion et la surveillance sont gérées via notre tableau de bord du cloud, qui déverrouille un certain nombre d'avantages :",
         "benefitSimplerOperations": {
             "title": "Opérations plus simples",
             "description": "Pas besoin de faire tourner votre propre serveur de messagerie ou de configurer des alertes complexes. Vous obtiendrez des contrôles de santé et des alertes de temps d'arrêt par la suite."
@@ -3068,7 +2937,7 @@
     "learnMore": "En savoir plus",
     "backToHome": "Retour à l'accueil",
     "needToSignInToOrg": "Besoin d'utiliser le fournisseur d'identité de votre organisation ?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Mode de maintenance",
     "maintenanceModeDescription": "Afficher une page de maintenance aux visiteurs",
     "maintenanceModeType": "Type de mode de maintenance",
     "showMaintenancePage": "Afficher une page de maintenance aux visiteurs",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "Achèvement estimé :",
     "createInternalResourceDialogDestinationRequired": "La destination est requise",
     "available": "Disponible",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Archivé",
     "noArchivedDevices": "Aucun périphérique archivé trouvé",
     "deviceArchived": "Appareil archivé",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "Ressource désactivée",
     "memberPortalShowingResources": "Affichage de {start}-{end} sur {total} ressources",
     "memberPortalPrevious": "Précédent",
-    "memberPortalNext": "Suivant",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Suivant"
 }

messages/it-IT.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Cerca risorse...",
     "resourceAdd": "Aggiungi Risorsa",
     "resourceErrorDelte": "Errore nell'eliminare la risorsa",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Autenticazione",
     "protected": "Protetto",
     "notProtected": "Non Protetto",
     "resourceMessageRemove": "Una volta rimossa la risorsa non sarà più accessibile. Tutti gli oggetti target associati alla risorsa saranno rimossi.",
     "resourceQuestionRemove": "Sei sicuro di voler rimuovere la risorsa dall'organizzazione?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "Risorsa HTTPS",
     "resourceHTTPDescription": "Richieste proxy su HTTPS usando un nome di dominio completo.",
     "resourceRaw": "Risorsa Raw TCP/UDP",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Richiesta proxy su TCP/UDP grezzo utilizzando un numero di porta. Richiede siti per connettersi a un nodo remoto.",
     "resourceCreate": "Crea Risorsa",
     "resourceCreateDescription": "Segui i passaggi seguenti per creare una nuova risorsa",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Vedi Tutte Le Risorse",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Informazioni Risorsa",
     "resourceNameDescription": "Questo è il nome visualizzato per la risorsa.",
     "siteSelect": "Seleziona sito",
     "siteSearch": "Cerca sito",
@@ -254,15 +231,12 @@
     "noCountryFound": "Nessun paese trovato.",
     "siteSelectionDescription": "Questo sito fornirà connettività all'oggetto target.",
     "resourceType": "Tipo Di Risorsa",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Determinare come accedere alla risorsa",
     "resourceHTTPSSettings": "Impostazioni HTTPS",
     "resourceHTTPSSettingsDescription": "Configura come sarà possibile accedere alla risorsa su HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Tipo Di Dominio",
     "subdomain": "Sottodominio",
     "baseDomain": "Dominio Base",
-    "configure": "Configure",
     "subdomnainDescription": "Il sottodominio in cui la risorsa sarà accessibile.",
     "resourceRawSettings": "Impostazioni TCP/UDP",
     "resourceRawSettingsDescription": "Configura come accedere alla risorsa tramite TCP/UDP",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "Scopri come configurare le risorse TCP/UDP",
     "resourceBack": "Torna alle risorse",
     "resourceGoTo": "Vai alla Risorsa",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Elimina Risorsa",
     "resourceDeleteConfirm": "Conferma Eliminazione Risorsa",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Visibilità",
     "enabled": "Abilitato",
     "disabled": "Disabilitato",
@@ -310,8 +265,6 @@
     "rules": "Regole",
     "resourceSettingDescription": "Configura le impostazioni sulla risorsa",
     "resourceSetting": "Impostazioni {resourceName}",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Bypass Autenticazione",
     "alwaysDeny": "Blocca Accesso",
     "passToAuth": "Passa all'autenticazione",
@@ -677,7 +630,7 @@
     "createdAt": "Creato Il",
     "proxyErrorInvalidHeader": "Valore dell'intestazione Host personalizzata non valido. Usa il formato nome dominio o salva vuoto per rimuovere l'intestazione Host personalizzata.",
     "proxyErrorTls": "Nome Server TLS non valido. Usa il formato nome dominio o salva vuoto per rimuovere il Nome Server TLS.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "Abilita TLS",
     "proxyEnableSSLDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alle risorse interne target.",
     "target": "Target",
     "configureTarget": "Configura Risorse Interne",
@@ -794,16 +747,6 @@
     "rulesNoOne": "Nessuna regola. Aggiungi una regola usando il modulo.",
     "rulesOrder": "Le regole sono valutate per priorità in ordine crescente.",
     "rulesSubmit": "Salva Regole",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Errore nella creazione della risorsa",
     "resourceErrorCreateDescription": "Si è verificato un errore durante la creazione della risorsa",
     "resourceErrorCreateMessage": "Errore nella creazione della risorsa:",
@@ -867,16 +810,6 @@
     "pincodeAdd": "Aggiungi Codice PIN",
     "pincodeRemove": "Rimuovi Codice PIN",
     "resourceAuthMethods": "Metodi di Autenticazione",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Consenti l'accesso alla risorsa tramite metodi di autenticazione aggiuntivi",
     "resourceAuthSettingsSave": "Salvato con successo",
     "resourceAuthSettingsSaveDescription": "Le impostazioni di autenticazione sono state salvate",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "Imposta Codice PIN",
     "resourcePincodeSetupTitleDescription": "Imposta un codice PIN per proteggere questa risorsa",
     "resourceRoleDescription": "Gli amministratori possono sempre accedere a questa risorsa.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Controlli di Accesso",
     "resourceUsersRolesDescription": "Configura quali utenti e ruoli possono visitare questa risorsa",
     "resourceUsersRolesSubmit": "Salva Controlli di Accesso",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "Si è verificato un problema durante la connessione a {name}. Contatta il tuo amministratore.",
     "idpErrorNotFound": "IdP non trovato",
     "inviteInvalid": "Invito Non Valido",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "Il link di invito non è valido.",
     "inviteErrorWrongUser": "L'invito non è per questo utente",
     "inviteErrorUserNotExists": "L'utente non esiste. Si prega di creare prima un account.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "Risorse",
     "sidebarProxyResources": "Pubblico",
     "sidebarClientResources": "Privato",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Controllo Accesso",
     "sidebarLogsAndAnalytics": "Registri E Analisi",
     "sidebarTeam": "Squadra",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "Sito {id}",
     "standaloneHcFilterResourceIdFallback": "Risorsa {id}",
     "blueprints": "Progetti",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Applica le configurazioni dichiarative e visualizza le partite precedenti",
     "blueprintAdd": "Aggiungi Progetto",
     "blueprintGoBack": "Vedi tutti i progetti",
     "blueprintCreate": "Crea Progetto",
@@ -1663,17 +1575,7 @@
     "contents": "Contenuti",
     "parsedContents": "Sommario Analizzato (Solo Lettura)",
     "enableDockerSocket": "Abilita Progetto Docker",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Abilita la raschiatura dell'etichetta Docker Socket per le etichette dei progetti. Il percorso del socket deve essere fornito a Newt.",
     "viewDockerContainers": "Visualizza Contenitori Docker",
     "containersIn": "Contenitori in {siteName}",
     "selectContainerDescription": "Seleziona qualsiasi contenitore da usare come hostname per questo obiettivo. Fai clic su una porta per usare una porta.",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "Certificato",
     "certificateStatusAutoRefreshHint": "Lo stato si aggiorna automaticamente.",
     "loading": "Caricamento",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Caricamento Delle Analisi",
     "restart": "Riavvia",
     "domains": "Domini",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "Gestisci il tuo abbonamento per le chiavi di licenza self-hosted a pagamento",
     "billingCurrentKeys": "Tasti Attuali",
     "billingModifyCurrentPlan": "Modifica Il Piano Corrente",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Conferma Aggiornamento",
     "billingConfirmDowngrade": "Conferma Downgrade",
     "billingConfirmUpgradeDescription": "Stai per aggiornare il tuo piano. Controlla i nuovi limiti e prezzi qui sotto.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "Il tempo è in secondi",
     "requireDeviceApproval": "Richiede Approvazioni Dispositivo",
     "requireDeviceApprovalDescription": "Gli utenti con questo ruolo hanno bisogno di nuovi dispositivi approvati da un amministratore prima di poter connettersi e accedere alle risorse.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "Accesso SSH",
     "roleAllowSsh": "Consenti SSH",
     "roleAllowSshAllow": "Consenti",
     "roleAllowSshDisallow": "Non Consentire",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "L'utente può eseguire solo i comandi specificati con sudo.",
     "sshSudo": "Consenti sudo",
     "sshSudoCommands": "Comandi Sudo",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Elenco di comandi separati da virgole che l'utente può eseguire con sudo.",
     "sshCreateHomeDir": "Crea Cartella Home",
     "sshUnixGroups": "Gruppi Unix",
     "sshUnixGroupsDescription": "Gruppi Unix separati da virgole per aggiungere l'utente sull'host di destinazione.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Metodo HTTP",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "Abilitare TLS",
     "editInternalResourceDialogEnableSslDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alla destinazione.",
     "editInternalResourceDialogDestination": "Destinazione",
     "editInternalResourceDialogDestinationHostDescription": "L'indirizzo IP o il nome host della risorsa nella rete del sito.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Metodo HTTP",
     "createInternalResourceDialogScheme": "Metodo HTTP",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "Abilitare TLS",
     "createInternalResourceDialogEnableSslDescription": "Abilita la crittografia SSL/TLS per connessioni HTTPS sicure alla destinazione.",
     "createInternalResourceDialogDestination": "Destinazione",
     "createInternalResourceDialogDestinationHostDescription": "L'indirizzo IP o il nome host della risorsa nella rete del sito.",
@@ -2364,7 +2233,7 @@
         "description": "Server Pangolin self-hosted più affidabile e a bassa manutenzione con campanelli e fischietti extra",
         "introTitle": "Managed Self-Hosted Pangolin",
         "introDescription": "è un'opzione di distribuzione progettata per le persone che vogliono la semplicità e l'affidabilità extra mantenendo i loro dati privati e self-hosted.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "Con questa opzione, esegui ancora il tuo nodo Pangolin - i tunnel, la terminazione TLS e il traffico rimangono tutti sul tuo server. La differenza è che la gestione e il monitoraggio sono gestiti attraverso il nostro cruscotto cloud, che sblocca una serie di vantaggi:",
         "benefitSimplerOperations": {
             "title": "Operazioni più semplici",
             "description": "Non è necessario eseguire il proprio server di posta o impostare un avviso complesso. Otterrai controlli di salute e avvisi di inattività fuori dalla casella."
@@ -3068,7 +2937,7 @@
     "learnMore": "Scopri di più",
     "backToHome": "Torna alla home",
     "needToSignInToOrg": "Hai bisogno di utilizzare il provider di identità della tua organizzazione?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Modalità di Manutenzione",
     "maintenanceModeDescription": "Visualizza una pagina di manutenzione ai visitatori",
     "maintenanceModeType": "Tipo di Modalità di Manutenzione",
     "showMaintenancePage": "Mostra una pagina di manutenzione ai visitatori",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "Completamento Stimato:",
     "createInternalResourceDialogDestinationRequired": "Destinazione richiesta",
     "available": "Disponibile",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Archiviato",
     "noArchivedDevices": "Nessun dispositivo archiviato trovato",
     "deviceArchived": "Dispositivo archiviato",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "Risorsa Disabilitata",
     "memberPortalShowingResources": "Mostrando {start}-{end} di {total} risorse",
     "memberPortalPrevious": "Precedente",
-    "memberPortalNext": "Successivo",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Successivo"
 }

messages/ko-KR.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "리소스 검색...",
     "resourceAdd": "리소스 추가",
     "resourceErrorDelte": "리소스 삭제 중 오류 발생",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "인증",
     "protected": "보호됨",
     "notProtected": "보호되지 않음",
     "resourceMessageRemove": "제거되면 리소스에 더 이상 접근할 수 없습니다. 리소스와 연결된 모든 대상도 제거됩니다.",
     "resourceQuestionRemove": "조직에서 리소스를 제거하시겠습니까?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "HTTPS 리소스",
     "resourceHTTPDescription": "완전한 도메인 이름을 사용해 RAW 또는 HTTPS로 프록시 요청을 수행합니다.",
     "resourceRaw": "원시 TCP/UDP 리소스",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "포트 번호를 사용하여 원격 노드에 연결해야 합니다. 원격 노드에서 리소스를 사용하려면 사용자 지정 도메인을 사용하십시오.",
     "resourceCreate": "리소스 생성",
     "resourceCreateDescription": "아래 단계를 따라 새 리소스를 생성하세요.",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "모든 리소스 보기",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "리소스 정보",
     "resourceNameDescription": "이것은 리소스의 표시 이름입니다.",
     "siteSelect": "사이트 선택",
     "siteSearch": "사이트 검색",
@@ -254,15 +231,12 @@
     "noCountryFound": "국가를 찾을 수 없습니다.",
     "siteSelectionDescription": "이 사이트는 대상에 대한 연결을 제공합니다.",
     "resourceType": "리소스 유형",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "리소스에 액세스하는 방법을 결정하세요.",
     "resourceHTTPSSettings": "HTTPS 설정",
     "resourceHTTPSSettingsDescription": "리소스가 HTTPS로 접근할 수 있는 방식을 구성합니다.",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "도메인 유형",
     "subdomain": "서브도메인",
     "baseDomain": "기본 도메인",
-    "configure": "Configure",
     "subdomnainDescription": "리소스에 접근할 수 있는 하위 도메인입니다.",
     "resourceRawSettings": "TCP/UDP 설정",
     "resourceRawSettingsDescription": "TCP/UDP를 통해 리소스에 접근하는 방법을 구성하세요.",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "TCP/UDP 리소스 구성 방법 알아보기",
     "resourceBack": "리소스로 돌아가기",
     "resourceGoTo": "리소스로 이동",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "리소스 삭제",
     "resourceDeleteConfirm": "리소스 삭제 확인",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "가시성",
     "enabled": "활성화됨",
     "disabled": "비활성화됨",
@@ -310,8 +265,6 @@
     "rules": "규칙",
     "resourceSettingDescription": "리소스의 설정을 구성하세요.",
     "resourceSetting": "{resourceName} 설정",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "인증 우회",
     "alwaysDeny": "접근 차단",
     "passToAuth": "인증으로 전달",
@@ -677,7 +630,7 @@
     "createdAt": "생성일",
     "proxyErrorInvalidHeader": "잘못된 사용자 정의 호스트 헤더 값입니다. 도메인 이름 형식을 사용하거나 사용자 정의 호스트 헤더를 해제하려면 비워 두십시오.",
     "proxyErrorTls": "유효하지 않은 TLS 서버 이름입니다. 도메인 이름 형식을 사용하거나 비워 두어 TLS 서버 이름을 제거하십시오.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "TLS 활성화",
     "proxyEnableSSLDescription": "타겟과의 안전한 HTTPS 연결을 위한 SSL/TLS 암호화를 활성화하세요.",
     "target": "대상",
     "configureTarget": "대상 구성",
@@ -794,16 +747,6 @@
     "rulesNoOne": "규칙이 없습니다. 양식을 사용하여 규칙을 추가하십시오.",
     "rulesOrder": "규칙은 우선 순위에 따라 오름차순으로 평가됩니다.",
     "rulesSubmit": "규칙 저장",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "리소스 생성 오류",
     "resourceErrorCreateDescription": "리소스를 생성하는 중 오류가 발생했습니다.",
     "resourceErrorCreateMessage": "리소스 생성 오류:",
@@ -867,16 +810,6 @@
     "pincodeAdd": "PIN 코드 추가",
     "pincodeRemove": "PIN 코드 제거",
     "resourceAuthMethods": "인증 방법",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "추가 인증 방법을 통해 리소스에 대한 액세스 허용",
     "resourceAuthSettingsSave": "성공적으로 저장되었습니다.",
     "resourceAuthSettingsSaveDescription": "인증 설정이 저장되었습니다",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "핀코드 설정",
     "resourcePincodeSetupTitleDescription": "이 리소스를 보호하기 위해 핀 코드를 설정하십시오.",
     "resourceRoleDescription": "관리자는 항상 이 리소스에 접근할 수 있습니다.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "접근 제어",
     "resourceUsersRolesDescription": "이 리소스를 방문할 수 있는 사용자 및 역할을 구성하십시오",
     "resourceUsersRolesSubmit": "접근 제어 저장",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "{name}에 연결하는 데 문제가 발생했습니다. 관리자에게 문의하십시오.",
     "idpErrorNotFound": "IdP를 찾을 수 없습니다.",
     "inviteInvalid": "유효하지 않은 초대",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "초대 링크가 유효하지 않습니다.",
     "inviteErrorWrongUser": "이 초대는 이 사용자에게 해당되지 않습니다",
     "inviteErrorUserNotExists": "사용자가 존재하지 않습니다. 먼저 계정을 생성해 주세요.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "리소스",
     "sidebarProxyResources": "공유",
     "sidebarClientResources": "비공개",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "액세스 제어",
     "sidebarLogsAndAnalytics": "로그 및 분석",
     "sidebarTeam": "팀",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "사이트 {id}",
     "standaloneHcFilterResourceIdFallback": "리소스 {id}",
     "blueprints": "청사진",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "선언적 구성을 적용하고 이전 실행을 봅니다",
     "blueprintAdd": "청사진 추가",
     "blueprintGoBack": "모든 청사진 보기",
     "blueprintCreate": "청사진 생성",
@@ -1663,17 +1575,7 @@
     "contents": "콘텐츠",
     "parsedContents": "구문 분석된 콘텐츠 (읽기 전용)",
     "enableDockerSocket": "Docker 청사진 활성화",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "블루프린트 레이블을 위한 Docker 소켓 레이블 수집을 활성화합니다. 소켓 경로는 Newt에 제공되어야 합니다.",
     "viewDockerContainers": "도커 컨테이너 보기",
     "containersIn": "{siteName}의 컨테이너",
     "selectContainerDescription": "이 대상을 위한 호스트 이름으로 사용할 컨테이너를 선택하세요. 포트를 사용하려면 포트를 클릭하세요.",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "인증서",
     "certificateStatusAutoRefreshHint": "상태가 자동으로 새로 고쳐집니다.",
     "loading": "로딩 중",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "분석 로딩 중",
     "restart": "재시작",
     "domains": "도메인",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "유료 독립 호스트 라이센스 키를 위한 구독 관리",
     "billingCurrentKeys": "현재 키",
     "billingModifyCurrentPlan": "현재 계획 수정",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "업그레이드 확인",
     "billingConfirmDowngrade": "다운그레이드 확인",
     "billingConfirmUpgradeDescription": "계획을 업그레이드하려고 합니다. 아래의 새로운 제한 및 가격을 검토하세요.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "시간은 초 단위입니다",
     "requireDeviceApproval": "장치 승인 요구",
     "requireDeviceApprovalDescription": "이 역할을 가진 사용자는 장치가 연결되기 전에 관리자의 승인이 필요합니다.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "SSH 접속",
     "roleAllowSsh": "SSH 허용",
     "roleAllowSshAllow": "허용",
     "roleAllowSshDisallow": "허용 안 함",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "사용자는 sudo로 지정된 명령만 실행할 수 있습니다.",
     "sshSudo": "Sudo 허용",
     "sshSudoCommands": "Sudo 명령",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "사용자가 sudo로 실행할 수 있는 명령어의 쉼표로 구분된 목록입니다.",
     "sshCreateHomeDir": "홈 디렉터리 생성",
     "sshUnixGroups": "유닉스 그룹",
     "sshUnixGroupsDescription": "대상 호스트에서 사용자에게 추가할 유닉스 그룹의 쉼표로 구분된 목록입니다.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "스킴",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "TLS 활성화",
     "editInternalResourceDialogEnableSslDescription": "목적지로의 안전한 HTTPS 연결을 위한 SSL/TLS 암호화 활성화.",
     "editInternalResourceDialogDestination": "대상지",
     "editInternalResourceDialogDestinationHostDescription": "사이트 네트워크의 자원 IP 주소입니다.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "스킴",
     "createInternalResourceDialogScheme": "스킴",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "TLS 활성화",
     "createInternalResourceDialogEnableSslDescription": "목적지로의 안전한 HTTPS 연결을 위한 SSL/TLS 암호화 활성화.",
     "createInternalResourceDialogDestination": "대상지",
     "createInternalResourceDialogDestinationHostDescription": "사이트 네트워크의 자원 IP 주소입니다.",
@@ -2364,7 +2233,7 @@
         "description": "더 신뢰할 수 있고 낮은 유지보수의 자체 호스팅 팡골린 서버, 추가 기능 포함",
         "introTitle": "관리 자체 호스팅 팡골린",
         "introDescription": "는 자신의 데이터를 프라이빗하고 자체 호스팅을 유지하면서 더 간단하고 추가적인 신뢰성을 원하는 사람들을 위한 배포 옵션입니다.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "이 옵션을 사용하면 여전히 자신의 팡골린 노드를 운영하고 - 터널, TLS 종료 및 트래픽 모두 서버에 유지됩니다. 차이점은 관리 및 모니터링이 클라우드 대시보드를 통해 처리되어 여러 혜택을 제공합니다.",
         "benefitSimplerOperations": {
             "title": "더 간단한 운영",
             "description": "자체 메일 서버를 운영하거나 복잡한 경고를 설정할 필요가 없습니다. 기본적으로 상태 점검 및 다운타임 경고를 받을 수 있습니다."
@@ -3068,7 +2937,7 @@
     "learnMore": "자세히 알아보기",
     "backToHome": "홈으로 돌아가기",
     "needToSignInToOrg": "조직의 아이덴티티 공급자를 사용해야 합니까?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "유지보수 모드",
     "maintenanceModeDescription": "방문자에게 유지보수 페이지 표시",
     "maintenanceModeType": "유지보수 모드 유형",
     "showMaintenancePage": "방문자에게 유지보수 페이지 표시",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "예상 완료:",
     "createInternalResourceDialogDestinationRequired": "목적지가 필요합니다.",
     "available": "사용 가능",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "보관된",
     "noArchivedDevices": "보관된 장치가 없습니다.",
     "deviceArchived": "장치가 보관되었습니다.",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "리소스 비활성화됨",
     "memberPortalShowingResources": "{start}-{end} 중 {total}개의 리소스를 표시 중",
     "memberPortalPrevious": "이전",
-    "memberPortalNext": "다음",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "다음"
 }

messages/nb-NO.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Søk i ressurser...",
     "resourceAdd": "Legg til ressurs",
     "resourceErrorDelte": "Feil ved sletting av ressurs",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Autentisering",
     "protected": "Beskyttet",
     "notProtected": "Ikke beskyttet",
     "resourceMessageRemove": "Når den er fjernet, vil ressursen ikke lenger være tilgjengelig. Alle mål knyttet til ressursen vil også bli fjernet.",
     "resourceQuestionRemove": "Er du sikker på at du vil fjerne ressursen fra organisasjonen?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "HTTPS-ressurs",
     "resourceHTTPDescription": "Proxy forespørsler over HTTPS ved å bruke et fullstendig kvalifisert domenenavn.",
     "resourceRaw": "Rå TCP/UDP-ressurs",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Proxy forespørsler om rå TCP/UDP ved hjelp av et portnummer. Krever sider for å koble til en ekstern node.",
     "resourceCreate": "Opprett ressurs",
     "resourceCreateDescription": "Følg trinnene nedenfor for å opprette en ny ressurs",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Se alle ressurser",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Ressursinformasjon",
     "resourceNameDescription": "Dette er visningsnavnet for ressursen.",
     "siteSelect": "Velg område",
     "siteSearch": "Søk i område",
@@ -254,15 +231,12 @@
     "noCountryFound": "Ingen land funnet.",
     "siteSelectionDescription": "Dette området vil gi tilkobling til mål.",
     "resourceType": "Ressurstype",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Bestemme hvordan denne ressursen skal brukes",
     "resourceHTTPSSettings": "HTTPS-innstillinger",
     "resourceHTTPSSettingsDescription": "Konfigurer hvordan ressursen skal nås over HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Domenetype",
     "subdomain": "Underdomene",
     "baseDomain": "Grunndomene",
-    "configure": "Configure",
     "subdomnainDescription": "Underdomenet hvor ressursen vil være tilgjengelig.",
     "resourceRawSettings": "TCP/UDP-innstillinger",
     "resourceRawSettingsDescription": "Konfigurer hvordan ressursen vil bli tilgjengelig over TCP/UDP",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "Lær hvordan å konfigurere TCP/UDP-ressurser",
     "resourceBack": "Tilbake til ressurser",
     "resourceGoTo": "Gå til ressurs",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Slett ressurs",
     "resourceDeleteConfirm": "Bekreft sletting av ressurs",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Synlighet",
     "enabled": "Aktivert",
     "disabled": "Deaktivert",
@@ -310,8 +265,6 @@
     "rules": "Regler",
     "resourceSettingDescription": "Konfigurere innstillingene på ressursen",
     "resourceSetting": "{resourceName} Innstillinger",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Omgå Auth",
     "alwaysDeny": "Blokker tilgang",
     "passToAuth": "Pass til Autentisering",
@@ -677,7 +630,7 @@
     "createdAt": "Opprettet",
     "proxyErrorInvalidHeader": "Ugyldig verdi for egendefinert vertsoverskrift. Bruk domenenavnformat, eller lagre tomt for å fjerne den egendefinerte vertsoverskriften.",
     "proxyErrorTls": "Ugyldig TLS-servernavn. Bruk domenenavnformat, eller la stå tomt for å fjerne TLS-servernavnet.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "Aktiver TLS",
     "proxyEnableSSLDescription": "Aktivere SSL/TLS-kryptering for sikker HTTPS tilkobling til målene.",
     "target": "Target",
     "configureTarget": "Konfigurer mål",
@@ -794,16 +747,6 @@
     "rulesNoOne": "Ingen regler. Legg til en regel ved å bruke skjemaet.",
     "rulesOrder": "Regler evalueres etter prioritet i stigende rekkefølge.",
     "rulesSubmit": "Lagre regler",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Feil under oppretting av ressurs",
     "resourceErrorCreateDescription": "Det oppstod en feil under oppretting av ressursen",
     "resourceErrorCreateMessage": "Feil ved oppretting av ressurs:",
@@ -867,16 +810,6 @@
     "pincodeAdd": "Legg til PIN-kode",
     "pincodeRemove": "Fjern PIN-kode",
     "resourceAuthMethods": "Autentiseringsmetoder",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Tillat tilgang til ressursen via ytterligere autentiseringsmetoder",
     "resourceAuthSettingsSave": "Lagret vellykket",
     "resourceAuthSettingsSaveDescription": "Autentiseringsinnstillinger er lagret",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "Angi PIN-kode",
     "resourcePincodeSetupTitleDescription": "Sett en pinkode for å beskytte denne ressursen",
     "resourceRoleDescription": "Administratorer har alltid tilgang til denne ressursen.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Tilgangskontroller",
     "resourceUsersRolesDescription": "Konfigurer hvilke brukere og roller som har tilgang til denne ressursen",
     "resourceUsersRolesSubmit": "Lagre tilgangskontroller",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "Det oppstod et problem med å koble til {name}. Vennligst kontakt din administrator.",
     "idpErrorNotFound": "IdP ikke funnet",
     "inviteInvalid": "Ugyldig invitasjon",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "Invitasjonslenken er ugyldig.",
     "inviteErrorWrongUser": "Invitasjonen er ikke for denne brukeren",
     "inviteErrorUserNotExists": "Brukeren eksisterer ikke. Vennligst opprett en konto først.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "Ressurser",
     "sidebarProxyResources": "Offentlig",
     "sidebarClientResources": "Privat",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Tilgangskontroll",
     "sidebarLogsAndAnalytics": "Logger og analyser",
     "sidebarTeam": "Lag",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "Område {id}",
     "standaloneHcFilterResourceIdFallback": "Ressurs {id}",
     "blueprints": "Tegninger",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Bruk deklarative konfigurasjoner og vis tidligere kjøringer",
     "blueprintAdd": "Legg til blåkopi",
     "blueprintGoBack": "Se alle blåkopier",
     "blueprintCreate": "Opprette mal",
@@ -1663,17 +1575,7 @@
     "contents": "Innhold",
     "parsedContents": "Parastinnhold (kun lese)",
     "enableDockerSocket": "Aktiver Docker blåkopi",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Aktiver skraping av Docker Socket for blueprint Etiketter. Socket bane må brukes for nye.",
     "viewDockerContainers": "Vis Docker-containere",
     "containersIn": "Containere i {siteName}",
     "selectContainerDescription": "Velg en hvilken som helst container for å bruke som vertsnavn for dette målet. Klikk på en port for å bruke en port.",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "Sertifikat",
     "certificateStatusAutoRefreshHint": "Status oppdateres automatisk.",
     "loading": "Laster inn",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Laster inn analyser",
     "restart": "Start på nytt",
     "domains": "Domener",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "Administrer abonnementet for betalte lisensnøkler selv hostet",
     "billingCurrentKeys": "Nåværende nøkler",
     "billingModifyCurrentPlan": "Endre gjeldende plan",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Bekreft oppgradering",
     "billingConfirmDowngrade": "Bekreft nedgradering",
     "billingConfirmUpgradeDescription": "Du er i ferd med å oppgradere abonnementet ditt. Gå gjennom de nye grensene og pris nedenfor.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "Tid er i sekunder",
     "requireDeviceApproval": "Krev enhetsgodkjenning",
     "requireDeviceApprovalDescription": "Brukere med denne rollen trenger nye enheter godkjent av en admin før de kan koble seg og få tilgang til ressurser.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "SSH tilgang",
     "roleAllowSsh": "Tillat SSH",
     "roleAllowSshAllow": "Tillat",
     "roleAllowSshDisallow": "Forby",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "Brukeren kan bare kjøre de angitte kommandoene med sudo.",
     "sshSudo": "Tillat sudo",
     "sshSudoCommands": "Sudo kommandoer",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Kommaseparert liste med kommandoer brukeren kan kjøre med sudo.",
     "sshCreateHomeDir": "Opprett hjemmappe",
     "sshUnixGroups": "Unix grupper",
     "sshUnixGroupsDescription": "Kommaseparerte Unix grupper for å legge brukeren til på mål-verten.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Skjema",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "Aktiver TLS",
     "editInternalResourceDialogEnableSslDescription": "Aktiver SSL/TLS-kryptering for sikre HTTPS-tilkoblinger til destinasjonen.",
     "editInternalResourceDialogDestination": "Destinasjon",
     "editInternalResourceDialogDestinationHostDescription": "IP-adressen eller vertsnavnet til ressursen på nettstedets nettverk.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Skjema",
     "createInternalResourceDialogScheme": "Skjema",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "Aktiver TLS",
     "createInternalResourceDialogEnableSslDescription": "Aktiver SSL/TLS-kryptering for sikre HTTPS-tilkoblinger til destinasjonen.",
     "createInternalResourceDialogDestination": "Destinasjon",
     "createInternalResourceDialogDestinationHostDescription": "IP-adressen eller vertsnavnet til ressursen på nettstedets nettverk.",
@@ -2364,7 +2233,7 @@
         "description": "Sikre og lavvedlikeholdsservere, selvbetjente Pangolin med ekstra klokker, og understell",
         "introTitle": "Administrert Self-Hosted Pangolin",
         "introDescription": "er et alternativ for bruk utviklet for personer som ønsker enkel og ekstra pålitelighet mens de fortsatt holder sine data privat og selvdrevne.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "Med dette valget kjører du fortsatt din egen Pangolin-node - tunneler, TLS-terminering og trafikken ligger på serveren din. Forskjellen er at behandling og overvåking håndteres gjennom vårt skydashbord, som låser opp en rekke fordeler:",
         "benefitSimplerOperations": {
             "title": "Enklere operasjoner",
             "description": "Ingen grunn til å kjøre din egen e-postserver eller sette opp kompleks varsling. Du vil få helsesjekk og nedetid varsler ut av boksen."
@@ -3068,7 +2937,7 @@
     "learnMore": "Lær mer",
     "backToHome": "Gå tilbake til start",
     "needToSignInToOrg": "Trenger du å bruke organisasjonens identitetsleverandør?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Vedlikeholdsmodus",
     "maintenanceModeDescription": "Vis en vedlikeholdsside til besøkende",
     "maintenanceModeType": "Vedlikeholdsmodus type",
     "showMaintenancePage": "Vis en vedlikeholdsside til besøkende",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "Estimert ferdigstillelse:",
     "createInternalResourceDialogDestinationRequired": "Destinasjonen er nødvendig",
     "available": "Tilgjengelig",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Arkivert",
     "noArchivedDevices": "Ingen arkiverte enheter funnet",
     "deviceArchived": "Enhet arkivert",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "Ressurs deaktivert",
     "memberPortalShowingResources": "Viser {start}-{end} av {total} ressurser",
     "memberPortalPrevious": "Forrige",
-    "memberPortalNext": "Neste",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Neste"
 }

messages/nl-NL.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Zoek bronnen...",
     "resourceAdd": "Bron toevoegen",
     "resourceErrorDelte": "Fout bij verwijderen document",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Authenticatie",
     "protected": "Beschermd",
     "notProtected": "Niet beveiligd",
     "resourceMessageRemove": "Eenmaal verwijderd, zal het bestand niet langer toegankelijk zijn. Alle doelen die gekoppeld zijn aan het hulpbron, zullen ook verwijderd worden.",
     "resourceQuestionRemove": "Weet u zeker dat u het document van de organisatie wilt verwijderen?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "HTTPS bron",
     "resourceHTTPDescription": "Proxyverzoeken via HTTPS met een volledig gekwalificeerde domeinnaam.",
     "resourceRaw": "TCP/UDP bron",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Proxy verzoeken over rauwe TCP/UDP met behulp van een poortnummer. Vereist sites om verbinding te maken met een remote node.",
     "resourceCreate": "Bron maken",
     "resourceCreateDescription": "Volg de onderstaande stappen om een nieuwe bron te maken",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Alle bronnen bekijken",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Bron informatie",
     "resourceNameDescription": "Dit is de weergavenaam voor het document.",
     "siteSelect": "Selecteer site",
     "siteSearch": "Zoek site",
@@ -254,15 +231,12 @@
     "noCountryFound": "Geen land gevonden.",
     "siteSelectionDescription": "Deze site zal connectiviteit met het doelwit bieden.",
     "resourceType": "Type bron",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Bepaal hoe u toegang wilt tot de bron",
     "resourceHTTPSSettings": "HTTPS instellingen",
     "resourceHTTPSSettingsDescription": "Stel in hoe de bron wordt benaderd via HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Domein type",
     "subdomain": "Subdomein",
     "baseDomain": "Basis domein",
-    "configure": "Configure",
     "subdomnainDescription": "Het subdomein waar de bron toegankelijk zal zijn.",
     "resourceRawSettings": "TCP/UDP instellingen",
     "resourceRawSettingsDescription": "Stel in hoe de bron wordt benaderd via TCP/UDP",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "Leer hoe je TCP/UDP bronnen kunt configureren",
     "resourceBack": "Terug naar bronnen",
     "resourceGoTo": "Ga naar Resource",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Document verwijderen",
     "resourceDeleteConfirm": "Bevestig Verwijderen Document",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Zichtbaarheid",
     "enabled": "Ingeschakeld",
     "disabled": "Uitgeschakeld",
@@ -310,8 +265,6 @@
     "rules": "Regels",
     "resourceSettingDescription": "Configureer de instellingen in de bron",
     "resourceSetting": "{resourceName} instellingen",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Authenticatie omzeilen",
     "alwaysDeny": "Blokkeer toegang",
     "passToAuth": "Passeren naar Auth",
@@ -677,7 +630,7 @@
     "createdAt": "Aangemaakt op",
     "proxyErrorInvalidHeader": "Ongeldige aangepaste Header waarde. Gebruik het domeinnaam formaat, of sla leeg op om de aangepaste Host header ongedaan te maken.",
     "proxyErrorTls": "Ongeldige TLS servernaam. Gebruik de domeinnaam of sla leeg op om de TLS servernaam te verwijderen.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "TLS inschakelen",
     "proxyEnableSSLDescription": "SSL/TLS-versleuteling inschakelen voor beveiligde HTTPS-verbindingen naar de doelen.",
     "target": "Target",
     "configureTarget": "Doelstellingen configureren",
@@ -794,16 +747,6 @@
     "rulesNoOne": "Geen regels. Voeg een regel toe via het formulier.",
     "rulesOrder": "Regels worden in oplopende volgorde volgens prioriteit beoordeeld.",
     "rulesSubmit": "Regels opslaan",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Fout bij maken document",
     "resourceErrorCreateDescription": "Er is een fout opgetreden bij het maken van het document",
     "resourceErrorCreateMessage": "Fout bij maken bron:",
@@ -867,16 +810,6 @@
     "pincodeAdd": "PIN-code toevoegen",
     "pincodeRemove": "PIN-code verwijderen",
     "resourceAuthMethods": "Authenticatie methoden",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Sta toegang tot de bron toe via extra autorisatiemethoden",
     "resourceAuthSettingsSave": "Succesvol opgeslagen",
     "resourceAuthSettingsSaveDescription": "Verificatie-instellingen zijn opgeslagen",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "Pincode instellen",
     "resourcePincodeSetupTitleDescription": "Stel een pincode in om deze hulpbron te beschermen",
     "resourceRoleDescription": "Beheerders hebben altijd toegang tot deze bron.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Toegang Bediening",
     "resourceUsersRolesDescription": "Configureer welke gebruikers en rollen deze pagina kunnen bezoeken",
     "resourceUsersRolesSubmit": "Bewaar Toegangsbesturing",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "Er was een probleem bij het verbinden met {name}. Neem contact op met uw beheerder.",
     "idpErrorNotFound": "IdP niet gevonden",
     "inviteInvalid": "Ongeldige uitnodiging",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "Uitnodigingslink is ongeldig.",
     "inviteErrorWrongUser": "Uitnodiging is niet voor deze gebruiker",
     "inviteErrorUserNotExists": "Gebruiker bestaat niet. Maak eerst een account aan.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "Bronnen",
     "sidebarProxyResources": "Openbaar",
     "sidebarClientResources": "Privé",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Toegangs controle",
     "sidebarLogsAndAnalytics": "Logs & Analytics",
     "sidebarTeam": "Team",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "Site {id}",
     "standaloneHcFilterResourceIdFallback": "Bron {id}",
     "blueprints": "Blauwdrukken",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Gebruik declaratieve configuraties en bekijk vorige uitvoeringen.",
     "blueprintAdd": "Blauwdruk toevoegen",
     "blueprintGoBack": "Bekijk alle Blauwdrukken",
     "blueprintCreate": "Creëer blauwdruk",
@@ -1663,17 +1575,7 @@
     "contents": "Inhoud",
     "parsedContents": "Geparseerde inhoud (alleen lezen)",
     "enableDockerSocket": "Schakel Docker Blauwdruk in",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Schakel Docker Socket label in voor blauwdruk labels. Pad naar Nieuw.",
     "viewDockerContainers": "Bekijk Docker containers",
     "containersIn": "Containers in {siteName}",
     "selectContainerDescription": "Selecteer een container om als hostnaam voor dit doel te gebruiken. Klik op een poort om een poort te gebruiken.",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "Certificaat",
     "certificateStatusAutoRefreshHint": "Status ververst automatisch.",
     "loading": "Bezig met laden",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Laden van Analytics",
     "restart": "Herstarten",
     "domains": "Domeinen",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "Beheer je abonnement voor betaalde zelf gehoste licentiesleutels",
     "billingCurrentKeys": "Huidige toetsen",
     "billingModifyCurrentPlan": "Huidig plan wijzigen",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Bevestig Upgrade",
     "billingConfirmDowngrade": "Downgraden bevestigen",
     "billingConfirmUpgradeDescription": "U staat op het punt uw abonnement te upgraden. Controleer de nieuwe limieten en prijzen hieronder.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "Tijd is in seconden",
     "requireDeviceApproval": "Vereist goedkeuring van apparaat",
     "requireDeviceApprovalDescription": "Gebruikers met deze rol hebben nieuwe apparaten nodig die door een beheerder zijn goedgekeurd voordat ze verbinding kunnen maken met bronnen en deze kunnen gebruiken.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "SSH toegang",
     "roleAllowSsh": "SSH toestaan",
     "roleAllowSshAllow": "Toestaan",
     "roleAllowSshDisallow": "Weigeren",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "Gebruiker kan alleen de opgegeven commando's uitvoeren met de sudo.",
     "sshSudo": "sudo toestaan",
     "sshSudoCommands": "Sudo Commando's",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Komma's gescheiden lijst van commando's waar de gebruiker een sudo mee mag uitvoeren.",
     "sshCreateHomeDir": "Maak Home Directory",
     "sshUnixGroups": "Unix groepen",
     "sshUnixGroupsDescription": "Door komma's gescheiden Unix-groepen om de gebruiker toe te voegen aan de doelhost.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Schema",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "TLS inschakelen",
     "editInternalResourceDialogEnableSslDescription": "Schakel SSL/TLS-encryptie in voor beveiligde HTTPS-verbindingen met de bestemming.",
     "editInternalResourceDialogDestination": "Bestemming",
     "editInternalResourceDialogDestinationHostDescription": "Het IP-adres of de hostnaam van de bron op het netwerk van de site.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Schema",
     "createInternalResourceDialogScheme": "Schema",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "TLS inschakelen",
     "createInternalResourceDialogEnableSslDescription": "Schakel SSL/TLS-encryptie in voor beveiligde HTTPS-verbindingen met de bestemming.",
     "createInternalResourceDialogDestination": "Bestemming",
     "createInternalResourceDialogDestinationHostDescription": "Het IP-adres of de hostnaam van de bron op het netwerk van de site.",
@@ -2364,7 +2233,7 @@
         "description": "betrouwbaardere en slecht onderhouden Pangolin server met extra klokken en klokkenluiders",
         "introTitle": "Beheerde zelfgehoste pangolin",
         "introDescription": "is een implementatieoptie ontworpen voor mensen die eenvoud en extra betrouwbaarheid willen, terwijl hun gegevens privé en zelf georganiseerd blijven.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "Met deze optie beheert u nog steeds uw eigen Pangolin node - uw tunnels, TLS-verbinding en verkeer alles op uw server. Het verschil is dat beheer en monitoring worden behandeld via onze cloud dashboard, wat een aantal voordelen oplevert:",
         "benefitSimplerOperations": {
             "title": "Simpler operaties",
             "description": "Je hoeft geen eigen mailserver te draaien of complexe waarschuwingen in te stellen. Je krijgt gezondheidscontroles en downtime meldingen uit de box."
@@ -3068,7 +2937,7 @@
     "learnMore": "Meer informatie",
     "backToHome": "Ga terug naar startpagina",
     "needToSignInToOrg": "Moet u de identiteit provider van uw organisatie gebruiken?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Onderhoudsmodus",
     "maintenanceModeDescription": "Toon een onderhoudspagina aan bezoekers",
     "maintenanceModeType": "Type onderhoudsmodus",
     "showMaintenancePage": "Toon een onderhoudspagina aan bezoekers",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "Geschatte voltooiing:",
     "createInternalResourceDialogDestinationRequired": "Bestemming is vereist",
     "available": "Beschikbaar",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Gearchiveerd",
     "noArchivedDevices": "Geen gearchiveerde apparaten gevonden",
     "deviceArchived": "Apparaat gearchiveerd",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "Bron Uitgeschakeld",
     "memberPortalShowingResources": "Toont {start}-{end} van {total} bronnen",
     "memberPortalPrevious": "Vorige",
-    "memberPortalNext": "Volgende",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Volgende"
 }

messages/pl-PL.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Szukaj zasobów...",
     "resourceAdd": "Dodaj zasób",
     "resourceErrorDelte": "Błąd podczas usuwania zasobu",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Uwierzytelnianie",
     "protected": "Chronione",
     "notProtected": "Niechronione",
     "resourceMessageRemove": "Po usunięciu zasób nie będzie już dostępny. Wszystkie cele związane z zasobem zostaną również usunięte.",
     "resourceQuestionRemove": "Czy na pewno chcesz usunąć zasób z organizacji?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "Zasób HTTPS",
     "resourceHTTPDescription": "Proxy zapytań przez HTTPS przy użyciu w pełni kwalifikowanej nazwy domeny.",
     "resourceRaw": "Surowy zasób TCP/UDP",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Żądania proxy nad surowym TCP/UDP przy użyciu numeru portu. Wymaga stron aby połączyć się ze zdalnym węzłem.",
     "resourceCreate": "Utwórz zasób",
     "resourceCreateDescription": "Wykonaj poniższe kroki, aby utworzyć nowy zasób",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Zobacz wszystkie zasoby",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Informacje o zasobach",
     "resourceNameDescription": "To jest wyświetlana nazwa zasobu.",
     "siteSelect": "Wybierz witrynę",
     "siteSearch": "Szukaj witryny",
@@ -254,15 +231,12 @@
     "noCountryFound": "Nie znaleziono kraju.",
     "siteSelectionDescription": "Ta strona zapewni połączenie z celem.",
     "resourceType": "Typ zasobu",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Określ jak uzyskać dostęp do zasobu",
     "resourceHTTPSSettings": "Ustawienia HTTPS",
     "resourceHTTPSSettingsDescription": "Skonfiguruj jak zasób będzie dostępny przez HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Typ domeny",
     "subdomain": "Poddomena",
     "baseDomain": "Bazowa domena",
-    "configure": "Configure",
     "subdomnainDescription": "Poddomena, w której zasób będzie dostępny.",
     "resourceRawSettings": "Ustawienia TCP/UDP",
     "resourceRawSettingsDescription": "Skonfiguruj jak zasób będzie dostępny przez TCP/UDP",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "Dowiedz się, jak skonfigurować zasoby TCP/UDP",
     "resourceBack": "Powrót do zasobów",
     "resourceGoTo": "Przejdź do zasobu",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Usuń zasób",
     "resourceDeleteConfirm": "Potwierdź usunięcie zasobu",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Widoczność",
     "enabled": "Włączone",
     "disabled": "Wyłączone",
@@ -310,8 +265,6 @@
     "rules": "Regulamin",
     "resourceSettingDescription": "Skonfiguruj ustawienia zasobu",
     "resourceSetting": "Ustawienia {resourceName}",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Omijanie uwierzytelniania",
     "alwaysDeny": "Blokuj dostęp",
     "passToAuth": "Przekaż do Autoryzacji",
@@ -677,7 +630,7 @@
     "createdAt": "Utworzono",
     "proxyErrorInvalidHeader": "Nieprawidłowa wartość niestandardowego nagłówka hosta. Użyj formatu nazwy domeny lub zapisz pusty, aby usunąć niestandardowy nagłówek hosta.",
     "proxyErrorTls": "Nieprawidłowa nazwa serwera TLS. Użyj formatu nazwy domeny lub zapisz pusty, aby usunąć nazwę serwera TLS.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "Włącz TLS",
     "proxyEnableSSLDescription": "Włącz szyfrowanie SSL/TLS dla bezpiecznych połączeń HTTPS z celami.",
     "target": "Target",
     "configureTarget": "Konfiguruj Targety",
@@ -794,16 +747,6 @@
     "rulesNoOne": "Brak reguł. Dodaj regułę używając formularza.",
     "rulesOrder": "Reguły są oceniane według priorytetu w kolejności rosnącej.",
     "rulesSubmit": "Zapisz reguły",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Błąd podczas tworzenia zasobu",
     "resourceErrorCreateDescription": "Wystąpił błąd podczas tworzenia zasobu",
     "resourceErrorCreateMessage": "Błąd podczas tworzenia zasobu:",
@@ -867,16 +810,6 @@
     "pincodeAdd": "Dodaj kod PIN",
     "pincodeRemove": "Usuń kod PIN",
     "resourceAuthMethods": "Metody uwierzytelniania",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Zezwól na dostęp do zasobu przez dodatkowe metody uwierzytelniania",
     "resourceAuthSettingsSave": "Zapisano pomyślnie",
     "resourceAuthSettingsSaveDescription": "Ustawienia uwierzytelniania zostały zapisane",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "Ustaw kod PIN",
     "resourcePincodeSetupTitleDescription": "Ustaw kod PIN, aby chronić ten zasób",
     "resourceRoleDescription": "Administratorzy zawsze mają dostęp do tego zasobu.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Kontrola dostępu",
     "resourceUsersRolesDescription": "Skonfiguruj, którzy użytkownicy i role mogą odwiedzać ten zasób",
     "resourceUsersRolesSubmit": "Zapisz kontrole dostępu",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "Wystąpił problem z połączeniem z {name}. Skontaktuj się z administratorem.",
     "idpErrorNotFound": "Nie znaleziono IdP",
     "inviteInvalid": "Nieprawidłowe zaproszenie",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "Link zapraszający jest nieprawidłowy.",
     "inviteErrorWrongUser": "Zaproszenie nie jest dla tego użytkownika",
     "inviteErrorUserNotExists": "Użytkownik nie istnieje. Najpierw utwórz konto.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "Zasoby",
     "sidebarProxyResources": "Publiczne",
     "sidebarClientResources": "Prywatny",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Kontrola dostępu",
     "sidebarLogsAndAnalytics": "Logi i Analityki",
     "sidebarTeam": "Drużyna",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "Witryna {id}",
     "standaloneHcFilterResourceIdFallback": "Zasób {id}",
     "blueprints": "Schematy",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Zastosuj konfiguracje deklaracyjne i wyświetl poprzednie operacje",
     "blueprintAdd": "Dodaj schemat",
     "blueprintGoBack": "Zobacz wszystkie schematy",
     "blueprintCreate": "Utwórz schemat",
@@ -1663,17 +1575,7 @@
     "contents": "Treść",
     "parsedContents": "Przetworzona zawartość (tylko do odczytu)",
     "enableDockerSocket": "Włącz schemat dokera",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Włącz etykietowanie kieszeni dokującej dla etykiet schematów. Ścieżka do gniazda musi być dostarczona do Newt.",
     "viewDockerContainers": "Zobacz kontenery dokujące",
     "containersIn": "Pojemniki w {siteName}",
     "selectContainerDescription": "Wybierz dowolny kontener do użycia jako nazwa hosta dla tego celu. Kliknij port, aby użyć portu.",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "Certyfikat",
     "certificateStatusAutoRefreshHint": "Status odświeża się automatycznie.",
     "loading": "Ładowanie",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Ładowanie Analityki",
     "restart": "Uruchom ponownie",
     "domains": "Domeny",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "Zarządzaj subskrypcją płatnych własnych kluczy licencyjnych",
     "billingCurrentKeys": "Bieżące klucze",
     "billingModifyCurrentPlan": "Modyfikuj bieżący plan",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Potwierdź aktualizację",
     "billingConfirmDowngrade": "Potwierdź obniżenie",
     "billingConfirmUpgradeDescription": "Zamierzasz ulepszyć swój plan. Przejrzyj nowe limity i ceny poniżej.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "Czas w sekundach",
     "requireDeviceApproval": "Wymagaj zatwierdzenia urządzenia",
     "requireDeviceApprovalDescription": "Użytkownicy o tej roli potrzebują nowych urządzeń zatwierdzonych przez administratora, zanim będą mogli połączyć się i uzyskać dostęp do zasobów.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "Dostęp SSH",
     "roleAllowSsh": "Zezwalaj na SSH",
     "roleAllowSshAllow": "Zezwól",
     "roleAllowSshDisallow": "Nie zezwalaj",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "Użytkownik może uruchamiać tylko określone polecenia z sudo.",
     "sshSudo": "Zezwól na sudo",
     "sshSudoCommands": "Komendy Sudo",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Lista poleceń oddzielonych przecinkami, które użytkownik może uruchamiać z sudo.",
     "sshCreateHomeDir": "Utwórz katalog domowy",
     "sshUnixGroups": "Grupy Unix",
     "sshUnixGroupsDescription": "Oddzielone przecinkami grupy Unix, aby dodać użytkownika do docelowego hosta.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Schemat",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "Włącz TLS",
     "editInternalResourceDialogEnableSslDescription": "Włącz szyfrowanie SSL/TLS dla bezpiecznych połączeń HTTPS z miejscem docelowym.",
     "editInternalResourceDialogDestination": "Miejsce docelowe",
     "editInternalResourceDialogDestinationHostDescription": "Adres IP lub nazwa hosta zasobu w sieci witryny.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Schemat",
     "createInternalResourceDialogScheme": "Schemat",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "Włącz TLS",
     "createInternalResourceDialogEnableSslDescription": "Włącz szyfrowanie SSL/TLS dla bezpiecznych połączeń HTTPS z miejscem docelowym.",
     "createInternalResourceDialogDestination": "Miejsce docelowe",
     "createInternalResourceDialogDestinationHostDescription": "Adres IP lub nazwa hosta zasobu w sieci witryny.",
@@ -2364,7 +2233,7 @@
         "description": "Większa niezawodność i niska konserwacja serwera Pangolin z dodatkowymi dzwonkami i sygnałami",
         "introTitle": "Zarządzany samowystarczalny Pangolin",
         "introDescription": "jest opcją wdrażania zaprojektowaną dla osób, które chcą prostoty i dodatkowej niezawodności, przy jednoczesnym utrzymaniu swoich danych prywatnych i samodzielnych.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "Z tą opcją nadal obsługujesz swój własny węzeł Pangolin - tunele, zakończenie TLS i ruch na Twoim serwerze. Różnica polega na tym, że zarządzanie i monitorowanie odbywa się za pomocą naszej tablicy rozdzielczej, która odblokowuje szereg korzyści:",
         "benefitSimplerOperations": {
             "title": "Uproszczone operacje",
             "description": "Nie ma potrzeby uruchamiania własnego serwera pocztowego lub ustawiania skomplikowanych powiadomień. Będziesz mieć kontrolę zdrowia i powiadomienia o przestoju."
@@ -3068,7 +2937,7 @@
     "learnMore": "Dowiedz się więcej",
     "backToHome": "Wróć do strony głównej",
     "needToSignInToOrg": "Czy potrzebujesz użyć dostawcy tożsamości organizacji?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Tryb konserwacji",
     "maintenanceModeDescription": "Wyświetl stronę konserwacyjną odwiedzającym",
     "maintenanceModeType": "Typ trybu konserwacji",
     "showMaintenancePage": "Pokaż odwiedzającym stronę konserwacji",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "Szacowane zakończenie:",
     "createInternalResourceDialogDestinationRequired": "Miejsce docelowe jest wymagane",
     "available": "Dostępny",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Zarchiwizowane",
     "noArchivedDevices": "Nie znaleziono zarchiwizowanych urządzeń",
     "deviceArchived": "Urządzenie zarchiwizowane",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "Zasób wyłączony",
     "memberPortalShowingResources": "Wyświetlanie zasobów od {start} do {end} z {total}",
     "memberPortalPrevious": "Poprzedni",
-    "memberPortalNext": "Następny",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Następny"
 }

messages/pt-PT.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Procurar recursos...",
     "resourceAdd": "Adicionar Recurso",
     "resourceErrorDelte": "Erro ao apagar recurso",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Autenticação",
     "protected": "Protegido",
     "notProtected": "Não Protegido",
     "resourceMessageRemove": "Uma vez removido, o recurso não estará mais acessível. Todos os alvos associados ao recurso também serão removidos.",
     "resourceQuestionRemove": "Você tem certeza que deseja remover o recurso da organização?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "Recurso HTTPS",
     "resourceHTTPDescription": "Proxies requests sobre HTTPS usando um nome de domínio totalmente qualificado.",
     "resourceRaw": "Recurso TCP/UDP bruto",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Proxy solicita por TCP/UDP bruto usando um número de porta. Requer que sites se conectem a um nó remoto.",
     "resourceCreate": "Criar Recurso",
     "resourceCreateDescription": "Siga os passos abaixo para criar um novo recurso",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Ver todos os recursos",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Informação do recurso",
     "resourceNameDescription": "Este é o nome de exibição para o recurso.",
     "siteSelect": "Selecionar site",
     "siteSearch": "Procurar no site",
@@ -254,15 +231,12 @@
     "noCountryFound": "Nenhum país encontrado.",
     "siteSelectionDescription": "Este site fornecerá conectividade ao destino.",
     "resourceType": "Tipo de Recurso",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Determine como acessar o recurso",
     "resourceHTTPSSettings": "Configurações de HTTPS",
     "resourceHTTPSSettingsDescription": "Configure como o recurso será acessado por HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Tipo de domínio",
     "subdomain": "Subdomínio",
     "baseDomain": "Domínio Base",
-    "configure": "Configure",
     "subdomnainDescription": "O subdomínio onde o recurso será acessível.",
     "resourceRawSettings": "Configurações TCP/UDP",
     "resourceRawSettingsDescription": "Configurar como o recurso será acessado sobre TCP/UDP",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "Aprenda como configurar os recursos TCP/UDP",
     "resourceBack": "Voltar aos recursos",
     "resourceGoTo": "Ir para o Recurso",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Excluir Recurso",
     "resourceDeleteConfirm": "Confirmar que pretende apagar o  recurso",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Visibilidade",
     "enabled": "Ativado",
     "disabled": "Desabilitado",
@@ -310,8 +265,6 @@
     "rules": "Regras",
     "resourceSettingDescription": "Configure as configurações do recurso",
     "resourceSetting": "Configurações do {resourceName}",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Autenticação de bypass",
     "alwaysDeny": "Bloquear Acesso",
     "passToAuth": "Passar para Autenticação",
@@ -677,7 +630,7 @@
     "createdAt": "Criado Em",
     "proxyErrorInvalidHeader": "Valor do cabeçalho Host personalizado inválido. Use o formato de nome de domínio ou salve vazio para remover o cabeçalho Host personalizado.",
     "proxyErrorTls": "Nome do Servidor TLS inválido. Use o formato de nome de domínio ou salve vazio para remover o Nome do Servidor TLS.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "Habilitar TLS",
     "proxyEnableSSLDescription": "Habilitar criptografia SSL/TLS para conexões HTTPS seguras aos alvos.",
     "target": "Target",
     "configureTarget": "Configurar Alvos",
@@ -794,16 +747,6 @@
     "rulesNoOne": "Sem regras. Adicione uma regra usando o formulário.",
     "rulesOrder": "As regras são avaliadas por prioridade em ordem ascendente.",
     "rulesSubmit": "Guardar Regras",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Erro ao criar recurso",
     "resourceErrorCreateDescription": "Ocorreu um erro ao criar o recurso",
     "resourceErrorCreateMessage": "Erro ao criar recurso:",
@@ -867,16 +810,6 @@
     "pincodeAdd": "Adicionar Código PIN",
     "pincodeRemove": "Remover Código PIN",
     "resourceAuthMethods": "Métodos de Autenticação",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Permitir acesso ao recurso via métodos de autenticação adicionais",
     "resourceAuthSettingsSave": "Salvo com sucesso",
     "resourceAuthSettingsSaveDescription": "As configurações de autenticação foram salvas",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "Definir Código PIN",
     "resourcePincodeSetupTitleDescription": "Defina um código PIN para proteger este recurso",
     "resourceRoleDescription": "Administradores sempre podem aceder este recurso.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Controlos de Acesso",
     "resourceUsersRolesDescription": "Configure quais utilizadores e funções podem visitar este recurso",
     "resourceUsersRolesSubmit": "Guardar Controlos de Acesso",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "Ocorreu um problema ao ligar a {name}. Por favor, contacte o seu administrador.",
     "idpErrorNotFound": "IdP não encontrado",
     "inviteInvalid": "Convite Inválido",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "O link do convite é inválido.",
     "inviteErrorWrongUser": "O convite não é para este utilizador",
     "inviteErrorUserNotExists": "O utilizador não existe. Por favor, crie uma conta primeiro.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "Recursos",
     "sidebarProxyResources": "Público",
     "sidebarClientResources": "Privado",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Controle de Acesso",
     "sidebarLogsAndAnalytics": "Registros e Análises",
     "sidebarTeam": "Equipe",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "Site {id}",
     "standaloneHcFilterResourceIdFallback": "Recurso {id}",
     "blueprints": "Diagramas",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Aplicar configurações declarativas e ver execuções anteriores",
     "blueprintAdd": "Adicionar Diagrama",
     "blueprintGoBack": "Ver todos os Diagramas",
     "blueprintCreate": "Criar Diagrama",
@@ -1663,17 +1575,7 @@
     "contents": "Conteúdo",
     "parsedContents": "Conteúdo analisado (Somente Leitura)",
     "enableDockerSocket": "Habilitar o Diagrama Docker",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Ativar a scraping de rótulo Docker para rótulos de diagramas. Caminho de Socket deve ser fornecido para Newt.",
     "viewDockerContainers": "Ver contêineres Docker",
     "containersIn": "Contêineres em {siteName}",
     "selectContainerDescription": "Selecione qualquer contêiner para usar como hostname para este alvo. Clique em uma porta para usar uma porta.",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "Certificado",
     "certificateStatusAutoRefreshHint": "Status atualiza automaticamente.",
     "loading": "Carregando",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Carregando Analytics",
     "restart": "Reiniciar",
     "domains": "Domínios",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "Gerencie sua assinatura para as chaves de licenças auto-hospedadas pagas",
     "billingCurrentKeys": "Chaves atuais",
     "billingModifyCurrentPlan": "Modificar o Plano Atual",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Confirmar a atualização",
     "billingConfirmDowngrade": "Confirmar downgrade",
     "billingConfirmUpgradeDescription": "Você está prestes a atualizar seu plano. Revise os novos limites e preços abaixo.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "O tempo está em segundos",
     "requireDeviceApproval": "Exigir aprovação do dispositivo",
     "requireDeviceApprovalDescription": "Usuários com esta função precisam de novos dispositivos aprovados por um administrador antes que eles possam se conectar e acessar recursos.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "Acesso SSH",
     "roleAllowSsh": "Permitir SSH",
     "roleAllowSshAllow": "Autorizar",
     "roleAllowSshDisallow": "Anular",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "Usuário só pode executar os comandos especificados com sudo.",
     "sshSudo": "Permitir sudo",
     "sshSudoCommands": "Comandos Sudo",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Lista separada por vírgulas de comandos que o usuário pode executar com sudo.",
     "sshCreateHomeDir": "Criar Diretório Inicial",
     "sshUnixGroups": "Grupos Unix",
     "sshUnixGroupsDescription": "Grupos Unix separados por vírgulas para adicionar o usuário no host alvo.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Esquema",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "Ativar TLS",
     "editInternalResourceDialogEnableSslDescription": "Ativar criptografia SSL/TLS para conexões HTTPS seguras com o destino.",
     "editInternalResourceDialogDestination": "Destino",
     "editInternalResourceDialogDestinationHostDescription": "O endereço IP ou o nome do host do recurso na rede do site.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Esquema",
     "createInternalResourceDialogScheme": "Esquema",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "Ativar TLS",
     "createInternalResourceDialogEnableSslDescription": "Ativar criptografia SSL/TLS para conexões HTTPS seguras com o destino.",
     "createInternalResourceDialogDestination": "Destino",
     "createInternalResourceDialogDestinationHostDescription": "O endereço IP ou o nome do host do recurso na rede do site.",
@@ -2364,7 +2233,7 @@
         "description": "Servidor Pangolin auto-hospedado mais confiável e com baixa manutenção com sinos extras e assobiamentos",
         "introTitle": "Pangolin Auto-Hospedado Gerenciado",
         "introDescription": "é uma opção de implantação projetada para pessoas que querem simplicidade e confiança adicional, mantendo os seus dados privados e auto-hospedados.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "Com esta opção, você ainda roda seu próprio nó Pangolin - seus túneis, terminação TLS e tráfego todos permanecem no seu servidor. A diferença é que a gestão e a monitorização são geridos através do nosso painel de nuvem, que desbloqueia vários benefícios:",
         "benefitSimplerOperations": {
             "title": "Operações simples",
             "description": "Não é necessário executar o seu próprio servidor de e-mail ou configurar um alerta complexo. Você receberá fora de caixa verificações de saúde e alertas de tempo de inatividade."
@@ -3068,7 +2937,7 @@
     "learnMore": "Saiba mais",
     "backToHome": "Voltar para a página inicial",
     "needToSignInToOrg": "Precisa usar o provedor de identidade da sua organização?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Modo de Manutenção",
     "maintenanceModeDescription": "Exibir uma página de manutenção para os visitantes",
     "maintenanceModeType": "Tipo de Modo de Manutenção",
     "showMaintenancePage": "Mostrar uma página de manutenção para os visitantes",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "Conclusão Estimada:",
     "createInternalResourceDialogDestinationRequired": "Destino é obrigatório",
     "available": "Disponível",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Arquivado",
     "noArchivedDevices": "Nenhum dispositivo arquivado encontrado",
     "deviceArchived": "Dispositivo arquivado",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "Recurso Desativado",
     "memberPortalShowingResources": "Mostrando {start}-{end} de {total} recursos",
     "memberPortalPrevious": "Anterior",
-    "memberPortalNext": "Próximo",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Próximo"
 }

messages/ru-RU.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Поиск ресурсов...",
     "resourceAdd": "Добавить ресурс",
     "resourceErrorDelte": "Ошибка при удалении ресурса",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Аутентификация",
     "protected": "Защищён",
     "notProtected": "Не защищён",
     "resourceMessageRemove": "После удаления ресурс больше не будет доступен. Все целевые узлы, связанные с ресурсом, также будут удалены.",
     "resourceQuestionRemove": "Вы уверены, что хотите удалить ресурс из организации?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "HTTPS-ресурс",
     "resourceHTTPDescription": "Проксировать запросы через HTTPS с использованием полного доменного имени.",
     "resourceRaw": "Сырой TCP/UDP-ресурс",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Прокси запросы через необработанный TCP/UDP с использованием номера порта. Требуется подключение сайтов к удаленному узлу.",
     "resourceCreate": "Создание ресурса",
     "resourceCreateDescription": "Следуйте инструкциям ниже для создания нового ресурса",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Посмотреть все ресурсы",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Информация о ресурсе",
     "resourceNameDescription": "Отображаемое имя ресурса.",
     "siteSelect": "Выберите сайт",
     "siteSearch": "Поиск сайта",
@@ -254,15 +231,12 @@
     "noCountryFound": "Страна не найдена.",
     "siteSelectionDescription": "Этот сайт предоставит подключение к цели.",
     "resourceType": "Тип ресурса",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Определить как получить доступ к ресурсу",
     "resourceHTTPSSettings": "Настройки HTTPS",
     "resourceHTTPSSettingsDescription": "Настройка доступа к ресурсу по HTTPS",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Тип домена",
     "subdomain": "Поддомен",
     "baseDomain": "Базовый домен",
-    "configure": "Configure",
     "subdomnainDescription": "Поддомен, в котором ресурс будет доступен.",
     "resourceRawSettings": "Настройки TCP/UDP",
     "resourceRawSettingsDescription": "Настройка доступа к ресурсу по TCP/UDP",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "Узнайте, как настроить TCP/UDP-ресурсы",
     "resourceBack": "Назад к ресурсам",
     "resourceGoTo": "Перейти к ресурсу",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Удалить ресурс",
     "resourceDeleteConfirm": "Подтвердить удаление",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Видимость",
     "enabled": "Включено",
     "disabled": "Отключено",
@@ -310,8 +265,6 @@
     "rules": "Правила",
     "resourceSettingDescription": "Настройка параметров ресурса",
     "resourceSetting": "Настройки {resourceName}",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Авторизация байпасса",
     "alwaysDeny": "Блокировать доступ",
     "passToAuth": "Переход к аутентификации",
@@ -677,7 +630,7 @@
     "createdAt": "Создано в",
     "proxyErrorInvalidHeader": "Неверное значение пользовательского заголовка Host. Используйте формат доменного имени или оставьте пустым для сброса пользовательского заголовка Host.",
     "proxyErrorTls": "Неверное имя TLS сервера. Используйте формат доменного имени или оставьте пустым для удаления имени TLS сервера.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "Включить TLS",
     "proxyEnableSSLDescription": "Включить шифрование SSL/TLS для безопасных HTTPS соединений с целями.",
     "target": "Target",
     "configureTarget": "Настроить адресаты",
@@ -794,16 +747,6 @@
     "rulesNoOne": "Нет правил. Добавьте правило с помощью формы.",
     "rulesOrder": "Правила оцениваются по приоритету в возрастающем порядке.",
     "rulesSubmit": "Сохранить правила",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Ошибка при создании ресурса",
     "resourceErrorCreateDescription": "Произошла ошибка при создании ресурса",
     "resourceErrorCreateMessage": "Ошибка создания ресурса:",
@@ -867,16 +810,6 @@
     "pincodeAdd": "Добавить PIN-код",
     "pincodeRemove": "Удалить PIN-код",
     "resourceAuthMethods": "Методы аутентификации",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Разрешить доступ к ресурсу через дополнительные методы аутентификации",
     "resourceAuthSettingsSave": "Успешно сохранено",
     "resourceAuthSettingsSaveDescription": "Настройки аутентификации сохранены",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "Установить PIN-код",
     "resourcePincodeSetupTitleDescription": "Установите PIN-код для защиты этого ресурса",
     "resourceRoleDescription": "Администраторы всегда имеют доступ к этому ресурсу.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Контроль доступа",
     "resourceUsersRolesDescription": "Выберите пользователей и роли с доступом к этому ресурсу",
     "resourceUsersRolesSubmit": "Сохранить контроль доступа",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "Возникла проблема при подключении к {name}. Пожалуйста, свяжитесь с вашим администратором.",
     "idpErrorNotFound": "IdP не найден",
     "inviteInvalid": "Недействительное приглашение",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "Ссылка на приглашение недействительна.",
     "inviteErrorWrongUser": "Приглашение не для этого пользователя",
     "inviteErrorUserNotExists": "Пользователь не существует. Пожалуйста, сначала создайте учетную запись.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "Ресурсы",
     "sidebarProxyResources": "Публичный",
     "sidebarClientResources": "Приватный",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Контроль доступа",
     "sidebarLogsAndAnalytics": "Журналы и аналитика",
     "sidebarTeam": "Команда",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "Сайт {id}",
     "standaloneHcFilterResourceIdFallback": "Ресурс {id}",
     "blueprints": "Чертежи",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Применить декларирующие конфигурации и просмотреть предыдущие запуски",
     "blueprintAdd": "Добавить чертёж",
     "blueprintGoBack": "Посмотреть все чертежи",
     "blueprintCreate": "Создать чертёж",
@@ -1663,17 +1575,7 @@
     "contents": "Содержание",
     "parsedContents": "Переработанное содержимое (только для чтения)",
     "enableDockerSocket": "Включить чертёж Docker",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Включить scraping ярлыка Docker Socket для ярлыков чертежей. Путь к сокету должен быть предоставлен в Newt.",
     "viewDockerContainers": "Просмотр контейнеров Docker",
     "containersIn": "Контейнеры в {siteName}",
     "selectContainerDescription": "Выберите любой контейнер для использования в качестве имени хоста для этой цели. Нажмите на порт, чтобы использовать порт.",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "Сертификат",
     "certificateStatusAutoRefreshHint": "Статус обновляется автоматически.",
     "loading": "Загрузка",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Загрузка аналитики",
     "restart": "Перезагрузка",
     "domains": "Домены",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "Управление подпиской на платные лицензионные ключи собственного хостинга",
     "billingCurrentKeys": "Текущие ключи",
     "billingModifyCurrentPlan": "Изменить текущий план",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Подтвердить обновление",
     "billingConfirmDowngrade": "Подтверждение понижения",
     "billingConfirmUpgradeDescription": "Вы собираетесь обновить тарифный план. Проверьте новые лимиты и цены ниже.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "Время указано в секундах",
     "requireDeviceApproval": "Требовать подтверждения устройства",
     "requireDeviceApprovalDescription": "Пользователям с этой ролью нужны новые устройства, одобренные администратором, прежде чем они смогут подключаться и получать доступ к ресурсам.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "SSH доступ",
     "roleAllowSsh": "Разрешить SSH",
     "roleAllowSshAllow": "Разрешить",
     "roleAllowSshDisallow": "Запретить",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "Пользователь может запускать только указанные команды с помощью sudo.",
     "sshSudo": "Разрешить sudo",
     "sshSudoCommands": "Sudo Команды",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Список команд, разделенных запятыми, которые пользователю разрешено запускать с помощью sudo.",
     "sshCreateHomeDir": "Создать домашний каталог",
     "sshUnixGroups": "Unix группы",
     "sshUnixGroupsDescription": "Группы Unix через запятую, чтобы добавить пользователя на целевой хост.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "СИДР",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Схема",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "Включить TLS",
     "editInternalResourceDialogEnableSslDescription": "Включите шифрование SSL/TLS для защищенных HTTPS соединений с конечной точкой.",
     "editInternalResourceDialogDestination": "Пункт назначения",
     "editInternalResourceDialogDestinationHostDescription": "IP адрес или имя хоста ресурса в сети сайта.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "СИДР",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Схема",
     "createInternalResourceDialogScheme": "Схема",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "Включить TLS",
     "createInternalResourceDialogEnableSslDescription": "Включите SSL/TLS шифрование для защищенных HTTPS соединений с конечной точкой.",
     "createInternalResourceDialogDestination": "Пункт назначения",
     "createInternalResourceDialogDestinationHostDescription": "IP адрес или имя хоста ресурса в сети сайта.",
@@ -2364,7 +2233,7 @@
         "description": "Более надежный и низко обслуживаемый сервер Pangolin с дополнительными колокольнями и свистками",
         "introTitle": "Управляемый Само-Хост Панголина",
         "introDescription": "- это вариант развертывания, предназначенный для людей, которые хотят простоты и надёжности, сохраняя при этом свои данные конфиденциальными и самостоятельными.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "С помощью этой опции вы по-прежнему используете узел Pangolin - туннели, TLS, и весь остающийся на вашем сервере. Разница заключается в том, что управление и мониторинг осуществляются через нашу панель инструментов из облака, которая открывает ряд преимуществ:",
         "benefitSimplerOperations": {
             "title": "Более простые операции",
             "description": "Не нужно запускать свой собственный почтовый сервер или настроить комплексное оповещение. Вы будете получать проверки состояния здоровья и оповещения о неисправностях из коробки."
@@ -3068,7 +2937,7 @@
     "learnMore": "Узнать больше",
     "backToHome": "Вернуться домой",
     "needToSignInToOrg": "Нужно использовать провайдера идентификаций вашей организации?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Режим обслуживания",
     "maintenanceModeDescription": "Показать страницу обслуживания посетителям",
     "maintenanceModeType": "Тип режима обслуживания",
     "showMaintenancePage": "Показать страницу обслуживания посетителям",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "Предполагаемое завершение:",
     "createInternalResourceDialogDestinationRequired": "Укажите адрес назначения. Это может быть имя хоста или IP-адрес.",
     "available": "Доступно",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Архивировано",
     "noArchivedDevices": "Архивные устройства не найдены",
     "deviceArchived": "Устройство архивировано",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "Ресурс отключён",
     "memberPortalShowingResources": "Показаны {start}-{end} из {total} ресурсов",
     "memberPortalPrevious": "Предыдущий",
-    "memberPortalNext": "Следующий",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Следующий"
 }

messages/tr-TR.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "Kaynakları ara...",
     "resourceAdd": "Kaynak Ekle",
     "resourceErrorDelte": "Kaynak silinirken hata",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "Kimlik Doğrulama",
     "protected": "Korunan",
     "notProtected": "Korunmayan",
     "resourceMessageRemove": "Kaldırıldıktan sonra kaynak artık erişilebilir olmayacaktır. Kaynakla ilişkili tüm hedefler de kaldırılacaktır.",
     "resourceQuestionRemove": "Kaynağı organizasyondan kaldırmak istediğinizden emin misiniz?",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "HTTPS Kaynağı",
     "resourceHTTPDescription": "Tam nitelikli bir etki alanı adı kullanarak HTTPS üzerinden proxy isteklerini yönlendirin.",
     "resourceRaw": "Ham TCP/UDP Kaynağı",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "Proxy isteklerini bir port numarası kullanarak ham TCP/UDP üzerinden yapın. Sitelerin uzak bir düğüme bağlanması gereklidir.",
     "resourceCreate": "Kaynak Oluştur",
     "resourceCreateDescription": "Yeni bir kaynak oluşturmak için aşağıdaki adımları izleyin",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "Tüm Kaynakları Gör",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "Kaynak Bilgilendirmesi",
     "resourceNameDescription": "Bu, kaynak için görünen addır.",
     "siteSelect": "Site seç",
     "siteSearch": "Site ara",
@@ -254,15 +231,12 @@
     "noCountryFound": "Ülke bulunamadı.",
     "siteSelectionDescription": "Bu site hedefe bağlantı sağlayacaktır.",
     "resourceType": "Kaynak Türü",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "Kaynağınıza nasıl erişmek istediğinizi belirleyin",
     "resourceHTTPSSettings": "HTTPS Ayarları",
     "resourceHTTPSSettingsDescription": "Kaynağınıza HTTPS üzerinden erişimin nasıl sağlanacağını yapılandırın",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "Alan Türü",
     "subdomain": "Alt Alan Adı",
     "baseDomain": "Temel Alan Adı",
-    "configure": "Configure",
     "subdomnainDescription": "Kaynağınızın erişilebileceği alt alan adı.",
     "resourceRawSettings": "TCP/UDP Ayarları",
     "resourceRawSettingsDescription": "Kaynaklara TCP/UDP üzerinden nasıl erişileceğini yapılandırın",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "TCP/UDP kaynaklarını nasıl yapılandıracağınızı öğrenin",
     "resourceBack": "Kaynaklara Geri Dön",
     "resourceGoTo": "Kaynağa Git",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "Kaynağı Sil",
     "resourceDeleteConfirm": "Kaynak Silmeyi Onayla",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "Görünürlük",
     "enabled": "Etkin",
     "disabled": "Devre Dışı",
@@ -310,8 +265,6 @@
     "rules": "Kurallar",
     "resourceSettingDescription": "Kaynağınızdaki ayarları yapılandırın",
     "resourceSetting": "{resourceName} Ayarları",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "Kimlik Doğrulamayı Atla",
     "alwaysDeny": "Erişimi Engelle",
     "passToAuth": "Kimlik Doğrulamasına Geç",
@@ -677,7 +630,7 @@
     "createdAt": "Oluşturulma Tarihi",
     "proxyErrorInvalidHeader": "Geçersiz özel Ana Bilgisayar Başlığı değeri. Alan adı formatını kullanın veya özel Ana Bilgisayar Başlığını ayarlamak için boş bırakın.",
     "proxyErrorTls": "Geçersiz TLS Sunucu Adı. Alan adı formatını kullanın veya TLS Sunucu Adını kaldırmak için boş bırakılsın.",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "TLS Etkinleştir",
     "proxyEnableSSLDescription": "Hedeflere güvenli HTTPS bağlantıları için SSL/TLS şifrelemesini etkinleştirin.",
     "target": "Hedef",
     "configureTarget": "Hedefleri Yapılandır",
@@ -794,16 +747,6 @@
     "rulesNoOne": "Kural yok. Formu kullanarak bir kural ekleyin.",
     "rulesOrder": "Kurallar, artan öncelik sırasına göre değerlendirilir.",
     "rulesSubmit": "Kuralları Kaydet",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "Kaynak oluşturma hatası",
     "resourceErrorCreateDescription": "Kaynak oluşturulurken bir hata oluştu",
     "resourceErrorCreateMessage": "Kaynak oluşturma hatası:",
@@ -867,16 +810,6 @@
     "pincodeAdd": "PIN Kodu Ekle",
     "pincodeRemove": "PIN Kodu Kaldır",
     "resourceAuthMethods": "Kimlik Doğrulama Yöntemleri",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "Ek kimlik doğrulama yöntemleriyle kaynağa erişime izin verin",
     "resourceAuthSettingsSave": "Başarıyla kaydedildi",
     "resourceAuthSettingsSaveDescription": "Kimlik doğrulama ayarları kaydedildi",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "Pincode Ayarla",
     "resourcePincodeSetupTitleDescription": "Bu kaynağı korumak için bir pincode ayarlayın",
     "resourceRoleDescription": "Yöneticiler her zaman bu kaynağa erişebilir.",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "Erişim Kontrolleri",
     "resourceUsersRolesDescription": "Bu kaynağı kimlerin ziyaret edebileceği kullanıcıları ve rolleri yapılandırın",
     "resourceUsersRolesSubmit": "Erişim Kontrollerini Kaydet",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "{name} ile bağlantı kurarken bir sorun meydana geldi. Lütfen yöneticiye danışın.",
     "idpErrorNotFound": "IdP bulunamadı",
     "inviteInvalid": "Geçersiz Davet",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "Davet bağlantısı geçersiz.",
     "inviteErrorWrongUser": "Davet bu kullanıcı için değil",
     "inviteErrorUserNotExists": "Kullanıcı mevcut değil. Lütfen önce bir hesap oluşturun.",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "Kaynaklar",
     "sidebarProxyResources": "Herkese Açık",
     "sidebarClientResources": "Özel",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "Erişim Kontrolü",
     "sidebarLogsAndAnalytics": "Kayıtlar & Analitik",
     "sidebarTeam": "Ekip",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "Site {id}",
     "standaloneHcFilterResourceIdFallback": "Kaynak {id}",
     "blueprints": "Planlar",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "Deklaratif yapılandırmaları uygulayın ve önceki çalışmaları görüntüleyin",
     "blueprintAdd": "Plan Ekle",
     "blueprintGoBack": "Tüm Planları Gör",
     "blueprintCreate": "Plan Oluştur",
@@ -1663,17 +1575,7 @@
     "contents": "İçerik",
     "parsedContents": "Verilerin Ayrıştırılmış İçeriği (Salt Okunur)",
     "enableDockerSocket": "Docker Soketini Etkinleştir",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "Plan etiketleri için Docker Socket etiket toplamasını etkinleştirin. Newt'e soket yolu sağlanmalıdır.",
     "viewDockerContainers": "Docker Konteynerlerini Görüntüle",
     "containersIn": "{siteName} içindeki konteynerler",
     "selectContainerDescription": "Bu hedef için bir ana bilgisayar adı olarak kullanmak üzere herhangi bir konteyner seçin. Bir bağlantı noktası kullanmak için bir bağlantı noktasına tıklayın.",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "Sertifika",
     "certificateStatusAutoRefreshHint": "Durum otomatik olarak yenilenir.",
     "loading": "Yükleniyor",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "Analiz Yükleniyor",
     "restart": "Yeniden Başlat",
     "domains": "Alan Adları",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "Kendi barındırdığınız ücretli lisans anahtarları için aboneliğinizi yönetin",
     "billingCurrentKeys": "Mevcut Anahtarlar",
     "billingModifyCurrentPlan": "Mevcut Planı Düzenle",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "Yükseltmeyi Onayla",
     "billingConfirmDowngrade": "Düşürmeyi Onayla",
     "billingConfirmUpgradeDescription": "Planınızı yükseltmek üzeresiniz. Yeni limitleri ve fiyatları aşağıda inceleyin.",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "Zaman saniye cinsindendir",
     "requireDeviceApproval": "Cihaz Onaylarını Gerektir",
     "requireDeviceApprovalDescription": "Bu role sahip kullanıcıların yeni cihazlarının bağlanabilmesi ve kaynaklara erişebilmesi için bir yönetici tarafından onaylanması gerekiyor.",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "SSH Erişimi",
     "roleAllowSsh": "SSH'a İzin Ver",
     "roleAllowSshAllow": "İzin Ver",
     "roleAllowSshDisallow": "İzin Verme",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "Kullanıcı sadece belirtilen komutları sudo ile çalıştırabilir.",
     "sshSudo": "Sudo'ya izin ver",
     "sshSudoCommands": "Sudo Komutları",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "Kullanıcının sudo ile çalıştırmasına izin verilen komutların virgülle ayrılmış listesi.",
     "sshCreateHomeDir": "Ev Dizini Oluştur",
     "sshUnixGroups": "Unix Grupları",
     "sshUnixGroupsDescription": "Hedef konakta kullanıcıya eklenecek Unix gruplarının virgülle ayrılmış listesi.",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "Şema",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "TLS Etkinleştir",
     "editInternalResourceDialogEnableSslDescription": "Hedefe güvenli HTTPS bağlantıları için SSL/TLS şifrelemeyi etkinleştirin.",
     "editInternalResourceDialogDestination": "Hedef",
     "editInternalResourceDialogDestinationHostDescription": "Site ağındaki kaynağın IP adresi veya ana bilgisayar adı.",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "Şema",
     "createInternalResourceDialogScheme": "Şema",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "TLS'yi Etkinleştir",
     "createInternalResourceDialogEnableSslDescription": "Hedefe güvenli HTTPS bağlantıları için SSL/TLS şifrelemeyi etkinleştirin.",
     "createInternalResourceDialogDestination": "Hedef",
     "createInternalResourceDialogDestinationHostDescription": "Site ağındaki kaynağın IP adresi veya ana bilgisayar adı.",
@@ -2364,7 +2233,7 @@
         "description": "Daha güvenilir ve düşük bakım gerektiren, ekstra özelliklere sahip kendi kendine barındırabileceğiniz Pangolin sunucusu",
         "introTitle": "Yönetilen Kendi Kendine Barındırılan Pangolin",
         "introDescription": "Bu, basitlik ve ekstra güvenilirlik arayan, ancak verilerini gizli tutmak ve kendi sunucularında barındırmak isteyen kişiler için tasarlanmış bir dağıtım seçeneğidir.",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "Bu seçenekle, kendi Pangolin düğümünüzü çalıştırmaya devam edersiniz - tünelleriniz, TLS bitişiniz ve trafiğiniz tamamen sunucunuzda kalır. Fark, yönetim ve izlemeyi bulut panomuz üzerinden gerçekleştiririz, bu da bir dizi avantaj sağlar:",
         "benefitSimplerOperations": {
             "title": "Daha basit işlemler",
             "description": "Kendi e-posta sunucunuzu çalıştırmanıza veya karmaşık uyarılar kurmanıza gerek yok. Sağlık kontrolleri ve kesinti uyarılarını kutudan çıktığı gibi alırsınız."
@@ -3068,7 +2937,7 @@
     "learnMore": "Daha fazla bilgi",
     "backToHome": "Ana sayfaya geri dön",
     "needToSignInToOrg": "Kuruluşunuzun kimlik sağlayıcısını kullanmanız mı gerekiyor?",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "Bakım Modu",
     "maintenanceModeDescription": "Ziyaretçilere bir bakım sayfası gösterin",
     "maintenanceModeType": "Bakım Modu Türü",
     "showMaintenancePage": "Ziyaretçilere bir bakım sayfası gösterin",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "Tahmini Tamamlama:",
     "createInternalResourceDialogDestinationRequired": "Hedef gereklidir",
     "available": "Mevcut",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "Arşivlenmiş",
     "noArchivedDevices": "Arşivlenmiş cihaz bulunamadı",
     "deviceArchived": "Cihaz arşivlendi",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "Kaynak Devre Dışı",
     "memberPortalShowingResources": "{total} kaynaktan {start}-{end} gösteriliyor",
     "memberPortalPrevious": "Önceki",
-    "memberPortalNext": "Sonraki",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "Sonraki"
 }

messages/zh-CN.json

@@ -208,33 +208,11 @@
     "resourcesSearch": "搜索资源...",
     "resourceAdd": "添加资源",
     "resourceErrorDelte": "删除资源时出错",
-    "resourcePoliciesTitle": "Manage Resource Policies",
-    "resourcePoliciesAttachedResourcesColumnTitle": "Attached resources",
-    "resourcePoliciesAttachedResources": "{count} resource(s)",
-    "resourcePoliciesAttachedResourcesEmpty": "no resources",
-    "resourcePoliciesDescription": "Create and manage authentication policies to control access to your resources",
-    "resourcePoliciesSearch": "Search policies...",
-    "resourcePoliciesAdd": "Add Policy",
-    "resourcePoliciesDefaultBadgeText": "Default policy",
-    "resourcePoliciesCreate": "Create Resource Policy",
-    "resourcePoliciesCreateDescription": "Follow the steps below to create a new policy",
-    "resourcePolicyName": "Policy Name",
-    "resourcePolicyNameDescription": "Give this policy a name to identify it across your resources",
-    "resourcePolicyNamePlaceholder": "e.g. Internal Access Policy",
-    "resourcePoliciesSeeAll": "See All Policies",
-    "resourcePolicyAuthMethodAdd": "Add Authentication Method",
-    "resourcePolicyOtpEmailAdd": "Add OTP emails",
-    "resourcePolicyRulesAdd": "Add Rules",
-    "resourcePolicyAuthMethodsDescription": "Allow access to resources via additional auth methods",
-    "resourcePolicyUsersRolesDescription": "Configure which users and roles can visit associated resources",
-    "rulesResourcePolicyDescription": "Configure rules to control access resources associated to this policy",
     "authentication": "认证",
     "protected": "受到保护",
     "notProtected": "未受到保护",
     "resourceMessageRemove": "一旦删除，资源将不再可访问。与该资源相关的所有目标也将被删除。",
     "resourceQuestionRemove": "您确定要从组织中删除资源吗？",
-    "resourcePolicyMessageRemove": "Once removed, the resource policy will no longer be accessible. All resources associated with the resource will be unlinked and left without authentication.",
-    "resourcePolicyQuestionRemove": "Are you sure you want to remove the resource policy from the organization?",
     "resourceHTTP": "HTTPS 资源",
     "resourceHTTPDescription": "通过使用完全限定的域名的HTTPS代理请求。",
     "resourceRaw": "TCP/UDP 资源",
@@ -242,9 +220,8 @@
     "resourceRawDescriptionCloud": "正在使用端口号使用 TCP/UDP 代理请求。需要站点连接到远程节点。",
     "resourceCreate": "创建资源",
     "resourceCreateDescription": "按照下面的步骤创建新资源",
-    "resourceCreateGeneralDescription": "Configure the basic resource settings including the name and the type",
     "resourceSeeAll": "查看所有资源",
-    "resourceCreateGeneral": "General",
+    "resourceInfo": "资源信息",
     "resourceNameDescription": "这是资源的显示名称。",
     "siteSelect": "选择站点",
     "siteSearch": "搜索站点",
@@ -254,15 +231,12 @@
     "noCountryFound": "找不到国家。",
     "siteSelectionDescription": "此站点将为目标提供连接。",
     "resourceType": "资源类型",
-    "resourceTypeDescription": "This controls the resource protocol and how it will be rendered in the browser. This can’t be changed later.",
-    "resourceDomainDescription": "The resource will be served at this fully qualified domain name.",
+    "resourceTypeDescription": "确定如何访问资源",
     "resourceHTTPSSettings": "HTTPS 设置",
     "resourceHTTPSSettingsDescription": "配置如何通过 HTTPS 访问资源",
-    "resourcePortDescription": "The external port on the Pangolin instance or node where the resource will be accessible.",
     "domainType": "域类型",
     "subdomain": "子域名",
     "baseDomain": "根域名",
-    "configure": "Configure",
     "subdomnainDescription": "可访问资源的子域。",
     "resourceRawSettings": "TCP/UDP 设置",
     "resourceRawSettingsDescription": "配置如何通过 TCP/UDP 访问资源",
@@ -279,27 +253,8 @@
     "resourceLearnRaw": "学习如何配置 TCP/UDP 资源",
     "resourceBack": "返回资源",
     "resourceGoTo": "转到资源",
-    "resourcePolicyDelete": "Delete Resource Policy",
-    "resourcePolicyDeleteConfirm": "Confirm Delete Resource Policy",
     "resourceDelete": "删除资源",
     "resourceDeleteConfirm": "确认删除资源",
-    "labelDelete": "Delete Label",
-    "labelAdd": "Add Label",
-    "labelCreateSuccessMessage": "Label Created Successfully",
-    "labelEditSuccessMessage": "Label Modified Successfully",
-    "labelNameField": "Label Name",
-    "labelColorField": "Label Color",
-    "labelPlaceholder": "Ex: homelab",
-    "labelCreate": "Create Label",
-    "createLabelDialogTitle": "Create Label",
-    "createLabelDialogDescription": "Create a new label that can be attached to this organization",
-    "labelEdit": "Edit Label",
-    "editLabelDialogTitle": "Update Label",
-    "editLabelDialogDescription": "Edit a new label that can be attached to this organization",
-    "labelDeleteConfirm": "Confirm Delete Label",
-    "labelErrorDelete": "Failed to delete label",
-    "labelMessageRemove": "This action is permanent. All sites, resources, and clients tagged with this label will be untagged.",
-    "labelQuestionRemove": "Are you sure you want to remove the label from the organization?",
     "visibility": "可见性",
     "enabled": "已启用",
     "disabled": "已禁用",
@@ -310,8 +265,6 @@
     "rules": "规则",
     "resourceSettingDescription": "配置资源上的设置",
     "resourceSetting": "{resourceName} 设置",
-    "resourcePolicySettingDescription": "Configure the settings on the resource policy",
-    "resourcePolicySetting": "{policyName} Settings",
     "alwaysAllow": "旁路认证",
     "alwaysDeny": "屏蔽访问",
     "passToAuth": "传递至认证",
@@ -677,7 +630,7 @@
     "createdAt": "创建于",
     "proxyErrorInvalidHeader": "无效的自定义主机头值。使用域名格式，或将空保存为取消自定义主机头。",
     "proxyErrorTls": "无效的 TLS 服务器名称。使用域名格式，或保存空以删除 TLS 服务器名称。",
-    "proxyEnableSSL": "Enable TLS",
+    "proxyEnableSSL": "启用 TLS",
     "proxyEnableSSLDescription": "启用 SSL/TLS 加密以确保目标的 HTTPS 连接。",
     "target": "Target",
     "configureTarget": "配置目标",
@@ -794,16 +747,6 @@
     "rulesNoOne": "没有规则。使用表单添加规则。",
     "rulesOrder": "规则按优先顺序评定。",
     "rulesSubmit": "保存规则",
-    "policyErrorCreate": "Error creating policy",
-    "policyErrorCreateDescription": "An error occurred when creating the policy",
-    "policyErrorCreateMessageDescription": "An unexpected error occurred",
-    "policyErrorUpdate": "Error updating policy",
-    "policyErrorUpdateDescription": "An error occurred when updating the policy",
-    "policyErrorUpdateMessageDescription": "An unexpected error occurred",
-    "policyCreatedSuccess": "Resource policy succesfully created",
-    "policyUpdatedSuccess": "Resource policy succesfully updated",
-    "authMethodsSave": "Save auth methods",
-    "rulesSave": "Save Rules",
     "resourceErrorCreate": "创建资源时出错",
     "resourceErrorCreateDescription": "创建资源时出错",
     "resourceErrorCreateMessage": "创建资源时发生错误：",
@@ -867,16 +810,6 @@
     "pincodeAdd": "添加 PIN 码",
     "pincodeRemove": "移除 PIN 码",
     "resourceAuthMethods": "身份验证方法",
-    "resourcePolicyAuthMethodsEmpty": "No authentication method",
-    "resourcePolicyOtpEmpty": "No one time password",
-    "resourcePolicyReadOnly": "This policy is Read only",
-    "resourcePolicyReadOnlyDescription": "This resource policy is shared accross multiple resources, you cannot edit it on this page.",
-    "resourcePolicyTypeSave": "Save Resource type",
-    "resourcePolicySelect": "Select resource policy",
-    "resourcePolicySelectError": "Select a resource policy",
-    "resourcePolicyNotFound": "Policy not found",
-    "resourcePolicySearch": "Search policies",
-    "resourcePolicyRulesEmpty": "No authentication rules",
     "resourceAuthMethodsDescriptions": "允许通过额外的认证方法访问资源",
     "resourceAuthSettingsSave": "保存成功",
     "resourceAuthSettingsSaveDescription": "已保存身份验证设置",
@@ -912,12 +845,6 @@
     "resourcePincodeSetupTitle": "设置 PIN 码",
     "resourcePincodeSetupTitleDescription": "设置 PIN 码来保护此资源",
     "resourceRoleDescription": "管理员总是可以访问此资源。",
-    "resourcePolicySelectTitle": "Resource Access Policy",
-    "resourcePolicySelectDescription": "Select the resource policy type for authentication",
-    "resourcePolicyInline": "Inline Resource Policy",
-    "resourcePolicyInlineDescription": "Access Policy scoped to only this resource",
-    "resourcePolicyShared": "Shared Resource Policy",
-    "resourcePolicySharedDescription": "Access Policy shared accross multiple resources",
     "resourceUsersRoles": "访问控制",
     "resourceUsersRolesDescription": "配置用户和角色可以访问此资源",
     "resourceUsersRolesSubmit": "保存访问控制",
@@ -1213,18 +1140,6 @@
     "idpErrorConnectingTo": "无法连接到 {name}，请联系管理员协助处理。",
     "idpErrorNotFound": "找不到 IdP",
     "inviteInvalid": "无效邀请",
-    "labels": "Labels",
-    "orgLabelsDescription": "Manage labels in this organization.",
-    "addLabels": "Add labels",
-    "siteLabelsTab": "Labels",
-    "siteLabelsDescription": "Manage labels associated with this site.",
-    "labelsNotFound": "Labels not found",
-    "labelSearch": "Search labels",
-    "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
-    "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
-    "accessLabelFilterClear": "Clear label filters",
-    "selectColor": "Select color",
-    "createNewLabel": "Create new org label \"{label}\"",
     "inviteInvalidDescription": "邀请链接无效。",
     "inviteErrorWrongUser": "邀请不是该用户的",
     "inviteErrorUserNotExists": "用户不存在。请先创建帐户。",
@@ -1459,8 +1374,6 @@
     "sidebarResources": "资源",
     "sidebarProxyResources": "公开的",
     "sidebarClientResources": "非公开的",
-    "sidebarPolicies": "Policies",
-    "sidebarResourcePolicies": "Resources",
     "sidebarAccessControl": "访问控制",
     "sidebarLogsAndAnalytics": "日志与分析",
     "sidebarTeam": "团队",
@@ -1644,8 +1557,7 @@
     "standaloneHcFilterSiteIdFallback": "站点 {id}",
     "standaloneHcFilterResourceIdFallback": "资源 {id}",
     "blueprints": "蓝图",
-    "blueprintsLog": "Blueprints Log",
-    "blueprintsDescription": "View past blueprint applications and their results",
+    "blueprintsDescription": "应用声明配置并查看先前运行的",
     "blueprintAdd": "添加蓝图",
     "blueprintGoBack": "查看所有蓝图",
     "blueprintCreate": "创建蓝图",
@@ -1663,17 +1575,7 @@
     "contents": "目录",
     "parsedContents": "解析内容 (只读)",
     "enableDockerSocket": "启用 Docker 蓝图",
-    "enableDockerSocketDescription": "Enable Docker Socket label scraping for blueprint labels. Socket path must be provided to the site connector. Read about how this works in <docsLink>the documentation</docsLink>.",
-    "newtAutoUpdate": "Enable Site Auto-Update",
-    "newtAutoUpdateDescription": "When enabled, site connectors will automatically update to the latest version when a new release is available.",
-    "siteAutoUpdate": "Site Auto-Update",
-    "siteAutoUpdateLabel": "Enable Auto-Update",
-    "siteAutoUpdateDescription": "Control whether this site's connector automatically downloads the latest version.",
-    "siteAutoUpdateOrgDefault": "Organization default: {state}",
-    "siteAutoUpdateOverriding": "Overriding organization setting",
-    "siteAutoUpdateResetToOrg": "Reset to Organization Default",
-    "siteAutoUpdateEnabled": "enabled",
-    "siteAutoUpdateDisabled": "disabled",
+    "enableDockerSocketDescription": "启用 Docker Socket 标签擦除蓝图标签。套接字路径必须提供给新的。",
     "viewDockerContainers": "查看停靠容器",
     "containersIn": "{siteName} 中的容器",
     "selectContainerDescription": "选择任何容器作为目标的主机名。点击端口使用端口。",
@@ -1718,7 +1620,6 @@
     "certificateStatus": "证书",
     "certificateStatusAutoRefreshHint": "状态自动刷新。",
     "loading": "加载中",
-    "loadingEllipsis": "Loading...",
     "loadingAnalytics": "加载分析",
     "restart": "重启",
     "domains": "域",
@@ -1945,7 +1846,6 @@
     "billingManageLicenseSubscription": "管理您对付费的自托管许可证密钥的订阅",
     "billingCurrentKeys": "当前密钥",
     "billingModifyCurrentPlan": "修改当前计划",
-    "billingManageLicenseSubscriptionDescription": "Manage your subscription for paid self-hosted license keys and download invoices.",
     "billingConfirmUpgrade": "确认升级",
     "billingConfirmDowngrade": "确认降级",
     "billingConfirmUpgradeDescription": "您即将升级您的计划。请检查下面的新限额和定价。",
@@ -2043,36 +1943,7 @@
     "timeIsInSeconds": "时间以秒为单位",
     "requireDeviceApproval": "需要设备批准",
     "requireDeviceApprovalDescription": "具有此角色的用户需要管理员批准的新设备才能连接和访问资源。",
-    "sshSettings": "SSH Settings",
-    "rdpSettings": "RDP Settings",
-    "vncSettings": "VNC Settings",
-    "sshServer": "SSH Server",
-    "rdpServer": "RDP Server",
-    "vncServer": "VNC Server",
-    "sshServerDescription": "Set up the authentication method, daemon location, and server destination",
-    "rdpServerDescription": "Configure the destination and port of the RDP server",
-    "vncServerDescription": "Configure the destination and port of the VNC server",
-    "sshServerMode": "Mode",
-    "sshServerModeStandard": "Standard SSH Server",
-    "sshServerModePangolin": "Pangolin SSH",
-    "sshServerModeStandardDescription": "Routes commands over network to an SSH server such as OpenSSH.",
-    "sshServerModeNative": "Native SSH Server",
-    "sshServerModeNativeDescription": "Executes commands directly on the host via the Site Connector. No network config required.",
-    "sshAuthenticationMethod": "Authentication Method",
-    "sshAuthMethodManual": "Manual Authentication",
-    "sshAuthMethodManualDescription": "Requires existing host credentials. Bypasses automatic provisioning.",
-    "sshAuthMethodAutomated": "Automated Provisioning",
-    "sshAuthMethodAutomatedDescription": "Automatically creates users, groups, and sudo permissions on host.",
-    "sshAuthDaemonLocation": "Auth Daemon Location",
-    "sshDaemonLocationSiteDescription": "Executes locally on the machine hosting the site connector.",
-    "sshDaemonLocationRemote": "On Remote Host",
-    "sshDaemonLocationRemoteDescription": "Executes on a separate target machine on the same network.",
-    "sshDaemonDisclaimer": "Ensure your target host is properly configured to run the auth daemon before completing this setup, or provisioning will fail.",
-    "sshDaemonPort": "Daemon Port",
-    "sshServerDestination": "Server Destination",
-    "sshServerDestinationDescription": "Configure the destination and port of the SSH server",
-    "destination": "Destination",
-    "bgTargetMultiSiteDisclaimer": "Selecting multiple sites enables resilient routing and failover for high availability.",
+    "sshAccess": "SSH 访问",
     "roleAllowSsh": "允许 SSH",
     "roleAllowSshAllow": "允许",
     "roleAllowSshDisallow": "不允许",
@@ -2086,7 +1957,7 @@
     "sshSudoModeCommandsDescription": "用户只能用 sudo 运行指定的命令。",
     "sshSudo": "允许Sudo",
     "sshSudoCommands": "Sudo 命令",
-    "sshSudoCommandsDescription": "Comma separated list of commands the user is allowed to run with sudo. Absolute paths must be used.",
+    "sshSudoCommandsDescription": "逗号分隔的用户允许使用 sudo 运行的命令列表。",
     "sshCreateHomeDir": "创建主目录",
     "sshUnixGroups": "Unix 组",
     "sshUnixGroupsDescription": "用逗号分隔了Unix组，将用户添加到目标主机上。",
@@ -2178,9 +2049,8 @@
     "editInternalResourceDialogModeCidr": "CIDR",
     "editInternalResourceDialogModeHttp": "HTTP",
     "editInternalResourceDialogModeHttps": "HTTPS",
-    "editInternalResourceDialogModeSsh": "SSH",
     "editInternalResourceDialogScheme": "方案",
-    "editInternalResourceDialogEnableSsl": "Enable TLS",
+    "editInternalResourceDialogEnableSsl": "启用 TLS",
     "editInternalResourceDialogEnableSslDescription": "为目标的安全 HTTPS 连接启用 SSL/TLS 加密。",
     "editInternalResourceDialogDestination": "目标",
     "editInternalResourceDialogDestinationHostDescription": "站点网络上资源的 IP 地址或主机名。",
@@ -2228,10 +2098,9 @@
     "createInternalResourceDialogModeCidr": "CIDR",
     "createInternalResourceDialogModeHttp": "HTTP",
     "createInternalResourceDialogModeHttps": "HTTPS",
-    "createInternalResourceDialogModeSsh": "SSH",
     "scheme": "方案",
     "createInternalResourceDialogScheme": "方案",
-    "createInternalResourceDialogEnableSsl": "Enable TLS",
+    "createInternalResourceDialogEnableSsl": "启用 TLS",
     "createInternalResourceDialogEnableSslDescription": "为目标的安全 HTTPS 连接启用 SSL/TLS 加密。",
     "createInternalResourceDialogDestination": "目标",
     "createInternalResourceDialogDestinationHostDescription": "站点网络上资源的 IP 地址或主机名。",
@@ -2364,7 +2233,7 @@
         "description": "更可靠和低维护自我托管的 Pangolin 服务器，带有额外的铃声和告密器",
         "introTitle": "托管自托管的潘戈林公司",
         "introDescription": "这是一种部署选择，为那些希望简洁和额外可靠的人设计，同时仍然保持他们的数据的私密性和自我托管性。",
-        "introDetail": "With this option, you still run your own Pangolin node - your tunnels, TLS termination, and traffic all stay on your server. The difference is that management and monitoring are handled through our cloud dashboard, which unlocks a number of benefits:",
+        "introDetail": "通过此选项，您仍然运行您自己的 Pangolin 节点 - - 您的隧道、TLS 终止，并且流量在您的服务器上保持所有状态。 不同之处在于，管理和监测是通过我们的云层仪表板进行的，该仪表板开启了一些好处：",
         "benefitSimplerOperations": {
             "title": "简单的操作",
             "description": "无需运行您自己的邮件服务器或设置复杂的警报。您将从方框中获得健康检查和下限提醒。"
@@ -3068,7 +2937,7 @@
     "learnMore": "了解更多",
     "backToHome": "返回首页",
     "needToSignInToOrg": "需要使用您组织的身份提供商吗？",
-    "maintenanceMode": "Maintenance Page",
+    "maintenanceMode": "维护模式",
     "maintenanceModeDescription": "向访客显示维护页面",
     "maintenanceModeType": "维护模式类型",
     "showMaintenancePage": "只在所有后端目标都故障或不健康时显示维护页面。只要至少一个目标健康，您的资源将正常工作。",
@@ -3098,7 +2967,6 @@
     "maintenanceScreenEstimatedCompletion": "预计完成时间：",
     "createInternalResourceDialogDestinationRequired": "需要目标地址",
     "available": "可用",
-    "disabledResourceDescription": "When disabled, the resource will be inaccessible by everyone.",
     "archived": "已存档",
     "noArchivedDevices": "未找到存档设备",
     "deviceArchived": "设备已存档",
@@ -3428,6 +3296,5 @@
     "memberPortalResourceDisabled": "资源已禁用",
     "memberPortalShowingResources": "显示 {start}-{end} 共 {total} 个资源",
     "memberPortalPrevious": "上一页",
-    "memberPortalNext": "下一页",
-    "httpSettings": "HTTP Settings"
+    "memberPortalNext": "下一页"
 }

next.config.ts

@@ -6,7 +6,6 @@ const withNextIntl = createNextIntlPlugin();
 const nextConfig: NextConfig = {
     reactStrictMode: false,
     reactCompiler: true,
-    transpilePackages: ["@novnc/novnc"],
     output: "standalone"
 };
 

package.json

@@ -34,13 +34,11 @@
     "dependencies": {
         "@asteasolutions/zod-to-openapi": "8.5.0",
         "@aws-sdk/client-s3": "3.1047.0",
+        "@faker-js/faker": "10.4.0",
         "@headlessui/react": "2.2.10",
-        "@devolutions/iron-remote-desktop": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-0.0.0.tgz",
-        "@devolutions/iron-remote-desktop-rdp": "https://static.pangolin.net/packages/devolutions-iron-remote-desktop-rdp-0.0.0.tgz",
         "@hookform/resolvers": "5.2.2",
         "@monaco-editor/react": "4.7.0",
         "@node-rs/argon2": "2.0.2",
-        "@novnc/novnc": "^1.7.0",
         "@oslojs/crypto": "1.0.1",
         "@oslojs/encoding": "1.1.0",
         "@radix-ui/react-avatar": "1.1.11",
@@ -66,13 +64,10 @@
         "@react-email/render": "2.0.8",
         "@react-email/tailwind": "2.0.7",
         "@simplewebauthn/browser": "13.3.0",
-        "@simplewebauthn/server": "13.3.1",
+        "@simplewebauthn/server": "13.3.0",
         "@tailwindcss/forms": "0.5.11",
-        "@tanstack/react-query": "5.100.14",
+        "@tanstack/react-query": "5.100.10",
         "@tanstack/react-table": "8.21.3",
-        "@xterm/addon-fit": "^0.11.0",
-        "@xterm/addon-web-links": "^0.12.0",
-        "@xterm/xterm": "^6.0.0",
         "arctic": "3.7.0",
         "axios": "1.16.1",
         "better-sqlite3": "11.9.1",
@@ -103,7 +98,7 @@
         "next-themes": "0.4.6",
         "nextjs-toploader": "3.9.17",
         "node-cache": "5.1.2",
-        "nodemailer": "8.0.9",
+        "nodemailer": "8.0.7",
         "oslo": "1.2.1",
         "pg": "8.20.0",
         "posthog-node": "5.34.1",
@@ -116,7 +111,8 @@
         "react-icons": "5.6.0",
         "recharts": "3.8.1",
         "reodotdev": "1.1.0",
-        "semver": "7.8.1",
+        "resend": "6.12.3",
+        "semver": "7.8.0",
         "sshpk": "1.18.0",
         "stripe": "20.4.1",
         "swagger-ui-express": "5.0.1",
@@ -136,9 +132,9 @@
         "zod-validation-error": "5.0.0"
     },
     "devDependencies": {
-        "@dotenvx/dotenvx": "1.69.1",
+        "@dotenvx/dotenvx": "1.66.0",
         "@esbuild-plugins/tsconfig-paths": "0.1.2",
-        "@react-email/ui": "^6.5.0",
+        "@react-email/ui": "^6.1.4",
         "@tailwindcss/postcss": "4.3.0",
         "@tanstack/react-query-devtools": "5.100.10",
         "@types/better-sqlite3": "7.6.13",
@@ -151,7 +147,7 @@
         "@types/jmespath": "0.15.2",
         "@types/js-yaml": "4.0.9",
         "@types/jsonwebtoken": "9.0.10",
-        "@types/node": "25.9.1",
+        "@types/node": "25.8.0",
         "@types/nodemailer": "8.0.0",
         "@types/nprogress": "0.2.3",
         "@types/pg": "8.20.0",
@@ -167,16 +163,16 @@
         "drizzle-kit": "0.31.10",
         "esbuild": "0.28.0",
         "esbuild-node-externals": "1.22.0",
-        "eslint": "10.4.0",
+        "eslint": "10.3.0",
         "eslint-config-next": "16.2.6",
         "postcss": "8.5.14",
         "prettier": "3.8.3",
-        "react-email": "6.5.0",
+        "react-email": "6.1.4",
         "tailwindcss": "4.3.0",
         "tsc-alias": "1.8.17",
         "tsx": "4.22.0",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.60.0"
+        "typescript-eslint": "8.59.3"
     },
     "overrides": {
         "esbuild": "0.28.0",

server/auth/actions.ts

@@ -5,7 +5,6 @@ import { and, eq, inArray } from "drizzle-orm";
 import createHttpError from "http-errors";
 import HttpCode from "@server/types/HttpCode";
 import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-import logger from "@server/logger";
 
 export enum ActionsEnum {
     createOrgUser = "createOrgUser",
@@ -159,26 +158,7 @@ export enum ActionsEnum {
     createHealthCheck = "createHealthCheck",
     updateHealthCheck = "updateHealthCheck",
     deleteHealthCheck = "deleteHealthCheck",
-    listHealthChecks = "listHealthChecks",
-    createBrowserGatewayTarget = "createBrowserGatewayTarget",
-    updateBrowserGatewayTarget = "updateBrowserGatewayTarget",
-    deleteBrowserGatewayTarget = "deleteBrowserGatewayTarget",
-    getBrowserGatewayTarget = "getBrowserGatewayTarget",
-    listBrowserGatewayTargets = "listBrowserGatewayTargets",
-    listResourcePolicies = "listResourcePolicies",
-    getResourcePolicy = "getResourcePolicy",
-    createResourcePolicy = "createResourcePolicy",
-    updateResourcePolicy = "updateResourcePolicy",
-    deleteResourcePolicy = "deleteResourcePolicy",
-    listResourcePolicyRoles = "listResourcePolicyRoles",
-    setResourcePolicyRoles = "setResourcePolicyRoles",
-    listResourcePolicyUsers = "listResourcePolicyUsers",
-    setResourcePolicyUsers = "setResourcePolicyUsers",
-    setResourcePolicyPassword = "setResourcePolicyPassword",
-    setResourcePolicyPincode = "setResourcePolicyPincode",
-    setResourcePolicyHeaderAuth = "setResourcePolicyHeaderAuth",
-    setResourcePolicyWhitelist = "setResourcePolicyWhitelist",
-    setResourcePolicyRules = "setResourcePolicyRules"
+    listHealthChecks = "listHealthChecks"
 }
 
 export async function checkUserActionPermission(
@@ -211,23 +191,6 @@ export async function checkUserActionPermission(
             }
         }
 
-        // If no direct permission, check role-based permission (any of user's roles)
-        const roleActionPermission = await db
-            .select()
-            .from(roleActions)
-            .where(
-                and(
-                    eq(roleActions.actionId, actionId),
-                    inArray(roleActions.roleId, userOrgRoleIds),
-                    eq(roleActions.orgId, req.userOrgId!)
-                )
-            )
-            .limit(1);
-
-        if (roleActionPermission.length > 0) {
-            return true;
-        }
-
         // Check if the user has direct permission for the action in the current org
         const userActionPermission = await db
             .select()
@@ -245,7 +208,20 @@ export async function checkUserActionPermission(
             return true;
         }
 
-        return false;
+        // If no direct permission, check role-based permission (any of user's roles)
+        const roleActionPermission = await db
+            .select()
+            .from(roleActions)
+            .where(
+                and(
+                    eq(roleActions.actionId, actionId),
+                    inArray(roleActions.roleId, userOrgRoleIds),
+                    eq(roleActions.orgId, req.userOrgId!)
+                )
+            )
+            .limit(1);
+
+        return roleActionPermission.length > 0;
     } catch (error) {
         console.error("Error checking user action permission:", error);
         throw createHttpError(

server/db/names.ts

@@ -1,12 +1,6 @@
 import { join } from "path";
 import { readFileSync } from "fs";
-import {
-    clients,
-    db,
-    resourcePolicies,
-    resources,
-    siteResources
-} from "@server/db";
+import { clients, db, resources, siteResources } from "@server/db";
 import { randomInt } from "crypto";
 import { exitNodes, sites } from "@server/db";
 import { eq, and } from "drizzle-orm";
@@ -113,35 +107,6 @@ export async function getUniqueResourceName(orgId: string): Promise<string> {
     }
 }
 
-export async function getUniqueResourcePolicyName(
-    orgId: string
-): Promise<string> {
-    let loops = 0;
-    while (true) {
-        if (loops > 100) {
-            throw new Error("Could not generate a unique name");
-        }
-
-        const name = generateName();
-        const policyCount = await db
-            .select({
-                niceId: resourcePolicies.niceId,
-                orgId: resourcePolicies.orgId
-            })
-            .from(resourcePolicies)
-            .where(
-                and(
-                    eq(resourcePolicies.niceId, name),
-                    eq(resourcePolicies.orgId, orgId)
-                )
-            );
-        if (policyCount.length === 0) {
-            return name;
-        }
-        loops++;
-    }
-}
-
 export async function getUniqueSiteResourceName(
     orgId: string
 ): Promise<string> {

server/db/pg/schema/privateSchema.ts

@@ -580,24 +580,6 @@ export const trialNotifications = pgTable("trialNotifications", {
     sentAt: bigint("sentAt", { mode: "number" }).notNull()
 });
 
-export const browserGatewayTarget = pgTable("browserGatewayTarget", {
-    browserGatewayTargetId: serial("browserGatewayTargetId").primaryKey(),
-    resourceId: integer("resourceId")
-        .references(() => resources.resourceId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    siteId: integer("siteId")
-        .references(() => sites.siteId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    authToken: varchar("authToken").notNull(),
-    type: varchar("type").notNull(), // "ssh", "rdp", "vnc"
-    destination: varchar("destination").notNull(),
-    destinationPort: integer("destinationPort").notNull()
-});
-
 export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
@@ -645,6 +627,3 @@ export type AlertEmailRecipients = InferSelectModel<
 >;
 export type AlertWebhookActions = InferSelectModel<typeof alertWebhookActions>;
 export type TrialNotification = InferSelectModel<typeof trialNotifications>;
-export type BrowserGatewayTarget = InferSelectModel<
-    typeof browserGatewayTarget
->;

server/db/pg/schema/schema.ts

@@ -65,12 +65,7 @@ export const orgs = pgTable("orgs", {
     sshCaPrivateKey: text("sshCaPrivateKey"), // Encrypted SSH CA private key (PEM format)
     sshCaPublicKey: text("sshCaPublicKey"), // SSH CA public key (OpenSSH format)
     isBillingOrg: boolean("isBillingOrg"),
-    billingOrgId: varchar("billingOrgId"),
-    settingsEnableGlobalNewtAutoUpdate: boolean(
-        "settingsEnableGlobalNewtAutoUpdate"
-    )
-        .notNull()
-        .default(false)
+    billingOrgId: varchar("billingOrgId")
 });
 
 export const orgDomains = pgTable("orgDomains", {
@@ -108,10 +103,6 @@ export const sites = pgTable("sites", {
     lastHolePunch: bigint("lastHolePunch", { mode: "number" }),
     listenPort: integer("listenPort"),
     dockerSocketEnabled: boolean("dockerSocketEnabled").notNull().default(true),
-    autoUpdateEnabled: boolean("autoUpdateEnabled").notNull().default(false),
-    autoUpdateOverrideOrg: boolean("autoUpdateOverrideOrg")
-        .notNull()
-        .default(false),
     status: varchar("status")
         .$type<"pending" | "approved">()
         .default("approved")
@@ -119,16 +110,6 @@ export const sites = pgTable("sites", {
 
 export const resources = pgTable("resources", {
     resourceId: serial("resourceId").primaryKey(),
-    resourcePolicyId: integer("resourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        { onDelete: "set null" }
-    ),
-    defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        {
-            onDelete: "restrict"
-        }
-    ),
     resourceGuid: varchar("resourceGuid", { length: 36 })
         .unique()
         .notNull()
@@ -148,6 +129,8 @@ export const resources = pgTable("resources", {
     ssl: boolean("ssl").notNull().default(false),
     blockAccess: boolean("blockAccess").notNull().default(false),
     sso: boolean("sso").notNull().default(true),
+    http: boolean("http").notNull().default(true),
+    protocol: varchar("protocol").notNull(),
     proxyPort: integer("proxyPort"),
     emailWhitelistEnabled: boolean("emailWhitelistEnabled")
         .notNull()
@@ -164,6 +147,7 @@ export const resources = pgTable("resources", {
     headers: text("headers"), // comma-separated list of headers to add to the request
     proxyProtocol: boolean("proxyProtocol").notNull().default(false),
     proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
+
     maintenanceModeEnabled: boolean("maintenanceModeEnabled")
         .notNull()
         .default(false),
@@ -175,15 +159,7 @@ export const resources = pgTable("resources", {
     maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
     postAuthPath: text("postAuthPath"),
     health: varchar("health").default("unknown"), // "healthy", "unhealthy", "unknown"
-    wildcard: boolean("wildcard").notNull().default(false),
-    mode: text("mode").default("http").notNull(), // rdp, ssh, http, vnc
-    pamMode: varchar("pamMode", { length: 32 })
-        .$type<"passthrough" | "push">()
-        .default("passthrough"),
-    authDaemonMode: varchar("authDaemonMode", { length: 32 })
-        .$type<"site" | "remote" | "native">()
-        .default("site"),
-    authDaemonPort: integer("authDaemonPort").default(22123)
+    wildcard: boolean("wildcard").notNull().default(false)
 });
 
 export const labels = pgTable("labels", {
@@ -363,11 +339,11 @@ export const siteResources = pgTable("siteResources", {
     niceId: varchar("niceId").notNull(),
     name: varchar("name").notNull(),
     ssl: boolean("ssl").notNull().default(false),
-    mode: varchar("mode").$type<"host" | "cidr" | "http" | "ssh">().notNull(), // "host" | "cidr" | "http"
+    mode: varchar("mode").$type<"host" | "cidr" | "http">().notNull(), // "host" | "cidr" | "http"
     scheme: varchar("scheme").$type<"http" | "https">(), // only for when we are doing https or http mode
     proxyPort: integer("proxyPort"), // only for port mode
     destinationPort: integer("destinationPort"), // only for port mode
-    destination: varchar("destination"), // ip, cidr, hostname; validate against the mode
+    destination: varchar("destination").notNull(), // ip, cidr, hostname; validate against the mode
     enabled: boolean("enabled").notNull().default(true),
     alias: varchar("alias"),
     aliasAddress: varchar("aliasAddress"),
@@ -375,11 +351,8 @@ export const siteResources = pgTable("siteResources", {
     udpPortRangeString: varchar("udpPortRangeString").notNull().default("*"),
     disableIcmp: boolean("disableIcmp").notNull().default(false),
     authDaemonPort: integer("authDaemonPort").default(22123),
-    pamMode: varchar("pamMode", { length: 32 })
-        .$type<"passthrough" | "push">()
-        .default("passthrough"),
     authDaemonMode: varchar("authDaemonMode", { length: 32 })
-        .$type<"site" | "remote" | "native">()
+        .$type<"site" | "remote">()
         .default("site"),
     domainId: varchar("domainId").references(() => domains.domainId, {
         onDelete: "set null"
@@ -633,38 +606,6 @@ export const userResources = pgTable("userResources", {
         .references(() => resources.resourceId, { onDelete: "cascade" })
 });
 
-export const rolePolicies = pgTable("rolePolicies", {
-    roleId: integer("roleId")
-        .notNull()
-        .references(() => roles.roleId, { onDelete: "cascade" }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const userPolicies = pgTable("userPolicies", {
-    userId: varchar("userId")
-        .notNull()
-        .references(() => users.userId, { onDelete: "cascade" }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyWhiteList = pgTable("resourcePolicyWhitelist", {
-    whitelistId: serial("id").primaryKey(),
-    email: varchar("email").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
 export const userInvites = pgTable("userInvites", {
     inviteId: varchar("inviteId").primaryKey(),
     orgId: varchar("orgId")
@@ -730,40 +671,6 @@ export const resourceHeaderAuthExtendedCompatibility = pgTable(
     }
 );
 
-export const resourcePolicyPincode = pgTable("resourcePolicyPincode", {
-    pincodeId: serial("pincodeId").primaryKey(),
-    pincodeHash: varchar("pincodeHash").notNull(),
-    digitLength: integer("digitLength").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyPassword = pgTable("resourcePolicyPassword", {
-    passwordId: serial("passwordId").primaryKey(),
-    passwordHash: varchar("passwordHash").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyHeaderAuth = pgTable("resourcePolicyHeaderAuth", {
-    headerAuthId: serial("headerAuthId").primaryKey(),
-    headerAuthHash: varchar("headerAuthHash").notNull(),
-    extendedCompatibility: boolean("extendedCompatibility")
-        .notNull()
-        .default(true),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
 export const resourceAccessToken = pgTable("resourceAccessToken", {
     accessTokenId: varchar("accessTokenId").primaryKey(),
     orgId: varchar("orgId")
@@ -857,43 +764,6 @@ export const resourceRules = pgTable("resourceRules", {
     value: varchar("value").notNull()
 });
 
-export const resourcePolicyRules = pgTable("resourcePolicyRules", {
-    ruleId: serial("ruleId").primaryKey(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        }),
-    enabled: boolean("enabled").notNull().default(true),
-    priority: integer("priority").notNull(),
-    action: varchar("action").$type<"ACCEPT" | "DROP" | "PASS">().notNull(),
-    match: varchar("match").$type<"CIDR" | "PATH" | "IP">().notNull(),
-    value: varchar("value").notNull()
-});
-
-export const resourcePolicies = pgTable("resourcePolicies", {
-    resourcePolicyId: serial("resourcePolicyId").primaryKey(),
-    sso: boolean("sso").notNull().default(true),
-    applyRules: boolean("applyRules").notNull().default(false),
-    scope: varchar("scope")
-        .$type<"global" | "resource">()
-        .notNull()
-        .default("global"),
-    emailWhitelistEnabled: boolean("emailWhitelistEnabled")
-        .notNull()
-        .default(false),
-    idpId: integer("idpId").references(() => idp.idpId, {
-        onDelete: "set null"
-    }),
-    niceId: text("niceId").notNull(),
-    name: varchar("name").notNull(),
-    orgId: varchar("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull()
-});
-
 export const supporterKey = pgTable("supporterKey", {
     keyId: serial("keyId").primaryKey(),
     key: varchar("key").notNull(),
@@ -1406,6 +1276,3 @@ export type RoundTripMessageTracker = InferSelectModel<
 export type Network = InferSelectModel<typeof networks>;
 export type StatusHistory = InferSelectModel<typeof statusHistory>;
 export type Label = InferSelectModel<typeof labels>;
-export type ResourcePolicy = InferSelectModel<typeof resourcePolicies>;
-export type RolePolicy = InferSelectModel<typeof rolePolicies>;
-export type UserPolicy = InferSelectModel<typeof userPolicies>;

server/db/queries/verifySessionQueries.ts

@@ -17,13 +17,10 @@ import {
     resourceHeaderAuth,
     ResourceHeaderAuth,
     resourceRules,
-    resourcePolicyRules,
     resources,
     roleResources,
-    rolePolicies,
     sessions,
     userResources,
-    userPolicies,
     users,
     ResourceHeaderAuthExtendedCompatibility,
     resourceHeaderAuthExtendedCompatibility
@@ -157,126 +154,58 @@ export async function getRoleName(roleId: number): Promise<string | null> {
 }
 
 /**
- * Check if role has access to resource (direct or via resource policy)
+ * Check if role has access to resource
  */
 export async function getRoleResourceAccess(
     resourceId: number,
     roleIds: number[]
 ) {
-    const [direct, viaPolicies] = await Promise.all([
-        db
-            .select()
-            .from(roleResources)
-            .where(
-                and(
-                    eq(roleResources.resourceId, resourceId),
-                    inArray(roleResources.roleId, roleIds)
-                )
-            ),
-        db
-            .select({
-                roleId: rolePolicies.roleId,
-                resourcePolicyId: rolePolicies.resourcePolicyId
-            })
-            .from(rolePolicies)
-            .innerJoin(
-                resources,
-                eq(resources.resourcePolicyId, rolePolicies.resourcePolicyId)
+    const roleResourceAccess = await db
+        .select()
+        .from(roleResources)
+        .where(
+            and(
+                eq(roleResources.resourceId, resourceId),
+                inArray(roleResources.roleId, roleIds)
             )
-            .where(
-                and(
-                    eq(resources.resourceId, resourceId),
-                    inArray(rolePolicies.roleId, roleIds)
-                )
-            )
-    ]);
+        );
 
-    const combined = [...direct, ...viaPolicies];
-    return combined.length > 0 ? combined : null;
+    return roleResourceAccess.length > 0 ? roleResourceAccess : null;
 }
 
 /**
- * Check if user has access to resource (direct or via resource policy)
+ * Check if user has direct access to resource
  */
 export async function getUserResourceAccess(
     userId: string,
     resourceId: number
 ) {
-    const [direct, viaPolicies] = await Promise.all([
-        db
-            .select()
-            .from(userResources)
-            .where(
-                and(
-                    eq(userResources.userId, userId),
-                    eq(userResources.resourceId, resourceId)
-                )
+    const userResourceAccess = await db
+        .select()
+        .from(userResources)
+        .where(
+            and(
+                eq(userResources.userId, userId),
+                eq(userResources.resourceId, resourceId)
             )
-            .limit(1),
-        db
-            .select({
-                userId: userPolicies.userId,
-                resourcePolicyId: userPolicies.resourcePolicyId
-            })
-            .from(userPolicies)
-            .innerJoin(
-                resources,
-                eq(resources.resourcePolicyId, userPolicies.resourcePolicyId)
-            )
-            .where(
-                and(
-                    eq(resources.resourceId, resourceId),
-                    eq(userPolicies.userId, userId)
-                )
-            )
-            .limit(1)
-    ]);
+        )
+        .limit(1);
 
-    return direct[0] ?? viaPolicies[0] ?? null;
+    return userResourceAccess.length > 0 ? userResourceAccess[0] : null;
 }
 
 /**
- * Get resource rules for a given resource (direct and via resource policy)
+ * Get resource rules for a given resource
  */
 export async function getResourceRules(
     resourceId: number
 ): Promise<ResourceRule[]> {
-    const [directRules, policyRules] = await Promise.all([
-        db
-            .select()
-            .from(resourceRules)
-            .where(eq(resourceRules.resourceId, resourceId)),
-        db
-            .select({
-                ruleId: resourcePolicyRules.ruleId,
-                resourceId: sql<number>`${resourceId}`,
-                enabled: resourcePolicyRules.enabled,
-                priority: resourcePolicyRules.priority,
-                action: resourcePolicyRules.action,
-                match: resourcePolicyRules.match,
-                value: resourcePolicyRules.value
-            })
-            .from(resourcePolicyRules)
-            .innerJoin(
-                resources,
-                eq(
-                    resources.resourcePolicyId,
-                    resourcePolicyRules.resourcePolicyId
-                )
-            )
-            .where(eq(resources.resourceId, resourceId))
-    ]);
+    const rules = await db
+        .select()
+        .from(resourceRules)
+        .where(eq(resourceRules.resourceId, resourceId));
 
-    const maxDirectPriority = directRules.reduce(
-        (max, r) => Math.max(max, r.priority),
-        0
-    );
-    const offsetPolicyRules = policyRules.map((r) => ({
-        ...r,
-        priority: maxDirectPriority + r.priority
-    }));
-
-    return [...directRules, ...offsetPolicyRules] as ResourceRule[];
+    return rules;
 }
 
 /**

server/db/sqlite/schema/privateSchema.ts

@@ -588,26 +588,6 @@ export const trialNotifications = sqliteTable("trialNotifications", {
     sentAt: integer("sentAt").notNull()
 });
 
-export const browserGatewayTarget = sqliteTable("browserGatewayTarget", {
-    browserGatewayTargetId: integer("browserGatewayTargetId").primaryKey({
-        autoIncrement: true
-    }),
-    resourceId: integer("resourceId")
-        .references(() => resources.resourceId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    siteId: integer("siteId")
-        .references(() => sites.siteId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    authToken: text("authToken").notNull(),
-    type: text("type").notNull(), // "ssh", "rdp", "vnc"
-    destination: text("destination").notNull(),
-    destinationPort: integer("destinationPort").notNull()
-});
-
 export type Approval = InferSelectModel<typeof approvals>;
 export type Limit = InferSelectModel<typeof limits>;
 export type Account = InferSelectModel<typeof account>;
@@ -647,6 +627,3 @@ export type AlertEmailAction = InferSelectModel<typeof alertEmailActions>;
 export type AlertEmailRecipient = InferSelectModel<typeof alertEmailRecipients>;
 export type AlertWebhookAction = InferSelectModel<typeof alertWebhookActions>;
 export type TrialNotification = InferSelectModel<typeof trialNotifications>;
-export type BrowserGatewayTarget = InferSelectModel<
-    typeof browserGatewayTarget
->;

server/db/sqlite/schema/schema.ts

@@ -62,13 +62,7 @@ export const orgs = sqliteTable("orgs", {
     sshCaPrivateKey: text("sshCaPrivateKey"), // Encrypted SSH CA private key (PEM format)
     sshCaPublicKey: text("sshCaPublicKey"), // SSH CA public key (OpenSSH format)
     isBillingOrg: integer("isBillingOrg", { mode: "boolean" }),
-    billingOrgId: text("billingOrgId"),
-    settingsEnableGlobalNewtAutoUpdate: integer(
-        "settingsEnableGlobalNewtAutoUpdate",
-        { mode: "boolean" }
-    )
-        .notNull()
-        .default(false)
+    billingOrgId: text("billingOrgId")
 });
 
 export const userDomains = sqliteTable("userDomains", {
@@ -122,29 +116,11 @@ export const sites = sqliteTable("sites", {
     dockerSocketEnabled: integer("dockerSocketEnabled", { mode: "boolean" })
         .notNull()
         .default(true),
-    autoUpdateEnabled: integer("autoUpdateEnabled", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    autoUpdateOverrideOrg: integer("autoUpdateOverrideOrg", {
-        mode: "boolean"
-    })
-        .notNull()
-        .default(false),
     status: text("status").$type<"pending" | "approved">().default("approved")
 });
 
 export const resources = sqliteTable("resources", {
     resourceId: integer("resourceId").primaryKey({ autoIncrement: true }),
-    resourcePolicyId: integer("resourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        { onDelete: "set null" }
-    ),
-    defaultResourcePolicyId: integer("defaultResourcePolicyId").references(
-        () => resourcePolicies.resourcePolicyId,
-        {
-            onDelete: "restrict"
-        }
-    ),
     resourceGuid: text("resourceGuid", { length: 36 })
         .unique()
         .notNull()
@@ -166,6 +142,8 @@ export const resources = sqliteTable("resources", {
         .notNull()
         .default(false),
     sso: integer("sso", { mode: "boolean" }).notNull().default(true),
+    http: integer("http", { mode: "boolean" }).notNull().default(true),
+    protocol: text("protocol").notNull(),
     proxyPort: integer("proxyPort"),
     emailWhitelistEnabled: integer("emailWhitelistEnabled", { mode: "boolean" })
         .notNull()
@@ -188,6 +166,7 @@ export const resources = sqliteTable("resources", {
         .notNull()
         .default(false),
     proxyProtocolVersion: integer("proxyProtocolVersion").default(1),
+
     maintenanceModeEnabled: integer("maintenanceModeEnabled", {
         mode: "boolean"
     })
@@ -201,15 +180,7 @@ export const resources = sqliteTable("resources", {
     maintenanceEstimatedTime: text("maintenanceEstimatedTime"),
     postAuthPath: text("postAuthPath"),
     health: text("health").default("unknown"), // "healthy", "unhealthy", "unknown"
-    wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false),
-    mode: text("mode").default("http").notNull(), // rdp, ssh, http, vnc
-    pamMode: text("pamMode")
-        .$type<"passthrough" | "push">()
-        .default("passthrough"),
-    authDaemonMode: text("authDaemonMode")
-        .$type<"site" | "remote" | "native">()
-        .default("site"),
-    authDaemonPort: integer("authDaemonPort").default(22123)
+    wildcard: integer("wildcard", { mode: "boolean" }).notNull().default(false)
 });
 
 export const labels = sqliteTable("labels", {
@@ -401,11 +372,11 @@ export const siteResources = sqliteTable("siteResources", {
     niceId: text("niceId").notNull(),
     name: text("name").notNull(),
     ssl: integer("ssl", { mode: "boolean" }).notNull().default(false),
-    mode: text("mode").$type<"host" | "cidr" | "http" | "ssh">().notNull(), // "host" | "cidr" | "http"
+    mode: text("mode").$type<"host" | "cidr" | "http">().notNull(), // "host" | "cidr" | "http"
     scheme: text("scheme").$type<"http" | "https">(), // only for when we are doing https or http mode
     proxyPort: integer("proxyPort"), // only for port mode
     destinationPort: integer("destinationPort"), // only for port mode
-    destination: text("destination"), // ip, cidr, hostname
+    destination: text("destination").notNull(), // ip, cidr, hostname
     enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
     alias: text("alias"),
     aliasAddress: text("aliasAddress"),
@@ -415,11 +386,8 @@ export const siteResources = sqliteTable("siteResources", {
         .notNull()
         .default(false),
     authDaemonPort: integer("authDaemonPort").default(22123),
-    pamMode: text("pamMode")
-        .$type<"passthrough" | "push">()
-        .default("passthrough"),
     authDaemonMode: text("authDaemonMode")
-        .$type<"site" | "remote" | "native">()
+        .$type<"site" | "remote">()
         .default("site"),
     domainId: text("domainId").references(() => domains.domainId, {
         onDelete: "set null"
@@ -1032,47 +1000,6 @@ export const resourceHeaderAuth = sqliteTable("resourceHeaderAuth", {
     headerAuthHash: text("headerAuthHash").notNull()
 });
 
-export const resourcePolicyPincode = sqliteTable("resourcePolicyPincode", {
-    pincodeId: integer("pincodeId").primaryKey({ autoIncrement: true }),
-    pincodeHash: text("pincodeHash").notNull(),
-    digitLength: integer("digitLength").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyPassword = sqliteTable("resourcePolicyPassword", {
-    passwordId: integer("passwordId").primaryKey({ autoIncrement: true }),
-    passwordHash: text("passwordHash").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyHeaderAuth = sqliteTable(
-    "resourcePolicyHeaderAuth",
-    {
-        headerAuthId: integer("headerAuthId").primaryKey({
-            autoIncrement: true
-        }),
-        headerAuthHash: text("headerAuthHash").notNull(),
-        extendedCompatibility: integer("extendedCompatibility", {
-            mode: "boolean"
-        })
-            .notNull()
-            .default(true),
-        resourcePolicyId: integer("resourcePolicyId")
-            .notNull()
-            .references(() => resourcePolicies.resourcePolicyId, {
-                onDelete: "cascade"
-            })
-    }
-);
-
 export const resourceHeaderAuthExtendedCompatibility = sqliteTable(
     "resourceHeaderAuthExtendedCompatibility",
     {
@@ -1187,77 +1114,6 @@ export const resourceRules = sqliteTable("resourceRules", {
     value: text("value").notNull()
 });
 
-export const rolePolicies = sqliteTable("rolePolicies", {
-    roleId: integer("roleId")
-        .notNull()
-        .references(() => roles.roleId, { onDelete: "cascade" }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const userPolicies = sqliteTable("userPolicies", {
-    userId: text("userId")
-        .notNull()
-        .references(() => users.userId, { onDelete: "cascade" }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyWhiteList = sqliteTable("resourcePolicyWhitelist", {
-    whitelistId: integer("id").primaryKey({ autoIncrement: true }),
-    email: text("email").notNull(),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        })
-});
-
-export const resourcePolicyRules = sqliteTable("resourcePolicyRules", {
-    ruleId: integer("ruleId").primaryKey({ autoIncrement: true }),
-    resourcePolicyId: integer("resourcePolicyId")
-        .notNull()
-        .references(() => resourcePolicies.resourcePolicyId, {
-            onDelete: "cascade"
-        }),
-    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true),
-    priority: integer("priority").notNull(),
-    action: text("action").$type<"ACCEPT" | "DROP" | "PASS">().notNull(),
-    match: text("match").$type<"CIDR" | "PATH" | "IP">().notNull(),
-    value: text("value").notNull()
-});
-
-export const resourcePolicies = sqliteTable("resourcePolicies", {
-    resourcePolicyId: integer("resourcePolicyId").primaryKey(),
-    sso: integer("sso", { mode: "boolean" }).notNull().default(true),
-    applyRules: integer("applyRules", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    scope: text("scope")
-        .$type<"global" | "resource">()
-        .notNull()
-        .default("global"),
-    emailWhitelistEnabled: integer("emailWhitelistEnabled", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    niceId: text("niceId").notNull(),
-    idpId: integer("idpId").references(() => idp.idpId, {
-        onDelete: "set null"
-    }),
-    name: text("name").notNull(),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull()
-});
-
 export const supporterKey = sqliteTable("supporterKey", {
     keyId: integer("keyId").primaryKey({ autoIncrement: true }),
     key: text("key").notNull(),
@@ -1525,6 +1381,3 @@ export type RoundTripMessageTracker = InferSelectModel<
 >;
 export type StatusHistory = InferSelectModel<typeof statusHistory>;
 export type Label = InferSelectModel<typeof labels>;
-export type ResourcePolicy = InferSelectModel<typeof resourcePolicies>;
-export type RolePolicy = InferSelectModel<typeof rolePolicies>;
-export type UserPolicy = InferSelectModel<typeof userPolicies>;

server/lib/alerts/events/healthCheckEvents.ts

@@ -221,18 +221,10 @@ async function handleResource(
         )
         .where(eq(targets.resourceId, resource.resourceId));
 
-    const monitoredTargets = otherTargets.filter(
-        (t) => t.hcHealth !== "unknown"
-    );
-
     let health = "healthy";
-    const allUnknown = monitoredTargets.length === 0;
-    const allHealthy = monitoredTargets.every(
-        (t) => t.hcHealth === "healthy"
-    );
-    const allUnhealthy = monitoredTargets.every(
-        (t) => t.hcHealth === "unhealthy"
-    );
+    const allUnknown = otherTargets.every((t) => t.hcHealth === "unknown");
+    const allHealthy = otherTargets.every((t) => t.hcHealth === "healthy");
+    const allUnhealthy = otherTargets.every((t) => t.hcHealth === "unhealthy");
 
     if (allUnknown) {
         logger.debug(

server/lib/billing/tierMatrix.ts

@@ -25,9 +25,7 @@ export enum TierFeature {
     StandaloneHealthChecks = "standaloneHealthChecks",
     AlertingRules = "alertingRules",
     WildcardSubdomain = "wildcardSubdomain",
-    Labels = "labels",
-    NewtAutoUpdate = "newtAutoUpdate",
-    ResourcePolicies = "resourcePolicies"
+    Labels = "labels"
 }
 
 export const tierMatrix: Record<TierFeature, Tier[]> = {
@@ -70,7 +68,5 @@ export const tierMatrix: Record<TierFeature, Tier[]> = {
     [TierFeature.DomainNamespaces]: ["tier1", "tier2", "tier3", "enterprise"],
     [TierFeature.StandaloneHealthChecks]: ["tier3", "enterprise"],
     [TierFeature.AlertingRules]: ["tier3", "enterprise"],
-    [TierFeature.WildcardSubdomain]: ["tier1", "tier2", "tier3", "enterprise"],
-    [TierFeature.NewtAutoUpdate]: ["tier1", "tier2", "tier3", "enterprise"],
-    [TierFeature.ResourcePolicies]: ["tier3", "enterprise"]
+    [TierFeature.WildcardSubdomain]: ["tier1", "tier2", "tier3", "enterprise"]
 };

server/lib/blueprints/applyBlueprint.ts

@@ -16,12 +16,14 @@ import logger from "@server/logger";
 import { sites } from "@server/db";
 import { eq, and, isNotNull } from "drizzle-orm";
 import { addTargets as addProxyTargets } from "@server/routers/newt/targets";
+import { addTargets as addClientTargets } from "@server/routers/client/targets";
 import {
     ClientResourcesResults,
     updateClientResources
 } from "./clientResources";
 import { BlueprintSource } from "@server/routers/blueprints/types";
 import { stringify as stringifyYaml } from "yaml";
+import { faker } from "@faker-js/faker";
 import { handleMessagingForUpdatedSiteResource } from "@server/routers/siteResource";
 import { rebuildClientAssociationsFromSiteResource } from "../rebuildClientAssociations";
 
@@ -104,7 +106,7 @@ export async function applyBlueprint({
                             site.newt.newtId,
                             [target],
                             matchingHealthcheck ? [matchingHealthcheck] : [],
-                            result.proxyResource.mode === "udp" ? "udp" : "tcp",
+                            result.proxyResource.protocol,
                             site.newt.version
                         );
                     }

server/lib/blueprints/clientResources.ts

@@ -225,11 +225,7 @@ export async function updateClientResources(
                             : resourceData["udp-ports"],
                     fullDomain: resourceData["full-domain"] || null,
                     subdomain: domainInfo ? domainInfo.subdomain : null,
-                    domainId: domainInfo ? domainInfo.domainId : null,
-                    pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
-                    authDaemonMode:
-                        resourceData["auth-daemon"]?.mode || "native",
-                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
+                    domainId: domainInfo ? domainInfo.domainId : null
                 })
                 .where(
                     eq(
@@ -364,14 +360,8 @@ export async function updateClientResources(
             });
         } else {
             let aliasAddress: string | null = null;
-            let releaseAliasLock: (() => Promise<void>) | null = null;
             if (resourceData.mode === "host" || resourceData.mode === "http") {
-                const { value, release } = await getNextAvailableAliasAddress(
-                    orgId,
-                    trx
-                );
-                aliasAddress = value;
-                releaseAliasLock = release;
+                aliasAddress = await getNextAvailableAliasAddress(orgId, trx);
             }
 
             let domainInfo:
@@ -425,16 +415,10 @@ export async function updateClientResources(
                             : resourceData["udp-ports"],
                     fullDomain: resourceData["full-domain"] || null,
                     subdomain: domainInfo ? domainInfo.subdomain : null,
-                    domainId: domainInfo ? domainInfo.domainId : null,
-                    pamMode: resourceData["auth-daemon"]?.pam || "passthrough",
-                    authDaemonMode:
-                        resourceData["auth-daemon"]?.mode || "native",
-                    authDaemonPort: resourceData["auth-daemon"]?.port || 22123
+                    domainId: domainInfo ? domainInfo.domainId : null
                 })
                 .returning();
 
-            await releaseAliasLock?.();
-
             const siteResourceId = newResource.siteResourceId;
 
             for (const site of allSites) {

server/lib/blueprints/types.ts

@@ -82,7 +82,7 @@ export const RuleSchema = z
     .object({
         action: z.enum(["allow", "deny", "pass"]),
         match: z.enum(["cidr", "path", "ip", "country", "asn", "region"]),
-        value: z.coerce.string(),
+        value: z.string(),
         priority: z.int().optional()
     })
     .refine(
@@ -161,34 +161,11 @@ export const HeaderSchema = z.object({
     value: z.string().min(1)
 });
 
-export const AuthDaemonSchema = z
-    .object({
-        pam: z.enum(["passthrough", "push"]).optional().default("passthrough"),
-        mode: z.enum(["site", "remote", "native"]).optional().default("site"),
-        port: z.int().min(1).max(65535).optional()
-    })
-    .refine(
-        (data) => {
-            if (data.mode === "remote") {
-                return data.port !== undefined;
-            }
-            return true;
-        },
-        {
-            path: ["port"],
-            message: "port is required when auth-daemon mode is 'remote'"
-        }
-    );
-
 // Schema for individual resource
-export const PublicResourceSchema = z
+export const ResourceSchema = z
     .object({
         name: z.string().optional(),
-        protocol: z
-            .enum(["http", "tcp", "udp", "ssh", "rdp", "vnc"])
-            .optional(), // this was the old one and is now DEPRECATED in favor of the mode
-        mode: z.enum(["http", "tcp", "udp", "ssh", "rdp", "vnc"]).optional(),
-        policy: z.string().optional(),
+        protocol: z.enum(["http", "tcp", "udp"]).optional(),
         ssl: z.boolean().optional(),
         scheme: z.enum(["http", "https"]).optional(),
         "full-domain": z.string().optional(),
@@ -200,8 +177,7 @@ export const PublicResourceSchema = z
         "tls-server-name": z.string().optional(),
         headers: z.array(HeaderSchema).optional(),
         rules: z.array(RuleSchema).optional(),
-        maintenance: MaintenanceSchema.optional(),
-        "auth-daemon": AuthDaemonSchema.optional()
+        maintenance: MaintenanceSchema.optional()
     })
     .refine(
         (resource) => {
@@ -209,10 +185,9 @@ export const PublicResourceSchema = z
                 return true;
             }
 
-            // Otherwise, require name and protocol/mode for full resource definition
+            // Otherwise, require name and protocol for full resource definition
             return (
-                resource.name !== undefined &&
-                (resource.mode !== undefined || resource.protocol !== undefined)
+                resource.name !== undefined && resource.protocol !== undefined
             );
         },
         {
@@ -226,8 +201,8 @@ export const PublicResourceSchema = z
                 return true;
             }
 
-            // If protocol/mode is http, all targets must have method field
-            if ((resource.mode ?? resource.protocol) === "http") {
+            // If protocol is http, all targets must have method field
+            if (resource.protocol === "http") {
                 return resource.targets.every(
                     (target) => target == null || target.method !== undefined
                 );
@@ -245,9 +220,8 @@ export const PublicResourceSchema = z
                 return true;
             }
 
-            // If protocol/mode is tcp or udp, no target should have method field
-            const effectiveProtocol1 = resource.mode ?? resource.protocol;
-            if (effectiveProtocol1 === "tcp" || effectiveProtocol1 === "udp") {
+            // If protocol is tcp or udp, no target should have method field
+            if (resource.protocol === "tcp" || resource.protocol === "udp") {
                 return resource.targets.every(
                     (target) => target == null || target.method === undefined
                 );
@@ -265,8 +239,8 @@ export const PublicResourceSchema = z
                 return true;
             }
 
-            // If protocol/mode is http, it must have a full-domain
-            if ((resource.mode ?? resource.protocol) === "http") {
+            // If protocol is http, it must have a full-domain
+            if (resource.protocol === "http") {
                 return (
                     resource["full-domain"] !== undefined &&
                     resource["full-domain"].length > 0
@@ -285,9 +259,8 @@ export const PublicResourceSchema = z
                 return true;
             }
 
-            // If protocol/mode is tcp or udp, it must have both proxy-port
-            const effectiveProtocol2 = resource.mode ?? resource.protocol;
-            if (effectiveProtocol2 === "tcp" || effectiveProtocol2 === "udp") {
+            // If protocol is tcp or udp, it must have both proxy-port
+            if (resource.protocol === "tcp" || resource.protocol === "udp") {
                 return resource["proxy-port"] !== undefined;
             }
             return true;
@@ -304,9 +277,8 @@ export const PublicResourceSchema = z
                 return true;
             }
 
-            // If protocol/mode is tcp or udp, it must not have auth
-            const effectiveProtocol3 = resource.mode ?? resource.protocol;
-            if (effectiveProtocol3 === "tcp" || effectiveProtocol3 === "udp") {
+            // If protocol is tcp or udp, it must not have auth
+            if (resource.protocol === "tcp" || resource.protocol === "udp") {
                 return resource.auth === undefined;
             }
             return true;
@@ -368,8 +340,7 @@ export const PublicResourceSchema = z
             if (parts.includes("*", 1)) return false; // no further wildcards
             if (parts.length < 3) return false; // need at least *.label.tld
 
-            const labelRegex =
-                /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$|^[a-zA-Z0-9]$/;
+            const labelRegex = /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$|^[a-zA-Z0-9]$/;
             return parts.slice(1).every((label) => labelRegex.test(label));
         },
         {
@@ -377,29 +348,22 @@ export const PublicResourceSchema = z
             message:
                 'Wildcard full-domain must have "*" as the leftmost label only, followed by at least two valid hostname labels (e.g. "*.example.com" or "*.level1.example.com"). Patterns like "*example.com" or "level2.*.example.com" are not supported.'
         }
-    )
-    .transform((resource) => {
-        // Normalize: prefer mode, fall back to protocol for backwards compatibility
-        if (resource.mode === undefined && resource.protocol !== undefined) {
-            resource.mode = resource.protocol;
-        }
-        return resource;
-    });
+    );
 
 export function isTargetsOnlyResource(resource: any): boolean {
     return Object.keys(resource).length === 1 && resource.targets;
 }
 
-export const PrivateResourceSchema = z
+export const ClientResourceSchema = z
     .object({
         name: z.string().min(1).max(255),
-        mode: z.enum(["host", "cidr", "http", "ssh"]),
+        mode: z.enum(["host", "cidr", "http"]),
         site: z.string().optional(), // DEPRECATED IN FAVOR OF sites
         sites: z.array(z.string()).optional().default([]),
         // protocol: z.enum(["tcp", "udp"]).optional(),
         // proxyPort: z.int().positive().optional(),
         "destination-port": z.int().positive().optional(),
-        destination: z.string().min(1).optional(),
+        destination: z.string().min(1),
         // enabled: z.boolean().default(true),
         "tcp-ports": portRangeStringSchema.optional().default("*"),
         "udp-ports": portRangeStringSchema.optional().default("*"),
@@ -422,31 +386,11 @@ export const PrivateResourceSchema = z
                 error: "Admin role cannot be included in roles"
             }),
         users: z.array(z.string()).optional().default([]),
-        machines: z.array(z.string()).optional().default([]),
-        "auth-daemon": AuthDaemonSchema.optional()
+        machines: z.array(z.string()).optional().default([])
     })
-    .refine(
-        (data) => {
-            // destination is optional only for ssh+native; required for everything else
-            const isNativeSSH =
-                data.mode === "ssh" &&
-                (data["auth-daemon"] === undefined ||
-                    data["auth-daemon"].mode === "native");
-            if (!isNativeSSH && !data.destination) {
-                return false;
-            }
-            return true;
-        },
-        {
-            path: ["destination"],
-            message:
-                "destination is required unless mode is 'ssh' with auth-daemon mode 'native'"
-        }
-    )
     .refine(
         (data) => {
             if (data.mode === "host") {
-                if (!data.destination) return true; // caught by the destination-required refine
                 // Check if it's a valid IP address using zod (v4 or v6)
                 const isValidIP = z
                     .union([z.ipv4(), z.ipv6()])
@@ -474,7 +418,6 @@ export const PrivateResourceSchema = z
     .refine(
         (data) => {
             if (data.mode === "cidr") {
-                if (!data.destination) return true; // caught by the destination-required refine
                 // Check if it's a valid CIDR (v4 or v6)
                 const isValidCIDR = z
                     .union([z.cidrv4(), z.cidrv6()])
@@ -492,19 +435,19 @@ export const PrivateResourceSchema = z
 export const ConfigSchema = z
     .object({
         "proxy-resources": z
-            .record(z.string(), PublicResourceSchema)
+            .record(z.string(), ResourceSchema)
             .optional()
             .prefault({}),
         "public-resources": z
-            .record(z.string(), PublicResourceSchema)
+            .record(z.string(), ResourceSchema)
             .optional()
             .prefault({}),
         "client-resources": z
-            .record(z.string(), PrivateResourceSchema)
+            .record(z.string(), ClientResourceSchema)
             .optional()
             .prefault({}),
         "private-resources": z
-            .record(z.string(), PrivateResourceSchema)
+            .record(z.string(), ClientResourceSchema)
             .optional()
             .prefault({}),
         sites: z.record(z.string(), SiteSchema).optional().prefault({})
@@ -529,13 +472,10 @@ export const ConfigSchema = z
         }
 
         return data as {
-            "proxy-resources": Record<
-                string,
-                z.infer<typeof PublicResourceSchema>
-            >;
+            "proxy-resources": Record<string, z.infer<typeof ResourceSchema>>;
             "client-resources": Record<
                 string,
-                z.infer<typeof PrivateResourceSchema>
+                z.infer<typeof ClientResourceSchema>
             >;
             sites: Record<string, z.infer<typeof SiteSchema>>;
         };
@@ -674,5 +614,5 @@ export const ConfigSchema = z
 // Type inference from the schema
 export type Site = z.infer<typeof SiteSchema>;
 export type Target = z.infer<typeof TargetSchema>;
-export type Resource = z.infer<typeof PublicResourceSchema>;
+export type Resource = z.infer<typeof ResourceSchema>;
 export type Config = z.infer<typeof ConfigSchema>;

server/lib/calculateUserClientsForOrgs.ts

@@ -331,8 +331,16 @@ export async function calculateUserClientsForOrgs(
                     ];
 
                 // Get next available subnet
-                const { value: newSubnet, release: releaseSubnetLock } =
-                    await getNextAvailableClientSubnet(orgId, transaction);
+                const newSubnet = await getNextAvailableClientSubnet(
+                    orgId,
+                    transaction
+                );
+                if (!newSubnet) {
+                    logger.warn(
+                        `Skipping org ${orgId} for OLM ${olm.olmId} (user ${userId}): no available subnet found`
+                    );
+                    continue;
+                }
 
                 const subnet = newSubnet.split("/")[0];
                 const updatedSubnet = `${subnet}/${org.subnet.split("/")[1]}`;
@@ -362,7 +370,6 @@ export async function calculateUserClientsForOrgs(
                     .insert(clients)
                     .values(newClientData)
                     .returning();
-                await releaseSubnetLock();
                 existingClientCache.set(
                     getOrgOlmKey(orgId, olm.olmId),
                     newClient

server/lib/ip.ts

@@ -327,145 +327,127 @@ export function doCidrsOverlap(cidr1: string, cidr2: string): boolean {
 export async function getNextAvailableClientSubnet(
     orgId: string,
     transaction: Transaction | typeof db = db
-): Promise<{ value: string; release: () => Promise<void> }> {
-    const lockKey = `client-subnet-allocation:${orgId}`;
-    const acquired = await lockManager.acquireLockWithRetry(lockKey, 6000);
-    if (!acquired) {
-        throw new Error(`Failed to acquire lock: ${lockKey}`);
-    }
-    const release = () => lockManager.releaseLock(lockKey);
+): Promise<string> {
+    return await lockManager.withLock(
+        `client-subnet-allocation:${orgId}`,
+        async () => {
+            const [org] = await transaction
+                .select()
+                .from(orgs)
+                .where(eq(orgs.orgId, orgId));
 
-    try {
-        const [org] = await transaction
-            .select()
-            .from(orgs)
-            .where(eq(orgs.orgId, orgId));
+            if (!org) {
+                throw new Error(`Organization with ID ${orgId} not found`);
+            }
 
-        if (!org) {
-            throw new Error(`Organization with ID ${orgId} not found`);
+            if (!org.subnet) {
+                throw new Error(
+                    `Organization with ID ${orgId} has no subnet defined`
+                );
+            }
+
+            const existingAddressesSites = await transaction
+                .select({
+                    address: sites.address
+                })
+                .from(sites)
+                .where(and(isNotNull(sites.address), eq(sites.orgId, orgId)));
+
+            const existingAddressesClients = await transaction
+                .select({
+                    address: clients.subnet
+                })
+                .from(clients)
+                .where(
+                    and(isNotNull(clients.subnet), eq(clients.orgId, orgId))
+                );
+
+            const addresses = [
+                ...existingAddressesSites.map(
+                    (site) => `${site.address?.split("/")[0]}/32`
+                ), // we are overriding the 32 so that we pick individual addresses in the subnet of the org for the site and the client even though they are stored with the /block_size of the org
+                ...existingAddressesClients.map(
+                    (client) => `${client.address.split("/")}/32`
+                )
+            ].filter((address) => address !== null) as string[];
+
+            const subnet = findNextAvailableCidr(addresses, 32, org.subnet); // pick the sites address in the org
+            if (!subnet) {
+                throw new Error("No available subnets remaining in space");
+            }
+
+            return subnet;
         }
-
-        if (!org.subnet) {
-            throw new Error(
-                `Organization with ID ${orgId} has no subnet defined`
-            );
-        }
-
-        const existingAddressesSites = await transaction
-            .select({
-                address: sites.address
-            })
-            .from(sites)
-            .where(and(isNotNull(sites.address), eq(sites.orgId, orgId)));
-
-        const existingAddressesClients = await transaction
-            .select({
-                address: clients.subnet
-            })
-            .from(clients)
-            .where(and(isNotNull(clients.subnet), eq(clients.orgId, orgId)));
-
-        const addresses = [
-            ...existingAddressesSites.map(
-                (site) => `${site.address?.split("/")[0]}/32`
-            ), // we are overriding the 32 so that we pick individual addresses in the subnet of the org for the site and the client even though they are stored with the /block_size of the org
-            ...existingAddressesClients.map(
-                (client) => `${client.address.split("/")[0]}/32`
-            )
-        ].filter((address) => address !== null) as string[];
-
-        const subnet = findNextAvailableCidr(addresses, 32, org.subnet); // pick the sites address in the org
-        if (!subnet) {
-            throw new Error("No available subnets remaining in space");
-        }
-
-        return { value: subnet, release };
-    } catch (e) {
-        await release();
-        throw e;
-    }
+    );
 }
 
 export async function getNextAvailableAliasAddress(
     orgId: string,
     trx: Transaction | typeof db = db
-): Promise<{ value: string; release: () => Promise<void> }> {
-    const lockKey = `alias-address-allocation:${orgId}`;
-    const acquired = await lockManager.acquireLockWithRetry(lockKey, 6000);
-    if (!acquired) {
-        throw new Error(`Failed to acquire lock: ${lockKey}`);
-    }
-    const release = () => lockManager.releaseLock(lockKey);
+): Promise<string> {
+    return await lockManager.withLock(
+        `alias-address-allocation:${orgId}`,
+        async () => {
+            const [org] = await trx
+                .select()
+                .from(orgs)
+                .where(eq(orgs.orgId, orgId));
 
-    try {
-        const [org] = await trx
-            .select()
-            .from(orgs)
-            .where(eq(orgs.orgId, orgId));
+            if (!org) {
+                throw new Error(`Organization with ID ${orgId} not found`);
+            }
 
-        if (!org) {
-            throw new Error(`Organization with ID ${orgId} not found`);
-        }
+            if (!org.subnet) {
+                throw new Error(
+                    `Organization with ID ${orgId} has no subnet defined`
+                );
+            }
 
-        if (!org.subnet) {
-            throw new Error(
-                `Organization with ID ${orgId} has no subnet defined`
+            if (!org.utilitySubnet) {
+                throw new Error(
+                    `Organization with ID ${orgId} has no utility subnet defined`
+                );
+            }
+
+            const existingAddresses = await trx
+                .select({
+                    aliasAddress: siteResources.aliasAddress
+                })
+                .from(siteResources)
+                .where(
+                    and(
+                        isNotNull(siteResources.aliasAddress),
+                        eq(siteResources.orgId, orgId)
+                    )
+                );
+
+            const addresses = [
+                ...existingAddresses.map(
+                    (site) => `${site.aliasAddress?.split("/")[0]}/32`
+                ),
+                // reserve a /29 for the dns server and other stuff
+                `${org.utilitySubnet.split("/")[0]}/29`
+            ].filter((address) => address !== null) as string[];
+
+            let subnet = findNextAvailableCidr(
+                addresses,
+                32,
+                org.utilitySubnet
             );
+            if (!subnet) {
+                throw new Error("No available subnets remaining in space");
+            }
+
+            // remove the cidr
+            subnet = subnet.split("/")[0];
+
+            return subnet;
         }
-
-        if (!org.utilitySubnet) {
-            throw new Error(
-                `Organization with ID ${orgId} has no utility subnet defined`
-            );
-        }
-
-        const existingAddresses = await trx
-            .select({
-                aliasAddress: siteResources.aliasAddress
-            })
-            .from(siteResources)
-            .where(
-                and(
-                    isNotNull(siteResources.aliasAddress),
-                    eq(siteResources.orgId, orgId)
-                )
-            );
-
-        const addresses = [
-            ...existingAddresses.map(
-                (site) => `${site.aliasAddress?.split("/")[0]}/32`
-            ),
-            // reserve a /29 for the dns server and other stuff
-            `${org.utilitySubnet.split("/")[0]}/29`
-        ].filter((address) => address !== null) as string[];
-
-        let subnet = findNextAvailableCidr(addresses, 32, org.utilitySubnet);
-        if (!subnet) {
-            throw new Error("No available subnets remaining in space");
-        }
-
-        // remove the cidr
-        subnet = subnet.split("/")[0];
-
-        return { value: subnet, release };
-    } catch (e) {
-        await release();
-        throw e;
-    }
+    );
 }
 
-export async function getNextAvailableOrgSubnet(): Promise<{
-    value: string;
-    release: () => Promise<void>;
-}> {
-    const lockKey = "org-subnet-allocation";
-    const acquired = await lockManager.acquireLockWithRetry(lockKey, 6000);
-    if (!acquired) {
-        throw new Error(`Failed to acquire lock: ${lockKey}`);
-    }
-    const release = () => lockManager.releaseLock(lockKey);
-
-    try {
+export async function getNextAvailableOrgSubnet(): Promise<string> {
+    return await lockManager.withLock("org-subnet-allocation", async () => {
         const existingAddresses = await db
             .select({
                 subnet: orgs.subnet
@@ -484,11 +466,8 @@ export async function getNextAvailableOrgSubnet(): Promise<{
             throw new Error("No available subnets remaining in space");
         }
 
-        return { value: subnet, release };
-    } catch (e) {
-        await release();
-        throw e;
-    }
+        return subnet;
+    });
 }
 
 export function generateRemoteSubnets(
@@ -496,8 +475,6 @@ export function generateRemoteSubnets(
 ): string[] {
     const remoteSubnets = allSiteResources
         .filter((sr) => {
-            if (!sr.destination) return false;
-
             if (sr.mode === "cidr") {
                 // check if its a valid CIDR using zod
                 const cidrSchema = z.union([z.cidrv4(), z.cidrv6()]);
@@ -519,7 +496,7 @@ export function generateRemoteSubnets(
             }
             return ""; // This should never be reached due to filtering, but satisfies TypeScript
         })
-        .filter((subnet): subnet is string => subnet !== "" && subnet !== null); // Remove invalid values just to be safe
+        .filter((subnet) => subnet !== ""); // Remove empty strings just to be safe
     // remove duplicates
     return Array.from(new Set(remoteSubnets));
 }
@@ -604,7 +581,7 @@ export function generateSubnetProxyTargets(
                 targets.push({
                     sourcePrefix: clientPrefix,
                     destPrefix: `${siteResource.aliasAddress}/32`,
-                    rewriteTo: destination!,
+                    rewriteTo: destination,
                     portRange,
                     disableIcmp
                 });
@@ -612,7 +589,7 @@ export function generateSubnetProxyTargets(
         } else if (siteResource.mode == "cidr") {
             targets.push({
                 sourcePrefix: clientPrefix,
-                destPrefix: siteResource.destination!,
+                destPrefix: siteResource.destination,
                 portRange,
                 disableIcmp
             });
@@ -694,7 +671,7 @@ export async function generateSubnetProxyTargetV2(
             targets.push({
                 sourcePrefixes: [],
                 destPrefix: `${siteResource.aliasAddress}/32`,
-                rewriteTo: destination!,
+                rewriteTo: destination,
                 portRange,
                 disableIcmp,
                 resourceId: siteResource.siteResourceId
@@ -703,7 +680,7 @@ export async function generateSubnetProxyTargetV2(
     } else if (siteResource.mode == "cidr") {
         targets.push({
             sourcePrefixes: [],
-            destPrefix: siteResource.destination!,
+            destPrefix: siteResource.destination,
             portRange,
             disableIcmp,
             resourceId: siteResource.siteResourceId
@@ -761,7 +738,7 @@ export async function generateSubnetProxyTargetV2(
             protocol: siteResource.ssl ? "https" : "http",
             httpTargets: [
                 {
-                    destAddr: siteResource.destination!,
+                    destAddr: siteResource.destination,
                     destPort: siteResource.destinationPort,
                     scheme: siteResource.scheme
                 }

server/lib/rebuildClientAssociations.ts

@@ -890,9 +890,6 @@ async function handleSubnetProxyTargetUpdates(
                 }
 
                 for (const client of removedClients) {
-                    if (!siteResource.destination) {
-                        continue;
-                    }
                     // Check if this client still has access to another resource
                     // on this specific site with the same destination. We scope
                     // by siteId (via siteNetworks) rather than networkId because
@@ -1566,9 +1563,6 @@ async function handleMessagesForClientResources(
                 }
 
                 try {
-                    if (!resource.destination) {
-                        continue;
-                    }
                     // Check if this client still has access to another resource
                     // on this specific site with the same destination. We scope
                     // by siteId (via siteNetworks) rather than networkId because
@@ -1832,77 +1826,3 @@ export async function verifyClientAssociationsCache(
         extraSiteIds: extraSiteIds.sort((a, b) => a - b)
     };
 }
-
-// cleanupSiteAssociations efficiently removes all client associations for a
-// site that is being deleted. Instead of calling
-// rebuildClientAssociationsFromSiteResource once per site resource (which is
-// O(resources) in DB round-trips and message fan-out), this function performs
-// a single bulk lookup of affected clients and site resources, deletes all
-// cache rows at once, and fires all peer/proxy removal messages in parallel.
-//
-// The caller is responsible for deleting the site row itself (and for sending
-// the newt/wg/terminate signal to the newt process).
-export async function cleanupSiteAssociations(
-    site: Site,
-    trx: Transaction | typeof db = db
-): Promise<void> {
-    const siteId = site.siteId;
-
-    logger.debug(`cleanupSiteAssociations: START siteId=${siteId}`);
-
-    // 1. Find every client currently cached against this site.
-    const cachedSiteClientRows = await trx
-        .select({ clientId: clientSitesAssociationsCache.clientId })
-        .from(clientSitesAssociationsCache)
-        .where(eq(clientSitesAssociationsCache.siteId, siteId));
-
-    const cachedClientIds = cachedSiteClientRows.map((r) => r.clientId);
-
-    // 2. Load full client details (needed for WireGuard public-key references).
-    const allClients =
-        cachedClientIds.length > 0
-            ? await trx
-                  .select({
-                      clientId: clients.clientId,
-                      pubKey: clients.pubKey,
-                      subnet: clients.subnet
-                  })
-                  .from(clients)
-                  .where(inArray(clients.clientId, cachedClientIds))
-            : [];
-
-    // 6. Bulk-delete all cache entries for this site.  Do this before sending
-    //    destination-update messages so updateClientSiteDestinations computes
-    //    the correct (post-deletion) set of destinations.
-    await trx
-        .delete(clientSitesAssociationsCache)
-        .where(eq(clientSitesAssociationsCache.siteId, siteId));
-
-    logger.debug(
-        `cleanupSiteAssociations: siteId=${siteId} cache cleared. clients=${allClients.length}`
-    );
-
-    // 7. Fire all removal messages in parallel.
-    const jobs: Promise<any>[] = [];
-
-    for (const client of allClients) {
-        // Tell each olm to drop the site's WireGuard peer.
-        if (site.publicKey) {
-            jobs.push(olmDeletePeer(client.clientId, siteId, site.publicKey));
-        }
-
-        // Recompute and push updated relay destinations (now excluding this site).
-        if (client.pubKey && client.subnet) {
-            jobs.push(updateClientSiteDestinations(client, trx));
-        }
-    }
-
-    await Promise.all(jobs).catch((error) => {
-        logger.error(
-            `cleanupSiteAssociations: error sending cleanup messages for siteId=${siteId}:`,
-            error
-        );
-    });
-
-    logger.debug(`cleanupSiteAssociations: DONE siteId=${siteId}`);
-}

server/lib/telemetry.ts

@@ -2,14 +2,7 @@ import { PostHog } from "posthog-node";
 import config from "./config";
 import { getHostMeta } from "./hostMeta";
 import logger from "@server/logger";
-import {
-    alertRules,
-    apiKeys,
-    blueprints,
-    db,
-    roles,
-    siteResources
-} from "@server/db";
+import { alertRules, apiKeys, blueprints, db, roles, siteResources } from "@server/db";
 import { sites, users, orgs, resources, clients, idp } from "@server/db";
 import { eq, count, notInArray, and, isNotNull, isNull } from "drizzle-orm";
 import { APP_VERSION } from "./consts";
@@ -150,7 +143,8 @@ class TelemetryClient {
                 .select({
                     name: resources.name,
                     sso: resources.sso,
-                    mode: resources.mode
+                    protocol: resources.protocol,
+                    http: resources.http
                 })
                 .from(resources);
 
@@ -317,7 +311,7 @@ class TelemetryClient {
                         (r) => r.sso
                     ).length,
                     num_resources_non_http: stats.resources.filter(
-                        (r) => r.mode !== "http"
+                        (r) => !r.http
                     ).length,
                     num_newt_sites: stats.sites.filter((s) => s.type === "newt")
                         .length,

server/lib/traefik/getTraefikConfig.ts

@@ -55,7 +55,9 @@ export async function getTraefikConfig(
             resourceName: resources.name,
             fullDomain: resources.fullDomain,
             ssl: resources.ssl,
+            http: resources.http,
             proxyPort: resources.proxyPort,
+            protocol: resources.protocol,
             subdomain: resources.subdomain,
             domainId: resources.domainId,
             enabled: resources.enabled,
@@ -66,7 +68,6 @@ export async function getTraefikConfig(
             headers: resources.headers,
             proxyProtocol: resources.proxyProtocol,
             proxyProtocolVersion: resources.proxyProtocolVersion,
-            mode: resources.mode,
 
             // Target fields
             targetId: targets.targetId,
@@ -114,8 +115,8 @@ export async function getTraefikConfig(
                 ),
                 inArray(sites.type, siteTypes),
                 allowRawResources
-                    ? inArray(resources.mode, ["http", "udp", "tcp"]) // allow all three
-                    : eq(resources.mode, "http")
+                    ? isNotNull(resources.http) // ignore the http check if allow_raw_resources is true
+                    : eq(resources.http, true)
             )
         )
         .orderBy(desc(targets.priority), targets.targetId); // stable ordering
@@ -165,8 +166,9 @@ export async function getTraefikConfig(
                 key: key,
                 fullDomain: row.fullDomain,
                 ssl: row.ssl,
-                mode: row.mode,
+                http: row.http,
                 proxyPort: row.proxyPort,
+                protocol: row.protocol,
                 subdomain: row.subdomain,
                 domainId: row.domainId,
                 enabled: row.enabled,
@@ -578,7 +580,7 @@ export async function getTraefikConfig(
                 continue;
             }
 
-            const protocol = resource.mode === "udp" ? "udp" : "tcp"; // all of the other ones are tcp
+            const protocol = resource.protocol.toLowerCase();
             const port = resource.proxyPort;
 
             if (!port) {

server/middlewares/index.ts

@@ -32,4 +32,3 @@ export * from "./verifySiteResourceAccess";
 export * from "./logActionAudit";
 export * from "./verifyOlmAccess";
 export * from "./verifyLimits";
-export * from "./verifyResourcePolicyAccess";

server/middlewares/integration/index.ts

@@ -16,4 +16,3 @@ export * from "./verifyApiKeyClientAccess";
 export * from "./verifyApiKeySiteResourceAccess";
 export * from "./verifyApiKeyIdpAccess";
 export * from "./verifyApiKeyDomainAccess";
-export * from "./verifyApiKeyResourcePolicyAccess";

server/middlewares/integration/verifyApiKeyResourcePolicyAccess.ts

@@ -1,92 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { db } from "@server/db";
-import { resourcePolicies, apiKeyOrg } from "@server/db";
-import { eq, and } from "drizzle-orm";
-import createHttpError from "http-errors";
-import HttpCode from "@server/types/HttpCode";
-
-export async function verifyApiKeyResourcePolicyAccess(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    const apiKey = req.apiKey;
-    const resourcePolicyId =
-        req.params.resourcePolicyId ||
-        req.body.resourcePolicyId ||
-        req.query.resourcePolicyId;
-
-    if (!apiKey) {
-        return next(
-            createHttpError(HttpCode.UNAUTHORIZED, "Key not authenticated")
-        );
-    }
-
-    try {
-        // Retrieve the resource policy
-        const [policy] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
-            .limit(1);
-
-        if (!policy) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource policy with ID ${resourcePolicyId} not found`
-                )
-            );
-        }
-
-        if (apiKey.isRoot) {
-            // Root keys can access any resource policy in any org
-            return next();
-        }
-
-        if (!policy.orgId) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    `Resource policy with ID ${resourcePolicyId} does not have an organization ID`
-                )
-            );
-        }
-
-        // Verify that the API key is linked to the resource policy's organization
-        if (!req.apiKeyOrg) {
-            const apiKeyOrgResult = await db
-                .select()
-                .from(apiKeyOrg)
-                .where(
-                    and(
-                        eq(apiKeyOrg.apiKeyId, apiKey.apiKeyId),
-                        eq(apiKeyOrg.orgId, policy.orgId)
-                    )
-                )
-                .limit(1);
-
-            if (apiKeyOrgResult.length > 0) {
-                req.apiKeyOrg = apiKeyOrgResult[0];
-            }
-        }
-
-        if (!req.apiKeyOrg) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "Key does not have access to this organization"
-                )
-            );
-        }
-
-        return next();
-    } catch (error) {
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Error verifying resource policy access"
-            )
-        );
-    }
-}

server/middlewares/verifyResourcePolicyAccess.ts

@@ -1,127 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { db } from "@server/db";
-import { resourcePolicies, userOrgs } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import createHttpError from "http-errors";
-import HttpCode from "@server/types/HttpCode";
-import { checkOrgAccessPolicy } from "#dynamic/lib/checkOrgAccessPolicy";
-import { getUserOrgRoleIds } from "@server/lib/userOrgRoles";
-
-export async function verifyResourcePolicyAccess(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    const userId = req.user!.userId;
-    const resourcePolicyIdStr =
-        req.params?.resourcePolicyId ||
-        req.body?.resourcePolicyId ||
-        req.query?.resourcePolicyId;
-    const niceId = req.params?.niceId || req.body?.niceId || req.query?.niceId;
-    const orgId = req.params?.orgId || req.body?.orgId || req.query?.orgId;
-
-    try {
-        if (!userId) {
-            return next(
-                createHttpError(HttpCode.UNAUTHORIZED, "User not authenticated")
-            );
-        }
-
-        let policy: typeof resourcePolicies.$inferSelect | null = null;
-
-        if (orgId && niceId) {
-            const [policyRes] = await db
-                .select()
-                .from(resourcePolicies)
-                .where(
-                    and(
-                        eq(resourcePolicies.niceId, niceId),
-                        eq(resourcePolicies.orgId, orgId)
-                    )
-                )
-                .limit(1);
-            policy = policyRes ?? null;
-        } else {
-            const resourcePolicyId = parseInt(resourcePolicyIdStr);
-            if (isNaN(resourcePolicyId)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid resource policy ID"
-                    )
-                );
-            }
-            const [policyRes] = await db
-                .select()
-                .from(resourcePolicies)
-                .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
-                .limit(1);
-            policy = policyRes ?? null;
-        }
-
-        if (!policy) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource policy with ID ${resourcePolicyIdStr ?? niceId} not found`
-                )
-            );
-        }
-
-        if (!req.userOrg) {
-            const userOrgRes = await db
-                .select()
-                .from(userOrgs)
-                .where(
-                    and(
-                        eq(userOrgs.userId, userId),
-                        eq(userOrgs.orgId, policy.orgId)
-                    )
-                )
-                .limit(1);
-            req.userOrg = userOrgRes[0];
-        }
-
-        if (!req.userOrg || req.userOrg.orgId !== policy.orgId) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "User does not have access to this organization"
-                )
-            );
-        }
-
-        if (req.orgPolicyAllowed === undefined && req.userOrg.orgId) {
-            const policyCheck = await checkOrgAccessPolicy({
-                orgId: req.userOrg.orgId,
-                userId,
-                session: req.session
-            });
-            req.orgPolicyAllowed = policyCheck.allowed;
-            if (!policyCheck.allowed || policyCheck.error) {
-                return next(
-                    createHttpError(
-                        HttpCode.FORBIDDEN,
-                        "Failed organization access policy check: " +
-                            (policyCheck.error || "Unknown error")
-                    )
-                );
-            }
-        }
-
-        req.userOrgRoleIds = await getUserOrgRoleIds(
-            req.userOrg.userId,
-            policy.orgId
-        );
-        req.userOrgId = policy.orgId;
-
-        return next();
-    } catch (error) {
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Error verifying resource policy access"
-            )
-        );
-    }
-}

server/middlewares/verifyUserCanSetUserOrgRoles.ts

@@ -38,7 +38,7 @@ export function verifyUserCanSetUserOrgRoles() {
             return next(
                 createHttpError(
                     HttpCode.FORBIDDEN,
-                    "User does not have permission to set user organization roles"
+                    "User does not have permission perform this action"
                 )
             );
         } catch (error) {

server/openApi.ts

@@ -7,7 +7,6 @@ export enum OpenAPITags {
     Org = "Organization",
     PublicResource = "Public Resource",
     PrivateResource = "Private Resource",
-    Policy = "Policy",
     Role = "Role",
     User = "User",
     Invitation = "User Invitation",

server/private/lib/acmeCertSync.ts

@@ -780,9 +780,9 @@ async function syncAcmeCerts(acmeJsonPath: string): Promise<void> {
             }
         }
 
-        // logger.debug(
-        //     `acmeCertSync: cert for ${mainDomain} covers ${allDomains.size} domain(s): ${[...allDomains].join(", ")}`
-        // );
+        logger.debug(
+            `acmeCertSync: cert for ${mainDomain} covers ${allDomains.size} domain(s): ${[...allDomains].join(", ")}`
+        );
 
         for (const domain of allDomains) {
             try {

server/private/lib/certificates.ts

@@ -36,6 +36,8 @@ export async function getValidCertificatesForDomains(
     domains: Set<string>,
     useCache: boolean = true
 ): Promise<Array<CertificateResult>> {
+
+
     const finalResults: CertificateResult[] = [];
     const domainsToQuery = new Set<string>();
 
@@ -47,26 +49,7 @@ export async function getValidCertificatesForDomains(
             if (cachedCert) {
                 finalResults.push(cachedCert); // Valid cache hit
             } else {
-                // Also check for a wildcard cache entry covering this domain's parent
-                const parts = domain.split(".");
-                let wildcardHit = false;
-                if (parts.length > 1) {
-                    const parentDomain = parts.slice(1).join(".");
-                    const wildcardCacheKey = `cert:*.${parentDomain}`;
-                    const cachedWildcard =
-                        await cache.get<CertificateResult>(wildcardCacheKey);
-                    if (cachedWildcard) {
-                        // Re-stamp queriedDomain so callers see the originally requested domain
-                        finalResults.push({
-                            ...cachedWildcard,
-                            queriedDomain: domain
-                        });
-                        wildcardHit = true;
-                    }
-                }
-                if (!wildcardHit) {
-                    domainsToQuery.add(domain); // Cache miss or expired
-                }
+                domainsToQuery.add(domain); // Cache miss or expired
             }
         }
     } else {
@@ -76,10 +59,7 @@ export async function getValidCertificatesForDomains(
 
     // 2. If all domains were resolved from the cache, return early
     if (domainsToQuery.size === 0) {
-        const decryptedResults = decryptFinalResults(
-            finalResults,
-            config.getRawConfig().server.secret!
-        );
+        const decryptedResults = decryptFinalResults(finalResults, config.getRawConfig().server.secret!);
         return decryptedResults;
     }
 
@@ -98,8 +78,7 @@ export async function getValidCertificatesForDomains(
     const parentDomainsArray = Array.from(parentDomainsToQuery);
 
     // Build wildcard variants: for each parent domain "example.com", also query "*.example.com"
-    const wildcardPrefixedArray =
-        build != "saas" ? parentDomainsArray.map((d) => `*.${d}`) : [];
+    const wildcardPrefixedArray = build != "saas" ? parentDomainsArray.map((d) => `*.${d}`) : [];
 
     // 4. Build and execute a single, efficient Drizzle query
     // This query fetches all potential exact and wildcard matches in one database round-trip.
@@ -193,24 +172,11 @@ export async function getValidCertificatesForDomains(
             if (useCache) {
                 const cacheKey = `cert:${domain}`;
                 await cache.set(cacheKey, resultCert, 180);
-
-                // Also cache wildcard certs under a pattern key so other subdomains
-                // can find them without a DB round-trip
-                if (resultCert.wildcard) {
-                    const normalizedCertDomain = normalizeWildcardDomain(
-                        resultCert.domain
-                    );
-                    const wildcardCacheKey = `cert:*.${normalizedCertDomain}`;
-                    await cache.set(wildcardCacheKey, resultCert, 180);
-                }
             }
         }
     }
 
-    const decryptedResults = decryptFinalResults(
-        finalResults,
-        config.getRawConfig().server.secret!
-    );
+    const decryptedResults = decryptFinalResults(finalResults, config.getRawConfig().server.secret!);
     return decryptedResults;
 }
 

server/private/lib/traefik/getTraefikConfig.ts

@@ -12,7 +12,6 @@
  */
 
 import {
-    browserGatewayTarget,
     certificates,
     db,
     domainNamespaces,
@@ -96,7 +95,9 @@ export async function getTraefikConfig(
             resourceName: resources.name,
             fullDomain: resources.fullDomain,
             ssl: resources.ssl,
+            http: resources.http,
             proxyPort: resources.proxyPort,
+            protocol: resources.protocol,
             subdomain: resources.subdomain,
             domainId: resources.domainId,
             enabled: resources.enabled,
@@ -108,7 +109,6 @@ export async function getTraefikConfig(
             proxyProtocol: resources.proxyProtocol,
             proxyProtocolVersion: resources.proxyProtocolVersion,
             wildcard: resources.wildcard,
-            mode: resources.mode,
 
             maintenanceModeEnabled: resources.maintenanceModeEnabled,
             maintenanceModeType: resources.maintenanceModeType,
@@ -171,8 +171,8 @@ export async function getTraefikConfig(
                 ),
                 inArray(sites.type, siteTypes),
                 allowRawResources
-                    ? inArray(resources.mode, ["http", "udp", "tcp"]) // allow all three
-                    : eq(resources.mode, "http")
+                    ? isNotNull(resources.http) // ignore the http check if allow_raw_resources is true
+                    : eq(resources.http, true)
             )
         )
         .orderBy(desc(targets.priority), targets.targetId); // stable ordering
@@ -226,8 +226,9 @@ export async function getTraefikConfig(
                 key: key,
                 fullDomain: row.fullDomain,
                 ssl: row.ssl,
+                http: row.http,
                 proxyPort: row.proxyPort,
-                mode: row.mode,
+                protocol: row.protocol,
                 subdomain: row.subdomain,
                 domainId: row.domainId,
                 enabled: row.enabled,
@@ -276,119 +277,10 @@ export async function getTraefikConfig(
         });
     });
 
-    // Query browser gateway targets for this exit node
-    const browserGatewayRows = await db
-        .select({
-            // Resource fields
-            resourceId: resources.resourceId,
-            resourceName: resources.name,
-            fullDomain: resources.fullDomain,
-            ssl: resources.ssl,
-            subdomain: resources.subdomain,
-            domainId: resources.domainId,
-            enabled: resources.enabled,
-            wildcard: resources.wildcard,
-            domainCertResolver: domains.certResolver,
-            preferWildcardCert: domains.preferWildcardCert,
-            domainNamespaceId: domainNamespaces.domainNamespaceId,
-            // Browser gateway target fields
-            browserGatewayTargetId: browserGatewayTarget.browserGatewayTargetId,
-            bgType: browserGatewayTarget.type,
-            // Site fields
-            siteId: sites.siteId,
-            siteType: sites.type,
-            siteOnline: sites.online,
-            subnet: sites.subnet,
-            siteExitNodeId: sites.exitNodeId
-        })
-        .from(browserGatewayTarget)
-        .innerJoin(sites, eq(sites.siteId, browserGatewayTarget.siteId))
-        .innerJoin(
-            resources,
-            eq(resources.resourceId, browserGatewayTarget.resourceId)
-        )
-        .leftJoin(domains, eq(domains.domainId, resources.domainId))
-        .leftJoin(
-            domainNamespaces,
-            eq(domainNamespaces.domainId, resources.domainId)
-        )
-        .where(
-            and(
-                eq(resources.enabled, true),
-                or(
-                    eq(sites.exitNodeId, exitNodeId),
-                    and(
-                        isNull(sites.exitNodeId),
-                        sql`(${siteTypes.includes("local") ? 1 : 0} = 1)`,
-                        eq(sites.type, "local"),
-                        sql`(${build != "saas" ? 1 : 0} = 1)`
-                    )
-                ),
-                inArray(sites.type, siteTypes)
-            )
-        );
-
-    // Group browser gateway targets by resource
-    type BrowserGatewayResourceEntry = {
-        resourceId: number;
-        name: string;
-        fullDomain: string | null;
-        ssl: boolean | null;
-        subdomain: string | null;
-        domainId: string | null;
-        enabled: boolean | null;
-        wildcard: boolean | null;
-        domainCertResolver: string | null;
-        preferWildcardCert: boolean | null;
-        targets: {
-            browserGatewayTargetId: number;
-            bgType: string;
-            siteId: number;
-            siteType: string;
-            siteOnline: boolean | null;
-            subnet: string | null;
-            siteExitNodeId: number | null;
-        }[];
-    };
-    const browserGatewayResourcesMap = new Map<
-        number,
-        BrowserGatewayResourceEntry
-    >();
-
-    for (const row of browserGatewayRows) {
-        if (filterOutNamespaceDomains && row.domainNamespaceId) {
-            continue;
-        }
-        if (!browserGatewayResourcesMap.has(row.resourceId)) {
-            browserGatewayResourcesMap.set(row.resourceId, {
-                resourceId: row.resourceId,
-                name: sanitize(row.resourceName) || "",
-                fullDomain: row.fullDomain,
-                ssl: row.ssl,
-                subdomain: row.subdomain,
-                domainId: row.domainId,
-                enabled: row.enabled,
-                wildcard: row.wildcard,
-                domainCertResolver: row.domainCertResolver,
-                preferWildcardCert: row.preferWildcardCert,
-                targets: []
-            });
-        }
-        browserGatewayResourcesMap.get(row.resourceId)!.targets.push({
-            browserGatewayTargetId: row.browserGatewayTargetId,
-            bgType: row.bgType,
-            siteId: row.siteId,
-            siteType: row.siteType,
-            siteOnline: row.siteOnline,
-            subnet: row.subnet,
-            siteExitNodeId: row.siteExitNodeId
-        });
-    }
-
     let siteResourcesWithFullDomain: {
         siteResourceId: number;
         fullDomain: string | null;
-        mode: "http" | "host" | "cidr" | "ssh";
+        mode: "http" | "host" | "cidr";
     }[] = [];
     if (build == "enterprise") {
         // we dont want to do this on the cloud
@@ -432,12 +324,6 @@ export async function getTraefikConfig(
                 domains.add(sr.fullDomain);
             }
         }
-        // Include browser gateway resource domains
-        for (const bgResource of browserGatewayResourcesMap.values()) {
-            if (bgResource.enabled && bgResource.ssl && bgResource.fullDomain) {
-                domains.add(bgResource.fullDomain);
-            }
-        }
         // get the valid certs for these domains
         validCerts = await getValidCertificatesForDomains(domains, true); // we are caching here because this is called often
         // logger.debug(`Valid certs for domains: ${JSON.stringify(validCerts)}`);
@@ -703,7 +589,7 @@ export async function getTraefikConfig(
                             resource.ssl ? entrypointHttps : entrypointHttp
                         ],
                         service: maintenanceServiceName,
-                        rule: `${rule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`)) `,
+                        rule: `${rule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`))`,
                         priority: 2001,
                         ...(resource.ssl ? { tls } : {})
                     };
@@ -944,7 +830,7 @@ export async function getTraefikConfig(
                 continue;
             }
 
-            const protocol = resource.mode == "udp" ? "udp" : "tcp";
+            const protocol = resource.protocol.toLowerCase();
             const port = resource.proxyPort;
 
             if (!port) {
@@ -1039,185 +925,6 @@ export async function getTraefikConfig(
         }
     }
 
-    // Generate Traefik config for browser gateway resources
-    const browserGatewayPort = 39999;
-    for (const [, bgResource] of browserGatewayResourcesMap.entries()) {
-        if (!bgResource.enabled) continue;
-        if (!bgResource.domainId) continue;
-        if (!bgResource.fullDomain) continue;
-
-        if (!config_output.http.routers) config_output.http.routers = {};
-        if (!config_output.http.services) config_output.http.services = {};
-
-        const fullDomain = bgResource.fullDomain;
-        const additionalMiddlewares =
-            config.getRawConfig().traefik.additional_middlewares || [];
-        const routerMiddlewares = [
-            badgerMiddlewareName,
-            ...additionalMiddlewares
-        ];
-
-        const hostRule = `Host(\`${fullDomain}\`)`;
-
-        // Build TLS config
-        let tls = {};
-        if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
-            const domainParts = fullDomain.split(".");
-            let wildCard: string;
-            if (domainParts.length <= 2) {
-                wildCard = `*.${domainParts.join(".")}`;
-            } else {
-                wildCard = `*.${domainParts.slice(1).join(".")}`;
-            }
-            if (!bgResource.subdomain) {
-                wildCard = fullDomain;
-            }
-
-            const globalDefaultResolver =
-                config.getRawConfig().traefik.cert_resolver;
-            const globalDefaultPreferWildcard =
-                config.getRawConfig().traefik.prefer_wildcard_cert;
-            const resolverName = bgResource.domainCertResolver
-                ? bgResource.domainCertResolver.trim()
-                : globalDefaultResolver;
-            const preferWildcard =
-                bgResource.preferWildcardCert !== undefined &&
-                bgResource.preferWildcardCert !== null
-                    ? bgResource.preferWildcardCert
-                    : globalDefaultPreferWildcard;
-
-            tls = {
-                certResolver: resolverName,
-                ...(preferWildcard ? { domains: [{ main: wildCard }] } : {})
-            };
-        } else {
-            const matchingCert = validCerts.find(
-                (cert) => cert.queriedDomain === fullDomain
-            );
-            if (!matchingCert) {
-                logger.debug(
-                    `No matching certificate found for browser gateway domain: ${fullDomain}`
-                );
-                continue;
-            }
-        }
-
-        const bgUiServiceName = `bg-r${bgResource.resourceId}-ui-service`;
-
-        if (bgResource.ssl) {
-            const redirectRouterName = `bg-r${bgResource.resourceId}-redirect`;
-            config_output.http.routers![redirectRouterName] = {
-                entryPoints: [config.getRawConfig().traefik.http_entrypoint],
-                middlewares: [redirectHttpsMiddlewareName],
-                service: bgUiServiceName,
-                rule: hostRule,
-                priority: 100
-            };
-        }
-
-        // Collect online sites for this resource (for any type)
-        const anySiteOnline = bgResource.targets.some((t) => t.siteOnline);
-
-        // Group targets by type and generate per-type websocket routers and services
-        const typeMap = new Map<string, typeof bgResource.targets>();
-        for (const t of bgResource.targets) {
-            if (!typeMap.has(t.bgType)) typeMap.set(t.bgType, []);
-            typeMap.get(t.bgType)!.push(t);
-        }
-
-        for (const [bgType, typedTargets] of typeMap.entries()) {
-            const bgKey = `bg-r${bgResource.resourceId}-${bgType}`;
-            const bgRouterName = `${bgKey}-router`;
-            const bgServiceName = `${bgKey}-service`;
-            const bgRule = `${hostRule} && PathPrefix(\`/gateway/${bgType}\`)`;
-
-            const servers = typedTargets
-                .filter((t) => {
-                    if (!t.siteOnline && anySiteOnline) return false;
-                    if (t.siteType === "newt") return !!t.subnet;
-                    return false; // browser gateway only supported on newt sites
-                })
-                .map((t) => ({
-                    url: `http://${t.subnet!.split("/")[0]}:${browserGatewayPort}`
-                }))
-                .filter((v, i, a) => a.findIndex((u) => u.url === v.url) === i);
-
-            config_output.http.routers![bgRouterName] = {
-                entryPoints: [
-                    bgResource.ssl
-                        ? config.getRawConfig().traefik.https_entrypoint
-                        : config.getRawConfig().traefik.http_entrypoint
-                ],
-                middlewares: routerMiddlewares,
-                service: bgServiceName,
-                rule: bgRule,
-                priority: 110, // highest - websocket path takes precedence
-                ...(bgResource.ssl ? { tls } : {})
-            };
-
-            config_output.http.services![bgServiceName] = {
-                loadBalancer: {
-                    servers
-                }
-            };
-        }
-
-        // UI: serve the browser gateway page from the internal pangolin instance.
-        // The primary type is used for the path rewrite (e.g. /rdp), mirroring
-        // how the maintenance page rewrites everything to /maintenance-screen.
-        const primaryType = typeMap.keys().next().value as string;
-        const internalHost = config.getRawConfig().server.internal_hostname;
-        const internalPort = config.getRawConfig().server.next_port;
-        const uiRewriteMiddlewareName = `bg-r${bgResource.resourceId}-ui-rewrite`;
-        const entrypoint = bgResource.ssl
-            ? config.getRawConfig().traefik.https_entrypoint
-            : config.getRawConfig().traefik.http_entrypoint;
-
-        if (!config_output.http.middlewares) {
-            config_output.http.middlewares = {};
-        }
-
-        config_output.http.middlewares![uiRewriteMiddlewareName] = {
-            replacePathRegex: {
-                regex: "^/(.*)",
-                replacement: `/${primaryType}`
-            }
-        };
-
-        config_output.http.services![bgUiServiceName] = {
-            loadBalancer: {
-                servers: [
-                    {
-                        url: `http://${internalHost}:${internalPort}`
-                    }
-                ]
-            }
-        };
-
-        // Assets router at higher priority so /_next files load without rewrite
-        config_output.http.routers![
-            `bg-r${bgResource.resourceId}-assets-router`
-        ] = {
-            entryPoints: [entrypoint],
-            middlewares: routerMiddlewares,
-            service: bgUiServiceName,
-            rule: `${hostRule} && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
-            priority: 101,
-            ...(bgResource.ssl ? { tls } : {})
-        };
-
-        // Catch-all router rewrites everything on the domain to /{primaryType}
-        config_output.http.routers![`bg-r${bgResource.resourceId}-ui-router`] =
-            {
-                entryPoints: [entrypoint],
-                middlewares: [...routerMiddlewares, uiRewriteMiddlewareName],
-                service: bgUiServiceName,
-                rule: hostRule,
-                priority: 100,
-                ...(bgResource.ssl ? { tls } : {})
-            };
-    }
-
     // Add Traefik routes for siteResource aliases (HTTP mode + SSL) so that
     // Traefik generates TLS certificates for those domains even when no
     // matching resource exists yet.
@@ -1333,7 +1040,7 @@ export async function getTraefikConfig(
             config_output.http.routers[`${siteResourceRouterName}-assets`] = {
                 entryPoints: [config.getRawConfig().traefik.https_entrypoint],
                 service: siteResourceServiceName,
-                rule: `Host(\`${fullDomain}\`) && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
+                rule: `Host(\`${fullDomain}\`) && (PathPrefix(\`/_next\`) || PathRegexp(\`^/__nextjs*\`))`,
                 priority: 101,
                 tls
             };
@@ -1436,7 +1143,7 @@ export async function getTraefikConfig(
                         config.getRawConfig().traefik.https_entrypoint
                     ],
                     service: "landing-service",
-                    rule: `Host(\`${fullDomain}\`) && (PathRegexp(\`^/auth/resource/[^/]+$\`) || PathRegexp(\`^/auth/idp/[0-9]+/oidc/callback\`) || PathPrefix(\`/_next\`) || Path(\`/auth/org\`) || PathRegexp(\`^/__nextjs*\`) || Path(\`/favicon.ico\`))`,
+                    rule: `Host(\`${fullDomain}\`) && (PathRegexp(\`^/auth/resource/[^/]+$\`) || PathRegexp(\`^/auth/idp/[0-9]+/oidc/callback\`) || PathPrefix(\`/_next\`) || Path(\`/auth/org\`) || PathRegexp(\`^/__nextjs*\`))`,
                     priority: 203,
                     tls: tls
                 };

server/private/routers/browserGatewayTarget/createBrowserGatewayTarget.ts

@@ -1,187 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import {
-    browserGatewayTarget,
-    BrowserGatewayTarget,
-    db,
-    newts,
-    resources,
-    sites
-} from "@server/db";
-import { eq, and } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { encrypt } from "@server/lib/crypto";
-import config from "@server/lib/config";
-import { sendBrowserGatewayTargets } from "@server/routers/newt/targets";
-import { generateId } from "@server/auth/sessions/app";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty(),
-    resourceId: z.string().transform(Number).pipe(z.number().int().positive())
-});
-
-const bodySchema = z.strictObject({
-    siteId: z.number().int().positive(),
-    type: z.enum(["ssh", "rdp", "vnc"]),
-    destination: z.string().nonempty(),
-    destinationPort: z.number().int().min(1).max(65535)
-});
-
-export type CreateBrowserGatewayTargetResponse = BrowserGatewayTarget;
-
-registry.registerPath({
-    method: "put",
-    path: "/org/{orgId}/resource/{resourceId}/browser-gateway-target",
-    description: "Create a browser gateway target for a resource.",
-    tags: [OpenAPITags.Org],
-    request: {
-        params: paramsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: bodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function createBrowserGatewayTarget(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId, resourceId } = parsedParams.data;
-
-        const parsedBody = bodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { siteId, type, destination, destinationPort } = parsedBody.data;
-
-        const [resource] = await db
-            .select()
-            .from(resources)
-            .where(
-                and(
-                    eq(resources.resourceId, resourceId),
-                    eq(resources.orgId, orgId)
-                )
-            )
-            .limit(1);
-
-        if (!resource) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource with ID ${resourceId} not found in organization ${orgId}`
-                )
-            );
-        }
-
-        const [site] = await db
-            .select()
-            .from(sites)
-            .where(and(eq(sites.siteId, siteId), eq(sites.orgId, orgId)))
-            .limit(1);
-
-        if (!site) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Site with ID ${siteId} not found in organization ${orgId}`
-                )
-            );
-        }
-
-        const plainToken = generateId(48);
-        const encryptedToken = encrypt(
-            plainToken,
-            config.getRawConfig().server.secret!
-        );
-
-        const [record] = await db
-            .insert(browserGatewayTarget)
-            .values({
-                resourceId,
-                siteId,
-                type,
-                destination,
-                destinationPort,
-                authToken: encryptedToken
-            })
-            .returning();
-
-        if (site.type === "newt") {
-            const [newt] = await db
-                .select()
-                .from(newts)
-                .where(eq(newts.siteId, siteId))
-                .limit(1);
-
-            if (newt) {
-                await sendBrowserGatewayTargets(
-                    newt.newtId,
-                    [record],
-                    newt.version
-                );
-            }
-        }
-
-        logger.info(
-            `Created browser gateway target ${record.browserGatewayTargetId} for resource ${resourceId}`
-        );
-
-        return response<CreateBrowserGatewayTargetResponse>(res, {
-            data: record,
-            success: true,
-            error: false,
-            message: "Browser gateway target created successfully",
-            status: HttpCode.CREATED
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to create browser gateway target"
-            )
-        );
-    }
-}

server/private/routers/browserGatewayTarget/deleteBrowserGatewayTarget.ts

@@ -1,130 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { browserGatewayTarget, db, newts, sites } from "@server/db";
-import { eq, and } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { removeBrowserGatewayTarget } from "@server/routers/newt/targets";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty(),
-    browserGatewayTargetId: z
-        .string()
-        .transform(Number)
-        .pipe(z.number().int().positive())
-});
-
-registry.registerPath({
-    method: "delete",
-    path: "/org/{orgId}/browser-gateway-target/{browserGatewayTargetId}",
-    description: "Delete a browser gateway target.",
-    tags: [OpenAPITags.Org],
-    request: {
-        params: paramsSchema
-    },
-    responses: {}
-});
-
-export async function deleteBrowserGatewayTarget(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId, browserGatewayTargetId } = parsedParams.data;
-
-        const [existing] = await db
-            .select({ bgt: browserGatewayTarget, site: sites })
-            .from(browserGatewayTarget)
-            .innerJoin(sites, eq(sites.siteId, browserGatewayTarget.siteId))
-            .where(
-                and(
-                    eq(
-                        browserGatewayTarget.browserGatewayTargetId,
-                        browserGatewayTargetId
-                    ),
-                    eq(sites.orgId, orgId)
-                )
-            )
-            .limit(1);
-
-        if (!existing) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Browser gateway target with ID ${browserGatewayTargetId} not found`
-                )
-            );
-        }
-
-        await db
-            .delete(browserGatewayTarget)
-            .where(
-                eq(
-                    browserGatewayTarget.browserGatewayTargetId,
-                    browserGatewayTargetId
-                )
-            );
-
-        if (existing.site.type === "newt") {
-            const [newt] = await db
-                .select()
-                .from(newts)
-                .where(eq(newts.siteId, existing.bgt.siteId))
-                .limit(1);
-
-            if (newt) {
-                await removeBrowserGatewayTarget(
-                    newt.newtId,
-                    browserGatewayTargetId,
-                    newt.version
-                );
-            }
-        }
-
-        logger.info(`Deleted browser gateway target ${browserGatewayTargetId}`);
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Browser gateway target deleted successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to delete browser gateway target"
-            )
-        );
-    }
-}

server/private/routers/browserGatewayTarget/getBrowserGatewayTarget.ts

@@ -1,109 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import {
-    browserGatewayTarget,
-    BrowserGatewayTarget,
-    db,
-    sites
-} from "@server/db";
-import { eq, and } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty(),
-    browserGatewayTargetId: z
-        .string()
-        .transform(Number)
-        .pipe(z.number().int().positive())
-});
-
-export type GetBrowserGatewayTargetResponse = BrowserGatewayTarget;
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/browser-gateway-target/{browserGatewayTargetId}",
-    description: "Get a browser gateway target.",
-    tags: [OpenAPITags.Org],
-    request: {
-        params: paramsSchema
-    },
-    responses: {}
-});
-
-export async function getBrowserGatewayTarget(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId, browserGatewayTargetId } = parsedParams.data;
-
-        const [result] = await db
-            .select({ bgt: browserGatewayTarget })
-            .from(browserGatewayTarget)
-            .innerJoin(sites, eq(sites.siteId, browserGatewayTarget.siteId))
-            .where(
-                and(
-                    eq(
-                        browserGatewayTarget.browserGatewayTargetId,
-                        browserGatewayTargetId
-                    ),
-                    eq(sites.orgId, orgId)
-                )
-            )
-            .limit(1);
-
-        if (!result) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Browser gateway target with ID ${browserGatewayTargetId} not found`
-                )
-            );
-        }
-
-        return response<GetBrowserGatewayTargetResponse>(res, {
-            data: result.bgt,
-            success: true,
-            error: false,
-            message: "Browser gateway target retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to retrieve browser gateway target"
-            )
-        );
-    }
-}

server/private/routers/browserGatewayTarget/index.ts

@@ -1,18 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-export * from "./createBrowserGatewayTarget";
-export * from "./updateBrowserGatewayTarget";
-export * from "./deleteBrowserGatewayTarget";
-export * from "./getBrowserGatewayTarget";
-export * from "./listBrowserGatewayTargets";

server/private/routers/browserGatewayTarget/listBrowserGatewayTargets.ts

@@ -1,148 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import {
-    browserGatewayTarget,
-    BrowserGatewayTarget,
-    db,
-    resources,
-    sites
-} from "@server/db";
-import { eq, and } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty(),
-    resourceId: z.string().transform(Number).pipe(z.number().int().positive())
-});
-
-const querySchema = z.object({
-    limit: z
-        .string()
-        .optional()
-        .default("1000")
-        .transform(Number)
-        .pipe(z.number().int().positive()),
-    offset: z
-        .string()
-        .optional()
-        .default("0")
-        .transform(Number)
-        .pipe(z.number().int().nonnegative())
-});
-
-export type ListBrowserGatewayTargetsResponse = {
-    targets: BrowserGatewayTarget[];
-    total: number;
-    limit: number;
-    offset: number;
-};
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/resource/{resourceId}/browser-gateway-targets",
-    description: "List browser gateway targets for a resource.",
-    tags: [OpenAPITags.Org],
-    request: {
-        params: paramsSchema,
-        query: querySchema
-    },
-    responses: {}
-});
-
-export async function listBrowserGatewayTargets(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId, resourceId } = parsedParams.data;
-
-        const parsedQuery = querySchema.safeParse(req.query);
-        if (!parsedQuery.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedQuery.error).toString()
-                )
-            );
-        }
-
-        const { limit, offset } = parsedQuery.data;
-
-        const [resource] = await db
-            .select()
-            .from(resources)
-            .where(
-                and(
-                    eq(resources.resourceId, resourceId),
-                    eq(resources.orgId, orgId)
-                )
-            )
-            .limit(1);
-
-        if (!resource) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource with ID ${resourceId} not found in organization ${orgId}`
-                )
-            );
-        }
-
-        const targets = await db
-            .select()
-            .from(browserGatewayTarget)
-            .where(eq(browserGatewayTarget.resourceId, resourceId))
-            .limit(limit)
-            .offset(offset);
-
-        return response<ListBrowserGatewayTargetsResponse>(res, {
-            data: {
-                targets: targets,
-                total: targets.length,
-                limit,
-                offset
-            },
-            success: true,
-            error: false,
-            message: "Browser gateway targets retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to list browser gateway targets"
-            )
-        );
-    }
-}

server/private/routers/browserGatewayTarget/updateBrowserGatewayTarget.ts

@@ -1,180 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import {
-    browserGatewayTarget,
-    BrowserGatewayTarget,
-    db,
-    newts,
-    sites
-} from "@server/db";
-import { eq, and } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { sendBrowserGatewayTargets } from "@server/routers/newt/targets";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty(),
-    browserGatewayTargetId: z
-        .string()
-        .transform(Number)
-        .pipe(z.number().int().positive())
-});
-
-const bodySchema = z.strictObject({
-    siteId: z.number().int().positive().optional(),
-    type: z.enum(["ssh", "rdp", "vnc"]).optional(),
-    destination: z.string().nonempty().optional(),
-    destinationPort: z.number().int().min(1).max(65535).optional()
-});
-
-export type UpdateBrowserGatewayTargetResponse = BrowserGatewayTarget;
-
-registry.registerPath({
-    method: "post",
-    path: "/org/{orgId}/browser-gateway-target/{browserGatewayTargetId}",
-    description: "Update a browser gateway target.",
-    tags: [OpenAPITags.Org],
-    request: {
-        params: paramsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: bodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function updateBrowserGatewayTarget(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId, browserGatewayTargetId } = parsedParams.data;
-
-        const parsedBody = bodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { siteId, type, destination, destinationPort } = parsedBody.data;
-
-        const [existing] = await db
-            .select({ bgt: browserGatewayTarget, site: sites })
-            .from(browserGatewayTarget)
-            .innerJoin(sites, eq(sites.siteId, browserGatewayTarget.siteId))
-            .where(
-                and(
-                    eq(
-                        browserGatewayTarget.browserGatewayTargetId,
-                        browserGatewayTargetId
-                    ),
-                    eq(sites.orgId, orgId)
-                )
-            )
-            .limit(1);
-
-        if (!existing) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Browser gateway target with ID ${browserGatewayTargetId} not found`
-                )
-            );
-        }
-
-        const updateValues: Partial<BrowserGatewayTarget> = {};
-        if (siteId !== undefined) updateValues.siteId = siteId;
-        if (type !== undefined) updateValues.type = type;
-        if (destination !== undefined) updateValues.destination = destination;
-        if (destinationPort !== undefined)
-            updateValues.destinationPort = destinationPort;
-
-        const [updated] = await db
-            .update(browserGatewayTarget)
-            .set(updateValues)
-            .where(
-                eq(
-                    browserGatewayTarget.browserGatewayTargetId,
-                    browserGatewayTargetId
-                )
-            )
-            .returning();
-
-        const targetSiteId = siteId ?? existing.bgt.siteId;
-        const [site] = await db
-            .select()
-            .from(sites)
-            .where(eq(sites.siteId, targetSiteId))
-            .limit(1);
-
-        if (site && site.type === "newt") {
-            const [newt] = await db
-                .select()
-                .from(newts)
-                .where(eq(newts.siteId, targetSiteId))
-                .limit(1);
-
-            if (newt) {
-                await sendBrowserGatewayTargets(
-                    newt.newtId,
-                    [updated],
-                    newt.version
-                );
-            }
-        }
-
-        logger.info(`Updated browser gateway target ${browserGatewayTargetId}`);
-
-        return response<UpdateBrowserGatewayTargetResponse>(res, {
-            data: updated,
-            success: true,
-            error: false,
-            message: "Browser gateway target updated successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to update browser gateway target"
-            )
-        );
-    }
-}

server/private/routers/external.ts

@@ -31,11 +31,8 @@ import * as siteProvisioning from "#private/routers/siteProvisioning";
 import * as eventStreamingDestination from "#private/routers/eventStreamingDestination";
 import * as alertRule from "#private/routers/alertRule";
 import * as healthChecks from "#private/routers/healthChecks";
-import * as browserGatewayTarget from "#private/routers/browserGatewayTarget";
 import * as labels from "#private/routers/labels";
 import * as client from "@server/routers/client";
-import * as resource from "#private/routers/resource";
-import * as policy from "#private/routers/policy";
 
 import {
     verifyOrgAccess,
@@ -49,8 +46,7 @@ import {
     verifyUserCanSetUserOrgRoles,
     verifySiteProvisioningKeyAccess,
     verifyIsLoggedInUser,
-    verifyAdmin,
-    verifyResourcePolicyAccess
+    verifyAdmin
 } from "@server/middlewares";
 import { ActionsEnum } from "@server/auth/actions";
 import {
@@ -388,39 +384,6 @@ authenticated.get(
     approval.countApprovals
 );
 
-authenticated.delete(
-    "/resource-policy/:resourcePolicyId",
-    verifyResourcePolicyAccess,
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.resourcePolicies),
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.deleteResourcePolicy),
-    logActionAudit(ActionsEnum.deleteResourcePolicy),
-    policy.deleteResourcePolicy
-);
-
-authenticated.get(
-    "/org/:orgId/resource-policies",
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.resourcePolicies),
-    verifyOrgAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.listResourcePolicies),
-    logActionAudit(ActionsEnum.listResourcePolicies),
-    policy.listResourcePolicies
-);
-
-authenticated.post(
-    "/org/:orgId/resource-policy",
-    verifyValidLicense,
-    verifyValidSubscription(tierMatrix.resourcePolicies),
-    verifyOrgAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.createResourcePolicy),
-    logActionAudit(ActionsEnum.createResourcePolicy),
-    policy.createResourcePolicy
-);
-
 authenticated.put(
     "/org/:orgId/approvals/:approvalId",
     verifyValidLicense,
@@ -879,48 +842,3 @@ authenticated.post(
     verifyClientAccess,
     client.rebuildClientAssociationsCacheRoute
 );
-
-authenticated.put(
-    "/org/:orgId/resource/:resourceId/browser-gateway-target",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.createBrowserGatewayTarget),
-    logActionAudit(ActionsEnum.createBrowserGatewayTarget),
-    browserGatewayTarget.createBrowserGatewayTarget
-);
-
-authenticated.get(
-    "/org/:orgId/resource/:resourceId/browser-gateway-targets",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.listBrowserGatewayTargets),
-    browserGatewayTarget.listBrowserGatewayTargets
-);
-
-authenticated.get(
-    "/org/:orgId/browser-gateway-target/:browserGatewayTargetId",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.getBrowserGatewayTarget),
-    browserGatewayTarget.getBrowserGatewayTarget
-);
-
-authenticated.post(
-    "/org/:orgId/browser-gateway-target/:browserGatewayTargetId",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.updateBrowserGatewayTarget),
-    logActionAudit(ActionsEnum.updateBrowserGatewayTarget),
-    browserGatewayTarget.updateBrowserGatewayTarget
-);
-
-authenticated.delete(
-    "/org/:orgId/browser-gateway-target/:browserGatewayTargetId",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.deleteBrowserGatewayTarget),
-    logActionAudit(ActionsEnum.deleteBrowserGatewayTarget),
-    browserGatewayTarget.deleteBrowserGatewayTarget
-);

server/private/routers/hybrid.ts

@@ -45,11 +45,8 @@ import {
     users,
     userOrgs,
     roleResources,
-    rolePolicies,
     userResources,
-    userPolicies,
     resourceRules,
-    resourcePolicyRules,
     userOrgRoles,
     roles
 } from "@server/db";
@@ -433,10 +430,7 @@ hybridRouter.get(
                 );
 
                 // Decrypt and save key file
-                const decryptedKey = decrypt(
-                    cert.keyFile!,
-                    config.getRawConfig().server.secret!
-                );
+                const decryptedKey = decrypt(cert.keyFile!, config.getRawConfig().server.secret!);
 
                 // Return only the certificate data without org information
                 return {
@@ -537,10 +531,7 @@ hybridRouter.get(
                         wildcardCandidates.length > 0
                             ? and(
                                   eq(resources.wildcard, true),
-                                  inArray(
-                                      resources.fullDomain,
-                                      wildcardCandidates
-                                  )
+                                  inArray(resources.fullDomain, wildcardCandidates)
                               )
                             : sql`false`
                     )
@@ -554,10 +545,10 @@ hybridRouter.get(
 
             if (
                 result &&
-                (await checkExitNodeOrg(
+                await checkExitNodeOrg(
                     remoteExitNode.exitNodeId,
                     result.resources.orgId
-                ))
+                )
             ) {
                 // If the exit node is not allowed for the org, return an error
                 return next(
@@ -1141,43 +1132,22 @@ hybridRouter.get(
                 );
             }
 
-            const [direct, viaPolicies] = await Promise.all([
-                db
-                    .select()
-                    .from(roleResources)
-                    .where(
-                        and(
-                            eq(roleResources.resourceId, resourceId),
-                            eq(roleResources.roleId, roleId)
-                        )
+            const roleResourceAccess = await db
+                .select()
+                .from(roleResources)
+                .where(
+                    and(
+                        eq(roleResources.resourceId, resourceId),
+                        eq(roleResources.roleId, roleId)
                     )
-                    .limit(1),
-                db
-                    .select({
-                        roleId: rolePolicies.roleId,
-                        resourcePolicyId: rolePolicies.resourcePolicyId
-                    })
-                    .from(rolePolicies)
-                    .innerJoin(
-                        resources,
-                        eq(
-                            resources.resourcePolicyId,
-                            rolePolicies.resourcePolicyId
-                        )
-                    )
-                    .where(
-                        and(
-                            eq(resources.resourceId, resourceId),
-                            eq(rolePolicies.roleId, roleId)
-                        )
-                    )
-                    .limit(1)
-            ]);
+                )
+                .limit(1);
 
-            const result = direct[0] ?? viaPolicies[0] ?? null;
+            const result =
+                roleResourceAccess.length > 0 ? roleResourceAccess[0] : null;
 
             return response<typeof roleResources.$inferSelect | null>(res, {
-                data: result as any,
+                data: result,
                 success: true,
                 error: false,
                 message: result
@@ -1252,44 +1222,21 @@ hybridRouter.get(
                 );
             }
 
-            const [direct, viaPolicies] = await Promise.all([
-                db
-                    .select({
-                        resourceId: roleResources.resourceId,
-                        roleId: roleResources.roleId
-                    })
-                    .from(roleResources)
-                    .where(
-                        and(
-                            eq(roleResources.resourceId, resourceId),
-                            inArray(roleResources.roleId, roleIds)
-                        )
-                    ),
-                roleIds.length > 0
-                    ? db
-                          .select({
-                              resourceId: sql<number>`${resourceId}`,
-                              roleId: rolePolicies.roleId
-                          })
-                          .from(rolePolicies)
-                          .innerJoin(
-                              resources,
-                              eq(
-                                  resources.resourcePolicyId,
-                                  rolePolicies.resourcePolicyId
-                              )
-                          )
-                          .where(
-                              and(
-                                  eq(resources.resourceId, resourceId),
-                                  inArray(rolePolicies.roleId, roleIds)
-                              )
-                          )
-                    : Promise.resolve([])
-            ]);
+            const roleResourceAccess = await db
+                .select({
+                    resourceId: roleResources.resourceId,
+                    roleId: roleResources.roleId
+                })
+                .from(roleResources)
+                .where(
+                    and(
+                        eq(roleResources.resourceId, resourceId),
+                        inArray(roleResources.roleId, roleIds)
+                    )
+                );
 
-            const combined = [...direct, ...viaPolicies];
-            const result = combined.length > 0 ? combined : null;
+            const result =
+                roleResourceAccess.length > 0 ? roleResourceAccess : null;
 
             return response<{ resourceId: number; roleId: number }[] | null>(
                 res,
@@ -1450,45 +1397,10 @@ hybridRouter.get(
                 );
             }
 
-            const [directRules, policyRules] = await Promise.all([
-                db
-                    .select()
-                    .from(resourceRules)
-                    .where(eq(resourceRules.resourceId, resourceId)),
-                db
-                    .select({
-                        ruleId: resourcePolicyRules.ruleId,
-                        resourceId: sql<number>`${resourceId}`,
-                        enabled: resourcePolicyRules.enabled,
-                        priority: resourcePolicyRules.priority,
-                        action: resourcePolicyRules.action,
-                        match: resourcePolicyRules.match,
-                        value: resourcePolicyRules.value
-                    })
-                    .from(resourcePolicyRules)
-                    .innerJoin(
-                        resources,
-                        eq(
-                            resources.resourcePolicyId,
-                            resourcePolicyRules.resourcePolicyId
-                        )
-                    )
-                    .where(eq(resources.resourceId, resourceId))
-            ]);
-
-            const maxDirectPriority = directRules.reduce(
-                (max, r) => Math.max(max, r.priority),
-                0
-            );
-            const offsetPolicyRules = policyRules.map((r) => ({
-                ...r,
-                priority: maxDirectPriority + r.priority
-            }));
-
-            const rules = [
-                ...directRules,
-                ...offsetPolicyRules
-            ] as (typeof resourceRules.$inferSelect)[];
+            const rules = await db
+                .select()
+                .from(resourceRules)
+                .where(eq(resourceRules.resourceId, resourceId));
 
             // backward compatibility: COUNTRY -> GEOIP
             // TODO: remove this after a few versions once all exit nodes are updated

server/private/routers/integration.ts

@@ -16,7 +16,6 @@ import * as org from "#private/routers/org";
 import * as logs from "#private/routers/auditLogs";
 import * as alertEvents from "#private/routers/alertEvents";
 import * as certificates from "#private/routers/certificates";
-import * as browserGatewayTarget from "#private/routers/browserGatewayTarget";
 
 import {
     verifyApiKeyHasAction,
@@ -216,43 +215,3 @@ authenticated.delete(
     logActionAudit(ActionsEnum.removeUserRole),
     user.removeUserRole
 );
-
-authenticated.put(
-    "/org/:orgId/resource/:resourceId/browser-gateway-target",
-    verifyApiKeyOrgAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.createBrowserGatewayTarget),
-    logActionAudit(ActionsEnum.createBrowserGatewayTarget),
-    browserGatewayTarget.createBrowserGatewayTarget
-);
-
-authenticated.get(
-    "/org/:orgId/resource/:resourceId/browser-gateway-targets",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.listBrowserGatewayTargets),
-    browserGatewayTarget.listBrowserGatewayTargets
-);
-
-authenticated.get(
-    "/org/:orgId/browser-gateway-target/:browserGatewayTargetId",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.getBrowserGatewayTarget),
-    browserGatewayTarget.getBrowserGatewayTarget
-);
-
-authenticated.post(
-    "/org/:orgId/browser-gateway-target/:browserGatewayTargetId",
-    verifyApiKeyOrgAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.updateBrowserGatewayTarget),
-    logActionAudit(ActionsEnum.updateBrowserGatewayTarget),
-    browserGatewayTarget.updateBrowserGatewayTarget
-);
-
-authenticated.delete(
-    "/org/:orgId/browser-gateway-target/:browserGatewayTargetId",
-    verifyApiKeyOrgAccess,
-    verifyApiKeyHasAction(ActionsEnum.deleteBrowserGatewayTarget),
-    logActionAudit(ActionsEnum.deleteBrowserGatewayTarget),
-    browserGatewayTarget.deleteBrowserGatewayTarget
-);

server/private/routers/policy/createResourcePolicy.ts

@@ -1,417 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { hashPassword } from "@server/auth/password";
-import {
-    db,
-    idp,
-    idpOrg,
-    orgs,
-    resourcePolicies,
-    resourcePolicyHeaderAuth,
-    resourcePolicyPassword,
-    resourcePolicyPincode,
-    resourcePolicyRules,
-    resourcePolicyWhiteList,
-    rolePolicies,
-    roles,
-    userOrgs,
-    userPolicies,
-    users,
-    type ResourcePolicy
-} from "@server/db";
-import { getUniqueResourcePolicyName } from "@server/db/names";
-import response from "@server/lib/response";
-import {
-    isValidCIDR,
-    isValidIP,
-    isValidUrlGlobPattern
-} from "@server/lib/validators";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import { and, eq, inArray, type InferInsertModel } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import z from "zod";
-import { fromError } from "zod-validation-error";
-
-const createResourcePolicyParamsSchema = z.strictObject({
-    orgId: z.string()
-});
-
-const ruleSchema = z.strictObject({
-    action: z.enum(["ACCEPT", "DROP", "PASS"]).openapi({
-        type: "string",
-        enum: ["ACCEPT", "DROP", "PASS"],
-        description: "rule action"
-    }),
-    match: z.enum(["CIDR", "IP", "PATH"]).openapi({
-        type: "string",
-        enum: ["CIDR", "IP", "PATH"],
-        description: "rule match"
-    }),
-    value: z.string().min(1),
-    priority: z.int().openapi({
-        type: "integer",
-        description: "Rule priority"
-    }),
-    enabled: z.boolean().optional()
-});
-
-const createResourcePolicyBodySchema = z.strictObject({
-    name: z.string().min(1).max(255),
-    // Access control
-    sso: z.boolean().default(true),
-    skipToIdpId: z
-        .int()
-        .positive()
-        .optional()
-        .nullable()
-        .openapi({ type: "integer" }),
-    roleIds: z
-        .array(z.string().transform(Number).pipe(z.int().positive()))
-        .optional()
-        .default([]),
-    userIds: z.array(z.string()).optional().default([]),
-    // auth methods
-    password: z.string().min(4).max(100).nullable().optional(),
-    pincode: z
-        .string()
-        .regex(/^\d{6}$/)
-        .or(z.null())
-        .optional(),
-    headerAuth: z
-        .object({
-            user: z.string().min(4).max(100),
-            password: z.string().min(4).max(100),
-            extendedCompatibility: z.boolean()
-        })
-        .nullable()
-        .optional(),
-    // email OTP
-    emailWhitelistEnabled: z.boolean().optional().default(false),
-    emails: z
-        .array(
-            z.email().or(
-                z.string().regex(/^\*@[\w.-]+\.[a-zA-Z]{2,}$/, {
-                    error: "Invalid email address. Wildcard (*) must be the entire local part."
-                })
-            )
-        )
-        .max(50)
-        .transform((v) => v.map((e) => e.toLowerCase()))
-        .optional()
-        .default([]),
-    // rules
-    applyRules: z.boolean().default(false),
-    rules: z.array(ruleSchema).optional().default([])
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/org/{orgId}/resource-policy",
-    description: "Create a resource policy.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
-    request: {
-        params: createResourcePolicyParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: createResourcePolicyBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function createResourcePolicy(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        // Validate request params
-        const parsedParams = createResourcePolicyParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-        const { orgId } = parsedParams.data;
-
-        if (req.user && req.userOrgRoleIds?.length === 0) {
-            return next(
-                createHttpError(HttpCode.FORBIDDEN, "User does not have a role")
-            );
-        }
-
-        // get the org
-        const org = await db
-            .select()
-            .from(orgs)
-            .where(eq(orgs.orgId, orgId))
-            .limit(1);
-
-        if (org.length === 0) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Organization with ID ${orgId} not found`
-                )
-            );
-        }
-
-        const parsedBody = createResourcePolicyBodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const {
-            name,
-            sso,
-            userIds,
-            roleIds,
-            skipToIdpId,
-            applyRules,
-            emailWhitelistEnabled,
-            password,
-            pincode,
-            headerAuth,
-            emails,
-            rules
-        } = parsedBody.data;
-
-        // Check if Identity provider in `skipToIdpId` exists
-        if (skipToIdpId) {
-            const [provider] = await db
-                .select()
-                .from(idp)
-                .innerJoin(idpOrg, eq(idpOrg.idpId, idp.idpId))
-                .where(and(eq(idp.idpId, skipToIdpId), eq(idpOrg.orgId, orgId)))
-                .limit(1);
-
-            if (!provider) {
-                return next(
-                    createHttpError(
-                        HttpCode.INTERNAL_SERVER_ERROR,
-                        "Identity provider not found in this organization"
-                    )
-                );
-            }
-        }
-
-        const adminRole = await db
-            .select()
-            .from(roles)
-            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
-            .limit(1);
-
-        if (adminRole.length === 0) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, `Admin role not found`)
-            );
-        }
-
-        const existingRoles = await db
-            .select()
-            .from(roles)
-            .where(and(inArray(roles.roleId, roleIds)));
-
-        const hasAdminRole = existingRoles.some((role) => role.isAdmin);
-
-        if (hasAdminRole) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Admin role cannot be assigned to resource policy"
-                )
-            );
-        }
-
-        const existingUsers = await db
-            .select()
-            .from(users)
-            .innerJoin(userOrgs, eq(userOrgs.userId, users.userId))
-            .where(
-                and(eq(userOrgs.orgId, orgId), inArray(users.userId, userIds))
-            );
-
-        const niceId = await getUniqueResourcePolicyName(orgId);
-
-        for (const rule of rules) {
-            if (rule.match === "CIDR" && !isValidCIDR(rule.value)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid CIDR provided"
-                    )
-                );
-            } else if (rule.match === "IP" && !isValidIP(rule.value)) {
-                return next(
-                    createHttpError(HttpCode.BAD_REQUEST, "Invalid IP provided")
-                );
-            } else if (
-                rule.match === "PATH" &&
-                !isValidUrlGlobPattern(rule.value)
-            ) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid URL glob pattern provided"
-                    )
-                );
-            }
-        }
-
-        const policy = await db.transaction(async (trx) => {
-            const [newPolicy] = await trx
-                .insert(resourcePolicies)
-                .values({
-                    niceId,
-                    orgId,
-                    name,
-                    sso,
-                    idpId: skipToIdpId,
-                    applyRules,
-                    emailWhitelistEnabled
-                })
-                .returning();
-
-            const rolesToAdd = [
-                {
-                    roleId: adminRole[0].roleId,
-                    resourcePolicyId: newPolicy.resourcePolicyId
-                }
-            ] satisfies InferInsertModel<typeof rolePolicies>[];
-
-            rolesToAdd.push(
-                ...existingRoles.map((role) => ({
-                    roleId: role.roleId,
-                    resourcePolicyId: newPolicy.resourcePolicyId
-                }))
-            );
-
-            await trx.insert(rolePolicies).values(rolesToAdd);
-
-            const usersToAdd: InferInsertModel<typeof userPolicies>[] = [];
-
-            if (
-                req.user &&
-                !req.userOrgRoleIds?.includes(adminRole[0].roleId)
-            ) {
-                // make sure the user can access the policy
-                usersToAdd.push({
-                    userId: req.user?.userId!,
-                    resourcePolicyId: newPolicy.resourcePolicyId
-                });
-            }
-
-            usersToAdd.push(
-                ...existingUsers.map(({ user }) => ({
-                    userId: user.userId,
-                    resourcePolicyId: newPolicy.resourcePolicyId
-                }))
-            );
-
-            if (usersToAdd.length > 0) {
-                await trx.insert(userPolicies).values(usersToAdd);
-            }
-
-            if (password) {
-                const passwordHash = await hashPassword(password);
-
-                await trx.insert(resourcePolicyPassword).values({
-                    resourcePolicyId: newPolicy.resourcePolicyId,
-                    passwordHash
-                });
-            }
-
-            if (pincode) {
-                const pincodeHash = await hashPassword(pincode);
-
-                await trx.insert(resourcePolicyPincode).values({
-                    resourcePolicyId: newPolicy.resourcePolicyId,
-                    pincodeHash,
-                    digitLength: 6
-                });
-            }
-
-            if (headerAuth) {
-                const headerAuthHash = await hashPassword(
-                    Buffer.from(
-                        `${headerAuth.user}:${headerAuth.password}`
-                    ).toString("base64")
-                );
-
-                await trx.insert(resourcePolicyHeaderAuth).values({
-                    resourcePolicyId: newPolicy.resourcePolicyId,
-                    headerAuthHash,
-                    extendedCompatibility: headerAuth.extendedCompatibility
-                });
-            }
-
-            if (emailWhitelistEnabled && emails.length > 0) {
-                await trx.insert(resourcePolicyWhiteList).values(
-                    emails.map((email) => ({
-                        email,
-                        resourcePolicyId: newPolicy.resourcePolicyId
-                    }))
-                );
-            }
-
-            if (rules.length > 0) {
-                await trx.insert(resourcePolicyRules).values(
-                    rules.map((rule) => ({
-                        resourcePolicyId: newPolicy.resourcePolicyId,
-                        ...rule
-                    }))
-                );
-            }
-
-            return newPolicy;
-        });
-
-        if (!policy) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Failed to create policy"
-                )
-            );
-        }
-        return response<ResourcePolicy>(res, {
-            data: policy,
-            success: true,
-            error: false,
-            message: "resource policy created successfully",
-            status: HttpCode.CREATED
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/policy/deleteResourcePolicy.ts

@@ -1,107 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { db, resourcePolicies, resources } from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import { eq } from "drizzle-orm";
-import type { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import z from "zod";
-import { fromError } from "zod-validation-error";
-
-// Define Zod schema for request parameters validation
-const deleteResourcePolicySchema = z.strictObject({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "delete",
-    path: "/resource-policy/{resourcePolicyId}",
-    description: "Delete a resource policy.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: deleteResourcePolicySchema
-    },
-    responses: {}
-});
-
-export async function deleteResourcePolicy(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = deleteResourcePolicySchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-
-        const [existingResource] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
-
-        if (!existingResource) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource Policy with ID ${resourcePolicyId} not found`
-                )
-            );
-        }
-
-        const totalAffectedResources = await db.$count(
-            db
-                .select()
-                .from(resources)
-                .where(eq(resources.resourcePolicyId, resourcePolicyId))
-        );
-
-        if (totalAffectedResources > 0) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    `Cannot delete Policy '${existingResource.name}' as it's being used by at least one resource`
-                )
-            );
-        }
-
-        // delete policy
-        await db
-            .delete(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Resource Policy deleted successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/policy/index.ts

@@ -1,16 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-export * from "./createResourcePolicy";
-export * from "./listResourcePolicies";
-export * from "./deleteResourcePolicy";

server/private/routers/policy/listResourcePolicies.ts

@@ -1,271 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import {
-    db,
-    resourcePolicies,
-    resources,
-    rolePolicies,
-    userPolicies
-} from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import type {
-    ListResourcePoliciesResponse,
-    ResourcePolicyWithResources
-} from "@server/routers/resource/types";
-import HttpCode from "@server/types/HttpCode";
-import { and, asc, eq, inArray, like, or, sql } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromZodError } from "zod-validation-error";
-
-const listResourcePoliciesParamsSchema = z.strictObject({
-    orgId: z.string()
-});
-
-const listResourcePoliciesSchema = z.object({
-    pageSize: z.coerce
-        .number<string>() // for prettier formatting
-        .int()
-        .positive()
-        .optional()
-        .catch(20)
-        .default(20)
-        .openapi({
-            type: "integer",
-            default: 20,
-            description: "Number of items per page"
-        }),
-    page: z.coerce
-        .number<string>() // for prettier formatting
-        .int()
-        .min(0)
-        .optional()
-        .catch(1)
-        .default(1)
-        .openapi({
-            type: "integer",
-            default: 1,
-            description: "Page number to retrieve"
-        }),
-    query: z.string().optional()
-});
-
-function queryResourcePoliciesBase() {
-    return db
-        .select({
-            resourcePolicyId: resourcePolicies.resourcePolicyId,
-            name: resourcePolicies.name,
-            niceId: resourcePolicies.niceId,
-            orgId: resourcePolicies.orgId
-        })
-        .from(resourcePolicies);
-}
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/resource-policies",
-    description: "List resource policies for an organization.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
-    request: {
-        params: z.object({
-            orgId: z.string()
-        }),
-        query: listResourcePoliciesSchema
-    },
-    responses: {}
-});
-
-export async function listResourcePolicies(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedQuery = listResourcePoliciesSchema.safeParse(req.query);
-        if (!parsedQuery.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromZodError(parsedQuery.error)
-                )
-            );
-        }
-        const { page, pageSize, query } = parsedQuery.data;
-
-        const parsedParams = listResourcePoliciesParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromZodError(parsedParams.error)
-                )
-            );
-        }
-
-        const orgId =
-            parsedParams.data.orgId ||
-            req.userOrg?.orgId ||
-            req.apiKeyOrg?.orgId;
-
-        if (!orgId) {
-            return next(
-                createHttpError(HttpCode.BAD_REQUEST, "Invalid organization ID")
-            );
-        }
-
-        if (req.user && orgId && orgId !== req.userOrgId) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "User does not have access to this organization"
-                )
-            );
-        }
-
-        let accessibleResourcePolicies: Array<{ resourcePolicyId: number }>;
-        if (req.user) {
-            accessibleResourcePolicies = await db
-                .select({
-                    resourcePolicyId: sql<number>`COALESCE(${userPolicies.resourcePolicyId}, ${rolePolicies.resourcePolicyId})`
-                })
-                .from(userPolicies)
-                .fullJoin(
-                    rolePolicies,
-                    eq(
-                        userPolicies.resourcePolicyId,
-                        rolePolicies.resourcePolicyId
-                    )
-                )
-                .where(
-                    or(
-                        eq(userPolicies.userId, req.user!.userId),
-                        inArray(rolePolicies.roleId, req.userOrgRoleIds || [])
-                    )
-                );
-        } else {
-            accessibleResourcePolicies = await db
-                .select({
-                    resourcePolicyId: resourcePolicies.resourcePolicyId
-                })
-                .from(resourcePolicies)
-                .where(eq(resourcePolicies.orgId, orgId));
-        }
-
-        const accessibleResourceIds = accessibleResourcePolicies.map(
-            (resource) => resource.resourcePolicyId
-        );
-
-        const conditions = [
-            and(
-                inArray(
-                    resourcePolicies.resourcePolicyId,
-                    accessibleResourceIds
-                ),
-                eq(resourcePolicies.orgId, orgId),
-                eq(resourcePolicies.scope, "global")
-            )
-        ];
-
-        if (query) {
-            conditions.push(
-                or(
-                    like(
-                        sql`LOWER(${resourcePolicies.name})`,
-                        "%" + query.toLowerCase() + "%"
-                    ),
-                    like(
-                        sql`LOWER(${resourcePolicies.niceId})`,
-                        "%" + query.toLowerCase() + "%"
-                    )
-                )
-            );
-        }
-
-        const baseQuery = queryResourcePoliciesBase().where(and(...conditions));
-
-        // we need to add `as` so that drizzle filters the result as a subquery
-        const countQuery = db.$count(baseQuery.as("filtered_policies"));
-
-        const [rows, totalCount] = await Promise.all([
-            baseQuery
-                .limit(pageSize)
-                .offset(pageSize * (page - 1))
-                .orderBy(asc(resourcePolicies.resourcePolicyId)),
-            countQuery
-        ]);
-
-        const attachedResources =
-            rows.length === 0
-                ? []
-                : await db
-                      .select({
-                          resourceId: resources.resourceId,
-                          name: resources.name,
-                          fullDomain: resources.fullDomain,
-                          resourcePolicyId: resources.resourcePolicyId
-                      })
-                      .from(resources)
-                      .where(
-                          inArray(
-                              resources.resourcePolicyId,
-                              rows.map((row) => row.resourcePolicyId)
-                          )
-                      );
-
-        // avoids TS issues with reduce/never[]
-        const map = new Map<number, ResourcePolicyWithResources>();
-
-        for (const row of rows) {
-            let entry = map.get(row.resourcePolicyId);
-            if (!entry) {
-                entry = {
-                    ...row,
-                    resources: []
-                };
-                map.set(row.resourcePolicyId, entry);
-            }
-
-            entry.resources = attachedResources.filter(
-                (r) => r.resourcePolicyId === entry?.resourcePolicyId
-            );
-        }
-
-        const policiesList = Array.from(map.values());
-
-        return response<ListResourcePoliciesResponse>(res, {
-            data: {
-                policies: policiesList,
-                pagination: {
-                    total: totalCount,
-                    pageSize,
-                    page
-                }
-            },
-            success: true,
-            error: false,
-            message: "Resources retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/ssh/signSshKey.ts

@@ -23,8 +23,7 @@ import {
     roundTripMessageTracker,
     siteResources,
     siteNetworks,
-    userOrgs,
-    sites
+    userOrgs
 } from "@server/db";
 import { logAccessAudit } from "#private/lib/logAccessAudit";
 import { isLicensedOrSubscribed } from "#private/lib/isLicencedOrSubscribed";
@@ -49,8 +48,7 @@ const bodySchema = z
     .strictObject({
         publicKey: z.string().nonempty(),
         resourceId: z.number().int().positive().optional(),
-        resource: z.string().nonempty().optional(), // this is either the nice id or the alias
-        username: z.string().nonempty().optional()
+        resource: z.string().nonempty().optional() // this is either the nice id or the alias
     })
     .refine(
         (data) => {
@@ -65,19 +63,19 @@ const bodySchema = z
     );
 
 export type SignSshKeyResponse = {
-    certificate?: string;
+    certificate: string;
     messageIds: number[];
-    messageId?: number;
+    messageId: number;
     sshUsername: string;
     sshHost: string;
     resourceId: number;
     siteIds: number[];
     siteId: number;
-    keyId?: string;
-    validPrincipals?: string[];
-    validAfter?: string;
-    validBefore?: string;
-    expiresIn?: number;
+    keyId: string;
+    validPrincipals: string[];
+    validAfter: string;
+    validBefore: string;
+    expiresIn: number;
 };
 
 // registry.registerPath({
@@ -128,8 +126,7 @@ export async function signSshKey(
         const {
             publicKey,
             resourceId,
-            resource: resourceQueryString,
-            username
+            resource: resourceQueryString
         } = parsedBody.data;
         const userId = req.user?.userId;
         const roleIds = req.userOrgRoleIds ?? [];
@@ -177,6 +174,101 @@ export async function signSshKey(
             );
         }
 
+        let usernameToUse;
+        if (!userOrg.pamUsername) {
+            if (req.user?.email) {
+                // Extract username from email (first part before @)
+                usernameToUse = req.user?.email
+                    .split("@")[0]
+                    .replace(/[^a-zA-Z0-9_-]/g, "");
+                if (!usernameToUse) {
+                    return next(
+                        createHttpError(
+                            HttpCode.BAD_REQUEST,
+                            "Unable to extract username from email"
+                        )
+                    );
+                }
+            } else if (req.user?.username) {
+                usernameToUse = req.user.username;
+                // We need to clean out any spaces or special characters from the username to ensure it's valid for SSH certificates
+                usernameToUse = usernameToUse.replace(/[^a-zA-Z0-9_-]/g, "-");
+                if (!usernameToUse) {
+                    return next(
+                        createHttpError(
+                            HttpCode.BAD_REQUEST,
+                            "Username is not valid for SSH certificate"
+                        )
+                    );
+                }
+            } else {
+                return next(
+                    createHttpError(
+                        HttpCode.BAD_REQUEST,
+                        "User does not have a valid email or username for SSH certificate"
+                    )
+                );
+            }
+
+            // prefix with p-
+            usernameToUse = `p-${usernameToUse}`;
+
+            // check if we have a existing user in this org with the same
+            const [existingUserWithSameName] = await db
+                .select()
+                .from(userOrgs)
+                .where(
+                    and(
+                        eq(userOrgs.orgId, orgId),
+                        eq(userOrgs.pamUsername, usernameToUse)
+                    )
+                )
+                .limit(1);
+
+            if (existingUserWithSameName) {
+                let foundUniqueUsername = false;
+                for (let attempt = 0; attempt < 20; attempt++) {
+                    const randomNum = Math.floor(Math.random() * 101); // 0 to 100
+                    const candidateUsername = `${usernameToUse}${randomNum}`;
+
+                    const [existingUser] = await db
+                        .select()
+                        .from(userOrgs)
+                        .where(
+                            and(
+                                eq(userOrgs.orgId, orgId),
+                                eq(userOrgs.pamUsername, candidateUsername)
+                            )
+                        )
+                        .limit(1);
+
+                    if (!existingUser) {
+                        usernameToUse = candidateUsername;
+                        foundUniqueUsername = true;
+                        break;
+                    }
+                }
+
+                if (!foundUniqueUsername) {
+                    return next(
+                        createHttpError(
+                            HttpCode.CONFLICT,
+                            "Unable to generate a unique username for SSH certificate"
+                        )
+                    );
+                }
+            }
+
+            await db
+                .update(userOrgs)
+                .set({ pamUsername: usernameToUse })
+                .where(
+                    and(eq(userOrgs.orgId, orgId), eq(userOrgs.userId, userId))
+                );
+        } else {
+            usernameToUse = userOrg.pamUsername;
+        }
+
         // Get and decrypt the org's CA keys
         const caKeys = await getOrgCAKeys(
             orgId,
@@ -269,303 +361,90 @@ export async function signSshKey(
             );
         }
 
-        const sitesFromNetworks = await db
+        const roleRows = await db
+            .select({
+                sshSudoCommands: roles.sshSudoCommands,
+                sshUnixGroups: roles.sshUnixGroups,
+                sshCreateHomeDir: roles.sshCreateHomeDir,
+                sshSudoMode: roles.sshSudoMode
+            })
+            .from(roles)
+            .innerJoin(
+                roleSiteResources,
+                eq(roleSiteResources.roleId, roles.roleId)
+            )
+            .where(
+                and(
+                    inArray(roles.roleId, roleIds),
+                    eq(
+                        roleSiteResources.siteResourceId,
+                        resource.siteResourceId
+                    )
+                )
+            );
+
+        const parsedSudoCommands: string[] = [];
+        const parsedGroupsSet = new Set<string>();
+        let homedir: boolean | null = null;
+        const sudoModeOrder = { none: 0, commands: 1, full: 2 };
+        let sudoMode: "none" | "commands" | "full" = "none";
+        for (const roleRow of roleRows) {
+            try {
+                const cmds = JSON.parse(roleRow?.sshSudoCommands ?? "[]");
+                if (Array.isArray(cmds)) parsedSudoCommands.push(...cmds);
+            } catch {
+                // skip
+            }
+            try {
+                const grps = JSON.parse(roleRow?.sshUnixGroups ?? "[]");
+                if (Array.isArray(grps))
+                    grps.forEach((g: string) => parsedGroupsSet.add(g));
+            } catch {
+                // skip
+            }
+            if (roleRow?.sshCreateHomeDir === true) homedir = true;
+            const m = roleRow?.sshSudoMode ?? "none";
+            if (
+                sudoModeOrder[m as keyof typeof sudoModeOrder] >
+                sudoModeOrder[sudoMode]
+            ) {
+                sudoMode = m as "none" | "commands" | "full";
+            }
+        }
+        const parsedGroups = Array.from(parsedGroupsSet);
+        if (homedir === null && roleRows.length > 0) {
+            homedir = roleRows[0].sshCreateHomeDir ?? null;
+        }
+
+        const sites = await db
             .select({ siteId: siteNetworks.siteId })
             .from(siteNetworks)
             .where(eq(siteNetworks.networkId, resource.networkId!));
 
-        const siteIds = sitesFromNetworks.map((site) => site.siteId);
+        const siteIds = sites.map((site) => site.siteId);
 
-        let expiresIn: number | undefined;
-        let messageIds: number[] = [];
-        let cert:
-            | {
-                  certificate: string;
-                  keyId: string;
-                  validPrincipals: string[];
-                  validAfter: Date;
-                  validBefore: Date;
-              }
-            | undefined;
-        // if the pam mode is push then we generate the user's pam username and use that or pull it from the userOrgs table
-        // if the mode is passthrough then just use what was provided because the user will log in themselves
-        let usernameToUse;
-        if (resource.pamMode === "push") {
-            if (!userOrg.pamUsername) {
-                if (req.user?.email) {
-                    // Extract username from email (first part before @)
-                    usernameToUse = req.user?.email
-                        .split("@")[0]
-                        .replace(/[^a-zA-Z0-9_-]/g, "");
-                    if (!usernameToUse) {
-                        return next(
-                            createHttpError(
-                                HttpCode.BAD_REQUEST,
-                                "Unable to extract username from email"
-                            )
-                        );
-                    }
-                } else if (req.user?.username) {
-                    usernameToUse = req.user.username;
-                    // We need to clean out any spaces or special characters from the username to ensure it's valid for SSH certificates
-                    usernameToUse = usernameToUse.replace(
-                        /[^a-zA-Z0-9_-]/g,
-                        "-"
-                    );
-                    if (!usernameToUse) {
-                        return next(
-                            createHttpError(
-                                HttpCode.BAD_REQUEST,
-                                "Username is not valid for SSH certificate"
-                            )
-                        );
-                    }
-                } else {
-                    return next(
-                        createHttpError(
-                            HttpCode.BAD_REQUEST,
-                            "User does not have a valid email or username for SSH certificate"
-                        )
-                    );
-                }
+        // Sign the public key
+        const now = BigInt(Math.floor(Date.now() / 1000));
+        // only valid for 5 minutes
+        const validFor = 300n;
 
-                // prefix with p-
-                usernameToUse = `p-${usernameToUse}`;
-
-                // check if we have a existing user in this org with the same
-                const [existingUserWithSameName] = await db
-                    .select()
-                    .from(userOrgs)
-                    .where(
-                        and(
-                            eq(userOrgs.orgId, orgId),
-                            eq(userOrgs.pamUsername, usernameToUse)
-                        )
-                    )
-                    .limit(1);
-
-                if (existingUserWithSameName) {
-                    let foundUniqueUsername = false;
-                    for (let attempt = 0; attempt < 20; attempt++) {
-                        const randomNum = Math.floor(Math.random() * 101); // 0 to 100
-                        const candidateUsername = `${usernameToUse}${randomNum}`;
-
-                        const [existingUser] = await db
-                            .select()
-                            .from(userOrgs)
-                            .where(
-                                and(
-                                    eq(userOrgs.orgId, orgId),
-                                    eq(userOrgs.pamUsername, candidateUsername)
-                                )
-                            )
-                            .limit(1);
-
-                        if (!existingUser) {
-                            usernameToUse = candidateUsername;
-                            foundUniqueUsername = true;
-                            break;
-                        }
-                    }
-
-                    if (!foundUniqueUsername) {
-                        return next(
-                            createHttpError(
-                                HttpCode.CONFLICT,
-                                "Unable to generate a unique username for SSH certificate"
-                            )
-                        );
-                    }
-                }
-
-                await db
-                    .update(userOrgs)
-                    .set({ pamUsername: usernameToUse })
-                    .where(
-                        and(
-                            eq(userOrgs.orgId, orgId),
-                            eq(userOrgs.userId, userId)
-                        )
-                    );
-            } else {
-                usernameToUse = userOrg.pamUsername;
-            }
-
-            const roleRows = await db
-                .select({
-                    sshSudoCommands: roles.sshSudoCommands,
-                    sshUnixGroups: roles.sshUnixGroups,
-                    sshCreateHomeDir: roles.sshCreateHomeDir,
-                    sshSudoMode: roles.sshSudoMode
-                })
-                .from(roles)
-                .innerJoin(
-                    roleSiteResources,
-                    eq(roleSiteResources.roleId, roles.roleId)
-                )
-                .where(
-                    and(
-                        inArray(roles.roleId, roleIds),
-                        eq(
-                            roleSiteResources.siteResourceId,
-                            resource.siteResourceId
-                        )
-                    )
-                );
-
-            const parsedSudoCommands: string[] = [];
-            const parsedGroupsSet = new Set<string>();
-            let homedir: boolean | null = null;
-            const sudoModeOrder = { none: 0, commands: 1, full: 2 };
-            let sudoMode: "none" | "commands" | "full" = "none";
-            for (const roleRow of roleRows) {
-                try {
-                    const cmds = JSON.parse(roleRow?.sshSudoCommands ?? "[]");
-                    if (Array.isArray(cmds)) parsedSudoCommands.push(...cmds);
-                } catch {
-                    // skip
-                }
-                try {
-                    const grps = JSON.parse(roleRow?.sshUnixGroups ?? "[]");
-                    if (Array.isArray(grps))
-                        grps.forEach((g: string) => parsedGroupsSet.add(g));
-                } catch {
-                    // skip
-                }
-                if (roleRow?.sshCreateHomeDir === true) homedir = true;
-                const m = roleRow?.sshSudoMode ?? "none";
-                if (
-                    sudoModeOrder[m as keyof typeof sudoModeOrder] >
-                    sudoModeOrder[sudoMode]
-                ) {
-                    sudoMode = m as "none" | "commands" | "full";
-                }
-            }
-            const parsedGroups = Array.from(parsedGroupsSet);
-            if (homedir === null && roleRows.length > 0) {
-                homedir = roleRows[0].sshCreateHomeDir ?? null;
-            }
-
-            // Sign the public key
-            const now = BigInt(Math.floor(Date.now() / 1000));
-            // only valid for 5 minutes
-            const validFor = 300n;
-            expiresIn = Number(validFor); // seconds
-
-            const cert = signPublicKey(caKeys.privateKeyPem, publicKey, {
-                keyId: `${usernameToUse}@${resource.niceId}`,
-                validPrincipals: [usernameToUse, resource.niceId],
-                validAfter: now - 60n, // Start 1 min ago for clock skew
-                validBefore: now + validFor
-            });
-
-            const messageIds: number[] = [];
-            for (const siteId of siteIds) {
-                // get the site
-                const [newt] = await db
-                    .select()
-                    .from(newts)
-                    .where(eq(newts.siteId, siteId))
-                    .limit(1);
-
-                if (!newt) {
-                    return next(
-                        createHttpError(
-                            HttpCode.INTERNAL_SERVER_ERROR,
-                            "Site associated with resource not found"
-                        )
-                    );
-                }
-
-                const [message] = await db
-                    .insert(roundTripMessageTracker)
-                    .values({
-                        wsClientId: newt.newtId,
-                        messageType: `newt/pam/connection`,
-                        sentAt: Math.floor(Date.now() / 1000)
-                    })
-                    .returning();
-
-                if (!message) {
-                    return next(
-                        createHttpError(
-                            HttpCode.INTERNAL_SERVER_ERROR,
-                            "Failed to create message tracker entry"
-                        )
-                    );
-                }
-
-                messageIds.push(message.messageId);
-
-                await sendToClient(newt.newtId, {
-                    type: `newt/pam/connection`,
-                    data: {
-                        messageId: message.messageId,
-                        orgId: orgId,
-                        agentPort: resource.authDaemonPort ?? 22123,
-                        authDaemonMode: resource.authDaemonMode, // site, remote, native where native is the pty mode
-                        externalAuthDaemon:
-                            resource.authDaemonMode === "remote", // keep this for backward compatibility but new newts are using the authDaemonMode field
-                        agentHost: resource.destination,
-                        caCert: caKeys.publicKeyOpenSSH,
-                        username: usernameToUse,
-                        niceId: resource.niceId,
-                        metadata: {
-                            sudoMode: sudoMode,
-                            sudoCommands: parsedSudoCommands,
-                            homedir: homedir,
-                            groups: parsedGroups
-                        }
-                    }
-                });
-            }
-        } else if (resource.pamMode === "passthrough") {
-            usernameToUse = username;
-            if (!usernameToUse) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Username must be provided when PAM mode is passthrough"
-                    )
-                );
-            }
-        } else {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Invalid PAM mode configured for resource"
-                )
-            );
-        }
-
-        let sshHost: string | undefined;
-        if (
-            resource.authDaemonMode === "site" ||
-            resource.authDaemonMode === "remote"
-        ) {
-            if (resource.alias && resource.alias != "") {
-                sshHost = resource.alias;
-            } else {
-                sshHost = resource.destination || ""; // TODO: IF WE HAVE THE NATIVE SSH MODE WHAT SHOULD WE DO HERE?
-            }
-        } else if (resource.authDaemonMode === "native") {
-            if (siteIds.length > 1) {
-                return next(
-                    createHttpError(
-                        HttpCode.INTERNAL_SERVER_ERROR,
-                        "Multiple sites associated with resource, unable to determine SSH host when in native mode"
-                    )
-                );
-            }
+        const cert = signPublicKey(caKeys.privateKeyPem, publicKey, {
+            keyId: `${usernameToUse}@${resource.niceId}`,
+            validPrincipals: [usernameToUse, resource.niceId],
+            validAfter: now - 60n, // Start 1 min ago for clock skew
+            validBefore: now + validFor
+        });
 
+        const messageIds: number[] = [];
+        for (const siteId of siteIds) {
             // get the site
-            const [site] = await db
+            const [newt] = await db
                 .select()
-                .from(sites)
-                .where(eq(sites.siteId, siteIds[0]))
+                .from(newts)
+                .where(eq(newts.siteId, siteId))
                 .limit(1);
 
-            if (!site) {
+            if (!newt) {
                 return next(
                     createHttpError(
                         HttpCode.INTERNAL_SERVER_ERROR,
@@ -574,26 +453,54 @@ export async function signSshKey(
                 );
             }
 
-            if (!site.address) {
+            const [message] = await db
+                .insert(roundTripMessageTracker)
+                .values({
+                    wsClientId: newt.newtId,
+                    messageType: `newt/pam/connection`,
+                    sentAt: Math.floor(Date.now() / 1000)
+                })
+                .returning();
+
+            if (!message) {
                 return next(
                     createHttpError(
                         HttpCode.INTERNAL_SERVER_ERROR,
-                        "Site address not configured, unable to determine SSH host when in native mode"
+                        "Failed to create message tracker entry"
                     )
                 );
             }
 
-            // its the address but split off the cidr if there is one
-            sshHost = site.address.split("/")[0];
+            messageIds.push(message.messageId);
+
+            await sendToClient(newt.newtId, {
+                type: `newt/pam/connection`,
+                data: {
+                    messageId: message.messageId,
+                    orgId: orgId,
+                    agentPort: resource.authDaemonPort ?? 22123,
+                    externalAuthDaemon: resource.authDaemonMode === "remote",
+                    agentHost: resource.destination,
+                    caCert: caKeys.publicKeyOpenSSH,
+                    username: usernameToUse,
+                    niceId: resource.niceId,
+                    metadata: {
+                        sudoMode: sudoMode,
+                        sudoCommands: parsedSudoCommands,
+                        homedir: homedir,
+                        groups: parsedGroups
+                    }
+                }
+            });
         }
 
-        if (!sshHost) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Unable to determine SSH host for the resource"
-                )
-            );
+        const expiresIn = Number(validFor); // seconds
+
+        let sshHost;
+        if (resource.alias && resource.alias != "") {
+            sshHost = resource.alias;
+        } else {
+            sshHost = resource.destination;
         }
 
         await logsDb.insert(actionAuditLog).values({
@@ -620,7 +527,7 @@ export async function signSshKey(
                 : undefined,
             metadata: {
                 resourceName: resource.name,
-                siteIds: siteIds,
+                siteId: siteIds[0],
                 sshUsername: usernameToUse,
                 sshHost: sshHost
             },
@@ -630,18 +537,18 @@ export async function signSshKey(
 
         return response<SignSshKeyResponse>(res, {
             data: {
-                certificate: cert?.certificate,
+                certificate: cert.certificate,
                 messageIds: messageIds,
-                messageId: messageIds[0], // just pick the first one for backward compatibility with older olms
+                messageId: messageIds[0], // just pick the first one for backward compatibility
                 sshUsername: usernameToUse,
-                sshHost: sshHost, // just pick the first one for backward compatibility with older olms
+                sshHost: sshHost,
                 resourceId: resource.siteResourceId,
                 siteIds: siteIds,
-                siteId: siteIds[0], // just pick the first one for backward compatibility with older olms
-                keyId: cert?.keyId,
-                validPrincipals: cert?.validPrincipals,
-                validAfter: cert?.validAfter.toISOString(),
-                validBefore: cert?.validBefore.toISOString(),
+                siteId: siteIds[0], // just pick the first one for backward compatibility
+                keyId: cert.keyId,
+                validPrincipals: cert.validPrincipals,
+                validAfter: cert.validAfter.toISOString(),
+                validBefore: cert.validBefore.toISOString(),
                 expiresIn
             },
             success: true,

server/private/routers/ws/ws.ts

@@ -522,13 +522,13 @@ const sendToClientLocal = async (
 
     const messageString = JSON.stringify(messageWithVersion);
     if (options.compress) {
-        // logger.debug(
-        //     `Message size before compression: ${messageString.length} bytes`
-        // );
+        logger.debug(
+            `Message size before compression: ${messageString.length} bytes`
+        );
         const compressed = zlib.gzipSync(Buffer.from(messageString, "utf8"));
-        // logger.debug(
-        //     `Message size after compression: ${compressed.length} bytes`
-        // );
+        logger.debug(
+            `Message size after compression: ${compressed.length} bytes`
+        );
         clients.forEach((client) => {
             if (client.readyState === WebSocket.OPEN) {
                 client.send(compressed);

server/routers/auditLogs/queryRequestAnalytics.ts

@@ -1,4 +1,4 @@
-import { logsDb, requestAuditLog, driver } from "@server/db";
+import { logsDb, requestAuditLog, driver, primaryLogsDb } from "@server/db";
 import { registry } from "@server/openApi";
 import { NextFunction } from "express";
 import { Request, Response } from "express";
@@ -74,12 +74,12 @@ async function query(query: Q) {
         );
     }
 
-    const [all] = await logsDb
+    const [all] = await primaryLogsDb
         .select({ total: count() })
         .from(requestAuditLog)
         .where(baseConditions);
 
-    const [blocked] = await logsDb
+    const [blocked] = await primaryLogsDb
         .select({ total: count() })
         .from(requestAuditLog)
         .where(and(baseConditions, eq(requestAuditLog.action, false)));
@@ -90,7 +90,7 @@ async function query(query: Q) {
 
     const DISTINCT_LIMIT = 500;
 
-    const requestsPerCountry = await logsDb
+    const requestsPerCountry = await primaryLogsDb
         .selectDistinct({
             code: requestAuditLog.location,
             count: totalQ
@@ -118,7 +118,7 @@ async function query(query: Q) {
     const booleanTrue = driver === "pg" ? sql`true` : sql`1`;
     const booleanFalse = driver === "pg" ? sql`false` : sql`0`;
 
-    const requestsPerDay = await logsDb
+    const requestsPerDay = await primaryLogsDb
         .select({
             day: groupByDayFunction.as("day"),
             allowedCount:

server/routers/auditLogs/queryRequestAuditLog.ts

@@ -1,4 +1,4 @@
-import { logsDb, requestAuditLog, resources, siteResources, db, primaryDb } from "@server/db";
+import { logsDb, primaryLogsDb, requestAuditLog, resources, siteResources, db, primaryDb } from "@server/db";
 import { registry } from "@server/openApi";
 import { NextFunction } from "express";
 import { Request, Response } from "express";
@@ -110,7 +110,7 @@ function getWhere(data: Q) {
 }
 
 export function queryRequest(data: Q) {
-    return logsDb
+    return primaryLogsDb
         .select({
             id: requestAuditLog.id,
                 timestamp: requestAuditLog.timestamp,
@@ -211,7 +211,7 @@ async function enrichWithResourceDetails(logs: Awaited<ReturnType<typeof queryRe
 }
 
 export function countRequestQuery(data: Q) {
-    const countQuery = logsDb
+    const countQuery = primaryLogsDb
         .select({ count: count() })
         .from(requestAuditLog)
         .where(getWhere(data));
@@ -254,34 +254,34 @@ async function queryUniqueFilterAttributes(
         uniqueResources,
         uniqueSiteResources
     ] = await Promise.all([
-        logsDb
+        primaryLogsDb
             .selectDistinct({ actor: requestAuditLog.actor })
             .from(requestAuditLog)
             .where(baseConditions)
             .limit(DISTINCT_LIMIT + 1),
-        logsDb
+        primaryLogsDb
             .selectDistinct({ locations: requestAuditLog.location })
             .from(requestAuditLog)
             .where(baseConditions)
             .limit(DISTINCT_LIMIT + 1),
-        logsDb
+        primaryLogsDb
             .selectDistinct({ hosts: requestAuditLog.host })
             .from(requestAuditLog)
             .where(baseConditions)
             .limit(DISTINCT_LIMIT + 1),
-        logsDb
+        primaryLogsDb
             .selectDistinct({ paths: requestAuditLog.path })
             .from(requestAuditLog)
             .where(baseConditions)
             .limit(DISTINCT_LIMIT + 1),
-        logsDb
+        primaryLogsDb
             .selectDistinct({
                 id: requestAuditLog.resourceId
             })
             .from(requestAuditLog)
             .where(baseConditions)
             .limit(DISTINCT_LIMIT + 1),
-        logsDb
+        primaryLogsDb
             .selectDistinct({
                 id: requestAuditLog.siteResourceId
             })

server/routers/badger/verifySession.ts

@@ -671,8 +671,7 @@ export async function verifyResourceSession(
                             resourceData.org
                         );
 
-                        // this is query intensive so let it cache a little longer
-                        localCache.set(userAccessCacheKey, allowedUserData, 12);
+                        localCache.set(userAccessCacheKey, allowedUserData, 5);
                     }
 
                     if (
@@ -1004,7 +1003,11 @@ async function checkRules(
             isIpInCidr(clientIp, rule.value)
         ) {
             return rule.action as any;
-        } else if (clientIp && rule.match == "IP" && clientIp == rule.value) {
+        } else if (
+            clientIp &&
+            rule.match == "IP" &&
+            clientIp == rule.value
+        ) {
             return rule.action as any;
         } else if (
             path &&
@@ -1012,7 +1015,10 @@ async function checkRules(
             isPathAllowed(rule.value, path)
         ) {
             return rule.action as any;
-        } else if (clientIp && rule.match == "COUNTRY") {
+        } else if (
+            clientIp &&
+            rule.match == "COUNTRY"
+        ) {
             // COUNTRY=ALL should not affect local/private/CGNAT addresses.
             if (
                 rule.value.toUpperCase() === "ALL" &&
@@ -1024,7 +1030,10 @@ async function checkRules(
             if (await isIpInGeoIP(ipCC, rule.value)) {
                 return rule.action as any;
             }
-        } else if (clientIp && rule.match == "ASN") {
+        } else if (
+            clientIp &&
+            rule.match == "ASN"
+        ) {
             // ASN=ALL/AS0 should not affect local/private/CGNAT addresses.
             if (
                 (rule.value.toUpperCase() === "ALL" ||
@@ -1263,15 +1272,11 @@ export async function isIpInRegion(
         if (region.id === checkRegionCode) {
             for (const subregion of region.includes) {
                 if (subregion.countries.includes(upperCode)) {
-                    logger.debug(
-                        `Country ${upperCode} is in region ${region.id} (${region.name})`
-                    );
+                    logger.debug(`Country ${upperCode} is in region ${region.id} (${region.name})`);
                     return true;
                 }
             }
-            logger.debug(
-                `Country ${upperCode} is not in region ${region.id} (${region.name})`
-            );
+            logger.debug(`Country ${upperCode} is not in region ${region.id} (${region.name})`);
             return false;
         }
 
@@ -1279,14 +1284,10 @@ export async function isIpInRegion(
         for (const subregion of region.includes) {
             if (subregion.id === checkRegionCode) {
                 if (subregion.countries.includes(upperCode)) {
-                    logger.debug(
-                        `Country ${upperCode} is in region ${subregion.id} (${subregion.name})`
-                    );
+                    logger.debug(`Country ${upperCode} is in region ${subregion.id} (${subregion.name})`);
                     return true;
                 }
-                logger.debug(
-                    `Country ${upperCode} is not in region ${subregion.id} (${subregion.name})`
-                );
+                logger.debug(`Country ${upperCode} is not in region ${subregion.id} (${subregion.name})`);
                 return false;
             }
         }

server/routers/client/pickClientDefaults.ts

@@ -51,9 +51,7 @@ export async function pickClientDefaults(
         const olmId = generateId(15);
         const secret = generateId(48);
 
-        const { value: newSubnet, release } =
-            await getNextAvailableClientSubnet(orgId);
-        await release(); // release immediately — this endpoint only previews the next available value
+        const newSubnet = await getNextAvailableClientSubnet(orgId);
         if (!newSubnet) {
             return next(
                 createHttpError(

server/routers/external.ts

@@ -3,7 +3,6 @@ import config from "@server/lib/config";
 import * as site from "./site";
 import * as org from "./org";
 import * as resource from "./resource";
-import * as policy from "./policy";
 import * as domain from "./domain";
 import * as target from "./target";
 import * as user from "./user";
@@ -43,8 +42,7 @@ import {
     verifyUserIsOrgOwner,
     verifySiteResourceAccess,
     verifyOlmAccess,
-    verifyLimits,
-    verifyResourcePolicyAccess
+    verifyLimits
 } from "@server/middlewares";
 import { ActionsEnum } from "@server/auth/actions";
 import rateLimit, { ipKeyGenerator } from "express-rate-limit";
@@ -105,6 +103,7 @@ authenticated.put(
     site.createSite
 );
 
+
 authenticated.get(
     "/org/:orgId/sites",
     verifyOrgAccess,
@@ -541,7 +540,6 @@ authenticated.get(
     verifyUserHasAction(ActionsEnum.getResource),
     resource.getResource
 );
-
 authenticated.post(
     "/resource/:resourceId",
     verifyResourceAccess,
@@ -648,29 +646,6 @@ authenticated.post(
     logActionAudit(ActionsEnum.updateRole),
     role.updateRole
 );
-
-authenticated.get(
-    "/org/:orgId/resource-policy/:niceId",
-    verifyOrgAccess,
-    verifyResourcePolicyAccess,
-    verifyUserHasAction(ActionsEnum.getResourcePolicy),
-    policy.getResourcePolicy
-);
-
-authenticated.get(
-    "/resource/:resourceId/policies",
-    verifyResourceAccess,
-    verifyUserHasAction(ActionsEnum.getResourcePolicy),
-    resource.getResourcePolicies
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId",
-    verifyResourcePolicyAccess,
-    verifyUserHasAction(ActionsEnum.updateResourcePolicy),
-    policy.updateResourcePolicy
-);
-
 // authenticated.get(
 //     "/role/:roleId",
 //     verifyRoleAccess,
@@ -722,59 +697,6 @@ authenticated.post(
     resource.setResourceUsers
 );
 
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/access-control",
-    verifyResourcePolicyAccess,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
-    logActionAudit(ActionsEnum.setResourcePolicyUsers),
-    policy.setResourcePolicyAccessControl
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/password",
-    verifyResourcePolicyAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyPassword),
-    logActionAudit(ActionsEnum.setResourcePolicyPassword),
-    policy.setResourcePolicyPassword
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/pincode",
-    verifyResourcePolicyAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyPincode),
-    logActionAudit(ActionsEnum.setResourcePolicyPincode),
-    policy.setResourcePolicyPincode
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/header-auth",
-    verifyResourcePolicyAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyHeaderAuth),
-    logActionAudit(ActionsEnum.setResourcePolicyHeaderAuth),
-    policy.setResourcePolicyHeaderAuth
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/whitelist",
-    verifyResourcePolicyAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyWhitelist),
-    logActionAudit(ActionsEnum.setResourcePolicyWhitelist),
-    policy.setResourcePolicyWhitelist
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/rules",
-    verifyResourcePolicyAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyRules),
-    logActionAudit(ActionsEnum.setResourcePolicyRules),
-    policy.setResourcePolicyRules
-);
-
 authenticated.post(
     `/resource/:resourceId/password`,
     verifyResourceAccess,
@@ -1234,7 +1156,7 @@ export const authRouter = Router();
 unauthenticated.use("/auth", authRouter);
 authRouter.use(
     rateLimit({
-        windowMs: config.getRawConfig().rate_limits.auth.window_minutes * 60 * 1000,
+        windowMs: config.getRawConfig().rate_limits.auth.window_minutes,
         max: config.getRawConfig().rate_limits.auth.max_requests,
         keyGenerator: (req) =>
             `authRouterGlobal:${ipKeyGenerator(req.ip || "")}:${req.path}`,
@@ -1309,22 +1231,6 @@ authRouter.post(
     newt.getNewtToken
 );
 
-authRouter.post(
-    "/newt/version",
-    rateLimit({
-        windowMs: 15 * 60 * 1000,
-        max: 60,
-        keyGenerator: (req) =>
-            `newtVersion:${req.body.newtId || ipKeyGenerator(req.ip || "")}`,
-        handler: (req, res, next) => {
-            const message = `You can only check the Newt version ${60} times every ${15} minutes. Please try again later.`;
-            return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));
-        },
-        store: createStore()
-    }),
-    newt.getNewtVersion
-);
-
 authRouter.post(
     "/newt/register",
     rateLimit({
@@ -1346,7 +1252,7 @@ authRouter.post(
         windowMs: 15 * 60 * 1000,
         max: 900,
         keyGenerator: (req) =>
-            `olmGetToken:${req.body.olmId || ipKeyGenerator(req.ip || "")}`,
+            `olmGetToken:${req.body.newtId || ipKeyGenerator(req.ip || "")}`,
         handler: (req, res, next) => {
             const message = `You can only request an Olm token ${900} times every ${15} minutes. Please try again later.`;
             return next(createHttpError(HttpCode.TOO_MANY_REQUESTS, message));

server/routers/integration.ts

@@ -2,7 +2,6 @@ import * as site from "./site";
 import * as org from "./org";
 import * as blueprints from "./blueprints";
 import * as resource from "./resource";
-import * as policy from "./policy";
 import * as domain from "./domain";
 import * as target from "./target";
 import * as user from "./user";
@@ -30,9 +29,7 @@ import {
     verifyApiKeySiteResourceAccess,
     verifyApiKeySetResourceClients,
     verifyLimits,
-    verifyApiKeyDomainAccess,
-    verifyApiKeyResourcePolicyAccess,
-    verifyUserHasAction
+    verifyApiKeyDomainAccess
 } from "@server/middlewares";
 import HttpCode from "@server/types/HttpCode";
 import { Router } from "express";
@@ -462,20 +459,6 @@ authenticated.get(
     resource.getResource
 );
 
-authenticated.get(
-    "/resource-policy/:resourcePolicyId",
-    verifyApiKeyResourcePolicyAccess,
-    verifyApiKeyHasAction(ActionsEnum.getResourcePolicy),
-    policy.getResourcePolicy
-);
-
-authenticated.get(
-    "/resource/:resourceId/policies",
-    verifyApiKeyResourceAccess,
-    verifyApiKeyHasAction(ActionsEnum.getResourcePolicy),
-    resource.getResourcePolicies
-);
-
 authenticated.post(
     "/resource/:resourceId",
     verifyApiKeyResourceAccess,
@@ -485,13 +468,6 @@ authenticated.post(
     resource.updateResource
 );
 
-authenticated.put(
-    "/resource-policy/:resourcePolicyId",
-    verifyApiKeyResourcePolicyAccess,
-    verifyApiKeyHasAction(ActionsEnum.updateResourcePolicy),
-    policy.updateResourcePolicy
-);
-
 authenticated.delete(
     "/resource/:resourceId",
     verifyApiKeyResourceAccess,
@@ -643,63 +619,6 @@ authenticated.post(
     resource.setResourceUsers
 );
 
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/access-control",
-    verifyApiKeyResourcePolicyAccess,
-    verifyApiKeyRoleAccess,
-    verifyLimits,
-    verifyUserHasAction(ActionsEnum.setResourcePolicyUsers),
-    verifyUserHasAction(ActionsEnum.setResourcePolicyRoles),
-    logActionAudit(ActionsEnum.setResourcePolicyUsers),
-    logActionAudit(ActionsEnum.setResourcePolicyRoles),
-    policy.setResourcePolicyAccessControl
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/password",
-    verifyApiKeyResourcePolicyAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPassword),
-    logActionAudit(ActionsEnum.setResourcePolicyPassword),
-    policy.setResourcePolicyPassword
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/pincode",
-    verifyApiKeyResourcePolicyAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyPincode),
-    logActionAudit(ActionsEnum.setResourcePolicyPincode),
-    policy.setResourcePolicyPincode
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/header-auth",
-    verifyApiKeyResourcePolicyAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyHeaderAuth),
-    logActionAudit(ActionsEnum.setResourcePolicyHeaderAuth),
-    policy.setResourcePolicyHeaderAuth
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/whitelist",
-    verifyApiKeyResourcePolicyAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyWhitelist),
-    logActionAudit(ActionsEnum.setResourcePolicyWhitelist),
-    policy.setResourcePolicyWhitelist
-);
-
-authenticated.put(
-    "/resource-policy/:resourcePolicyId/rules",
-    verifyApiKeyResourcePolicyAccess,
-    verifyLimits,
-    verifyApiKeyHasAction(ActionsEnum.setResourcePolicyRules),
-    logActionAudit(ActionsEnum.setResourcePolicyRules),
-    policy.setResourcePolicyRules
-);
-
 authenticated.post(
     "/resource/:resourceId/roles/add",
     verifyApiKeyResourceAccess,

server/routers/internal.ts

@@ -42,8 +42,6 @@ internalRouter.get("/idp", idp.listIdps);
 
 internalRouter.get("/idp/:idpId", idp.getIdp);
 
-internalRouter.get("/resource/browser-target", resource.getBrowserTarget);
-
 // Gerbil routes
 const gerbilRouter = Router();
 internalRouter.use("/gerbil", gerbilRouter);

server/routers/newt/buildConfiguration.ts

@@ -1,6 +1,4 @@
 import {
-    browserGatewayTarget,
-    BrowserGatewayTarget,
     clients,
     clientSiteResourcesAssociationsCache,
     clientSitesAssociationsCache,
@@ -18,7 +16,6 @@ import logger from "@server/logger";
 import { initPeerAddHandshake, updatePeer } from "../olm/peers";
 import { eq, and } from "drizzle-orm";
 import config from "@server/lib/config";
-import { decrypt } from "@server/lib/crypto";
 import {
     formatEndpoint,
     generateSubnetProxyTargetV2,
@@ -197,7 +194,7 @@ export async function buildTargetConfigurationForNewtClient(
     siteId: number,
     version?: string | null
 ) {
-    // Get all enabled targets with their resource mode information
+    // Get all enabled targets with their resource protocol information
     const allTargets = await db
         .select({
             resourceId: targets.resourceId,
@@ -207,7 +204,7 @@ export async function buildTargetConfigurationForNewtClient(
             port: targets.port,
             internalPort: targets.internalPort,
             enabled: targets.enabled,
-            mode: resources.mode
+            protocol: resources.protocol
         })
         .from(targets)
         .innerJoin(resources, eq(targets.resourceId, resources.resourceId))
@@ -236,11 +233,6 @@ export async function buildTargetConfigurationForNewtClient(
         .from(targetHealthCheck)
         .where(eq(targetHealthCheck.siteId, siteId));
 
-    const allBrowserGatewayTargets = await db
-        .select()
-        .from(browserGatewayTarget)
-        .where(eq(browserGatewayTarget.siteId, siteId));
-
     const { tcpTargets, udpTargets } = allTargets.reduce(
         (acc, target) => {
             // Filter out invalid targets
@@ -252,11 +244,10 @@ export async function buildTargetConfigurationForNewtClient(
             const formattedTarget = `${target.internalPort}:${formatEndpoint(target.ip, target.port)}`;
 
             // Add to the appropriate protocol array
-            if (target.mode === "udp") {
-                acc.udpTargets.push(formattedTarget);
-            } else {
-                // all other modes are tcp
+            if (target.protocol === "tcp") {
                 acc.tcpTargets.push(formattedTarget);
+            } else {
+                acc.udpTargets.push(formattedTarget);
             }
 
             return acc;
@@ -313,22 +304,9 @@ export async function buildTargetConfigurationForNewtClient(
         (target) => target !== null
     );
 
-    const serverSecret = config.getRawConfig().server.secret!;
-    const browserGatewayTargets = allBrowserGatewayTargets.map((t) => {
-        const decryptAuthToken = decrypt(t.authToken, serverSecret);
-        return {
-            id: t.browserGatewayTargetId,
-            type: t.type,
-            destination: t.destination,
-            destinationPort: t.destinationPort,
-            authToken: decryptAuthToken
-        };
-    });
-
     return {
         validHealthCheckTargets,
         tcpTargets,
-        udpTargets,
-        browserGatewayTargets
+        udpTargets
     };
 }

server/routers/newt/getNewtVersion.ts

@@ -1,317 +0,0 @@
-import { db, orgs, sites } from "@server/db";
-import { newts } from "@server/db";
-import { eq } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-import semver from "semver";
-import { verifyPassword } from "@server/auth/password";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import logger from "@server/logger";
-import cache from "#dynamic/lib/cache";
-import config from "@server/lib/config";
-
-// Stale-while-revalidate in-memory fallback for the releases API.
-type ReleaseInfo = {
-    version: string;
-    // binary filename -> sha256 hex (sourced from asset `digest` field in GitHub API)
-    assetDigests: Record<string, string>;
-};
-let staleReleaseInfo: ReleaseInfo | null = null;
-
-/**
- * Fetches the latest stable newt release from GitHub and returns the version
- * tag together with a map of asset-name → sha256 hex digest.
- * Results are cached for one hour; stale data is returned on failure.
- */
-async function getLatestReleaseInfo(): Promise<ReleaseInfo | null> {
-    try {
-        const cached = await cache.get<ReleaseInfo>("cache:newtReleaseInfo");
-        if (cached) {
-            return cached;
-        }
-
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), 5000);
-
-        const fetchResponse = await fetch(
-            "https://api.github.com/repos/fosrl/newt/releases",
-            { signal: controller.signal }
-        );
-
-        clearTimeout(timeoutId);
-
-        if (!fetchResponse.ok) {
-            logger.warn(
-                `Failed to fetch Newt releases from GitHub: ${fetchResponse.status} ${fetchResponse.statusText}`
-            );
-            return staleReleaseInfo;
-        }
-
-        let releases: any[] = await fetchResponse.json();
-        if (!Array.isArray(releases) || releases.length === 0) {
-            logger.warn("No releases found for Newt repository");
-            return staleReleaseInfo;
-        }
-
-        // Drop drafts, pre-releases, and anything with "rc" in the tag name.
-        releases = releases.filter(
-            (r: any) =>
-                !r.draft &&
-                !r.prerelease &&
-                !r.tag_name.includes("rc") &&
-                !r.tag_name.includes("v")
-        );
-
-        // Sort descending by semver to find the true latest stable release.
-        releases.sort((a: any, b: any) => {
-            const va = semver.coerce(a.tag_name);
-            const vb = semver.coerce(b.tag_name);
-            if (!va && !vb) return 0;
-            if (!va) return 1;
-            if (!vb) return -1;
-            return semver.rcompare(va, vb);
-        });
-
-        if (releases.length === 0) {
-            logger.warn("No stable releases found for Newt repository");
-            return staleReleaseInfo;
-        }
-
-        const latest = releases[0];
-        const version: string = latest.tag_name;
-
-        // Build a map of binary filename → sha256 hex from the asset `digest`
-        // field returned by the GitHub API (format: "sha256:<hex>").
-        const assetDigests: Record<string, string> = {};
-        if (Array.isArray(latest.assets)) {
-            for (const asset of latest.assets) {
-                if (
-                    typeof asset.name === "string" &&
-                    typeof asset.digest === "string" &&
-                    asset.digest.startsWith("sha256:")
-                ) {
-                    assetDigests[asset.name] = asset.digest.slice(
-                        "sha256:".length
-                    );
-                }
-            }
-        }
-
-        const info: ReleaseInfo = { version, assetDigests };
-        staleReleaseInfo = info;
-        await cache.set("cache:newtReleaseInfo", info, 3600);
-        return info;
-    } catch (error: any) {
-        if (error.name === "AbortError") {
-            logger.warn("Request to fetch Newt releases timed out (5s)");
-        } else {
-            logger.warn(
-                "Error fetching Newt releases:",
-                error.message || error
-            );
-        }
-        return staleReleaseInfo;
-    }
-}
-
-const bodySchema = z.object({
-    newtId: z.string(),
-    secret: z.string(),
-    platform: z.string() // e.g. "linux_amd64", "darwin_arm64"
-});
-
-export type GetNewtVersionBody = z.infer<typeof bodySchema>;
-
-export type GetNewtVersionResponse = {
-    latestVersion: string;
-    currentIsLatest: boolean;
-    downloadUrl: string;
-    sha256: string;
-};
-
-export async function getNewtVersion(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    const parsedBody = bodySchema.safeParse(req.body);
-
-    if (!parsedBody.success) {
-        return next(
-            createHttpError(
-                HttpCode.BAD_REQUEST,
-                fromError(parsedBody.error).toString()
-            )
-        );
-    }
-
-    const { newtId, secret, platform } = parsedBody.data;
-
-    try {
-        // Verify newt credentials
-        const [existingNewt] = await db
-            .select()
-            .from(newts)
-            .where(eq(newts.newtId, newtId))
-            .limit(1);
-
-        if (!existingNewt) {
-            if (config.getRawConfig().app.log_failed_attempts) {
-                logger.info(
-                    `Newt version check: no newt found with ID ${newtId}. IP: ${req.ip}.`
-                );
-            }
-            return next(
-                createHttpError(HttpCode.UNAUTHORIZED, "Invalid credentials")
-            );
-        }
-
-        if (!existingNewt.siteId) {
-            logger.warn(`Newt ${newtId} has no associated site`);
-            return next(
-                createHttpError(
-                    HttpCode.UNAUTHORIZED,
-                    "Not associated with a site"
-                )
-            );
-        }
-
-        const validSecret = await verifyPassword(
-            secret,
-            existingNewt.secretHash
-        );
-        if (!validSecret) {
-            if (config.getRawConfig().app.log_failed_attempts) {
-                logger.info(
-                    `Newt version check: invalid secret for newt ID ${newtId}. IP: ${req.ip}.`
-                );
-            }
-            return next(
-                createHttpError(HttpCode.UNAUTHORIZED, "Invalid credentials")
-            );
-        }
-
-        // check if udpates are enabled for the org or the site
-        const [site] = await db
-            .select()
-            .from(sites)
-            .where(eq(sites.siteId, existingNewt.siteId))
-            .limit(1);
-
-        if (!site) {
-            logger.warn(`Site with ID ${existingNewt.siteId} not found`);
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Associated site not found"
-                )
-            );
-        }
-
-        const [org] = await db
-            .select()
-            .from(orgs)
-            .where(eq(orgs.orgId, site.orgId))
-            .limit(1);
-
-        if (!org) {
-            logger.warn(`Org with ID ${site.orgId} not found`);
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Associated organization not found"
-                )
-            );
-        }
-
-        let doUpdate = false;
-
-        if (site.autoUpdateOverrideOrg) {
-            doUpdate = site.autoUpdateEnabled;
-        } else {
-            doUpdate = org.settingsEnableGlobalNewtAutoUpdate;
-        }
-
-        if (!doUpdate) {
-            // return no content http code
-            return response(res, {
-                data: {
-                    latestVersion: existingNewt.version ?? "",
-                    currentIsLatest: true,
-                    downloadUrl: "",
-                    sha256: ""
-                },
-                success: true,
-                error: false,
-                message:
-                    "Auto-updates are disabled for this site and organization",
-                status: HttpCode.NO_CONTENT
-            });
-        }
-
-        // Fetch latest release info (version + asset digests) in one API call.
-        const releaseInfo = await getLatestReleaseInfo();
-
-        if (!releaseInfo) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Unable to determine latest Newt version"
-                )
-            );
-        }
-
-        const latestVersion = releaseInfo.version;
-
-        // Binary name follows the get-newt.sh convention: newt_<platform>[.exe]
-        const binaryName = platform.includes("windows")
-            ? `newt_${platform}.exe`
-            : `newt_${platform}`;
-
-        const downloadUrl = `https://github.com/fosrl/newt/releases/download/${latestVersion}/${binaryName}`;
-
-        // Look up the SHA256 digest for this specific binary from the GitHub
-        // release asset metadata (the `digest` field, format "sha256:<hex>").
-        const sha256 = releaseInfo.assetDigests[binaryName] ?? "";
-
-        // Determine whether the newt that's asking is already up to date.
-        // We store the current version on the newt row when it registers.
-        const currentVersion = existingNewt.version ?? null;
-        let currentIsLatest = false;
-        if (currentVersion) {
-            try {
-                const latest = semver.coerce(latestVersion);
-                const current = semver.coerce(currentVersion);
-                if (latest && current) {
-                    currentIsLatest = !semver.lt(current, latest);
-                }
-            } catch {
-                // If we can't compare, assume not latest
-            }
-        }
-
-        return response<GetNewtVersionResponse>(res, {
-            data: {
-                latestVersion,
-                currentIsLatest,
-                downloadUrl,
-                sha256
-            },
-            success: true,
-            error: false,
-            message: "Version info retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (e) {
-        logger.error(e);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "Failed to retrieve version info"
-            )
-        );
-    }
-}

server/routers/newt/handleNewtRegisterMessage.ts

@@ -43,13 +43,8 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
 
     const siteId = newt.siteId;
 
-    const {
-        publicKey,
-        pingResults,
-        newtVersion,
-        backwardsCompatible,
-        chainId
-    } = message.data;
+    const { publicKey, pingResults, newtVersion, backwardsCompatible, chainId } =
+        message.data;
     if (!publicKey) {
         logger.warn("Public key not provided");
         return;
@@ -196,12 +191,8 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
             .where(eq(newts.newtId, newt.newtId));
     }
 
-    const {
-        tcpTargets,
-        udpTargets,
-        validHealthCheckTargets,
-        browserGatewayTargets
-    } = await buildTargetConfigurationForNewtClient(siteId, newtVersion);
+    const { tcpTargets, udpTargets, validHealthCheckTargets } =
+        await buildTargetConfigurationForNewtClient(siteId, newtVersion);
 
     logger.debug(
         `Sending health check targets to newt ${newt.newtId}: ${JSON.stringify(validHealthCheckTargets)}`
@@ -221,7 +212,6 @@ export const handleNewtRegisterMessage: MessageHandler = async (context) => {
                     tcp: tcpTargets
                 },
                 healthCheckTargets: validHealthCheckTargets,
-                browserGatewayTargets: browserGatewayTargets,
                 chainId: chainId
             }
         },

server/routers/newt/index.ts

@@ -1,6 +1,5 @@
 export * from "./createNewt";
 export * from "./getNewtToken";
-export * from "./getNewtVersion";
 export * from "./handleNewtRegisterMessage";
 export * from "./handleReceiveBandwidthMessage";
 export * from "./handleNewtGetConfigMessage";

server/routers/newt/registerNewt.ts

@@ -203,82 +203,84 @@ export async function registerNewt(
 
         let newSiteId: number | undefined;
 
-        const { value: newClientAddress, release: releaseSubnetLock } =
-            await getNextAvailableClientSubnet(orgId);
-        try {
-            await db.transaction(async (trx) => {
-                let clientAddress = newClientAddress.split("/")[0];
-                clientAddress = `${clientAddress}/${org.subnet!.split("/")[1]}`; // we want the block size of the whole org
+        await db.transaction(async (trx) => {
+            const newClientAddress = await getNextAvailableClientSubnet(orgId);
+            if (!newClientAddress) {
+                return next(
+                    createHttpError(
+                        HttpCode.INTERNAL_SERVER_ERROR,
+                        "No available subnet found"
+                    )
+                );
+            }
 
-                // Create the site (type "newt", name = niceId)
-                const [newSite] = await trx
-                    .insert(sites)
-                    .values({
-                        orgId,
-                        name: name || niceId,
-                        niceId,
-                        address: clientAddress,
-                        type: "newt",
-                        dockerSocketEnabled: true,
-                        status: keyRecord.approveNewSites
-                            ? "approved"
-                            : "pending"
-                    })
-                    .returning();
+            let clientAddress = newClientAddress.split("/")[0];
+            clientAddress = `${clientAddress}/${org.subnet!.split("/")[1]}`; // we want the block size of the whole org
 
-                await logsDb.insert(statusHistory).values({
-                    entityType: "site",
-                    entityId: newSite.siteId,
-                    orgId: orgId,
-                    status: "offline",
-                    timestamp: Math.floor(Date.now() / 1000)
-                });
+            // Create the site (type "newt", name = niceId)
+            const [newSite] = await trx
+                .insert(sites)
+                .values({
+                    orgId,
+                    name: name || niceId,
+                    niceId,
+                    address: clientAddress,
+                    type: "newt",
+                    dockerSocketEnabled: true,
+                    status: keyRecord.approveNewSites ? "approved" : "pending"
+                })
+                .returning();
 
-                newSiteId = newSite.siteId;
-
-                // Grant admin role access to the new site
-                const [adminRole] = await trx
-                    .select()
-                    .from(roles)
-                    .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
-                    .limit(1);
-
-                if (!adminRole) {
-                    throw new Error(`Admin role not found for org ${orgId}`);
-                }
-
-                await trx.insert(roleSites).values({
-                    roleId: adminRole.roleId,
-                    siteId: newSite.siteId
-                });
-
-                // Create the newt for this site
-                await trx.insert(newts).values({
-                    newtId,
-                    secretHash,
-                    siteId: newSite.siteId,
-                    dateCreated: moment().toISOString()
-                });
-
-                // Consume the provisioning key - cascade removes siteProvisioningKeyOrg
-                await trx
-                    .update(siteProvisioningKeys)
-                    .set({
-                        lastUsed: moment().toISOString(),
-                        numUsed: sql`${siteProvisioningKeys.numUsed} + 1`
-                    })
-                    .where(
-                        eq(
-                            siteProvisioningKeys.siteProvisioningKeyId,
-                            provisioningKeyId
-                        )
-                    );
-
-                await usageService.add(orgId, FeatureId.SITES, 1, trx);
+            await logsDb.insert(statusHistory).values({
+                entityType: "site",
+                entityId: newSite.siteId,
+                orgId: orgId,
+                status: "offline",
+                timestamp: Math.floor(Date.now() / 1000)
             });
-        } finally {
-            await releaseSubnetLock();
-        }
+
+            newSiteId = newSite.siteId;
+
+            // Grant admin role access to the new site
+            const [adminRole] = await trx
+                .select()
+                .from(roles)
+                .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
+                .limit(1);
+
+            if (!adminRole) {
+                throw new Error(`Admin role not found for org ${orgId}`);
+            }
+
+            await trx.insert(roleSites).values({
+                roleId: adminRole.roleId,
+                siteId: newSite.siteId
+            });
+
+            // Create the newt for this site
+            await trx.insert(newts).values({
+                newtId,
+                secretHash,
+                siteId: newSite.siteId,
+                dateCreated: moment().toISOString()
+            });
+
+            // Consume the provisioning key - cascade removes siteProvisioningKeyOrg
+            await trx
+                .update(siteProvisioningKeys)
+                .set({
+                    lastUsed: moment().toISOString(),
+                    numUsed: sql`${siteProvisioningKeys.numUsed} + 1`
+                })
+                .where(
+                    eq(
+                        siteProvisioningKeys.siteProvisioningKeyId,
+                        provisioningKeyId
+                    )
+                );
+
+            await usageService.add(orgId, FeatureId.SITES, 1, trx);
+        });
 
         logger.info(
             `Provisioned new site (ID: ${newSiteId}) and newt (ID: ${newtId}) for org ${orgId} via provisioning key ${provisioningKeyId}`

server/routers/newt/sync.ts

@@ -9,12 +9,8 @@ import {
 import { canCompress } from "@server/lib/clientVersionChecks";
 
 export async function sendNewtSyncMessage(newt: Newt, site: Site) {
-    const {
-        tcpTargets,
-        udpTargets,
-        validHealthCheckTargets,
-        browserGatewayTargets
-    } = await buildTargetConfigurationForNewtClient(site.siteId);
+    const { tcpTargets, udpTargets, validHealthCheckTargets } =
+        await buildTargetConfigurationForNewtClient(site.siteId);
 
     let exitNode: ExitNode | undefined;
     if (site.exitNodeId) {
@@ -40,8 +36,7 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
                 },
                 healthCheckTargets: validHealthCheckTargets,
                 peers: peers,
-                clientTargets: targets,
-                browserGatewayTargets: browserGatewayTargets
+                clientTargets: targets
             }
         },
         {

server/routers/newt/targets.ts

@@ -1,9 +1,7 @@
-import { BrowserGatewayTarget, Target, TargetHealthCheck } from "@server/db";
+import { Target, TargetHealthCheck } from "@server/db";
 import { sendToClient } from "#dynamic/routers/ws";
 import logger from "@server/logger";
 import { canCompress } from "@server/lib/clientVersionChecks";
-import { decrypt } from "@server/lib/crypto";
-import config from "@server/lib/config";
 
 export async function addTargets(
     newtId: string,
@@ -241,55 +239,3 @@ export async function removeTargets(
         { incrementConfigVersion: true, compress: canCompress(version, "newt") }
     );
 }
-
-export async function sendBrowserGatewayTargets(
-    newtId: string,
-    targets: BrowserGatewayTarget[],
-    version?: string | null
-) {
-    if (targets.length === 0) return;
-
-    const payload = targets.map((t) => {
-        const decryptAuthToken = decrypt(
-            t.authToken,
-            config.getRawConfig().server.secret!
-        );
-        return {
-            id: t.browserGatewayTargetId,
-            resourceId: t.resourceId,
-            siteId: t.siteId,
-            type: t.type,
-            destination: t.destination,
-            destinationPort: t.destinationPort,
-            authToken: decryptAuthToken
-        };
-    });
-
-    await sendToClient(
-        newtId,
-        {
-            type: "newt/browsergateway/add",
-            data: {
-                targets: payload
-            }
-        },
-        { incrementConfigVersion: true, compress: canCompress(version, "newt") }
-    );
-}
-
-export async function removeBrowserGatewayTarget(
-    newtId: string,
-    browserGatewayTargetId: number,
-    version?: string | null
-) {
-    await sendToClient(
-        newtId,
-        {
-            type: "newt/browsergateway/remove",
-            data: {
-                ids: [browserGatewayTargetId]
-            }
-        },
-        { incrementConfigVersion: true, compress: canCompress(version, "newt") }
-    );
-}

server/routers/org/updateOrg.ts

@@ -40,8 +40,7 @@ const updateOrgBodySchema = z
         settingsLogRetentionDaysConnection: z
             .number()
             .min(build === "saas" ? 0 : -1)
-            .optional(),
-        settingsEnableGlobalNewtAutoUpdate: z.boolean().optional()
+            .optional()
     })
     .refine((data) => Object.keys(data).length > 0, {
         error: "At least one field must be provided for update"
@@ -119,15 +118,6 @@ export async function updateOrg(
         if (!hasPasswordExpirationFeature) {
             parsedBody.data.passwordExpiryDays = undefined;
         }
-
-        const hasNewtAutoUpdateFeature = await isLicensedOrSubscribed(
-            orgId,
-            tierMatrix[TierFeature.NewtAutoUpdate]
-        );
-        if (!hasNewtAutoUpdateFeature) {
-            parsedBody.data.settingsEnableGlobalNewtAutoUpdate = false; // force it off
-        }
-
         if (build == "saas") {
             const { tier } = await getOrgTierData(orgId);
 
@@ -146,10 +136,8 @@ export async function updateOrg(
 
             if (maxRetentionDays !== null) {
                 if (
-                    parsedBody.data.settingsLogRetentionDaysRequest !==
-                        undefined &&
-                    parsedBody.data.settingsLogRetentionDaysRequest >
-                        maxRetentionDays
+                    parsedBody.data.settingsLogRetentionDaysRequest !== undefined &&
+                    parsedBody.data.settingsLogRetentionDaysRequest > maxRetentionDays
                 ) {
                     return next(
                         createHttpError(
@@ -159,10 +147,8 @@ export async function updateOrg(
                     );
                 }
                 if (
-                    parsedBody.data.settingsLogRetentionDaysAccess !==
-                        undefined &&
-                    parsedBody.data.settingsLogRetentionDaysAccess >
-                        maxRetentionDays
+                    parsedBody.data.settingsLogRetentionDaysAccess !== undefined &&
+                    parsedBody.data.settingsLogRetentionDaysAccess > maxRetentionDays
                 ) {
                     return next(
                         createHttpError(
@@ -172,10 +158,8 @@ export async function updateOrg(
                     );
                 }
                 if (
-                    parsedBody.data.settingsLogRetentionDaysAction !==
-                        undefined &&
-                    parsedBody.data.settingsLogRetentionDaysAction >
-                        maxRetentionDays
+                    parsedBody.data.settingsLogRetentionDaysAction !== undefined &&
+                    parsedBody.data.settingsLogRetentionDaysAction > maxRetentionDays
                 ) {
                     return next(
                         createHttpError(
@@ -185,10 +169,8 @@ export async function updateOrg(
                     );
                 }
                 if (
-                    parsedBody.data.settingsLogRetentionDaysConnection !==
-                        undefined &&
-                    parsedBody.data.settingsLogRetentionDaysConnection >
-                        maxRetentionDays
+                    parsedBody.data.settingsLogRetentionDaysConnection !== undefined &&
+                    parsedBody.data.settingsLogRetentionDaysConnection > maxRetentionDays
                 ) {
                     return next(
                         createHttpError(
@@ -214,9 +196,7 @@ export async function updateOrg(
                 settingsLogRetentionDaysAction:
                     parsedBody.data.settingsLogRetentionDaysAction,
                 settingsLogRetentionDaysConnection:
-                    parsedBody.data.settingsLogRetentionDaysConnection,
-                settingsEnableGlobalNewtAutoUpdate:
-                    parsedBody.data.settingsEnableGlobalNewtAutoUpdate
+                    parsedBody.data.settingsLogRetentionDaysConnection
             })
             .where(eq(orgs.orgId, orgId))
             .returning();

server/routers/policy/getResourcePolicy.ts

@@ -1,231 +0,0 @@
-import {
-    db,
-    idp,
-    resourcePolicyRules,
-    resourcePolicies,
-    resourcePolicyHeaderAuth,
-    resourcePolicyPassword,
-    resourcePolicyPincode,
-    resourcePolicyWhiteList,
-    rolePolicies,
-    roles,
-    userPolicies,
-    users
-} from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import { and, eq, isNull, not, or, type SQL } from "drizzle-orm";
-import type { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import z from "zod";
-import { fromError } from "zod-validation-error";
-
-const getResourcePolicySchema = z
-    .strictObject({
-        niceId: z.string(),
-        orgId: z.string()
-    })
-    .or(
-        z.strictObject({
-            resourcePolicyId: z.coerce
-                .number<string>()
-                .int()
-                .positive()
-                .openapi({
-                    type: "integer",
-                    description: "Resource policy ID"
-                })
-        })
-    );
-
-export async function queryResourcePolicy(
-    params: z.infer<typeof getResourcePolicySchema>
-) {
-    const conditions: SQL<unknown>[] = [];
-    if ("resourcePolicyId" in params) {
-        conditions.push(
-            eq(resourcePolicies.resourcePolicyId, params.resourcePolicyId)
-        );
-    } else {
-        conditions.push(
-            eq(resourcePolicies.niceId, params.niceId),
-            eq(resourcePolicies.orgId, params.orgId)
-        );
-    }
-
-    const [res] = await db
-        .select({
-            resourcePolicyId: resourcePolicies.resourcePolicyId,
-            sso: resourcePolicies.sso,
-            applyRules: resourcePolicies.applyRules,
-            emailWhitelistEnabled: resourcePolicies.emailWhitelistEnabled,
-            idpId: resourcePolicies.idpId,
-            niceId: resourcePolicies.niceId,
-            name: resourcePolicies.name,
-            passwordId: resourcePolicyPassword.passwordId,
-            pincodeId: resourcePolicyPincode.pincodeId,
-            headerAuth: {
-                id: resourcePolicyHeaderAuth.headerAuthId,
-                extendedCompability:
-                    resourcePolicyHeaderAuth.extendedCompatibility
-            }
-        })
-        .from(resourcePolicies)
-        .leftJoin(
-            resourcePolicyPassword,
-            eq(
-                resourcePolicyPassword.resourcePolicyId,
-                resourcePolicies.resourcePolicyId
-            )
-        )
-        .leftJoin(
-            resourcePolicyPincode,
-            eq(
-                resourcePolicyPincode.resourcePolicyId,
-                resourcePolicies.resourcePolicyId
-            )
-        )
-        .leftJoin(
-            resourcePolicyHeaderAuth,
-            eq(
-                resourcePolicyHeaderAuth.resourcePolicyId,
-                resourcePolicies.resourcePolicyId
-            )
-        )
-        .where(and(...conditions))
-        .limit(1);
-
-    if (!res) return null;
-
-    const policyUsers = await db
-        .select({
-            userId: userPolicies.userId,
-            email: users.email,
-            name: users.name,
-            username: users.username,
-            type: users.type,
-            idpName: idp.name
-        })
-        .from(userPolicies)
-        .innerJoin(users, eq(userPolicies.userId, users.userId))
-        .leftJoin(idp, eq(idp.idpId, users.idpId))
-        .where(eq(userPolicies.resourcePolicyId, res.resourcePolicyId));
-
-    const policyRoles = await db
-        .select({
-            roleId: rolePolicies.roleId,
-            name: roles.name
-        })
-        .from(rolePolicies)
-        .innerJoin(
-            roles,
-            and(
-                eq(rolePolicies.roleId, roles.roleId),
-                or(isNull(roles.isAdmin), not(roles.isAdmin))
-            )
-        )
-        .where(eq(rolePolicies.resourcePolicyId, res.resourcePolicyId));
-
-    const policyEmailWhiteList = await db
-        .select({
-            whiteListId: resourcePolicyWhiteList.whitelistId,
-            email: resourcePolicyWhiteList.email
-        })
-        .from(resourcePolicyWhiteList)
-        .where(
-            eq(resourcePolicyWhiteList.resourcePolicyId, res.resourcePolicyId)
-        );
-
-    const policyRules = await db
-        .select({
-            ruleId: resourcePolicyRules.ruleId,
-            enabled: resourcePolicyRules.enabled,
-            priority: resourcePolicyRules.priority,
-            action: resourcePolicyRules.action,
-            match: resourcePolicyRules.match,
-            value: resourcePolicyRules.value
-        })
-        .from(resourcePolicyRules)
-        .where(eq(resourcePolicyRules.resourcePolicyId, res.resourcePolicyId));
-
-    return {
-        ...res,
-        roles: policyRoles,
-        users: policyUsers,
-        emailWhiteList: policyEmailWhiteList,
-        rules: policyRules
-    };
-}
-
-export type GetResourcePolicyResponse = NonNullable<
-    Awaited<ReturnType<typeof queryResourcePolicy>>
->;
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/resource-policy/{niceId}",
-    description:
-        "Get a resource policy by orgId and niceId. NiceId is a readable ID for the resource and unique on a per org basis.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
-    request: {
-        params: z.object({
-            orgId: z.string(),
-            niceId: z.string()
-        })
-    },
-    responses: {}
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/resource-policy/{resourcePolicyId}",
-    description: "Get a resource policy by its resourcePolicyId.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: z.object({
-            resourcePolicyId: z.number()
-        })
-    },
-    responses: {}
-});
-
-export async function getResourcePolicy(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = getResourcePolicySchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const policy = await queryResourcePolicy(parsedParams.data);
-
-        if (!policy) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, "Resource policy not found")
-            );
-        }
-
-        return response<GetResourcePolicyResponse>(res, {
-            data: policy,
-            success: true,
-            error: false,
-            message: "Resource Policy retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/policy/index.ts

@@ -1,8 +0,0 @@
-export * from "./getResourcePolicy";
-export * from "./updateResourcePolicy";
-export * from "./setResourcePolicyAccessControl";
-export * from "./setResourcePolicyPassword";
-export * from "./setResourcePolicyPincode";
-export * from "./setResourcePolicyHeaderAuth";
-export * from "./setResourcePolicyWhitelist";
-export * from "./setResourcePolicyRules";

server/routers/policy/setResourcePolicyAccessControl.ts

@@ -1,237 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import {
-    db,
-    idp,
-    idpOrg,
-    resourcePolicies,
-    rolePolicies,
-    roles,
-    userOrgs,
-    users
-} from "@server/db";
-import { userPolicies } from "@server/db";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { and, eq, inArray, ne } from "drizzle-orm";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const setResourcePolicyAcccessControlBodySchema = z.strictObject({
-    sso: z.boolean(),
-    userIds: z.array(z.string()),
-    roleIds: z.array(z.int().positive()).openapi({
-        type: "array"
-    }),
-    skipToIdpId: z.int().positive().optional().nullable().openapi({
-        type: "integer",
-        description: "Page number to retrieve"
-    })
-});
-
-const setResourcePolicyAccessControlParamsSchema = z.strictObject({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/resource-policy/{resourceId}/access-control",
-    description:
-        "Set access control users for a resource policy, including SSO, users, roles, Identity provider.",
-    tags: [OpenAPITags.Policy, OpenAPITags.User],
-    request: {
-        params: setResourcePolicyAccessControlParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyAcccessControlBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function setResourcePolicyAccessControl(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedBody = setResourcePolicyAcccessControlBodySchema.safeParse(
-            req.body
-        );
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { userIds, roleIds, sso, skipToIdpId: idpId } = parsedBody.data;
-
-        const parsedParams =
-            setResourcePolicyAccessControlParamsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-
-        const [policy] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
-            .limit(1);
-
-        if (!policy) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Resource policy not found"
-                )
-            );
-        }
-
-        // Check if Identity provider in `skipToIdpId` exists
-        if (idpId) {
-            const [provider] = await db
-                .select()
-                .from(idp)
-                .innerJoin(idpOrg, eq(idpOrg.idpId, idp.idpId))
-                .where(
-                    and(eq(idp.idpId, idpId), eq(idpOrg.orgId, policy.orgId))
-                )
-                .limit(1);
-
-            if (!provider) {
-                return next(
-                    createHttpError(
-                        HttpCode.INTERNAL_SERVER_ERROR,
-                        "Identity provider not found in this organization"
-                    )
-                );
-            }
-        }
-
-        // Check if any of the roleIds are admin roles
-        const rolesToCheck = await db
-            .select()
-            .from(roles)
-            .where(
-                and(
-                    inArray(roles.roleId, roleIds),
-                    eq(roles.orgId, policy.orgId)
-                )
-            );
-
-        const hasAdminRole = rolesToCheck.some((role) => role.isAdmin);
-
-        if (hasAdminRole) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Admin role cannot be assigned to resources"
-                )
-            );
-        }
-
-        // Get all admin role IDs for this org to exclude from deletion
-        const adminRoles = await db
-            .select()
-            .from(roles)
-            .where(and(eq(roles.isAdmin, true), eq(roles.orgId, policy.orgId)));
-        const adminRoleIds = adminRoles.map((role) => role.roleId);
-
-        const existingUsers = await db
-            .select()
-            .from(users)
-            .innerJoin(userOrgs, eq(userOrgs.userId, users.userId))
-            .where(
-                and(
-                    eq(userOrgs.orgId, policy.orgId),
-                    inArray(users.userId, userIds)
-                )
-            );
-
-        const existingRoles = await db
-            .select()
-            .from(roles)
-            .where(
-                and(
-                    eq(roles.orgId, policy.orgId),
-                    inArray(roles.roleId, roleIds)
-                )
-            );
-
-        await db.transaction(async (trx) => {
-            // Update SSO status
-            await trx
-                .update(resourcePolicies)
-                .set({
-                    sso,
-                    idpId
-                })
-                .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
-
-            // Update roles
-            if (adminRoleIds.length > 0) {
-                await trx.delete(rolePolicies).where(
-                    and(
-                        eq(rolePolicies.resourcePolicyId, resourcePolicyId),
-                        ne(rolePolicies.roleId, adminRoleIds[0]) // delete all but the admin role
-                    )
-                );
-            } else {
-                await trx
-                    .delete(rolePolicies)
-                    .where(eq(rolePolicies.resourcePolicyId, resourcePolicyId));
-            }
-
-            const rolesToAdd = existingRoles.map(({ roleId }) => ({
-                roleId,
-                resourcePolicyId
-            }));
-
-            if (rolesToAdd.length > 0) {
-                await trx.insert(rolePolicies).values(rolesToAdd);
-            }
-
-            // Update users
-            await trx
-                .delete(userPolicies)
-                .where(eq(userPolicies.resourcePolicyId, resourcePolicyId));
-
-            const usersToAdd = existingUsers.map(({ user }) => ({
-                userId: user.userId,
-                resourcePolicyId: resourcePolicyId
-            }));
-
-            if (usersToAdd.length > 0) {
-                await trx.insert(userPolicies).values(usersToAdd);
-            }
-        });
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Resource policy succesfully updated",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/policy/setResourcePolicyHeaderAuth.ts

@@ -1,117 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db, resourcePolicyHeaderAuth } from "@server/db";
-import { eq } from "drizzle-orm";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { fromError } from "zod-validation-error";
-import { response } from "@server/lib/response";
-import logger from "@server/logger";
-import { hashPassword } from "@server/auth/password";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const setResourcePolicyHeaderAuthParamsSchema = z.object({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-const setResourcePolicyHeaderAuthBodySchema = z.strictObject({
-    headerAuth: z
-        .object({
-            user: z.string().min(4).max(100),
-            password: z.string().min(4).max(100),
-            extendedCompatibility: z.boolean()
-        })
-        .nullable()
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/resource-policy/{resourcePolicyId}/header-auth",
-    description:
-        "Set or update the header authentication for a resource policy. If user and password is not provided, it will remove the header authentication.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyHeaderAuthParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyHeaderAuthBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function setResourcePolicyHeaderAuth(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = setResourcePolicyHeaderAuthParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedBody = setResourcePolicyHeaderAuthBodySchema.safeParse(
-            req.body
-        );
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-        const { headerAuth } = parsedBody.data;
-
-        await db.transaction(async (trx) => {
-            await trx
-                .delete(resourcePolicyHeaderAuth)
-                .where(
-                    eq(
-                        resourcePolicyHeaderAuth.resourcePolicyId,
-                        resourcePolicyId
-                    )
-                );
-
-            if (headerAuth !== null) {
-                const headerAuthHash = await hashPassword(
-                    Buffer.from(
-                        `${headerAuth.user}:${headerAuth.password}`
-                    ).toString("base64")
-                );
-
-                await trx.insert(resourcePolicyHeaderAuth).values({
-                    resourcePolicyId,
-                    headerAuthHash,
-                    extendedCompatibility: headerAuth.extendedCompatibility
-                });
-            }
-        });
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Header Authentication set successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/policy/setResourcePolicyPassword.ts

@@ -1,106 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import { resourcePolicyPassword } from "@server/db";
-import { eq } from "drizzle-orm";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { fromError } from "zod-validation-error";
-import { response } from "@server/lib/response";
-import logger from "@server/logger";
-import { hashPassword } from "@server/auth/password";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const setResourcePolicyPasswordParamsSchema = z.object({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-const setResourcePolicyPasswordBodySchema = z.strictObject({
-    password: z.string().min(4).max(100).nullable()
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/resource-policy/{resourcePolicyId}/password",
-    description:
-        "Set the password for a resource policy. Setting the password to null will remove it.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyPasswordParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyPasswordBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function setResourcePolicyPassword(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = setResourcePolicyPasswordParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedBody = setResourcePolicyPasswordBodySchema.safeParse(
-            req.body
-        );
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-        const { password } = parsedBody.data;
-
-        await db.transaction(async (trx) => {
-            await trx
-                .delete(resourcePolicyPassword)
-                .where(
-                    eq(
-                        resourcePolicyPassword.resourcePolicyId,
-                        resourcePolicyId
-                    )
-                );
-
-            if (password) {
-                const passwordHash = await hashPassword(password);
-
-                await trx
-                    .insert(resourcePolicyPassword)
-                    .values({ resourcePolicyId, passwordHash });
-            }
-        });
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Resource policy password set successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/policy/setResourcePolicyPincode.ts

@@ -1,106 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db } from "@server/db";
-import { resourcePolicyPincode } from "@server/db";
-import { eq } from "drizzle-orm";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { fromError } from "zod-validation-error";
-import { response } from "@server/lib/response";
-import logger from "@server/logger";
-import { hashPassword } from "@server/auth/password";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const setResourcePolicyPincodeParamsSchema = z.object({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-const setResourcePolicyPincodeBodySchema = z.strictObject({
-    pincode: z
-        .string()
-        .regex(/^\d{6}$/)
-        .or(z.null())
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/resource-policy/{resourcePolicyId}/pincode",
-    description:
-        "Set the PIN code for a resource policy. Setting the PIN code to null will remove it.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyPincodeParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyPincodeBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function setResourcePolicyPincode(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = setResourcePolicyPincodeParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedBody = setResourcePolicyPincodeBodySchema.safeParse(
-            req.body
-        );
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-        const { pincode } = parsedBody.data;
-
-        await db.transaction(async (trx) => {
-            await trx
-                .delete(resourcePolicyPincode)
-                .where(
-                    eq(resourcePolicyPincode.resourcePolicyId, resourcePolicyId)
-                );
-
-            if (pincode) {
-                const pincodeHash = await hashPassword(pincode);
-
-                await trx
-                    .insert(resourcePolicyPincode)
-                    .values({ resourcePolicyId, pincodeHash, digitLength: 6 });
-            }
-        });
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Resource policy PIN code set successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/policy/setResourcePolicyRules.ts

@@ -1,167 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db, resourcePolicyRules, resourcePolicies } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import {
-    isValidCIDR,
-    isValidIP,
-    isValidUrlGlobPattern
-} from "@server/lib/validators";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const ruleSchema = z.strictObject({
-    action: z.enum(["ACCEPT", "DROP", "PASS"]).openapi({
-        type: "string",
-        enum: ["ACCEPT", "DROP", "PASS"],
-        description: "rule action"
-    }),
-    match: z.enum(["CIDR", "IP", "PATH"]).openapi({
-        type: "string",
-        enum: ["CIDR", "IP", "PATH"],
-        description: "rule match"
-    }),
-    value: z.string().min(1),
-    priority: z.int().openapi({
-        type: "integer",
-        description: "Rule priority"
-    }),
-    enabled: z.boolean().optional()
-});
-
-const setResourcePolicyRulesBodySchema = z.strictObject({
-    applyRules: z.boolean(),
-    rules: z.array(ruleSchema)
-});
-
-const setResourcePolicyRulesParamsSchema = z.strictObject({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/resource-policy/{resourcePolicyId}/rules",
-    description:
-        "Set all rules for a resource policy at once. This will replace all existing rules.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyRulesParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyRulesBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function setResourcePolicyRules(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = setResourcePolicyRulesParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedBody = setResourcePolicyRulesBodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-        const { applyRules, rules } = parsedBody.data;
-
-        const [policy] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
-            .limit(1);
-
-        if (!policy) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, "Resource policy not found")
-            );
-        }
-
-        for (const rule of rules) {
-            if (rule.match === "CIDR" && !isValidCIDR(rule.value)) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid CIDR provided"
-                    )
-                );
-            } else if (rule.match === "IP" && !isValidIP(rule.value)) {
-                return next(
-                    createHttpError(HttpCode.BAD_REQUEST, "Invalid IP provided")
-                );
-            } else if (
-                rule.match === "PATH" &&
-                !isValidUrlGlobPattern(rule.value)
-            ) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Invalid URL glob pattern provided"
-                    )
-                );
-            }
-        }
-
-        await db.transaction(async (trx) => {
-            await trx
-                .update(resourcePolicies)
-                .set({ applyRules })
-                .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
-
-            await trx
-                .delete(resourcePolicyRules)
-                .where(
-                    eq(resourcePolicyRules.resourcePolicyId, resourcePolicyId)
-                );
-
-            if (rules.length > 0) {
-                await trx.insert(resourcePolicyRules).values(
-                    rules.map((rule) => ({
-                        resourcePolicyId,
-                        ...rule
-                    }))
-                );
-            }
-        });
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Resource policy rules set successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/policy/setResourcePolicyWhitelist.ts

@@ -1,132 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db, resourcePolicies, resourcePolicyWhiteList } from "@server/db";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { and, eq } from "drizzle-orm";
-import { OpenAPITags, registry } from "@server/openApi";
-
-const setResourcePolicyWhitelistBodySchema = z.strictObject({
-    emailWhitelistEnabled: z.boolean(),
-    emails: z
-        .array(
-            z.email().or(
-                z.string().regex(/^\*@[\w.-]+\.[a-zA-Z]{2,}$/, {
-                    error: "Invalid email address. Wildcard (*) must be the entire local part."
-                })
-            )
-        )
-        .max(50)
-        .transform((v) => v.map((e) => e.toLowerCase()))
-});
-
-const setResourcePolicyWhitelistParamsSchema = z.strictObject({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/resource-policy/{resourcePolicyId}/whitelist",
-    description:
-        "Set email whitelist for a resource policy. This will replace all existing emails.",
-    tags: [OpenAPITags.Policy],
-    request: {
-        params: setResourcePolicyWhitelistParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: setResourcePolicyWhitelistBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function setResourcePolicyWhitelist(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedBody = setResourcePolicyWhitelistBodySchema.safeParse(
-            req.body
-        );
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const parsedParams = setResourcePolicyWhitelistParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-        const { emailWhitelistEnabled, emails } = parsedBody.data;
-
-        const [policy] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
-
-        if (!policy) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, "Resource policy not found")
-            );
-        }
-
-        await db.transaction(async (trx) => {
-            await trx
-                .update(resourcePolicies)
-                .set({ emailWhitelistEnabled })
-                .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId));
-
-            // delete all whitelist emails
-            await trx
-                .delete(resourcePolicyWhiteList)
-                .where(
-                    eq(
-                        resourcePolicyWhiteList.resourcePolicyId,
-                        resourcePolicyId
-                    )
-                );
-
-            if (emailWhitelistEnabled && emails.length > 0) {
-                await trx.insert(resourcePolicyWhiteList).values(
-                    emails.map((email) => ({
-                        email,
-                        resourcePolicyId
-                    }))
-                );
-            }
-        });
-
-        return response(res, {
-            data: {},
-            success: true,
-            error: false,
-            message: "Whitelist set for resource policy successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/policy/updateResourcePolicy.ts

@@ -1,157 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import z from "zod";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { fromError } from "zod-validation-error";
-import { db, orgs, resourcePolicies, type ResourcePolicy } from "@server/db";
-import { and, eq } from "drizzle-orm";
-import logger from "@server/logger";
-import response from "@server/lib/response";
-
-const updateResourcePolicyParamsSchema = z.strictObject({
-    resourcePolicyId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-const updateResourcePolicyBodySchema = z.strictObject({
-    name: z.string().min(1).max(255).optional(),
-    niceId: z.string().min(1).max(255).optional()
-});
-
-registry.registerPath({
-    method: "put",
-    path: "/resource-policy/{resourcePolicyId}",
-    description: "Update a resource policy.",
-    tags: [OpenAPITags.Org, OpenAPITags.Policy],
-    request: {
-        params: updateResourcePolicyParamsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: updateResourcePolicyBodySchema
-                }
-            }
-        }
-    },
-    responses: {}
-});
-
-export async function updateResourcePolicy(
-    req: Request,
-    res: Response,
-    next: NextFunction
-) {
-    try {
-        const parsedParams = updateResourcePolicyParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        if (req.user && req.userOrgRoleIds?.length === 0) {
-            return next(
-                createHttpError(HttpCode.FORBIDDEN, "User does not have a role")
-            );
-        }
-
-        const { resourcePolicyId } = parsedParams.data;
-        const [result] = await db
-            .select()
-            .from(resourcePolicies)
-            .where(eq(resourcePolicies.resourcePolicyId, resourcePolicyId))
-            .leftJoin(orgs, eq(resourcePolicies.orgId, orgs.orgId));
-
-        const policy = result?.resourcePolicies;
-        const org = result?.orgs;
-
-        if (!policy || !org) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Resource Policy with ID ${resourcePolicyId} not found`
-                )
-            );
-        }
-
-        const parsedBody = updateResourcePolicyBodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const updateData = parsedBody.data;
-
-        if (updateData.niceId) {
-            const [existingPolicy] = await db
-                .select()
-                .from(resourcePolicies)
-                .where(
-                    and(
-                        eq(resourcePolicies.niceId, updateData.niceId),
-                        eq(resourcePolicies.orgId, policy.orgId)
-                    )
-                );
-
-            if (
-                existingPolicy &&
-                existingPolicy.resourcePolicyId !== policy.resourcePolicyId
-            ) {
-                return next(
-                    createHttpError(
-                        HttpCode.CONFLICT,
-                        `A resource policy with niceId "${updateData.niceId}" already exists`
-                    )
-                );
-            }
-        }
-
-        const updatedPolicy = await db.transaction(async (trx) => {
-            const [updated] = await trx
-                .update(resourcePolicies)
-                .set({
-                    ...updateData
-                })
-                .where(
-                    eq(
-                        resourcePolicies.resourcePolicyId,
-                        policy.resourcePolicyId
-                    )
-                )
-                .returning();
-
-            return updated;
-        });
-
-        if (!updatedPolicy) {
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Failed to update policy"
-                )
-            );
-        }
-
-        return response<ResourcePolicy>(res, {
-            data: updatedPolicy,
-            success: true,
-            error: false,
-            message: "Resource policy updated successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/resource/createResource.ts

@@ -1,19 +1,15 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { build } from "@server/build";
+import { db, domainNamespaces, loginPage } from "@server/db";
 import {
-    db,
-    loginPage,
+    domains,
+    orgDomains,
     orgs,
     Resource,
     resources,
-    resourcePolicies,
     roleResources,
-    rolePolicies,
     roles,
-    userPolicies,
-    userResources,
-    domainNamespaces
+    userResources
 } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -24,75 +20,27 @@ import logger from "@server/logger";
 import { subdomainSchema, wildcardSubdomainSchema } from "@server/lib/schemas";
 import config from "@server/lib/config";
 import { OpenAPITags, registry } from "@server/openApi";
+import { build } from "@server/build";
 import { createCertificate } from "#dynamic/routers/certificates/createCertificate";
-import {
-    validateAndConstructDomain,
-    checkWildcardDomainConflict
-} from "@server/lib/domainUtils";
+import { getUniqueResourceName } from "@server/db/names";
+import { validateAndConstructDomain, checkWildcardDomainConflict } from "@server/lib/domainUtils";
 import { isSubscribed } from "#dynamic/lib/isSubscribed";
 import { isLicensedOrSubscribed } from "#dynamic/lib/isLicencedOrSubscribed";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
-import {
-    getUniqueResourceName,
-    getUniqueResourcePolicyName
-} from "@server/db/names";
 
 const createResourceParamsSchema = z.strictObject({
     orgId: z.string()
 });
 
-function resolveModeFromLegacyFields(data: {
-    mode?: "http" | "ssh" | "rdp" | "vnc" | "tcp" | "udp";
-    http?: boolean;
-    protocol?: "tcp" | "udp";
-}): {
-    mode?: "http" | "ssh" | "rdp" | "vnc" | "tcp" | "udp";
-    error?: string;
-} {
-    if (data.mode) {
-        return { mode: data.mode };
-    }
-
-    if (typeof data.http === "boolean" && data.protocol) {
-        if (data.http && data.protocol === "tcp") {
-            return { mode: "http" };
-        }
-        if (!data.http && data.protocol === "tcp") {
-            return { mode: "tcp" };
-        }
-        if (!data.http && data.protocol === "udp") {
-            return { mode: "udp" };
-        }
-        return {
-            error: "Invalid deprecated http/protocol combination"
-        };
-    }
-
-    return { mode: undefined };
-}
-
 const createHttpResourceSchema = z
     .strictObject({
         name: z.string().min(1).max(255),
         subdomain: z.string().nullable().optional(),
-        http: z.boolean().optional().openapi({
-            deprecated: true,
-            description:
-                "Deprecated. Use `mode` instead. Legacy compatibility only."
-        }),
-        protocol: z.enum(["tcp", "udp"]).optional().openapi({
-            deprecated: true,
-            description:
-                "Deprecated. Use `mode` instead. Legacy compatibility only."
-        }),
+        http: z.boolean(),
+        protocol: z.enum(["tcp", "udp"]),
         domainId: z.string(),
         stickySession: z.boolean().optional(),
-        postAuthPath: z.string().nullable().optional(),
-        mode: z.enum(["http", "ssh", "rdp", "vnc", "tcp", "udp"]).optional(),
-        // SSH Settings
-        pamMode: z.enum(["passthrough", "push"]).optional(),
-        authDaemonPort: z.int().positive().optional(),
-        authDaemonMode: z.enum(["site", "remote", "native"]).optional()
+        postAuthPath: z.string().nullable().optional()
     })
     .refine(
         (data) => {
@@ -112,27 +60,13 @@ const createHttpResourceSchema = z
 const createRawResourceSchema = z
     .strictObject({
         name: z.string().min(1).max(255),
-        http: z.boolean().optional().openapi({
-            deprecated: true,
-            description:
-                "Deprecated. Use `mode` instead. Legacy compatibility only."
-        }),
-        protocol: z.enum(["tcp", "udp"]).optional().openapi({
-            deprecated: true,
-            description:
-                "Deprecated. Use `mode` instead. Legacy compatibility only."
-        }),
-        mode: z.enum(["tcp", "udp"]).optional(),
+        http: z.boolean(),
+        protocol: z.enum(["tcp", "udp"]),
         proxyPort: z.int().min(1).max(65535)
         // enableProxy: z.boolean().default(true) // always true now
     })
     .refine(
         (data) => {
-            const resolved = resolveModeFromLegacyFields(data);
-            if (resolved.error || !resolved.mode) {
-                return false;
-            }
-
             if (!config.getRawConfig().flags?.allow_raw_resources) {
                 if (data.proxyPort !== undefined) {
                     return false;
@@ -209,18 +143,17 @@ export async function createResource(
             );
         }
 
-        const resolvedMode = resolveModeFromLegacyFields(req.body);
-        if (resolvedMode.error) {
+        if (typeof req.body.http !== "boolean") {
             return next(
-                createHttpError(HttpCode.BAD_REQUEST, resolvedMode.error)
+                createHttpError(HttpCode.BAD_REQUEST, "http field is required")
             );
         }
 
-        if (resolvedMode.mode) {
-            req.body.mode = resolvedMode.mode;
-        }
+        const { http } = req.body;
 
-        if (typeof req.body.proxyPort === "number") {
+        if (http) {
+            return await createHttpResource({ req, res, next }, { orgId });
+        } else {
             if (
                 !config.getRawConfig().flags?.allow_raw_resources &&
                 build == "oss"
@@ -234,17 +167,6 @@ export async function createResource(
             }
             return await createRawResource({ req, res, next }, { orgId });
         }
-
-        if (req.body.mode) {
-            return await createHttpResource({ req, res, next }, { orgId });
-        } else {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "mode is required when deprecated fields are not provided"
-                )
-            );
-        }
     } catch (error) {
         logger.error(error);
         return next(
@@ -276,15 +198,7 @@ async function createHttpResource(
         );
     }
 
-    const {
-        name,
-        domainId,
-        postAuthPath,
-        mode,
-        authDaemonPort,
-        authDaemonMode,
-        pamMode
-    } = parsedBody.data;
+    const { name, domainId, postAuthPath } = parsedBody.data;
     const subdomain = parsedBody.data.subdomain;
     const stickySession = parsedBody.data.stickySession;
 
@@ -397,10 +311,28 @@ async function createHttpResource(
     let resource: Resource | undefined;
 
     const niceId = await getUniqueResourceName(orgId);
-    const policyNiceId = await getUniqueResourcePolicyName(orgId);
 
     await db.transaction(async (trx) => {
-        const adminRole = await trx
+        const newResource = await trx
+            .insert(resources)
+            .values({
+                niceId,
+                fullDomain,
+                domainId,
+                orgId,
+                name,
+                subdomain: finalSubdomain,
+                http: true,
+                protocol: "tcp",
+                ssl: true,
+                stickySession: stickySession,
+                postAuthPath: postAuthPath,
+                wildcard,
+                health: "unknown"
+            })
+            .returning();
+
+        const adminRole = await db
             .select()
             .from(roles)
             .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
@@ -412,53 +344,6 @@ async function createHttpResource(
             );
         }
 
-        const [defaultPolicy] = await trx
-            .insert(resourcePolicies)
-            .values({
-                niceId: policyNiceId,
-                orgId,
-                name: `default policy for ${niceId}`,
-                sso: true,
-                scope: "resource"
-            })
-            .returning();
-
-        // make this policy visible by the admin role
-        await trx.insert(rolePolicies).values({
-            roleId: adminRole[0].roleId,
-            resourcePolicyId: defaultPolicy.resourcePolicyId
-        });
-
-        // make this policy visible by the current user
-        if (req.user && !req.userOrgRoleIds?.includes(adminRole[0].roleId)) {
-            await trx.insert(userPolicies).values({
-                userId: req.user?.userId!,
-                resourcePolicyId: defaultPolicy.resourcePolicyId
-            });
-        }
-
-        const newResource = await trx
-            .insert(resources)
-            .values({
-                niceId,
-                fullDomain,
-                domainId,
-                orgId,
-                name,
-                subdomain: finalSubdomain,
-                mode: mode,
-                pamMode: pamMode,
-                authDaemonMode: authDaemonMode,
-                authDaemonPort: authDaemonPort,
-                ssl: true,
-                stickySession: stickySession,
-                postAuthPath: postAuthPath,
-                wildcard,
-                health: "unknown",
-                defaultResourcePolicyId: defaultPolicy.resourcePolicyId
-            })
-            .returning();
-
         await trx.insert(roleResources).values({
             roleId: adminRole[0].roleId,
             resourceId: newResource[0].resourceId
@@ -484,7 +369,7 @@ async function createHttpResource(
         );
     }
 
-    if (build !== "oss") {
+    if (build != "oss") {
         await createCertificate(domainId, fullDomain, db);
     }
 
@@ -520,25 +405,27 @@ async function createRawResource(
         );
     }
 
-    const { name, proxyPort } = parsedBody.data;
-    const resolvedMode = resolveModeFromLegacyFields(parsedBody.data);
-    if (resolvedMode.error || !resolvedMode.mode) {
-        return next(
-            createHttpError(
-                HttpCode.BAD_REQUEST,
-                resolvedMode.error ||
-                    "mode is required when deprecated fields are not provided"
-            )
-        );
-    }
+    const { name, http, protocol, proxyPort } = parsedBody.data;
 
     let resource: Resource | undefined;
 
     const niceId = await getUniqueResourceName(orgId);
-    const policyNiceId = await getUniqueResourcePolicyName(orgId);
 
     await db.transaction(async (trx) => {
-        const adminRole = await trx
+        const newResource = await trx
+            .insert(resources)
+            .values({
+                niceId,
+                orgId,
+                name,
+                http,
+                protocol,
+                proxyPort
+                // enableProxy
+            })
+            .returning();
+
+        const adminRole = await db
             .select()
             .from(roles)
             .where(and(eq(roles.isAdmin, true), eq(roles.orgId, orgId)))
@@ -550,43 +437,6 @@ async function createRawResource(
             );
         }
 
-        const [defaultPolicy] = await trx
-            .insert(resourcePolicies)
-            .values({
-                niceId: policyNiceId,
-                orgId,
-                name: `default policy for ${niceId}`,
-                sso: true,
-                scope: "resource"
-            })
-            .returning();
-
-        // make this policy visible by the admin role
-        await trx.insert(rolePolicies).values({
-            roleId: adminRole[0].roleId,
-            resourcePolicyId: defaultPolicy.resourcePolicyId
-        });
-
-        // make this policy visible by the current user
-        if (req.user && !req.userOrgRoleIds?.includes(adminRole[0].roleId)) {
-            await trx.insert(userPolicies).values({
-                userId: req.user?.userId!,
-                resourcePolicyId: defaultPolicy.resourcePolicyId
-            });
-        }
-
-        const newResource = await trx
-            .insert(resources)
-            .values({
-                niceId,
-                orgId,
-                name,
-                mode: resolvedMode.mode,
-                proxyPort,
-                defaultResourcePolicyId: defaultPolicy.resourcePolicyId
-            })
-            .returning();
-
         await trx.insert(roleResources).values({
             roleId: adminRole[0].roleId,
             resourceId: newResource[0].resourceId

server/routers/resource/createResourceRule.ts

@@ -94,7 +94,7 @@ export async function createResourceRule(
             );
         }
 
-        if (!["http", "ssh", "rdp", "vnc"].includes(resource.mode)) {
+        if (!resource.http) {
             return next(
                 createHttpError(
                     HttpCode.BAD_REQUEST,

server/routers/resource/deleteResource.ts

@@ -1,22 +1,17 @@
-import { eq, inArray } from "drizzle-orm";
-import {
-    db,
-    newts,
-    resourcePolicies,
-    resources,
-    sites,
-    targetHealthCheck,
-    targets
-} from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
+import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
+import { db, targetHealthCheck } from "@server/db";
+import { newts, resources, sites, targets } from "@server/db";
+import { eq, inArray } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
+import { addPeer } from "../gerbil/peers";
 import { removeTargets } from "../newt/targets";
+import { getAllowedIps } from "../target/helpers";
+import { OpenAPITags, registry } from "@server/openApi";
 
 // Define Zod schema for request parameters validation
 const deleteResourceSchema = z.strictObject({
@@ -111,25 +106,13 @@ export async function deleteResource(
                         // [target],
                         [], // deleting the target from newt causes issues because we cant unbind the port. this needs to be fixed in newt before we can do this
                         healthChecksToBeRemoved,
-                        deletedResource.mode === "udp" ? "udp" : "tcp",
+                        deletedResource.protocol,
                         newt.version
                     );
                 }
             }
         }
 
-        // Also delete default resource policy
-        if (deletedResource.defaultResourcePolicyId) {
-            await db
-                .delete(resourcePolicies)
-                .where(
-                    eq(
-                        resourcePolicies.resourcePolicyId,
-                        deletedResource.defaultResourcePolicyId
-                    )
-                );
-        }
-
         return response(res, {
             data: null,
             success: true,

server/routers/resource/getBrowserTarget.ts

@@ -1,109 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { browserGatewayTarget, db } from "@server/db";
-import { resources, targets } from "@server/db";
-import { eq } from "drizzle-orm";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import { fromError } from "zod-validation-error";
-import logger from "@server/logger";
-import { decrypt } from "@server/lib/crypto";
-import config from "@server/lib/config";
-
-const getBrowserTargetSchema = z
-    .object({
-        fullDomain: z.string().min(1, "fullDomain is required")
-    })
-    .strict();
-
-export type GetBrowserTargetResponse = {
-    ip: string;
-    port: number;
-    authToken: string;
-    orgId: string;
-    resourceId: number;
-    niceId: string;
-    pamMode: "passthrough" | "push" | null;
-    authDaemonMode: "site" | "remote" | "native" | null;
-};
-
-export async function getBrowserTarget(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsed = getBrowserTargetSchema.safeParse(req.query);
-        if (!parsed.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsed.error).toString()
-                )
-            );
-        }
-
-        const { fullDomain } = parsed.data;
-
-        logger.info(`Retrieving browser target for domain: ${fullDomain}`);
-
-        const [browserTarget] = await db
-            .select({
-                destination: browserGatewayTarget.destination,
-                destinationPort: browserGatewayTarget.destinationPort,
-                authToken: browserGatewayTarget.authToken,
-                resourceId: resources.resourceId,
-                niceId: resources.niceId,
-                orgId: resources.orgId,
-                pamMode: resources.pamMode,
-                authDaemonMode: resources.authDaemonMode
-            })
-            .from(browserGatewayTarget)
-            .innerJoin(
-                resources,
-                eq(browserGatewayTarget.resourceId, resources.resourceId)
-            )
-            .where(eq(resources.fullDomain, fullDomain))
-            .limit(1);
-
-        const decryptedAuthToken = decrypt(
-            browserTarget.authToken,
-            config.getRawConfig().server.secret!
-        );
-
-        if (!browserTarget) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    "No resource found for this domain"
-                )
-            );
-        }
-
-        return response<GetBrowserTargetResponse>(res, {
-            data: {
-                ip: browserTarget.destination,
-                port: browserTarget.destinationPort,
-                authToken: decryptedAuthToken,
-                pamMode: browserTarget.pamMode,
-                authDaemonMode: browserTarget.authDaemonMode,
-                orgId: browserTarget.orgId,
-                resourceId: browserTarget.resourceId,
-                niceId: browserTarget.niceId
-            },
-            success: true,
-            error: false,
-            message: "Browser target retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(
-                HttpCode.INTERNAL_SERVER_ERROR,
-                "An error occurred while retrieving the browser target"
-            )
-        );
-    }
-}

server/routers/resource/getResourceAuthInfo.ts

@@ -2,13 +2,13 @@ import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
 import {
     db,
-    resourcePolicies,
-    resourcePolicyHeaderAuth,
-    resourcePolicyPassword,
-    resourcePolicyPincode,
+    resourceHeaderAuth,
+    resourceHeaderAuthExtendedCompatibility,
+    resourcePassword,
+    resourcePincode,
     resources
 } from "@server/db";
-import { eq, or } from "drizzle-orm";
+import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
@@ -60,53 +60,64 @@ export async function getResourceAuthInfo(
 
         const isGuidInteger = /^\d+$/.test(resourceGuid);
 
-        const buildQuery = (whereClause: ReturnType<typeof eq>) =>
-            db
-                .select()
-                .from(resources)
-                .leftJoin(
-                    resourcePolicies,
-                    or(
-                        eq(
-                            resourcePolicies.resourcePolicyId,
-                            resources.resourcePolicyId
-                        ),
-                        eq(
-                            resourcePolicies.resourcePolicyId,
-                            resources.defaultResourcePolicyId
-                        )
-                    )
-                )
-                .leftJoin(
-                    resourcePolicyPincode,
-                    eq(
-                        resourcePolicyPincode.resourcePolicyId,
-                        resourcePolicies.resourcePolicyId
-                    )
-                )
-                .leftJoin(
-                    resourcePolicyPassword,
-                    eq(
-                        resourcePolicyPassword.resourcePolicyId,
-                        resourcePolicies.resourcePolicyId
-                    )
-                )
-                .leftJoin(
-                    resourcePolicyHeaderAuth,
-                    eq(
-                        resourcePolicyHeaderAuth.resourcePolicyId,
-                        resourcePolicies.resourcePolicyId
-                    )
-                )
-                .where(whereClause)
-                .limit(1);
-
         const [result] =
             isGuidInteger && build === "saas"
-                ? await buildQuery(
-                      eq(resources.resourceId, Number(resourceGuid))
-                  )
-                : await buildQuery(eq(resources.resourceGuid, resourceGuid));
+                ? await db
+                      .select()
+                      .from(resources)
+                      .leftJoin(
+                          resourcePincode,
+                          eq(resourcePincode.resourceId, resources.resourceId)
+                      )
+                      .leftJoin(
+                          resourcePassword,
+                          eq(resourcePassword.resourceId, resources.resourceId)
+                      )
+
+                      .leftJoin(
+                          resourceHeaderAuth,
+                          eq(
+                              resourceHeaderAuth.resourceId,
+                              resources.resourceId
+                          )
+                      )
+                      .leftJoin(
+                          resourceHeaderAuthExtendedCompatibility,
+                          eq(
+                              resourceHeaderAuthExtendedCompatibility.resourceId,
+                              resources.resourceId
+                          )
+                      )
+                      .where(eq(resources.resourceId, Number(resourceGuid)))
+                      .limit(1)
+                : await db
+                      .select()
+                      .from(resources)
+                      .leftJoin(
+                          resourcePincode,
+                          eq(resourcePincode.resourceId, resources.resourceId)
+                      )
+                      .leftJoin(
+                          resourcePassword,
+                          eq(resourcePassword.resourceId, resources.resourceId)
+                      )
+
+                      .leftJoin(
+                          resourceHeaderAuth,
+                          eq(
+                              resourceHeaderAuth.resourceId,
+                              resources.resourceId
+                          )
+                      )
+                      .leftJoin(
+                          resourceHeaderAuthExtendedCompatibility,
+                          eq(
+                              resourceHeaderAuthExtendedCompatibility.resourceId,
+                              resources.resourceId
+                          )
+                      )
+                      .where(eq(resources.resourceGuid, resourceGuid))
+                      .limit(1);
 
         const resource = result?.resources;
         if (!resource) {
@@ -115,10 +126,11 @@ export async function getResourceAuthInfo(
             );
         }
 
-        const policy = result?.resourcePolicies;
-        const pincode = result?.resourcePolicyPincode;
-        const password = result?.resourcePolicyPassword;
-        const headerAuth = result?.resourcePolicyHeaderAuth;
+        const pincode = result?.resourcePincode;
+        const password = result?.resourcePassword;
+        const headerAuth = result?.resourceHeaderAuth;
+        const headerAuthExtendedCompatibility =
+            result?.resourceHeaderAuthExtendedCompatibility;
 
         const url = resource.fullDomain
             ? `${resource.ssl ? "https" : "http"}://${resource.fullDomain}`
@@ -134,13 +146,13 @@ export async function getResourceAuthInfo(
                 pincode: pincode !== null,
                 headerAuth: headerAuth !== null,
                 headerAuthExtendedCompatibility:
-                    headerAuth?.extendedCompatibility ?? false,
-                sso: policy?.sso ?? false,
+                    headerAuthExtendedCompatibility !== null,
+                sso: resource.sso,
                 blockAccess: resource.blockAccess,
                 url: url ?? "",
                 wildcard: resource.wildcard ?? false,
                 fullDomain: resource.fullDomain,
-                whitelist: policy?.emailWhitelistEnabled ?? false,
+                whitelist: resource.emailWhitelistEnabled,
                 skipToIdpId: resource.skipToIdpId,
                 orgId: resource.orgId,
                 postAuthPath: resource.postAuthPath ?? null

server/routers/resource/getResourcePolicies.ts

@@ -1,109 +0,0 @@
-import { db, resources } from "@server/db";
-import {
-    queryResourcePolicy,
-    type GetResourcePolicyResponse
-} from "@server/routers/policy/getResourcePolicy";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { OpenAPITags, registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import { eq } from "drizzle-orm";
-import type { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import z from "zod";
-import { fromError } from "zod-validation-error";
-
-const getResourcePoliciesParamsSchema = z.strictObject({
-    resourceId: z.string().transform(Number).pipe(z.int().positive())
-});
-
-export type GetResourcePoliciesResponse = {
-    defaultPolicy: GetResourcePolicyResponse;
-    sharedPolicy: GetResourcePolicyResponse | null;
-};
-
-registry.registerPath({
-    method: "get",
-    path: "/resource/{resourceId}/policies",
-    description: "Get the inline and shared policies associated with a resource.",
-    tags: [OpenAPITags.PublicResource, OpenAPITags.Policy],
-    request: {
-        params: getResourcePoliciesParamsSchema
-    },
-    responses: {}
-});
-
-export async function getResourcePolicies(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = getResourcePoliciesParamsSchema.safeParse(
-            req.params
-        );
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { resourceId } = parsedParams.data;
-
-        const [resource] = await db
-            .select({
-                defaultResourcePolicyId: resources.defaultResourcePolicyId,
-                resourcePolicyId: resources.resourcePolicyId
-            })
-            .from(resources)
-            .where(eq(resources.resourceId, resourceId))
-            .limit(1);
-
-        if (!resource) {
-            return next(
-                createHttpError(HttpCode.NOT_FOUND, "Resource not found")
-            );
-        }
-
-        if (!resource.defaultResourcePolicyId) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    "Resource has no default policy"
-                )
-            );
-        }
-
-        const [defaultPolicy, sharedPolicy] = await Promise.all([
-            queryResourcePolicy({
-                resourcePolicyId: resource.defaultResourcePolicyId
-            }),
-            resource.resourcePolicyId
-                ? queryResourcePolicy({
-                      resourcePolicyId: resource.resourcePolicyId
-                  })
-                : null
-        ]);
-
-        return response<GetResourcePoliciesResponse>(res, {
-            data: {
-                defaultPolicy:
-                    // the policy will always be non nullable
-                    defaultPolicy as unknown as GetResourcePolicyResponse,
-                sharedPolicy
-            },
-            success: true,
-            error: false,
-            message: "Resource policies retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/resource/getUserResources.ts

@@ -127,7 +127,7 @@ export async function getUserResources(
             ssl: boolean;
             enabled: boolean;
             sso: boolean;
-            mode: string;
+            protocol: string;
             emailWhitelistEnabled: boolean;
         }> = [];
         if (accessibleResourceIds.length > 0) {
@@ -139,7 +139,7 @@ export async function getUserResources(
                     ssl: resources.ssl,
                     enabled: resources.enabled,
                     sso: resources.sso,
-                    mode: resources.mode,
+                    protocol: resources.protocol,
                     emailWhitelistEnabled: resources.emailWhitelistEnabled
                 })
                 .from(resources)
@@ -323,7 +323,7 @@ export async function getUserResources(
                         hasPincode ||
                         hasWhitelist
                     ),
-                    mode: resource.mode,
+                    protocol: resource.protocol,
                     sso: resource.sso,
                     password: hasPassword,
                     pincode: hasPincode,
@@ -339,6 +339,7 @@ export async function getUserResources(
                 name: siteResource.name,
                 destination: siteResource.destination,
                 mode: siteResource.mode,
+                protocol: siteResource.scheme,
                 ssl: siteResource.ssl,
                 fullDomain: siteResource.fullDomain,
                 enabled: siteResource.enabled,
@@ -386,13 +387,14 @@ export type GetUserResourcesResponse = {
             domain: string;
             enabled: boolean;
             protected: boolean;
-            mode: string;
+            protocol: string;
         }>;
         siteResources: Array<{
             siteResourceId: number;
             name: string;
             destination: string;
             mode: string;
+            protocol: string | null;
             tcpPortRangeString: string | null;
             udpPortRangeString: string | null;
             disableIcmp: boolean | null;