show ssh commands

feat: allow multiple server admins

.gitignore

@@ -46,6 +46,7 @@ public/branding
 server/db/index.ts
 server/build.ts
 postgres/
+dynamic/
 *.mmdb
 scratch/
 tsconfig.json

config/ha-reference/README.md

@@ -1,3 +0,0 @@
-## Example Docker Reference HA Deployment
-
-This directory contains basic config for a highly available deployment of Pangolin with two nodes. For more information [refer to the docs](/self-host/clustering/understanding-clustering).

config/ha-reference/database/docker-compose.yml

@@ -1,23 +0,0 @@
-services:
-  postgres:
-    image: postgres:17
-    container_name: postgres
-    environment:
-      POSTGRES_DB: postgres # Default database name
-      POSTGRES_USER: postgres # Default user
-      POSTGRES_PASSWORD: password # Default password (change for production!)
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-    ports:
-      - "5432:5432"
-    restart: always
-
-  redis:
-    image: redis:latest
-    container_name: redis
-    ports:
-      - "6379:6379"
-    restart: always
-
-volumes:
-  postgres_data:

config/ha-reference/node1/config/config.yml

@@ -1,38 +0,0 @@
-# To see all available options, please visit the docs:
-# https://docs.pangolin.net/
-
-gerbil:
-    start_port: 51820
-    base_endpoint: "<THIS_NODE_EXTERNAL_IP>"
-    exit_node_name: "node1"
-
-app:
-    dashboard_url: "https://pangolin.example.com"
-    log_level: "info"
-
-postgres:
-    connection_string: postgresql://<POSTGRES_USERNAME>:<POSTGRES_PASSWORD>@<POSTGRES_INTERNAL_HOST>:5432/postgres
-
-traefik:
-    site_types: ["newt"] # Wireguard and local sites are not support in clustering
-    file_mode: true # Pangolin will generate and save yaml files in a shared volume
-
-server:
-    secret: "<SECRET>"
-    cors:
-        origins: ["https://pangolin.example.com"]
-        methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]
-        allowed_headers: ["X-CSRF-Token", "Content-Type"]
-        credentials: false
-    maxmind_db_path: "./config/GeoLite2-Country.mmdb" # Make sure to download and place into the config dir
-    maxmind_asn_path: "./config/GeoLite2-ASN.mmdb"
-
-flags:
-    require_email_verification: false
-    disable_signup_without_invite: true
-    disable_user_create_org: false
-    allow_raw_resources: false
-    enable_acme_cert_sync: false
-    disable_local_sites: true
-    disable_basic_wireguard_sites: true
-    disable_config_managed_domains: true

config/ha-reference/node1/config/dynamic/dynamic_config.yml

@@ -1,67 +0,0 @@
-http:
-  middlewares:
-    badger:
-      plugin:
-        badger:
-          disableForwardAuth: true
-
-  routers:
-    # Next.js router (handles everything except API and WebSocket paths)
-    next-router:
-      rule: "!PathPrefix(`/api/v1`)"
-      service: next-service
-      entryPoints:
-        - dashboard
-      middlewares:
-        - badger
-
-    # API router (handles /api/v1 paths)
-    api-router:
-      rule: "PathPrefix(`/api/v1`)"
-      service: api-service
-      entryPoints:
-        - dashboard
-      middlewares:
-        - badger
-
-    # WebSocket router
-    ws-router:
-      rule: "PathPrefix(`/`)"
-      service: api-service
-      entryPoints:
-        - dashboard
-      middlewares:
-        - badger
-
-  services:
-    next-service:
-      loadBalancer:
-        servers:
-          - url: "http://pangolin:3002"  # Next.js server
-
-    api-service:
-      loadBalancer:
-        servers:
-          - url: "http://pangolin:3000"  # API/WebSocket server
-
-tcp:
-  serversTransports:
-    pp-transport-v1:
-      proxyProtocol:
-        version: 1
-    pp-transport-v2:
-      proxyProtocol:
-        version: 2
-
-udp:
-  routers:
-    dns-router:
-      entryPoints:
-        - dns
-      service: dns-service
-
-  services:
-    dns-service:
-      loadBalancer:
-        servers:
-          - address: "pangolin:53"

config/ha-reference/node1/config/privateConfig.yml

@@ -1,18 +0,0 @@
-app:
-  region: "region1"
-  identity_provider_mode: "org"
-redis:
-  host: "<REDIS_INTERNAL_HOST>"
-  port: 6379
-flags:
-  enable_redis: true
-  use_pangolin_dns: true
-acme:
-  cert_mode: "pangolin"
-  contact_email: "<CONTACT_EMAIL>"
-  enable_acme_client: true
-dns:
-  enabled: true
-  nameserver_name: "ns.example.com"
-  cname_extension: "cname.example.com"
-  site_extension: "site.example.com" # Optional

config/ha-reference/node1/config/traefik/traefik_config.yml

@@ -1,45 +0,0 @@
-providers:
-  file:
-    directory: "/var/dynamic"
-    watch: true
-
-experimental:
-  plugins:
-    badger:
-      moduleName: "github.com/fosrl/badger"
-      version: "v1.7.0"
-
-log:
-  level: "INFO"
-  format: "common"
-  maxSize: 100
-  maxBackups: 3
-  maxAge: 3
-  compress: true
-
-entryPoints:
-  web:
-    address: ":80"
-  websecure:
-    address: ":443"
-    proxyProtocol: # We trust gerbil upstream
-      trustedIPs:
-        - 0.0.0.0/0
-        - ::1/128
-    transport:
-      respondingTimeouts:
-        readTimeout: "30m"
-    http:
-      encodedCharacters:
-        allowEncodedSlash: true
-        allowEncodedQuestionMark: true
-  dashboard:
-    address: ":3000"
-  dns:
-    address: ":53/udp"
-
-serversTransport:
-  insecureSkipVerify: true
-
-ping:
-  entryPoint: "web"

config/ha-reference/node1/docker-compose.yml

@@ -1,62 +0,0 @@
-name: pangolin
-services:
-  pangolin:
-    image: docker.io/fosrl/pangolin:ee-latest
-    container_name: pangolin
-    restart: unless-stopped
-    volumes:
-      - ./config:/app/config
-      - ./config/certificates:/var/certificates
-      - ./config/dynamic:/var/dynamic
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
-      interval: "10s"
-      timeout: "10s"
-      retries: 15
-
-  gerbil:
-    image: docker.io/fosrl/gerbil:latest
-    container_name: gerbil
-    restart: unless-stopped
-    depends_on:
-      pangolin:
-        condition: service_healthy
-    command:
-      - --reachableAt=http://<NODE1_INTERNAL_IP>:3004
-      - --generateAndSaveKeyTo=/var/config/key
-      - --remoteConfig=http://pangolin:3001/api/v1/
-      - --trusted-upstreams=<NODE1_EXTERNAL_IP>,<NODE2_EXTERNAL_IP>
-    volumes:
-      - ./config/:/var/config
-    cap_add:
-      - NET_ADMIN
-      - SYS_MODULE
-    ports:
-      - 51820:51820/udp # wireguard
-      - 21820:21820/udp # relay
-      - 53:53/udp # DNS
-      - 443:8443 # resources
-      - 80:80 # web
-      - 3004:3004 # gerbil api
-      - 3000:3000 # Pangolin UI
-
-  traefik:
-    image: docker.io/traefik:v3.7.11
-    container_name: traefik
-    restart: unless-stopped
-    network_mode: service:gerbil # Ports appear on the gerbil service
-    depends_on:
-      pangolin:
-        condition: service_healthy
-    command:
-      - --configFile=/etc/traefik/traefik_config.yml
-    volumes:
-      - ./config/traefik:/etc/traefik:ro
-      - ./config/traefik/logs:/var/log/traefik
-      - ./config/certificates:/var/certificates:ro
-      - ./config/dynamic:/var/dynamic:ro
-
-networks:
-  default:
-    driver: bridge
-    name: pangolin

config/ha-reference/node2/config/config.yml

@@ -1,38 +0,0 @@
-# To see all available options, please visit the docs:
-# https://docs.pangolin.net/
-
-gerbil:
-    start_port: 51820
-    base_endpoint: "<THIS_NODE_EXTERNAL_IP>"
-    exit_node_name: "node2"
-
-app:
-    dashboard_url: "https://pangolin.example.com"
-    log_level: "info"
-
-postgres:
-    connection_string: postgresql://<POSTGRES_USERNAME>:<POSTGRES_PASSWORD>@<POSTGRES_INTERNAL_HOST>:5432/postgres
-
-traefik:
-    site_types: ["newt"] # Wireguard and local sites are not support in clustering
-    file_mode: true # Pangolin will generate and save yaml files in a shared volume
-
-server:
-    secret: "<SECRET>"
-    cors:
-        origins: ["https://pangolin.example.com"]
-        methods: ["GET", "POST", "PUT", "DELETE", "PATCH"]
-        allowed_headers: ["X-CSRF-Token", "Content-Type"]
-        credentials: false
-    maxmind_db_path: "./config/GeoLite2-Country.mmdb" # Make sure to download and place into the config dir
-    maxmind_asn_path: "./config/GeoLite2-ASN.mmdb"
-
-flags:
-    require_email_verification: false
-    disable_signup_without_invite: true
-    disable_user_create_org: false
-    allow_raw_resources: false
-    enable_acme_cert_sync: false
-    disable_local_sites: true 
-    disable_basic_wireguard_sites: true
-    disable_config_managed_domains: true

config/ha-reference/node2/config/dynamic/dynamic_config.yml

@@ -1,67 +0,0 @@
-http:
-  middlewares:
-    badger:
-      plugin:
-        badger:
-          disableForwardAuth: true
-
-  routers:
-    # Next.js router (handles everything except API and WebSocket paths)
-    next-router:
-      rule: "!PathPrefix(`/api/v1`)"
-      service: next-service
-      entryPoints:
-        - dashboard
-      middlewares:
-        - badger
-
-    # API router (handles /api/v1 paths)
-    api-router:
-      rule: "PathPrefix(`/api/v1`)"
-      service: api-service
-      entryPoints:
-        - dashboard
-      middlewares:
-        - badger
-
-    # WebSocket router
-    ws-router:
-      rule: "PathPrefix(`/`)"
-      service: api-service
-      entryPoints:
-        - dashboard
-      middlewares:
-        - badger
-
-  services:
-    next-service:
-      loadBalancer:
-        servers:
-          - url: "http://pangolin:3002"  # Next.js server
-
-    api-service:
-      loadBalancer:
-        servers:
-          - url: "http://pangolin:3000"  # API/WebSocket server
-
-tcp:
-  serversTransports:
-    pp-transport-v1:
-      proxyProtocol:
-        version: 1
-    pp-transport-v2:
-      proxyProtocol:
-        version: 2
-
-udp:
-  routers:
-    dns-router:
-      entryPoints:
-        - dns
-      service: dns-service
-
-  services:
-    dns-service:
-      loadBalancer:
-        servers:
-          - address: "pangolin:53"

config/ha-reference/node2/config/privateConfig.yml

@@ -1,16 +0,0 @@
-app:
-  region: "region1"
-  identity_provider_mode: "org"
-redis:
-  host: "<REDIS_INTERNAL_HOST>"
-  port: 6379
-flags:
-  enable_redis: true
-  use_pangolin_dns: true
-acme:
-  cert_mode: "pangolin"
-dns:
-  enabled: true
-  nameserver_name: "ns.example.com"
-  cname_extension: "cname.example.com"
-  site_extension: "site.example.com" # Optional

config/ha-reference/node2/config/traefik/traefik_config.yml

@@ -1,45 +0,0 @@
-providers:
-  file:
-    directory: "/var/dynamic"
-    watch: true
-
-experimental:
-  plugins:
-    badger:
-      moduleName: "github.com/fosrl/badger"
-      version: "v1.7.0"
-
-log:
-  level: "INFO"
-  format: "common"
-  maxSize: 100
-  maxBackups: 3
-  maxAge: 3
-  compress: true
-
-entryPoints:
-  web:
-    address: ":80"
-  websecure:
-    address: ":443"
-    proxyProtocol: # We trust gerbil upstream
-      trustedIPs:
-        - 0.0.0.0/0
-        - ::1/128
-    transport:
-      respondingTimeouts:
-        readTimeout: "30m"
-    http:
-      encodedCharacters:
-        allowEncodedSlash: true
-        allowEncodedQuestionMark: true
-  dashboard:
-    address: ":3000"
-  dns:
-    address: ":53/udp"
-
-serversTransport:
-  insecureSkipVerify: true
-
-ping:
-  entryPoint: "web"

config/ha-reference/node2/docker-compose.yml

@@ -1,62 +0,0 @@
-name: pangolin
-services:
-  pangolin:
-    image: docker.io/fosrl/pangolin:ee-latest
-    container_name: pangolin
-    restart: unless-stopped
-    volumes:
-      - ./config:/app/config
-      - ./config/certificates:/var/certificates
-      - ./config/dynamic:/var/dynamic
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3001/api/v1/"]
-      interval: "10s"
-      timeout: "10s"
-      retries: 15
-
-  gerbil:
-    image: docker.io/fosrl/gerbil:latest
-    container_name: gerbil
-    restart: unless-stopped
-    depends_on:
-      pangolin:
-        condition: service_healthy
-    command:
-      - --reachableAt=http://<NODE1_INTERNAL_IP>:3004
-      - --generateAndSaveKeyTo=/var/config/key
-      - --remoteConfig=http://pangolin:3001/api/v1/
-      - --trusted-upstreams=<NODE1_EXTERNAL_IP>,<NODE2_EXTERNAL_IP>
-    volumes:
-      - ./config/:/var/config
-    cap_add:
-      - NET_ADMIN
-      - SYS_MODULE
-    ports:
-      - 51820:51820/udp # wireguard
-      - 21820:21820/udp # relay
-      - 53:53/udp # DNS
-      - 443:8443 # resources
-      - 80:80 # web
-      - 3004:3004 # gerbil api
-      - 3000:3000 # Pangolin UI 
-
-  traefik:
-    image: docker.io/traefik:v3.7.11
-    container_name: traefik
-    restart: unless-stopped
-    network_mode: service:gerbil # Ports appear on the gerbil service
-    depends_on:
-      pangolin:
-        condition: service_healthy
-    command:
-      - --configFile=/etc/traefik/traefik_config.yml
-    volumes:
-      - ./config/traefik:/etc/traefik:ro
-      - ./config/traefik/logs:/var/log/traefik
-      - ./config/certificates:/var/certificates:ro
-      - ./config/dynamic:/var/dynamic:ro
-
-networks:
-  default:
-    driver: bridge
-    name: pangolin

dynamic/cert_config.yml

@@ -1,2 +0,0 @@
-tls:
-  certificates: []

dynamic/router_config.yml

@@ -1 +0,0 @@
-{}

messages/en-US.json

@@ -80,7 +80,7 @@
     "siteManageSites": "Manage Sites",
     "siteDescription": "Create and manage sites to enable connectivity to private networks",
     "sitesBannerTitle": "Connect Any Network",
-    "sitesBannerDescription": "A site is a connection to a remote network that allows Pangolin to provide access to resources, whether public or private, to users anywhere. Install the site network connector (Newt) anywhere you can run a binary or container to establish the connection.",
+    "sitesBannerDescription": "A site is a connection to a remote network that allows Pangolin to provide access to resources, whether public or private, to users anywhere. Install the site network connector anywhere you can run a binary or container to establish the connection.",
     "sitesBannerButtonText": "Install Site Connector",
     "approvalsBannerTitle": "Approve or Deny Device Access",
     "approvalsBannerDescription": "Review and approve or deny device access requests from users. When device approvals are required, users must get admin approval before their devices can connect to your organization's resources.",
@@ -226,9 +226,9 @@
     "never": "Never",
     "shareErrorSelectResource": "Please select a resource",
     "proxyResourceTitle": "Manage Public Resources",
-    "proxyResourceDescription": "Create and manage resources that are publicly accessible through a web browser",
+    "proxyResourceDescription": "Create and manage resources that are publicly accessible via a proxy",
     "publicResourcesBannerTitle": "Web-based Public Access",
-    "publicResourcesBannerDescription": "Public resources are proxies accessible to anyone on the internet through a web browser and include identity and context-aware access policies. Unlike private resources, they do not require client-side software.",
+    "publicResourcesBannerDescription": "Public resources are proxies accessible to anyone on the internet, like a website or API, and include identity and context-aware access policies. Unlike private resources, they do not require any client-side software to access.",
     "clientResourceTitle": "Manage Private Resources",
     "clientResourceDescription": "Create and manage resources that are only accessible through a connected client",
     "privateResourcesBannerTitle": "Zero-Trust Private Access",
@@ -465,6 +465,8 @@
     "apiKeysDelete": "Delete API Key",
     "apiKeysManage": "Manage API Keys",
     "apiKeysDescription": "API keys are used to authenticate with the integration API",
+    "orgsManage": "Manage Organizations",
+    "orgsDescription": "View and manage all organizations on this instance",
     "provisioningKeysTitle": "Provisioning Key",
     "provisioningKeysManage": "Manage Provisioning Keys",
     "provisioningKeysDescription": "Provisioning keys are used to authenticate automated site provisioning for your organization.",
@@ -520,12 +522,12 @@
     "pendingSitesBannerDescription": "Sites that connect using a provisioning key appear here for review.",
     "pendingSitesBannerButtonText": "Learn More",
     "apiKeysSettings": "{apiKeyName} Settings",
-    "userTitle": "Manage All Users",
+    "userTitle": "Manage Users",
-    "userDescription": "View and manage all users in the system",
+    "userDescription": "View and manage all users in this instance",
     "userAbount": "About User Management",
     "userAbountDescription": "This table displays all base user objects in the system. Each user may belong to multiple organizations. Removing a user from an organization does not delete their base user object. They will remain in the system. To completely remove a user from the system, you must delete their base user object using the delete action in this table.",
     "userServer": "Server Users",
-    "userSearch": "Search server users...",
+    "userSearch": "Search users...",
     "userErrorDelete": "Error deleting user",
     "userDeleteConfirm": "Confirm Delete User",
     "userDeleteServer": "Delete User from Server",
@@ -594,7 +596,7 @@
     "licensePricingPage": "For the most up-to-date pricing and discounts, please visit the ",
     "invite": "Invitations",
     "inviteRegenerate": "Regenerate Invitation",
-    "inviteRegenerateDescription": "Revoke previous invitation and create a new one",
+    "inviteRegenerateDescription": "Create a new invite link for this user. The previous invitation will be revoked.",
     "inviteRemove": "Remove Invitation",
     "inviteRemoveError": "Failed to remove invitation",
     "inviteRemoveErrorDescription": "An error occurred while removing the invitation.",
@@ -674,11 +676,11 @@
     "accessUserCreateDescription": "Follow the steps below to create a new user",
     "userSeeAll": "See All Users",
     "userTypeTitle": "User Type",
-    "userTypeDescription": "Determine how you want to create the user",
+    "userTypeDescription": "Select the identity provider to use for this user",
     "userSettings": "User Information",
-    "userSettingsDescription": "Enter the details for the new user",
+    "userSettingsDescription": "Enter the general details for the new user",
     "inviteEmailSent": "Send invite email to user",
-    "inviteValid": "Invite Valid For (days)",
+    "inviteValid": "Invite Valid For",
     "selectDuration": "Select duration",
     "selectResource": "Select Resource",
     "filterByResource": "Filter By Resource",
@@ -716,6 +718,7 @@
     "nameOptional": "Name (Optional)",
     "accessControls": "Access Controls",
     "userDescription2": "Manage the settings on this user",
+    "userGeneralSettingsDescription": "Manage this user's roles and settings in the organization",
     "accessRoleErrorAdd": "Failed to add user to role",
     "accessRoleErrorAddDescription": "An error occurred while adding user to the role.",
     "userSaved": "User saved",
@@ -1214,7 +1217,7 @@
     "orgPoliciesEdit": "Edit Organization Policy",
     "org": "Organization",
     "orgSelect": "Select organization",
-    "orgSearch": "Search org",
+    "orgSearch": "Search organizations...",
     "orgNotFound": "No org found.",
     "roleMappingPathOptional": "Role Mapping Path (Optional)",
     "orgMappingPathOptional": "Organization Mapping Path (Optional)",
@@ -1353,7 +1356,7 @@
     "siteLabelsDescription": "Manage labels associated with this site.",
     "labelsNotFound": "No labels found.",
     "labelsEmptyCreateHint": "Start typing above to create a label.",
-    "labelSearch": "Search labels",
+    "labelSearch": "Search labels...",
     "labelSearchOrCreate": "Search or create a label",
     "accessLabelFilterCount": "{count, plural, one {# label} other {# labels}}",
     "labelOverflowCount": "+{count, plural, one {# label} other {# labels}}",
@@ -1424,6 +1427,24 @@
     "logoutError": "Error logging out",
     "signingAs": "Signed in as",
     "serverAdmin": "Server Admin",
+    "promoteServerAdmin": "Promote to Server admin",
+    "promoteServerAdminTitle": "Promote to Server Admin",
+    "promoteServerAdminQuestion": "Are you sure you want to promote {selectedUser} to server admin?",
+    "promoteServerAdminMessage": "Server admins have the highest privileges and can manage the server.",
+    "promoteServerAdminWarning": "This can be undone at any time by demoting the user.",
+    "promoteServerAdminConfirm": "Promote to Server Admin",
+    "promoteServerAdminSuccess": "User Promoted",
+    "promoteServerAdminSuccessDescription": "{selectedUser} is now a server admin.",
+    "promoteServerAdminError": "Failed to promote user",
+    "demoteServerAdmin": "Demote from Server admin",
+    "demoteServerAdminTitle": "Demote from Server Admin",
+    "demoteServerAdminQuestion": "Are you sure you want to demote {selectedUser} from server admin?",
+    "demoteServerAdminMessage": "{selectedUser} will lose all server admin privileges.",
+    "demoteServerAdminWarning": "This can be undone at any time by promoting the user.",
+    "demoteServerAdminConfirm": "Demote from server admin",
+    "demoteServerAdminSuccess": "User demoted",
+    "demoteServerAdminSuccessDescription": "{selectedUser} is no longer a server admin.",
+    "demoteServerAdminError": "Failed to demote user",
     "managedSelfhosted": "Managed Self-Hosted",
     "otpEnable": "Enable Two-factor",
     "otpDisable": "Disable Two-factor",
@@ -2095,9 +2116,10 @@
     "resourceBudgetSettings": "Budget",
     "resourceBudgetSettingsDescription": "Configure how this AI gateway restricts usage based on spending or token limits",
     "sidebarApiKeys": "API Keys",
+    "sidebarOrgs": "Organizations",
     "sidebarProvisioning": "Provisioning",
     "sidebarSettings": "Settings",
-    "sidebarAllUsers": "All Users",
+    "sidebarAllUsers": "Users",
     "sidebarIdentityProviders": "Identity Providers",
     "sidebarLicense": "License",
     "sidebarClients": "Clients",
@@ -3477,8 +3499,7 @@
     },
     "priority": "Priority",
     "priorityDescription": "Higher priority routes are evaluated first. Priority = 100 means automatic ordering (system decides). Use another number to enforce manual priority.",
-    "instanceName": "Server ID",
+    "instanceName": "Instance Name",
-    "clearInstanceName": "Reset Server Association",
     "pathMatchModalTitle": "Configure Path Matching",
     "pathMatchModalDescription": "Set up how incoming requests should be matched based on their path.",
     "pathMatchType": "Match Type",
@@ -3975,11 +3996,12 @@
     "disconnected": "Disconnected",
     "approvalsEmptyStateTitle": "Device Approvals Not Enabled",
     "approvalsEmptyStateDescription": "Enable device approvals for roles to require admin approval before users can connect new devices.",
+    "approvalsEmptyStateHowToTitle": "How to Enable",
     "approvalsEmptyStateStep1Title": "Go to Roles",
     "approvalsEmptyStateStep1Description": "Navigate to your organization's roles settings to configure device approvals.",
     "approvalsEmptyStateStep2Title": "Enable Device Approvals",
     "approvalsEmptyStateStep2Description": "Edit a role and enable the 'Require Device Approvals' option. Users with this role will need admin approval for new devices.",
-    "approvalsEmptyStatePreviewDescription": "Preview: When enabled, pending device requests will appear here for review",
+    "approvalsEmptyStatePreviewDescription": "When enabled, pending device requests will appear here for review.",
     "approvalsEmptyStateButtonText": "Manage Roles",
     "domainErrorTitle": "We are having trouble verifying your domain",
     "idpAdminAutoProvisionPoliciesTabHint": "Configure role mapping and organization policies on the <policiesTabLink>Auto Provision Settings</policiesTabLink> tab.",
@@ -4254,6 +4276,11 @@
     "resourceLauncherViewAsAdmin": "View as Admin",
     "resourceLauncherResourceDetailsDescription": "Connection information and status for this resource.",
     "resourceLauncherResourceDetails": "Resource Details",
+    "resourceLauncherSitesDescription": "The resource is accessible via the following sites.",
+    "resourceLauncherViewSiteAsAdmin": "View Site as Admin",
+    "resourceLauncherFilterBySite": "Filter by Site",
+    "resourceLauncherSshCommand": "SSH Command",
+    "resourceLauncherSshCommandDescription": "Use the Pangolin CLI to open an SSH session to this resource.",
     "resourceLauncherAuthMethodsDescription": "Authentication methods enabled for this resource.",
     "resourceLauncherPrivateClientRequired": "Connect with a client on your device to access this resource privately.",
     "resourceLauncherPrivateClientRequiredTitle": "Client Connection Required",

next.config.ts

@@ -34,6 +34,11 @@ const nextConfig: NextConfig = {
                 source: "/:orgId/settings/resources/client/:path*",
                 destination: "/:orgId/settings/resources/private/:path*",
                 permanent: true
+            },
+            {
+                source: "/:orgId/settings/access/users/:userId/access-controls",
+                destination: "/:orgId/settings/access/users/:userId/general",
+                permanent: false
             }
         ];
     }

package-lock.json

@@ -50,7 +50,6 @@
                 "@xterm/addon-fit": "^0.11.0",
                 "@xterm/addon-web-links": "^0.12.0",
                 "@xterm/xterm": "^6.0.0",
-                "acme-client": "^5.4.0",
                 "arctic": "3.7.0",
                 "axios": "1.20.0",
                 "better-sqlite3": "11.9.1",
@@ -62,7 +61,6 @@
                 "cors": "2.8.6",
                 "crypto-js": "4.2.0",
                 "d3": "7.9.0",
-                "dns-packet": "^5.6.1",
                 "drizzle-orm": "0.45.2",
                 "express": "5.2.1",
                 "express-rate-limit": "8.7.0",
@@ -126,7 +124,6 @@
                 "@types/cors": "2.8.19",
                 "@types/crypto-js": "4.2.2",
                 "@types/d3": "7.4.3",
-                "@types/dns-packet": "^5.6.5",
                 "@types/express": "5.0.6",
                 "@types/express-session": "1.19.0",
                 "@types/jmespath": "0.15.2",
@@ -2448,12 +2445,6 @@
                 "@jridgewell/sourcemap-codec": "^1.4.14"
             }
         },
-        "node_modules/@leichtgewicht/ip-codec": {
-            "version": "2.0.5",
-            "resolved": "https://registry.npmjs.org/@leichtgewicht/ip-codec/-/ip-codec-2.0.5.tgz",
-            "integrity": "sha512-Vo+PSpZG2/fmgmiNzYK9qWRh8h/CHrwD0mo1h1DzL4yzHNSfWYujGTYsWGreD000gcgmZ7K4Ys6Tx9TxtsKdDw==",
-            "license": "MIT"
-        },
         "node_modules/@levischuck/tiny-cbor": {
             "version": "0.2.11",
             "resolved": "https://registry.npmjs.org/@levischuck/tiny-cbor/-/tiny-cbor-0.2.11.tgz",
@@ -6773,16 +6764,6 @@
                 "@types/d3-selection": "*"
             }
         },
-        "node_modules/@types/dns-packet": {
-            "version": "5.6.5",
-            "resolved": "https://registry.npmjs.org/@types/dns-packet/-/dns-packet-5.6.5.tgz",
-            "integrity": "sha512-qXOC7XLOEe43ehtWJCMnQXvgcIpv6rPmQ1jXT98Ad8A3TB1Ue50jsCbSSSyuazScEuZ/Q026vHbrOTVkmwA+7Q==",
-            "dev": true,
-            "license": "MIT",
-            "dependencies": {
-                "@types/node": "*"
-            }
-        },
         "node_modules/@types/esrecurse": {
             "version": "4.3.1",
             "resolved": "https://registry.npmjs.org/@types/esrecurse/-/esrecurse-4.3.1.tgz",
@@ -7454,22 +7435,6 @@
                 "node": ">= 0.6"
             }
         },
-        "node_modules/acme-client": {
-            "version": "5.4.0",
-            "resolved": "https://registry.npmjs.org/acme-client/-/acme-client-5.4.0.tgz",
-            "integrity": "sha512-mORqg60S8iML6XSmVjqjGHJkINrCGLMj2QvDmFzI9vIlv1RGlyjmw3nrzaINJjkNsYXC41XhhD5pfy7CtuGcbA==",
-            "license": "MIT",
-            "dependencies": {
-                "@peculiar/x509": "^1.11.0",
-                "asn1js": "^3.0.5",
-                "axios": "^1.7.2",
-                "debug": "^4.3.5",
-                "node-forge": "^1.3.1"
-            },
-            "engines": {
-                "node": ">= 16"
-            }
-        },
         "node_modules/acorn": {
             "version": "8.16.0",
             "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
@@ -9296,18 +9261,6 @@
                 "node": ">=8"
             }
         },
-        "node_modules/dns-packet": {
-            "version": "5.6.1",
-            "resolved": "https://registry.npmjs.org/dns-packet/-/dns-packet-5.6.1.tgz",
-            "integrity": "sha512-l4gcSouhcgIKRvyy99RNVOgxXiicE+2jZoNmaNmZ6JXiGajBOJAesk1OBlJuM5k2c+eudGdLxDqXuPCKIj6kpw==",
-            "license": "MIT",
-            "dependencies": {
-                "@leichtgewicht/ip-codec": "^2.0.1"
-            },
-            "engines": {
-                "node": ">=6"
-            }
-        },
         "node_modules/doctrine": {
             "version": "2.1.0",
             "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-2.1.0.tgz",
@@ -13187,15 +13140,6 @@
                 "semver": "bin/semver.js"
             }
         },
-        "node_modules/node-forge": {
-            "version": "1.4.0",
-            "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
-            "integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
-            "license": "(BSD-3-Clause OR GPL-2.0)",
-            "engines": {
-                "node": ">= 6.13.0"
-            }
-        },
         "node_modules/node-releases": {
             "version": "2.0.54",
             "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",

package.json

@@ -73,7 +73,6 @@
         "@xterm/addon-fit": "^0.11.0",
         "@xterm/addon-web-links": "^0.12.0",
         "@xterm/xterm": "^6.0.0",
-        "acme-client": "^5.4.0",
         "arctic": "3.7.0",
         "axios": "1.20.0",
         "better-sqlite3": "11.9.1",
@@ -85,7 +84,6 @@
         "cors": "2.8.6",
         "crypto-js": "4.2.0",
         "d3": "7.9.0",
-        "dns-packet": "^5.6.1",
         "drizzle-orm": "0.45.2",
         "express": "5.2.1",
         "express-rate-limit": "8.7.0",
@@ -98,6 +96,7 @@
         "jmespath": "0.16.0",
         "js-yaml": "5.4.1",
         "jsonwebtoken": "9.0.3",
+        "lru-cache": "11.5.2",
         "lucide-react": "1.38.0",
         "maxmind": "5.0.7",
         "moment": "2.30.1",
@@ -105,7 +104,6 @@
         "next-intl": "4.14.1",
         "next-themes": "0.4.6",
         "nextjs-toploader": "3.9.17",
-        "node-cache": "5.1.2",
         "nodemailer": "9.1.0",
         "oslo": "1.2.1",
         "pg": "8.23.0",
@@ -149,7 +147,6 @@
         "@types/cors": "2.8.19",
         "@types/crypto-js": "4.2.2",
         "@types/d3": "7.4.3",
-        "@types/dns-packet": "^5.6.5",
         "@types/express": "5.0.6",
         "@types/express-session": "1.19.0",
         "@types/jmespath": "0.15.2",

server/certificates.ts

@@ -1,8 +0,0 @@
-export async function startCertificateManager() {
-    // No-op: ACME certificate generation/management is only available in
-    // builds that include the private/enterprise feature set.
-}
-
-export async function stopCertificateManager() {
-    // No-op counterpart to startCertificateManager.
-}

server/dns.ts

@@ -1,8 +0,0 @@
-export async function startDnsServer() {
-    // No-op: the authoritative DNS server is only available in builds
-    // that include the private/enterprise feature set.
-}
-
-export async function stopDnsServer() {
-    // No-op counterpart to startDnsServer.
-}

server/index.ts

@@ -25,8 +25,6 @@ import { setHostMeta } from "@server/lib/hostMeta";
 import { TraefikConfigManager } from "@server/lib/traefik/TraefikConfigManager";
 import { initCleanup } from "#dynamic/cleanup";
 import { startSchedulers } from "#dynamic/startSchedulers";
-import { startDnsServer } from "#dynamic/dns";
-import { startCertificateManager } from "#dynamic/certificates";
 import license from "#dynamic/license/license";
 import { fetchServerIp } from "@server/lib/serverIpService";
 import { initAiModelCatalog } from "@server/lib/aiModelCatalog";
@@ -47,10 +45,6 @@ async function startServers() {
 
     startSchedulers();
 
-    await startDnsServer();
-
-    await startCertificateManager();
-
     // Start all servers
     const apiServer = createApiServer();
     const internalServer = createInternalServer();

server/lib/cache.ts

@@ -1,13 +1,7 @@
-import NodeCache from "node-cache";
 import logger from "@server/logger";
+import { createLocalCache } from "@server/lib/createLocalCache";
 
-// Create local cache with maxKeys limit to prevent memory leaks
+export const localCache = createLocalCache();
-// With ~10k requests/day and 5min TTL, 10k keys should be more than sufficient
-export const localCache = new NodeCache({
-    stdTTL: 3600,
-    checkperiod: 120,
-    maxKeys: 10000
-});
 
 // Log cache statistics periodically for monitoring
 // setInterval(() => {

server/lib/createLocalCache.ts

@@ -0,0 +1,79 @@
+import { LRUCache } from "lru-cache";
+
+const DEFAULT_MAX_KEYS = 10000;
+const DEFAULT_TTL_MS = 3600 * 1000;
+
+export type LocalCache = {
+    get<T>(key: string): T | undefined;
+    set(key: string, value: unknown, ttlSeconds?: number): boolean;
+    del(key: string | string[]): number;
+    has(key: string): boolean;
+    keys(): string[];
+    flushAll(): void;
+    getStats(): { keys: number };
+    getTtl(key: string): number | undefined;
+};
+
+export function createLocalCache(max = DEFAULT_MAX_KEYS): LocalCache {
+    const lru = new LRUCache<string, {}>({
+        max,
+        ttl: DEFAULT_TTL_MS,
+        updateAgeOnGet: false
+    });
+
+    return {
+        get<T>(key: string): T | undefined {
+            return lru.get(key) as T | undefined;
+        },
+
+        set(key: string, value: unknown, ttlSeconds?: number): boolean {
+            const stored = value as {};
+            if (ttlSeconds === undefined) {
+                lru.set(key, stored);
+            } else if (ttlSeconds === 0) {
+                lru.set(key, stored, { ttl: 0 });
+            } else {
+                lru.set(key, stored, { ttl: ttlSeconds * 1000 });
+            }
+            return true;
+        },
+
+        del(key: string | string[]): number {
+            const keys = Array.isArray(key) ? key : [key];
+            let deleted = 0;
+            for (const k of keys) {
+                if (lru.delete(k)) {
+                    deleted++;
+                }
+            }
+            return deleted;
+        },
+
+        has(key: string): boolean {
+            return lru.has(key);
+        },
+
+        keys(): string[] {
+            return [...lru.keys()];
+        },
+
+        flushAll(): void {
+            lru.clear();
+        },
+
+        getStats(): { keys: number } {
+            return { keys: lru.size };
+        },
+
+        getTtl(key: string): number | undefined {
+            if (!lru.has(key)) {
+                return undefined;
+            }
+            const remaining = lru.getRemainingTTL(key);
+            if (!Number.isFinite(remaining)) {
+                return 0;
+            }
+            return Date.now() + remaining;
+        }
+    };
+}

server/lib/dns/generateDomains.ts

@@ -1,3 +0,0 @@
-export function createCname(domainId: string, baseDomain: string) {}
-
-export function createNs() {}

server/lib/exitNodes/exitNodeCheckIn.ts

@@ -1,14 +0,0 @@
-// Tracks, per process lifetime, whether a given exit node has ever checked in
-// (called /gerbil/get-config) since this Pangolin instance started. This lets
-// callers distinguish "gerbil hasn't come up yet" (expected briefly after a
-// restart, since gerbil depends on pangolin's container starting first) from
-// "gerbil was reachable and now isn't" (a real problem worth an error log).
-const checkedInExitNodeIds = new Set<number>();
-
-export function markExitNodeCheckedIn(exitNodeId: number): void {
-    checkedInExitNodeIds.add(exitNodeId);
-}
-
-export function hasExitNodeCheckedIn(exitNodeId: number): boolean {
-    return checkedInExitNodeIds.has(exitNodeId);
-}

server/lib/exitNodes/exitNodeComms.ts

@@ -1,7 +1,6 @@
 import axios from "axios";
 import logger from "@server/logger";
 import { ExitNode } from "@server/db";
-import { hasExitNodeCheckedIn } from "./exitNodeCheckIn";
 
 interface ExitNodeRequest {
     remoteType?: string;
@@ -73,19 +72,13 @@ export async function sendToExitNode(
 
         return response.data;
     } catch (error) {
-        const message = axios.isAxiosError(error)
+        if (axios.isAxiosError(error)) {
-            ? `Error making ${method} request (can Pangolin see Gerbil HTTP API?) for exit node at ${exitNode.reachableAt} (status: ${error.response?.status}): ${error.message}`
+            logger.error(
-            : `Error making ${method} request for exit node at ${exitNode.reachableAt}: ${error}`;
+                `Error making ${method} request (can Pangolin see Gerbil HTTP API?) for exit node at ${exitNode.reachableAt} (status: ${error.response?.status}): ${error.message}`
-
+            );
-        // The exit node (gerbil) may still be starting up and not yet
-        // reachable. Until it has checked in at least once, log this at a
-        // lower level since it's expected; once it has checked in, a
-        // connection failure is a real problem.
-        if (hasExitNodeCheckedIn(exitNode.exitNodeId)) {
-            logger.error(message);
         } else {
-            logger.warn(
+            logger.error(
-                `${message} (exit node has not checked in yet since startup, this is expected briefly)`
+                `Error making ${method} request for exit node at ${exitNode.reachableAt}: ${error}`
             );
         }
         throw error;

server/lib/exitNodes/index.ts

@@ -1,6 +1,5 @@
 export * from "./exitNodes";
 export * from "./exitNodeComms";
-export * from "./exitNodeCheckIn";
 export * from "./subnet";
 export * from "./getCurrentExitNodeId";
 export * from "./calculateExitNodeWeight";

server/lib/readConfigFile.ts

@@ -493,6 +493,23 @@ export const configSchema = z
                     .prefault({})
             })
             .optional()
+            .prefault({}),
+        dns: z
+            .object({
+                nameservers: z
+                    .array(z.string().optional().optional())
+                    .optional()
+                    .default([
+                        "ns1.pangolin.net",
+                        "ns2.pangolin.net",
+                        "ns3.pangolin.net"
+                    ]),
+                cname_extension: z
+                    .string()
+                    .optional()
+                    .default("cname.pangolin.net")
+            })
+            .optional()
             .prefault({})
     })
     .refine(

server/lib/retry.ts

@@ -1,72 +0,0 @@
-import logger from "@server/logger";
-
-export async function withRetry<T>(
-    fn: () => Promise<T>,
-    options: {
-        retries?: number;
-        baseDelayMs?: number;
-        label?: string;
-        // Called with each caught error to decide whether it's worth
-        // retrying. Defaults to retrying everything (existing behavior) -
-        // pass this to exclude errors that are known to be permanent (e.g.
-        // an upstream rate limit or validation rejection) rather than
-        // transient, so they fail fast instead of wasting retry attempts.
-        shouldRetry?: (error: unknown) => boolean;
-    } = {}
-): Promise<T> {
-    const {
-        retries = 3,
-        baseDelayMs = 250,
-        label = "operation",
-        shouldRetry = () => true
-    } = options;
-
-    let attempt = 0;
-    while (true) {
-        try {
-            return await fn();
-        } catch (error) {
-            attempt++;
-            if (attempt > retries || !shouldRetry(error)) {
-                throw error;
-            }
-
-            // Exponential backoff with jitter so retries don't all land at once.
-            const delay =
-                baseDelayMs * 2 ** (attempt - 1) * (0.5 + Math.random());
-
-            logger.warn(
-                `${label} failed (attempt ${attempt}/${retries + 1}), retrying in ${delay.toFixed(0)}ms`,
-                error
-            );
-
-            await new Promise((resolve) => setTimeout(resolve, delay));
-        }
-    }
-}
-
-// Bounds an operation that has no timeout of its own (e.g. acme-client's
-// axios instance never sets one, so a stalled TCP connection to the ACME
-// server hangs forever instead of erroring). Without this, a single hung
-// call can leave its caller's promise permanently unsettled - fatal for
-// code that gates future work on that promise resolving, like the
-// scheduler's runExclusive() waiting on a batch's Promise.all.
-export async function withTimeout<T>(
-    promise: Promise<T>,
-    ms: number,
-    label = "operation"
-): Promise<T> {
-    let timer: NodeJS.Timeout;
-    const timeout = new Promise<never>((_, reject) => {
-        timer = setTimeout(
-            () => reject(new Error(`${label} timed out after ${ms}ms`)),
-            ms
-        );
-    });
-
-    try {
-        return await Promise.race([promise, timeout]);
-    } finally {
-        clearTimeout(timer!);
-    }
-}

server/lib/traefik/TraefikConfigManager.ts

@@ -6,10 +6,7 @@ import * as yaml from "js-yaml";
 import axios from "axios";
 import { db, exitNodes } from "@server/db";
 import { eq } from "drizzle-orm";
-import {
+import { getCurrentExitNodeId } from "@server/lib/exitNodes";
-    getCurrentExitNodeId,
-    hasExitNodeCheckedIn
-} from "@server/lib/exitNodes";
 import { getTraefikConfig } from "#dynamic/lib/traefik";
 import { getValidCertificatesForDomains } from "@server/lib/certificates";
 import { sendToExitNode } from "#dynamic/lib/exitNodes";
@@ -344,6 +341,10 @@ export class TraefikConfigManager {
 
             const { domains, traefikConfig } = getTraefikConfig;
 
+            // Add static domains from config
+            // const staticDomains = [config.getRawConfig().app.dashboard_url];
+            // staticDomains.forEach((domain) => domains.add(domain));
+
             // Log if domains changed
             if (
                 this.lastActiveDomains.size !== domains.size ||
@@ -357,7 +358,7 @@ export class TraefikConfigManager {
                 this.lastActiveDomains = new Set(domains);
             }
 
-            if (process.env.CERT_MODE === "pangolin" && build != "oss") {
+            if (process.env.USE_PANGOLIN_DNS === "true" && build != "oss") {
                 // Scan current local certificate state
                 this.lastLocalCertificateState =
                     await this.scanLocalCertificateState();
@@ -438,13 +439,13 @@ export class TraefikConfigManager {
                     // Always ensure all existing certificates (including wildcards) are in the config
                     await this.updateDynamicConfigFromLocalCerts(domains);
                 } else {
-                    // const timeSinceLastFetch = this.lastCertificateFetch
+                    const timeSinceLastFetch = this.lastCertificateFetch
-                    //     ? Math.round(
+                        ? Math.round(
-                    //           (Date.now() -
+                              (Date.now() -
-                    //               this.lastCertificateFetch.getTime()) /
+                                  this.lastCertificateFetch.getTime()) /
-                    //               (1000 * 60)
+                                  (1000 * 60)
-                    //       )
+                          )
-                    //     : 0;
+                        : 0;
 
                     // logger.debug(
                     //     `Skipping certificate fetch - no changes detected and within 24-hour window (last fetch: ${timeSinceLastFetch} minutes ago)`
@@ -465,52 +466,33 @@ export class TraefikConfigManager {
             await this.writeTraefikDynamicConfig(traefikConfig);
 
             // Send domains to SNI proxy
-            let exitNodeForSni: typeof exitNodes.$inferSelect | undefined;
             try {
+                let exitNode;
                 if (config.getRawConfig().gerbil.exit_node_name) {
                     const exitNodeName =
                         config.getRawConfig().gerbil.exit_node_name!;
-                    [exitNodeForSni] = await db
+                    [exitNode] = await db
                         .select()
                         .from(exitNodes)
                         .where(eq(exitNodes.name, exitNodeName))
                         .limit(1);
                 } else {
-                    [exitNodeForSni] = await db
+                    [exitNode] = await db.select().from(exitNodes).limit(1);
-                        .select()
-                        .from(exitNodes)
-                        .limit(1);
                 }
-                if (exitNodeForSni) {
+                if (exitNode) {
-                    await sendToExitNode(exitNodeForSni, {
+                    await sendToExitNode(exitNode, {
                         localPath: "/update-local-snis",
                         method: "POST",
-                        data: {
+                        data: { fullDomains: Array.from(domains) }
-                            fullDomains: [
-                                ...Array.from(domains),
-                                ...config.getRawConfig().traefik.static_domains
-                            ]
-                        }
                     });
                 } else {
-                    logger.warn(
+                    logger.error(
                         "No exit node found. Has gerbil registered yet?"
                     );
                 }
             } catch (err) {
-                // sendToExitNode already logs the underlying connection
-                // error at the appropriate level (warn before the exit node
-                // has checked in since startup, error after), so avoid
-                // double-logging it as an error here.
-                if (
-                    exitNodeForSni &&
-                    !hasExitNodeCheckedIn(exitNodeForSni.exitNodeId)
-                ) {
-                    logger.warn("Failed to post domains to SNI proxy:", err);
-                } else {
                 logger.error("Failed to post domains to SNI proxy:", err);
             }
-            }
 
             // Update active domains tracking
             this.activeDomains = domains;

server/lib/traefik/rule.ts

@@ -1,5 +1,7 @@
-// Build the Host()/HostRegexp() Traefik rule for a resource's domain.
+/**
-// Wildcard resources match any single subdomain via HostRegexp.
+ * Build the Host()/HostRegexp() Traefik rule for a resource's domain.
+ * Wildcard resources match any single subdomain via HostRegexp.
+ */
 export function buildHostRule(
     fullDomain: string,
     wildcard?: boolean | null
@@ -12,8 +14,10 @@ export function buildHostRule(
     return `Host(\`${fullDomain}\`)`;
 }
 
-// Append a path-matching clause to a Traefik rule based on the resource's
+/**
-// configured path and pathMatchType.
+ * Append a path-matching clause to a Traefik rule based on the resource's
+ * configured path and pathMatchType.
+ */
 export function appendPathMatch(
     rule: string,
     path: string | null | undefined,
@@ -36,8 +40,10 @@ export function appendPathMatch(
     return rule;
 }
 
-// Compute the router priority for a resource, favoring an explicit override
+/**
-// and otherwise deriving it from the path match specificity.
+ * Compute the router priority for a resource, favoring an explicit override
+ * and otherwise deriving it from the path match specificity.
+ */
 export function computeRoutePriority(
     priority: number | null | undefined,
     path: string | null | undefined,

server/private/certificates.ts

@@ -1,17 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-export {
-    startCertificateManager,
-    stopCertificateManager
-} from "./lib/certificates";

server/private/cleanup.ts

@@ -20,8 +20,6 @@ import { flushSiteBandwidthToDb } from "@server/routers/gerbil/receiveBandwidth"
 import { stopPingAccumulator } from "@server/routers/newt/pingAccumulator";
 import { shutdownUsageRecorder } from "@server/lib/aiBudgetEnforcement";
 import { shutdownAiSessionLogger } from "@server/routers/aiGateway/logAiSession";
-import { stopDnsServer } from "./dns";
-import { stopCertificateManager } from "./certificates";
 
 async function cleanup() {
     await stopPingAccumulator();
@@ -33,8 +31,6 @@ async function cleanup() {
     await rateLimitService.cleanup();
     await wsCleanup();
     await logStreamingManager.shutdown();
-    await stopDnsServer();
-    await stopCertificateManager();
 
     process.exit(0);
 }

server/private/dns.ts

@@ -1,44 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { AuthoritativeDNSServer } from "#private/lib/dns";
-import { privateConfig } from "#private/lib/config";
-
-let dnsServer: AuthoritativeDNSServer | undefined;
-
-export async function startDnsServer() {
-    const dnsConfig = privateConfig.getRawPrivateConfig().dns;
-    if (!dnsConfig || !dnsConfig.enabled) {
-        return;
-    }
-
-    const cacheOptions = {
-        stdTTL: 300, // 5 minutes default TTL
-        checkperiod: 60, // Check for expired keys every 60 seconds
-        useClones: false // Better performance
-    };
-
-    // Create DNS server
-    dnsServer = new AuthoritativeDNSServer(dnsConfig.listen_port, cacheOptions);
-
-    await dnsServer.start();
-}
-
-export async function stopDnsServer() {
-    if (!dnsServer) {
-        return;
-    }
-
-    await dnsServer.stop();
-    dnsServer = undefined;
-}

server/private/lib/cache.ts

@@ -11,17 +11,11 @@
  * This file is not licensed under the AGPLv3.
  */
 
-import NodeCache from "node-cache";
 import logger from "@server/logger";
-import { redisManager, regionalRedisManager } from "#private/lib/redis";
+import { createLocalCache } from "@server/lib/createLocalCache";
+import { redisManager, regionalRedisManager } from "@server/private/lib/redis";
 
-// Create local cache with maxKeys limit to prevent memory leaks
+export const localCache = createLocalCache();
-// With ~10k requests/day and 5min TTL, 10k keys should be more than sufficient
-export const localCache = new NodeCache({
-    stdTTL: 3600,
-    checkperiod: 120,
-    maxKeys: 10000
-});
 
 // Log cache statistics periodically for monitoring
 // setInterval(() => {
@@ -97,11 +91,11 @@ class AdaptiveCache {
                 const value = await redisManager.get(key);
 
                 if (value !== null) {
-                    // logger.debug(`Cache hit in Redis: ${key}`);
+                    logger.debug(`Cache hit in Redis: ${key}`);
                     return JSON.parse(value) as T;
                 }
 
-                // logger.debug(`Cache miss in Redis: ${key}`);
+                logger.debug(`Cache miss in Redis: ${key}`);
                 return undefined;
             } catch (error) {
                 logger.error(`Redis get error for key ${key}:`, error);
@@ -134,7 +128,7 @@ class AdaptiveCache {
                     const success = await redisManager.del(k);
                     if (success) {
                         deletedCount++;
-                        // logger.debug(`Deleted key from Redis: ${k}`);
+                        logger.debug(`Deleted key from Redis: ${k}`);
                     }
                 }
 
@@ -161,7 +155,7 @@ class AdaptiveCache {
             const success = localCache.del(k);
             if (success > 0) {
                 deletedCount++;
-                // logger.debug(`Deleted key from local cache: ${k}`);
+                logger.debug(`Deleted key from local cache: ${k}`);
             }
         }
 
@@ -229,7 +223,7 @@ class AdaptiveCache {
         }
 
         localCache.flushAll();
-        // logger.debug("Flushed local cache");
+        logger.debug("Flushed local cache");
     }
 
     /**
@@ -301,15 +295,11 @@ export default cache;
 
 /**
  * Regional adaptive cache backed by the in-cluster Redis instance.
- * Falls back to a local NodeCache when the regional Redis is unavailable.
+ * Falls back to a local LRU cache when the regional Redis is unavailable.
  * Use this for data that is regional in nature (e.g. status history) so
  * reads are served from the same cluster the user is hitting.
  */
-const regionalLocalCache = new NodeCache({
+const regionalLocalCache = createLocalCache();
-    stdTTL: 3600,
-    checkperiod: 120,
-    maxKeys: 10000
-});
 
 class RegionalAdaptiveCache {
     private useRedis(): boolean {
@@ -332,7 +322,7 @@ class RegionalAdaptiveCache {
                     redisTtl
                 );
                 if (success) {
-                    // logger.debug(`[regional] Set key in Redis: ${key}`);
+                    logger.debug(`[regional] Set key in Redis: ${key}`);
                     return true;
                 }
             } catch (error) {
@@ -353,10 +343,10 @@ class RegionalAdaptiveCache {
             try {
                 const value = await regionalRedisManager.get(key);
                 if (value !== null) {
-                    // logger.debug(`[regional] Cache hit in Redis: ${key}`);
+                    logger.debug(`[regional] Cache hit in Redis: ${key}`);
                     return JSON.parse(value) as T;
                 }
-                // logger.debug(`[regional] Cache miss in Redis: ${key}`);
+                logger.debug(`[regional] Cache miss in Redis: ${key}`);
                 return undefined;
             } catch (error) {
                 logger.error(
@@ -385,7 +375,7 @@ class RegionalAdaptiveCache {
                     const success = await regionalRedisManager.del(k);
                     if (success) {
                         deletedCount++;
-                        // logger.debug(`[regional] Deleted key from Redis: ${k}`);
+                        logger.debug(`[regional] Deleted key from Redis: ${k}`);
                     }
                 }
                 if (deletedCount === keys.length) return deletedCount;
@@ -400,7 +390,7 @@ class RegionalAdaptiveCache {
             const count = regionalLocalCache.del(k);
             if (count > 0) {
                 deletedCount++;
-                // logger.debug(`[regional] Deleted key from local cache: ${k}`);
+                logger.debug(`[regional] Deleted key from local cache: ${k}`);
             }
         }
         return deletedCount;

server/private/lib/certificates/acme-client.ts

@@ -1,298 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import * as acme from "acme-client";
-import * as fs from "fs";
-import { eq } from "drizzle-orm/sql";
-import { privateConfig as config } from "#private/lib/config";
-import { DnsChallenge, db, dnsChallenge } from "@server/db";
-import { withRetry } from "@server/lib/retry";
-import logger from "@server/logger";
-import { acmeRateLimiter } from "./acmeRateLimiter";
-
-// acme-client's own retry/backoff logging (429 retries, 5xx retries, each
-// status-poll tick in waitForValidStatus) is a no-op by default - it only
-// activates via DEBUG=acme-client or this call, neither of which was wired
-// up. Without it, a cert silently retrying a Let's Encrypt rate limit for
-// several minutes is indistinguishable in our logs from one that's actually
-// hung, since our own logging only wraps the call, not what happens inside
-// it. Must run before any AcmeClient method is called.
-acme.setLogger((msg: string) => logger.info(`[acme-client] ${msg}`));
-
-// acme-client's axios retry wrapper treats any response-less request error
-// (timeout, connection reset, DNS blip reaching the ACME server) as
-// retryable, but once its internal retries are exhausted it falls through to
-// `validateStatus(response)` with `response` still undefined, throwing this
-// uninformative TypeError instead of the real network error.
-// https://github.com/publishlab/node-acme-client/blob/master/src/axios.js
-function isUnresponsiveAcmeError(error: unknown): boolean {
-    return (
-        error instanceof TypeError &&
-        error.message ===
-            "Cannot read properties of undefined (reading 'config')"
-    );
-}
-
-function normalizeAcmeError(error: unknown): Error {
-    if (isUnresponsiveAcmeError(error)) {
-        return new Error(
-            "ACME server did not respond after repeated attempts (network error reaching the ACME endpoint)",
-            { cause: error }
-        );
-    }
-    return error instanceof Error ? error : new Error(String(error));
-}
-
-export class AcmeClientManager {
-    private client: acme.Client | null = null;
-    private accountKey: string | null = null;
-
-    async initialize() {
-        try {
-            this.accountKey = await this.loadAccountKey();
-
-            this.client = new acme.Client({
-                directoryUrl: config.getRawConfig().acme!.acme_directory_url,
-                accountKey: this.accountKey
-            });
-
-            // Try to create account or get existing one
-            await this.client.createAccount({
-                termsOfServiceAgreed: true,
-                contact: [`mailto:${config.getRawConfig().acme!.contact_email}`]
-            });
-
-            logger.info("ACME client initialized successfully");
-        } catch (error) {
-            logger.error("Failed to initialize ACME client:", error);
-            throw error;
-        }
-    }
-
-    private async loadAccountKey(): Promise<string> {
-        const keyPath = config.getRawConfig().acme!.acme_account_key_path;
-
-        if (fs.existsSync(keyPath)) {
-            logger.info("Loading existing account key");
-            return fs.readFileSync(keyPath, "utf8");
-        } else {
-            logger.info("Generating new account key");
-            const privateKey = await acme.crypto.createPrivateKey();
-            const privateKeyString = privateKey.toString();
-            fs.writeFileSync(keyPath, privateKeyString);
-            return privateKeyString;
-        }
-    }
-
-    getClient(): acme.Client {
-        if (!this.client) {
-            throw new Error("ACME client not initialized");
-        }
-        return this.client;
-    }
-
-    async createOrder(domain: string, wildcard: boolean = false): Promise<any> {
-        const client = this.getClient();
-
-        const identifiers = wildcard
-            ? [
-                  { type: "dns", value: domain },
-                  { type: "dns", value: `*.${domain}` }
-              ]
-            : [{ type: "dns", value: domain }];
-
-        await acmeRateLimiter.acquire();
-        const order = await client.createOrder({
-            identifiers
-        });
-
-        if (wildcard) {
-            logger.info(`Created wildcard order for domain: ${domain}`);
-        } else {
-            logger.info(`Created order for domain: ${domain}`);
-        }
-        return order;
-    }
-
-    async getAuthorizations(order: any): Promise<any[]> {
-        const client = this.getClient();
-        await acmeRateLimiter.acquire();
-        return client.getAuthorizations(order);
-    }
-
-    async handleDnsChallenge(
-        dnsChallenges: {
-            authz: any;
-            challenge: any;
-        }[]
-    ): Promise<void> {
-        const client = this.getClient();
-
-        let challengeDomains: DnsChallenge[] = [];
-
-        for (const { authz, challenge } of dnsChallenges) {
-            const keyAuthorization =
-                await client.getChallengeKeyAuthorization(challenge);
-
-            // Extract the domain from authorization
-            const domain = authz.identifier.value;
-
-            // Store challenge in database for DNS server to pick up
-            challengeDomains = await withRetry(
-                () =>
-                    db
-                        .insert(dnsChallenge)
-                        .values({
-                            domain: domain,
-                            token: challenge.token,
-                            keyAuthorization,
-                            createdAt: Math.floor(Date.now() / 1000),
-                            expiresAt: Math.floor(
-                                (Date.now() +
-                                    config.getRawConfig().acme!
-                                        .challenge_ttl_ms) /
-                                    1000
-                            )
-                        })
-                        .returning(),
-                { label: `insert dnsChallenge for domain ${domain}` }
-            );
-
-            logger.info(
-                `DNS challenge stored for domain: ${domain} as token ${challenge.token} and keyAuthorization`
-            );
-        }
-
-        await new Promise((resolve) => setTimeout(resolve, 2000));
-
-        const failedDomains: string[] = [];
-
-        for (const { authz, challenge } of dnsChallenges) {
-            const domain = authz.identifier.value;
-            const challengeDomain = `_acme-challenge.${domain}`;
-
-            try {
-                // The ACME server occasionally has a transient network blip
-                // mid-sequence; retry the whole verify/complete/wait sequence
-                // rather than just the DNS challenge propagation wait, since
-                // these calls are safe to repeat against the ACME server.
-                await withRetry(
-                    async () => {
-                        // Verify challenge
-                        await acmeRateLimiter.acquire();
-                        await client.verifyChallenge(authz, challenge);
-
-                        // Complete challenge
-                        logger.info(
-                            `Completing challenge for domain: ${challengeDomain}`
-                        );
-                        await acmeRateLimiter.acquire();
-                        await client.completeChallenge(challenge);
-
-                        // Wait for validation
-                        logger.info(
-                            `Waiting for challenge to be validated for domain: ${challengeDomain}...`
-                        );
-                        await acmeRateLimiter.acquire();
-                        await client.waitForValidStatus(challenge);
-                    },
-                    {
-                        retries: 2,
-                        baseDelayMs: 5000,
-                        label: `ACME challenge completion for domain ${domain}`,
-                        // Only retry the known network-blip crash - a
-                        // genuine validation failure (e.g. challenge marked
-                        // "invalid" because the DNS record wasn't found) is
-                        // permanent and should fail immediately instead of
-                        // burning Let's Encrypt's per-hostname failed-
-                        // validation rate limit on retries that can't help.
-                        shouldRetry: isUnresponsiveAcmeError
-                    }
-                );
-
-                logger.info(`Challenge completed for domain: ${domain}`);
-            } catch (error) {
-                logger.error(
-                    `Failed to complete challenge for domain ${domain}:`,
-                    normalizeAcmeError(error)
-                );
-                failedDomains.push(domain);
-            }
-        }
-
-        for (const challengeDomain of challengeDomains) {
-            await this.removeDnsChallenge(challengeDomain.dnsChallengeId);
-            logger.info(
-                `Removed DNS challenge for domain: ${challengeDomain.domain}`
-            );
-        }
-
-        // A failed dns-01 challenge leaves the order stuck in "pending" -
-        // finalizing it would just fail with a confusing ACME error, so
-        // stop here and let the caller mark the certificate as failed.
-        if (failedDomains.length > 0) {
-            throw new Error(
-                `DNS-01 challenge validation failed for domain(s): ${failedDomains.join(", ")}`
-            );
-        }
-    }
-
-    async removeDnsChallenge(dnsChallengeId: number): Promise<void> {
-        try {
-            await withRetry(
-                () =>
-                    db
-                        .delete(dnsChallenge)
-                        .where(eq(dnsChallenge.dnsChallengeId, dnsChallengeId)),
-                { label: `delete dnsChallenge ${dnsChallengeId}` }
-            );
-        } catch (error) {
-            logger.error(
-                `Failed to clean up DNS challenge for id ${dnsChallengeId}:`,
-                error
-            );
-        }
-    }
-
-    async finalizeCertificate(
-        order: any,
-        domain: string,
-        wildcard: boolean = false
-    ): Promise<{ certificate: string; privateKey: string }> {
-        const client = this.getClient();
-
-        const altNames = wildcard ? [`*.${domain}`, domain] : [domain];
-
-        // Create CSR
-        const [privateKey, csr] = await acme.crypto.createCsr({
-            altNames
-        });
-
-        // Finalize order
-        await acmeRateLimiter.acquire();
-        const finalizedOrder = await client.finalizeOrder(order, csr);
-
-        // Get certificate
-        await acmeRateLimiter.acquire();
-        const certificate = await client.getCertificate(finalizedOrder);
-
-        logger.info(`Certificate obtained for domain: ${domain}`);
-
-        return {
-            certificate: certificate.toString(),
-            privateKey: privateKey.toString()
-        };
-    }
-}
-
-export const acmeClientManager = new AcmeClientManager();

server/private/lib/certificates/acmeRateLimiter.ts

@@ -1,71 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { privateConfig as config } from "#private/lib/config";
-import logger from "@server/logger";
-import { redis } from "../redis";
-// Caps outgoing ACME API calls to a fixed budget per wall-clock second,
-// shared across all pops workers via Redis (mirrors the lockManager pattern
-// in @lib/lock) - a per-process limiter wouldn't be enough since multiple
-// workers issue certificates against the same Let's Encrypt account.
-const ACQUIRE_SCRIPT = `
-local key = KEYS[1]
-local limit = tonumber(ARGV[1])
-local current = redis.call('INCR', key)
-if current == 1 then
-    redis.call('PEXPIRE', key, 2000)
-end
-if current > limit then
-    return 0
-else
-    return 1
-end
-`;
-
-class AcmeRateLimiter {
-    async acquire(): Promise<void> {
-        const limit =
-            config.getRawConfig().acme?.acme_requests_per_second ?? 15;
-
-        for (;;) {
-            const bucket = Math.floor(Date.now() / 1000);
-            const key = `acme_rate_limit:${bucket}`;
-
-            let allowed: number;
-            try {
-                allowed = (await redis.eval(
-                    ACQUIRE_SCRIPT,
-                    1,
-                    key,
-                    limit.toString()
-                )) as number;
-            } catch (error) {
-                logger.error(
-                    "ACME rate limiter check failed, proceeding without throttling:",
-                    error
-                );
-                return;
-            }
-
-            if (allowed === 1) {
-                return;
-            }
-
-            // Budget for this second is spent - wait for the next window.
-            const waitMs = 1000 - (Date.now() % 1000) + 10;
-            await new Promise((resolve) => setTimeout(resolve, waitMs));
-        }
-    }
-}
-
-export const acmeRateLimiter = new AcmeRateLimiter();

server/private/lib/certificates/certificate-service.ts

@@ -1,511 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { acmeClientManager } from "./acme-client";
-import { dnsValidator } from "./dns-validator";
-import { getTableColumns } from "drizzle-orm";
-import { eq, and, or, isNull, lt, asc } from "drizzle-orm/sql";
-import { config } from "@server/lib/config";
-import { db, certificates, domains, Certificate } from "@server/db";
-import { encrypt } from "@server/lib/crypto";
-import { withTimeout, withRetry } from "@server/lib/retry";
-import logger from "@server/logger";
-import { lockManager } from "../lock";
-import { pushCertUpdateToAffectedNewts } from "@server/lib/acmeCertSync";
-import crypto from "crypto";
-
-// Number of on-demand DNS validation attempts made right before a
-// certificate is (re)issued, to avoid burning Let's Encrypt rate limits on
-// domains whose DNS has drifted since they were last verified.
-const PRE_CERT_DNS_VALIDATION_ATTEMPTS = 3;
-
-// Hard ceiling on a single certificate's issuance/renewal flow. acme-client's
-// axios instance never sets a request timeout, so a stalled connection to
-// the ACME server hangs forever instead of erroring - and since
-// processPendingCertificates/processRenewalCandidates gate the *next* batch
-// on Promise.all(...) over the current one, one hung certificate would
-// otherwise stall every other domain permanently. Sized generously above the
-// legitimate worst case (acme-client's own bounded backoff is ~3.6min per
-// status-polling loop, and a wildcard cert's two identifiers plus order
-// finalization can chain a few of those) so this only fires on a genuine hang.
-const CERTIFICATE_ISSUANCE_TIMEOUT_MS = 20 * 60 * 1000;
-
-// "requested" is set the instant a cert starts processing and is never
-// queried anywhere else - processPendingCertificates only selects "pending"
-// and processRenewalCandidates only selects "valid". So if the *process*
-// dies mid-flight (OOM, node eviction, a rolling deploy) rather than just
-// hanging, the row is orphaned in "requested" permanently with nothing to
-// ever pick it back up, no matter how good the in-process timeouts are.
-// Threshold is set comfortably above CERTIFICATE_ISSUANCE_TIMEOUT_MS plus the
-// scheduler's own outer backstop so this never reclaims a cert that's still
-// genuinely being worked on.
-const STUCK_CERTIFICATE_THRESHOLD_MS = 40 * 60 * 1000;
-
-export class CertificateService {
-    // Runs at the top of every processPendingCertificates tick so an
-    // interrupted worker's leftovers always get put back in the queue
-    // instead of sitting invisible to every query forever.
-    private async reclaimStuckCertificates(): Promise<void> {
-        const staleBefore =
-            Math.floor(Date.now() / 1000) -
-            Math.floor(STUCK_CERTIFICATE_THRESHOLD_MS / 1000);
-
-        const reclaimed = await db
-            .update(certificates)
-            .set({
-                status: "pending",
-                errorMessage:
-                    'Reclaimed after being stuck in "requested" state - the worker processing it likely restarted or crashed',
-                updatedAt: Math.floor(Date.now() / 1000)
-            })
-            .where(
-                and(
-                    eq(certificates.status, "requested"),
-                    lt(certificates.updatedAt, staleBefore)
-                )
-            )
-            .returning({ domain: certificates.domain });
-
-        if (reclaimed.length > 0) {
-            logger.warn(
-                `Reclaimed ${reclaimed.length} certificate(s) stuck in "requested" state: ${reclaimed
-                    .map((c) => c.domain)
-                    .join(", ")}`
-            );
-        }
-    }
-
-    async processPendingCertificates(): Promise<void> {
-        logger.debug("Checking for pending certificates...");
-
-        await this.reclaimStuckCertificates();
-
-        const pendingCerts = await db
-            .select(getTableColumns(certificates))
-            .from(certificates)
-            .leftJoin(domains, eq(certificates.domainId, domains.domainId))
-            .where(
-                and(
-                    eq(certificates.status, "pending"),
-                    or(
-                        // Certs with no linked domain row (e.g. legacy certs
-                        // imported from acme.json) aren't gated on domain
-                        // verification since there's nothing to check.
-                        isNull(certificates.domainId),
-                        and(
-                            eq(domains.verified, true),
-                            eq(domains.failed, false)
-                        )
-                    )
-                )
-            )
-            .limit(10);
-
-        if (pendingCerts.length === 0) {
-            logger.debug("No pending certificates found");
-            return;
-        }
-
-        logger.info(`Found ${pendingCerts.length} pending certificates`);
-
-        // Process the batch concurrently so one domain stuck retrying a slow
-        // DNS-01 challenge (the ACME client's waitForValidStatus can spend
-        // minutes on a bad domain) doesn't stall the rest of the batch.
-        // processSingleCertificate catches its own errors and each cert uses
-        // an independent per-domain lock, so this is safe to parallelize.
-        await Promise.all(
-            pendingCerts.map((cert) => this.processSingleCertificate(cert))
-        );
-    }
-
-    async processRenewalCandidates(): Promise<void> {
-        logger.debug("Checking for certificates needing renewal...");
-
-        const now = Math.floor(Date.now() / 1000);
-
-        const renewalCandidates = await db
-            .select(getTableColumns(certificates))
-            .from(certificates)
-            .leftJoin(domains, eq(certificates.domainId, domains.domainId))
-            .where(
-                and(
-                    eq(certificates.status, "valid"),
-                    lt(certificates.expiresAt, now + 15 * 24 * 60 * 60), // 15 days from now
-                    or(
-                        // Certs with no linked domain row (e.g. legacy certs
-                        // imported from acme.json) aren't gated on domain
-                        // verification since there's nothing to check.
-                        isNull(certificates.domainId),
-                        and(
-                            eq(domains.verified, true),
-                            eq(domains.failed, false)
-                        )
-                    )
-                )
-            )
-            // Most urgent first, so already-expired certs aren't starved
-            // behind the limit by certs that still have weeks of runway.
-            .orderBy(asc(certificates.expiresAt))
-            .limit(50);
-
-        if (renewalCandidates.length === 0) {
-            logger.debug("No certificates need renewal");
-            return;
-        }
-
-        logger.info(
-            `Found ${renewalCandidates.length} certificates needing renewal`
-        );
-
-        for (const cert of renewalCandidates) {
-            if (cert.expiresAt !== null && cert.expiresAt < now) {
-                logger.warn(
-                    `Certificate for ${cert.domain} is marked "valid" but already expired at ${new Date(cert.expiresAt * 1000).toISOString()} (bad state) - renewing immediately`
-                );
-            }
-        }
-
-        // Process the batch concurrently - see processPendingCertificates for why.
-        await Promise.all(
-            renewalCandidates.map((cert) => this.renewCertificate(cert))
-        );
-    }
-
-    private async processSingleCertificate(cert: Certificate): Promise<void> {
-        const lockKey = `cert:${cert.domain}`;
-
-        const lockToken = await lockManager.acquireLock(lockKey);
-        if (!lockToken) {
-            logger.debug(
-                `Could not acquire lock for certificate: ${cert.domain}`
-            );
-            return;
-        }
-
-        try {
-            logger.info(`Processing certificate for domain: ${cert.domain}`);
-
-            // Update status to processing
-            await db
-                .update(certificates)
-                .set({
-                    status: "requested",
-                    updatedAt: Math.floor(Date.now() / 1000)
-                })
-                .where(eq(certificates.certId, cert.certId));
-            //
-
-            await withTimeout(
-                this.obtainCertificate(cert),
-                CERTIFICATE_ISSUANCE_TIMEOUT_MS,
-                `certificate issuance for ${cert.domain}`
-            );
-        } catch (error) {
-            logger.error(
-                `Failed to process certificate for ${cert.domain}:`,
-                error
-            );
-
-            await db
-                .update(certificates)
-                .set({
-                    status: "failed",
-                    errorMessage:
-                        error instanceof Error
-                            ? error.message
-                            : "Unknown error",
-                    updatedAt: Math.floor(Date.now() / 1000)
-                })
-                .where(eq(certificates.certId, cert.certId));
-        } finally {
-            await lockManager.releaseLock(lockKey, lockToken);
-        }
-    }
-
-    private async renewCertificate(cert: Certificate): Promise<void> {
-        const lockKey = `cert:${cert.domain}`;
-
-        const lockToken = await lockManager.acquireLock(lockKey);
-        if (!lockToken) {
-            logger.debug(
-                `Could not acquire lock for certificate renewal: ${cert.domain}`
-            );
-            return;
-        }
-
-        try {
-            logger.info(`Renewing certificate for domain: ${cert.domain}`);
-
-            // Update last renewal attempt
-            await db
-                .update(certificates)
-                .set({
-                    lastRenewalAttempt: Math.floor(Date.now() / 1000),
-                    updatedAt: Math.floor(Date.now() / 1000)
-                })
-                .where(eq(certificates.certId, cert.certId));
-
-            await withTimeout(
-                this.obtainCertificate(cert),
-                CERTIFICATE_ISSUANCE_TIMEOUT_MS,
-                `certificate renewal for ${cert.domain}`
-            );
-        } catch (error) {
-            logger.error(
-                `Failed to renew certificate for ${cert.domain}:`,
-                error
-            );
-
-            await db
-                .update(certificates)
-                .set({
-                    status: "failed",
-                    errorMessage:
-                        error instanceof Error
-                            ? error.message
-                            : "Unknown error",
-                    lastRenewalAttempt: Math.floor(Date.now() / 1000),
-                    updatedAt: Math.floor(Date.now() / 1000)
-                })
-                .where(eq(certificates.certId, cert.certId));
-        } finally {
-            await lockManager.releaseLock(lockKey, lockToken);
-        }
-    }
-
-    // Re-checks the domain's DNS records right before we spend a Let's
-    // Encrypt order on it, so drift that happened after the domain was
-    // originally verified doesn't burn ACME rate limits. Certs with no
-    // linked domain row (e.g. legacy/manually-managed certs) skip this and
-    // proceed as before, since there are no tracked DNS records to check.
-    private async verifyDomainBeforeIssuance(cert: Certificate): Promise<void> {
-        if (!cert.domainId) {
-            return;
-        }
-
-        const [domain] = await db
-            .select()
-            .from(domains)
-            .where(eq(domains.domainId, cert.domainId))
-            .limit(1);
-
-        if (!domain) {
-            return;
-        }
-
-        for (
-            let attempt = 1;
-            attempt <= PRE_CERT_DNS_VALIDATION_ATTEMPTS;
-            attempt++
-        ) {
-            // Offset `tries` so each attempt round-robins to a different
-            // privateConfigured DNS resolver instead of re-querying the same one.
-            const probe = { ...domain, tries: domain.tries + attempt - 1 };
-            if (
-                await dnsValidator.validateDomain(probe, {
-                    forceRecheck: true
-                })
-            ) {
-                await db
-                    .update(domains)
-                    .set({ verified: true, failed: false, errorMessage: null })
-                    .where(eq(domains.domainId, domain.domainId));
-                return;
-            }
-
-            logger.warn(
-                `Pre-certificate DNS check ${attempt}/${PRE_CERT_DNS_VALIDATION_ATTEMPTS} failed for domain ${domain.baseDomain} (cert: ${cert.domain})`
-            );
-        }
-
-        const errorMessage = `Domain failed DNS validation ${PRE_CERT_DNS_VALIDATION_ATTEMPTS} times before certificate issuance`;
-        await db
-            .update(domains)
-            .set({ verified: false, failed: true, errorMessage })
-            .where(eq(domains.domainId, domain.domainId));
-
-        throw new Error(errorMessage);
-    }
-
-    private async obtainCertificate(cert: Certificate): Promise<void> {
-        await this.verifyDomainBeforeIssuance(cert);
-
-        // Create order
-        const order = await acmeClientManager.createOrder(
-            cert.domain,
-            cert.wildcard || false
-        );
-
-        // Update with order ID
-        await withRetry(
-            () =>
-                db
-                    .update(certificates)
-                    .set({
-                        orderId: order.url,
-                        updatedAt: Math.floor(Date.now() / 1000)
-                    })
-                    .where(eq(certificates.certId, cert.certId)),
-            { label: `update orderId for certificate ${cert.domain}` }
-        );
-
-        // Get authorizations
-        const authorizations = await acmeClientManager.getAuthorizations(order);
-
-        // Aggregate all DNS-01 challenges
-        const dnsChallenges = authorizations.map((authz: any) => {
-            const dnsChallenge = authz.challenges.find(
-                (c: any) => c.type === "dns-01"
-            );
-            if (!dnsChallenge) {
-                throw new Error(
-                    `No DNS-01 challenge found for ${authz.identifier.value}`
-                );
-            }
-            return {
-                authz,
-                challenge: dnsChallenge
-            };
-        });
-
-        // Send all DNS-01 challenges in one request to handleDnsChallenge
-        await acmeClientManager.handleDnsChallenge(dnsChallenges);
-
-        // Finalize certificate
-        const { certificate, privateKey } =
-            await acmeClientManager.finalizeCertificate(
-                order,
-                cert.domain,
-                cert.wildcard || false
-            );
-
-        const encryptionKey = config.getRawConfig().server.secret;
-        if (!encryptionKey) {
-            throw new Error("Encryption key not provided");
-        }
-
-        // Encrypt certificate and private key
-        const encryptedCert = encrypt(certificate, encryptionKey);
-        const encryptedKey = encrypt(privateKey, encryptionKey);
-
-        // Parse certificate to get expiration date
-        const expiresAt = this.extractExpirationDate(certificate);
-
-        // Update database record. This persists the certificate we just
-        // obtained from the ACME server, so it's retried aggressively -
-        // losing this write means re-issuing the cert from scratch.
-        await withRetry(
-            () =>
-                db
-                    .update(certificates)
-                    .set({
-                        status: "valid",
-                        expiresAt: Math.floor(expiresAt.getTime() / 1000),
-                        renewalCount: (cert.renewalCount || 0) + 1,
-                        errorMessage: null,
-                        updatedAt: Math.floor(Date.now() / 1000),
-                        certFile: encryptedCert,
-                        keyFile: encryptedKey
-                    })
-                    .where(eq(certificates.certId, cert.certId)),
-            {
-                retries: 5,
-                label: `persist issued certificate for ${cert.domain}`
-            }
-        );
-
-        logger.info(
-            `Certificate successfully obtained/renewed for domain: ${cert.domain}`
-        );
-
-        await pushCertUpdateToAffectedNewts(
-            cert.domain,
-            cert.domainId ?? null,
-            certificate,
-            privateKey
-        );
-    }
-
-    private extractExpirationDate(certificate: string): Date {
-        try {
-            // Extract the certificate block
-            const pem = certificate
-                .replace(/-----BEGIN CERTIFICATE-----/g, "")
-                .replace(/-----END CERTIFICATE-----/g, "")
-                .replace(/\s+/g, "");
-            const der = Buffer.from(pem, "base64");
-
-            // Use Node.js crypto to parse the certificate
-            const x509 = new crypto.X509Certificate(der);
-            return new Date(x509.validTo);
-        } catch (error) {
-            logger.warn(
-                "Failed to parse certificate expiration date, using default",
-                error
-            );
-            // Default to 90 days from now (Let's Encrypt default)
-            return new Date(Date.now() + 90 * 24 * 60 * 60 * 1000);
-        }
-    }
-
-    async addCertificateRequest(domain: string): Promise<void> {
-        try {
-            await db.insert(certificates).values({
-                domain,
-                status: "pending",
-                createdAt: Math.floor(Date.now() / 1000),
-                updatedAt: Math.floor(Date.now() / 1000)
-            });
-            logger.info(`Certificate request added for domain: ${domain}`);
-        } catch (error) {
-            if (error instanceof Error && error.message.includes("unique")) {
-                logger.warn(
-                    `Certificate request already exists for domain: ${domain}`
-                );
-            } else {
-                throw error;
-            }
-        }
-    }
-
-    async getCertificateStatus(domain: string) {
-        const cert = await db
-            .select()
-            .from(certificates)
-            .where(eq(certificates.domain, domain))
-            .limit(1);
-
-        return cert[0] || null;
-    }
-
-    async cleanupExpiredChallenges(): Promise<void> {
-        try {
-            const result = await db
-                .delete(certificates)
-                .where(
-                    lt(certificates.expiresAt, Math.floor(Date.now() / 1000))
-                )
-                .returning();
-
-            if (result.length > 0) {
-                logger.info(
-                    `Cleaned up ${result.length} expired DNS challenges`
-                );
-            }
-        } catch (error) {
-            logger.error("Failed to cleanup expired challenges:", error);
-        }
-    }
-}
-
-export const certificateService = new CertificateService();

server/private/lib/certificates/dns-validator.ts

@@ -1,334 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { eq, and, lt } from "drizzle-orm";
-import * as dns from "dns/promises";
-import { privateConfig as config } from "#private/lib/config";
-import { db, domains, DnsRecord, dnsRecords, Domain } from "@server/db";
-import logger from "@server/logger";
-import { lockManager } from "../lock";
-
-export const DNS_VALIDATOR_MAX_TRIES = 300;
-
-export class DNSValidator {
-    private static readonly MAX_TRIES = DNS_VALIDATOR_MAX_TRIES;
-
-    constructor() {}
-
-    async validateAll(): Promise<void> {
-        // Get all domains that are not yet verified and haven't exceeded max tries
-        const unverifiedDomains: Domain[] = await db
-            .select()
-            .from(domains)
-            .where(
-                and(
-                    eq(domains.verified, false),
-                    lt(domains.tries, DNSValidator.MAX_TRIES)
-                )
-            );
-
-        if (unverifiedDomains.length === 0) {
-            logger.debug("No unverified domains found for DNS validation");
-            return;
-        }
-
-        logger.info(`Validating ${unverifiedDomains.length} DNS records`);
-
-        for (const domain of unverifiedDomains) {
-            const lockKey = `dns:${domain.baseDomain}`;
-            const lockToken = await lockManager.acquireLock(lockKey);
-            if (!lockToken) {
-                logger.debug(
-                    `Could not acquire lock for DNS validation: ${domain.baseDomain}`
-                );
-                continue;
-            }
-            try {
-                const isValid = await this.validateDomain(domain);
-                if (isValid) {
-                    await db
-                        .update(domains)
-                        .set({
-                            verified: true,
-                            failed: false,
-                            tries: 0,
-                            errorMessage: null
-                        })
-                        .where(eq(domains.domainId, domain.domainId));
-                    logger.info(
-                        `Domain ${domain.baseDomain} validated successfully`
-                    );
-                } else {
-                    const newTries = domain.tries + 1;
-                    const shouldMarkAsFailed =
-                        newTries >= DNSValidator.MAX_TRIES;
-
-                    await db
-                        .update(domains)
-                        .set({
-                            tries: newTries,
-                            failed: shouldMarkAsFailed
-                        })
-                        .where(eq(domains.domainId, domain.domainId));
-
-                    if (shouldMarkAsFailed) {
-                        logger.warn(
-                            `Domain ${domain.baseDomain} exceeded maximum tries (${DNSValidator.MAX_TRIES}), marking as failed`
-                        );
-                    } else {
-                        logger.debug(
-                            `Domain ${domain.baseDomain} did not validate (attempt ${newTries}/${DNSValidator.MAX_TRIES})`
-                        );
-                    }
-                }
-            } catch (err) {
-                logger.warn(
-                    `Error validating domain ${domain.baseDomain}:`,
-                    err
-                );
-                // Increment tries even on error
-                const newTries = domain.tries + 1;
-                const shouldMarkAsFailed = newTries >= DNSValidator.MAX_TRIES;
-
-                await db
-                    .update(domains)
-                    .set({
-                        tries: newTries,
-                        failed: shouldMarkAsFailed
-                    })
-                    .where(eq(domains.domainId, domain.domainId));
-            } finally {
-                await lockManager.releaseLock(lockKey, lockToken);
-            }
-        }
-    }
-
-    async validateDomain(
-        domain: Domain,
-        opts: { forceRecheck?: boolean } = {}
-    ): Promise<boolean> {
-        const { forceRecheck = false } = opts;
-        const resolver = new dns.Resolver();
-        const servers = config.getRawConfig().acme?.dns_resolvers;
-        if (!servers || servers.length === 0) {
-            throw new Error("No DNS resolvers configured");
-        }
-        const dnsServer = servers[domain.tries % servers.length]!;
-        resolver.setServers([dnsServer]);
-        logger.debug(
-            `Using DNS server ${dnsServer} for domain ${domain.baseDomain} (try ${domain.tries})`
-        );
-
-        // Get all DNS records for this domain
-        const records: DnsRecord[] = await db
-            .select()
-            .from(dnsRecords)
-            .where(eq(dnsRecords.domainId, domain.domainId));
-
-        if (records.length === 0) {
-            logger.warn(`No DNS records found for domain ${domain.baseDomain}`);
-            return false;
-        }
-
-        if (!forceRecheck && records.every((r) => r.verified)) {
-            logger.info(
-                `All DNS records already verified for domain ${domain.baseDomain}`
-            );
-            return true;
-        }
-
-        logger.info(
-            `Validating ${records.length} DNS records for domain ${domain.baseDomain}`
-        );
-
-        // Collect the full set of expected NS values for this domain so we can
-        // detect extra records that are present in DNS but not in our DB.
-        const expectedNsValues = new Set<string>(
-            records.filter((r) => r.recordType === "NS").map((r) => r.value)
-        );
-
-        // Cache resolved NS records across iterations — there will be 3 NS
-        // records in the DB and we don't need to hit the upstream server 3 times.
-        let previousNs: string[] | null = null;
-
-        for (const record of records) {
-            // Skip already verified records, unless a live recheck was requested
-            if (record.verified && !forceRecheck) {
-                continue;
-            }
-
-            let isValid = false;
-
-            try {
-                if (record.recordType === "NS") {
-                    let nsRecords: string[] | null = previousNs;
-                    if (!nsRecords) {
-                        nsRecords = await resolver.resolveNs(
-                            record.baseDomain || domain.baseDomain
-                        );
-                    }
-                    logger.info(
-                        `NS records for ${
-                            record.baseDomain || domain.baseDomain
-                        }:`,
-                        nsRecords
-                    );
-
-                    // Check if this expected NS value is present in the live records.
-                    // A stale/legacy expected value (e.g. left over from a
-                    // nameserver rebrand) is also accepted as long as the live
-                    // records resolve to some other known-valid nameserver —
-                    // the specific literal hostname stored per-domain isn't
-                    // meaningful once it's a recognized alias.
-                    isValid = nsRecords.some((ns) => ns === record.value);
-
-                    previousNs = nsRecords;
-                } else if (record.recordType === "CNAME") {
-                    const cnameRecords = await resolver.resolveCname(
-                        record.baseDomain || domain.baseDomain
-                    );
-                    logger.info(
-                        `CNAME records for ${
-                            record.baseDomain || domain.baseDomain
-                        }:`,
-                        cnameRecords
-                    );
-
-                    // Check if the CNAME record matches the expected value
-                    isValid =
-                        cnameRecords.length === 1 &&
-                        cnameRecords[0] === record.value;
-                } else if (record.recordType === "TXT") {
-                    const txtRecords = await resolver.resolveTxt(
-                        record.baseDomain || domain.baseDomain
-                    );
-                    logger.info(
-                        `TXT records for ${
-                            record.baseDomain || domain.baseDomain
-                        }:`,
-                        txtRecords
-                    );
-
-                    // TXT records come as an array of arrays, flatten and check
-                    const flatTxtRecords = txtRecords.flat();
-                    isValid = flatTxtRecords.includes(record.value);
-                } else if (record.recordType === "A") {
-                    const aRecords = await resolver.resolve4(
-                        record.baseDomain || domain.baseDomain
-                    );
-                    logger.info(
-                        `A records for ${
-                            record.baseDomain || domain.baseDomain
-                        }:`,
-                        aRecords
-                    );
-
-                    // Check if the A record matches the expected value
-                    isValid = aRecords.includes(record.value);
-                } else {
-                    logger.warn(
-                        `Unsupported record type: ${record.recordType}`
-                    );
-                    continue;
-                }
-            } catch (error) {
-                isValid = false;
-                logger.debug(
-                    `Did not resolve ${record.recordType} record for ${
-                        record.baseDomain || domain.baseDomain
-                    }:`,
-                    error
-                );
-            }
-
-            // Update the individual record verification status. Runs for
-            // both a mismatched value and a failed/thrown DNS lookup, so a
-            // previously-verified record that stops resolving (e.g. NXDOMAIN
-            // after NS delegation is dropped) gets downgraded instead of
-            // leaving stale `verified: true` state behind.
-            if (isValid) {
-                await db
-                    .update(dnsRecords)
-                    .set({ verified: true })
-                    .where(eq(dnsRecords.id, record.id));
-                logger.info(
-                    `DNS record ${record.id} (${record.recordType}) for ${
-                        record.baseDomain || domain.baseDomain
-                    } verified successfully`
-                );
-            } else {
-                if (record.verified) {
-                    await db
-                        .update(dnsRecords)
-                        .set({ verified: false })
-                        .where(eq(dnsRecords.id, record.id));
-                }
-                logger.debug(
-                    `DNS record ${record.id} (${record.recordType}) for ${
-                        record.baseDomain || domain.baseDomain
-                    } does not match expected value: ${record.value}`
-                );
-            }
-        }
-
-        // --- Extra NS record check ---
-        // If we resolved NS records during this pass, verify that the live DNS
-        // has no nameservers beyond the ones we expect.  Individual records may
-        // already be marked verified above, but we must block full domain
-        // verification until the extra records are removed.
-        if (previousNs !== null && expectedNsValues.size > 0) {
-            const extraNsRecords = previousNs.filter(
-                (ns) => !expectedNsValues.has(ns)
-            );
-
-            if (extraNsRecords.length > 0) {
-                const errorMessage = `Extra NS records found that are not expected: ${extraNsRecords.join(", ")}. Remove these nameservers to complete domain verification.`;
-
-                await db
-                    .update(domains)
-                    .set({ errorMessage })
-                    .where(eq(domains.domainId, domain.domainId));
-
-                logger.warn(
-                    `Domain ${domain.baseDomain} has extra NS records that prevent verification: ${extraNsRecords.join(", ")}`
-                );
-
-                return false;
-            }
-
-            // No extras — clear any stale error that was previously written
-            await db
-                .update(domains)
-                .set({ errorMessage: null })
-                .where(eq(domains.domainId, domain.domainId));
-        }
-
-        // Check if all records are now verified
-        const updatedRecords: DnsRecord[] = await db
-            .select()
-            .from(dnsRecords)
-            .where(eq(dnsRecords.domainId, domain.domainId));
-
-        const allRecordsVerified = updatedRecords.every((r) => r.verified);
-
-        logger.info(
-            `Domain ${domain.baseDomain}: ${
-                updatedRecords.filter((r) => r.verified).length
-            }/${updatedRecords.length} records verified`
-        );
-
-        return allRecordsVerified;
-    }
-}
-
-export const dnsValidator = new DNSValidator();

server/private/lib/certificates/domain-reverifier.ts

@@ -1,233 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { eq, and, or, isNull, lt } from "drizzle-orm";
-import * as dns from "dns/promises";
-import { DNS_VALIDATOR_MAX_TRIES } from "./dns-validator";
-import { db, domains, DnsRecord, dnsRecords, Domain } from "@server/db";
-import logger from "@server/logger";
-import { lockManager } from "../lock";
-import { privateConfig as config } from "#private/lib/config";
-
-// Module-level counter so successive domains in a batch round-robin across servers.
-let serverIndex = 0;
-
-export class DomainReverifier {
-    async reverifyAll(): Promise<void> {
-        const certConfig = config.getRawConfig().acme;
-        if (!certConfig) {
-            logger.debug(
-                "No certificate config — skipping domain reverification"
-            );
-            return;
-        }
-
-        const windowMs = certConfig.domain_reverification_window_ms;
-        const batchSize = certConfig.domain_reverification_batch_size;
-        const windowSecs = Math.floor(windowMs / 1000);
-        const cutoff = Math.floor(Date.now() / 1000) - windowSecs;
-
-        const domainsToCheck: Domain[] = await db
-            .select()
-            .from(domains)
-            .where(
-                and(
-                    eq(domains.verified, true),
-                    or(
-                        isNull(domains.lastCheckedAt),
-                        lt(domains.lastCheckedAt, cutoff)
-                    )
-                )
-            )
-            .limit(batchSize);
-
-        if (domainsToCheck.length === 0) {
-            logger.debug("No verified domains due for reverification");
-            return;
-        }
-
-        logger.info(`Reverifying ${domainsToCheck.length} domains`);
-
-        for (const domain of domainsToCheck) {
-            const lockKey = `dns-reverify:${domain.baseDomain}`;
-            const lockToken = await lockManager.acquireLock(lockKey);
-            if (!lockToken) {
-                logger.debug(
-                    `Could not acquire lock for domain reverification: ${domain.baseDomain}`
-                );
-                continue;
-            }
-
-            try {
-                await this.reverifyDomain(domain, certConfig.dns_resolvers);
-            } catch (err) {
-                logger.warn(
-                    `Unexpected error reverifying domain ${domain.baseDomain}:`,
-                    err
-                );
-                // Still stamp lastCheckedAt so we don't hammer a broken domain every run.
-                await db
-                    .update(domains)
-                    .set({ lastCheckedAt: Math.floor(Date.now() / 1000) })
-                    .where(eq(domains.domainId, domain.domainId));
-            } finally {
-                await lockManager.releaseLock(lockKey, lockToken);
-            }
-        }
-    }
-
-    private async reverifyDomain(
-        domain: Domain,
-        servers: string[]
-    ): Promise<void> {
-        if (!servers || servers.length === 0) {
-            throw new Error("No DNS resolvers configured");
-        }
-
-        // Round-robin across servers; advance the global counter so the next
-        // domain in the same batch gets a different server.
-        const dnsServer = servers[serverIndex % servers.length]!;
-        serverIndex++;
-
-        const resolver = new dns.Resolver();
-        resolver.setServers([dnsServer]);
-
-        logger.debug(
-            `Reverifying domain ${domain.baseDomain} using DNS server ${dnsServer}`
-        );
-
-        const records: DnsRecord[] = await db
-            .select()
-            .from(dnsRecords)
-            .where(eq(dnsRecords.domainId, domain.domainId));
-
-        if (records.length === 0) {
-            logger.warn(
-                `No DNS records found for domain ${domain.baseDomain} during reverification — marking failed`
-            );
-            await this.markFailed(
-                domain.domainId,
-                "No DNS records found during periodic reverification"
-            );
-            return;
-        }
-
-        const expectedNsValues = new Set<string>(
-            records.filter((r) => r.recordType === "NS").map((r) => r.value)
-        );
-
-        let allValid = true;
-        let errorMessage: string | null = null;
-        let resolvedNs: string[] | null = null;
-
-        for (const record of records) {
-            let isValid = false;
-
-            try {
-                if (record.recordType === "NS") {
-                    if (!resolvedNs) {
-                        resolvedNs = await resolver.resolveNs(
-                            record.baseDomain || domain.baseDomain
-                        );
-                    }
-                    isValid = resolvedNs.some((ns) => ns === record.value);
-                } else if (record.recordType === "CNAME") {
-                    const cnameRecords = await resolver.resolveCname(
-                        record.baseDomain || domain.baseDomain
-                    );
-                    isValid =
-                        cnameRecords.length === 1 &&
-                        cnameRecords[0] === record.value;
-                } else if (record.recordType === "TXT") {
-                    const txtRecords = await resolver.resolveTxt(
-                        record.baseDomain || domain.baseDomain
-                    );
-                    isValid = txtRecords.flat().includes(record.value);
-                } else if (record.recordType === "A") {
-                    const aRecords = await resolver.resolve4(
-                        record.baseDomain || domain.baseDomain
-                    );
-                    isValid = aRecords.includes(record.value);
-                } else {
-                    logger.warn(
-                        `Unsupported record type ${record.recordType} during reverification of ${domain.baseDomain}`
-                    );
-                    continue;
-                }
-            } catch (err) {
-                logger.debug(
-                    `DNS lookup failed for ${record.recordType} record on ${record.baseDomain || domain.baseDomain}:`,
-                    err
-                );
-                isValid = false;
-            }
-
-            if (!isValid) {
-                allValid = false;
-                errorMessage = `${record.recordType} record for ${record.baseDomain || domain.baseDomain} no longer resolves to expected value "${record.value}"`;
-                break;
-            }
-        }
-
-        // Check for extra NS records beyond what we expect.
-        if (allValid && resolvedNs !== null && expectedNsValues.size > 0) {
-            const extraNs = resolvedNs.filter(
-                (ns) => !expectedNsValues.has(ns)
-            );
-            if (extraNs.length > 0) {
-                allValid = false;
-                errorMessage = `Extra NS records found: ${extraNs.join(", ")}. Remove these nameservers.`;
-            }
-        }
-
-        const now = Math.floor(Date.now() / 1000);
-
-        if (allValid) {
-            await db
-                .update(domains)
-                .set({ lastCheckedAt: now, errorMessage: null })
-                .where(eq(domains.domainId, domain.domainId));
-            logger.debug(
-                `Domain ${domain.baseDomain} passed periodic reverification`
-            );
-        } else {
-            await this.markFailed(domain.domainId, errorMessage);
-            logger.warn(
-                `Domain ${domain.baseDomain} failed periodic reverification: ${errorMessage}`
-            );
-        }
-    }
-
-    private async markFailed(
-        domainId: string,
-        errorMessage: string | null
-    ): Promise<void> {
-        await db
-            .update(domains)
-            .set({
-                verified: false,
-                failed: true,
-                // Three below MAX_TRIES: keeps the domain out of the DNS
-                // validator's immediate retry loop, while still leaving it
-                // eligible (tries < MAX_TRIES) for a few more validation
-                // passes instead of being excluded forever once tries hits
-                // MAX_TRIES.
-                tries: DNS_VALIDATOR_MAX_TRIES - 3,
-                lastCheckedAt: Math.floor(Date.now() / 1000),
-                errorMessage
-            })
-            .where(eq(domains.domainId, domainId));
-    }
-}
-
-export const domainReverifier = new DomainReverifier();

server/private/lib/certificates/index.ts

@@ -1,45 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import logger from "@server/logger";
-import { privateConfig } from "#private/lib/config";
-import { acmeClientManager } from "./acme-client";
-import { jobScheduler } from "./scheduler";
-
-export async function startCertificateManager() {
-    const acmeConfig = privateConfig.getRawPrivateConfig().acme;
-    if (
-        acmeConfig &&
-        acmeConfig.cert_mode === "pangolin" &&
-        acmeConfig.enable_acme_client
-    ) {
-        logger.info("Starting certificate management server...");
-
-        // Initialize ACME client
-        await acmeClientManager.initialize();
-
-        // Start certificate issuance/renewal jobs
-        await jobScheduler.start();
-    }
-
-    if (privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
-        // DNS record validation/reverification doesn't require certs, so it
-        // runs whenever Pangolin is acting as the authoritative DNS server,
-        // independent of the cert manager above.
-        await jobScheduler.startDnsJobs();
-    }
-}
-
-export async function stopCertificateManager() {
-    await jobScheduler.stop();
-}

server/private/lib/certificates/scheduler.ts

@@ -1,197 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { withTimeout } from "@server/lib/retry";
-import logger from "@server/logger";
-import { certificateService } from "./certificate-service";
-import { privateConfig as config } from "#private/lib/config";
-import { dnsValidator } from "./dns-validator";
-import { domainReverifier } from "./domain-reverifier";
-import license from "#private/license/license";
-
-// Backstop for runExclusive: no single job's own internal timeouts (e.g.
-// certificate-service's per-cert issuance timeout) are relied on here. This
-// is the last line of defense - if *anything* inside a job hangs with no
-// error (a stalled Redis/DB call, a future code path that forgets to bound
-// itself, etc.), state.active must still reset so the next tick can run.
-// Without it, one hung run permanently skips every future tick for that job,
-// since runExclusive only clears state.active after the job promise settles.
-const RUN_EXCLUSIVE_TIMEOUT_MS = 30 * 60 * 1000;
-
-export class JobScheduler {
-    private certIntervals: NodeJS.Timeout[] = [];
-    private dnsIntervals: NodeJS.Timeout[] = [];
-    private certRunning = false;
-    private dnsRunning = false;
-
-    // Guards against a slow batch (e.g. 10 certs whose DNS challenges take a
-    // while) still being processed when the next interval tick fires -
-    // without this, overlapping ticks would each pull their own batch of up
-    // to 10 pending/renewal certs and process them concurrently instead of
-    // waiting for the prior batch to finish.
-    private runExclusive(
-        job: () => Promise<void>,
-        state: { active: boolean },
-        label: string
-    ): () => Promise<void> {
-        return async () => {
-            if (!(await license.isUnlocked())) {
-                logger.debug(
-                    `Skipping ${label} tick - license is not subscribed`
-                );
-                return;
-            }
-            if (state.active) {
-                logger.debug(
-                    `Skipping ${label} tick - previous run still in progress`
-                );
-                return;
-            }
-            state.active = true;
-            try {
-                await withTimeout(job(), RUN_EXCLUSIVE_TIMEOUT_MS, label);
-            } catch (error) {
-                logger.error(`Error in ${label}:`, error);
-            } finally {
-                state.active = false;
-            }
-        };
-    }
-
-    // Certificate issuance/renewal - requires an ACME client, so this is
-    // only started when Pangolin is actually managing certs.
-    async start(): Promise<void> {
-        if (this.certRunning) {
-            logger.warn("Certificate job scheduler is already running");
-            return;
-        }
-
-        this.certRunning = true;
-        logger.info("Starting certificate job scheduler");
-
-        const newCertState = { active: false };
-        const renewalState = { active: false };
-
-        const runNewCertCheck = this.runExclusive(
-            () => certificateService.processPendingCertificates(),
-            newCertState,
-            "processing pending certificates"
-        );
-        const runRenewalCheck = this.runExclusive(
-            () => certificateService.processRenewalCandidates(),
-            renewalState,
-            "processing renewal candidates"
-        );
-
-        // Schedule new certificate processing
-        const newCertInterval = setInterval(
-            runNewCertCheck,
-            config.getRawConfig().acme!.new_cert_check_interval_ms
-        );
-
-        // Schedule renewal processing (every 24 hours)
-        const renewalInterval = setInterval(
-            runRenewalCheck,
-            config.getRawConfig().acme!.renewal_check_interval_ms
-        );
-
-        this.certIntervals.push(newCertInterval, renewalInterval);
-
-        // Run initial checks
-        setTimeout(async () => {
-            try {
-                await runNewCertCheck();
-                // await runRenewalCheck();
-            } catch (error) {
-                logger.error("Error in initial certificate processing:", error);
-            }
-        }, 1000); // Wait 1 second after startup
-
-        logger.info("Certificate job scheduler started successfully");
-    }
-
-    // DNS record validation/reverification - doesn't touch certs at all, so
-    // this runs independently whenever Pangolin is acting as the
-    // authoritative DNS server, regardless of cert_mode.
-    async startDnsJobs(): Promise<void> {
-        if (this.dnsRunning) {
-            logger.warn("DNS validation job scheduler is already running");
-            return;
-        }
-
-        this.dnsRunning = true;
-        logger.info("Starting DNS validation job scheduler");
-
-        const dnsValidationState = { active: false };
-        const reverifyState = { active: false };
-
-        const runDnsValidation = this.runExclusive(
-            () => dnsValidator.validateAll(),
-            dnsValidationState,
-            "validating DNS records"
-        );
-        const runReverify = this.runExclusive(
-            () => domainReverifier.reverifyAll(),
-            reverifyState,
-            "reverifying domains"
-        );
-
-        // Schedule DNS validation
-        const dnsValidationInterval = setInterval(
-            runDnsValidation,
-            config.getRawConfig().acme?.dns_check_interval_ms ?? 60000
-        );
-
-        // Schedule periodic reverification of already-verified domains
-        const reverifyInterval = setInterval(
-            runReverify,
-            config.getRawConfig().acme?.domain_reverification_interval_ms ??
-                3600000
-        );
-
-        this.dnsIntervals.push(dnsValidationInterval, reverifyInterval);
-
-        // Run an initial validation pass shortly after startup
-        setTimeout(async () => {
-            try {
-                await runDnsValidation();
-            } catch (error) {
-                logger.error("Error in initial DNS validation:", error);
-            }
-        }, 1000);
-
-        logger.info("DNS validation job scheduler started successfully");
-    }
-
-    async stop(): Promise<void> {
-        if (this.certRunning) {
-            logger.info("Stopping certificate job scheduler");
-            this.certRunning = false;
-            this.certIntervals.forEach((interval) => clearInterval(interval));
-            this.certIntervals = [];
-        }
-
-        if (this.dnsRunning) {
-            logger.info("Stopping DNS validation job scheduler");
-            this.dnsRunning = false;
-            this.dnsIntervals.forEach((interval) => clearInterval(interval));
-            this.dnsIntervals = [];
-        }
-    }
-
-    isRunning(): boolean {
-        return this.certRunning || this.dnsRunning;
-    }
-}
-
-export const jobScheduler = new JobScheduler();

server/private/lib/config.ts

@@ -146,20 +146,12 @@ export class PrivateConfig {
             process.env.USE_PANGOLIN_DNS =
                 this.rawPrivateConfig.flags.use_pangolin_dns.toString();
         }
-
-        if (this.rawPrivateConfig.acme?.cert_mode) {
-            process.env.CERT_MODE = this.rawPrivateConfig.acme.cert_mode;
-        }
     }
 
     public getRawPrivateConfig() {
         return this.rawPrivateConfig;
     }
 
-    public getRawConfig() {
-        return this.getRawPrivateConfig();
-    }
-
     // `flags.enable_acme_cert_sync`, `flags.disable_private_http_placeholder`,
     // and `acme` used to live in the private config file. They now live in
     // the public config file. If an operator still has them set in the

server/private/lib/dns/generateDomains.ts

@@ -1,47 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import { build } from "@server/build";
-import privateConfig from "#private/lib/config";
-
-export function createCname(domainId: string, baseDomain: string) {
-    if (!privateConfig.getRawPrivateConfig().dns?.cname_extension) {
-        throw new Error("CNAME extension not configured");
-    }
-
-    let cnameRecords = [
-        {
-            value: `${domainId}.${privateConfig.getRawPrivateConfig().dns?.cname_extension}`,
-            baseDomain: baseDomain
-        },
-        {
-            value: `_acme-challenge.${domainId}.${privateConfig.getRawPrivateConfig().dns?.cname_extension}`,
-            baseDomain: `_acme-challenge.${baseDomain}`
-        }
-    ];
-
-    return cnameRecords;
-}
-
-export function createNs() {
-    if (!privateConfig.getRawPrivateConfig().dns?.nameserver_name) {
-        throw new Error("Nameservers not configured");
-    }
-
-    const nsRecords = [
-        privateConfig.getRawPrivateConfig().dns?.nameserver_name,
-        ...(privateConfig.getRawPrivateConfig().dns?.alternate_nameservers ||
-            [])
-    ] as string[];
-    return nsRecords;
-}

server/private/lib/dns/index.ts

@@ -1,14 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-export * from "./server";

server/private/lib/exitNodes/exitNodeComms.ts

@@ -18,7 +18,6 @@ import { eq } from "drizzle-orm";
 import { sendToClient } from "#private/routers/ws";
 import privateConfig from "#private/lib/config";
 import config from "@server/lib/config";
-import { hasExitNodeCheckedIn } from "@server/lib/exitNodes";
 
 interface ExitNodeRequest {
     remoteType?: string;
@@ -139,19 +138,13 @@ export async function sendToExitNode(
 
             return response.data;
         } catch (error) {
-            const message = axios.isAxiosError(error)
+            if (axios.isAxiosError(error)) {
-                ? `Error making ${method} request (can Pangolin see Gerbil HTTP API?) for exit node at ${hostname} (status: ${error.response?.status}): ${error.message}`
+                logger.error(
-                : `Error making ${method} request for exit node at ${hostname}: ${error}`;
+                    `Error making ${method} request (can Pangolin see Gerbil HTTP API?) for exit node at ${hostname} (status: ${error.response?.status}): ${error.message}`
-
+                );
-            // The exit node (gerbil) may still be starting up and not yet
-            // reachable. Until it has checked in at least once, log this at a
-            // lower level since it's expected; once it has checked in, a
-            // connection failure is a real problem.
-            if (hasExitNodeCheckedIn(exitNode.exitNodeId)) {
-                logger.error(message);
             } else {
-                logger.warn(
+                logger.error(
-                    `${message} (exit node has not checked in yet since startup, this is expected briefly)`
+                    `Error making ${method} request for exit node at ${hostname}: ${error}`
                 );
             }
         }

server/private/lib/readConfigFile.ts

@@ -95,70 +95,6 @@ export const privateConfigSchema = z
                     .optional()
             })
             .optional(),
-        dns: z
-            .object({
-                enabled: z.boolean().optional().default(false),
-                listen_port: z.number().int().positive().optional().default(53),
-                nameserver_name: z.string(),
-                cname_extension: z.string(),
-                site_extension: z.string().optional(),
-                cname_alternate_extensions: z
-                    .array(z.string())
-                    .optional()
-                    .default([]),
-                alternate_nameservers: z
-                    .array(z.string())
-                    .optional()
-                    .default([]),
-                rate_limit: z
-                    .object({
-                        enabled: z.boolean().optional().default(true),
-                        window_ms: z
-                            .number()
-                            .int()
-                            .min(1000)
-                            .max(600000)
-                            .optional()
-                            .default(60000),
-                        max_requests: z
-                            .number()
-                            .int()
-                            .min(50)
-                            .max(100000)
-                            .optional()
-                            .default(1200),
-                        max_requests_per_query_type: z
-                            .number()
-                            .int()
-                            .min(10)
-                            .max(50000)
-                            .optional()
-                            .default(600)
-                    })
-                    .default({
-                        enabled: true,
-                        window_ms: 60000,
-                        max_requests: 1200,
-                        max_requests_per_query_type: 600
-                    }),
-                static_records: z
-                    .array(
-                        z.object({
-                            domain: z.string(),
-                            type: z.enum(["TXT", "CNAME", "A", "NS"]),
-                            value: z.string(),
-                            ttl: z
-                                .number()
-                                .int()
-                                .positive()
-                                .optional()
-                                .default(300)
-                        })
-                    )
-                    .optional()
-                    .default([])
-            })
-            .optional(),
         gerbil: z
             .object({
                 local_exit_node_reachable_at: z
@@ -189,86 +125,15 @@ export const privateConfigSchema = z
             })
             .optional()
             .prefault({}),
+        // @deprecated Moved to the public config file as `acme`
+        // (server/lib/readConfigFile.ts). Kept here only so existing private
+        // config files keep parsing; any value set here is migrated into the
+        // public config at startup by PrivateConfig (server/private/lib/config.ts).
         acme: z
             .object({
-                cert_mode: z
-                    .enum(["traefik", "pangolin"])
-                    .optional()
-                    .default("traefik"),
-                enable_acme_client: z.boolean().optional().default(false),
-                // @deprecated Moved to the public config file
-                // (server/lib/readConfigFile.ts). Kept here only so existing private
-                // config files keep parsing; any value set here is migrated into the
-                // public config at startup by PrivateConfig (server/private/lib/config.ts).
                 acme_json_path: z.string().optional(),
-                // @deprecated Moved to the public config file
-                // (server/lib/readConfigFile.ts). Kept here only so existing private
-                // config files keep parsing; any value set here is migrated into the
-                // public config at startup by PrivateConfig (server/private/lib/config.ts).
                 acme_http_endpoint: z.string().optional(),
-                // @deprecated Moved to the public config file
+                sync_interval_ms: z.number().optional()
-                // (server/lib/readConfigFile.ts). Kept here only so existing private
-                // config files keep parsing; any value set here is migrated into the
-                // public config at startup by PrivateConfig (server/private/lib/config.ts).
-                sync_interval_ms: z.number().optional(),
-                acme_directory_url: z
-                    .string()
-                    .url()
-                    .default("https://acme-v02.api.letsencrypt.org/directory"),
-                contact_email: z.string().email().optional(),
-                acme_account_key_path: z
-                    .string()
-                    .default("./config/account.key"),
-                challenge_ttl_ms: z.number().int().positive().default(300000),
-                renewal_check_interval_ms: z
-                    .number()
-                    .int()
-                    .positive()
-                    .default(3600000),
-                new_cert_check_interval_ms: z
-                    .number()
-                    .int()
-                    .positive()
-                    .default(5000),
-                // Kept safely under Let's Encrypt's ~20 req/s limit since this
-                // budget is shared across all pops workers and only covers the
-                // request-issuing calls we make directly (not every request
-                // acme-client makes internally, e.g. while polling for
-                // challenge/order status).
-                acme_requests_per_second: z
-                    .number()
-                    .int()
-                    .positive()
-                    .default(15),
-                dns_check_interval_ms: z
-                    .number()
-                    .int()
-                    .positive()
-                    .default(60000),
-                domain_reverification_interval_ms: z
-                    .number()
-                    .int()
-                    .positive()
-                    .default(3600000), // 1 hour — how often to run the reverification pass
-                domain_reverification_window_ms: z
-                    .number()
-                    .int()
-                    .positive()
-                    .default(259200000), // 72 hours — how old checkedAt must be before rechecking
-                domain_reverification_batch_size: z
-                    .number()
-                    .int()
-                    .positive()
-                    .default(20), // max domains to recheck per pass
-                dns_resolvers: z
-                    .array(z.string())
-                    .optional()
-                    .default([
-                        "8.8.8.8",
-                        "1.1.1.1",
-                        "9.9.9.9",
-                        "208.67.222.222"
-                    ])
             })
             .optional(),
         branding: z

server/private/lib/traefik/getTraefikConfig.ts

@@ -396,7 +396,7 @@ export async function getTraefikConfig(
         );
 
     let validCerts: CertificateResult[] = [];
-    if (privateConfig.getRawPrivateConfig().acme?.cert_mode == "pangolin") {
+    if (privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
         // create a list of all domains to get certs for
         const domains = new Set<string>();
         for (const resource of resourcesMap.values()) {
@@ -522,10 +522,7 @@ export async function getTraefikConfig(
             );
 
             let tls = {};
-            if (
+            if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
-                privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                "pangolin"
-            ) {
                 tls = buildWildcardTls({
                     fullDomain,
                     hasSubdomain: !!resource.subdomain,
@@ -792,8 +789,7 @@ export async function getTraefikConfig(
                 preferWildcardCert
             }) => {
                 if (
-                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                    !privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
-                    "pangolin"
                 ) {
                     return buildWildcardTls({
                         fullDomain,
@@ -836,8 +832,7 @@ export async function getTraefikConfig(
             redirectHttpsMiddlewareName,
             resolveTls: (fullDomain) => {
                 if (
-                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                    !privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
-                    "pangolin"
                 ) {
                     // siteResource aliases don't have a per-domain cert
                     // resolver stored, so always fall back to the global
@@ -929,10 +924,7 @@ export async function getTraefikConfig(
             const rule = buildHostRule(fullDomain, ir.wildcard);
 
             let tls: any = {};
-            if (
+            if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
-                privateConfig.getRawPrivateConfig().acme?.cert_mode !=
-                "pangolin"
-            ) {
                 tls = buildWildcardTls({
                     fullDomain,
                     hasSubdomain: !!ir.subdomain,
@@ -1013,8 +1005,7 @@ export async function getTraefikConfig(
 
                 let tls: any = {};
                 if (
-                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                    !privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
-                    "pangolin"
                 ) {
                     // siteResource aliases don't have a per-domain cert
                     // resolver stored, so always fall back to the global
@@ -1089,7 +1080,7 @@ export async function getTraefikConfig(
             .where(eq(exitNodes.exitNodeId, exitNodeId));
 
         let validCertsLoginPages: CertificateResult[] = [];
-        if (privateConfig.getRawPrivateConfig().acme?.cert_mode == "pangolin") {
+        if (privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
             // create a list of all domains to get certs for
             const domains = new Set<string>();
             for (const lp of exitNodeLoginPages) {
@@ -1135,8 +1126,7 @@ export async function getTraefikConfig(
 
                 const tls = {};
                 if (
-                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                    !privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
-                    "pangolin"
                 ) {
                     // TODO: we need to add the wildcard logic here too
                 } else {

server/private/license/license.ts

@@ -14,7 +14,7 @@
 import { db, HostMeta, sites, users } from "@server/db";
 import { hostMeta, licenseKey } from "@server/db";
 import logger from "@server/logger";
-import NodeCache from "node-cache";
+import { createLocalCache } from "@server/lib/createLocalCache";
 import { validateJWT } from "./licenseJwt";
 import { count, eq } from "drizzle-orm";
 import moment from "moment";
@@ -65,8 +65,8 @@ export class License {
     private validationServerUrl = `${this.serverBaseUrl}/api/v1/license/enterprise/validate`;
     private activationServerUrl = `${this.serverBaseUrl}/api/v1/license/enterprise/activate`;
 
-    private statusCache = new NodeCache();
+    private statusCache = createLocalCache();
-    private licenseKeyCache = new NodeCache();
+    private licenseKeyCache = createLocalCache();
 
     private statusKey = "status";
     private serverSecret!: string;
@@ -179,7 +179,7 @@ LQIDAQAB
                 status.isHostLicensed = false;
                 // Invalidate all and set new cache (empty)
                 this.licenseKeyCache.flushAll();
-                this.statusCache.set(this.statusKey, status);
+                this.statusCache.set(this.statusKey, status, 0);
                 return status;
             }
 
@@ -389,7 +389,7 @@ LQIDAQAB
             // Invalidate old cache and set new cache
             this.licenseKeyCache.flushAll();
             for (const [key, value] of newCache.entries()) {
-                this.licenseKeyCache.set<LicenseKeyCache>(key, value);
+                this.licenseKeyCache.set(key, value, 0);
             }
         } catch (error) {
             logger.error("Error checking license status:");
@@ -398,7 +398,7 @@ LQIDAQAB
             this.checkInProgress = false;
         }
 
-        this.statusCache.set(this.statusKey, status);
+        this.statusCache.set(this.statusKey, status, 0);
         return status;
     }
 

server/private/routers/alertRule/testAlertRule.ts

@@ -14,7 +14,7 @@
 import { getRandomItemInArray } from "@app/lib/getRandomItemInArray";
 import response from "@server/lib/response";
 import logger from "@server/logger";
-import { processTestAlerts } from "#private/lib/alerts/processTestAlerts";
+import { processTestAlerts } from "@server/private/lib/alerts/processTestAlerts";
 import { type AlertAction } from "@server/routers/alertRule/types";
 import HttpCode from "@server/types/HttpCode";
 import { NextFunction, Request, Response } from "express";

server/private/routers/alertRule/updateAlertRule.ts

@@ -33,11 +33,8 @@ import { OpenAPITags, registry } from "@server/openApi";
 import { and, eq } from "drizzle-orm";
 import { encrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
-import {
+import { HC_EVENT_TYPES, SITE_EVENT_TYPES, RESOURCE_EVENT_TYPES } from "./createAlertRule";
-    HC_EVENT_TYPES,
+import { invalidateAllRemoteExitNodeSessions } from "@server/private/auth/sessions/remoteExitNode";
-    SITE_EVENT_TYPES,
-    RESOURCE_EVENT_TYPES
-} from "./createAlertRule";
 
 const paramsSchema = z
     .object({
@@ -88,57 +85,35 @@ const bodySchema = z
         const isHcEvent = (HC_EVENT_TYPES as readonly string[]).includes(
             val.eventType
         );
-        const isResourceEvent = (
+        const isResourceEvent = (RESOURCE_EVENT_TYPES as readonly string[]).includes(
-            RESOURCE_EVENT_TYPES as readonly string[]
+            val.eventType
-        ).includes(val.eventType);
+        );
 
-        if (
+        if (isSiteEvent && val.siteIds !== undefined && val.siteIds.length === 0 && !val.allSites) {
-            isSiteEvent &&
-            val.siteIds !== undefined &&
-            val.siteIds.length === 0 &&
-            !val.allSites
-        ) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
-                message:
+                message: "At least one siteId is required for site event types when allSites is false",
-                    "At least one siteId is required for site event types when allSites is false",
                 path: ["siteIds"]
             });
         }
 
-        if (
+        if (isHcEvent && val.healthCheckIds !== undefined && val.healthCheckIds.length === 0 && !val.allHealthChecks) {
-            isHcEvent &&
-            val.healthCheckIds !== undefined &&
-            val.healthCheckIds.length === 0 &&
-            !val.allHealthChecks
-        ) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
-                message:
+                message: "At least one healthCheckId is required for health check event types when allHealthChecks is false",
-                    "At least one healthCheckId is required for health check event types when allHealthChecks is false",
                 path: ["healthCheckIds"]
             });
         }
 
-        if (
+        if (isResourceEvent && val.resourceIds !== undefined && val.resourceIds.length === 0 && !val.allResources) {
-            isResourceEvent &&
-            val.resourceIds !== undefined &&
-            val.resourceIds.length === 0 &&
-            !val.allResources
-        ) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
-                message:
+                message: "At least one resourceId is required for resource event types when allResources is false",
-                    "At least one resourceId is required for resource event types when allResources is false",
                 path: ["resourceIds"]
             });
         }
 
-        if (
+        if (isSiteEvent && val.healthCheckIds !== undefined && val.healthCheckIds.length > 0) {
-            isSiteEvent &&
-            val.healthCheckIds !== undefined &&
-            val.healthCheckIds.length > 0
-        ) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
                 message: "healthCheckIds must not be set for site event types",
@@ -154,11 +129,7 @@ const bodySchema = z
             });
         }
 
-        if (
+        if (isResourceEvent && val.siteIds !== undefined && val.siteIds.length > 0) {
-            isResourceEvent &&
-            val.siteIds !== undefined &&
-            val.siteIds.length > 0
-        ) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
                 message: "siteIds must not be set for resource event types",
@@ -166,15 +137,10 @@ const bodySchema = z
             });
         }
 
-        if (
+        if (isResourceEvent && val.healthCheckIds !== undefined && val.healthCheckIds.length > 0) {
-            isResourceEvent &&
-            val.healthCheckIds !== undefined &&
-            val.healthCheckIds.length > 0
-        ) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
-                message:
+                message: "healthCheckIds must not be set for resource event types",
-                    "healthCheckIds must not be set for resource event types",
                 path: ["healthCheckIds"]
             });
         }
@@ -187,6 +153,7 @@ const UpdateAlertRuleResponseDataSchema = z.object({
     alertRuleId: z.number()
 });
 
+
 registry.registerPath({
     method: "post",
     path: "/org/{orgId}/alert-rule/{alertRuleId}",
@@ -207,9 +174,7 @@ registry.registerPath({
             description: "Successful response",
             content: {
                 "application/json": {
-                    schema: createApiResponseSchema(
+                    schema: createApiResponseSchema(UpdateAlertRuleResponseDataSchema)
-                        UpdateAlertRuleResponseDataSchema
-                    )
                 }
             }
         }
@@ -285,11 +250,9 @@ export async function updateAlertRule(
         if (name !== undefined) updateData.name = name;
         if (eventType !== undefined) updateData.eventType = eventType;
         if (enabled !== undefined) updateData.enabled = enabled;
-        if (cooldownSeconds !== undefined)
+        if (cooldownSeconds !== undefined) updateData.cooldownSeconds = cooldownSeconds;
-            updateData.cooldownSeconds = cooldownSeconds;
         if (allSites !== undefined) updateData.allSites = allSites;
-        if (allHealthChecks !== undefined)
+        if (allHealthChecks !== undefined) updateData.allHealthChecks = allHealthChecks;
-            updateData.allHealthChecks = allHealthChecks;
         if (allResources !== undefined) updateData.allResources = allResources;
 
         await db
@@ -310,11 +273,7 @@ export async function updateAlertRule(
 
             // Only insert junction rows when allSites is not true
             const effectiveAllSites = allSites ?? false;
-            if (
+            if (!effectiveAllSites && siteIds !== undefined && siteIds.length > 0) {
-                !effectiveAllSites &&
-                siteIds !== undefined &&
-                siteIds.length > 0
-            ) {
                 await db.insert(alertSites).values(
                     siteIds.map((siteId) => ({
                         alertRuleId,
@@ -331,11 +290,7 @@ export async function updateAlertRule(
                 .where(eq(alertHealthChecks.alertRuleId, alertRuleId));
 
             const effectiveAllHealthChecks = allHealthChecks ?? false;
-            if (
+            if (!effectiveAllHealthChecks && healthCheckIds !== undefined && healthCheckIds.length > 0) {
-                !effectiveAllHealthChecks &&
-                healthCheckIds !== undefined &&
-                healthCheckIds.length > 0
-            ) {
                 await db.insert(alertHealthChecks).values(
                     healthCheckIds.map((healthCheckId) => ({
                         alertRuleId,
@@ -352,11 +307,7 @@ export async function updateAlertRule(
                 .where(eq(alertResources.alertRuleId, alertRuleId));
 
             const effectiveAllResources = allResources ?? false;
-            if (
+            if (!effectiveAllResources && resourceIds !== undefined && resourceIds.length > 0) {
-                !effectiveAllResources &&
-                resourceIds !== undefined &&
-                resourceIds.length > 0
-            ) {
                 await db.insert(alertResources).values(
                     resourceIds.map((resourceId) => ({
                         alertRuleId,
@@ -441,10 +392,7 @@ export async function updateAlertRule(
                     webhookActions.map((wa) => ({
                         alertRuleId,
                         webhookUrl: wa.webhookUrl,
-                        config:
+                        config: wa.config != null ? encrypt(wa.config, serverSecret) : null,
-                            wa.config != null
-                                ? encrypt(wa.config, serverSecret)
-                                : null,
                         enabled: wa.enabled
                     }))
                 );

server/private/routers/generatedLicense/clearInstanceName.ts

@@ -31,9 +31,7 @@ export async function clearInstanceName(
     next: NextFunction
 ): Promise<any> {
     try {
-        const parsedParams = clearInstanceNameParamsSchema.safeParse(
+        const parsedParams = clearInstanceNameParamsSchema.safeParse(req.params);
-            req.params
-        );
         if (!parsedParams.success) {
             return next(
                 createHttpError(
@@ -65,8 +63,7 @@ export async function clearInstanceName(
             return next(
                 createHttpError(
                     data.status || HttpCode.BAD_REQUEST,
-                    data.message ||
+                    data.message || "Failed to clear instance name from Fossorial API"
-                        "Failed to clear server ID from Fossorial API"
                 )
             );
         }
@@ -75,7 +72,7 @@ export async function clearInstanceName(
             data: null,
             success: true,
             error: false,
-            message: "Server ID cleared successfully",
+            message: "Instance name cleared successfully",
             status: HttpCode.OK
         });
     } catch (error) {
@@ -83,7 +80,7 @@ export async function clearInstanceName(
         return next(
             createHttpError(
                 HttpCode.INTERNAL_SERVER_ERROR,
-                "An error occurred while clearing the server ID."
+                "An error occurred while clearing the instance name."
             )
         );
     }

server/private/routers/gerbil/createExitNode.ts

@@ -12,8 +12,8 @@
  */
 
 import { db, ExitNode, exitNodes } from "@server/db";
+import { getUniqueExitNodeEndpointName } from "@server/db/names";
 import config from "@server/lib/config";
-import privateConfig from "#private/lib/config";
 import { getNextAvailableSubnet } from "@server/lib/exitNodes";
 import logger from "@server/logger";
 import { eq } from "drizzle-orm";
@@ -45,8 +45,6 @@ export async function createExitNode(
                 .values({
                     publicKey,
                     endpoint: config.getRawConfig().gerbil.base_endpoint,
-                    region:
-                        privateConfig.getRawPrivateConfig().app.region || null,
                     address,
                     listenPort,
                     online: true,

server/private/routers/remoteExitNode/getRemoteExitNodeToken.ts

@@ -26,7 +26,7 @@ import {
     validateRemoteExitNodeSessionToken,
     EXPIRES
 } from "#private/auth/sessions/remoteExitNode";
-import { getOrCreateCachedToken } from "#private/lib/tokenCache";
+import { getOrCreateCachedToken } from "@server/private/lib/tokenCache";
 import { verifyPassword } from "@server/auth/password";
 import logger from "@server/logger";
 import config from "@server/lib/config";

server/routers/badger/verifySession.ts

@@ -691,8 +691,10 @@ export async function verifyResourceSession(
                 );
 
                 resourceSession = result?.resourceSession;
+                if (resourceSession) {
                     localCache.set(sessionCacheKey, resourceSession, 5);
                 }
+            }
 
             if (resourceSession?.isRequestToken) {
                 logger.debug(
@@ -1121,8 +1123,10 @@ async function allowAccessToken(
                 resource.resourceId
             );
             resourceSession = result?.resourceSession;
+            if (resourceSession) {
                 localCache.set(sessionCacheKey, resourceSession, 5);
             }
+        }
 
         if (
             resourceSession &&

server/routers/domain/createOrgDomain.ts

@@ -21,7 +21,6 @@ import { LimitId } from "@server/lib/billing";
 import { isSecondLevelDomain, isValidDomain } from "@server/lib/validators";
 import { build } from "@server/build";
 import config from "@server/lib/config";
-import { createNs, createCname } from "#dynamic/lib/dns/generateDomains";
 
 const paramsSchema = z.strictObject({
     orgId: z.string()
@@ -284,7 +283,8 @@ export async function createOrgDomain(
 
             // TODO: This needs to be cross region and not hardcoded
             if (type === "ns") {
-                nsRecords = createNs();
+                nsRecords = config.getRawConfig().dns.nameservers as string[];
+
                 // Save NS records to database
                 for (const nsValue of nsRecords) {
                     recordsToInsert.push({
@@ -296,7 +296,16 @@ export async function createOrgDomain(
                     });
                 }
             } else if (type === "cname") {
-                cnameRecords = createCname(domainId, baseDomain);
+                cnameRecords = [
+                    {
+                        value: `${domainId}.${config.getRawConfig().dns.cname_extension}`,
+                        baseDomain: baseDomain
+                    },
+                    {
+                        value: `_acme-challenge.${domainId}.${config.getRawConfig().dns.cname_extension}`,
+                        baseDomain: `_acme-challenge.${baseDomain}`
+                    }
+                ];
 
                 // Save CNAME records to database
                 for (const cnameRecord of cnameRecords) {

server/routers/external.ts

@@ -87,6 +87,12 @@ authenticated.get("/org/checkId", org.checkId);
 authenticated.put("/org", getUserOrgs, org.createOrg);
 
 authenticated.get("/orgs", verifyUserIsServerAdmin, org.listOrgs);
+authenticated.get("/admin/orgs", verifyUserIsServerAdmin, org.adminListOrgs);
+authenticated.delete(
+    "/admin/org/:orgId",
+    verifyUserIsServerAdmin,
+    org.adminDeleteOrg
+);
 authenticated.get("/user/:userId/orgs", verifyIsLoggedInUser, org.listUserOrgs);
 
 authenticated.get(
@@ -1378,6 +1384,12 @@ if (build !== "saas") {
         user.adminGeneratePasswordResetCode
     );
 
+    authenticated.post(
+        "/user/:userId/server-admin",
+        verifyUserIsServerAdmin,
+        user.adminSetServerAdmin
+    );
+
     authenticated.delete(
         "/user/:userId",
         verifyUserIsServerAdmin,

server/routers/gerbil/getConfig.ts

@@ -10,7 +10,6 @@ import config from "@server/lib/config";
 import { fromError } from "zod-validation-error";
 import { getAllowedIps } from "../target/helpers";
 import { createExitNode } from "#dynamic/routers/gerbil/createExitNode";
-import { markExitNodeCheckedIn } from "@server/lib/exitNodes";
 
 // Define Zod schema for request validation
 const getConfigSchema = z.object({
@@ -66,8 +65,6 @@ export async function getConfig(
             );
         }
 
-        markExitNodeCheckedIn(exitNode.exitNodeId);
-
         const configResponse = await generateGerbilConfig(exitNode);
 
         logger.debug("Sending config: ", configResponse);

server/routers/launcher/launcherResourceAccess.ts

@@ -522,6 +522,7 @@ async function fetchLabelsForResources(
 type SiteGroupRow = {
     siteId: number;
     name: string;
+    niceId: string;
     type: string;
     online: boolean;
     itemCount: number;
@@ -556,6 +557,7 @@ async function listSiteGroups(
             .select({
                 siteId: sites.siteId,
                 name: sites.name,
+                niceId: sites.niceId,
                 type: sites.type,
                 online: sites.online,
                 itemCount: countDistinct(resources.resourceId)
@@ -576,7 +578,13 @@ async function listSiteGroups(
 
         const publicRows = await publicQuery
             .where(and(...publicConditions))
-            .groupBy(sites.siteId, sites.name, sites.type, sites.online);
+            .groupBy(
+                sites.siteId,
+                sites.name,
+                sites.niceId,
+                sites.type,
+                sites.online
+            );
 
         for (const row of publicRows) {
             const existing = siteCountMap.get(row.siteId);
@@ -586,6 +594,7 @@ async function listSiteGroups(
                 siteCountMap.set(row.siteId, {
                     siteId: row.siteId,
                     name: row.name,
+                    niceId: row.niceId,
                     type: row.type,
                     online: row.online,
                     itemCount: Number(row.itemCount)
@@ -612,6 +621,7 @@ async function listSiteGroups(
             .select({
                 siteId: sites.siteId,
                 name: sites.name,
+                niceId: sites.niceId,
                 type: sites.type,
                 online: sites.online,
                 itemCount: countDistinct(siteResources.siteResourceId)
@@ -638,7 +648,13 @@ async function listSiteGroups(
 
         const siteRows = await siteResourceQuery
             .where(and(...siteConditions))
-            .groupBy(sites.siteId, sites.name, sites.type, sites.online);
+            .groupBy(
+                sites.siteId,
+                sites.name,
+                sites.niceId,
+                sites.type,
+                sites.online
+            );
 
         for (const row of siteRows) {
             const existing = siteCountMap.get(row.siteId);
@@ -648,6 +664,7 @@ async function listSiteGroups(
                 siteCountMap.set(row.siteId, {
                     siteId: row.siteId,
                     name: row.name,
+                    niceId: row.niceId,
                     type: row.type,
                     online: row.online,
                     itemCount: Number(row.itemCount)
@@ -1061,6 +1078,43 @@ export async function listLauncherGroupsForUser(
     };
 }
 
+function toLauncherSiteInfo(row: {
+    siteId: number | null;
+    siteName: string | null;
+    siteNiceId: string | null;
+    siteType: string | null;
+    siteOnline: boolean | null;
+}): LauncherSiteInfo | null {
+    if (
+        row.siteId == null ||
+        row.siteName == null ||
+        row.siteNiceId == null ||
+        row.siteType == null
+    ) {
+        return null;
+    }
+    return {
+        siteId: row.siteId,
+        name: row.siteName,
+        niceId: row.siteNiceId,
+        type: row.siteType,
+        online: row.siteOnline ?? undefined
+    };
+}
+
+function pickPrimarySite(
+    sites: LauncherSiteInfo[],
+    siteIdFilter?: number
+): LauncherSiteInfo | undefined {
+    if (sites.length === 0) {
+        return undefined;
+    }
+    if (siteIdFilter != null) {
+        return sites.find((site) => site.siteId === siteIdFilter) ?? sites[0];
+    }
+    return sites[0];
+}
+
 async function mapPublicResources(
     orgId: string,
     resourceIds: number[],
@@ -1084,6 +1138,7 @@ async function mapPublicResources(
             enabled: resources.enabled,
             siteId: sites.siteId,
             siteName: sites.name,
+            siteNiceId: sites.niceId,
             siteType: sites.type,
             siteOnline: sites.online,
             exitNodeEndpoint: exitNodes.endpoint
@@ -1097,23 +1152,18 @@ async function mapPublicResources(
                 inArray(resources.resourceId, resourceIds),
                 eq(resources.orgId, orgId),
                 eq(resources.enabled, true),
-                eq(resources.status, "approved"),
+                eq(resources.status, "approved")
-                siteIdFilter != null
-                    ? eq(sites.siteId, siteIdFilter)
-                    : undefined
             )
         );
 
-    const seen = new Set<string>();
+    const byKey = new Map<string, LauncherResource>();
-    const result: LauncherResource[] = [];
+    const siteIdsByKey = new Map<string, Set<number>>();
 
     for (const row of rows) {
         const key = `public:${row.resourceId}`;
-        if (seen.has(key)) {
+        let item = byKey.get(key);
-            continue;
-        }
-        seen.add(key);
 
+        if (!item) {
             const access = formatPublicResourceAccess({
                 mode: row.mode,
                 fullDomain: row.fullDomain,
@@ -1123,7 +1173,7 @@ async function mapPublicResources(
                 exitNodeEndpoint: row.exitNodeEndpoint
             });
 
-        result.push({
+            item = {
                 launcherResourceKey: key,
                 resourceType: "public",
                 resourceId: row.resourceId,
@@ -1134,19 +1184,33 @@ async function mapPublicResources(
                 enabled: row.enabled,
                 mode: row.mode,
                 labels: labelMaps.byResourceId.get(row.resourceId) ?? [],
-            site:
+                sites: []
-                row.siteId != null
+            };
-                    ? {
+            byKey.set(key, item);
-                          siteId: row.siteId,
+            siteIdsByKey.set(key, new Set());
-                          name: row.siteName!,
-                          type: row.siteType!,
-                          online: row.siteOnline ?? undefined
-                      }
-                    : undefined
-        });
         }
 
-    return result;
+        const site = toLauncherSiteInfo(row);
+        if (!site) {
+            continue;
+        }
+
+        const seenSiteIds = siteIdsByKey.get(key)!;
+        if (seenSiteIds.has(site.siteId)) {
+            continue;
+        }
+        seenSiteIds.add(site.siteId);
+        item.sites.push(site);
+    }
+
+    for (const item of byKey.values()) {
+        item.sites.sort((a, b) =>
+            a.name.localeCompare(b.name, undefined, { sensitivity: "base" })
+        );
+        item.site = pickPrimarySite(item.sites, siteIdFilter);
+    }
+
+    return Array.from(byKey.values());
 }
 
 async function mapSiteResources(
@@ -1175,6 +1239,7 @@ async function mapSiteResources(
             enabled: siteResources.enabled,
             siteId: sites.siteId,
             siteName: sites.name,
+            siteNiceId: sites.niceId,
             siteType: sites.type,
             siteOnline: sites.online
         })
@@ -1189,23 +1254,18 @@ async function mapSiteResources(
                 inArray(siteResources.siteResourceId, siteResourceIds),
                 eq(siteResources.orgId, orgId),
                 eq(siteResources.enabled, true),
-                eq(siteResources.status, "approved"),
+                eq(siteResources.status, "approved")
-                siteIdFilter != null
-                    ? eq(sites.siteId, siteIdFilter)
-                    : undefined
             )
         );
 
-    const seen = new Set<string>();
+    const byKey = new Map<string, LauncherResource>();
-    const result: LauncherResource[] = [];
+    const siteIdsByKey = new Map<string, Set<number>>();
 
     for (const row of rows) {
         const key = `site:${row.siteResourceId}`;
-        if (seen.has(key)) {
+        let item = byKey.get(key);
-            continue;
-        }
-        seen.add(key);
 
+        if (!item) {
             const access = formatSiteResourceAccess({
                 mode: row.mode,
                 destination: row.destination,
@@ -1217,7 +1277,7 @@ async function mapSiteResources(
                 aliasAddress: row.aliasAddress
             });
 
-        result.push({
+            item = {
                 launcherResourceKey: key,
                 resourceType: "site",
                 resourceId: row.siteResourceId,
@@ -1228,20 +1288,35 @@ async function mapSiteResources(
                 iconUrl: null,
                 enabled: row.enabled,
                 mode: row.mode,
-            labels: labelMaps.bySiteResourceId.get(row.siteResourceId) ?? [],
+                labels:
-            site:
+                    labelMaps.bySiteResourceId.get(row.siteResourceId) ?? [],
-                row.siteId != null
+                sites: []
-                    ? {
+            };
-                          siteId: row.siteId,
+            byKey.set(key, item);
-                          name: row.siteName!,
+            siteIdsByKey.set(key, new Set());
-                          type: row.siteType!,
-                          online: row.siteOnline ?? undefined
-                      }
-                    : undefined
-        });
         }
 
-    return result;
+        const site = toLauncherSiteInfo(row);
+        if (!site) {
+            continue;
+        }
+
+        const seenSiteIds = siteIdsByKey.get(key)!;
+        if (seenSiteIds.has(site.siteId)) {
+            continue;
+        }
+        seenSiteIds.add(site.siteId);
+        item.sites.push(site);
+    }
+
+    for (const item of byKey.values()) {
+        item.sites.sort((a, b) =>
+            a.name.localeCompare(b.name, undefined, { sensitivity: "base" })
+        );
+        item.site = pickPrimarySite(item.sites, siteIdFilter);
+    }
+
+    return Array.from(byKey.values());
 }
 
 function filterResourcesBySite(
@@ -1252,13 +1327,17 @@ function filterResourcesBySite(
         return items.filter((item) => item.mode === "inference");
     }
     if (groupKey === LAUNCHER_NO_SITE_GROUP_KEY) {
-        return items.filter((item) => !item.site && item.mode !== "inference");
+        return items.filter(
+            (item) => item.sites.length === 0 && item.mode !== "inference"
+        );
     }
     const siteId = Number.parseInt(groupKey, 10);
     if (!Number.isFinite(siteId)) {
         return items;
     }
-    return items.filter((item) => item.site?.siteId === siteId);
+    return items.filter((item) =>
+        item.sites.some((site) => site.siteId === siteId)
+    );
 }
 
 function filterResourcesByLabel(
@@ -1499,6 +1578,7 @@ async function collectAccessibleSites(
             .select({
                 siteId: sites.siteId,
                 name: sites.name,
+                niceId: sites.niceId,
                 type: sites.type,
                 online: sites.online,
                 itemCount: countDistinct(resources.resourceId)
@@ -1507,7 +1587,13 @@ async function collectAccessibleSites(
             .innerJoin(resources, eq(targets.resourceId, resources.resourceId))
             .innerJoin(sites, eq(targets.siteId, sites.siteId))
             .where(and(...publicConditions))
-            .groupBy(sites.siteId, sites.name, sites.type, sites.online);
+            .groupBy(
+                sites.siteId,
+                sites.name,
+                sites.niceId,
+                sites.type,
+                sites.online
+            );
 
         for (const row of publicRows) {
             const existing = siteCountMap.get(row.siteId);
@@ -1517,6 +1603,7 @@ async function collectAccessibleSites(
                 siteCountMap.set(row.siteId, {
                     siteId: row.siteId,
                     name: row.name,
+                    niceId: row.niceId,
                     type: row.type,
                     online: row.online,
                     itemCount: Number(row.itemCount)
@@ -1540,6 +1627,7 @@ async function collectAccessibleSites(
             .select({
                 siteId: sites.siteId,
                 name: sites.name,
+                niceId: sites.niceId,
                 type: sites.type,
                 online: sites.online,
                 itemCount: countDistinct(siteResources.siteResourceId)
@@ -1551,7 +1639,13 @@ async function collectAccessibleSites(
             )
             .innerJoin(sites, eq(siteNetworks.siteId, sites.siteId))
             .where(and(...siteConditions))
-            .groupBy(sites.siteId, sites.name, sites.type, sites.online);
+            .groupBy(
+                sites.siteId,
+                sites.name,
+                sites.niceId,
+                sites.type,
+                sites.online
+            );
 
         for (const row of siteRows) {
             const existing = siteCountMap.get(row.siteId);
@@ -1561,6 +1655,7 @@ async function collectAccessibleSites(
                 siteCountMap.set(row.siteId, {
                     siteId: row.siteId,
                     name: row.name,
+                    niceId: row.niceId,
                     type: row.type,
                     online: row.online,
                     itemCount: Number(row.itemCount)
@@ -1675,6 +1770,7 @@ export async function listAccessibleLauncherSitesForUser(
         .map((row) => ({
             siteId: row.siteId,
             name: row.name,
+            niceId: row.niceId,
             type: row.type,
             online: row.online
         }))

server/routers/launcher/types.ts

@@ -32,6 +32,7 @@ export type LauncherLabel = {
 export type LauncherSiteInfo = {
     siteId: number;
     name: string;
+    niceId: string;
     type: string;
     online?: boolean;
 };
@@ -51,6 +52,7 @@ export type LauncherResource = {
     mode: string;
     labels: LauncherLabel[];
     site?: LauncherSiteInfo;
+    sites: LauncherSiteInfo[];
 };
 
 export type LauncherGroup = {
@@ -184,8 +186,7 @@ export function parseIdListParam(value: string | undefined): number[] {
 export const DEFAULT_LAUNCHER_VIEW_ID = "default" as const;
 
 export type LauncherViewSelection =
-    | { type: "default" }
+    { type: "default" } | { type: "saved"; viewId: number };
-    | { type: "saved"; viewId: number };
 
 export type LauncherScaleCapabilities = {
     allowSiteGrouping: boolean;

server/routers/newt/handleRequestLogMessage.ts

@@ -1,3 +1,16 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
 import { db } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import { sites, Newt, orgs, clients, clientSitesAssociationsCache, users } from "@server/db";

server/routers/org/adminDeleteOrg.ts

@@ -0,0 +1,98 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { deleteOrgById, sendTerminationMessages } from "@server/lib/deleteOrg";
+import { db, orgs } from "@server/db";
+import { eq } from "drizzle-orm";
+
+const adminDeleteOrgSchema = z.strictObject({
+    orgId: z.string()
+});
+
+export type AdminDeleteOrgResponse = {};
+
+registry.registerPath({
+    method: "delete",
+    path: "/admin/org/{orgId}",
+    description: "Delete any organization in the system (server admin).",
+    tags: [OpenAPITags.Org],
+    request: {
+        params: adminDeleteOrgSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function adminDeleteOrg(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = adminDeleteOrgSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+        const { orgId } = parsedParams.data;
+
+        const [org] = await db
+            .select()
+            .from(orgs)
+            .where(eq(orgs.orgId, orgId))
+            .limit(1);
+
+        if (!org) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    `Organization with ID ${orgId} not found`
+                )
+            );
+        }
+
+        const result = await deleteOrgById(orgId);
+        sendTerminationMessages(result);
+        return response(res, {
+            data: null,
+            success: true,
+            error: false,
+            message: "Organization deleted successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        if (createHttpError.isHttpError(error)) {
+            return next(error);
+        }
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred..."
+            )
+        );
+    }
+}

server/routers/org/adminListOrgs.ts

@@ -0,0 +1,241 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, users } from "@server/db";
+import { orgs, resources, sites, userOrgs } from "@server/db";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import { and, asc, desc, eq, like, or, sql, type SQL } from "drizzle-orm";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
+import type { PaginatedResponse } from "@server/types/Pagination";
+
+const adminListOrgsSchema = z.strictObject({
+    pageSize: z.coerce
+        .number<string>()
+        .int()
+        .positive()
+        .optional()
+        .catch(20)
+        .default(20)
+        .openapi({
+            type: "integer",
+            default: 20,
+            description: "Number of items per page"
+        }),
+    page: z.coerce
+        .number<string>()
+        .int()
+        .positive()
+        .optional()
+        .catch(1)
+        .default(1)
+        .openapi({
+            type: "integer",
+            default: 1,
+            description: "Page number to retrieve"
+        }),
+    query: z.string().optional(),
+    sort_by: z
+        .enum(["name", "createdAt"])
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "string",
+            enum: ["name", "createdAt"],
+            description: "Field to sort by"
+        }),
+    order: z
+        .enum(["asc", "desc"])
+        .optional()
+        .default("asc")
+        .catch("asc")
+        .openapi({
+            type: "string",
+            enum: ["asc", "desc"],
+            default: "asc",
+            description: "Sort order"
+        })
+});
+
+export type AdminOrgRow = {
+    orgId: string;
+    name: string;
+    subnet: string | null;
+    utilitySubnet: string | null;
+    createdAt: string | null;
+    userCount: number;
+    siteCount: number;
+    resourceCount: number;
+    owner: {
+        userId: string;
+        username: string;
+    } | null;
+};
+
+export type AdminListOrgsResponse = PaginatedResponse<{
+    orgs: AdminOrgRow[];
+}>;
+
+const AdminListOrgsResponseDataSchema = z.object({
+    orgs: z.array(
+        z.object({
+            orgId: z.string(),
+            name: z.string(),
+            subnet: z.string().nullable(),
+            createdAt: z.string().nullable(),
+            userCount: z.number(),
+            siteCount: z.number(),
+            resourceCount: z.number()
+        })
+    ),
+    pagination: z.object({
+        total: z.number(),
+        page: z.number(),
+        pageSize: z.number()
+    })
+});
+
+registry.registerPath({
+    method: "get",
+    path: "/admin/orgs",
+    description:
+        "List all organizations in the system with usage counts (server admin).",
+    tags: [OpenAPITags.Org],
+    request: {
+        query: adminListOrgsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        AdminListOrgsResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
+});
+
+export async function adminListOrgs(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedQuery = adminListOrgsSchema.safeParse(req.query);
+        if (!parsedQuery.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedQuery.error)
+                )
+            );
+        }
+
+        const { pageSize, page, query, sort_by, order } = parsedQuery.data;
+
+        let conditions: (SQL<unknown> | undefined)[] = [];
+        if (query) {
+            const q = "%" + query.toLowerCase() + "%";
+            conditions.push(
+                or(
+                    like(sql`LOWER(${orgs.name})`, q),
+                    like(sql`LOWER(${orgs.orgId})`, q),
+                    like(sql`LOWER(${orgs.subnet})`, q)
+                )
+            );
+        }
+
+        const sortColumns = {
+            name: orgs.name,
+            createdAt: orgs.createdAt
+        } as const;
+
+        const orderBy = sort_by
+            ? order === "asc"
+                ? asc(sortColumns[sort_by])
+                : desc(sortColumns[sort_by])
+            : asc(orgs.name);
+
+        // Drizzle renders bare column references in the select list without their
+        // table prefix, which would make a correlated subquery compare a column to
+        // itself, so the outer `orgs` side is qualified explicitly.
+        const orgIdRef = sql`${sql.identifier("orgs")}.${sql.identifier("orgId")}`;
+
+        const [countRows, rows] = await Promise.all([
+            db
+                .select({ count: sql<number>`count(*)` })
+                .from(orgs)
+                .where(and(...conditions)),
+            db
+                .selectDistinct({
+                    orgId: orgs.orgId,
+                    name: orgs.name,
+                    subnet: orgs.subnet,
+                    utilitySubnet: orgs.utilitySubnet,
+                    createdAt: orgs.createdAt,
+                    userCount: sql<number>`(
+                        SELECT COUNT(*)
+                        FROM ${userOrgs}
+                        WHERE ${userOrgs.orgId} = ${orgIdRef}
+                    )`.as("userCount"),
+                    siteCount: sql<number>`(
+                        SELECT COUNT(*)
+                        FROM ${sites}
+                        WHERE ${sites.orgId} = ${orgIdRef}
+                    )`.as("siteCount"),
+                    resourceCount: sql<number>`(
+                        SELECT COUNT(*)
+                        FROM ${resources}
+                        WHERE ${resources.orgId} = ${orgIdRef}
+                    )`.as("resourceCount"),
+                    owner: {
+                        userId: users.userId,
+                        username: users.username
+                    }
+                })
+                .from(orgs)
+                .where(and(...conditions, eq(userOrgs.isOwner, true)))
+                .leftJoin(userOrgs, eq(userOrgs.orgId, orgs.orgId))
+                .leftJoin(users, eq(userOrgs.userId, users.userId))
+                .limit(pageSize)
+                .offset(pageSize * (page - 1))
+                .orderBy(orderBy)
+        ]);
+
+        const totalCount = Number(countRows[0]?.count ?? 0);
+
+        return response<AdminListOrgsResponse>(res, {
+            data: {
+                orgs: rows.map((row) => ({
+                    ...row,
+                    userCount: Number(row.userCount ?? 0),
+                    siteCount: Number(row.siteCount ?? 0),
+                    resourceCount: Number(row.resourceCount ?? 0)
+                })),
+                pagination: {
+                    total: totalCount,
+                    page,
+                    pageSize
+                }
+            },
+            success: true,
+            error: false,
+            message: "Organizations retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(
+                HttpCode.INTERNAL_SERVER_ERROR,
+                "An error occurred..."
+            )
+        );
+    }
+}

server/routers/org/index.ts

@@ -9,3 +9,5 @@ export * from "./listOrgs";
 export * from "./pickOrgDefaults";
 export * from "./checkOrgUserAccess";
 export * from "./resetOrgBandwidth";
+export * from "./adminListOrgs";
+export * from "./adminDeleteOrg";

server/routers/user/adminListUsers.ts

@@ -4,7 +4,7 @@ import { db, idp, users } from "@server/db";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
-import { and, asc, desc, eq, like, or, sql } from "drizzle-orm";
+import { and, asc, desc, eq, like, or, sql, type SQL } from "drizzle-orm";
 import logger from "@server/logger";
 import { fromZodError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
@@ -88,6 +88,15 @@ const listUsersSchema = z.strictObject({
             type: "boolean",
             description:
                 "Filter by 2FA state matching: enabled if twoFactorEnabled or twoFactorSetupRequested"
+        }),
+    server_admin: z
+        .enum(["true", "false"])
+        .transform((v) => v === "true")
+        .optional()
+        .catch(undefined)
+        .openapi({
+            type: "boolean",
+            description: "Filter by server admin status"
         })
 });
 
@@ -177,7 +186,8 @@ export async function adminListUsers(
             sort_by,
             order,
             idp_id,
-            two_factor: twoFactorFilter
+            two_factor: twoFactorFilter,
+            server_admin: serverAdminFilter
         } = parsedQuery.data;
 
         if (typeof idp_id === "number") {
@@ -196,7 +206,7 @@ export async function adminListUsers(
             }
         }
 
-        const conditions = [eq(users.serverAdmin, false)];
+        const conditions: Array<SQL<unknown> | undefined> = [];
 
         if (query) {
             const q = "%" + query.toLowerCase() + "%";
@@ -233,6 +243,10 @@ export async function adminListUsers(
             }
         }
 
+        if (typeof serverAdminFilter === "boolean") {
+            conditions.push(eq(users.serverAdmin, serverAdminFilter));
+        }
+
         const whereClause = and(...conditions);
 
         const countQuery = db.$count(

server/routers/user/adminSetServerAdmin.ts

@@ -0,0 +1,151 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, users } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { createApiResponseSchema } from "@server/lib/openapi/createApiResponseSchema";
+
+const setServerAdminParamsSchema = z.strictObject({
+    userId: z.string()
+});
+
+const setServerAdminBodySchema = z.strictObject({
+    serverAdmin: z.boolean()
+});
+
+export type AdminSetServerAdminResponse = {
+    userId: string;
+    serverAdmin: boolean;
+};
+
+const AdminSetServerAdminResponseDataSchema = z.object({
+    userId: z.string(),
+    serverAdmin: z.boolean()
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/user/{userId}/server-admin",
+    description:
+        "Promote or demote a user's server admin status (server admin).",
+    tags: [OpenAPITags.User],
+    request: {
+        params: setServerAdminParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setServerAdminBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: createApiResponseSchema(
+                        AdminSetServerAdminResponseDataSchema
+                    )
+                }
+            }
+        }
+    }
+});
+
+export async function adminSetServerAdmin(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = setServerAdminParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const parsedBody = setServerAdminBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { userId } = parsedParams.data;
+        const { serverAdmin } = parsedBody.data;
+
+        const [existingUser] = await db
+            .select({
+                userId: users.userId,
+                serverAdmin: users.serverAdmin,
+                type: users.type
+            })
+            .from(users)
+            .where(eq(users.userId, userId))
+            .limit(1);
+
+        if (!existingUser) {
+            return next(createHttpError(HttpCode.NOT_FOUND, "User not found"));
+        }
+
+        if (existingUser.type !== "internal") {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "Server admin status can only be changed for internal users"
+                )
+            );
+        }
+
+        if (!serverAdmin && req.user?.userId === userId) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "You cannot remove your own server admin status"
+                )
+            );
+        }
+
+        if (existingUser.serverAdmin !== serverAdmin) {
+            logger.info(
+                `${serverAdmin ? "Promoting" : "Demoting"} user ${userId} ${serverAdmin ? "to" : "from"} server admin (by ${req.user?.userId})`
+            );
+
+            await db
+                .update(users)
+                .set({ serverAdmin })
+                .where(eq(users.userId, userId));
+        }
+
+        return response<AdminSetServerAdminResponse>(res, {
+            data: {
+                userId: existingUser.userId,
+                serverAdmin
+            },
+            success: true,
+            error: false,
+            message: serverAdmin
+                ? "User promoted to server admin successfully"
+                : "User demoted from server admin successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/user/index.ts

@@ -11,6 +11,7 @@ export * from "./adminListUsers";
 export * from "./adminRemoveUser";
 export * from "./adminGetUser";
 export * from "./adminGeneratePasswordResetCode";
+export * from "./adminSetServerAdmin";
 export * from "./listInvitations";
 export * from "./removeInvitation";
 export * from "./createOrgUser";

server/routers/user/listUsers.ts

@@ -95,22 +95,34 @@ const listUsersSchema = z.strictObject({
                 'Filter by identity provider id, or "internal" for internal users'
         }),
     role_id: z
-        .preprocess((val) => {
+        .preprocess(
+            (val) => {
                 if (val === undefined || val === null || val === "") {
                     return undefined;
                 }
                 const raw = Array.isArray(val) ? val : [val];
+                const includeOwner = raw.some((v) => v === "owner");
                 const nums = raw
                     .map((v) =>
                         typeof v === "string" ? parseInt(v, 10) : Number(v)
                     )
                     .filter((n) => Number.isInteger(n) && n > 0);
                 const unique = [...new Set(nums)];
-            return unique.length ? unique : undefined;
+                if (!unique.length && !includeOwner) {
-        }, z.array(z.number().int().positive()).optional())
+                    return undefined;
+                }
+                return { roleIds: unique, includeOwner };
+            },
+            z
+                .object({
+                    roleIds: z.array(z.number().int().positive()),
+                    includeOwner: z.boolean()
+                })
+                .optional()
+        )
         .openapi({
             description:
-                "Filter users who have any of these role ids in the organization (repeat query param)"
+                'Filter users who have any of these role ids in the organization, or "owner" for organization owners (repeat query param)'
         })
 });
 
@@ -193,7 +205,8 @@ export async function listUsers(
         }
         const { page, pageSize, sort_by, order, query, idp_id, role_id } =
             parsedQuery.data;
-        const roleIds = role_id ?? [];
+        const roleIds = role_id?.roleIds ?? [];
+        const includeOwner = role_id?.includeOwner ?? false;
 
         const parsedParams = listUsersParamsSchema.safeParse(req.params);
         if (!parsedParams.success) {
@@ -267,8 +280,15 @@ export async function listUsers(
             conditions.push(eq(users.idpId, idp_id));
         }
 
+        if (roleIds.length > 0 || includeOwner) {
+            const roleFilterParts = [];
+
+            if (includeOwner) {
+                roleFilterParts.push(eq(userOrgs.isOwner, true));
+            }
+
             if (roleIds.length > 0) {
-            conditions.push(
+                roleFilterParts.push(
                     exists(
                         db
                             .select()
@@ -284,6 +304,13 @@ export async function listUsers(
                 );
             }
 
+            if (roleFilterParts.length === 1) {
+                conditions.push(roleFilterParts[0]);
+            } else if (roleFilterParts.length > 1) {
+                conditions.push(or(...roleFilterParts));
+            }
+        }
+
         const countQuery = db.$count(
             queryUsersBase()
                 .where(and(...conditions))

server/setup/migrationsPg.ts

@@ -66,12 +66,6 @@ const migrations = [
 
 await run();
 
-// The pg Pool is created with allowExitOnIdle: false (see poolConfig.ts) so
-// its sockets keep the event loop alive even when idle. Without an explicit
-// exit here, this one-shot script would hang until the pool's
-// idleTimeoutMillis elapses before the process could terminate.
-process.exit(0);
-
 async function run() {
     // run the migrations
     await runMigrations();

src/app/[orgId]/loading.tsx

@@ -1,9 +1,5 @@
-import { Loader2 } from "lucide-react";
+import OrgRouteLoading from "@app/components/OrgRouteLoading";
 
 export default function OrgPageLoading() {
-    return (
+    return <OrgRouteLoading />;
-        <div className="flex items-center justify-center py-16">
-            <Loader2 className="size-6 animate-spin text-muted-foreground" />
-        </div>
-    );
 }

src/app/[orgId]/settings/(private)/remote-exit-nodes/page.tsx

@@ -10,7 +10,6 @@ import { getTranslations } from "next-intl/server";
 import type { Metadata } from "next";
 import { build } from "@server/build";
 import { redirect } from "next/navigation";
-import { useEnvContext } from "@app/hooks/useEnvContext";
 
 export const metadata: Metadata = {
     title: "Remote Exit Nodes"
@@ -25,6 +24,10 @@ export const dynamic = "force-dynamic";
 export default async function RemoteExitNodesPage(
     props: RemoteExitNodesPageProps
 ) {
+    if (build != "saas") {
+        redirect("/");
+    }
+
     const params = await props.params;
     let remoteExitNodes: ListRemoteExitNodesResponse["remoteExitNodes"] = [];
     try {

src/app/[orgId]/settings/access/users/[userId]/general/page.tsx

@@ -38,7 +38,7 @@ import { useEffect, useState } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
 
-export default function AccessControlsPage() {
+export default function GeneralPage() {
     const { orgUser: user, updateOrgUser } = userOrgUserContext();
     const { user: sessionUser } = useUserContext();
     const { env } = useEnvContext();
@@ -57,7 +57,7 @@ export default function AccessControlsPage() {
             (build === "enterprise" && !isPaid) ||
             (build === "oss" && !isPaid));
 
-    const accessControlsFormSchema = z.object({
+    const generalFormSchema = z.object({
         username: z.string(),
         autoProvisioned: z.boolean(),
         roles: z
@@ -72,7 +72,7 @@ export default function AccessControlsPage() {
     });
 
     const form = useForm({
-        resolver: zodResolver(accessControlsFormSchema),
+        resolver: zodResolver(generalFormSchema),
         defaultValues: {
             username: user.username!,
             autoProvisioned: user.autoProvisioned || false,
@@ -155,7 +155,7 @@ export default function AccessControlsPage() {
         }
     }
 
-    async function handleAccessControlsSubmit(e: React.FormEvent) {
+    async function handleGeneralSubmit(e: React.FormEvent) {
         e.preventDefault();
 
         const isValid = await form.trigger();
@@ -196,11 +196,9 @@ export default function AccessControlsPage() {
 
             <SettingsSection>
                 <SettingsSectionHeader>
-                    <SettingsSectionTitle>
+                    <SettingsSectionTitle>{t("general")}</SettingsSectionTitle>
-                        {t("accessControls")}
-                    </SettingsSectionTitle>
                     <SettingsSectionDescription>
-                        {t("accessControlsDescription")}
+                        {t("userGeneralSettingsDescription")}
                     </SettingsSectionDescription>
                 </SettingsSectionHeader>
 
@@ -208,11 +206,9 @@ export default function AccessControlsPage() {
                     <SettingsSectionForm>
                         <Form {...form}>
                             <form
-                                onSubmit={(e) =>
+                                onSubmit={(e) => void handleGeneralSubmit(e)}
-                                    void handleAccessControlsSubmit(e)
-                                }
                                 className="space-y-4"
-                                id="access-controls-form"
+                                id="user-general-form"
                             >
                                 {user.type !== UserType.Internal &&
                                     user.idpType && (
@@ -281,9 +277,9 @@ export default function AccessControlsPage() {
                         type="submit"
                         loading={isSaving}
                         disabled={isSaving}
-                        form="access-controls-form"
+                        form="user-general-form"
                     >
-                        {t("accessControlsSubmit")}
+                        {t("saveSettings")}
                     </Button>
                 </SettingsSectionFooter>
             </SettingsSection>

src/app/[orgId]/settings/access/users/[userId]/layout.tsx

@@ -9,15 +9,16 @@ import { cache } from "react";
 import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
 import { getTranslations } from "next-intl/server";
 import type { Metadata } from "next";
+import { getUserDisplayName } from "@app/lib/getUserDisplayName";
 
 export const metadata: Metadata = {
     title: "User"
 };
 
-interface UserLayoutProps {
+type UserLayoutProps = {
     children: React.ReactNode;
     params: Promise<{ userId: string; orgId: string }>;
-}
+};
 
 export default async function UserLayoutProps(props: UserLayoutProps) {
     const params = await props.params;
@@ -42,15 +43,23 @@ export default async function UserLayoutProps(props: UserLayoutProps) {
 
     const navItems = [
         {
-            title: t("accessControls"),
+            title: t("general"),
-            href: "/{orgId}/settings/access/users/{userId}/access-controls"
+            href: "/{orgId}/settings/access/users/{userId}/general"
         }
     ];
 
     return (
         <>
             <SettingsSectionTitle
-                title={`${user?.email}`}
+                title={
+                    user
+                        ? getUserDisplayName({
+                              email: user.email,
+                              name: user.name,
+                              username: user.username
+                          })
+                        : ""
+                }
                 description={t("userDescription2")}
             />
             <OrgUserProvider orgUser={user}>

src/app/[orgId]/settings/access/users/[userId]/page.tsx

@@ -9,5 +9,5 @@ export default async function UserPage(props: {
     params: Promise<{ orgId: string; userId: string }>;
 }) {
     const { orgId, userId } = await props.params;
-    redirect(`/${orgId}/settings/access/users/${userId}/access-controls`);
+    redirect(`/${orgId}/settings/access/users/${userId}/general`);
 }

src/app/[orgId]/settings/access/users/create/page.tsx

@@ -1,24 +1,20 @@
 "use client";
 
+import CopyTextBox from "@app/components/CopyTextBox";
 import {
-    SettingsContainer,
+    Credenza,
-    SettingsSection,
+    CredenzaBody,
-    SettingsSectionBody,
+    CredenzaContent,
-    SettingsSectionDescription,
+    CredenzaDescription,
-    SettingsSectionForm,
+    CredenzaFooter,
-    SettingsSectionHeader,
+    CredenzaHeader,
-    SettingsSectionTitle
+    CredenzaTitle
-} from "@app/components/Settings";
+} from "@app/components/Credenza";
-import { StrategyOption, StrategySelect } from "@app/components/StrategySelect";
+import { StrategySelect } from "@app/components/StrategySelect";
 import HeaderTitle from "@app/components/SettingsSectionTitle";
 import { Button } from "@app/components/ui/button";
 import { useParams, useRouter } from "next/navigation";
-import {
+import { useActionState, useRef, useState, startTransition } from "react";
-    useActionState,
-    useRef,
-    useState,
-    startTransition
-} from "react";
 import {
     Form,
     FormControl,
@@ -42,7 +38,6 @@ import { AxiosResponse } from "axios";
 import { useEffect } from "react";
 import { useForm } from "react-hook-form";
 import { z } from "zod";
-import CopyTextBox from "@app/components/CopyTextBox";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { ListRolesResponse } from "@server/routers/role";
 import { formatAxiosError } from "@app/lib/api";
@@ -55,7 +50,15 @@ import IdpTypeIcon from "@app/components/IdpTypeIcon";
 import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import OrgRolesTagField from "@app/components/OrgRolesTagField";
-import CopyToClipboard from "@app/components/CopyToClipboard";
+import {
+    SettingsContainer,
+    SettingsSection,
+    SettingsSectionBody,
+    SettingsSectionDescription,
+    SettingsSectionForm,
+    SettingsSectionHeader,
+    SettingsSectionTitle
+} from "@app/components/Settings";
 
 type UserType = "internal" | "oidc";
 
@@ -96,6 +99,7 @@ export default function Page() {
         "internal"
     );
     const [inviteLink, setInviteLink] = useState<string | null>(null);
+    const [isInviteDialogOpen, setIsInviteDialogOpen] = useState(false);
 
     const [expiresInDays, setExpiresInDays] = useState(1);
     const [roles, setRoles] = useState<{ roleId: number; name: string }[]>([]);
@@ -246,9 +250,9 @@ export default function Page() {
                 build === "saas" || env.app.identityProviderMode === "org";
 
             const res = await api
-                .get<
+                .get<AxiosResponse<ListIdpsResponse>>(
-                    AxiosResponse<ListIdpsResponse>
+                    useOrgIdps ? `/org/${orgId}/idp` : "/idp"
-                >(useOrgIdps ? `/org/${orgId}/idp` : "/idp")
+                )
                 .catch((e) => {
                     console.error(e);
                     toast({
@@ -350,13 +354,13 @@ export default function Page() {
 
         if (res && res.status === 200) {
             setInviteLink(res.data.data.inviteLink);
+            setExpiresInDays(parseInt(values.validForHours) / 24);
+            setIsInviteDialogOpen(true);
             toast({
                 variant: "default",
                 title: t("userInvited"),
                 description: t("userInvitedDescription")
             });
-
-            setExpiresInDays(parseInt(values.validForHours) / 24);
         }
     }
 
@@ -460,6 +464,7 @@ export default function Page() {
             setSendEmail(env.email.emailEnabled);
             internalForm.reset();
             setInviteLink(null);
+            setIsInviteDialogOpen(false);
             setExpiresInDays(1);
         } else {
             googleAzureForm.reset();
@@ -486,7 +491,7 @@ export default function Page() {
 
             <div>
                 <SettingsContainer>
-                    {!inviteLink && userOptions.length > 1 ? (
+                    {userOptions.length > 1 ? (
                         <SettingsSection>
                             <SettingsSectionHeader>
                                 <SettingsSectionTitle>
@@ -508,8 +513,6 @@ export default function Page() {
                     ) : null}
 
                     {selectedOption === "internal" && dataLoaded && (
-                        <>
-                            {!inviteLink ? (
                         <SettingsSection>
                             <SettingsSectionHeader>
                                 <SettingsSectionTitle>
@@ -533,9 +536,7 @@ export default function Page() {
                                             id="create-user-form"
                                         >
                                             <FormField
-                                                        control={
+                                                control={internalForm.control}
-                                                            internalForm.control
-                                                        }
                                                 name="email"
                                                 render={({ field }) => (
                                                     <FormItem>
@@ -543,26 +544,40 @@ export default function Page() {
                                                             {t("email")}
                                                         </FormLabel>
                                                         <FormControl>
-                                                                    <Input
+                                                            <Input {...field} />
-                                                                        {...field}
-                                                                    />
                                                         </FormControl>
                                                         <FormMessage />
                                                     </FormItem>
                                                 )}
                                             />
 
-                                                    <FormField
+                                            {env.email.emailEnabled && (
-                                                        control={
+                                                <div className="flex items-center space-x-2">
-                                                            internalForm.control
+                                                    <Checkbox
+                                                        id="send-email"
+                                                        checked={sendEmail}
+                                                        onCheckedChange={(e) =>
+                                                            setSendEmail(
+                                                                e as boolean
+                                                            )
                                                         }
+                                                    />
+                                                    <label
+                                                        htmlFor="send-email"
+                                                        className="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
+                                                    >
+                                                        {t("inviteEmailSent")}
+                                                    </label>
+                                                </div>
+                                            )}
+
+                                            <FormField
+                                                control={internalForm.control}
                                                 name="validForHours"
                                                 render={({ field }) => (
                                                     <FormItem>
                                                         <FormLabel>
-                                                                    {t(
+                                                            {t("inviteValid")}
-                                                                        "inviteValid"
-                                                                    )}
                                                         </FormLabel>
                                                         <Select
                                                             onValueChange={
@@ -619,66 +634,11 @@ export default function Page() {
                                                     invitePaywallMessage
                                                 }
                                             />
-
-                                                    {env.email.emailEnabled && (
-                                                        <div className="flex items-center space-x-2">
-                                                            <Checkbox
-                                                                id="send-email"
-                                                                checked={
-                                                                    sendEmail
-                                                                }
-                                                                onCheckedChange={(
-                                                                    e
-                                                                ) =>
-                                                                    setSendEmail(
-                                                                        e as boolean
-                                                                    )
-                                                                }
-                                                            />
-                                                            <label
-                                                                htmlFor="send-email"
-                                                                className="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70"
-                                                            >
-                                                                {t(
-                                                                    "inviteEmailSent"
-                                                                )}
-                                                            </label>
-                                                        </div>
-                                                    )}
                                         </form>
                                     </Form>
                                 </SettingsSectionForm>
                             </SettingsSectionBody>
                         </SettingsSection>
-                            ) : (
-                                <SettingsSection>
-                                    <SettingsSectionHeader>
-                                        <SettingsSectionTitle>
-                                            {t("userInvited")}
-                                        </SettingsSectionTitle>
-                                        <SettingsSectionDescription>
-                                            {sendEmail
-                                                ? t(
-                                                      "inviteEmailSentDescription"
-                                                  )
-                                                : t("inviteSentDescription")}
-                                        </SettingsSectionDescription>
-                                    </SettingsSectionHeader>
-                                    <SettingsSectionBody>
-                                        <div className="space-y-4">
-                                            <p>
-                                                {t("inviteExpiresIn", {
-                                                    days: expiresInDays
-                                                })}
-                                            </p>
-                                            <CopyToClipboard
-                                                text={inviteLink}
-                                            />
-                                        </div>
-                                    </SettingsSectionBody>
-                                </SettingsSection>
-                            )}
-                        </>
                     )}
 
                     {selectedOption &&
@@ -898,24 +858,56 @@ export default function Page() {
                 <div className="flex justify-end space-x-2 mt-8">
                     {selectedOption && dataLoaded && (
                         <Button
-                            type={inviteLink ? "button" : "submit"}
+                            type="submit"
-                            form={inviteLink ? undefined : "create-user-form"}
+                            form="create-user-form"
                             loading={loading}
                             disabled={loading}
-                            onClick={
-                                inviteLink
-                                    ? () =>
-                                          router.push(
-                                              `/${orgId}/settings/access/users`
-                                          )
-                                    : undefined
-                            }
                         >
-                            {inviteLink ? t("done") : t("accessUserCreate")}
+                            {t("accessUserCreate")}
                         </Button>
                     )}
                 </div>
             </div>
+
+            <Credenza
+                open={isInviteDialogOpen}
+                onOpenChange={(open) => {
+                    setIsInviteDialogOpen(open);
+                    if (!open) {
+                        setInviteLink(null);
+                    }
+                }}
+            >
+                <CredenzaContent>
+                    <CredenzaHeader>
+                        <CredenzaTitle>{t("userInvited")}</CredenzaTitle>
+                        <CredenzaDescription>
+                            {sendEmail
+                                ? t("inviteEmailSentDescription")
+                                : t("inviteSentDescription")}
+                        </CredenzaDescription>
+                    </CredenzaHeader>
+                    <CredenzaBody>
+                        <div className="space-y-4">
+                            <p>
+                                {t("inviteExpiresIn", {
+                                    days: expiresInDays
+                                })}
+                            </p>
+                            {inviteLink && <CopyTextBox text={inviteLink} />}
+                        </div>
+                    </CredenzaBody>
+                    <CredenzaFooter>
+                        <Button
+                            onClick={() =>
+                                router.push(`/${orgId}/settings/access/users`)
+                            }
+                        >
+                            {t("done")}
+                        </Button>
+                    </CredenzaFooter>
+                </CredenzaContent>
+            </Credenza>
         </>
     );
 }

src/app/[orgId]/settings/access/users/page.tsx

@@ -78,12 +78,13 @@ export default async function UsersPage(props: UsersPageProps) {
         rolesRes && rolesRes.status === 200
             ? (rolesRes.data.data.roles ?? [])
             : [];
-    const roleFilterOptions = orgRoles.map(
+    const roleFilterOptions = [
-        (r: ListRolesResponse["roles"][number]) => ({
+        { value: "owner", label: t("accessRoleOwner") },
+        ...orgRoles.map((r: ListRolesResponse["roles"][number]) => ({
             value: String(r.roleId),
             label: r.name
-        })
+        }))
-    );
+    ];
 
     const invitationsRes = await internal
         .get(
@@ -126,9 +127,7 @@ export default async function UsersPage(props: UsersPageProps) {
             idpId: user.idpId,
             idpName: user.idpName || t("idpNameInternal"),
             status: t("userConfirmed"),
-            roleLabels: user.isOwner
+            roleLabels: (() => {
-                ? [t("accessRoleOwner")]
-                : (() => {
                 const names = (user.roles ?? [])
                     .map((r) => r.roleName)
                     .filter((n): n is string => Boolean(n?.length));

src/app/[orgId]/settings/api-keys/create/page.tsx

@@ -43,10 +43,18 @@ import {
 } from "@app/components/InfoSection";
 import CopyToClipboard from "@app/components/CopyToClipboard";
 import moment from "moment";
-import CopyCodeBox from "@server/emails/templates/components/CopyCodeBox";
 import CopyTextBox from "@app/components/CopyTextBox";
 import PermissionsSelectBox from "@app/components/PermissionsSelectBox";
 import { useTranslations } from "next-intl";
+import {
+    Credenza,
+    CredenzaBody,
+    CredenzaContent,
+    CredenzaDescription,
+    CredenzaFooter,
+    CredenzaHeader,
+    CredenzaTitle
+} from "@app/components/Credenza";
 
 export default function Page() {
     const { env } = useEnvContext();
@@ -58,6 +66,7 @@ export default function Page() {
     const [loadingPage, setLoadingPage] = useState(true);
     const [createLoading, setCreateLoading] = useState(false);
     const [apiKey, setApiKey] = useState<CreateOrgApiKeyResponse | null>(null);
+    const [isApiKeyDialogOpen, setIsApiKeyDialogOpen] = useState(false);
     const [selectedPermissions, setSelectedPermissions] = useState<
         Record<string, boolean>
     >({});
@@ -75,22 +84,6 @@ export default function Page() {
 
     type CreateFormValues = z.infer<typeof createFormSchema>;
 
-    const copiedFormSchema = z
-        .object({
-            copied: z.boolean()
-        })
-        .refine(
-            (data) => {
-                return data.copied;
-            },
-            {
-                message: t("apiKeysConfirmCopy2"),
-                path: ["copied"]
-            }
-        );
-
-    type CopiedFormValues = z.infer<typeof copiedFormSchema>;
-
     const form = useForm({
         resolver: zodResolver(createFormSchema),
         defaultValues: {
@@ -98,12 +91,9 @@ export default function Page() {
         }
     });
 
-    const copiedForm = useForm({
+    function goToApiKeysList() {
-        resolver: zodResolver(copiedFormSchema),
+        router.push(`/${orgId}/settings/api-keys`);
-        defaultValues: {
-            copied: true
     }
-    });
 
     async function onSubmit(data: CreateFormValues) {
         setCreateLoading(true);
@@ -113,9 +103,10 @@ export default function Page() {
         };
 
         const res = await api
-            .put<
+            .put<AxiosResponse<CreateOrgApiKeyResponse>>(
-                AxiosResponse<CreateOrgApiKeyResponse>
+                `/org/${orgId}/api-key/`,
-            >(`/org/${orgId}/api-key/`, payload)
+                payload
+            )
             .catch((e) => {
                 toast({
                     variant: "destructive",
@@ -125,16 +116,10 @@ export default function Page() {
             });
 
         if (res && res.status === 201) {
-            const data = res.data.data;
+            const created = res.data.data;
-
-            console.log({
-                actionIds: Object.keys(selectedPermissions).filter(
-                    (key) => selectedPermissions[key]
-                )
-            });
 
             const actionsRes = await api
-                .post(`/org/${orgId}/api-key/${data.apiKeyId}/actions`, {
+                .post(`/org/${orgId}/api-key/${created.apiKeyId}/actions`, {
                     actionIds: Object.keys(selectedPermissions).filter(
                         (key) => selectedPermissions[key]
                     )
@@ -149,27 +134,14 @@ export default function Page() {
                 });
 
             if (actionsRes) {
-                setApiKey(data);
+                setApiKey(created);
+                setIsApiKeyDialogOpen(true);
             }
         }
 
         setCreateLoading(false);
     }
 
-    async function onCopiedSubmit(data: CopiedFormValues) {
-        if (!data.copied) {
-            return;
-        }
-
-        router.push(`/${orgId}/settings/api-keys`);
-    }
-
-    const formatLabel = (str: string) => {
-        return str
-            .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
-            .replace(/^./, (char) => char.toUpperCase());
-    };
-
     useEffect(() => {
         const load = async () => {
             setLoadingPage(false);
@@ -185,12 +157,7 @@ export default function Page() {
                     title={t("apiKeysCreate")}
                     description={t("apiKeysCreateDescription")}
                 />
-                <Button
+                <Button variant="outline" onClick={goToApiKeysList}>
-                    variant="outline"
-                    onClick={() => {
-                        router.push(`/${orgId}/settings/api-keys`);
-                    }}
-                >
                     {t("apiKeysSeeAll")}
                 </Button>
             </div>
@@ -198,8 +165,6 @@ export default function Page() {
             {!loadingPage && (
                 <div>
                     <SettingsContainer>
-                        {!apiKey && (
-                            <>
                         <SettingsSection>
                             <SettingsSectionHeader>
                                 <SettingsSectionTitle>
@@ -212,7 +177,7 @@ export default function Page() {
                                         <form
                                             onKeyDown={(e) => {
                                                 if (e.key === "Enter") {
-                                                            e.preventDefault(); // block default enter refresh
+                                                    e.preventDefault();
                                                 }
                                             }}
                                             className="space-y-4"
@@ -248,31 +213,60 @@ export default function Page() {
                                     {t("apiKeysGeneralSettings")}
                                 </SettingsSectionTitle>
                                 <SettingsSectionDescription>
-                                            {t(
+                                    {t("apiKeysGeneralSettingsDescription")}
-                                                "apiKeysGeneralSettingsDescription"
-                                            )}
                                 </SettingsSectionDescription>
                             </SettingsSectionHeader>
                             <SettingsSectionBody>
                                 <PermissionsSelectBox
-                                            selectedPermissions={
+                                    selectedPermissions={selectedPermissions}
-                                                selectedPermissions
-                                            }
                                     onChange={setSelectedPermissions}
                                 />
                             </SettingsSectionBody>
                         </SettingsSection>
-                            </>
+                    </SettingsContainer>
+
+                    <div className="flex justify-end space-x-2 mt-8">
+                        <Button
+                            type="button"
+                            variant="outline"
+                            disabled={createLoading || apiKey !== null}
+                            onClick={goToApiKeysList}
+                        >
+                            {t("cancel")}
+                        </Button>
+                        <Button
+                            type="button"
+                            loading={createLoading}
+                            disabled={createLoading || apiKey !== null}
+                            onClick={() => {
+                                form.handleSubmit(onSubmit)();
+                            }}
+                        >
+                            {t("generate")}
+                        </Button>
+                    </div>
+                </div>
             )}
 
+            <Credenza
+                open={isApiKeyDialogOpen}
+                onOpenChange={(open) => {
+                    setIsApiKeyDialogOpen(open);
+                    if (!open && apiKey) {
+                        goToApiKeysList();
+                    }
+                }}
+            >
+                <CredenzaContent>
+                    <CredenzaHeader>
+                        <CredenzaTitle>{t("apiKeysList")}</CredenzaTitle>
+                        <CredenzaDescription>
+                            {t("apiKeysSaveDescription")}
+                        </CredenzaDescription>
+                    </CredenzaHeader>
+                    <CredenzaBody>
                         {apiKey && (
-                            <SettingsSection>
+                            <div className="space-y-4">
-                                <SettingsSectionHeader>
-                                    <SettingsSectionTitle>
-                                        {t("apiKeysList")}
-                                    </SettingsSectionTitle>
-                                </SettingsSectionHeader>
-                                <SettingsSectionBody>
                                 <InfoSections cols={2}>
                                     <InfoSection>
                                         <InfoSectionTitle>
@@ -289,9 +283,9 @@ export default function Page() {
                                             {t("created")}
                                         </InfoSectionTitle>
                                         <InfoSectionContent>
-                                                {moment(
+                                            {moment(apiKey.createdAt).format(
-                                                    apiKey.createdAt
+                                                "lll"
-                                                ).format("lll")}
+                                            )}
                                         </InfoSectionContent>
                                     </InfoSection>
                                 </InfoSections>
@@ -306,98 +300,17 @@ export default function Page() {
                                     </AlertDescription>
                                 </Alert>
 
-                                    {/* <h4 className="font-semibold"> */}
-                                    {/*     {t('apiKeysInfo')} */}
-                                    {/* </h4> */}
-
                                 <CopyTextBox
                                     text={`${apiKey.apiKeyId}.${apiKey.apiKey}`}
                                 />
-
-                                    {/* <Form {...copiedForm}> */}
-                                    {/*     <form */}
-                                    {/*         className="space-y-4" */}
-                                    {/*         id="copied-form" */}
-                                    {/*     > */}
-                                    {/*         <FormField */}
-                                    {/*             control={copiedForm.control} */}
-                                    {/*             name="copied" */}
-                                    {/*             render={({ field }) => ( */}
-                                    {/*                 <FormItem> */}
-                                    {/*                     <div className="flex items-center space-x-2"> */}
-                                    {/*                         <Checkbox */}
-                                    {/*                             id="terms" */}
-                                    {/*                             defaultChecked={ */}
-                                    {/*                                 copiedForm.getValues( */}
-                                    {/*                                     "copied" */}
-                                    {/*                                 ) as boolean */}
-                                    {/*                             } */}
-                                    {/*                             onCheckedChange={( */}
-                                    {/*                                 e */}
-                                    {/*                             ) => { */}
-                                    {/*                                 copiedForm.setValue( */}
-                                    {/*                                     "copied", */}
-                                    {/*                                     e as boolean */}
-                                    {/*                                 ); */}
-                                    {/*                             }} */}
-                                    {/*                         /> */}
-                                    {/*                         <label */}
-                                    {/*                             htmlFor="terms" */}
-                                    {/*                             className="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70" */}
-                                    {/*                         > */}
-                                    {/*                             {t('apiKeysConfirmCopy')} */}
-                                    {/*                         </label> */}
-                                    {/*                     </div> */}
-                                    {/*                     <FormMessage /> */}
-                                    {/*                 </FormItem> */}
-                                    {/*             )} */}
-                                    {/*         /> */}
-                                    {/*     </form> */}
-                                    {/* </Form> */}
-                                </SettingsSectionBody>
-                            </SettingsSection>
-                        )}
-                    </SettingsContainer>
-
-                    <div className="flex justify-end space-x-2 mt-8">
-                        {!apiKey && (
-                            <Button
-                                type="button"
-                                variant="outline"
-                                disabled={createLoading || apiKey !== null}
-                                onClick={() => {
-                                    router.push(`/${orgId}/settings/api-keys`);
-                                }}
-                            >
-                                {t("cancel")}
-                            </Button>
-                        )}
-                        {!apiKey && (
-                            <Button
-                                type="button"
-                                loading={createLoading}
-                                disabled={createLoading || apiKey !== null}
-                                onClick={() => {
-                                    form.handleSubmit(onSubmit)();
-                                }}
-                            >
-                                {t("generate")}
-                            </Button>
-                        )}
-
-                        {apiKey && (
-                            <Button
-                                type="button"
-                                onClick={() => {
-                                    copiedForm.handleSubmit(onCopiedSubmit)();
-                                }}
-                            >
-                                {t("done")}
-                            </Button>
-                        )}
-                    </div>
                             </div>
                         )}
+                    </CredenzaBody>
+                    <CredenzaFooter>
+                        <Button onClick={goToApiKeysList}>{t("done")}</Button>
+                    </CredenzaFooter>
+                </CredenzaContent>
+            </Credenza>
         </>
     );
 }

src/app/[orgId]/settings/resources/public/ProxyResourceTargetsForm.tsx

@@ -954,7 +954,6 @@ export const ProxyResourceTargetsForm = forwardRef<
                                 colSpan={columns.length}
                                 message={emptyMessage ?? t("targetNoOne")}
                                 action={addTargetButton}
-                                compact
                             />
                         )}
                     </TableBody>

src/app/admin/api-keys/create/page.tsx

@@ -46,6 +46,15 @@ import moment from "moment";
 import CopyTextBox from "@app/components/CopyTextBox";
 import PermissionsSelectBox from "@app/components/PermissionsSelectBox";
 import { useTranslations } from "next-intl";
+import {
+    Credenza,
+    CredenzaBody,
+    CredenzaContent,
+    CredenzaDescription,
+    CredenzaFooter,
+    CredenzaHeader,
+    CredenzaTitle
+} from "@app/components/Credenza";
 
 export default function Page() {
     const { env } = useEnvContext();
@@ -56,6 +65,7 @@ export default function Page() {
     const [loadingPage, setLoadingPage] = useState(true);
     const [createLoading, setCreateLoading] = useState(false);
     const [apiKey, setApiKey] = useState<CreateOrgApiKeyResponse | null>(null);
+    const [isApiKeyDialogOpen, setIsApiKeyDialogOpen] = useState(false);
     const [selectedPermissions, setSelectedPermissions] = useState<
         Record<string, boolean>
     >({});
@@ -73,22 +83,6 @@ export default function Page() {
 
     type CreateFormValues = z.infer<typeof createFormSchema>;
 
-    const copiedFormSchema = z
-        .object({
-            copied: z.boolean()
-        })
-        .refine(
-            (data) => {
-                return data.copied;
-            },
-            {
-                message: t("apiKeysConfirmCopy2"),
-                path: ["copied"]
-            }
-        );
-
-    type CopiedFormValues = z.infer<typeof copiedFormSchema>;
-
     const form = useForm({
         resolver: zodResolver(createFormSchema),
         defaultValues: {
@@ -96,12 +90,9 @@ export default function Page() {
         }
     });
 
-    const copiedForm = useForm({
+    function goToApiKeysList() {
-        resolver: zodResolver(copiedFormSchema),
+        router.push(`/admin/api-keys`);
-        defaultValues: {
-            copied: true
     }
-    });
 
     async function onSubmit(data: CreateFormValues) {
         setCreateLoading(true);
@@ -121,16 +112,10 @@ export default function Page() {
             });
 
         if (res && res.status === 201) {
-            const data = res.data.data;
+            const created = res.data.data;
-
-            console.log({
-                actionIds: Object.keys(selectedPermissions).filter(
-                    (key) => selectedPermissions[key]
-                )
-            });
 
             const actionsRes = await api
-                .post(`/api-key/${data.apiKeyId}/actions`, {
+                .post(`/api-key/${created.apiKeyId}/actions`, {
                     actionIds: Object.keys(selectedPermissions).filter(
                         (key) => selectedPermissions[key]
                     )
@@ -145,21 +130,14 @@ export default function Page() {
                 });
 
             if (actionsRes) {
-                setApiKey(data);
+                setApiKey(created);
+                setIsApiKeyDialogOpen(true);
             }
         }
 
         setCreateLoading(false);
     }
 
-    async function onCopiedSubmit(data: CopiedFormValues) {
-        if (!data.copied) {
-            return;
-        }
-
-        router.push(`/admin/api-keys`);
-    }
-
     useEffect(() => {
         const load = async () => {
             setLoadingPage(false);
@@ -175,12 +153,7 @@ export default function Page() {
                     title={t("apiKeysCreate")}
                     description={t("apiKeysCreateDescription")}
                 />
-                <Button
+                <Button variant="outline" onClick={goToApiKeysList}>
-                    variant="outline"
-                    onClick={() => {
-                        router.push(`/admin/api-keys`);
-                    }}
-                >
                     {t("apiKeysSeeAll")}
                 </Button>
             </div>
@@ -188,8 +161,6 @@ export default function Page() {
             {!loadingPage && (
                 <div>
                     <SettingsContainer>
-                        {!apiKey && (
-                            <>
                         <SettingsSection>
                             <SettingsSectionHeader>
                                 <SettingsSectionTitle>
@@ -202,7 +173,7 @@ export default function Page() {
                                         <form
                                             onKeyDown={(e) => {
                                                 if (e.key === "Enter") {
-                                                            e.preventDefault(); // block default enter refresh
+                                                    e.preventDefault();
                                                 }
                                             }}
                                             className="space-y-4"
@@ -238,32 +209,61 @@ export default function Page() {
                                     {t("apiKeysGeneralSettings")}
                                 </SettingsSectionTitle>
                                 <SettingsSectionDescription>
-                                            {t(
+                                    {t("apiKeysGeneralSettingsDescription")}
-                                                "apiKeysGeneralSettingsDescription"
-                                            )}
                                 </SettingsSectionDescription>
                             </SettingsSectionHeader>
                             <SettingsSectionBody>
                                 <PermissionsSelectBox
                                     root={true}
-                                            selectedPermissions={
+                                    selectedPermissions={selectedPermissions}
-                                                selectedPermissions
-                                            }
                                     onChange={setSelectedPermissions}
                                 />
                             </SettingsSectionBody>
                         </SettingsSection>
-                            </>
+                    </SettingsContainer>
+
+                    <div className="flex justify-end space-x-2 mt-8">
+                        <Button
+                            type="button"
+                            variant="outline"
+                            disabled={createLoading || apiKey !== null}
+                            onClick={goToApiKeysList}
+                        >
+                            {t("cancel")}
+                        </Button>
+                        <Button
+                            type="button"
+                            loading={createLoading}
+                            disabled={createLoading || apiKey !== null}
+                            onClick={() => {
+                                form.handleSubmit(onSubmit)();
+                            }}
+                        >
+                            {t("generate")}
+                        </Button>
+                    </div>
+                </div>
             )}
 
+            <Credenza
+                open={isApiKeyDialogOpen}
+                onOpenChange={(open) => {
+                    setIsApiKeyDialogOpen(open);
+                    if (!open && apiKey) {
+                        goToApiKeysList();
+                    }
+                }}
+            >
+                <CredenzaContent>
+                    <CredenzaHeader>
+                        <CredenzaTitle>{t("apiKeysList")}</CredenzaTitle>
+                        <CredenzaDescription>
+                            {t("apiKeysSaveDescription")}
+                        </CredenzaDescription>
+                    </CredenzaHeader>
+                    <CredenzaBody>
                         {apiKey && (
-                            <SettingsSection>
+                            <div className="space-y-4">
-                                <SettingsSectionHeader>
-                                    <SettingsSectionTitle>
-                                        {t("apiKeysList")}
-                                    </SettingsSectionTitle>
-                                </SettingsSectionHeader>
-                                <SettingsSectionBody>
                                 <InfoSections cols={2}>
                                     <InfoSection>
                                         <InfoSectionTitle>
@@ -280,9 +280,9 @@ export default function Page() {
                                             {t("created")}
                                         </InfoSectionTitle>
                                         <InfoSectionContent>
-                                                {moment(
+                                            {moment(apiKey.createdAt).format(
-                                                    apiKey.createdAt
+                                                "lll"
-                                                ).format("lll")}
+                                            )}
                                         </InfoSectionContent>
                                     </InfoSection>
                                 </InfoSections>
@@ -297,98 +297,17 @@ export default function Page() {
                                     </AlertDescription>
                                 </Alert>
 
-                                    {/* <h4 className="font-semibold"> */}
-                                    {/*     {t('apiKeysInfo')} */}
-                                    {/* </h4> */}
-
                                 <CopyTextBox
                                     text={`${apiKey.apiKeyId}.${apiKey.apiKey}`}
                                 />
-
-                                    {/* <Form {...copiedForm}> */}
-                                    {/*     <form */}
-                                    {/*         className="space-y-4" */}
-                                    {/*         id="copied-form" */}
-                                    {/*     > */}
-                                    {/*         <FormField */}
-                                    {/*             control={copiedForm.control} */}
-                                    {/*             name="copied" */}
-                                    {/*             render={({ field }) => ( */}
-                                    {/*                 <FormItem> */}
-                                    {/*                     <div className="flex items-center space-x-2"> */}
-                                    {/*                         <Checkbox */}
-                                    {/*                             id="terms" */}
-                                    {/*                             defaultChecked={ */}
-                                    {/*                                 copiedForm.getValues( */}
-                                    {/*                                     "copied" */}
-                                    {/*                                 ) as boolean */}
-                                    {/*                             } */}
-                                    {/*                             onCheckedChange={( */}
-                                    {/*                                 e */}
-                                    {/*                             ) => { */}
-                                    {/*                                 copiedForm.setValue( */}
-                                    {/*                                     "copied", */}
-                                    {/*                                     e as boolean */}
-                                    {/*                                 ); */}
-                                    {/*                             }} */}
-                                    {/*                         /> */}
-                                    {/*                         <label */}
-                                    {/*                             htmlFor="terms" */}
-                                    {/*                             className="text-sm font-medium leading-none peer-disabled:cursor-not-allowed peer-disabled:opacity-70" */}
-                                    {/*                         > */}
-                                    {/*                             {t('apiKeysConfirmCopy')} */}
-                                    {/*                         </label> */}
-                                    {/*                     </div> */}
-                                    {/*                     <FormMessage /> */}
-                                    {/*                 </FormItem> */}
-                                    {/*             )} */}
-                                    {/*         /> */}
-                                    {/*     </form> */}
-                                    {/* </Form> */}
-                                </SettingsSectionBody>
-                            </SettingsSection>
-                        )}
-                    </SettingsContainer>
-
-                    <div className="flex justify-end space-x-2 mt-8">
-                        {!apiKey && (
-                            <Button
-                                type="button"
-                                variant="outline"
-                                disabled={createLoading || apiKey !== null}
-                                onClick={() => {
-                                    router.push(`/admin/api-keys`);
-                                }}
-                            >
-                                {t("cancel")}
-                            </Button>
-                        )}
-                        {!apiKey && (
-                            <Button
-                                type="button"
-                                loading={createLoading}
-                                disabled={createLoading || apiKey !== null}
-                                onClick={() => {
-                                    form.handleSubmit(onSubmit)();
-                                }}
-                            >
-                                {t("generate")}
-                            </Button>
-                        )}
-
-                        {apiKey && (
-                            <Button
-                                type="button"
-                                onClick={() => {
-                                    copiedForm.handleSubmit(onCopiedSubmit)();
-                                }}
-                            >
-                                {t("done")}
-                            </Button>
-                        )}
-                    </div>
                             </div>
                         )}
+                    </CredenzaBody>
+                    <CredenzaFooter>
+                        <Button onClick={goToApiKeysList}>{t("done")}</Button>
+                    </CredenzaFooter>
+                </CredenzaContent>
+            </Credenza>
         </>
     );
 }

src/app/admin/organizations/page.tsx

@@ -0,0 +1,59 @@
+import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
+import OrgsTable from "@app/components/OrgsTable";
+import { internal } from "@app/lib/api";
+import { authCookieHeader } from "@app/lib/api/cookies";
+import type { AdminListOrgsResponse } from "@server/routers/org";
+import type { AxiosResponse } from "axios";
+import type { Metadata } from "next";
+import { getTranslations } from "next-intl/server";
+
+export const metadata: Metadata = {
+    title: "Organizations"
+};
+
+export const dynamic = "force-dynamic";
+
+type OrganizationsPageProps = {
+    searchParams: Promise<Record<string, string>>;
+};
+
+export default async function OrganizationsPage(props: OrganizationsPageProps) {
+    const searchParams = new URLSearchParams(await props.searchParams);
+
+    let orgs: AdminListOrgsResponse["orgs"] = [];
+    let pagination: AdminListOrgsResponse["pagination"] = {
+        total: 0,
+        page: 1,
+        pageSize: 20
+    };
+
+    try {
+        const res = await internal.get<AxiosResponse<AdminListOrgsResponse>>(
+            `/admin/orgs?${searchParams.toString()}`,
+            await authCookieHeader()
+        );
+        const responseData = res.data.data;
+        orgs = responseData.orgs;
+        pagination = responseData.pagination;
+    } catch (e) {}
+
+    const t = await getTranslations();
+
+    return (
+        <>
+            <SettingsSectionTitle
+                title={t("orgsManage")}
+                description={t("orgsDescription")}
+            />
+
+            <OrgsTable
+                orgs={orgs}
+                rowCount={pagination.total}
+                pagination={{
+                    pageIndex: pagination.page - 1,
+                    pageSize: pagination.pageSize
+                }}
+            />
+        </>
+    );
+}

src/app/globals.css

@@ -65,7 +65,7 @@
     --chart-3: oklch(0.769 0.188 70.08);
     --chart-4: oklch(0.627 0.265 303.9);
     --chart-5: oklch(0.645 0.246 16.439);
-    --sidebar: #0C0C0D;
+    --sidebar: #0c0c0d;
     --sidebar-foreground: oklch(0.985 0 0);
     --sidebar-primary: oklch(0.646 0.222 41.116);
     --sidebar-primary-foreground: oklch(0.98 0.016 73.684);

src/app/navigation.tsx

@@ -6,6 +6,7 @@ import {
     Bot,
     Boxes,
     Building2,
+    Building2Icon,
     Cable,
     ChartLine,
     Coins,
@@ -140,7 +141,7 @@ export const orgNavSections = (
                 href: "/{orgId}/settings/domains",
                 icon: <Globe className="size-4 flex-none" />
             },
-            ...(env?.flags.usePangolinDns
+            ...(build === "saas"
                 ? [
                       {
                           title: "sidebarRemoteExitNodes",
@@ -376,6 +377,11 @@ export const adminNavSections = (env?: Env): SidebarNavSection[] => [
                 href: "/admin/users",
                 icon: <Users className="size-4 flex-none" />
             },
+            {
+                title: "sidebarOrgs",
+                href: "/admin/organizations",
+                icon: <Building2Icon className="size-4 flex-none" />
+            },
             {
                 title: "sidebarApiKeys",
                 href: "/admin/api-keys",
@@ -392,7 +398,7 @@ export const adminNavSections = (env?: Env): SidebarNavSection[] => [
                       }
                   ]
                 : []),
-            ...(build == "enterprise"
+            ...(build === "enterprise"
                 ? [
                       {
                           title: "sidebarLicense",
@@ -461,7 +467,7 @@ export const commandBarNavSections = (
                 title: "commandMachineClients",
                 icon: <Server className="size-4 flex-none" />
             },
-            ...(env?.flags.usePangolinDns
+            ...(build === "saas"
                 ? [
                       {
                           title: "commandRemoteExitNodes",

src/components/AdminUsersTable.tsx

@@ -19,7 +19,8 @@ import {
     ArrowRight,
     ArrowUp10Icon,
     ChevronsUpDownIcon,
-    MoreHorizontal
+    MoreHorizontal,
+    ShieldUserIcon
 } from "lucide-react";
 import { useTranslations } from "next-intl";
 import { useRouter } from "next/navigation";
@@ -43,6 +44,13 @@ import {
     CredenzaClose
 } from "@app/components/Credenza";
 import CopyToClipboard from "@app/components/CopyToClipboard";
+import {
+    Tooltip,
+    TooltipContent,
+    TooltipProvider,
+    TooltipTrigger
+} from "./ui/tooltip";
+import { useUserContext } from "@app/hooks/useUserContext";
 
 export type GlobalUserRow = {
     id: string;
@@ -90,6 +98,11 @@ export default function UsersTable({
     const [passwordResetCodeData, setPasswordResetCodeData] =
         useState<AdminGeneratePasswordResetCodeResponse | null>(null);
     const [isGeneratingCode, setIsGeneratingCode] = useState(false);
+    const [isPromoteModalOpen, setIsPromoteModalOpen] = useState(false);
+    const [promoting, setPromoting] = useState<GlobalUserRow | null>(null);
+    const [isDemoteModalOpen, setIsDemoteModalOpen] = useState(false);
+    const [demoting, setDemoting] = useState<GlobalUserRow | null>(null);
+    const user = useUserContext();
 
     const [isRefreshing, startTransition] = useTransition();
     const {
@@ -109,6 +122,11 @@ export default function UsersTable({
         .optional()
         .catch(undefined);
 
+    const serverAdminFilterSchema = z
+        .enum(["true", "false"])
+        .optional()
+        .catch(undefined);
+
     function handleFilterChange(
         column: string,
         value: string | undefined | null
@@ -184,6 +202,54 @@ export default function UsersTable({
         }
     };
 
+    const setServerAdmin = async (
+        targetUser: GlobalUserRow,
+        serverAdmin: boolean
+    ) => {
+        const successTitleKey = serverAdmin
+            ? "promoteServerAdminSuccess"
+            : "demoteServerAdminSuccess";
+        const successDescriptionKey = serverAdmin
+            ? "promoteServerAdminSuccessDescription"
+            : "demoteServerAdminSuccessDescription";
+        const errorKey = serverAdmin
+            ? "promoteServerAdminError"
+            : "demoteServerAdminError";
+
+        try {
+            await api.post(`/user/${targetUser.id}/server-admin`, {
+                serverAdmin
+            });
+
+            toast({
+                title: t(successTitleKey),
+                description: t(successDescriptionKey, {
+                    selectedUser: getUserDisplayName({
+                        email: targetUser.email,
+                        name: targetUser.name,
+                        username: targetUser.username
+                    })
+                })
+            });
+
+            startTransition(() => {
+                router.refresh();
+            });
+        } catch (e) {
+            console.error(t(errorKey), e);
+            toast({
+                variant: "destructive",
+                title: t(errorKey),
+                description: formatAxiosError(e, t(errorKey))
+            });
+        } finally {
+            setIsPromoteModalOpen(false);
+            setPromoting(null);
+            setIsDemoteModalOpen(false);
+            setDemoting(null);
+        }
+    };
+
     function toggleSort(column: string) {
         const newSearch = getNextSortOrder(column, searchParams);
         filter({
@@ -235,7 +301,32 @@ export default function UsersTable({
                         <Icon className="ml-2 h-4 w-4" />
                     </Button>
                 );
-            }
+            },
+            cell: ({ row }) => (
+                <span className="inline-flex gap-1 items-center">
+                    {row.original.username}{" "}
+                    {row.original.id === user.user.userId && (
+                        <>
+                            <span className="text-muted-foreground">
+                                &middot;
+                            </span>{" "}
+                            <span className="text-primary">you</span>
+                        </>
+                    )}
+                    {row.original.serverAdmin && (
+                        <TooltipProvider>
+                            <Tooltip>
+                                <TooltipTrigger asChild>
+                                    <ShieldUserIcon className="text-primary size-4 flex-none" />
+                                </TooltipTrigger>
+                                <TooltipContent>
+                                    {t("serverAdmin")}
+                                </TooltipContent>
+                            </Tooltip>
+                        </TooltipProvider>
+                    )}
+                </span>
+            )
         },
         {
             accessorKey: "email",
@@ -341,6 +432,37 @@ export default function UsersTable({
                 );
             }
         },
+        {
+            accessorKey: "serverAdmin",
+            friendlyName: t("serverAdmin"),
+            header: () => (
+                <ColumnFilterButton
+                    options={[
+                        { value: "true", label: t("yes") },
+                        { value: "false", label: t("no") }
+                    ]}
+                    selectedValue={serverAdminFilterSchema.parse(
+                        searchParams.get("server_admin") ?? undefined
+                    )}
+                    onValueChange={(value) =>
+                        handleFilterChange("server_admin", value)
+                    }
+                    searchPlaceholder={t("searchPlaceholder")}
+                    emptyMessage={t("emptySearchOptions")}
+                    label={t("serverAdmin")}
+                    className="p-3"
+                />
+            ),
+            cell: ({ row }) => (
+                <span>
+                    {row.original.serverAdmin ? (
+                        <span>{t("yes")}</span>
+                    ) : (
+                        <span>{t("no")}</span>
+                    )}
+                </span>
+            )
+        },
         {
             id: "actions",
             enableHiding: false,
@@ -369,11 +491,34 @@ export default function UsersTable({
                                         {t("generatePasswordResetCode")}
                                     </DropdownMenuItem>
                                 )}
+                                {r.type === "internal" && !r.serverAdmin && (
+                                    <DropdownMenuItem
+                                        onClick={() => {
+                                            setPromoting(r);
+                                            setIsPromoteModalOpen(true);
+                                        }}
+                                    >
+                                        {t("promoteServerAdmin")}
+                                    </DropdownMenuItem>
+                                )}
+                                {r.type === "internal" &&
+                                    r.serverAdmin &&
+                                    r.id !== user.user.userId && (
+                                        <DropdownMenuItem
+                                            onClick={() => {
+                                                setDemoting(r);
+                                                setIsDemoteModalOpen(true);
+                                            }}
+                                        >
+                                            {t("demoteServerAdmin")}
+                                        </DropdownMenuItem>
+                                    )}
                                 <DropdownMenuItem
                                     onClick={() => {
                                         setSelected(r);
                                         setIsDeleteModalOpen(true);
                                     }}
+                                    className="text-red-400"
                                 >
                                     {t("delete")}
                                 </DropdownMenuItem>
@@ -435,6 +580,86 @@ export default function UsersTable({
                 />
             )}
 
+            {promoting && (
+                <ConfirmDeleteDialog
+                    open={isPromoteModalOpen}
+                    setOpen={(val) => {
+                        setIsPromoteModalOpen(val);
+                        if (!val) {
+                            setPromoting(null);
+                        }
+                    }}
+                    dialog={
+                        <div className="space-y-2">
+                            <p>
+                                {t("promoteServerAdminQuestion", {
+                                    selectedUser: getUserDisplayName({
+                                        email: promoting.email,
+                                        name: promoting.name,
+                                        username: promoting.username
+                                    })
+                                })}
+                            </p>
+
+                            <p>{t("promoteServerAdminMessage")}</p>
+                        </div>
+                    }
+                    buttonText={t("promoteServerAdminConfirm")}
+                    onConfirm={async () => setServerAdmin(promoting, true)}
+                    string={getUserDisplayName({
+                        email: promoting.email,
+                        name: promoting.name,
+                        username: promoting.username
+                    })}
+                    warningText={t("promoteServerAdminWarning")}
+                    title={t("promoteServerAdminTitle")}
+                />
+            )}
+
+            {demoting && (
+                <ConfirmDeleteDialog
+                    open={isDemoteModalOpen}
+                    setOpen={(val) => {
+                        setIsDemoteModalOpen(val);
+                        if (!val) {
+                            setDemoting(null);
+                        }
+                    }}
+                    dialog={
+                        <div className="space-y-2">
+                            <p>
+                                {t("demoteServerAdminQuestion", {
+                                    selectedUser: getUserDisplayName({
+                                        email: demoting.email,
+                                        name: demoting.name,
+                                        username: demoting.username
+                                    })
+                                })}
+                            </p>
+
+                            <p>
+                                {t("demoteServerAdminMessage", {
+                                    selectedUser: getUserDisplayName({
+                                        email: demoting.email,
+                                        name: demoting.name,
+                                        username: demoting.username
+                                    })
+                                })}
+                            </p>
+                        </div>
+                    }
+                    buttonText={t("demoteServerAdminConfirm")}
+                    onConfirm={async () => setServerAdmin(demoting, false)}
+                    string={getUserDisplayName({
+                        email: demoting.email,
+                        name: demoting.name,
+                        username: demoting.username
+                    })}
+                    warningText={t("demoteServerAdminWarning")}
+                    title={t("demoteServerAdminTitle")}
+                />
+            )}
+
             <ControlledDataTable
                 columns={columns}
                 rows={users}

src/components/ApprovalFeed.tsx

@@ -227,7 +227,7 @@ function ApprovalRequest({ approval, orgId, onSuccess }: ApprovalRequestProps) {
             <div className="inline-flex items-start md:items-center gap-2">
                 <span>
                     <Link
-                        href={`/${orgId}/settings/access/users/${approval.user.userId}/access-controls`}
+                        href={`/${orgId}/settings/access/users/${approval.user.userId}/general`}
                         className="text-primary hover:underline cursor-pointer"
                     >
                         {getUserDisplayName({

src/components/ApprovalsEmptyState.tsx

@@ -1,15 +1,12 @@
 "use client";
 
 import { Button } from "@app/components/ui/button";
-import { Card, CardContent } from "@app/components/ui/card";
 import {
-    ShieldCheck,
+    SettingsSection,
-    Check,
+    SettingsSectionBody,
-    Ban,
+    SettingsSectionFooter
-    User,
+} from "@app/components/Settings";
-    Settings,
+import { ArrowRight, Settings, ShieldCheck, User } from "lucide-react";
-    ArrowRight
-} from "lucide-react";
 import { useTranslations } from "next-intl";
 import Link from "next/link";
 
@@ -21,102 +18,50 @@ export function ApprovalsEmptyState({ orgId }: ApprovalsEmptyStateProps) {
     const t = useTranslations();
 
     return (
-        <div className="flex flex-col gap-6">
+        <SettingsSection>
-            <Card>
+            <SettingsSectionBody>
-                <CardContent className="p-6 md:p-12">
+                <div className="flex flex-col items-center text-center py-6 md:py-10 px-2">
-                    <div className="flex flex-col items-center text-center gap-4 md:gap-6 max-w-2xl mx-auto">
+                    <ShieldCheck className="h-8 w-8 text-primary" />
-                        <div className="space-y-2">
+                    <h2 className="mt-4 text-2xl font-semibold tracking-tight max-w-xl">
-                            <h3 className="text-xl md:text-2xl font-semibold">
                         {t("approvalsEmptyStateTitle")}
-                            </h3>
+                    </h2>
-                            <p className="text-muted-foreground text-sm md:text-lg">
+                    <p className="mt-3 text-sm text-muted-foreground max-w-lg">
                         {t("approvalsEmptyStateDescription")}
                     </p>
+
+                    <div className="mt-8 w-full max-w-lg text-left space-y-3">
+                        <p className="text-sm font-medium text-center">
+                            {t("approvalsEmptyStateHowToTitle")}
+                        </p>
+                        <ul className="text-sm text-muted-foreground space-y-2">
+                            <li className="flex items-start gap-2">
+                                <Settings className="mt-0.5 h-4 w-4 shrink-0 text-primary" />
+                                <span>
+                                    {t("approvalsEmptyStateStep1Description")}
+                                </span>
+                            </li>
+                            <li className="flex items-start gap-2">
+                                <User className="mt-0.5 h-4 w-4 shrink-0 text-primary" />
+                                <span>
+                                    {t("approvalsEmptyStateStep2Description")}
+                                </span>
+                            </li>
+                        </ul>
                     </div>
 
-                        <div className="w-full space-y-3 md:space-y-4 mt-2 md:mt-4">
+                    <p className="mt-8 text-sm text-muted-foreground max-w-lg">
-                            <div className="bg-muted/50 rounded-lg p-4 md:p-6 space-y-3 md:space-y-4 border">
+                        {t("approvalsEmptyStatePreviewDescription")}
-                                <div className="flex items-start gap-3 md:gap-4">
-                                    <div className="rounded-lg bg-background p-2 md:p-3 border shrink-0">
-                                        <Settings className="w-4 h-4 md:w-5 md:h-5 text-primary" />
-                                    </div>
-                                    <div className="flex-1 text-left min-w-0">
-                                        <h4 className="font-semibold mb-1 text-sm md:text-base">
-                                            {t("approvalsEmptyStateStep1Title")}
-                                        </h4>
-                                        <p className="text-xs md:text-sm text-muted-foreground">
-                                            {t(
-                                                "approvalsEmptyStateStep1Description"
-                                            )}
                     </p>
                 </div>
-                                </div>
+            </SettingsSectionBody>
-
+            <SettingsSectionFooter className="justify-center md:justify-center">
-                                <div className="flex items-start gap-3 md:gap-4">
+                <Button asChild>
-                                    <div className="rounded-lg bg-background p-2 md:p-3 border shrink-0">
+                    <Link href={`/${orgId}/settings/access/roles`}>
-                                        <User className="w-4 h-4 md:w-5 md:h-5 text-primary" />
-                                    </div>
-                                    <div className="flex-1 text-left min-w-0">
-                                        <h4 className="font-semibold mb-1 text-sm md:text-base">
-                                            {t("approvalsEmptyStateStep2Title")}
-                                        </h4>
-                                        <p className="text-xs md:text-sm text-muted-foreground">
-                                            {t(
-                                                "approvalsEmptyStateStep2Description"
-                                            )}
-                                        </p>
-                                    </div>
-                                </div>
-                            </div>
-
-                            {/* Abstract UI Preview - Hidden on mobile */}
-                            <div className="hidden md:block bg-muted/50 rounded-lg p-6 border">
-                                <div className="space-y-3">
-                                    <div className="flex items-center justify-between p-3 bg-background rounded border">
-                                        <div className="flex items-center gap-3">
-                                            <div className="w-8 h-8 rounded-full bg-primary/10 flex items-center justify-center">
-                                                <User className="w-4 h-4 text-primary" />
-                                            </div>
-                                            <div>
-                                                <div className="h-3 w-24 bg-muted-foreground/20 rounded mb-1"></div>
-                                                <div className="h-2 w-32 bg-muted-foreground/10 rounded"></div>
-                                            </div>
-                                        </div>
-                                        <div className="flex gap-2">
-                                            <div className="h-6 w-16 bg-muted-foreground/10 rounded"></div>
-                                            <div className="h-6 w-16 bg-muted-foreground/10 rounded"></div>
-                                        </div>
-                                    </div>
-                                    <div className="flex items-center justify-between p-3 bg-background rounded border">
-                                        <div className="flex items-center gap-3">
-                                            <div className="w-8 h-8 rounded-full bg-primary/10 flex items-center justify-center">
-                                                <User className="w-4 h-4 text-primary" />
-                                            </div>
-                                            <div>
-                                                <div className="h-3 w-24 bg-muted-foreground/20 rounded mb-1"></div>
-                                                <div className="h-2 w-32 bg-muted-foreground/10 rounded"></div>
-                                            </div>
-                                        </div>
-                                        <div className="flex gap-2">
-                                            <div className="h-6 w-16 bg-green-500/20 rounded flex items-center justify-center">
-                                                <Check className="w-3 h-3 text-green-600" />
-                                            </div>
-                                            <div className="h-6 w-16 bg-muted-foreground/10 rounded"></div>
-                                        </div>
-                                    </div>
-                                </div>
-                            </div>
-                        </div>
-
-                        <Link href={`/${orgId}/settings/access/roles`} className="w-full md:w-auto">
-                            <Button className="gap-2 mt-2 w-full md:w-auto">
                         {t("approvalsEmptyStateButtonText")}
-                                <ArrowRight className="w-4 h-4" />
+                        <ArrowRight className="ml-2 h-4 w-4" />
-                            </Button>
                     </Link>
-                    </div>
+                </Button>
-                </CardContent>
+            </SettingsSectionFooter>
-            </Card>
+        </SettingsSection>
-        </div>
     );
 }

src/components/GenerateLicenseKeysTable.tsx

@@ -78,16 +78,13 @@ export default function GenerateLicenseKeysTable({
             );
             toast({
                 title: t("success"),
-                description: "Server ID cleared successfully"
+                description: "Instance name cleared successfully"
             });
             await refreshData();
         } catch (error) {
             toast({
                 title: t("error"),
-                description: formatAxiosError(
+                description: formatAxiosError(error, "Failed to clear instance name"),
-                    error,
-                    "Failed to clear server ID"
-                ),
                 variant: "destructive"
             });
         } finally {
@@ -294,7 +291,7 @@ export default function GenerateLicenseKeysTable({
                                         clearInstanceName(key.licenseKey)
                                     }
                                 >
-                                    {t("clearInstanceName")}
+                                    Clear Instance Name
                                 </DropdownMenuItem>
                             </DropdownMenuContent>
                         </DropdownMenu>

src/components/LoadingDots.tsx

@@ -0,0 +1,56 @@
+import { cn } from "@app/lib/cn";
+
+type LoadingDotsProps = {
+    className?: string;
+    size?: "sm" | "md";
+};
+
+const sizeClasses = {
+    sm: {
+        gap: "gap-1.5",
+        dot: "h-1.5 w-1.5"
+    },
+    md: {
+        gap: "gap-2.5",
+        dot: "h-2.5 w-2.5"
+    }
+} as const;
+
+export default function LoadingDots({
+    className,
+    size = "md"
+}: LoadingDotsProps) {
+    const classes = sizeClasses[size];
+
+    return (
+        <span
+            className={cn(
+                "flex items-center text-muted-foreground",
+                classes.gap,
+                className
+            )}
+        >
+            <span
+                className={cn(
+                    "rounded-full bg-current animate-dot-pulse",
+                    classes.dot
+                )}
+                style={{ animationDelay: "0ms" }}
+            />
+            <span
+                className={cn(
+                    "rounded-full bg-current animate-dot-pulse",
+                    classes.dot
+                )}
+                style={{ animationDelay: "200ms" }}
+            />
+            <span
+                className={cn(
+                    "rounded-full bg-current animate-dot-pulse",
+                    classes.dot
+                )}
+                style={{ animationDelay: "400ms" }}
+            />
+        </span>
+    );
+}

src/components/LocaleSwitcherSelect.tsx

@@ -1,19 +1,18 @@
 "use client";
 
 import {
-    DropdownMenu,
-    DropdownMenuContent,
     DropdownMenuItem,
-    DropdownMenuTrigger
+    DropdownMenuSub,
+    DropdownMenuSubContent,
+    DropdownMenuSubTrigger
 } from "@app/components/ui/dropdown-menu";
-import { Button } from "@app/components/ui/button";
+import { Check, Languages } from "lucide-react";
-import { Check, Globe, Languages } from "lucide-react";
-import clsx from "clsx";
 import { useTransition } from "react";
 import { Locale } from "@/i18n/config";
 import { setUserLocale } from "@/services/locale";
 import { createApiClient } from "@app/lib/api";
 import { useEnvContext } from "@app/hooks/useEnvContext";
+import { cn } from "@app/lib/cn";
 
 type Props = {
     defaultValue: string;
@@ -43,36 +42,31 @@ export default function LocaleSwitcherSelect({
     const selected = items.find((item) => item.value === defaultValue);
 
     return (
-        <DropdownMenu>
+        <DropdownMenuSub>
-            <DropdownMenuTrigger asChild>
+            <DropdownMenuSubTrigger
-                <Button
+                className={cn(
-                    variant="ghost"
+                    "[&_svg:not([class*='text-'])]:text-muted-foreground",
-                    className={clsx(
-                        "w-full rounded-sm h-8 gap-2 justify-start font-normal",
                     isPending && "pointer-events-none"
                 )}
                 aria-label={label}
             >
-                    <Languages className="text-muted-foreground h-4 w-4" />
+                <Languages className="mr-2 h-4 w-4" />
-                    <span className="text-left flex-1">
+                <span>{selected?.label ?? label}</span>
-                        {selected?.label ?? label}
+            </DropdownMenuSubTrigger>
-                    </span>
+            <DropdownMenuSubContent className="min-w-[8rem]">
-                </Button>
-            </DropdownMenuTrigger>
-            <DropdownMenuContent align="end" className="min-w-[8rem]">
                 {items.map((item) => (
                     <DropdownMenuItem
                         key={item.value}
                         onClick={() => onChange(item.value)}
                         className="flex items-center gap-2"
                     >
-                        {item.value === defaultValue && (
-                            <Check className="h-4 w-4" />
-                        )}
                         <span>{item.label}</span>
+                        {item.value === defaultValue && (
+                            <Check className="ml-auto h-4 w-4" />
+                        )}
                     </DropdownMenuItem>
                 ))}
-            </DropdownMenuContent>
+            </DropdownMenuSubContent>
-        </DropdownMenu>
+        </DropdownMenuSub>
     );
 }

src/components/OrgRouteLoading.tsx

@@ -0,0 +1,45 @@
+"use client";
+
+import Link from "next/link";
+import BrandingLogo from "@app/components/BrandingLogo";
+import LoadingDots from "@app/components/LoadingDots";
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { useLicenseStatusContext } from "@app/hooks/useLicenseStatusContext";
+
+export default function OrgRouteLoading() {
+    const { env } = useEnvContext();
+    const { isUnlocked } = useLicenseStatusContext();
+
+    const logoWidth = isUnlocked()
+        ? env.branding.logo?.navbar?.width || 98
+        : 98;
+    const logoHeight = isUnlocked()
+        ? env.branding.logo?.navbar?.height || 32
+        : 32;
+
+    return (
+        <div className="relative h-screen-safe overflow-hidden">
+            <div className="absolute top-0 left-0 right-0 z-50">
+                <div className="px-6 py-2">
+                    <div className="container mx-auto max-w-12xl">
+                        <div className="flex h-16 items-center">
+                            <Link
+                                href="/"
+                                className="flex shrink-0 items-center"
+                            >
+                                <BrandingLogo
+                                    width={logoWidth}
+                                    height={logoHeight}
+                                />
+                            </Link>
+                        </div>
+                    </div>
+                </div>
+            </div>
+
+            <div className="absolute inset-0 flex items-center justify-center">
+                <LoadingDots size="md" />
+            </div>
+        </div>
+    );
+}

src/components/OrgSelector.tsx

@@ -27,15 +27,7 @@ export function OrgSelector({
     const selectedOrg = orgs?.find((org) => org.orgId === orgId);
 
     const picker = (
-        <OrgPicker
+        <OrgPicker orgId={orgId} orgs={orgs} contentClassName="w-[320px]">
-            orgId={orgId}
-            orgs={orgs}
-            contentClassName={
-                isCollapsed
-                    ? "w-[320px]"
-                    : "w-[var(--radix-popover-trigger-width)]"
-            }
-        >
             <div
                 role="combobox"
                 className={cn(

src/components/OrgsTable.tsx

@@ -0,0 +1,290 @@
+"use client";
+
+import { Button } from "@app/components/ui/button";
+import {
+    ControlledDataTable,
+    type ExtendedColumnDef
+} from "@app/components/ui/controlled-data-table";
+import { useNavigationContext } from "@app/hooks/useNavigationContext";
+import { toast } from "@app/hooks/useToast";
+import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
+import type { AdminOrgRow } from "@server/routers/org";
+
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { createApiClient, formatAxiosError } from "@app/lib/api";
+import { type PaginationState } from "@tanstack/react-table";
+import {
+    ArrowDown01Icon,
+    ArrowUp10Icon,
+    ArrowUpRight,
+    ChevronsUpDownIcon
+} from "lucide-react";
+import moment from "moment";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+import { useRouter } from "next/navigation";
+import { useMemo, useState, useTransition } from "react";
+import { useDebouncedCallback } from "use-debounce";
+import ConfirmDeleteDialog from "./ConfirmDeleteDialog";
+import CopyToClipboard from "./CopyToClipboard";
+
+type OrgTableProps = {
+    orgs: AdminOrgRow[];
+    pagination: PaginationState;
+    rowCount: number;
+};
+
+export default function OrgsTable({
+    orgs,
+    pagination,
+    rowCount
+}: OrgTableProps) {
+    const router = useRouter();
+    const t = useTranslations();
+    const {
+        navigate: filter,
+        isNavigating: isFiltering,
+        searchParams
+    } = useNavigationContext();
+
+    const [isRefreshing, startTransition] = useTransition();
+
+    const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
+    const [selectedOrg, setSelectedOrg] = useState<AdminOrgRow | null>();
+    const api = createApiClient(useEnvContext());
+
+    function refreshData() {
+        startTransition(async () => {
+            try {
+                router.refresh();
+            } catch (error) {
+                toast({
+                    title: t("error"),
+                    description: t("refreshError"),
+                    variant: "destructive"
+                });
+            }
+        });
+    }
+
+    function toggleSort(column: string) {
+        const newSearch = getNextSortOrder(column, searchParams);
+
+        filter({
+            searchParams: newSearch
+        });
+    }
+
+    function sortableHeader(column: string, label: string) {
+        const sortOrder = getSortDirection(column, searchParams);
+        const Icon =
+            sortOrder === "asc"
+                ? ArrowDown01Icon
+                : sortOrder === "desc"
+                  ? ArrowUp10Icon
+                  : ChevronsUpDownIcon;
+
+        return (
+            <Button
+                variant="ghost"
+                className="p-3"
+                onClick={() => toggleSort(column)}
+            >
+                {label}
+                <Icon className="ml-2 h-4 w-4" />
+            </Button>
+        );
+    }
+
+    const columns = useMemo<ExtendedColumnDef<AdminOrgRow>[]>(() => {
+        return [
+            {
+                accessorKey: "name",
+                friendlyName: t("name"),
+                enableHiding: false,
+                header: () => sortableHeader("name", t("name"))
+            },
+            {
+                accessorKey: "orgId",
+                friendlyName: t("orgId"),
+                header: () => <span className="p-3">{t("orgId")}</span>,
+                cell: ({ row }) => (
+                    <CopyToClipboard text={row.original.orgId} isLink={false} />
+                )
+            },
+            {
+                accessorKey: "createdAt",
+                friendlyName: t("createdAt"),
+                header: () => sortableHeader("createdAt", t("createdAt")),
+                cell: ({ row }) => {
+                    const createdAt = row.original.createdAt;
+                    return (
+                        <span>
+                            {createdAt ? moment(createdAt).format("lll") : "-"}
+                        </span>
+                    );
+                }
+            },
+            {
+                accessorKey: "owner",
+                friendlyName: t("accessRoleOwner"),
+                header: () => (
+                    <span className="p-3">{t("accessRoleOwner")}</span>
+                ),
+                cell: ({ row }) => {
+                    const owner = row.original.owner;
+                    return owner ? (
+                        <Button
+                            className="tabular-nums"
+                            asChild
+                            variant="outline"
+                            size="sm"
+                        >
+                            <Link href={`/admin/users/${owner.userId}`}>
+                                {owner.username}
+                                <ArrowUpRight className="ml-2 h-3 w-3" />
+                            </Link>
+                        </Button>
+                    ) : (
+                        <code>-</code>
+                    );
+                }
+            },
+            {
+                accessorKey: "subnet",
+                friendlyName: t("subnet"),
+                header: () => <span className="p-3">{t("subnet")}</span>,
+                cell: ({ row }) => <span>{row.original.subnet || "-"}</span>
+            },
+            {
+                accessorKey: "utilitySubnet",
+                friendlyName: t("utilitySubnet"),
+                header: () => <span className="p-3">{t("utilitySubnet")}</span>,
+                cell: ({ row }) => (
+                    <span>{row.original.utilitySubnet || "-"}</span>
+                )
+            },
+            {
+                accessorKey: "userCount",
+                friendlyName: t("users"),
+                header: () => <span className="p-3">{t("users")}</span>,
+                cell: ({ row }) => <span>{row.original.userCount}</span>
+            },
+            {
+                accessorKey: "siteCount",
+                friendlyName: t("sites"),
+                header: () => <span className="p-3">{t("sites")}</span>,
+                cell: ({ row }) => <span>{row.original.siteCount}</span>
+            },
+            {
+                accessorKey: "resourceCount",
+                friendlyName: t("resources"),
+                header: () => <span className="p-3">{t("resources")}</span>,
+                cell: ({ row }) => <span>{row.original.resourceCount}</span>
+            },
+
+            {
+                id: "actions",
+                enableHiding: false,
+                header: () => <span className="p-3"></span>,
+                cell: ({ row }) => {
+                    const orgRow = row.original;
+                    return (
+                        <div className="flex items-center gap-2 justify-end">
+                            <Button
+                                onClick={() => {
+                                    setSelectedOrg(orgRow);
+                                    setIsDeleteModalOpen(true);
+                                }}
+                                variant="outline"
+                            >
+                                {t("delete")}
+                            </Button>
+                        </div>
+                    );
+                }
+            }
+        ];
+    }, [t, searchParams]);
+
+    const handlePaginationChange = (newPage: PaginationState) => {
+        searchParams.set("page", (newPage.pageIndex + 1).toString());
+        searchParams.set("pageSize", newPage.pageSize.toString());
+        filter({
+            searchParams
+        });
+    };
+
+    const handleSearchChange = useDebouncedCallback((query: string) => {
+        searchParams.set("query", query);
+        searchParams.delete("page");
+        filter({
+            searchParams
+        });
+    }, 300);
+
+    async function deleteOrg(orgId: string) {
+        try {
+            const res = await api.delete(`/admin/org/${orgId}`);
+            toast({
+                title: t("orgDeleted"),
+                description: t("orgDeletedMessage")
+            });
+        } catch (err) {
+            console.error(err);
+            toast({
+                variant: "destructive",
+                title: t("orgErrorDelete"),
+                description: formatAxiosError(err, t("orgErrorDeleteMessage"))
+            });
+        } finally {
+            router.refresh();
+        }
+    }
+
+    return (
+        <>
+            {selectedOrg && (
+                <ConfirmDeleteDialog
+                    open={isDeleteModalOpen}
+                    setOpen={(val) => {
+                        setIsDeleteModalOpen(val);
+                        setSelectedOrg(null);
+                    }}
+                    dialog={
+                        <div className="space-y-2">
+                            <p>{t("orgQuestionRemove")}</p>
+                            <p>{t("orgMessageRemove")}</p>
+                        </div>
+                    }
+                    buttonText={t("orgDeleteConfirm")}
+                    onConfirm={async () => {
+                        startTransition(() => deleteOrg(selectedOrg.orgId));
+                    }}
+                    string={selectedOrg.name}
+                    title={t("orgDelete")}
+                />
+            )}
+            <ControlledDataTable
+                columns={columns}
+                rows={orgs}
+                tableId="admin-orgs-table"
+                searchPlaceholder={t("orgSearch")}
+                pagination={pagination}
+                onPaginationChange={handlePaginationChange}
+                searchQuery={searchParams.get("query")?.toString()}
+                onSearch={handleSearchChange}
+                onRefresh={refreshData}
+                isRefreshing={isRefreshing || isFiltering}
+                rowCount={rowCount}
+                columnVisibility={{
+                    subnet: false,
+                    utilitySubnet: false
+                }}
+                enableColumnVisibility
+                stickyLeftColumn="name"
+                stickyRightColumn="actions"
+            />
+        </>
+    );
+}

src/components/PendingSitesTable.tsx

@@ -402,8 +402,7 @@ export default function PendingSitesTable({
                         "saturn",
                         "uranus",
                         "neptune",
-                        "pluto",
+                        "pluto"
-                        "erid"
                     ].includes(originalRow.exitNodeName.toLowerCase());
 
                 if (isCloudNode) {

src/components/ProfileIcon.tsx

@@ -9,13 +9,16 @@ import {
     DropdownMenuItem,
     DropdownMenuLabel,
     DropdownMenuSeparator,
+    DropdownMenuSub,
+    DropdownMenuSubContent,
+    DropdownMenuSubTrigger,
     DropdownMenuTrigger
 } from "@app/components/ui/dropdown-menu";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { toast } from "@app/hooks/useToast";
 import { formatAxiosError } from "@app/lib/api";
 import { getUserDisplayName } from "@app/lib/getUserDisplayName";
-import { Laptop, LogOut, Moon, Sun, Smartphone, Trash2 } from "lucide-react";
+import { Check, Laptop, Moon, Sun, Trash2 } from "lucide-react";
 import { useTheme } from "next-themes";
 import { useRouter } from "next/navigation";
 import Link from "next/link";
@@ -149,42 +152,49 @@ export default function ProfileIcon() {
                             >
                                 <span>{t("changePassword")}</span>
                             </DropdownMenuItem>
-                            <DropdownMenuSeparator />
                         </>
                     )}
                     <DropdownMenuItem onClick={() => setOpenViewDevices(true)}>
-                        <Smartphone className="mr-2 h-4 w-4" />
                         <span>{t("viewDevices") || "View Devices"}</span>
                     </DropdownMenuItem>
                     <DropdownMenuSeparator />
                     <DropdownMenuLabel>{t("theme")}</DropdownMenuLabel>
+                    <DropdownMenuSub>
+                        <DropdownMenuSubTrigger className="[&_svg:not([class*='text-'])]:text-muted-foreground">
+                            {userTheme === "light" && (
+                                <Sun className="mr-2 h-4 w-4" />
+                            )}
+                            {userTheme === "dark" && (
+                                <Moon className="mr-2 h-4 w-4" />
+                            )}
+                            {userTheme === "system" && (
+                                <Laptop className="mr-2 h-4 w-4" />
+                            )}
+                            <span className="capitalize">{t(userTheme)}</span>
+                        </DropdownMenuSubTrigger>
+                        <DropdownMenuSubContent className="min-w-[8rem]">
                             {(["light", "dark", "system"] as const).map(
                                 (themeOption) => (
                                     <DropdownMenuItem
                                         key={themeOption}
-                                onClick={() => handleThemeChange(themeOption)}
+                                        onClick={() =>
+                                            handleThemeChange(themeOption)
+                                        }
+                                        className="flex items-center gap-2"
                                     >
-                                {themeOption === "light" && (
-                                    <Sun className="mr-2 h-4 w-4" />
-                                )}
-                                {themeOption === "dark" && (
-                                    <Moon className="mr-2 h-4 w-4" />
-                                )}
-                                {themeOption === "system" && (
-                                    <Laptop className="mr-2 h-4 w-4" />
-                                )}
                                         <span className="capitalize">
                                             {t(themeOption)}
                                         </span>
                                         {userTheme === themeOption && (
-                                    <span className="absolute right-2 flex h-3.5 w-3.5 items-center justify-center">
+                                            <Check className="ml-auto h-4 w-4" />
-                                        <span className="h-2 w-2 rounded-full bg-primary"></span>
-                                    </span>
                                         )}
                                     </DropdownMenuItem>
                                 )
                             )}
+                        </DropdownMenuSubContent>
+                    </DropdownMenuSub>
                     <DropdownMenuSeparator />
+                    <DropdownMenuLabel>{t("language")}</DropdownMenuLabel>
                     <LocaleSwitcher />
                     <DropdownMenuSeparator />
                     {user?.type === UserType.Internal && !user?.serverAdmin && (

src/components/PublicResourcesTable.tsx

@@ -21,14 +21,12 @@ import { Switch } from "@app/components/ui/switch";
 import { useEnvContext } from "@app/hooks/useEnvContext";
 import { useNavigationContext } from "@app/hooks/useNavigationContext";
 import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
-import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { toast } from "@app/hooks/useToast";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { orgQueries } from "@app/lib/queries";
 import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
-import { build } from "@server/build";
-import { UpdateResourceResponse } from "@server/routers/resource";
 import type { GetBatchedCertificateResponse } from "@server/routers/certificates/types";
+import { UpdateResourceResponse } from "@server/routers/resource";
 import { useQuery } from "@tanstack/react-query";
 import type { PaginationState } from "@tanstack/react-table";
 import { AxiosResponse } from "axios";