Add region from config file

messages/en-US.json

@@ -2095,7 +2095,6 @@
     "resourceBudgetSettings": "Budget",
     "resourceBudgetSettingsDescription": "Configure how this AI gateway restricts usage based on spending or token limits",
     "sidebarApiKeys": "API Keys",
-    "sidebarRedirects": "Redirects",
     "sidebarProvisioning": "Provisioning",
     "sidebarSettings": "Settings",
     "sidebarAllUsers": "All Users",
@@ -3478,7 +3477,8 @@
     },
     "priority": "Priority",
     "priorityDescription": "Higher priority routes are evaluated first. Priority = 100 means automatic ordering (system decides). Use another number to enforce manual priority.",
-    "instanceName": "Instance Name",
+    "instanceName": "Server ID",
+    "clearInstanceName": "Reset Server Association",
     "pathMatchModalTitle": "Configure Path Matching",
     "pathMatchModalDescription": "Set up how incoming requests should be matched based on their path.",
     "pathMatchType": "Match Type",
@@ -4364,49 +4364,5 @@
     "rdpUnicodeKeyboardMode": "Unicode keyboard mode",
     "sessionToolbarShow": "Show toolbar",
     "sessionToolbarHide": "Hide toolbar",
-    "actionUpdateSiteApprovals": "Update Site Approvals",
-    "redirectsTitle": "Manage Redirects",
-    "redirectsDescription": "Forward requests from a path on your domains or resources to another URL",
-    "redirectsSearch": "Search redirects...",
-    "redirectAdd": "Add Redirect",
-    "redirectSource": "Source",
-    "redirectAttachedTo": "Attached To",
-    "redirectType": "Type",
-    "redirectTypePermanent": "Permanent (301)",
-    "redirectTypeTemporary": "Temporary (302)",
-    "redirectUpdated": "Redirect updated successfully",
-    "redirectErrorUpdate": "Failed to update redirect",
-    "redirectDeleted": "Redirect deleted successfully",
-    "redirectErrorDelete": "Failed to delete redirect",
-    "redirectDelete": "Delete Redirect",
-    "redirectDeleteConfirm": "Confirm Delete Redirect",
-    "redirectQuestionRemove": "Are you sure you want to remove this redirect?",
-    "redirectMessageRemove": "Once removed, requests matching this redirect will no longer be forwarded.",
-    "redirectDestinationDomain": "Destination Domain",
-    "redirectDestinationDomainDescription": "The domain requests are sent to, such as example.com",
-    "redirectDestinationDomainRequired": "Enter a destination domain",
-    "redirectMatchPathDescription": "Which incoming paths this redirect applies to",
-    "redirectRewritePathDescription": "Optionally change the path before redirecting. Leave unset to keep the original path.",
-    "redirectRewritePathRequired": "Enter a rewrite path, or choose Strip Prefix",
-    "redirectCreate": "Create Redirect",
-    "redirectCreateDescription": "Forward requests matching a path to another URL",
-    "redirectEditDescription": "Update how this redirect forwards incoming requests",
-    "redirectGoBack": "Back to Redirects",
-    "redirectCreated": "Redirect created successfully",
-    "redirectErrorCreate": "Failed to create redirect",
-    "redirectSettings": "Redirect Settings",
-    "selectedRedirectDomain": "Selected Domain",
-    "selectedRedirectResource": "Selected Resource",
-    "redirectResourceNoDomain": "This resource has no domain",
-    "redirectSettingsGeneralDescription": "Configure the basic redirect settings",
-    "redirectSettingsDescription": "Configure where requests come from and where they are sent",
-    "redirectEnabledDescription": "Turn the redirect off to stop forwarding requests without deleting it",
-    "redirectAttachedToDescription": "Choose whether this redirect applies to a whole domain or a single resource",
-    "redirectAttachDomain": "Domain",
-    "redirectAttachResource": "Resource",
-    "redirectDomainRequired": "Select a domain to attach this redirect to",
-    "redirectResourceRequired": "Select a resource to attach this redirect to",
-    "redirectPermanent": "Permanent Redirect",
-    "redirectPermanentDescription": "Respond with 308 instead of 307. Permanent redirects are cached by browsers.",
-    "redirectDangerSectionDescription": "Permanently remove this redirect. This cannot be undone."
+    "actionUpdateSiteApprovals": "Update Site Approvals"
 }

package-lock.json

@@ -50,6 +50,7 @@
                 "@xterm/addon-fit": "^0.11.0",
                 "@xterm/addon-web-links": "^0.12.0",
                 "@xterm/xterm": "^6.0.0",
+                "acme-client": "^5.4.0",
                 "arctic": "3.7.0",
                 "axios": "1.20.0",
                 "better-sqlite3": "11.9.1",
@@ -61,6 +62,7 @@
                 "cors": "2.8.6",
                 "crypto-js": "4.2.0",
                 "d3": "7.9.0",
+                "dns-packet": "^5.6.1",
                 "drizzle-orm": "0.45.2",
                 "express": "5.2.1",
                 "express-rate-limit": "8.7.0",
@@ -124,6 +126,7 @@
                 "@types/cors": "2.8.19",
                 "@types/crypto-js": "4.2.2",
                 "@types/d3": "7.4.3",
+                "@types/dns-packet": "^5.6.5",
                 "@types/express": "5.0.6",
                 "@types/express-session": "1.19.0",
                 "@types/jmespath": "0.15.2",
@@ -2445,6 +2448,12 @@
                 "@jridgewell/sourcemap-codec": "^1.4.14"
             }
         },
+        "node_modules/@leichtgewicht/ip-codec": {
+            "version": "2.0.5",
+            "resolved": "https://registry.npmjs.org/@leichtgewicht/ip-codec/-/ip-codec-2.0.5.tgz",
+            "integrity": "sha512-Vo+PSpZG2/fmgmiNzYK9qWRh8h/CHrwD0mo1h1DzL4yzHNSfWYujGTYsWGreD000gcgmZ7K4Ys6Tx9TxtsKdDw==",
+            "license": "MIT"
+        },
         "node_modules/@levischuck/tiny-cbor": {
             "version": "0.2.11",
             "resolved": "https://registry.npmjs.org/@levischuck/tiny-cbor/-/tiny-cbor-0.2.11.tgz",
@@ -6764,6 +6773,16 @@
                 "@types/d3-selection": "*"
             }
         },
+        "node_modules/@types/dns-packet": {
+            "version": "5.6.5",
+            "resolved": "https://registry.npmjs.org/@types/dns-packet/-/dns-packet-5.6.5.tgz",
+            "integrity": "sha512-qXOC7XLOEe43ehtWJCMnQXvgcIpv6rPmQ1jXT98Ad8A3TB1Ue50jsCbSSSyuazScEuZ/Q026vHbrOTVkmwA+7Q==",
+            "dev": true,
+            "license": "MIT",
+            "dependencies": {
+                "@types/node": "*"
+            }
+        },
         "node_modules/@types/esrecurse": {
             "version": "4.3.1",
             "resolved": "https://registry.npmjs.org/@types/esrecurse/-/esrecurse-4.3.1.tgz",
@@ -7435,6 +7454,22 @@
                 "node": ">= 0.6"
             }
         },
+        "node_modules/acme-client": {
+            "version": "5.4.0",
+            "resolved": "https://registry.npmjs.org/acme-client/-/acme-client-5.4.0.tgz",
+            "integrity": "sha512-mORqg60S8iML6XSmVjqjGHJkINrCGLMj2QvDmFzI9vIlv1RGlyjmw3nrzaINJjkNsYXC41XhhD5pfy7CtuGcbA==",
+            "license": "MIT",
+            "dependencies": {
+                "@peculiar/x509": "^1.11.0",
+                "asn1js": "^3.0.5",
+                "axios": "^1.7.2",
+                "debug": "^4.3.5",
+                "node-forge": "^1.3.1"
+            },
+            "engines": {
+                "node": ">= 16"
+            }
+        },
         "node_modules/acorn": {
             "version": "8.16.0",
             "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
@@ -9261,6 +9296,18 @@
                 "node": ">=8"
             }
         },
+        "node_modules/dns-packet": {
+            "version": "5.6.1",
+            "resolved": "https://registry.npmjs.org/dns-packet/-/dns-packet-5.6.1.tgz",
+            "integrity": "sha512-l4gcSouhcgIKRvyy99RNVOgxXiicE+2jZoNmaNmZ6JXiGajBOJAesk1OBlJuM5k2c+eudGdLxDqXuPCKIj6kpw==",
+            "license": "MIT",
+            "dependencies": {
+                "@leichtgewicht/ip-codec": "^2.0.1"
+            },
+            "engines": {
+                "node": ">=6"
+            }
+        },
         "node_modules/doctrine": {
             "version": "2.1.0",
             "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-2.1.0.tgz",
@@ -13140,6 +13187,15 @@
                 "semver": "bin/semver.js"
             }
         },
+        "node_modules/node-forge": {
+            "version": "1.4.0",
+            "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
+            "integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
+            "license": "(BSD-3-Clause OR GPL-2.0)",
+            "engines": {
+                "node": ">= 6.13.0"
+            }
+        },
         "node_modules/node-releases": {
             "version": "2.0.54",
             "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",

package.json

@@ -73,6 +73,7 @@
         "@xterm/addon-fit": "^0.11.0",
         "@xterm/addon-web-links": "^0.12.0",
         "@xterm/xterm": "^6.0.0",
+        "acme-client": "^5.4.0",
         "arctic": "3.7.0",
         "axios": "1.20.0",
         "better-sqlite3": "11.9.1",
@@ -84,6 +85,7 @@
         "cors": "2.8.6",
         "crypto-js": "4.2.0",
         "d3": "7.9.0",
+        "dns-packet": "^5.6.1",
         "drizzle-orm": "0.45.2",
         "express": "5.2.1",
         "express-rate-limit": "8.7.0",
@@ -147,6 +149,7 @@
         "@types/cors": "2.8.19",
         "@types/crypto-js": "4.2.2",
         "@types/d3": "7.4.3",
+        "@types/dns-packet": "^5.6.5",
         "@types/express": "5.0.6",
         "@types/express-session": "1.19.0",
         "@types/jmespath": "0.15.2",

server/auth/actions.ts

@@ -205,12 +205,7 @@ export enum ActionsEnum {
     deleteVirtualApiKey = "deleteVirtualApiKey",
     getVirtualApiKey = "getVirtualApiKey",
     listVirtualApiKeys = "listVirtualApiKeys",
-    updateVirtualApiKey = "updateVirtualApiKey",
-    createRedirect = "createRedirect",
-    deleteRedirect = "deleteRedirect",
-    getRedirect = "getRedirect",
-    listRedirects = "listRedirects",
-    updateRedirect = "updateRedirect"
+    updateVirtualApiKey = "updateVirtualApiKey"
 }
 
 export async function checkUserActionPermission(

server/certificates.ts

@@ -0,0 +1,8 @@
+export async function startCertificateManager() {
+    // No-op: ACME certificate generation/management is only available in
+    // builds that include the private/enterprise feature set.
+}
+
+export async function stopCertificateManager() {
+    // No-op counterpart to startCertificateManager.
+}

server/db/names.ts

@@ -4,7 +4,6 @@ import {
     aiProviders,
     clients,
     db,
-    redirects,
     resourcePolicies,
     resources,
     siteResources
@@ -141,30 +140,6 @@ export async function getUniqueProviderName(orgId: string): Promise<string> {
     }
 }
 
-export async function getUniqueRedirectName(orgId: string): Promise<string> {
-    let loops = 0;
-    while (true) {
-        if (loops > 100) {
-            throw new Error("Could not generate a unique name");
-        }
-
-        const name = generateName();
-
-        const redirectCount = await db
-            .select({
-                niceId: redirects.niceId,
-                orgId: redirects.orgId
-            })
-            .from(redirects)
-            .where(and(eq(redirects.niceId, name), eq(redirects.orgId, orgId)));
-
-        if (redirectCount.length === 0) {
-            return name;
-        }
-        loops++;
-    }
-}
-
 export async function getUniqueResourcePolicyName(
     orgId: string
 ): Promise<string> {

server/db/pg/schema/schema.ts

@@ -227,38 +227,6 @@ export const resources = pgTable(
     ]
 );
 
-export const redirects = pgTable("redirects", {
-    redirectId: serial("redirectId").primaryKey(),
-    orgId: varchar("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    resourceId: integer("resourceId").references(() => resources.resourceId, {
-        onDelete: "cascade"
-    }),
-    domainId: varchar("domainId").references(() => domains.domainId, {
-        onDelete: "cascade"
-    }),
-    niceId: text("niceId").notNull(),
-    name: varchar("name").notNull(),
-    subdomain: varchar("subdomain"),
-    destinationDomain: varchar("destinationDomain").notNull(),
-    pathMatchType: varchar("pathMatchType")
-        .$type<"exact" | "prefix" | "regex">()
-        .notNull()
-        .default("regex"), // exact, prefix, regex
-    matchPath: varchar("matchPath").notNull().default(".*"),
-    rewritePath: varchar("rewritePath"), // if set, rewrites the path to this value,
-    //  else, the original path will be kept
-    rewritePathType: varchar("rewritePathType").$type<
-        "exact" | "prefix" | "regex" | "stripPrefix"
-    >(), // exact, prefix, regex, stripPrefix
-
-    permanent: boolean("permanent").notNull().default(false),
-    enabled: boolean("enabled").notNull().default(true)
-});
-
 export const resourceAiProviders = pgTable(
     "resourceAiProviders",
     {
@@ -2097,7 +2065,6 @@ export type ResourcePolicy = InferSelectModel<typeof resourcePolicies>;
 export type RolePolicy = InferSelectModel<typeof rolePolicies>;
 export type UserPolicy = InferSelectModel<typeof userPolicies>;
 export type ResourcePolicyRule = InferSelectModel<typeof resourcePolicyRules>;
-export type Redirect = InferSelectModel<typeof redirects>;
 export type AiProvider = InferSelectModel<typeof aiProviders>;
 export type AiModel = InferSelectModel<typeof aiModels>;
 export type AiBudget = InferSelectModel<typeof aiBudgets>;

server/db/sqlite/schema/schema.ts

@@ -243,40 +243,6 @@ export const resources = sqliteTable(
     (table) => [index("idx_resources_orgId").on(table.orgId)]
 );
 
-export const redirects = sqliteTable("redirects", {
-    redirectId: integer("redirectId").primaryKey({ autoIncrement: true }),
-    orgId: text("orgId")
-        .references(() => orgs.orgId, {
-            onDelete: "cascade"
-        })
-        .notNull(),
-    resourceId: integer("resourceId").references(() => resources.resourceId, {
-        onDelete: "cascade"
-    }),
-    domainId: text("domainId").references(() => domains.domainId, {
-        onDelete: "cascade"
-    }),
-    niceId: text("niceId").notNull(),
-    name: text("name").notNull(),
-    subdomain: text("subdomain"),
-    destinationDomain: text("destinationDomain").notNull(),
-    pathMatchType: text("pathMatchType")
-        .$type<"exact" | "prefix" | "regex">()
-        .notNull()
-        .default("regex"), // exact, prefix, regex
-    matchPath: text("matchPath").notNull().default("*"),
-    rewritePath: text("rewritePath"), // if set, rewrites the path to this value,
-    //  else, the original path will be kept
-    rewritePathType: text("rewritePathType").$type<
-        "exact" | "prefix" | "regex" | "stripPrefix"
-    >(), // exact, prefix, regex, stripPrefix
-
-    permanent: integer("permanent", { mode: "boolean" })
-        .notNull()
-        .default(false),
-    enabled: integer("enabled", { mode: "boolean" }).notNull().default(true)
-});
-
 export const resourceAiProviders = sqliteTable(
     "resourceAiProviders",
     {
@@ -2138,7 +2104,6 @@ export type ResourcePolicyHeaderAuth = InferSelectModel<
 >;
 export type RolePolicy = InferSelectModel<typeof rolePolicies>;
 export type UserPolicy = InferSelectModel<typeof userPolicies>;
-export type Redirect = InferSelectModel<typeof redirects>;
 export type AiProvider = InferSelectModel<typeof aiProviders>;
 export type AiModel = InferSelectModel<typeof aiModels>;
 export type AiBudget = InferSelectModel<typeof aiBudgets>;

server/dns.ts

@@ -0,0 +1,8 @@
+export async function startDnsServer() {
+    // No-op: the authoritative DNS server is only available in builds
+    // that include the private/enterprise feature set.
+}
+
+export async function stopDnsServer() {
+    // No-op counterpart to startDnsServer.
+}

server/index.ts

@@ -25,6 +25,8 @@ import { setHostMeta } from "@server/lib/hostMeta";
 import { TraefikConfigManager } from "@server/lib/traefik/TraefikConfigManager";
 import { initCleanup } from "#dynamic/cleanup";
 import { startSchedulers } from "#dynamic/startSchedulers";
+import { startDnsServer } from "#dynamic/dns";
+import { startCertificateManager } from "#dynamic/certificates";
 import license from "#dynamic/license/license";
 import { fetchServerIp } from "@server/lib/serverIpService";
 import { initAiModelCatalog } from "@server/lib/aiModelCatalog";
@@ -45,6 +47,10 @@ async function startServers() {
 
     startSchedulers();
 
+    await startDnsServer();
+
+    await startCertificateManager();
+
     // Start all servers
     const apiServer = createApiServer();
     const internalServer = createInternalServer();

server/lib/dns/generateDomains.ts

@@ -0,0 +1,3 @@
+export function createCname(domainId: string, baseDomain: string) {}
+
+export function createNs() {}

server/lib/exitNodes/exitNodeCheckIn.ts

@@ -0,0 +1,14 @@
+// Tracks, per process lifetime, whether a given exit node has ever checked in
+// (called /gerbil/get-config) since this Pangolin instance started. This lets
+// callers distinguish "gerbil hasn't come up yet" (expected briefly after a
+// restart, since gerbil depends on pangolin's container starting first) from
+// "gerbil was reachable and now isn't" (a real problem worth an error log).
+const checkedInExitNodeIds = new Set<number>();
+
+export function markExitNodeCheckedIn(exitNodeId: number): void {
+    checkedInExitNodeIds.add(exitNodeId);
+}
+
+export function hasExitNodeCheckedIn(exitNodeId: number): boolean {
+    return checkedInExitNodeIds.has(exitNodeId);
+}

server/lib/exitNodes/exitNodeComms.ts

@@ -1,6 +1,7 @@
 import axios from "axios";
 import logger from "@server/logger";
 import { ExitNode } from "@server/db";
+import { hasExitNodeCheckedIn } from "./exitNodeCheckIn";
 
 interface ExitNodeRequest {
     remoteType?: string;
@@ -72,13 +73,19 @@ export async function sendToExitNode(
 
         return response.data;
     } catch (error) {
-        if (axios.isAxiosError(error)) {
-            logger.error(
-                `Error making ${method} request (can Pangolin see Gerbil HTTP API?) for exit node at ${exitNode.reachableAt} (status: ${error.response?.status}): ${error.message}`
-            );
+        const message = axios.isAxiosError(error)
+            ? `Error making ${method} request (can Pangolin see Gerbil HTTP API?) for exit node at ${exitNode.reachableAt} (status: ${error.response?.status}): ${error.message}`
+            : `Error making ${method} request for exit node at ${exitNode.reachableAt}: ${error}`;
+
+        // The exit node (gerbil) may still be starting up and not yet
+        // reachable. Until it has checked in at least once, log this at a
+        // lower level since it's expected; once it has checked in, a
+        // connection failure is a real problem.
+        if (hasExitNodeCheckedIn(exitNode.exitNodeId)) {
+            logger.error(message);
         } else {
-            logger.error(
-                `Error making ${method} request for exit node at ${exitNode.reachableAt}: ${error}`
+            logger.warn(
+                `${message} (exit node has not checked in yet since startup, this is expected briefly)`
             );
         }
         throw error;

server/lib/exitNodes/index.ts

@@ -1,5 +1,6 @@
 export * from "./exitNodes";
 export * from "./exitNodeComms";
+export * from "./exitNodeCheckIn";
 export * from "./subnet";
 export * from "./getCurrentExitNodeId";
 export * from "./calculateExitNodeWeight";

server/lib/readConfigFile.ts

@@ -493,23 +493,6 @@ export const configSchema = z
                     .prefault({})
             })
             .optional()
-            .prefault({}),
-        dns: z
-            .object({
-                nameservers: z
-                    .array(z.string().optional().optional())
-                    .optional()
-                    .default([
-                        "ns1.pangolin.net",
-                        "ns2.pangolin.net",
-                        "ns3.pangolin.net"
-                    ]),
-                cname_extension: z
-                    .string()
-                    .optional()
-                    .default("cname.pangolin.net")
-            })
-            .optional()
             .prefault({})
     })
     .refine(

server/lib/retry.ts

@@ -0,0 +1,72 @@
+import logger from "@server/logger";
+
+export async function withRetry<T>(
+    fn: () => Promise<T>,
+    options: {
+        retries?: number;
+        baseDelayMs?: number;
+        label?: string;
+        // Called with each caught error to decide whether it's worth
+        // retrying. Defaults to retrying everything (existing behavior) -
+        // pass this to exclude errors that are known to be permanent (e.g.
+        // an upstream rate limit or validation rejection) rather than
+        // transient, so they fail fast instead of wasting retry attempts.
+        shouldRetry?: (error: unknown) => boolean;
+    } = {}
+): Promise<T> {
+    const {
+        retries = 3,
+        baseDelayMs = 250,
+        label = "operation",
+        shouldRetry = () => true
+    } = options;
+
+    let attempt = 0;
+    while (true) {
+        try {
+            return await fn();
+        } catch (error) {
+            attempt++;
+            if (attempt > retries || !shouldRetry(error)) {
+                throw error;
+            }
+
+            // Exponential backoff with jitter so retries don't all land at once.
+            const delay =
+                baseDelayMs * 2 ** (attempt - 1) * (0.5 + Math.random());
+
+            logger.warn(
+                `${label} failed (attempt ${attempt}/${retries + 1}), retrying in ${delay.toFixed(0)}ms`,
+                error
+            );
+
+            await new Promise((resolve) => setTimeout(resolve, delay));
+        }
+    }
+}
+
+// Bounds an operation that has no timeout of its own (e.g. acme-client's
+// axios instance never sets one, so a stalled TCP connection to the ACME
+// server hangs forever instead of erroring). Without this, a single hung
+// call can leave its caller's promise permanently unsettled - fatal for
+// code that gates future work on that promise resolving, like the
+// scheduler's runExclusive() waiting on a batch's Promise.all.
+export async function withTimeout<T>(
+    promise: Promise<T>,
+    ms: number,
+    label = "operation"
+): Promise<T> {
+    let timer: NodeJS.Timeout;
+    const timeout = new Promise<never>((_, reject) => {
+        timer = setTimeout(
+            () => reject(new Error(`${label} timed out after ${ms}ms`)),
+            ms
+        );
+    });
+
+    try {
+        return await Promise.race([promise, timeout]);
+    } finally {
+        clearTimeout(timer!);
+    }
+}

server/lib/traefik/TraefikConfigManager.ts

@@ -6,7 +6,10 @@ import * as yaml from "js-yaml";
 import axios from "axios";
 import { db, exitNodes } from "@server/db";
 import { eq } from "drizzle-orm";
-import { getCurrentExitNodeId } from "@server/lib/exitNodes";
+import {
+    getCurrentExitNodeId,
+    hasExitNodeCheckedIn
+} from "@server/lib/exitNodes";
 import { getTraefikConfig } from "#dynamic/lib/traefik";
 import { getValidCertificatesForDomains } from "@server/lib/certificates";
 import { sendToExitNode } from "#dynamic/lib/exitNodes";
@@ -341,10 +344,6 @@ export class TraefikConfigManager {
 
             const { domains, traefikConfig } = getTraefikConfig;
 
-            // Add static domains from config
-            // const staticDomains = [config.getRawConfig().app.dashboard_url];
-            // staticDomains.forEach((domain) => domains.add(domain));
-
             // Log if domains changed
             if (
                 this.lastActiveDomains.size !== domains.size ||
@@ -358,7 +357,7 @@ export class TraefikConfigManager {
                 this.lastActiveDomains = new Set(domains);
             }
 
-            if (process.env.USE_PANGOLIN_DNS === "true" && build != "oss") {
+            if (process.env.CERT_MODE === "pangolin" && build != "oss") {
                 // Scan current local certificate state
                 this.lastLocalCertificateState =
                     await this.scanLocalCertificateState();
@@ -439,13 +438,13 @@ export class TraefikConfigManager {
                     // Always ensure all existing certificates (including wildcards) are in the config
                     await this.updateDynamicConfigFromLocalCerts(domains);
                 } else {
-                    const timeSinceLastFetch = this.lastCertificateFetch
-                        ? Math.round(
-                              (Date.now() -
-                                  this.lastCertificateFetch.getTime()) /
-                                  (1000 * 60)
-                          )
-                        : 0;
+                    // const timeSinceLastFetch = this.lastCertificateFetch
+                    //     ? Math.round(
+                    //           (Date.now() -
+                    //               this.lastCertificateFetch.getTime()) /
+                    //               (1000 * 60)
+                    //       )
+                    //     : 0;
 
                     // logger.debug(
                     //     `Skipping certificate fetch - no changes detected and within 24-hour window (last fetch: ${timeSinceLastFetch} minutes ago)`
@@ -466,32 +465,51 @@ export class TraefikConfigManager {
             await this.writeTraefikDynamicConfig(traefikConfig);
 
             // Send domains to SNI proxy
+            let exitNodeForSni: typeof exitNodes.$inferSelect | undefined;
             try {
-                let exitNode;
                 if (config.getRawConfig().gerbil.exit_node_name) {
                     const exitNodeName =
                         config.getRawConfig().gerbil.exit_node_name!;
-                    [exitNode] = await db
+                    [exitNodeForSni] = await db
                         .select()
                         .from(exitNodes)
                         .where(eq(exitNodes.name, exitNodeName))
                         .limit(1);
                 } else {
-                    [exitNode] = await db.select().from(exitNodes).limit(1);
+                    [exitNodeForSni] = await db
+                        .select()
+                        .from(exitNodes)
+                        .limit(1);
                 }
-                if (exitNode) {
-                    await sendToExitNode(exitNode, {
+                if (exitNodeForSni) {
+                    await sendToExitNode(exitNodeForSni, {
                         localPath: "/update-local-snis",
                         method: "POST",
-                        data: { fullDomains: Array.from(domains) }
+                        data: {
+                            fullDomains: [
+                                ...Array.from(domains),
+                                ...config.getRawConfig().traefik.static_domains
+                            ]
+                        }
                     });
                 } else {
-                    logger.error(
+                    logger.warn(
                         "No exit node found. Has gerbil registered yet?"
                     );
                 }
             } catch (err) {
-                logger.error("Failed to post domains to SNI proxy:", err);
+                // sendToExitNode already logs the underlying connection
+                // error at the appropriate level (warn before the exit node
+                // has checked in since startup, error after), so avoid
+                // double-logging it as an error here.
+                if (
+                    exitNodeForSni &&
+                    !hasExitNodeCheckedIn(exitNodeForSni.exitNodeId)
+                ) {
+                    logger.warn("Failed to post domains to SNI proxy:", err);
+                } else {
+                    logger.error("Failed to post domains to SNI proxy:", err);
+                }
             }
 
             // Update active domains tracking

server/lib/traefik/rule.ts

@@ -1,7 +1,5 @@
-/**
- * Build the Host()/HostRegexp() Traefik rule for a resource's domain.
- * Wildcard resources match any single subdomain via HostRegexp.
- */
+// Build the Host()/HostRegexp() Traefik rule for a resource's domain.
+// Wildcard resources match any single subdomain via HostRegexp.
 export function buildHostRule(
     fullDomain: string,
     wildcard?: boolean | null
@@ -14,10 +12,8 @@ export function buildHostRule(
     return `Host(\`${fullDomain}\`)`;
 }
 
-/**
- * Append a path-matching clause to a Traefik rule based on the resource's
- * configured path and pathMatchType.
- */
+// Append a path-matching clause to a Traefik rule based on the resource's
+// configured path and pathMatchType.
 export function appendPathMatch(
     rule: string,
     path: string | null | undefined,
@@ -40,10 +36,8 @@ export function appendPathMatch(
     return rule;
 }
 
-/**
- * Compute the router priority for a resource, favoring an explicit override
- * and otherwise deriving it from the path match specificity.
- */
+// Compute the router priority for a resource, favoring an explicit override
+// and otherwise deriving it from the path match specificity.
 export function computeRoutePriority(
     priority: number | null | undefined,
     path: string | null | undefined,

server/openApi.ts

@@ -32,8 +32,7 @@ export enum OpenAPITags {
     AiProvider = "AI Provider",
     AiModel = "AI Model",
     AiBudget = "AI Budget",
-    VirtualApiKey = "Virtual API Key",
-    Redirect = "Redirect"
+    VirtualApiKey = "Virtual API Key"
 }
 
 // Order here controls the order tags are displayed in Swagger UI

server/private/certificates.ts

@@ -0,0 +1,17 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+export {
+    startCertificateManager,
+    stopCertificateManager
+} from "./lib/certificates";

server/private/cleanup.ts

@@ -20,6 +20,8 @@ import { flushSiteBandwidthToDb } from "@server/routers/gerbil/receiveBandwidth"
 import { stopPingAccumulator } from "@server/routers/newt/pingAccumulator";
 import { shutdownUsageRecorder } from "@server/lib/aiBudgetEnforcement";
 import { shutdownAiSessionLogger } from "@server/routers/aiGateway/logAiSession";
+import { stopDnsServer } from "./dns";
+import { stopCertificateManager } from "./certificates";
 
 async function cleanup() {
     await stopPingAccumulator();
@@ -31,6 +33,8 @@ async function cleanup() {
     await rateLimitService.cleanup();
     await wsCleanup();
     await logStreamingManager.shutdown();
+    await stopDnsServer();
+    await stopCertificateManager();
 
     process.exit(0);
 }

server/private/dns.ts

@@ -0,0 +1,44 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { AuthoritativeDNSServer } from "#private/lib/dns";
+import { privateConfig } from "#private/lib/config";
+
+let dnsServer: AuthoritativeDNSServer | undefined;
+
+export async function startDnsServer() {
+    const dnsConfig = privateConfig.getRawPrivateConfig().dns;
+    if (!dnsConfig || !dnsConfig.enabled) {
+        return;
+    }
+
+    const cacheOptions = {
+        stdTTL: 300, // 5 minutes default TTL
+        checkperiod: 60, // Check for expired keys every 60 seconds
+        useClones: false // Better performance
+    };
+
+    // Create DNS server
+    dnsServer = new AuthoritativeDNSServer(dnsConfig.listen_port, cacheOptions);
+
+    await dnsServer.start();
+}
+
+export async function stopDnsServer() {
+    if (!dnsServer) {
+        return;
+    }
+
+    await dnsServer.stop();
+    dnsServer = undefined;
+}

server/private/lib/cache.ts

@@ -13,7 +13,7 @@
 
 import NodeCache from "node-cache";
 import logger from "@server/logger";
-import { redisManager, regionalRedisManager } from "@server/private/lib/redis";
+import { redisManager, regionalRedisManager } from "#private/lib/redis";
 
 // Create local cache with maxKeys limit to prevent memory leaks
 // With ~10k requests/day and 5min TTL, 10k keys should be more than sufficient
@@ -97,11 +97,11 @@ class AdaptiveCache {
                 const value = await redisManager.get(key);
 
                 if (value !== null) {
-                    logger.debug(`Cache hit in Redis: ${key}`);
+                    // logger.debug(`Cache hit in Redis: ${key}`);
                     return JSON.parse(value) as T;
                 }
 
-                logger.debug(`Cache miss in Redis: ${key}`);
+                // logger.debug(`Cache miss in Redis: ${key}`);
                 return undefined;
             } catch (error) {
                 logger.error(`Redis get error for key ${key}:`, error);
@@ -134,7 +134,7 @@ class AdaptiveCache {
                     const success = await redisManager.del(k);
                     if (success) {
                         deletedCount++;
-                        logger.debug(`Deleted key from Redis: ${k}`);
+                        // logger.debug(`Deleted key from Redis: ${k}`);
                     }
                 }
 
@@ -161,7 +161,7 @@ class AdaptiveCache {
             const success = localCache.del(k);
             if (success > 0) {
                 deletedCount++;
-                logger.debug(`Deleted key from local cache: ${k}`);
+                // logger.debug(`Deleted key from local cache: ${k}`);
             }
         }
 
@@ -229,7 +229,7 @@ class AdaptiveCache {
         }
 
         localCache.flushAll();
-        logger.debug("Flushed local cache");
+        // logger.debug("Flushed local cache");
     }
 
     /**
@@ -332,7 +332,7 @@ class RegionalAdaptiveCache {
                     redisTtl
                 );
                 if (success) {
-                    logger.debug(`[regional] Set key in Redis: ${key}`);
+                    // logger.debug(`[regional] Set key in Redis: ${key}`);
                     return true;
                 }
             } catch (error) {
@@ -353,10 +353,10 @@ class RegionalAdaptiveCache {
             try {
                 const value = await regionalRedisManager.get(key);
                 if (value !== null) {
-                    logger.debug(`[regional] Cache hit in Redis: ${key}`);
+                    // logger.debug(`[regional] Cache hit in Redis: ${key}`);
                     return JSON.parse(value) as T;
                 }
-                logger.debug(`[regional] Cache miss in Redis: ${key}`);
+                // logger.debug(`[regional] Cache miss in Redis: ${key}`);
                 return undefined;
             } catch (error) {
                 logger.error(
@@ -385,7 +385,7 @@ class RegionalAdaptiveCache {
                     const success = await regionalRedisManager.del(k);
                     if (success) {
                         deletedCount++;
-                        logger.debug(`[regional] Deleted key from Redis: ${k}`);
+                        // logger.debug(`[regional] Deleted key from Redis: ${k}`);
                     }
                 }
                 if (deletedCount === keys.length) return deletedCount;
@@ -400,7 +400,7 @@ class RegionalAdaptiveCache {
             const count = regionalLocalCache.del(k);
             if (count > 0) {
                 deletedCount++;
-                logger.debug(`[regional] Deleted key from local cache: ${k}`);
+                // logger.debug(`[regional] Deleted key from local cache: ${k}`);
             }
         }
         return deletedCount;

server/private/lib/certificates/acme-client.ts

@@ -0,0 +1,298 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import * as acme from "acme-client";
+import * as fs from "fs";
+import { eq } from "drizzle-orm/sql";
+import { privateConfig as config } from "#private/lib/config";
+import { DnsChallenge, db, dnsChallenge } from "@server/db";
+import { withRetry } from "@server/lib/retry";
+import logger from "@server/logger";
+import { acmeRateLimiter } from "./acmeRateLimiter";
+
+// acme-client's own retry/backoff logging (429 retries, 5xx retries, each
+// status-poll tick in waitForValidStatus) is a no-op by default - it only
+// activates via DEBUG=acme-client or this call, neither of which was wired
+// up. Without it, a cert silently retrying a Let's Encrypt rate limit for
+// several minutes is indistinguishable in our logs from one that's actually
+// hung, since our own logging only wraps the call, not what happens inside
+// it. Must run before any AcmeClient method is called.
+acme.setLogger((msg: string) => logger.info(`[acme-client] ${msg}`));
+
+// acme-client's axios retry wrapper treats any response-less request error
+// (timeout, connection reset, DNS blip reaching the ACME server) as
+// retryable, but once its internal retries are exhausted it falls through to
+// `validateStatus(response)` with `response` still undefined, throwing this
+// uninformative TypeError instead of the real network error.
+// https://github.com/publishlab/node-acme-client/blob/master/src/axios.js
+function isUnresponsiveAcmeError(error: unknown): boolean {
+    return (
+        error instanceof TypeError &&
+        error.message ===
+            "Cannot read properties of undefined (reading 'config')"
+    );
+}
+
+function normalizeAcmeError(error: unknown): Error {
+    if (isUnresponsiveAcmeError(error)) {
+        return new Error(
+            "ACME server did not respond after repeated attempts (network error reaching the ACME endpoint)",
+            { cause: error }
+        );
+    }
+    return error instanceof Error ? error : new Error(String(error));
+}
+
+export class AcmeClientManager {
+    private client: acme.Client | null = null;
+    private accountKey: string | null = null;
+
+    async initialize() {
+        try {
+            this.accountKey = await this.loadAccountKey();
+
+            this.client = new acme.Client({
+                directoryUrl: config.getRawConfig().acme!.acme_directory_url,
+                accountKey: this.accountKey
+            });
+
+            // Try to create account or get existing one
+            await this.client.createAccount({
+                termsOfServiceAgreed: true,
+                contact: [`mailto:${config.getRawConfig().acme!.contact_email}`]
+            });
+
+            logger.info("ACME client initialized successfully");
+        } catch (error) {
+            logger.error("Failed to initialize ACME client:", error);
+            throw error;
+        }
+    }
+
+    private async loadAccountKey(): Promise<string> {
+        const keyPath = config.getRawConfig().acme!.acme_account_key_path;
+
+        if (fs.existsSync(keyPath)) {
+            logger.info("Loading existing account key");
+            return fs.readFileSync(keyPath, "utf8");
+        } else {
+            logger.info("Generating new account key");
+            const privateKey = await acme.crypto.createPrivateKey();
+            const privateKeyString = privateKey.toString();
+            fs.writeFileSync(keyPath, privateKeyString);
+            return privateKeyString;
+        }
+    }
+
+    getClient(): acme.Client {
+        if (!this.client) {
+            throw new Error("ACME client not initialized");
+        }
+        return this.client;
+    }
+
+    async createOrder(domain: string, wildcard: boolean = false): Promise<any> {
+        const client = this.getClient();
+
+        const identifiers = wildcard
+            ? [
+                  { type: "dns", value: domain },
+                  { type: "dns", value: `*.${domain}` }
+              ]
+            : [{ type: "dns", value: domain }];
+
+        await acmeRateLimiter.acquire();
+        const order = await client.createOrder({
+            identifiers
+        });
+
+        if (wildcard) {
+            logger.info(`Created wildcard order for domain: ${domain}`);
+        } else {
+            logger.info(`Created order for domain: ${domain}`);
+        }
+        return order;
+    }
+
+    async getAuthorizations(order: any): Promise<any[]> {
+        const client = this.getClient();
+        await acmeRateLimiter.acquire();
+        return client.getAuthorizations(order);
+    }
+
+    async handleDnsChallenge(
+        dnsChallenges: {
+            authz: any;
+            challenge: any;
+        }[]
+    ): Promise<void> {
+        const client = this.getClient();
+
+        let challengeDomains: DnsChallenge[] = [];
+
+        for (const { authz, challenge } of dnsChallenges) {
+            const keyAuthorization =
+                await client.getChallengeKeyAuthorization(challenge);
+
+            // Extract the domain from authorization
+            const domain = authz.identifier.value;
+
+            // Store challenge in database for DNS server to pick up
+            challengeDomains = await withRetry(
+                () =>
+                    db
+                        .insert(dnsChallenge)
+                        .values({
+                            domain: domain,
+                            token: challenge.token,
+                            keyAuthorization,
+                            createdAt: Math.floor(Date.now() / 1000),
+                            expiresAt: Math.floor(
+                                (Date.now() +
+                                    config.getRawConfig().acme!
+                                        .challenge_ttl_ms) /
+                                    1000
+                            )
+                        })
+                        .returning(),
+                { label: `insert dnsChallenge for domain ${domain}` }
+            );
+
+            logger.info(
+                `DNS challenge stored for domain: ${domain} as token ${challenge.token} and keyAuthorization`
+            );
+        }
+
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+
+        const failedDomains: string[] = [];
+
+        for (const { authz, challenge } of dnsChallenges) {
+            const domain = authz.identifier.value;
+            const challengeDomain = `_acme-challenge.${domain}`;
+
+            try {
+                // The ACME server occasionally has a transient network blip
+                // mid-sequence; retry the whole verify/complete/wait sequence
+                // rather than just the DNS challenge propagation wait, since
+                // these calls are safe to repeat against the ACME server.
+                await withRetry(
+                    async () => {
+                        // Verify challenge
+                        await acmeRateLimiter.acquire();
+                        await client.verifyChallenge(authz, challenge);
+
+                        // Complete challenge
+                        logger.info(
+                            `Completing challenge for domain: ${challengeDomain}`
+                        );
+                        await acmeRateLimiter.acquire();
+                        await client.completeChallenge(challenge);
+
+                        // Wait for validation
+                        logger.info(
+                            `Waiting for challenge to be validated for domain: ${challengeDomain}...`
+                        );
+                        await acmeRateLimiter.acquire();
+                        await client.waitForValidStatus(challenge);
+                    },
+                    {
+                        retries: 2,
+                        baseDelayMs: 5000,
+                        label: `ACME challenge completion for domain ${domain}`,
+                        // Only retry the known network-blip crash - a
+                        // genuine validation failure (e.g. challenge marked
+                        // "invalid" because the DNS record wasn't found) is
+                        // permanent and should fail immediately instead of
+                        // burning Let's Encrypt's per-hostname failed-
+                        // validation rate limit on retries that can't help.
+                        shouldRetry: isUnresponsiveAcmeError
+                    }
+                );
+
+                logger.info(`Challenge completed for domain: ${domain}`);
+            } catch (error) {
+                logger.error(
+                    `Failed to complete challenge for domain ${domain}:`,
+                    normalizeAcmeError(error)
+                );
+                failedDomains.push(domain);
+            }
+        }
+
+        for (const challengeDomain of challengeDomains) {
+            await this.removeDnsChallenge(challengeDomain.dnsChallengeId);
+            logger.info(
+                `Removed DNS challenge for domain: ${challengeDomain.domain}`
+            );
+        }
+
+        // A failed dns-01 challenge leaves the order stuck in "pending" -
+        // finalizing it would just fail with a confusing ACME error, so
+        // stop here and let the caller mark the certificate as failed.
+        if (failedDomains.length > 0) {
+            throw new Error(
+                `DNS-01 challenge validation failed for domain(s): ${failedDomains.join(", ")}`
+            );
+        }
+    }
+
+    async removeDnsChallenge(dnsChallengeId: number): Promise<void> {
+        try {
+            await withRetry(
+                () =>
+                    db
+                        .delete(dnsChallenge)
+                        .where(eq(dnsChallenge.dnsChallengeId, dnsChallengeId)),
+                { label: `delete dnsChallenge ${dnsChallengeId}` }
+            );
+        } catch (error) {
+            logger.error(
+                `Failed to clean up DNS challenge for id ${dnsChallengeId}:`,
+                error
+            );
+        }
+    }
+
+    async finalizeCertificate(
+        order: any,
+        domain: string,
+        wildcard: boolean = false
+    ): Promise<{ certificate: string; privateKey: string }> {
+        const client = this.getClient();
+
+        const altNames = wildcard ? [`*.${domain}`, domain] : [domain];
+
+        // Create CSR
+        const [privateKey, csr] = await acme.crypto.createCsr({
+            altNames
+        });
+
+        // Finalize order
+        await acmeRateLimiter.acquire();
+        const finalizedOrder = await client.finalizeOrder(order, csr);
+
+        // Get certificate
+        await acmeRateLimiter.acquire();
+        const certificate = await client.getCertificate(finalizedOrder);
+
+        logger.info(`Certificate obtained for domain: ${domain}`);
+
+        return {
+            certificate: certificate.toString(),
+            privateKey: privateKey.toString()
+        };
+    }
+}
+
+export const acmeClientManager = new AcmeClientManager();

server/private/lib/certificates/acmeRateLimiter.ts

@@ -0,0 +1,71 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { privateConfig as config } from "#private/lib/config";
+import logger from "@server/logger";
+import { redis } from "../redis";
+// Caps outgoing ACME API calls to a fixed budget per wall-clock second,
+// shared across all pops workers via Redis (mirrors the lockManager pattern
+// in @lib/lock) - a per-process limiter wouldn't be enough since multiple
+// workers issue certificates against the same Let's Encrypt account.
+const ACQUIRE_SCRIPT = `
+local key = KEYS[1]
+local limit = tonumber(ARGV[1])
+local current = redis.call('INCR', key)
+if current == 1 then
+    redis.call('PEXPIRE', key, 2000)
+end
+if current > limit then
+    return 0
+else
+    return 1
+end
+`;
+
+class AcmeRateLimiter {
+    async acquire(): Promise<void> {
+        const limit =
+            config.getRawConfig().acme?.acme_requests_per_second ?? 15;
+
+        for (;;) {
+            const bucket = Math.floor(Date.now() / 1000);
+            const key = `acme_rate_limit:${bucket}`;
+
+            let allowed: number;
+            try {
+                allowed = (await redis.eval(
+                    ACQUIRE_SCRIPT,
+                    1,
+                    key,
+                    limit.toString()
+                )) as number;
+            } catch (error) {
+                logger.error(
+                    "ACME rate limiter check failed, proceeding without throttling:",
+                    error
+                );
+                return;
+            }
+
+            if (allowed === 1) {
+                return;
+            }
+
+            // Budget for this second is spent - wait for the next window.
+            const waitMs = 1000 - (Date.now() % 1000) + 10;
+            await new Promise((resolve) => setTimeout(resolve, waitMs));
+        }
+    }
+}
+
+export const acmeRateLimiter = new AcmeRateLimiter();

server/private/lib/certificates/certificate-service.ts

@@ -0,0 +1,511 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { acmeClientManager } from "./acme-client";
+import { dnsValidator } from "./dns-validator";
+import { getTableColumns } from "drizzle-orm";
+import { eq, and, or, isNull, lt, asc } from "drizzle-orm/sql";
+import { config } from "@server/lib/config";
+import { db, certificates, domains, Certificate } from "@server/db";
+import { encrypt } from "@server/lib/crypto";
+import { withTimeout, withRetry } from "@server/lib/retry";
+import logger from "@server/logger";
+import { lockManager } from "../lock";
+import { pushCertUpdateToAffectedNewts } from "@server/lib/acmeCertSync";
+import crypto from "crypto";
+
+// Number of on-demand DNS validation attempts made right before a
+// certificate is (re)issued, to avoid burning Let's Encrypt rate limits on
+// domains whose DNS has drifted since they were last verified.
+const PRE_CERT_DNS_VALIDATION_ATTEMPTS = 3;
+
+// Hard ceiling on a single certificate's issuance/renewal flow. acme-client's
+// axios instance never sets a request timeout, so a stalled connection to
+// the ACME server hangs forever instead of erroring - and since
+// processPendingCertificates/processRenewalCandidates gate the *next* batch
+// on Promise.all(...) over the current one, one hung certificate would
+// otherwise stall every other domain permanently. Sized generously above the
+// legitimate worst case (acme-client's own bounded backoff is ~3.6min per
+// status-polling loop, and a wildcard cert's two identifiers plus order
+// finalization can chain a few of those) so this only fires on a genuine hang.
+const CERTIFICATE_ISSUANCE_TIMEOUT_MS = 20 * 60 * 1000;
+
+// "requested" is set the instant a cert starts processing and is never
+// queried anywhere else - processPendingCertificates only selects "pending"
+// and processRenewalCandidates only selects "valid". So if the *process*
+// dies mid-flight (OOM, node eviction, a rolling deploy) rather than just
+// hanging, the row is orphaned in "requested" permanently with nothing to
+// ever pick it back up, no matter how good the in-process timeouts are.
+// Threshold is set comfortably above CERTIFICATE_ISSUANCE_TIMEOUT_MS plus the
+// scheduler's own outer backstop so this never reclaims a cert that's still
+// genuinely being worked on.
+const STUCK_CERTIFICATE_THRESHOLD_MS = 40 * 60 * 1000;
+
+export class CertificateService {
+    // Runs at the top of every processPendingCertificates tick so an
+    // interrupted worker's leftovers always get put back in the queue
+    // instead of sitting invisible to every query forever.
+    private async reclaimStuckCertificates(): Promise<void> {
+        const staleBefore =
+            Math.floor(Date.now() / 1000) -
+            Math.floor(STUCK_CERTIFICATE_THRESHOLD_MS / 1000);
+
+        const reclaimed = await db
+            .update(certificates)
+            .set({
+                status: "pending",
+                errorMessage:
+                    'Reclaimed after being stuck in "requested" state - the worker processing it likely restarted or crashed',
+                updatedAt: Math.floor(Date.now() / 1000)
+            })
+            .where(
+                and(
+                    eq(certificates.status, "requested"),
+                    lt(certificates.updatedAt, staleBefore)
+                )
+            )
+            .returning({ domain: certificates.domain });
+
+        if (reclaimed.length > 0) {
+            logger.warn(
+                `Reclaimed ${reclaimed.length} certificate(s) stuck in "requested" state: ${reclaimed
+                    .map((c) => c.domain)
+                    .join(", ")}`
+            );
+        }
+    }
+
+    async processPendingCertificates(): Promise<void> {
+        logger.debug("Checking for pending certificates...");
+
+        await this.reclaimStuckCertificates();
+
+        const pendingCerts = await db
+            .select(getTableColumns(certificates))
+            .from(certificates)
+            .leftJoin(domains, eq(certificates.domainId, domains.domainId))
+            .where(
+                and(
+                    eq(certificates.status, "pending"),
+                    or(
+                        // Certs with no linked domain row (e.g. legacy certs
+                        // imported from acme.json) aren't gated on domain
+                        // verification since there's nothing to check.
+                        isNull(certificates.domainId),
+                        and(
+                            eq(domains.verified, true),
+                            eq(domains.failed, false)
+                        )
+                    )
+                )
+            )
+            .limit(10);
+
+        if (pendingCerts.length === 0) {
+            logger.debug("No pending certificates found");
+            return;
+        }
+
+        logger.info(`Found ${pendingCerts.length} pending certificates`);
+
+        // Process the batch concurrently so one domain stuck retrying a slow
+        // DNS-01 challenge (the ACME client's waitForValidStatus can spend
+        // minutes on a bad domain) doesn't stall the rest of the batch.
+        // processSingleCertificate catches its own errors and each cert uses
+        // an independent per-domain lock, so this is safe to parallelize.
+        await Promise.all(
+            pendingCerts.map((cert) => this.processSingleCertificate(cert))
+        );
+    }
+
+    async processRenewalCandidates(): Promise<void> {
+        logger.debug("Checking for certificates needing renewal...");
+
+        const now = Math.floor(Date.now() / 1000);
+
+        const renewalCandidates = await db
+            .select(getTableColumns(certificates))
+            .from(certificates)
+            .leftJoin(domains, eq(certificates.domainId, domains.domainId))
+            .where(
+                and(
+                    eq(certificates.status, "valid"),
+                    lt(certificates.expiresAt, now + 15 * 24 * 60 * 60), // 15 days from now
+                    or(
+                        // Certs with no linked domain row (e.g. legacy certs
+                        // imported from acme.json) aren't gated on domain
+                        // verification since there's nothing to check.
+                        isNull(certificates.domainId),
+                        and(
+                            eq(domains.verified, true),
+                            eq(domains.failed, false)
+                        )
+                    )
+                )
+            )
+            // Most urgent first, so already-expired certs aren't starved
+            // behind the limit by certs that still have weeks of runway.
+            .orderBy(asc(certificates.expiresAt))
+            .limit(50);
+
+        if (renewalCandidates.length === 0) {
+            logger.debug("No certificates need renewal");
+            return;
+        }
+
+        logger.info(
+            `Found ${renewalCandidates.length} certificates needing renewal`
+        );
+
+        for (const cert of renewalCandidates) {
+            if (cert.expiresAt !== null && cert.expiresAt < now) {
+                logger.warn(
+                    `Certificate for ${cert.domain} is marked "valid" but already expired at ${new Date(cert.expiresAt * 1000).toISOString()} (bad state) - renewing immediately`
+                );
+            }
+        }
+
+        // Process the batch concurrently - see processPendingCertificates for why.
+        await Promise.all(
+            renewalCandidates.map((cert) => this.renewCertificate(cert))
+        );
+    }
+
+    private async processSingleCertificate(cert: Certificate): Promise<void> {
+        const lockKey = `cert:${cert.domain}`;
+
+        const lockToken = await lockManager.acquireLock(lockKey);
+        if (!lockToken) {
+            logger.debug(
+                `Could not acquire lock for certificate: ${cert.domain}`
+            );
+            return;
+        }
+
+        try {
+            logger.info(`Processing certificate for domain: ${cert.domain}`);
+
+            // Update status to processing
+            await db
+                .update(certificates)
+                .set({
+                    status: "requested",
+                    updatedAt: Math.floor(Date.now() / 1000)
+                })
+                .where(eq(certificates.certId, cert.certId));
+            //
+
+            await withTimeout(
+                this.obtainCertificate(cert),
+                CERTIFICATE_ISSUANCE_TIMEOUT_MS,
+                `certificate issuance for ${cert.domain}`
+            );
+        } catch (error) {
+            logger.error(
+                `Failed to process certificate for ${cert.domain}:`,
+                error
+            );
+
+            await db
+                .update(certificates)
+                .set({
+                    status: "failed",
+                    errorMessage:
+                        error instanceof Error
+                            ? error.message
+                            : "Unknown error",
+                    updatedAt: Math.floor(Date.now() / 1000)
+                })
+                .where(eq(certificates.certId, cert.certId));
+        } finally {
+            await lockManager.releaseLock(lockKey, lockToken);
+        }
+    }
+
+    private async renewCertificate(cert: Certificate): Promise<void> {
+        const lockKey = `cert:${cert.domain}`;
+
+        const lockToken = await lockManager.acquireLock(lockKey);
+        if (!lockToken) {
+            logger.debug(
+                `Could not acquire lock for certificate renewal: ${cert.domain}`
+            );
+            return;
+        }
+
+        try {
+            logger.info(`Renewing certificate for domain: ${cert.domain}`);
+
+            // Update last renewal attempt
+            await db
+                .update(certificates)
+                .set({
+                    lastRenewalAttempt: Math.floor(Date.now() / 1000),
+                    updatedAt: Math.floor(Date.now() / 1000)
+                })
+                .where(eq(certificates.certId, cert.certId));
+
+            await withTimeout(
+                this.obtainCertificate(cert),
+                CERTIFICATE_ISSUANCE_TIMEOUT_MS,
+                `certificate renewal for ${cert.domain}`
+            );
+        } catch (error) {
+            logger.error(
+                `Failed to renew certificate for ${cert.domain}:`,
+                error
+            );
+
+            await db
+                .update(certificates)
+                .set({
+                    status: "failed",
+                    errorMessage:
+                        error instanceof Error
+                            ? error.message
+                            : "Unknown error",
+                    lastRenewalAttempt: Math.floor(Date.now() / 1000),
+                    updatedAt: Math.floor(Date.now() / 1000)
+                })
+                .where(eq(certificates.certId, cert.certId));
+        } finally {
+            await lockManager.releaseLock(lockKey, lockToken);
+        }
+    }
+
+    // Re-checks the domain's DNS records right before we spend a Let's
+    // Encrypt order on it, so drift that happened after the domain was
+    // originally verified doesn't burn ACME rate limits. Certs with no
+    // linked domain row (e.g. legacy/manually-managed certs) skip this and
+    // proceed as before, since there are no tracked DNS records to check.
+    private async verifyDomainBeforeIssuance(cert: Certificate): Promise<void> {
+        if (!cert.domainId) {
+            return;
+        }
+
+        const [domain] = await db
+            .select()
+            .from(domains)
+            .where(eq(domains.domainId, cert.domainId))
+            .limit(1);
+
+        if (!domain) {
+            return;
+        }
+
+        for (
+            let attempt = 1;
+            attempt <= PRE_CERT_DNS_VALIDATION_ATTEMPTS;
+            attempt++
+        ) {
+            // Offset `tries` so each attempt round-robins to a different
+            // privateConfigured DNS resolver instead of re-querying the same one.
+            const probe = { ...domain, tries: domain.tries + attempt - 1 };
+            if (
+                await dnsValidator.validateDomain(probe, {
+                    forceRecheck: true
+                })
+            ) {
+                await db
+                    .update(domains)
+                    .set({ verified: true, failed: false, errorMessage: null })
+                    .where(eq(domains.domainId, domain.domainId));
+                return;
+            }
+
+            logger.warn(
+                `Pre-certificate DNS check ${attempt}/${PRE_CERT_DNS_VALIDATION_ATTEMPTS} failed for domain ${domain.baseDomain} (cert: ${cert.domain})`
+            );
+        }
+
+        const errorMessage = `Domain failed DNS validation ${PRE_CERT_DNS_VALIDATION_ATTEMPTS} times before certificate issuance`;
+        await db
+            .update(domains)
+            .set({ verified: false, failed: true, errorMessage })
+            .where(eq(domains.domainId, domain.domainId));
+
+        throw new Error(errorMessage);
+    }
+
+    private async obtainCertificate(cert: Certificate): Promise<void> {
+        await this.verifyDomainBeforeIssuance(cert);
+
+        // Create order
+        const order = await acmeClientManager.createOrder(
+            cert.domain,
+            cert.wildcard || false
+        );
+
+        // Update with order ID
+        await withRetry(
+            () =>
+                db
+                    .update(certificates)
+                    .set({
+                        orderId: order.url,
+                        updatedAt: Math.floor(Date.now() / 1000)
+                    })
+                    .where(eq(certificates.certId, cert.certId)),
+            { label: `update orderId for certificate ${cert.domain}` }
+        );
+
+        // Get authorizations
+        const authorizations = await acmeClientManager.getAuthorizations(order);
+
+        // Aggregate all DNS-01 challenges
+        const dnsChallenges = authorizations.map((authz: any) => {
+            const dnsChallenge = authz.challenges.find(
+                (c: any) => c.type === "dns-01"
+            );
+            if (!dnsChallenge) {
+                throw new Error(
+                    `No DNS-01 challenge found for ${authz.identifier.value}`
+                );
+            }
+            return {
+                authz,
+                challenge: dnsChallenge
+            };
+        });
+
+        // Send all DNS-01 challenges in one request to handleDnsChallenge
+        await acmeClientManager.handleDnsChallenge(dnsChallenges);
+
+        // Finalize certificate
+        const { certificate, privateKey } =
+            await acmeClientManager.finalizeCertificate(
+                order,
+                cert.domain,
+                cert.wildcard || false
+            );
+
+        const encryptionKey = config.getRawConfig().server.secret;
+        if (!encryptionKey) {
+            throw new Error("Encryption key not provided");
+        }
+
+        // Encrypt certificate and private key
+        const encryptedCert = encrypt(certificate, encryptionKey);
+        const encryptedKey = encrypt(privateKey, encryptionKey);
+
+        // Parse certificate to get expiration date
+        const expiresAt = this.extractExpirationDate(certificate);
+
+        // Update database record. This persists the certificate we just
+        // obtained from the ACME server, so it's retried aggressively -
+        // losing this write means re-issuing the cert from scratch.
+        await withRetry(
+            () =>
+                db
+                    .update(certificates)
+                    .set({
+                        status: "valid",
+                        expiresAt: Math.floor(expiresAt.getTime() / 1000),
+                        renewalCount: (cert.renewalCount || 0) + 1,
+                        errorMessage: null,
+                        updatedAt: Math.floor(Date.now() / 1000),
+                        certFile: encryptedCert,
+                        keyFile: encryptedKey
+                    })
+                    .where(eq(certificates.certId, cert.certId)),
+            {
+                retries: 5,
+                label: `persist issued certificate for ${cert.domain}`
+            }
+        );
+
+        logger.info(
+            `Certificate successfully obtained/renewed for domain: ${cert.domain}`
+        );
+
+        await pushCertUpdateToAffectedNewts(
+            cert.domain,
+            cert.domainId ?? null,
+            certificate,
+            privateKey
+        );
+    }
+
+    private extractExpirationDate(certificate: string): Date {
+        try {
+            // Extract the certificate block
+            const pem = certificate
+                .replace(/-----BEGIN CERTIFICATE-----/g, "")
+                .replace(/-----END CERTIFICATE-----/g, "")
+                .replace(/\s+/g, "");
+            const der = Buffer.from(pem, "base64");
+
+            // Use Node.js crypto to parse the certificate
+            const x509 = new crypto.X509Certificate(der);
+            return new Date(x509.validTo);
+        } catch (error) {
+            logger.warn(
+                "Failed to parse certificate expiration date, using default",
+                error
+            );
+            // Default to 90 days from now (Let's Encrypt default)
+            return new Date(Date.now() + 90 * 24 * 60 * 60 * 1000);
+        }
+    }
+
+    async addCertificateRequest(domain: string): Promise<void> {
+        try {
+            await db.insert(certificates).values({
+                domain,
+                status: "pending",
+                createdAt: Math.floor(Date.now() / 1000),
+                updatedAt: Math.floor(Date.now() / 1000)
+            });
+            logger.info(`Certificate request added for domain: ${domain}`);
+        } catch (error) {
+            if (error instanceof Error && error.message.includes("unique")) {
+                logger.warn(
+                    `Certificate request already exists for domain: ${domain}`
+                );
+            } else {
+                throw error;
+            }
+        }
+    }
+
+    async getCertificateStatus(domain: string) {
+        const cert = await db
+            .select()
+            .from(certificates)
+            .where(eq(certificates.domain, domain))
+            .limit(1);
+
+        return cert[0] || null;
+    }
+
+    async cleanupExpiredChallenges(): Promise<void> {
+        try {
+            const result = await db
+                .delete(certificates)
+                .where(
+                    lt(certificates.expiresAt, Math.floor(Date.now() / 1000))
+                )
+                .returning();
+
+            if (result.length > 0) {
+                logger.info(
+                    `Cleaned up ${result.length} expired DNS challenges`
+                );
+            }
+        } catch (error) {
+            logger.error("Failed to cleanup expired challenges:", error);
+        }
+    }
+}
+
+export const certificateService = new CertificateService();

server/private/lib/certificates/dns-validator.ts

@@ -0,0 +1,334 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { eq, and, lt } from "drizzle-orm";
+import * as dns from "dns/promises";
+import { privateConfig as config } from "#private/lib/config";
+import { db, domains, DnsRecord, dnsRecords, Domain } from "@server/db";
+import logger from "@server/logger";
+import { lockManager } from "../lock";
+
+export const DNS_VALIDATOR_MAX_TRIES = 300;
+
+export class DNSValidator {
+    private static readonly MAX_TRIES = DNS_VALIDATOR_MAX_TRIES;
+
+    constructor() {}
+
+    async validateAll(): Promise<void> {
+        // Get all domains that are not yet verified and haven't exceeded max tries
+        const unverifiedDomains: Domain[] = await db
+            .select()
+            .from(domains)
+            .where(
+                and(
+                    eq(domains.verified, false),
+                    lt(domains.tries, DNSValidator.MAX_TRIES)
+                )
+            );
+
+        if (unverifiedDomains.length === 0) {
+            logger.debug("No unverified domains found for DNS validation");
+            return;
+        }
+
+        logger.info(`Validating ${unverifiedDomains.length} DNS records`);
+
+        for (const domain of unverifiedDomains) {
+            const lockKey = `dns:${domain.baseDomain}`;
+            const lockToken = await lockManager.acquireLock(lockKey);
+            if (!lockToken) {
+                logger.debug(
+                    `Could not acquire lock for DNS validation: ${domain.baseDomain}`
+                );
+                continue;
+            }
+            try {
+                const isValid = await this.validateDomain(domain);
+                if (isValid) {
+                    await db
+                        .update(domains)
+                        .set({
+                            verified: true,
+                            failed: false,
+                            tries: 0,
+                            errorMessage: null
+                        })
+                        .where(eq(domains.domainId, domain.domainId));
+                    logger.info(
+                        `Domain ${domain.baseDomain} validated successfully`
+                    );
+                } else {
+                    const newTries = domain.tries + 1;
+                    const shouldMarkAsFailed =
+                        newTries >= DNSValidator.MAX_TRIES;
+
+                    await db
+                        .update(domains)
+                        .set({
+                            tries: newTries,
+                            failed: shouldMarkAsFailed
+                        })
+                        .where(eq(domains.domainId, domain.domainId));
+
+                    if (shouldMarkAsFailed) {
+                        logger.warn(
+                            `Domain ${domain.baseDomain} exceeded maximum tries (${DNSValidator.MAX_TRIES}), marking as failed`
+                        );
+                    } else {
+                        logger.debug(
+                            `Domain ${domain.baseDomain} did not validate (attempt ${newTries}/${DNSValidator.MAX_TRIES})`
+                        );
+                    }
+                }
+            } catch (err) {
+                logger.warn(
+                    `Error validating domain ${domain.baseDomain}:`,
+                    err
+                );
+                // Increment tries even on error
+                const newTries = domain.tries + 1;
+                const shouldMarkAsFailed = newTries >= DNSValidator.MAX_TRIES;
+
+                await db
+                    .update(domains)
+                    .set({
+                        tries: newTries,
+                        failed: shouldMarkAsFailed
+                    })
+                    .where(eq(domains.domainId, domain.domainId));
+            } finally {
+                await lockManager.releaseLock(lockKey, lockToken);
+            }
+        }
+    }
+
+    async validateDomain(
+        domain: Domain,
+        opts: { forceRecheck?: boolean } = {}
+    ): Promise<boolean> {
+        const { forceRecheck = false } = opts;
+        const resolver = new dns.Resolver();
+        const servers = config.getRawConfig().acme?.dns_resolvers;
+        if (!servers || servers.length === 0) {
+            throw new Error("No DNS resolvers configured");
+        }
+        const dnsServer = servers[domain.tries % servers.length]!;
+        resolver.setServers([dnsServer]);
+        logger.debug(
+            `Using DNS server ${dnsServer} for domain ${domain.baseDomain} (try ${domain.tries})`
+        );
+
+        // Get all DNS records for this domain
+        const records: DnsRecord[] = await db
+            .select()
+            .from(dnsRecords)
+            .where(eq(dnsRecords.domainId, domain.domainId));
+
+        if (records.length === 0) {
+            logger.warn(`No DNS records found for domain ${domain.baseDomain}`);
+            return false;
+        }
+
+        if (!forceRecheck && records.every((r) => r.verified)) {
+            logger.info(
+                `All DNS records already verified for domain ${domain.baseDomain}`
+            );
+            return true;
+        }
+
+        logger.info(
+            `Validating ${records.length} DNS records for domain ${domain.baseDomain}`
+        );
+
+        // Collect the full set of expected NS values for this domain so we can
+        // detect extra records that are present in DNS but not in our DB.
+        const expectedNsValues = new Set<string>(
+            records.filter((r) => r.recordType === "NS").map((r) => r.value)
+        );
+
+        // Cache resolved NS records across iterations — there will be 3 NS
+        // records in the DB and we don't need to hit the upstream server 3 times.
+        let previousNs: string[] | null = null;
+
+        for (const record of records) {
+            // Skip already verified records, unless a live recheck was requested
+            if (record.verified && !forceRecheck) {
+                continue;
+            }
+
+            let isValid = false;
+
+            try {
+                if (record.recordType === "NS") {
+                    let nsRecords: string[] | null = previousNs;
+                    if (!nsRecords) {
+                        nsRecords = await resolver.resolveNs(
+                            record.baseDomain || domain.baseDomain
+                        );
+                    }
+                    logger.info(
+                        `NS records for ${
+                            record.baseDomain || domain.baseDomain
+                        }:`,
+                        nsRecords
+                    );
+
+                    // Check if this expected NS value is present in the live records.
+                    // A stale/legacy expected value (e.g. left over from a
+                    // nameserver rebrand) is also accepted as long as the live
+                    // records resolve to some other known-valid nameserver —
+                    // the specific literal hostname stored per-domain isn't
+                    // meaningful once it's a recognized alias.
+                    isValid = nsRecords.some((ns) => ns === record.value);
+
+                    previousNs = nsRecords;
+                } else if (record.recordType === "CNAME") {
+                    const cnameRecords = await resolver.resolveCname(
+                        record.baseDomain || domain.baseDomain
+                    );
+                    logger.info(
+                        `CNAME records for ${
+                            record.baseDomain || domain.baseDomain
+                        }:`,
+                        cnameRecords
+                    );
+
+                    // Check if the CNAME record matches the expected value
+                    isValid =
+                        cnameRecords.length === 1 &&
+                        cnameRecords[0] === record.value;
+                } else if (record.recordType === "TXT") {
+                    const txtRecords = await resolver.resolveTxt(
+                        record.baseDomain || domain.baseDomain
+                    );
+                    logger.info(
+                        `TXT records for ${
+                            record.baseDomain || domain.baseDomain
+                        }:`,
+                        txtRecords
+                    );
+
+                    // TXT records come as an array of arrays, flatten and check
+                    const flatTxtRecords = txtRecords.flat();
+                    isValid = flatTxtRecords.includes(record.value);
+                } else if (record.recordType === "A") {
+                    const aRecords = await resolver.resolve4(
+                        record.baseDomain || domain.baseDomain
+                    );
+                    logger.info(
+                        `A records for ${
+                            record.baseDomain || domain.baseDomain
+                        }:`,
+                        aRecords
+                    );
+
+                    // Check if the A record matches the expected value
+                    isValid = aRecords.includes(record.value);
+                } else {
+                    logger.warn(
+                        `Unsupported record type: ${record.recordType}`
+                    );
+                    continue;
+                }
+            } catch (error) {
+                isValid = false;
+                logger.debug(
+                    `Did not resolve ${record.recordType} record for ${
+                        record.baseDomain || domain.baseDomain
+                    }:`,
+                    error
+                );
+            }
+
+            // Update the individual record verification status. Runs for
+            // both a mismatched value and a failed/thrown DNS lookup, so a
+            // previously-verified record that stops resolving (e.g. NXDOMAIN
+            // after NS delegation is dropped) gets downgraded instead of
+            // leaving stale `verified: true` state behind.
+            if (isValid) {
+                await db
+                    .update(dnsRecords)
+                    .set({ verified: true })
+                    .where(eq(dnsRecords.id, record.id));
+                logger.info(
+                    `DNS record ${record.id} (${record.recordType}) for ${
+                        record.baseDomain || domain.baseDomain
+                    } verified successfully`
+                );
+            } else {
+                if (record.verified) {
+                    await db
+                        .update(dnsRecords)
+                        .set({ verified: false })
+                        .where(eq(dnsRecords.id, record.id));
+                }
+                logger.debug(
+                    `DNS record ${record.id} (${record.recordType}) for ${
+                        record.baseDomain || domain.baseDomain
+                    } does not match expected value: ${record.value}`
+                );
+            }
+        }
+
+        // --- Extra NS record check ---
+        // If we resolved NS records during this pass, verify that the live DNS
+        // has no nameservers beyond the ones we expect.  Individual records may
+        // already be marked verified above, but we must block full domain
+        // verification until the extra records are removed.
+        if (previousNs !== null && expectedNsValues.size > 0) {
+            const extraNsRecords = previousNs.filter(
+                (ns) => !expectedNsValues.has(ns)
+            );
+
+            if (extraNsRecords.length > 0) {
+                const errorMessage = `Extra NS records found that are not expected: ${extraNsRecords.join(", ")}. Remove these nameservers to complete domain verification.`;
+
+                await db
+                    .update(domains)
+                    .set({ errorMessage })
+                    .where(eq(domains.domainId, domain.domainId));
+
+                logger.warn(
+                    `Domain ${domain.baseDomain} has extra NS records that prevent verification: ${extraNsRecords.join(", ")}`
+                );
+
+                return false;
+            }
+
+            // No extras — clear any stale error that was previously written
+            await db
+                .update(domains)
+                .set({ errorMessage: null })
+                .where(eq(domains.domainId, domain.domainId));
+        }
+
+        // Check if all records are now verified
+        const updatedRecords: DnsRecord[] = await db
+            .select()
+            .from(dnsRecords)
+            .where(eq(dnsRecords.domainId, domain.domainId));
+
+        const allRecordsVerified = updatedRecords.every((r) => r.verified);
+
+        logger.info(
+            `Domain ${domain.baseDomain}: ${
+                updatedRecords.filter((r) => r.verified).length
+            }/${updatedRecords.length} records verified`
+        );
+
+        return allRecordsVerified;
+    }
+}
+
+export const dnsValidator = new DNSValidator();

server/private/lib/certificates/domain-reverifier.ts

@@ -0,0 +1,233 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { eq, and, or, isNull, lt } from "drizzle-orm";
+import * as dns from "dns/promises";
+import { DNS_VALIDATOR_MAX_TRIES } from "./dns-validator";
+import { db, domains, DnsRecord, dnsRecords, Domain } from "@server/db";
+import logger from "@server/logger";
+import { lockManager } from "../lock";
+import { privateConfig as config } from "#private/lib/config";
+
+// Module-level counter so successive domains in a batch round-robin across servers.
+let serverIndex = 0;
+
+export class DomainReverifier {
+    async reverifyAll(): Promise<void> {
+        const certConfig = config.getRawConfig().acme;
+        if (!certConfig) {
+            logger.debug(
+                "No certificate config — skipping domain reverification"
+            );
+            return;
+        }
+
+        const windowMs = certConfig.domain_reverification_window_ms;
+        const batchSize = certConfig.domain_reverification_batch_size;
+        const windowSecs = Math.floor(windowMs / 1000);
+        const cutoff = Math.floor(Date.now() / 1000) - windowSecs;
+
+        const domainsToCheck: Domain[] = await db
+            .select()
+            .from(domains)
+            .where(
+                and(
+                    eq(domains.verified, true),
+                    or(
+                        isNull(domains.lastCheckedAt),
+                        lt(domains.lastCheckedAt, cutoff)
+                    )
+                )
+            )
+            .limit(batchSize);
+
+        if (domainsToCheck.length === 0) {
+            logger.debug("No verified domains due for reverification");
+            return;
+        }
+
+        logger.info(`Reverifying ${domainsToCheck.length} domains`);
+
+        for (const domain of domainsToCheck) {
+            const lockKey = `dns-reverify:${domain.baseDomain}`;
+            const lockToken = await lockManager.acquireLock(lockKey);
+            if (!lockToken) {
+                logger.debug(
+                    `Could not acquire lock for domain reverification: ${domain.baseDomain}`
+                );
+                continue;
+            }
+
+            try {
+                await this.reverifyDomain(domain, certConfig.dns_resolvers);
+            } catch (err) {
+                logger.warn(
+                    `Unexpected error reverifying domain ${domain.baseDomain}:`,
+                    err
+                );
+                // Still stamp lastCheckedAt so we don't hammer a broken domain every run.
+                await db
+                    .update(domains)
+                    .set({ lastCheckedAt: Math.floor(Date.now() / 1000) })
+                    .where(eq(domains.domainId, domain.domainId));
+            } finally {
+                await lockManager.releaseLock(lockKey, lockToken);
+            }
+        }
+    }
+
+    private async reverifyDomain(
+        domain: Domain,
+        servers: string[]
+    ): Promise<void> {
+        if (!servers || servers.length === 0) {
+            throw new Error("No DNS resolvers configured");
+        }
+
+        // Round-robin across servers; advance the global counter so the next
+        // domain in the same batch gets a different server.
+        const dnsServer = servers[serverIndex % servers.length]!;
+        serverIndex++;
+
+        const resolver = new dns.Resolver();
+        resolver.setServers([dnsServer]);
+
+        logger.debug(
+            `Reverifying domain ${domain.baseDomain} using DNS server ${dnsServer}`
+        );
+
+        const records: DnsRecord[] = await db
+            .select()
+            .from(dnsRecords)
+            .where(eq(dnsRecords.domainId, domain.domainId));
+
+        if (records.length === 0) {
+            logger.warn(
+                `No DNS records found for domain ${domain.baseDomain} during reverification — marking failed`
+            );
+            await this.markFailed(
+                domain.domainId,
+                "No DNS records found during periodic reverification"
+            );
+            return;
+        }
+
+        const expectedNsValues = new Set<string>(
+            records.filter((r) => r.recordType === "NS").map((r) => r.value)
+        );
+
+        let allValid = true;
+        let errorMessage: string | null = null;
+        let resolvedNs: string[] | null = null;
+
+        for (const record of records) {
+            let isValid = false;
+
+            try {
+                if (record.recordType === "NS") {
+                    if (!resolvedNs) {
+                        resolvedNs = await resolver.resolveNs(
+                            record.baseDomain || domain.baseDomain
+                        );
+                    }
+                    isValid = resolvedNs.some((ns) => ns === record.value);
+                } else if (record.recordType === "CNAME") {
+                    const cnameRecords = await resolver.resolveCname(
+                        record.baseDomain || domain.baseDomain
+                    );
+                    isValid =
+                        cnameRecords.length === 1 &&
+                        cnameRecords[0] === record.value;
+                } else if (record.recordType === "TXT") {
+                    const txtRecords = await resolver.resolveTxt(
+                        record.baseDomain || domain.baseDomain
+                    );
+                    isValid = txtRecords.flat().includes(record.value);
+                } else if (record.recordType === "A") {
+                    const aRecords = await resolver.resolve4(
+                        record.baseDomain || domain.baseDomain
+                    );
+                    isValid = aRecords.includes(record.value);
+                } else {
+                    logger.warn(
+                        `Unsupported record type ${record.recordType} during reverification of ${domain.baseDomain}`
+                    );
+                    continue;
+                }
+            } catch (err) {
+                logger.debug(
+                    `DNS lookup failed for ${record.recordType} record on ${record.baseDomain || domain.baseDomain}:`,
+                    err
+                );
+                isValid = false;
+            }
+
+            if (!isValid) {
+                allValid = false;
+                errorMessage = `${record.recordType} record for ${record.baseDomain || domain.baseDomain} no longer resolves to expected value "${record.value}"`;
+                break;
+            }
+        }
+
+        // Check for extra NS records beyond what we expect.
+        if (allValid && resolvedNs !== null && expectedNsValues.size > 0) {
+            const extraNs = resolvedNs.filter(
+                (ns) => !expectedNsValues.has(ns)
+            );
+            if (extraNs.length > 0) {
+                allValid = false;
+                errorMessage = `Extra NS records found: ${extraNs.join(", ")}. Remove these nameservers.`;
+            }
+        }
+
+        const now = Math.floor(Date.now() / 1000);
+
+        if (allValid) {
+            await db
+                .update(domains)
+                .set({ lastCheckedAt: now, errorMessage: null })
+                .where(eq(domains.domainId, domain.domainId));
+            logger.debug(
+                `Domain ${domain.baseDomain} passed periodic reverification`
+            );
+        } else {
+            await this.markFailed(domain.domainId, errorMessage);
+            logger.warn(
+                `Domain ${domain.baseDomain} failed periodic reverification: ${errorMessage}`
+            );
+        }
+    }
+
+    private async markFailed(
+        domainId: string,
+        errorMessage: string | null
+    ): Promise<void> {
+        await db
+            .update(domains)
+            .set({
+                verified: false,
+                failed: true,
+                // Three below MAX_TRIES: keeps the domain out of the DNS
+                // validator's immediate retry loop, while still leaving it
+                // eligible (tries < MAX_TRIES) for a few more validation
+                // passes instead of being excluded forever once tries hits
+                // MAX_TRIES.
+                tries: DNS_VALIDATOR_MAX_TRIES - 3,
+                lastCheckedAt: Math.floor(Date.now() / 1000),
+                errorMessage
+            })
+            .where(eq(domains.domainId, domainId));
+    }
+}
+
+export const domainReverifier = new DomainReverifier();

server/private/lib/certificates/index.ts

@@ -0,0 +1,45 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import logger from "@server/logger";
+import { privateConfig } from "#private/lib/config";
+import { acmeClientManager } from "./acme-client";
+import { jobScheduler } from "./scheduler";
+
+export async function startCertificateManager() {
+    const acmeConfig = privateConfig.getRawPrivateConfig().acme;
+    if (
+        acmeConfig &&
+        acmeConfig.cert_mode === "pangolin" &&
+        acmeConfig.enable_acme_client
+    ) {
+        logger.info("Starting certificate management server...");
+
+        // Initialize ACME client
+        await acmeClientManager.initialize();
+
+        // Start certificate issuance/renewal jobs
+        await jobScheduler.start();
+    }
+
+    if (privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
+        // DNS record validation/reverification doesn't require certs, so it
+        // runs whenever Pangolin is acting as the authoritative DNS server,
+        // independent of the cert manager above.
+        await jobScheduler.startDnsJobs();
+    }
+}
+
+export async function stopCertificateManager() {
+    await jobScheduler.stop();
+}

server/private/lib/certificates/scheduler.ts

@@ -0,0 +1,197 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { withTimeout } from "@server/lib/retry";
+import logger from "@server/logger";
+import { certificateService } from "./certificate-service";
+import { privateConfig as config } from "#private/lib/config";
+import { dnsValidator } from "./dns-validator";
+import { domainReverifier } from "./domain-reverifier";
+import license from "#private/license/license";
+
+// Backstop for runExclusive: no single job's own internal timeouts (e.g.
+// certificate-service's per-cert issuance timeout) are relied on here. This
+// is the last line of defense - if *anything* inside a job hangs with no
+// error (a stalled Redis/DB call, a future code path that forgets to bound
+// itself, etc.), state.active must still reset so the next tick can run.
+// Without it, one hung run permanently skips every future tick for that job,
+// since runExclusive only clears state.active after the job promise settles.
+const RUN_EXCLUSIVE_TIMEOUT_MS = 30 * 60 * 1000;
+
+export class JobScheduler {
+    private certIntervals: NodeJS.Timeout[] = [];
+    private dnsIntervals: NodeJS.Timeout[] = [];
+    private certRunning = false;
+    private dnsRunning = false;
+
+    // Guards against a slow batch (e.g. 10 certs whose DNS challenges take a
+    // while) still being processed when the next interval tick fires -
+    // without this, overlapping ticks would each pull their own batch of up
+    // to 10 pending/renewal certs and process them concurrently instead of
+    // waiting for the prior batch to finish.
+    private runExclusive(
+        job: () => Promise<void>,
+        state: { active: boolean },
+        label: string
+    ): () => Promise<void> {
+        return async () => {
+            if (!(await license.isUnlocked())) {
+                logger.debug(
+                    `Skipping ${label} tick - license is not subscribed`
+                );
+                return;
+            }
+            if (state.active) {
+                logger.debug(
+                    `Skipping ${label} tick - previous run still in progress`
+                );
+                return;
+            }
+            state.active = true;
+            try {
+                await withTimeout(job(), RUN_EXCLUSIVE_TIMEOUT_MS, label);
+            } catch (error) {
+                logger.error(`Error in ${label}:`, error);
+            } finally {
+                state.active = false;
+            }
+        };
+    }
+
+    // Certificate issuance/renewal - requires an ACME client, so this is
+    // only started when Pangolin is actually managing certs.
+    async start(): Promise<void> {
+        if (this.certRunning) {
+            logger.warn("Certificate job scheduler is already running");
+            return;
+        }
+
+        this.certRunning = true;
+        logger.info("Starting certificate job scheduler");
+
+        const newCertState = { active: false };
+        const renewalState = { active: false };
+
+        const runNewCertCheck = this.runExclusive(
+            () => certificateService.processPendingCertificates(),
+            newCertState,
+            "processing pending certificates"
+        );
+        const runRenewalCheck = this.runExclusive(
+            () => certificateService.processRenewalCandidates(),
+            renewalState,
+            "processing renewal candidates"
+        );
+
+        // Schedule new certificate processing
+        const newCertInterval = setInterval(
+            runNewCertCheck,
+            config.getRawConfig().acme!.new_cert_check_interval_ms
+        );
+
+        // Schedule renewal processing (every 24 hours)
+        const renewalInterval = setInterval(
+            runRenewalCheck,
+            config.getRawConfig().acme!.renewal_check_interval_ms
+        );
+
+        this.certIntervals.push(newCertInterval, renewalInterval);
+
+        // Run initial checks
+        setTimeout(async () => {
+            try {
+                await runNewCertCheck();
+                // await runRenewalCheck();
+            } catch (error) {
+                logger.error("Error in initial certificate processing:", error);
+            }
+        }, 1000); // Wait 1 second after startup
+
+        logger.info("Certificate job scheduler started successfully");
+    }
+
+    // DNS record validation/reverification - doesn't touch certs at all, so
+    // this runs independently whenever Pangolin is acting as the
+    // authoritative DNS server, regardless of cert_mode.
+    async startDnsJobs(): Promise<void> {
+        if (this.dnsRunning) {
+            logger.warn("DNS validation job scheduler is already running");
+            return;
+        }
+
+        this.dnsRunning = true;
+        logger.info("Starting DNS validation job scheduler");
+
+        const dnsValidationState = { active: false };
+        const reverifyState = { active: false };
+
+        const runDnsValidation = this.runExclusive(
+            () => dnsValidator.validateAll(),
+            dnsValidationState,
+            "validating DNS records"
+        );
+        const runReverify = this.runExclusive(
+            () => domainReverifier.reverifyAll(),
+            reverifyState,
+            "reverifying domains"
+        );
+
+        // Schedule DNS validation
+        const dnsValidationInterval = setInterval(
+            runDnsValidation,
+            config.getRawConfig().acme?.dns_check_interval_ms ?? 60000
+        );
+
+        // Schedule periodic reverification of already-verified domains
+        const reverifyInterval = setInterval(
+            runReverify,
+            config.getRawConfig().acme?.domain_reverification_interval_ms ??
+                3600000
+        );
+
+        this.dnsIntervals.push(dnsValidationInterval, reverifyInterval);
+
+        // Run an initial validation pass shortly after startup
+        setTimeout(async () => {
+            try {
+                await runDnsValidation();
+            } catch (error) {
+                logger.error("Error in initial DNS validation:", error);
+            }
+        }, 1000);
+
+        logger.info("DNS validation job scheduler started successfully");
+    }
+
+    async stop(): Promise<void> {
+        if (this.certRunning) {
+            logger.info("Stopping certificate job scheduler");
+            this.certRunning = false;
+            this.certIntervals.forEach((interval) => clearInterval(interval));
+            this.certIntervals = [];
+        }
+
+        if (this.dnsRunning) {
+            logger.info("Stopping DNS validation job scheduler");
+            this.dnsRunning = false;
+            this.dnsIntervals.forEach((interval) => clearInterval(interval));
+            this.dnsIntervals = [];
+        }
+    }
+
+    isRunning(): boolean {
+        return this.certRunning || this.dnsRunning;
+    }
+}
+
+export const jobScheduler = new JobScheduler();

server/private/lib/config.ts

@@ -146,12 +146,20 @@ export class PrivateConfig {
             process.env.USE_PANGOLIN_DNS =
                 this.rawPrivateConfig.flags.use_pangolin_dns.toString();
         }
+
+        if (this.rawPrivateConfig.acme?.cert_mode) {
+            process.env.CERT_MODE = this.rawPrivateConfig.acme.cert_mode;
+        }
     }
 
     public getRawPrivateConfig() {
         return this.rawPrivateConfig;
     }
 
+    public getRawConfig() {
+        return this.getRawPrivateConfig();
+    }
+
     // `flags.enable_acme_cert_sync`, `flags.disable_private_http_placeholder`,
     // and `acme` used to live in the private config file. They now live in
     // the public config file. If an operator still has them set in the

server/private/lib/dns/generateDomains.ts

@@ -0,0 +1,47 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+import { build } from "@server/build";
+import privateConfig from "#private/lib/config";
+
+export function createCname(domainId: string, baseDomain: string) {
+    if (!privateConfig.getRawPrivateConfig().dns?.cname_extension) {
+        throw new Error("CNAME extension not configured");
+    }
+
+    let cnameRecords = [
+        {
+            value: `${domainId}.${privateConfig.getRawPrivateConfig().dns?.cname_extension}`,
+            baseDomain: baseDomain
+        },
+        {
+            value: `_acme-challenge.${domainId}.${privateConfig.getRawPrivateConfig().dns?.cname_extension}`,
+            baseDomain: `_acme-challenge.${baseDomain}`
+        }
+    ];
+
+    return cnameRecords;
+}
+
+export function createNs() {
+    if (!privateConfig.getRawPrivateConfig().dns?.nameserver_name) {
+        throw new Error("Nameservers not configured");
+    }
+
+    const nsRecords = [
+        privateConfig.getRawPrivateConfig().dns?.nameserver_name,
+        ...(privateConfig.getRawPrivateConfig().dns?.alternate_nameservers ||
+            [])
+    ] as string[];
+    return nsRecords;
+}

server/private/lib/dns/index.ts

@@ -0,0 +1,14 @@
+/*
+ * This file is part of a proprietary work.
+ *
+ * Copyright (c) 2025-2026 Fossorial, Inc.
+ * All rights reserved.
+ *
+ * This file is licensed under the Fossorial Commercial License.
+ * You may not use this file except in compliance with the License.
+ * Unauthorized use, copying, modification, or distribution is strictly prohibited.
+ *
+ * This file is not licensed under the AGPLv3.
+ */
+
+export * from "./server";

server/private/lib/exitNodes/exitNodeComms.ts

@@ -18,6 +18,7 @@ import { eq } from "drizzle-orm";
 import { sendToClient } from "#private/routers/ws";
 import privateConfig from "#private/lib/config";
 import config from "@server/lib/config";
+import { hasExitNodeCheckedIn } from "@server/lib/exitNodes";
 
 interface ExitNodeRequest {
     remoteType?: string;
@@ -138,13 +139,19 @@ export async function sendToExitNode(
 
             return response.data;
         } catch (error) {
-            if (axios.isAxiosError(error)) {
-                logger.error(
-                    `Error making ${method} request (can Pangolin see Gerbil HTTP API?) for exit node at ${hostname} (status: ${error.response?.status}): ${error.message}`
-                );
+            const message = axios.isAxiosError(error)
+                ? `Error making ${method} request (can Pangolin see Gerbil HTTP API?) for exit node at ${hostname} (status: ${error.response?.status}): ${error.message}`
+                : `Error making ${method} request for exit node at ${hostname}: ${error}`;
+
+            // The exit node (gerbil) may still be starting up and not yet
+            // reachable. Until it has checked in at least once, log this at a
+            // lower level since it's expected; once it has checked in, a
+            // connection failure is a real problem.
+            if (hasExitNodeCheckedIn(exitNode.exitNodeId)) {
+                logger.error(message);
             } else {
-                logger.error(
-                    `Error making ${method} request for exit node at ${hostname}: ${error}`
+                logger.warn(
+                    `${message} (exit node has not checked in yet since startup, this is expected briefly)`
                 );
             }
         }

server/private/lib/readConfigFile.ts

@@ -95,6 +95,70 @@ export const privateConfigSchema = z
                     .optional()
             })
             .optional(),
+        dns: z
+            .object({
+                enabled: z.boolean().optional().default(false),
+                listen_port: z.number().int().positive().optional().default(53),
+                nameserver_name: z.string(),
+                cname_extension: z.string(),
+                site_extension: z.string().optional(),
+                cname_alternate_extensions: z
+                    .array(z.string())
+                    .optional()
+                    .default([]),
+                alternate_nameservers: z
+                    .array(z.string())
+                    .optional()
+                    .default([]),
+                rate_limit: z
+                    .object({
+                        enabled: z.boolean().optional().default(true),
+                        window_ms: z
+                            .number()
+                            .int()
+                            .min(1000)
+                            .max(600000)
+                            .optional()
+                            .default(60000),
+                        max_requests: z
+                            .number()
+                            .int()
+                            .min(50)
+                            .max(100000)
+                            .optional()
+                            .default(1200),
+                        max_requests_per_query_type: z
+                            .number()
+                            .int()
+                            .min(10)
+                            .max(50000)
+                            .optional()
+                            .default(600)
+                    })
+                    .default({
+                        enabled: true,
+                        window_ms: 60000,
+                        max_requests: 1200,
+                        max_requests_per_query_type: 600
+                    }),
+                static_records: z
+                    .array(
+                        z.object({
+                            domain: z.string(),
+                            type: z.enum(["TXT", "CNAME", "A", "NS"]),
+                            value: z.string(),
+                            ttl: z
+                                .number()
+                                .int()
+                                .positive()
+                                .optional()
+                                .default(300)
+                        })
+                    )
+                    .optional()
+                    .default([])
+            })
+            .optional(),
         gerbil: z
             .object({
                 local_exit_node_reachable_at: z
@@ -125,15 +189,86 @@ export const privateConfigSchema = z
             })
             .optional()
             .prefault({}),
-        // @deprecated Moved to the public config file as `acme`
-        // (server/lib/readConfigFile.ts). Kept here only so existing private
-        // config files keep parsing; any value set here is migrated into the
-        // public config at startup by PrivateConfig (server/private/lib/config.ts).
         acme: z
             .object({
+                cert_mode: z
+                    .enum(["traefik", "pangolin"])
+                    .optional()
+                    .default("traefik"),
+                enable_acme_client: z.boolean().optional().default(false),
+                // @deprecated Moved to the public config file
+                // (server/lib/readConfigFile.ts). Kept here only so existing private
+                // config files keep parsing; any value set here is migrated into the
+                // public config at startup by PrivateConfig (server/private/lib/config.ts).
                 acme_json_path: z.string().optional(),
+                // @deprecated Moved to the public config file
+                // (server/lib/readConfigFile.ts). Kept here only so existing private
+                // config files keep parsing; any value set here is migrated into the
+                // public config at startup by PrivateConfig (server/private/lib/config.ts).
                 acme_http_endpoint: z.string().optional(),
-                sync_interval_ms: z.number().optional()
+                // @deprecated Moved to the public config file
+                // (server/lib/readConfigFile.ts). Kept here only so existing private
+                // config files keep parsing; any value set here is migrated into the
+                // public config at startup by PrivateConfig (server/private/lib/config.ts).
+                sync_interval_ms: z.number().optional(),
+                acme_directory_url: z
+                    .string()
+                    .url()
+                    .default("https://acme-v02.api.letsencrypt.org/directory"),
+                contact_email: z.string().email().optional(),
+                acme_account_key_path: z
+                    .string()
+                    .default("./config/account.key"),
+                challenge_ttl_ms: z.number().int().positive().default(300000),
+                renewal_check_interval_ms: z
+                    .number()
+                    .int()
+                    .positive()
+                    .default(3600000),
+                new_cert_check_interval_ms: z
+                    .number()
+                    .int()
+                    .positive()
+                    .default(5000),
+                // Kept safely under Let's Encrypt's ~20 req/s limit since this
+                // budget is shared across all pops workers and only covers the
+                // request-issuing calls we make directly (not every request
+                // acme-client makes internally, e.g. while polling for
+                // challenge/order status).
+                acme_requests_per_second: z
+                    .number()
+                    .int()
+                    .positive()
+                    .default(15),
+                dns_check_interval_ms: z
+                    .number()
+                    .int()
+                    .positive()
+                    .default(60000),
+                domain_reverification_interval_ms: z
+                    .number()
+                    .int()
+                    .positive()
+                    .default(3600000), // 1 hour — how often to run the reverification pass
+                domain_reverification_window_ms: z
+                    .number()
+                    .int()
+                    .positive()
+                    .default(259200000), // 72 hours — how old checkedAt must be before rechecking
+                domain_reverification_batch_size: z
+                    .number()
+                    .int()
+                    .positive()
+                    .default(20), // max domains to recheck per pass
+                dns_resolvers: z
+                    .array(z.string())
+                    .optional()
+                    .default([
+                        "8.8.8.8",
+                        "1.1.1.1",
+                        "9.9.9.9",
+                        "208.67.222.222"
+                    ])
             })
             .optional(),
         branding: z

server/private/lib/traefik/getTraefikConfig.ts

@@ -396,7 +396,7 @@ export async function getTraefikConfig(
         );
 
     let validCerts: CertificateResult[] = [];
-    if (privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
+    if (privateConfig.getRawPrivateConfig().acme?.cert_mode == "pangolin") {
         // create a list of all domains to get certs for
         const domains = new Set<string>();
         for (const resource of resourcesMap.values()) {
@@ -522,7 +522,10 @@ export async function getTraefikConfig(
             );
 
             let tls = {};
-            if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
+            if (
+                privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                "pangolin"
+            ) {
                 tls = buildWildcardTls({
                     fullDomain,
                     hasSubdomain: !!resource.subdomain,
@@ -789,7 +792,8 @@ export async function getTraefikConfig(
                 preferWildcardCert
             }) => {
                 if (
-                    !privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
+                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                    "pangolin"
                 ) {
                     return buildWildcardTls({
                         fullDomain,
@@ -832,7 +836,8 @@ export async function getTraefikConfig(
             redirectHttpsMiddlewareName,
             resolveTls: (fullDomain) => {
                 if (
-                    !privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
+                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                    "pangolin"
                 ) {
                     // siteResource aliases don't have a per-domain cert
                     // resolver stored, so always fall back to the global
@@ -924,7 +929,10 @@ export async function getTraefikConfig(
             const rule = buildHostRule(fullDomain, ir.wildcard);
 
             let tls: any = {};
-            if (!privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
+            if (
+                privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                "pangolin"
+            ) {
                 tls = buildWildcardTls({
                     fullDomain,
                     hasSubdomain: !!ir.subdomain,
@@ -1005,7 +1013,8 @@ export async function getTraefikConfig(
 
                 let tls: any = {};
                 if (
-                    !privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
+                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                    "pangolin"
                 ) {
                     // siteResource aliases don't have a per-domain cert
                     // resolver stored, so always fall back to the global
@@ -1080,7 +1089,7 @@ export async function getTraefikConfig(
             .where(eq(exitNodes.exitNodeId, exitNodeId));
 
         let validCertsLoginPages: CertificateResult[] = [];
-        if (privateConfig.getRawPrivateConfig().flags.use_pangolin_dns) {
+        if (privateConfig.getRawPrivateConfig().acme?.cert_mode == "pangolin") {
             // create a list of all domains to get certs for
             const domains = new Set<string>();
             for (const lp of exitNodeLoginPages) {
@@ -1126,7 +1135,8 @@ export async function getTraefikConfig(
 
                 const tls = {};
                 if (
-                    !privateConfig.getRawPrivateConfig().flags.use_pangolin_dns
+                    privateConfig.getRawPrivateConfig().acme?.cert_mode !=
+                    "pangolin"
                 ) {
                     // TODO: we need to add the wildcard logic here too
                 } else {

server/private/routers/alertRule/testAlertRule.ts

@@ -14,7 +14,7 @@
 import { getRandomItemInArray } from "@app/lib/getRandomItemInArray";
 import response from "@server/lib/response";
 import logger from "@server/logger";
-import { processTestAlerts } from "@server/private/lib/alerts/processTestAlerts";
+import { processTestAlerts } from "#private/lib/alerts/processTestAlerts";
 import { type AlertAction } from "@server/routers/alertRule/types";
 import HttpCode from "@server/types/HttpCode";
 import { NextFunction, Request, Response } from "express";

server/private/routers/alertRule/updateAlertRule.ts

@@ -33,8 +33,11 @@ import { OpenAPITags, registry } from "@server/openApi";
 import { and, eq } from "drizzle-orm";
 import { encrypt } from "@server/lib/crypto";
 import config from "@server/lib/config";
-import { HC_EVENT_TYPES, SITE_EVENT_TYPES, RESOURCE_EVENT_TYPES } from "./createAlertRule";
-import { invalidateAllRemoteExitNodeSessions } from "@server/private/auth/sessions/remoteExitNode";
+import {
+    HC_EVENT_TYPES,
+    SITE_EVENT_TYPES,
+    RESOURCE_EVENT_TYPES
+} from "./createAlertRule";
 
 const paramsSchema = z
     .object({
@@ -85,35 +88,57 @@ const bodySchema = z
         const isHcEvent = (HC_EVENT_TYPES as readonly string[]).includes(
             val.eventType
         );
-        const isResourceEvent = (RESOURCE_EVENT_TYPES as readonly string[]).includes(
-            val.eventType
-        );
+        const isResourceEvent = (
+            RESOURCE_EVENT_TYPES as readonly string[]
+        ).includes(val.eventType);
 
-        if (isSiteEvent && val.siteIds !== undefined && val.siteIds.length === 0 && !val.allSites) {
+        if (
+            isSiteEvent &&
+            val.siteIds !== undefined &&
+            val.siteIds.length === 0 &&
+            !val.allSites
+        ) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
-                message: "At least one siteId is required for site event types when allSites is false",
+                message:
+                    "At least one siteId is required for site event types when allSites is false",
                 path: ["siteIds"]
             });
         }
 
-        if (isHcEvent && val.healthCheckIds !== undefined && val.healthCheckIds.length === 0 && !val.allHealthChecks) {
+        if (
+            isHcEvent &&
+            val.healthCheckIds !== undefined &&
+            val.healthCheckIds.length === 0 &&
+            !val.allHealthChecks
+        ) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
-                message: "At least one healthCheckId is required for health check event types when allHealthChecks is false",
+                message:
+                    "At least one healthCheckId is required for health check event types when allHealthChecks is false",
                 path: ["healthCheckIds"]
             });
         }
 
-        if (isResourceEvent && val.resourceIds !== undefined && val.resourceIds.length === 0 && !val.allResources) {
+        if (
+            isResourceEvent &&
+            val.resourceIds !== undefined &&
+            val.resourceIds.length === 0 &&
+            !val.allResources
+        ) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
-                message: "At least one resourceId is required for resource event types when allResources is false",
+                message:
+                    "At least one resourceId is required for resource event types when allResources is false",
                 path: ["resourceIds"]
             });
         }
 
-        if (isSiteEvent && val.healthCheckIds !== undefined && val.healthCheckIds.length > 0) {
+        if (
+            isSiteEvent &&
+            val.healthCheckIds !== undefined &&
+            val.healthCheckIds.length > 0
+        ) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
                 message: "healthCheckIds must not be set for site event types",
@@ -129,7 +154,11 @@ const bodySchema = z
             });
         }
 
-        if (isResourceEvent && val.siteIds !== undefined && val.siteIds.length > 0) {
+        if (
+            isResourceEvent &&
+            val.siteIds !== undefined &&
+            val.siteIds.length > 0
+        ) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
                 message: "siteIds must not be set for resource event types",
@@ -137,10 +166,15 @@ const bodySchema = z
             });
         }
 
-        if (isResourceEvent && val.healthCheckIds !== undefined && val.healthCheckIds.length > 0) {
+        if (
+            isResourceEvent &&
+            val.healthCheckIds !== undefined &&
+            val.healthCheckIds.length > 0
+        ) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
-                message: "healthCheckIds must not be set for resource event types",
+                message:
+                    "healthCheckIds must not be set for resource event types",
                 path: ["healthCheckIds"]
             });
         }
@@ -153,7 +187,6 @@ const UpdateAlertRuleResponseDataSchema = z.object({
     alertRuleId: z.number()
 });
 
-
 registry.registerPath({
     method: "post",
     path: "/org/{orgId}/alert-rule/{alertRuleId}",
@@ -174,7 +207,9 @@ registry.registerPath({
             description: "Successful response",
             content: {
                 "application/json": {
-                    schema: createApiResponseSchema(UpdateAlertRuleResponseDataSchema)
+                    schema: createApiResponseSchema(
+                        UpdateAlertRuleResponseDataSchema
+                    )
                 }
             }
         }
@@ -250,9 +285,11 @@ export async function updateAlertRule(
         if (name !== undefined) updateData.name = name;
         if (eventType !== undefined) updateData.eventType = eventType;
         if (enabled !== undefined) updateData.enabled = enabled;
-        if (cooldownSeconds !== undefined) updateData.cooldownSeconds = cooldownSeconds;
+        if (cooldownSeconds !== undefined)
+            updateData.cooldownSeconds = cooldownSeconds;
         if (allSites !== undefined) updateData.allSites = allSites;
-        if (allHealthChecks !== undefined) updateData.allHealthChecks = allHealthChecks;
+        if (allHealthChecks !== undefined)
+            updateData.allHealthChecks = allHealthChecks;
         if (allResources !== undefined) updateData.allResources = allResources;
 
         await db
@@ -273,7 +310,11 @@ export async function updateAlertRule(
 
             // Only insert junction rows when allSites is not true
             const effectiveAllSites = allSites ?? false;
-            if (!effectiveAllSites && siteIds !== undefined && siteIds.length > 0) {
+            if (
+                !effectiveAllSites &&
+                siteIds !== undefined &&
+                siteIds.length > 0
+            ) {
                 await db.insert(alertSites).values(
                     siteIds.map((siteId) => ({
                         alertRuleId,
@@ -290,7 +331,11 @@ export async function updateAlertRule(
                 .where(eq(alertHealthChecks.alertRuleId, alertRuleId));
 
             const effectiveAllHealthChecks = allHealthChecks ?? false;
-            if (!effectiveAllHealthChecks && healthCheckIds !== undefined && healthCheckIds.length > 0) {
+            if (
+                !effectiveAllHealthChecks &&
+                healthCheckIds !== undefined &&
+                healthCheckIds.length > 0
+            ) {
                 await db.insert(alertHealthChecks).values(
                     healthCheckIds.map((healthCheckId) => ({
                         alertRuleId,
@@ -307,7 +352,11 @@ export async function updateAlertRule(
                 .where(eq(alertResources.alertRuleId, alertRuleId));
 
             const effectiveAllResources = allResources ?? false;
-            if (!effectiveAllResources && resourceIds !== undefined && resourceIds.length > 0) {
+            if (
+                !effectiveAllResources &&
+                resourceIds !== undefined &&
+                resourceIds.length > 0
+            ) {
                 await db.insert(alertResources).values(
                     resourceIds.map((resourceId) => ({
                         alertRuleId,
@@ -392,7 +441,10 @@ export async function updateAlertRule(
                     webhookActions.map((wa) => ({
                         alertRuleId,
                         webhookUrl: wa.webhookUrl,
-                        config: wa.config != null ? encrypt(wa.config, serverSecret) : null,
+                        config:
+                            wa.config != null
+                                ? encrypt(wa.config, serverSecret)
+                                : null,
                         enabled: wa.enabled
                     }))
                 );

server/private/routers/generatedLicense/clearInstanceName.ts

@@ -31,7 +31,9 @@ export async function clearInstanceName(
     next: NextFunction
 ): Promise<any> {
     try {
-        const parsedParams = clearInstanceNameParamsSchema.safeParse(req.params);
+        const parsedParams = clearInstanceNameParamsSchema.safeParse(
+            req.params
+        );
         if (!parsedParams.success) {
             return next(
                 createHttpError(
@@ -63,7 +65,8 @@ export async function clearInstanceName(
             return next(
                 createHttpError(
                     data.status || HttpCode.BAD_REQUEST,
-                    data.message || "Failed to clear instance name from Fossorial API"
+                    data.message ||
+                        "Failed to clear server ID from Fossorial API"
                 )
             );
         }
@@ -72,7 +75,7 @@ export async function clearInstanceName(
             data: null,
             success: true,
             error: false,
-            message: "Instance name cleared successfully",
+            message: "Server ID cleared successfully",
             status: HttpCode.OK
         });
     } catch (error) {
@@ -80,8 +83,8 @@ export async function clearInstanceName(
         return next(
             createHttpError(
                 HttpCode.INTERNAL_SERVER_ERROR,
-                "An error occurred while clearing the instance name."
+                "An error occurred while clearing the server ID."
             )
         );
     }
-}
+}

server/private/routers/gerbil/createExitNode.ts

@@ -12,8 +12,8 @@
  */
 
 import { db, ExitNode, exitNodes } from "@server/db";
-import { getUniqueExitNodeEndpointName } from "@server/db/names";
 import config from "@server/lib/config";
+import privateConfig from "#private/lib/config";
 import { getNextAvailableSubnet } from "@server/lib/exitNodes";
 import logger from "@server/logger";
 import { eq } from "drizzle-orm";
@@ -45,6 +45,8 @@ export async function createExitNode(
                 .values({
                     publicKey,
                     endpoint: config.getRawConfig().gerbil.base_endpoint,
+                    region:
+                        privateConfig.getRawPrivateConfig().app.region || null,
                     address,
                     listenPort,
                     online: true,

server/private/routers/remoteExitNode/getRemoteExitNodeToken.ts

@@ -26,7 +26,7 @@ import {
     validateRemoteExitNodeSessionToken,
     EXPIRES
 } from "#private/auth/sessions/remoteExitNode";
-import { getOrCreateCachedToken } from "@server/private/lib/tokenCache";
+import { getOrCreateCachedToken } from "#private/lib/tokenCache";
 import { verifyPassword } from "@server/auth/password";
 import logger from "@server/logger";
 import config from "@server/lib/config";

server/routers/domain/createOrgDomain.ts

@@ -21,6 +21,7 @@ import { LimitId } from "@server/lib/billing";
 import { isSecondLevelDomain, isValidDomain } from "@server/lib/validators";
 import { build } from "@server/build";
 import config from "@server/lib/config";
+import { createNs, createCname } from "#dynamic/lib/dns/generateDomains";
 
 const paramsSchema = z.strictObject({
     orgId: z.string()
@@ -283,8 +284,7 @@ export async function createOrgDomain(
 
             // TODO: This needs to be cross region and not hardcoded
             if (type === "ns") {
-                nsRecords = config.getRawConfig().dns.nameservers as string[];
-
+                nsRecords = createNs();
                 // Save NS records to database
                 for (const nsValue of nsRecords) {
                     recordsToInsert.push({
@@ -296,16 +296,7 @@ export async function createOrgDomain(
                     });
                 }
             } else if (type === "cname") {
-                cnameRecords = [
-                    {
-                        value: `${domainId}.${config.getRawConfig().dns.cname_extension}`,
-                        baseDomain: baseDomain
-                    },
-                    {
-                        value: `_acme-challenge.${domainId}.${config.getRawConfig().dns.cname_extension}`,
-                        baseDomain: `_acme-challenge.${baseDomain}`
-                    }
-                ];
+                cnameRecords = createCname(domainId, baseDomain);
 
                 // Save CNAME records to database
                 for (const cnameRecord of cnameRecords) {

server/routers/external.ts

@@ -62,7 +62,6 @@ import { createStore } from "#dynamic/lib/rateLimitStore";
 import { checkRoundTripMessage } from "./ws";
 import * as labels from "@server/routers/labels";
 import * as aiProvider from "@server/routers/aiProvider";
-import * as redirect from "@server/routers/redirect";
 import * as aiBudget from "@server/routers/aiBudget";
 import * as virtualApiKey from "@server/routers/virtualApiKey";
 import * as certificates from "@server/routers/certificates";
@@ -1623,50 +1622,6 @@ authenticated.delete(
     aiProvider.deleteAiProvider
 );
 
-authenticated.put(
-    "/org/:orgId/redirect",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.createRedirect),
-    logActionAudit(ActionsEnum.createRedirect),
-    redirect.createRedirect
-);
-
-authenticated.get(
-    "/org/:orgId/redirects",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.listRedirects),
-    redirect.listRedirects
-);
-
-authenticated.get(
-    "/org/:orgId/redirects/:redirectId",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.getRedirect),
-    redirect.getRedirect
-);
-authenticated.get(
-    "/org/:orgId/redirect/:niceId",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.getRedirect),
-    redirect.getRedirect
-);
-
-authenticated.post(
-    "/org/:orgId/redirects/:redirectId",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.updateRedirect),
-    logActionAudit(ActionsEnum.updateRedirect),
-    redirect.updateRedirect
-);
-
-authenticated.delete(
-    "/org/:orgId/redirects/:redirectId",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.deleteRedirect),
-    logActionAudit(ActionsEnum.deleteRedirect),
-    redirect.deleteRedirect
-);
-
 authenticated.put(
     "/ai-provider/:providerId/model",
     verifyAiProviderAccess,

server/routers/gerbil/getConfig.ts

@@ -10,6 +10,7 @@ import config from "@server/lib/config";
 import { fromError } from "zod-validation-error";
 import { getAllowedIps } from "../target/helpers";
 import { createExitNode } from "#dynamic/routers/gerbil/createExitNode";
+import { markExitNodeCheckedIn } from "@server/lib/exitNodes";
 
 // Define Zod schema for request validation
 const getConfigSchema = z.object({
@@ -65,6 +66,8 @@ export async function getConfig(
             );
         }
 
+        markExitNodeCheckedIn(exitNode.exitNodeId);
+
         const configResponse = await generateGerbilConfig(exitNode);
 
         logger.debug("Sending config: ", configResponse);

server/routers/newt/handleRequestLogMessage.ts

@@ -1,16 +1,3 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
 import { db } from "@server/db";
 import { MessageHandler } from "@server/routers/ws";
 import { sites, Newt, orgs, clients, clientSitesAssociationsCache, users } from "@server/db";

server/routers/redirect/createRedirect.ts

@@ -1,201 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db, domains, orgDomains, redirects, resources } from "@server/db";
-import type { Redirect } from "@server/db";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { and, eq } from "drizzle-orm";
-import {
-    redirectMatchPathSchema,
-    redirectPathMatchTypeSchema,
-    redirectRewritePathSchema,
-    redirectRewritePathTypeSchema
-} from "@server/routers/redirect/validation";
-import { getUniqueRedirectName } from "@server/db/names";
-
-export type CreateRedirectResponse = {
-    redirect: Redirect;
-};
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty()
-});
-
-const bodySchema = z.strictObject({
-    name: z.string().nonempty(),
-    resourceId: z.number().int().positive().optional().nullable(),
-    domainId: z.string().nonempty().optional().nullable(),
-    subdomain: z.string().nonempty().optional().nullable(),
-    destinationDomain: z.string().nonempty(),
-    pathMatchType: redirectPathMatchTypeSchema.optional(),
-    matchPath: redirectMatchPathSchema,
-    rewritePath: redirectRewritePathSchema.optional().nullable(),
-    rewritePathType: redirectRewritePathTypeSchema.optional().nullable(),
-    permanent: z.boolean().optional(),
-    enabled: z.boolean().optional()
-}).refine(
-    (data) =>
-        // stripPrefix removes the matched prefix and needs no replacement
-        // value; every other rewrite type is meaningless without one.
-        !data.rewritePathType ||
-        data.rewritePathType === "stripPrefix" ||
-        Boolean(data.rewritePath),
-    {
-        message:
-            "rewritePath is required unless rewritePathType is stripPrefix",
-        path: ["rewritePath"]
-    }
-);
-
-registry.registerPath({
-    method: "put",
-    path: "/org/{orgId}/redirect",
-    description: "Create a redirect for an organization.",
-    tags: [OpenAPITags.Redirect],
-    request: {
-        params: paramsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: bodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        201: {
-            description: "Successful response"
-        }
-    }
-});
-
-export async function createRedirect(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedBody = bodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { orgId } = parsedParams.data;
-        const {
-            name,
-            resourceId,
-            domainId,
-            subdomain,
-            destinationDomain,
-            pathMatchType,
-            matchPath,
-            rewritePath,
-            rewritePathType,
-            permanent,
-            enabled
-        } = parsedBody.data;
-
-        if (resourceId) {
-            const [resource] = await db
-                .select({ resourceId: resources.resourceId })
-                .from(resources)
-                .where(
-                    and(
-                        eq(resources.resourceId, resourceId),
-                        eq(resources.orgId, orgId)
-                    )
-                )
-                .limit(1);
-
-            if (!resource) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Resource with ID ${resourceId} not found`
-                    )
-                );
-            }
-        }
-
-        if (domainId) {
-            const [domain] = await db
-                .select({ domainId: domains.domainId })
-                .from(domains)
-                .innerJoin(
-                    orgDomains,
-                    eq(orgDomains.domainId, domains.domainId)
-                )
-                .where(
-                    and(
-                        eq(domains.domainId, domainId),
-                        eq(orgDomains.orgId, orgId)
-                    )
-                )
-                .limit(1);
-
-            if (!domain) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Domain with ID ${domainId} not found`
-                    )
-                );
-            }
-        }
-
-        const niceId = await getUniqueRedirectName(orgId);
-
-        const [redirect] = await db
-            .insert(redirects)
-            .values({
-                orgId,
-                name,
-                niceId,
-                resourceId: resourceId ?? null,
-                domainId: domainId ?? null,
-                subdomain: subdomain ?? null,
-                destinationDomain,
-                pathMatchType: pathMatchType ?? "regex",
-                matchPath,
-                rewritePath: rewritePath ?? null,
-                rewritePathType: rewritePathType ?? null,
-                permanent: permanent ?? false,
-                enabled: enabled ?? true
-            })
-            .returning();
-
-        return response<CreateRedirectResponse>(res, {
-            data: {
-                redirect
-            },
-            success: true,
-            error: false,
-            message: "Redirect created successfully",
-            status: HttpCode.CREATED
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/redirect/deleteRedirect.ts

@@ -1,92 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { redirects, db } from "@server/db";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { and, eq } from "drizzle-orm";
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty(),
-    redirectId: z.coerce.number().int().positive()
-});
-
-registry.registerPath({
-    method: "delete",
-    path: "/org/{orgId}/redirects/{redirectId}",
-    description: "Delete a redirect.",
-    tags: [OpenAPITags.Redirect],
-    request: {
-        params: paramsSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response"
-        }
-    }
-});
-
-export async function deleteRedirect(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId, redirectId } = parsedParams.data;
-
-        const [existing] = await db
-            .select({ redirectId: redirects.redirectId })
-            .from(redirects)
-            .where(
-                and(
-                    eq(redirects.redirectId, redirectId),
-                    eq(redirects.orgId, orgId)
-                )
-            )
-            .limit(1);
-
-        if (!existing) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Redirect with ID ${redirectId} not found`
-                )
-            );
-        }
-
-        await db
-            .delete(redirects)
-            .where(
-                and(
-                    eq(redirects.redirectId, redirectId),
-                    eq(redirects.orgId, orgId)
-                )
-            );
-
-        return response(res, {
-            data: null,
-            success: true,
-            error: false,
-            message: "Redirect deleted successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/redirect/getRedirect.ts

@@ -1,182 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { domains, redirects, resources, db } from "@server/db";
-import response from "@server/lib/response";
-import stoi from "@server/lib/stoi";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { and, eq } from "drizzle-orm";
-
-export type GetRedirectResponse = {
-    redirect: {
-        redirectId: number;
-        orgId: string;
-        niceId: string;
-        name: string;
-        subdomain: string | null;
-        destinationDomain: string;
-        pathMatchType: "exact" | "prefix" | "regex";
-        matchPath: string;
-        rewritePath: string | null;
-        rewritePathType: "exact" | "prefix" | "regex" | "stripPrefix" | null;
-        permanent: boolean;
-        enabled: boolean;
-        resourceId: number | null;
-        resourceName: string | null;
-        resourceNiceId: string | null;
-        resourceFullDomain: string | null;
-        resourceSsl: boolean | null;
-        resourceWildcard: boolean | null;
-        domainId: string | null;
-        baseDomain: string | null;
-    };
-};
-
-const redirectColumns = {
-    redirectId: redirects.redirectId,
-    orgId: redirects.orgId,
-    niceId: redirects.niceId,
-    name: redirects.name,
-    subdomain: redirects.subdomain,
-    destinationDomain: redirects.destinationDomain,
-    pathMatchType: redirects.pathMatchType,
-    matchPath: redirects.matchPath,
-    rewritePath: redirects.rewritePath,
-    rewritePathType: redirects.rewritePathType,
-    permanent: redirects.permanent,
-    enabled: redirects.enabled,
-    resourceId: redirects.resourceId,
-    resourceName: resources.name,
-    resourceNiceId: resources.niceId,
-    resourceFullDomain: resources.fullDomain,
-    resourceSsl: resources.ssl,
-    resourceWildcard: resources.wildcard,
-    domainId: redirects.domainId,
-    baseDomain: domains.baseDomain
-};
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty(),
-    redirectId: z
-        .string()
-        .optional()
-        .transform(stoi)
-        .pipe(z.int().positive().optional())
-        .optional(),
-    niceId: z.string().optional()
-});
-
-async function query(orgId: string, redirectId?: number, niceId?: string) {
-    if (redirectId) {
-        const [res] = await db
-            .select(redirectColumns)
-            .from(redirects)
-            .leftJoin(resources, eq(resources.resourceId, redirects.resourceId))
-            .leftJoin(domains, eq(domains.domainId, redirects.domainId))
-            .where(
-                and(
-                    eq(redirects.redirectId, redirectId),
-                    eq(redirects.orgId, orgId)
-                )
-            )
-            .limit(1);
-        return res;
-    } else if (niceId) {
-        const [res] = await db
-            .select(redirectColumns)
-            .from(redirects)
-            .leftJoin(resources, eq(resources.resourceId, redirects.resourceId))
-            .leftJoin(domains, eq(domains.domainId, redirects.domainId))
-            .where(
-                and(eq(redirects.niceId, niceId), eq(redirects.orgId, orgId))
-            )
-            .limit(1);
-        return res;
-    }
-}
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/redirects/{redirectId}",
-    description: "Get a redirect by ID.",
-    tags: [OpenAPITags.Redirect],
-    request: {
-        params: z.object({
-            orgId: z.string(),
-            redirectId: z.string()
-        })
-    },
-    responses: {
-        200: {
-            description: "Successful response"
-        }
-    }
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/redirect/{niceId}",
-    description:
-        "Get a redirect by orgId and niceId. NiceId is a readable ID for the redirect and unique on a per org basis.",
-    tags: [OpenAPITags.Redirect],
-    request: {
-        params: z.object({
-            orgId: z.string(),
-            niceId: z.string()
-        })
-    },
-    responses: {
-        200: {
-            description: "Successful response"
-        }
-    }
-});
-
-export async function getRedirect(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId, redirectId, niceId } = parsedParams.data;
-
-        const redirect = await query(orgId, redirectId, niceId);
-
-        if (!redirect) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Redirect with ID ${redirectId || niceId} not found`
-                )
-            );
-        }
-
-        return response<GetRedirectResponse>(res, {
-            data: {
-                redirect
-            },
-            success: true,
-            error: false,
-            message: "Redirect retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/redirect/index.ts

@@ -1,5 +0,0 @@
-export * from "./createRedirect";
-export * from "./listRedirects";
-export * from "./getRedirect";
-export * from "./updateRedirect";
-export * from "./deleteRedirect";

server/routers/redirect/listRedirects.ts

@@ -1,197 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { domains, redirects, resources, db } from "@server/db";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { and, asc, eq, like, or, sql } from "drizzle-orm";
-import type { PaginatedResponse } from "@server/types/Pagination";
-
-export type ListRedirectsResponse = PaginatedResponse<{
-    redirects: Array<{
-        redirectId: number;
-        orgId: string;
-        niceId: string;
-        name: string;
-        subdomain: string | null;
-        destinationDomain: string;
-        pathMatchType: "exact" | "prefix" | "regex";
-        matchPath: string;
-        rewritePath: string | null;
-        rewritePathType: "exact" | "prefix" | "regex" | "stripPrefix" | null;
-        permanent: boolean;
-        enabled: boolean;
-        resourceId: number | null;
-        resourceName: string | null;
-        resourceNiceId: string | null;
-        resourceFullDomain: string | null;
-        domainId: string | null;
-        baseDomain: string | null;
-    }>;
-}>;
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty()
-});
-
-const listSchema = z.object({
-    pageSize: z.coerce
-        .number<string>()
-        .int()
-        .positive()
-        .optional()
-        .catch(20)
-        .default(20)
-        .openapi({
-            type: "integer",
-            default: 20,
-            description: "Number of items per page"
-        }),
-    page: z.coerce
-        .number<string>()
-        .int()
-        .min(0)
-        .optional()
-        .catch(1)
-        .default(1)
-        .openapi({
-            type: "integer",
-            default: 1,
-            description: "Page number to retrieve"
-        }),
-    query: z.string().optional()
-});
-
-registry.registerPath({
-    method: "get",
-    path: "/org/{orgId}/redirects",
-    description: "List redirects for an organization.",
-    tags: [OpenAPITags.Redirect],
-    request: {
-        params: paramsSchema,
-        query: listSchema
-    },
-    responses: {
-        200: {
-            description: "Successful response"
-        }
-    }
-});
-
-export async function listRedirects(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedQuery = listSchema.safeParse(req.query);
-        if (!parsedQuery.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedQuery.error).toString()
-                )
-            );
-        }
-
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId } = parsedParams.data;
-
-        if (req.user && orgId && orgId !== req.userOrgId) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "User does not have access to this organization"
-                )
-            );
-        }
-
-        const { pageSize, page, query } = parsedQuery.data;
-        const conditions = [eq(redirects.orgId, orgId)];
-
-        if (query) {
-            const term = "%" + query.toLowerCase() + "%";
-            conditions.push(
-                or(
-                    like(sql`LOWER(${redirects.name})`, term),
-                    like(sql`LOWER(${redirects.matchPath})`, term),
-                    like(sql`LOWER(${redirects.destinationDomain})`, term)
-                )!
-            );
-        }
-
-        const baseQuery = db
-            .select({
-                redirectId: redirects.redirectId,
-                orgId: redirects.orgId,
-                niceId: redirects.niceId,
-                name: redirects.name,
-                subdomain: redirects.subdomain,
-                destinationDomain: redirects.destinationDomain,
-                pathMatchType: redirects.pathMatchType,
-                matchPath: redirects.matchPath,
-                rewritePath: redirects.rewritePath,
-                rewritePathType: redirects.rewritePathType,
-                permanent: redirects.permanent,
-                enabled: redirects.enabled,
-                resourceId: redirects.resourceId,
-                resourceName: resources.name,
-                resourceNiceId: resources.niceId,
-                resourceFullDomain: resources.fullDomain,
-                domainId: redirects.domainId,
-                baseDomain: domains.baseDomain
-            })
-            .from(redirects)
-            .leftJoin(resources, eq(resources.resourceId, redirects.resourceId))
-            .leftJoin(domains, eq(domains.domainId, redirects.domainId))
-            .where(and(...conditions));
-
-        const countQuery = db.$count(
-            db
-                .select()
-                .from(redirects)
-                .where(and(...conditions))
-                .as("filtered_redirects")
-        );
-
-        const [totalCount, rows] = await Promise.all([
-            countQuery,
-            baseQuery
-                .limit(pageSize)
-                .offset(pageSize * (page - 1))
-                .orderBy(asc(redirects.name))
-        ]);
-
-        return response<ListRedirectsResponse>(res, {
-            data: {
-                redirects: rows,
-                pagination: {
-                    total: totalCount,
-                    pageSize,
-                    page
-                }
-            },
-            success: true,
-            error: false,
-            message: "Redirects retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/redirect/updateRedirect.ts

@@ -1,251 +0,0 @@
-import { Request, Response, NextFunction } from "express";
-import { z } from "zod";
-import { db, domains, orgDomains, redirects, resources } from "@server/db";
-import type { Redirect } from "@server/db";
-import response from "@server/lib/response";
-import HttpCode from "@server/types/HttpCode";
-import createHttpError from "http-errors";
-import logger from "@server/logger";
-import { fromError } from "zod-validation-error";
-import { OpenAPITags, registry } from "@server/openApi";
-import { and, eq, ne } from "drizzle-orm";
-import {
-    redirectNiceIdSchema,
-    redirectMatchPathSchema,
-    redirectPathMatchTypeSchema,
-    redirectRewritePathSchema,
-    redirectRewritePathTypeSchema
-} from "@server/routers/redirect/validation";
-
-export type UpdateRedirectResponse = {
-    redirect: Redirect;
-};
-
-const paramsSchema = z.strictObject({
-    orgId: z.string().nonempty(),
-    redirectId: z.coerce.number().int().positive()
-});
-
-const bodySchema = z.strictObject({
-    name: z.string().nonempty().optional(),
-    niceId: redirectNiceIdSchema.optional(),
-    resourceId: z.number().int().positive().optional().nullable(),
-    domainId: z.string().nonempty().optional().nullable(),
-    subdomain: z.string().nonempty().optional().nullable(),
-    destinationDomain: z.string().nonempty().optional(),
-    pathMatchType: redirectPathMatchTypeSchema.optional(),
-    matchPath: redirectMatchPathSchema.optional(),
-    rewritePath: redirectRewritePathSchema.optional().nullable(),
-    rewritePathType: redirectRewritePathTypeSchema.optional().nullable(),
-    permanent: z.boolean().optional(),
-    enabled: z.boolean().optional()
-});
-
-registry.registerPath({
-    method: "post",
-    path: "/org/{orgId}/redirects/{redirectId}",
-    description: "Update a redirect.",
-    tags: [OpenAPITags.Redirect],
-    request: {
-        params: paramsSchema,
-        body: {
-            content: {
-                "application/json": {
-                    schema: bodySchema
-                }
-            }
-        }
-    },
-    responses: {
-        200: {
-            description: "Successful response"
-        }
-    }
-});
-
-export async function updateRedirect(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = paramsSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const parsedBody = bodySchema.safeParse(req.body);
-        if (!parsedBody.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedBody.error).toString()
-                )
-            );
-        }
-
-        const { orgId, redirectId } = parsedParams.data;
-        const body = parsedBody.data;
-
-        const [existing] = await db
-            .select()
-            .from(redirects)
-            .where(
-                and(
-                    eq(redirects.redirectId, redirectId),
-                    eq(redirects.orgId, orgId)
-                )
-            )
-            .limit(1);
-
-        if (!existing) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Redirect with ID ${redirectId} not found`
-                )
-            );
-        }
-
-        if (body.resourceId) {
-            const [resource] = await db
-                .select({ resourceId: resources.resourceId })
-                .from(resources)
-                .where(
-                    and(
-                        eq(resources.resourceId, body.resourceId),
-                        eq(resources.orgId, existing.orgId)
-                    )
-                )
-                .limit(1);
-
-            if (!resource) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Resource with ID ${body.resourceId} not found`
-                    )
-                );
-            }
-        }
-
-        if (body.domainId) {
-            const [domain] = await db
-                .select({ domainId: domains.domainId })
-                .from(domains)
-                .innerJoin(
-                    orgDomains,
-                    eq(orgDomains.domainId, domains.domainId)
-                )
-                .where(
-                    and(
-                        eq(domains.domainId, body.domainId),
-                        eq(orgDomains.orgId, existing.orgId)
-                    )
-                )
-                .limit(1);
-
-            if (!domain) {
-                return next(
-                    createHttpError(
-                        HttpCode.NOT_FOUND,
-                        `Domain with ID ${body.domainId} not found`
-                    )
-                );
-            }
-        }
-
-        if (body.niceId) {
-            const [existingNiceId] = await db
-                .select()
-                .from(redirects)
-                .where(
-                    and(
-                        eq(redirects.niceId, body.niceId),
-                        eq(redirects.orgId, existing.orgId),
-                        ne(redirects.redirectId, existing.redirectId) // exclude the current redirect from the search
-                    )
-                )
-                .limit(1);
-
-            if (existingNiceId) {
-                return next(
-                    createHttpError(
-                        HttpCode.CONFLICT,
-                        `A redirect with niceId "${body.niceId}" already exists`
-                    )
-                );
-            }
-        }
-
-        const updateData: Partial<typeof redirects.$inferInsert> = {};
-
-        if (body.name !== undefined) {
-            updateData.name = body.name;
-        }
-        if (body.niceId !== undefined) {
-            updateData.niceId = body.niceId;
-        }
-        if (body.resourceId !== undefined) {
-            updateData.resourceId = body.resourceId;
-        }
-        if (body.domainId !== undefined) {
-            updateData.domainId = body.domainId;
-        }
-        if (body.subdomain !== undefined) {
-            updateData.subdomain = body.subdomain;
-        }
-        if (body.destinationDomain !== undefined) {
-            updateData.destinationDomain = body.destinationDomain;
-        }
-        if (body.pathMatchType !== undefined) {
-            updateData.pathMatchType = body.pathMatchType;
-        }
-        if (body.matchPath !== undefined) {
-            updateData.matchPath = body.matchPath;
-        }
-        if (body.rewritePath !== undefined) {
-            updateData.rewritePath = body.rewritePath;
-        }
-        if (body.rewritePathType !== undefined) {
-            updateData.rewritePathType = body.rewritePathType;
-        }
-        if (body.permanent !== undefined) {
-            updateData.permanent = body.permanent;
-        }
-        if (body.enabled !== undefined) {
-            updateData.enabled = body.enabled;
-        }
-
-        const [redirect] = await db
-            .update(redirects)
-            .set(updateData)
-            .where(
-                and(
-                    eq(redirects.redirectId, redirectId),
-                    eq(redirects.orgId, orgId)
-                )
-            )
-            .returning();
-
-        return response<UpdateRedirectResponse>(res, {
-            data: {
-                redirect
-            },
-            success: true,
-            error: false,
-            message: "Redirect updated successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/redirect/validation.ts

@@ -1,23 +0,0 @@
-import { z } from "zod";
-
-export const redirectNiceIdSchema = z
-    .string()
-    .min(1)
-    .max(255)
-    .regex(
-        /^[a-zA-Z0-9-]+$/,
-        "niceId can only contain letters, numbers, and dashes"
-    );
-
-export const redirectPathMatchTypeSchema = z.enum(["exact", "prefix", "regex"]);
-
-export const redirectRewritePathTypeSchema = z.enum([
-    "exact",
-    "prefix",
-    "regex",
-    "stripPrefix"
-]);
-
-export const redirectMatchPathSchema = z.string().nonempty().default("*");
-
-export const redirectRewritePathSchema = z.string().nonempty();

server/setup/migrationsPg.ts

@@ -66,6 +66,12 @@ const migrations = [
 
 await run();
 
+// The pg Pool is created with allowExitOnIdle: false (see poolConfig.ts) so
+// its sockets keep the event loop alive even when idle. Without an explicit
+// exit here, this one-shot script would hang until the pool's
+// idleTimeoutMillis elapses before the process could terminate.
+process.exit(0);
+
 async function run() {
     // run the migrations
     await runMigrations();

src/app/[orgId]/settings/redirects/[niceId]/page.tsx

@@ -1,73 +0,0 @@
-import RedirectForm from "@app/components/RedirectForm";
-import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
-import { Button } from "@app/components/ui/button";
-import { internal } from "@app/lib/api";
-import { authCookieHeader } from "@app/lib/api/cookies";
-import type { GetRedirectResponse } from "@server/routers/redirect";
-import type { AxiosResponse } from "axios";
-import type { Metadata } from "next";
-import { getTranslations } from "next-intl/server";
-import Link from "next/link";
-import { notFound } from "next/navigation";
-
-export const metadata: Metadata = {
-    title: "Edit Redirect"
-};
-
-export const dynamic = "force-dynamic";
-
-type EditRedirectPageProps = {
-    params: Promise<{ orgId: string; niceId: string }>;
-};
-
-export default async function EditRedirectPage(props: EditRedirectPageProps) {
-    const { orgId, niceId } = await props.params;
-    const t = await getTranslations();
-
-    let redirect: GetRedirectResponse["redirect"];
-    try {
-        const res = await internal.get<AxiosResponse<GetRedirectResponse>>(
-            `/org/${orgId}/redirect/${niceId}`,
-            await authCookieHeader()
-        );
-        redirect = res.data.data.redirect;
-    } catch {
-        notFound();
-    }
-
-    // The resource selector needs the resource's display fields up front so the
-    // trigger shows a name instead of a bare id before the list query resolves.
-    const initialResource =
-        redirect.resourceId && redirect.resourceNiceId
-            ? {
-                  resourceId: redirect.resourceId,
-                  niceId: redirect.resourceNiceId,
-                  name: redirect.resourceName ?? redirect.resourceNiceId,
-                  fullDomain: redirect.resourceFullDomain,
-                  ssl: redirect.resourceSsl ?? false,
-                  wildcard: redirect.resourceWildcard ?? false
-              }
-            : null;
-
-    return (
-        <>
-            <div className="flex gap-2 justify-between">
-                <SettingsSectionTitle
-                    title={redirect.name}
-                    description={t("redirectEditDescription")}
-                />
-                <Button variant="outline" asChild>
-                    <Link href={`/${orgId}/settings/redirects`}>
-                        {t("redirectGoBack")}
-                    </Link>
-                </Button>
-            </div>
-
-            <RedirectForm
-                orgId={orgId}
-                redirect={redirect}
-                initialResource={initialResource}
-            />
-        </>
-    );
-}

src/app/[orgId]/settings/redirects/create/page.tsx

@@ -1,39 +0,0 @@
-import RedirectForm from "@app/components/RedirectForm";
-import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
-import { Button } from "@app/components/ui/button";
-import type { Metadata } from "next";
-import { getTranslations } from "next-intl/server";
-import Link from "next/link";
-
-export const metadata: Metadata = {
-    title: "Create Redirect"
-};
-
-type CreateRedirectPageProps = {
-    params: Promise<{ orgId: string }>;
-};
-
-export default async function CreateRedirectPage(
-    props: CreateRedirectPageProps
-) {
-    const { orgId } = await props.params;
-    const t = await getTranslations();
-
-    return (
-        <>
-            <div className="flex gap-2 justify-between">
-                <SettingsSectionTitle
-                    title={t("redirectCreate")}
-                    description={t("redirectCreateDescription")}
-                />
-                <Button variant="outline" asChild>
-                    <Link href={`/${orgId}/settings/redirects`}>
-                        {t("redirectGoBack")}
-                    </Link>
-                </Button>
-            </div>
-
-            <RedirectForm orgId={orgId} />
-        </>
-    );
-}

src/app/[orgId]/settings/redirects/page.tsx

@@ -1,81 +0,0 @@
-import RedirectsTable from "@app/components/RedirectsTable";
-import SettingsSectionTitle from "@app/components/SettingsSectionTitle";
-import { internal } from "@app/lib/api";
-import { authCookieHeader } from "@app/lib/api/cookies";
-import type { ListRedirectsResponse } from "@server/routers/redirect";
-import type { AxiosResponse } from "axios";
-import type { Metadata } from "next";
-import { getTranslations } from "next-intl/server";
-
-export const metadata: Metadata = {
-    title: "Redirects"
-};
-
-type RedirectIndexPageProps = {
-    params: Promise<{ orgId: string }>;
-    searchParams: Promise<Record<string, string>>;
-};
-
-export const dynamic = "force-dynamic";
-
-export default async function RedirectIndexPage(props: RedirectIndexPageProps) {
-    const { orgId } = await props.params;
-    const searchParams = new URLSearchParams(await props.searchParams);
-    const t = await getTranslations();
-
-    let redirects: ListRedirectsResponse["redirects"] = [];
-    let pagination: ListRedirectsResponse["pagination"] = {
-        total: 0,
-        page: 1,
-        pageSize: 20
-    };
-
-    try {
-        const res = await internal.get<AxiosResponse<ListRedirectsResponse>>(
-            `/org/${orgId}/redirects?${searchParams.toString()}`,
-            await authCookieHeader()
-        );
-        const responseData = res.data.data;
-        redirects = responseData.redirects;
-        pagination = responseData.pagination;
-    } catch {
-        // empty list on error
-    }
-
-    return (
-        <>
-            <SettingsSectionTitle
-                title={t("redirectsTitle")}
-                description={t("redirectsDescription")}
-            />
-
-            <RedirectsTable
-                orgId={orgId}
-                redirects={redirects.map((redirect) => ({
-                    redirectId: redirect.redirectId,
-                    niceId: redirect.niceId,
-                    name: redirect.name,
-                    subdomain: redirect.subdomain,
-                    destinationDomain: redirect.destinationDomain,
-                    pathMatchType: redirect.pathMatchType,
-                    matchPath: redirect.matchPath,
-                    rewritePath: redirect.rewritePath,
-                    rewritePathType: redirect.rewritePathType,
-                    permanent: redirect.permanent,
-                    enabled: redirect.enabled,
-                    resourceId: redirect.resourceId,
-                    resourceName: redirect.resourceName,
-                    resourceNiceId: redirect.resourceNiceId,
-                    resourceFullDomain: redirect.resourceFullDomain,
-                    domainId: redirect.domainId,
-                    baseDomain: redirect.baseDomain
-                }))}
-                rowCount={pagination.total}
-                pagination={{
-                    pageIndex: pagination.page - 1,
-                    pageSize: pagination.pageSize
-                }}
-            />
-        </>
-    );
-}

src/app/navigation.tsx

@@ -25,7 +25,6 @@ import {
     MonitorUp,
     Plug,
     ReceiptText,
-    Repeat,
     ScanEye,
     Server,
     Settings,
@@ -324,11 +323,6 @@ export const orgNavSections = (
                         href: "/{orgId}/settings/api-keys",
                         icon: <KeyRound className="size-4 flex-none" />
                     },
-                    {
-                        title: "sidebarRedirects",
-                        href: "/{orgId}/settings/redirects",
-                        icon: <Repeat className="size-4 flex-none" />
-                    },
                     ...(!env?.flags.disableEnterpriseFeatures
                         ? [
                               {

src/components/GenerateLicenseKeysTable.tsx

@@ -78,13 +78,16 @@ export default function GenerateLicenseKeysTable({
             );
             toast({
                 title: t("success"),
-                description: "Instance name cleared successfully"
+                description: "Server ID cleared successfully"
             });
             await refreshData();
         } catch (error) {
             toast({
                 title: t("error"),
-                description: formatAxiosError(error, "Failed to clear instance name"),
+                description: formatAxiosError(
+                    error,
+                    "Failed to clear server ID"
+                ),
                 variant: "destructive"
             });
         } finally {
@@ -291,7 +294,7 @@ export default function GenerateLicenseKeysTable({
                                         clearInstanceName(key.licenseKey)
                                     }
                                 >
-                                    Clear Instance Name
+                                    {t("clearInstanceName")}
                                 </DropdownMenuItem>
                             </DropdownMenuContent>
                         </DropdownMenu>

src/components/RedirectForm.tsx

@@ -1,795 +0,0 @@
-"use client";
-
-import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
-import {
-    SettingsContainer,
-    SettingsFormCell,
-    SettingsFormGrid,
-    SettingsSection,
-    SettingsSectionBody,
-    SettingsSectionDescription,
-    SettingsSectionFooter,
-    SettingsSectionForm,
-    SettingsSectionHeader,
-    SettingsSectionTitle
-} from "@app/components/Settings";
-import { SwitchInput } from "@app/components/SwitchInput";
-import { Button } from "@app/components/ui/button";
-import {
-    Form,
-    FormControl,
-    FormDescription,
-    FormField,
-    FormItem,
-    FormLabel,
-    FormMessage
-} from "@app/components/ui/form";
-import { Input } from "@app/components/ui/input";
-import {
-    Popover,
-    PopoverContent,
-    PopoverTrigger
-} from "@app/components/ui/popover";
-import {
-    Select,
-    SelectContent,
-    SelectItem,
-    SelectTrigger,
-    SelectValue
-} from "@app/components/ui/select";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { toast } from "@app/hooks/useToast";
-import { createApiClient, formatAxiosError } from "@app/lib/api";
-import { cn } from "@app/lib/cn";
-import { CaretSortIcon } from "@radix-ui/react-icons";
-import { zodResolver } from "@hookform/resolvers/zod";
-import type {
-    CreateRedirectResponse,
-    GetRedirectResponse
-} from "@server/routers/redirect";
-import type { AxiosResponse } from "axios";
-import { useTranslations } from "next-intl";
-import { useRouter } from "next/navigation";
-import { useMemo, useState } from "react";
-import { useForm } from "react-hook-form";
-import { z } from "zod";
-import { ResourceSelector, type SelectedResource } from "./resource-selector";
-import {
-    PathMatchDisplay,
-    PathMatchModal,
-    PathRewriteDisplay,
-    PathRewriteModal
-} from "@app/components/PathMatchRenameModal";
-import { Plus } from "lucide-react";
-import DomainPicker from "@app/components/DomainPicker";
-import Link from "next/link";
-
-const DEFAULT_MATCH_PATH = ".*";
-const DEFAULT_PATH_MATCH_TYPE = "regex" as const;
-
-export type ExistingRedirect = GetRedirectResponse["redirect"];
-
-type RedirectFormProps = {
-    orgId: string;
-    /** Omit to create a new redirect. */
-    redirect?: ExistingRedirect;
-    /** Name/domain of the resource the redirect is attached to, when there is one. */
-    initialResource?: SelectedResource | null;
-};
-
-export default function RedirectForm({
-    orgId,
-    redirect,
-    initialResource = null
-}: RedirectFormProps) {
-    const isEditing = Boolean(redirect);
-    const { env } = useEnvContext();
-    const api = createApiClient({ env });
-    const router = useRouter();
-    const t = useTranslations();
-
-    const [saveLoading, setSaveLoading] = useState(false);
-    const [deleteLoading, setDeleteLoading] = useState(false);
-    const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
-    const [selectedResource, setSelectedResource] =
-        useState<SelectedResource | null>(initialResource);
-
-    const formSchema = useMemo(
-        () =>
-            z
-                .object({
-                    name: z
-                        .string()
-                        .trim()
-                        .min(1, { message: t("nameRequired") }),
-                    attachTo: z.enum(["domain", "resource"]),
-                    domainId: z.string().nullable(),
-                    subdomain: z.string().nullable(),
-                    resourceId: z.number().int().positive().nullable(),
-                    destinationDomain: z
-                        .string()
-                        .trim()
-                        .min(1, {
-                            message: t("redirectDestinationDomainRequired")
-                        }),
-                    pathMatchType: z.enum(["exact", "prefix", "regex"]),
-                    matchPath: z.string().trim().min(1),
-                    rewritePath: z.string().nullable(),
-                    rewritePathType: z
-                        .enum(["exact", "prefix", "regex", "stripPrefix"])
-                        .nullable(),
-                    permanent: z.boolean(),
-                    enabled: z.boolean()
-                })
-                .superRefine((data, ctx) => {
-                    if (data.attachTo === "domain" && !data.domainId) {
-                        ctx.addIssue({
-                            code: "custom",
-                            message: t("redirectDomainRequired"),
-                            path: ["domainId"]
-                        });
-                    }
-                    if (data.attachTo === "resource" && !data.resourceId) {
-                        ctx.addIssue({
-                            code: "custom",
-                            message: t("redirectResourceRequired"),
-                            path: ["resourceId"]
-                        });
-                    }
-                    // stripPrefix drops the matched prefix outright, so it is
-                    // the one rewrite type that needs no replacement value.
-                    if (
-                        data.rewritePathType &&
-                        data.rewritePathType !== "stripPrefix" &&
-                        !data.rewritePath
-                    ) {
-                        ctx.addIssue({
-                            code: "custom",
-                            message: t("redirectRewritePathRequired"),
-                            path: ["rewritePath"]
-                        });
-                    }
-                }),
-        [t]
-    );
-
-    type RedirectFormValues = z.infer<typeof formSchema>;
-
-    const form = useForm<RedirectFormValues>({
-        resolver: zodResolver(formSchema),
-        defaultValues: {
-            name: redirect?.name ?? "",
-            attachTo: redirect?.resourceId ? "resource" : "domain",
-            domainId: redirect?.domainId ?? null,
-            subdomain: redirect?.subdomain ?? null,
-            resourceId: redirect?.resourceId ?? null,
-            destinationDomain: redirect?.destinationDomain ?? "",
-            pathMatchType: redirect?.pathMatchType ?? DEFAULT_PATH_MATCH_TYPE,
-            matchPath: redirect?.matchPath ?? DEFAULT_MATCH_PATH,
-            rewritePath: redirect?.rewritePath ?? null,
-            rewritePathType: redirect?.rewritePathType ?? null,
-            permanent: redirect?.permanent ?? false,
-            enabled: redirect?.enabled ?? true
-        }
-    });
-
-    const attachTo = form.watch("attachTo");
-    const pathMatchType = form.watch("pathMatchType");
-    const rewritePath = form.watch("rewritePath");
-    const rewritePathType = form.watch("rewritePathType");
-    // stripPrefix is a valid rewrite with no path value, so it counts as set.
-    const hasRewrite =
-        Boolean(rewritePath) || rewritePathType === "stripPrefix";
-
-    async function onSubmit(values: RedirectFormValues) {
-        setSaveLoading(true);
-
-        // Only one of the two attachment points is ever persisted; clear the
-        // other so switching between them doesn't leave a stale reference.
-        const body = {
-            name: values.name.trim(),
-            domainId: values.attachTo === "domain" ? values.domainId : null,
-            subdomain:
-                values.attachTo === "domain" ? values.subdomain || null : null,
-            resourceId:
-                values.attachTo === "resource" ? values.resourceId : null,
-            destinationDomain: values.destinationDomain.trim(),
-            pathMatchType: values.pathMatchType,
-            matchPath: values.matchPath.trim(),
-            rewritePath: values.rewritePath?.trim() || null,
-            rewritePathType: values.rewritePathType,
-            permanent: values.permanent,
-            enabled: values.enabled
-        };
-
-        try {
-            if (isEditing) {
-                await api.post(
-                    `/org/${orgId}/redirects/${redirect!.redirectId}`,
-                    body
-                );
-                toast({
-                    title: t("success"),
-                    description: t("redirectUpdated")
-                });
-                router.refresh();
-            } else {
-                const res = await api.put<
-                    AxiosResponse<CreateRedirectResponse>
-                >(`/org/${orgId}/redirect`, body);
-                toast({
-                    title: t("success"),
-                    description: t("redirectCreated")
-                });
-                router.push(
-                    `/${orgId}/settings/redirects/${res.data.data.redirect.niceId}`
-                );
-            }
-        } catch (e) {
-            toast({
-                variant: "destructive",
-                title: isEditing
-                    ? t("redirectErrorUpdate")
-                    : t("redirectErrorCreate"),
-                description: formatAxiosError(
-                    e,
-                    isEditing
-                        ? t("redirectErrorUpdate")
-                        : t("redirectErrorCreate")
-                )
-            });
-        } finally {
-            setSaveLoading(false);
-        }
-    }
-
-    async function onDelete() {
-        setDeleteLoading(true);
-        try {
-            await api.delete(`/org/${orgId}/redirects/${redirect!.redirectId}`);
-            toast({
-                title: t("success"),
-                description: t("redirectDeleted")
-            });
-            router.push(`/${orgId}/settings/redirects`);
-        } catch (e) {
-            toast({
-                variant: "destructive",
-                title: t("redirectErrorDelete"),
-                description: formatAxiosError(e, t("redirectErrorDelete"))
-            });
-        } finally {
-            setDeleteLoading(false);
-            setIsDeleteModalOpen(false);
-        }
-    }
-
-    return (
-        <>
-            {isEditing && (
-                <ConfirmDeleteDialog
-                    open={isDeleteModalOpen}
-                    setOpen={setIsDeleteModalOpen}
-                    dialog={
-                        <div className="space-y-2">
-                            <p>{t("redirectQuestionRemove")}</p>
-                            <p>{t("redirectMessageRemove")}</p>
-                        </div>
-                    }
-                    buttonText={t("redirectDeleteConfirm")}
-                    onConfirm={onDelete}
-                    string={redirect!.name}
-                    title={t("redirectDelete")}
-                />
-            )}
-
-            <SettingsContainer>
-                <SettingsSection className="pb-10">
-                    <SettingsSectionHeader>
-                        <SettingsSectionTitle>
-                            {t("general")}
-                        </SettingsSectionTitle>
-                        <SettingsSectionDescription>
-                            {t("redirectSettingsGeneralDescription")}
-                        </SettingsSectionDescription>
-                    </SettingsSectionHeader>
-
-                    <SettingsSectionBody>
-                        <SettingsSectionForm variant="half">
-                            <Form {...form}>
-                                <form
-                                    onSubmit={form.handleSubmit(onSubmit)}
-                                    id="redirect-form"
-                                >
-                                    <SettingsFormGrid>
-                                        <SettingsFormCell span="full">
-                                            <FormField
-                                                control={form.control}
-                                                name="enabled"
-                                                render={({ field }) => (
-                                                    <FormItem>
-                                                        <FormControl>
-                                                            <SwitchInput
-                                                                id="redirect-enabled"
-                                                                label={t(
-                                                                    "enabled"
-                                                                )}
-                                                                description={t(
-                                                                    "redirectEnabledDescription"
-                                                                )}
-                                                                checked={
-                                                                    field.value
-                                                                }
-                                                                onCheckedChange={
-                                                                    field.onChange
-                                                                }
-                                                            />
-                                                        </FormControl>
-                                                        <FormMessage />
-                                                    </FormItem>
-                                                )}
-                                            />
-                                        </SettingsFormCell>
-
-                                        <SettingsFormCell span="full">
-                                            <FormField
-                                                control={form.control}
-                                                name="name"
-                                                render={({ field }) => (
-                                                    <FormItem>
-                                                        <FormLabel>
-                                                            {t("name")}
-                                                        </FormLabel>
-                                                        <FormControl>
-                                                            <Input
-                                                                autoComplete="off"
-                                                                {...field}
-                                                            />
-                                                        </FormControl>
-                                                        <FormMessage />
-                                                    </FormItem>
-                                                )}
-                                            />
-                                        </SettingsFormCell>
-
-                                        <SettingsFormCell span="half">
-                                            <FormField
-                                                control={form.control}
-                                                name="attachTo"
-                                                render={({ field }) => (
-                                                    <FormItem>
-                                                        <FormLabel>
-                                                            {t(
-                                                                "redirectAttachedTo"
-                                                            )}
-                                                        </FormLabel>
-                                                        <Select
-                                                            value={field.value}
-                                                            onValueChange={
-                                                                field.onChange
-                                                            }
-                                                        >
-                                                            <FormControl>
-                                                                <SelectTrigger>
-                                                                    <SelectValue />
-                                                                </SelectTrigger>
-                                                            </FormControl>
-                                                            <SelectContent>
-                                                                <SelectItem value="domain">
-                                                                    {t(
-                                                                        "redirectAttachDomain"
-                                                                    )}
-                                                                </SelectItem>
-                                                                <SelectItem value="resource">
-                                                                    {t(
-                                                                        "redirectAttachResource"
-                                                                    )}
-                                                                </SelectItem>
-                                                            </SelectContent>
-                                                        </Select>
-                                                        <FormDescription>
-                                                            {t(
-                                                                "redirectAttachedToDescription"
-                                                            )}
-                                                        </FormDescription>
-                                                        <FormMessage />
-                                                    </FormItem>
-                                                )}
-                                            />
-                                        </SettingsFormCell>
-                                        {attachTo === "domain" ? (
-                                            <SettingsFormCell span="full">
-                                                <FormField
-                                                    control={form.control}
-                                                    name="domainId"
-                                                    render={() => (
-                                                        <FormItem>
-                                                            <DomainPicker
-                                                                orgId={orgId}
-                                                                cols={1}
-                                                                hideFreeDomain
-                                                                defaultDomainId={
-                                                                    redirect?.domainId
-                                                                }
-                                                                allowWildcard
-                                                                defaultSubdomain={
-                                                                    redirect?.subdomain
-                                                                }
-                                                                onDomainChange={(
-                                                                    res
-                                                                ) => {
-                                                                    form.setValue(
-                                                                        "domainId",
-                                                                        res?.domainId ??
-                                                                            null,
-                                                                        {
-                                                                            shouldValidate: true
-                                                                        }
-                                                                    );
-                                                                    form.setValue(
-                                                                        "subdomain",
-                                                                        res?.subdomain ||
-                                                                            null
-                                                                    );
-                                                                }}
-                                                            />
-                                                            <FormMessage />
-                                                        </FormItem>
-                                                    )}
-                                                />
-                                            </SettingsFormCell>
-                                        ) : (
-                                            <SettingsFormCell span="half">
-                                                <FormField
-                                                    control={form.control}
-                                                    name="resourceId"
-                                                    render={({ field }) => (
-                                                        <FormItem className="flex flex-col">
-                                                            <FormLabel>
-                                                                {t(
-                                                                    "selectedRedirectResource"
-                                                                )}
-                                                            </FormLabel>
-                                                            <Popover>
-                                                                <PopoverTrigger
-                                                                    asChild
-                                                                >
-                                                                    <FormControl>
-                                                                        <Button
-                                                                            variant="outline"
-                                                                            role="combobox"
-                                                                            className={cn(
-                                                                                "justify-between",
-                                                                                !field.value &&
-                                                                                    "text-muted-foreground"
-                                                                            )}
-                                                                        >
-                                                                            {selectedResource?.name ??
-                                                                                t(
-                                                                                    "resourceSelect"
-                                                                                )}
-                                                                            <CaretSortIcon className="ml-2 h-4 w-4 shrink-0 opacity-50" />
-                                                                        </Button>
-                                                                    </FormControl>
-                                                                </PopoverTrigger>
-                                                                <PopoverContent className="p-0">
-                                                                    <ResourceSelector
-                                                                        orgId={
-                                                                            orgId
-                                                                        }
-                                                                        selectedResource={
-                                                                            selectedResource
-                                                                        }
-                                                                        onSelectResource={(
-                                                                            resource
-                                                                        ) => {
-                                                                            setSelectedResource(
-                                                                                resource
-                                                                            );
-                                                                            field.onChange(
-                                                                                resource.resourceId
-                                                                            );
-                                                                        }}
-                                                                    />
-                                                                </PopoverContent>
-                                                            </Popover>
-                                                            <FormMessage />
-                                                        </FormItem>
-                                                    )}
-                                                />
-                                            </SettingsFormCell>
-                                        )}
-
-                                        {attachTo === "resource" && (
-                                            <SettingsFormCell span="full">
-                                                <FormItem>
-                                                    <FormLabel>
-                                                        {t("resourceDomain")}
-                                                    </FormLabel>
-                                                    <Input
-                                                        disabled
-                                                        readOnly
-                                                        value={
-                                                            selectedResource?.fullDomain ??
-                                                            ""
-                                                        }
-                                                        placeholder={
-                                                            selectedResource
-                                                                ? t(
-                                                                      "redirectResourceNoDomain"
-                                                                  )
-                                                                : t(
-                                                                      "resourceSelect"
-                                                                  )
-                                                        }
-                                                    />
-                                                </FormItem>
-                                            </SettingsFormCell>
-                                        )}
-                                    </SettingsFormGrid>
-                                </form>
-                            </Form>
-                        </SettingsSectionForm>
-                    </SettingsSectionBody>
-                </SettingsSection>
-
-                <SettingsSection className="pb-10">
-                    <SettingsSectionHeader>
-                        <SettingsSectionTitle>
-                            {t("redirectSettings")}
-                        </SettingsSectionTitle>
-                        <SettingsSectionDescription>
-                            {t("redirectSettingsDescription")}
-                        </SettingsSectionDescription>
-                    </SettingsSectionHeader>
-
-                    <SettingsSectionBody>
-                        <SettingsSectionForm variant="half">
-                            <Form {...form}>
-                                <form onSubmit={form.handleSubmit(onSubmit)}>
-                                    <SettingsFormGrid>
-                                        <SettingsFormCell span="full">
-                                            <FormField
-                                                control={form.control}
-                                                name="destinationDomain"
-                                                render={({ field }) => (
-                                                    <FormItem>
-                                                        <FormLabel>
-                                                            {t(
-                                                                "redirectDestinationDomain"
-                                                            )}
-                                                        </FormLabel>
-                                                        <FormControl>
-                                                            <Input
-                                                                autoComplete="off"
-                                                                placeholder="example.com"
-                                                                {...field}
-                                                            />
-                                                        </FormControl>
-                                                        <FormDescription>
-                                                            {t(
-                                                                "redirectDestinationDomainDescription"
-                                                            )}
-                                                        </FormDescription>
-                                                        <FormMessage />
-                                                    </FormItem>
-                                                )}
-                                            />
-                                        </SettingsFormCell>
-
-                                        <SettingsFormCell span="half">
-                                            <FormField
-                                                control={form.control}
-                                                name="matchPath"
-                                                render={({ field }) => (
-                                                    <FormItem className="flex flex-col">
-                                                        <FormLabel>
-                                                            {t("matchPath")}
-                                                        </FormLabel>
-                                                        <PathMatchModal
-                                                            value={{
-                                                                path: field.value,
-                                                                pathMatchType:
-                                                                    pathMatchType
-                                                            }}
-                                                            onChange={(
-                                                                config
-                                                            ) => {
-                                                                // matchPath and
-                                                                // pathMatchType are
-                                                                // NOT NULL, so a
-                                                                // clear falls back
-                                                                // to the defaults
-                                                                // rather than null.
-                                                                field.onChange(
-                                                                    config.path ||
-                                                                        DEFAULT_MATCH_PATH
-                                                                );
-                                                                form.setValue(
-                                                                    "pathMatchType",
-                                                                    (config.pathMatchType as
-                                                                        | "exact"
-                                                                        | "prefix"
-                                                                        | "regex") ||
-                                                                        DEFAULT_PATH_MATCH_TYPE
-                                                                );
-                                                            }}
-                                                            trigger={
-                                                                <Button
-                                                                    type="button"
-                                                                    variant="outline"
-                                                                    className="flex items-center gap-2 p-2 w-full text-left cursor-pointer"
-                                                                >
-                                                                    <PathMatchDisplay
-                                                                        value={{
-                                                                            path: field.value,
-                                                                            pathMatchType:
-                                                                                pathMatchType
-                                                                        }}
-                                                                    />
-                                                                </Button>
-                                                            }
-                                                        />
-                                                        <FormDescription>
-                                                            {t(
-                                                                "redirectMatchPathDescription"
-                                                            )}
-                                                        </FormDescription>
-                                                        <FormMessage />
-                                                    </FormItem>
-                                                )}
-                                            />
-                                        </SettingsFormCell>
-
-                                        <SettingsFormCell span="half">
-                                            <FormField
-                                                control={form.control}
-                                                name="rewritePath"
-                                                render={({ field }) => (
-                                                    <FormItem className="flex flex-col">
-                                                        <FormLabel>
-                                                            {t("rewritePath")}
-                                                        </FormLabel>
-                                                        <PathRewriteModal
-                                                            value={{
-                                                                rewritePath:
-                                                                    field.value,
-                                                                rewritePathType:
-                                                                    rewritePathType
-                                                            }}
-                                                            onChange={(
-                                                                config
-                                                            ) => {
-                                                                field.onChange(
-                                                                    config.rewritePath ||
-                                                                        null
-                                                                );
-                                                                form.setValue(
-                                                                    "rewritePathType",
-                                                                    (config.rewritePathType as
-                                                                        | "exact"
-                                                                        | "prefix"
-                                                                        | "regex"
-                                                                        | "stripPrefix"
-                                                                        | null) ??
-                                                                        null
-                                                                );
-                                                            }}
-                                                            trigger={
-                                                                hasRewrite ? (
-                                                                    <Button
-                                                                        type="button"
-                                                                        variant="outline"
-                                                                        className="flex items-center gap-2 p-2 w-full text-left cursor-pointer"
-                                                                    >
-                                                                        <PathRewriteDisplay
-                                                                            value={{
-                                                                                rewritePath:
-                                                                                    field.value,
-                                                                                rewritePathType:
-                                                                                    rewritePathType
-                                                                            }}
-                                                                        />
-                                                                    </Button>
-                                                                ) : (
-                                                                    <Button
-                                                                        type="button"
-                                                                        variant="outline"
-                                                                        className="w-full"
-                                                                    >
-                                                                        <Plus className="h-4 w-4 mr-2" />
-                                                                        {t(
-                                                                            "rewritePath"
-                                                                        )}
-                                                                    </Button>
-                                                                )
-                                                            }
-                                                        />
-                                                        <FormDescription>
-                                                            {t(
-                                                                "redirectRewritePathDescription"
-                                                            )}
-                                                        </FormDescription>
-                                                        <FormMessage />
-                                                    </FormItem>
-                                                )}
-                                            />
-                                        </SettingsFormCell>
-
-                                        <SettingsFormCell span="full">
-                                            <FormField
-                                                control={form.control}
-                                                name="permanent"
-                                                render={({ field }) => (
-                                                    <FormItem>
-                                                        <FormControl>
-                                                            <SwitchInput
-                                                                id="redirect-permanent"
-                                                                label={t(
-                                                                    "redirectPermanent"
-                                                                )}
-                                                                description={t(
-                                                                    "redirectPermanentDescription"
-                                                                )}
-                                                                checked={
-                                                                    field.value
-                                                                }
-                                                                onCheckedChange={
-                                                                    field.onChange
-                                                                }
-                                                            />
-                                                        </FormControl>
-                                                        <FormMessage />
-                                                    </FormItem>
-                                                )}
-                                            />
-                                        </SettingsFormCell>
-                                    </SettingsFormGrid>
-                                </form>
-                            </Form>
-                        </SettingsSectionForm>
-                    </SettingsSectionBody>
-                </SettingsSection>
-
-                {isEditing && (
-                    <SettingsSection>
-                        <SettingsSectionHeader>
-                            <SettingsSectionTitle>
-                                {t("dangerSection")}
-                            </SettingsSectionTitle>
-                            <SettingsSectionDescription>
-                                {t("redirectDangerSectionDescription")}
-                            </SettingsSectionDescription>
-                        </SettingsSectionHeader>
-                        <SettingsSectionFooter>
-                            <Button
-                                variant="destructive"
-                                onClick={() => setIsDeleteModalOpen(true)}
-                                loading={deleteLoading}
-                                disabled={deleteLoading}
-                            >
-                                {t("redirectDelete")}
-                            </Button>
-                        </SettingsSectionFooter>
-                    </SettingsSection>
-                )}
-
-                <div className="flex justify-end space-x-2 mt-8">
-                    <Button type="button" variant="outline" asChild>
-                        <Link href={`/${orgId}/settings/redirects`}>
-                            {t("cancel")}
-                        </Link>
-                    </Button>
-                    <Button
-                        type="submit"
-                        form="redirect-form"
-                        loading={saveLoading}
-                        disabled={saveLoading}
-                    >
-                        {isEditing ? t("saveSettings") : t("redirectAdd")}
-                    </Button>
-                </div>
-            </SettingsContainer>
-        </>
-    );
-}

src/components/RedirectsTable.tsx

@@ -1,428 +0,0 @@
-"use client";
-
-import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
-import { Badge } from "@app/components/ui/badge";
-import { Button } from "@app/components/ui/button";
-import {
-    DropdownMenu,
-    DropdownMenuContent,
-    DropdownMenuItem,
-    DropdownMenuTrigger
-} from "@app/components/ui/dropdown-menu";
-import { Switch } from "@app/components/ui/switch";
-import {
-    ControlledDataTable,
-    type ExtendedColumnDef
-} from "@app/components/ui/controlled-data-table";
-import { useEnvContext } from "@app/hooks/useEnvContext";
-import { useNavigationContext } from "@app/hooks/useNavigationContext";
-import { toast } from "@app/hooks/useToast";
-import { createApiClient, formatAxiosError } from "@app/lib/api";
-import type { PaginationState } from "@tanstack/react-table";
-import { ArrowRight, MoreHorizontal } from "lucide-react";
-import { useTranslations } from "next-intl";
-import Link from "next/link";
-import { useRouter } from "next/navigation";
-import { useEffect, useMemo, useState, useTransition } from "react";
-import { useDebouncedCallback } from "use-debounce";
-
-export type RedirectRow = {
-    redirectId: number;
-    niceId: string;
-    name: string;
-    subdomain: string | null;
-    destinationDomain: string;
-    pathMatchType: "exact" | "prefix" | "regex";
-    matchPath: string;
-    rewritePath: string | null;
-    rewritePathType: "exact" | "prefix" | "regex" | "stripPrefix" | null;
-    permanent: boolean;
-    enabled: boolean;
-    resourceId: number | null;
-    resourceName: string | null;
-    resourceNiceId: string | null;
-    resourceFullDomain: string | null;
-    domainId: string | null;
-    baseDomain: string | null;
-};
-
-type RedirectsTableProps = {
-    redirects: RedirectRow[];
-    orgId: string;
-    pagination: PaginationState;
-    rowCount: number;
-};
-
-export default function RedirectsTable({
-    redirects,
-    orgId,
-    pagination,
-    rowCount
-}: RedirectsTableProps) {
-    const router = useRouter();
-    const t = useTranslations();
-    const api = createApiClient(useEnvContext());
-    const {
-        navigate: filter,
-        isNavigating: isFiltering,
-        searchParams
-    } = useNavigationContext();
-
-    const [rows, setRows] = useState(redirects);
-    const [selected, setSelected] = useState<RedirectRow | null>(null);
-    const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
-    const [isRefreshing, startTransition] = useTransition();
-    const [isNavigatingToAddPage, startNavigation] = useTransition();
-
-    useEffect(() => {
-        setRows(redirects);
-    }, [redirects]);
-
-    function refreshData() {
-        startTransition(() => {
-            try {
-                router.refresh();
-            } catch {
-                toast({
-                    title: t("error"),
-                    description: t("refreshError"),
-                    variant: "destructive"
-                });
-            }
-        });
-    }
-
-    const handlePaginationChange = (newPage: PaginationState) => {
-        searchParams.set("page", (newPage.pageIndex + 1).toString());
-        searchParams.set("pageSize", newPage.pageSize.toString());
-        filter({ searchParams });
-    };
-
-    const handleSearchChange = useDebouncedCallback((query: string) => {
-        searchParams.set("query", query);
-        searchParams.delete("page");
-        filter({ searchParams });
-    }, 300);
-
-    function matchTypeLabel(type: RedirectRow["pathMatchType"]) {
-        return {
-            prefix: t("pathMatchPrefix"),
-            exact: t("pathMatchExact"),
-            regex: t("pathMatchRegex")
-        }[type];
-    }
-
-    function rewriteTypeLabel(type: RedirectRow["rewritePathType"]) {
-        if (!type) return "";
-        return {
-            prefix: t("pathRewritePrefix"),
-            exact: t("pathRewriteExact"),
-            regex: t("pathRewriteRegex"),
-            stripPrefix: t("pathRewriteStrip")
-        }[type];
-    }
-
-    async function toggleEnabled(row: RedirectRow, enabled: boolean) {
-        setRows((prev) =>
-            prev.map((r) =>
-                r.redirectId === row.redirectId ? { ...r, enabled } : r
-            )
-        );
-
-        try {
-            await api.post(`/org/${orgId}/redirects/${row.redirectId}`, {
-                enabled
-            });
-            toast({
-                title: t("success"),
-                description: t("redirectUpdated")
-            });
-            router.refresh();
-        } catch (e) {
-            setRows((prev) =>
-                prev.map((r) =>
-                    r.redirectId === row.redirectId
-                        ? { ...r, enabled: row.enabled }
-                        : r
-                )
-            );
-            toast({
-                variant: "destructive",
-                title: t("redirectErrorUpdate"),
-                description: formatAxiosError(e, t("redirectErrorUpdate"))
-            });
-        }
-    }
-
-    function deleteRedirect(row: RedirectRow) {
-        startTransition(async () => {
-            try {
-                await api.delete(`/org/${orgId}/redirects/${row.redirectId}`);
-                setRows((prev) =>
-                    prev.filter((r) => r.redirectId !== row.redirectId)
-                );
-                setIsDeleteModalOpen(false);
-                setSelected(null);
-                toast({
-                    title: t("success"),
-                    description: t("redirectDeleted")
-                });
-                router.refresh();
-            } catch (e) {
-                toast({
-                    variant: "destructive",
-                    title: t("redirectErrorDelete"),
-                    description: formatAxiosError(e, t("redirectErrorDelete"))
-                });
-            }
-        });
-    }
-
-    const columns = useMemo<ExtendedColumnDef<RedirectRow>[]>(
-        () => [
-            {
-                accessorKey: "name",
-                enableHiding: false,
-                header: () => <span className="p-3">{t("name")}</span>,
-                cell: ({ row }) => (
-                    <Link
-                        href={`/${orgId}/settings/redirects/${row.original.niceId}`}
-                        className="hover:underline"
-                    >
-                        {row.original.name}
-                    </Link>
-                )
-            },
-            {
-                id: "source",
-                friendlyName: t("redirectSource"),
-                header: () => (
-                    <span className="p-3">{t("redirectSource")}</span>
-                ),
-                cell: ({ row }) => {
-                    const redirect = row.original;
-                    // A domain-attached redirect may target a specific host
-                    // under the base domain, e.g. old.example.com.
-                    const domainHost = redirect.baseDomain
-                        ? [redirect.subdomain, redirect.baseDomain]
-                              .filter(Boolean)
-                              .join(".")
-                        : null;
-                    const host = redirect.resourceFullDomain ?? domainHost;
-
-                    return (
-                        <div className="flex items-center gap-2">
-                            <Badge variant="secondary" className="shrink-0">
-                                {matchTypeLabel(redirect.pathMatchType)}
-                            </Badge>
-                            <code className="text-sm truncate">
-                                {host ?? ""}
-                                {redirect.matchPath}
-                            </code>
-                        </div>
-                    );
-                }
-            },
-            {
-                id: "attachedTo",
-                friendlyName: t("redirectAttachedTo"),
-                header: () => (
-                    <span className="p-3">{t("redirectAttachedTo")}</span>
-                ),
-                cell: ({ row }) => {
-                    const redirect = row.original;
-
-                    if (redirect.resourceId && redirect.resourceNiceId) {
-                        return (
-                            <Link
-                                href={`/${orgId}/settings/resources/${redirect.resourceNiceId}`}
-                                className="hover:underline"
-                            >
-                                {redirect.resourceName}
-                            </Link>
-                        );
-                    }
-
-                    if (redirect.baseDomain) {
-                        return (
-                            <span>
-                                {[redirect.subdomain, redirect.baseDomain]
-                                    .filter(Boolean)
-                                    .join(".")}
-                            </span>
-                        );
-                    }
-
-                    return <span>-</span>;
-                }
-            },
-            {
-                accessorKey: "destinationDomain",
-                friendlyName: t("redirectDestinationDomain"),
-                header: () => (
-                    <span className="p-3">
-                        {t("redirectDestinationDomain")}
-                    </span>
-                ),
-                cell: ({ row }) => (
-                    <code className="text-sm">
-                        {row.original.destinationDomain}
-                    </code>
-                )
-            },
-            {
-                id: "rewritePath",
-                accessorKey: "rewritePath",
-                friendlyName: t("rewritePath"),
-                header: () => <span className="p-3">{t("rewritePath")}</span>,
-                cell: ({ row }) => {
-                    const redirect = row.original;
-                    const hasRewrite =
-                        Boolean(redirect.rewritePath) ||
-                        redirect.rewritePathType === "stripPrefix";
-
-                    if (!hasRewrite) {
-                        return <span>-</span>;
-                    }
-
-                    return (
-                        <div className="flex items-center gap-2">
-                            <Badge variant="secondary" className="shrink-0">
-                                {rewriteTypeLabel(redirect.rewritePathType)}
-                            </Badge>
-                            <code className="text-sm truncate">
-                                {redirect.rewritePath ?? ""}
-                            </code>
-                        </div>
-                    );
-                }
-            },
-            {
-                accessorKey: "permanent",
-                friendlyName: t("redirectType"),
-                header: () => <span className="p-3">{t("redirectType")}</span>,
-                cell: ({ row }) => (
-                    <Badge variant="secondary">
-                        {row.original.permanent
-                            ? t("redirectTypePermanent")
-                            : t("redirectTypeTemporary")}
-                    </Badge>
-                )
-            },
-            {
-                accessorKey: "enabled",
-                friendlyName: t("enabled"),
-                header: () => <span className="p-3">{t("enabled")}</span>,
-                cell: ({ row }) => (
-                    <Switch
-                        checked={row.original.enabled}
-                        onCheckedChange={(checked) =>
-                            toggleEnabled(row.original, checked)
-                        }
-                    />
-                )
-            },
-            {
-                id: "actions",
-                enableHiding: false,
-                header: () => <span className="p-3" />,
-                cell: ({ row }) => (
-                    <div className="flex items-center gap-2 justify-end">
-                        <DropdownMenu>
-                            <DropdownMenuTrigger asChild>
-                                <Button variant="ghost" className="h-8 w-8 p-0">
-                                    <span className="sr-only">
-                                        {t("openMenu")}
-                                    </span>
-                                    <MoreHorizontal className="h-4 w-4" />
-                                </Button>
-                            </DropdownMenuTrigger>
-                            <DropdownMenuContent align="end">
-                                <DropdownMenuItem asChild>
-                                    <Link
-                                        href={`/${orgId}/settings/redirects/${row.original.niceId}`}
-                                    >
-                                        {t("edit")}
-                                    </Link>
-                                </DropdownMenuItem>
-                                <DropdownMenuItem
-                                    onClick={() => {
-                                        setSelected(row.original);
-                                        setIsDeleteModalOpen(true);
-                                    }}
-                                >
-                                    <span className="text-red-500">
-                                        {t("delete")}
-                                    </span>
-                                </DropdownMenuItem>
-                            </DropdownMenuContent>
-                        </DropdownMenu>
-                        <Link
-                            href={`/${orgId}/settings/redirects/${row.original.niceId}`}
-                        >
-                            <Button variant="outline">
-                                {t("edit")}
-                                <ArrowRight className="ml-2 w-4 h-4" />
-                            </Button>
-                        </Link>
-                    </div>
-                )
-            }
-        ],
-        [orgId, t]
-    );
-
-    return (
-        <>
-            {selected && (
-                <ConfirmDeleteDialog
-                    open={isDeleteModalOpen}
-                    setOpen={(val) => {
-                        setIsDeleteModalOpen(val);
-                        if (!val) {
-                            setSelected(null);
-                        }
-                    }}
-                    dialog={
-                        <div className="space-y-2">
-                            <p>{t("redirectQuestionRemove")}</p>
-                            <p>{t("redirectMessageRemove")}</p>
-                        </div>
-                    }
-                    buttonText={t("redirectDeleteConfirm")}
-                    onConfirm={async () => deleteRedirect(selected)}
-                    string={selected.name}
-                    title={t("redirectDelete")}
-                />
-            )}
-
-            <ControlledDataTable
-                columns={columns}
-                rows={rows}
-                addButtonText={t("redirectAdd")}
-                onAdd={() =>
-                    startNavigation(() =>
-                        router.push(`/${orgId}/settings/redirects/create`)
-                    )
-                }
-                isNavigatingToAddPage={isNavigatingToAddPage}
-                tableId="redirects-table"
-                searchPlaceholder={t("redirectsSearch")}
-                pagination={pagination}
-                onPaginationChange={handlePaginationChange}
-                searchQuery={searchParams.get("query")?.toString()}
-                onSearch={handleSearchChange}
-                onRefresh={refreshData}
-                isRefreshing={isRefreshing || isFiltering}
-                rowCount={rowCount}
-                columnVisibility={{
-                    attachedTo: false,
-                    rewritePath: false
-                }}
-                enableColumnVisibility
-                stickyLeftColumn="name"
-                stickyRightColumn="actions"
-            />
-        </>
-    );
-}

src/components/Settings.tsx

@@ -1,46 +1,23 @@
 import { cn } from "@app/lib/cn";
 
-export function SettingsContainer({
-    children,
-    className
-}: {
-    children: React.ReactNode;
-    className?: string;
-}) {
-    return <div className={cn("space-y-6", className)}>{children}</div>;
+export function SettingsContainer({ children }: { children: React.ReactNode }) {
+    return <div className="space-y-6">{children}</div>;
 }
 
-export function SettingsSection({
-    children,
-    className
-}: {
-    children: React.ReactNode;
-    className?: string;
-}) {
+export function SettingsSection({ children }: { children: React.ReactNode }) {
     return (
-        <div
-            className={cn(
-                "border rounded-lg bg-card p-5 flex flex-col min-h-[200px]",
-                className
-            )}
-        >
+        <div className="border rounded-lg bg-card p-5 flex flex-col min-h-[200px]">
             {children}
         </div>
     );
 }
 
 export function SettingsSectionHeader({
-    children,
-    className
+    children
 }: {
     children: React.ReactNode;
-    className?: string;
 }) {
-    return (
-        <div className={cn("text-lg space-y-0.5 pb-6", className)}>
-            {children}
-        </div>
-    );
+    return <div className="text-lg space-y-0.5 pb-6">{children}</div>;
 }
 
 export function SettingsSectionForm({
@@ -100,7 +77,7 @@ export function SettingsFormCell({
                 "min-w-0",
                 span === "quarter" && "md:col-span-1",
                 span === "half" && "md:col-span-2",
-                span === "full" && "col-span-full",
+                span === "full" && "md:col-span-4",
                 className
             )}
         >
@@ -110,36 +87,23 @@ export function SettingsFormCell({
 }
 
 export function SettingsSectionTitle({
-    children,
-    className
+    children
 }: {
     children: React.ReactNode;
-    className?: string;
 }) {
     return (
-        <h2
-            className={cn(
-                "text-1xl font-semibold tracking-tight flex items-center gap-2",
-                className
-            )}
-        >
+        <h2 className="text-1xl font-semibold tracking-tight flex items-center gap-2">
             {children}
         </h2>
     );
 }
 
 export function SettingsSectionDescription({
-    children,
-    className
+    children
 }: {
     children: React.ReactNode;
-    className?: string;
 }) {
-    return (
-        <p className={cn("text-muted-foreground text-sm", className)}>
-            {children}
-        </p>
-    );
+    return <p className="text-muted-foreground text-sm">{children}</p>;
 }
 
 export function SettingsSubsectionHeader({
@@ -177,15 +141,11 @@ export function SettingsSubsectionDescription({
 }
 
 export function SettingsSectionBody({
-    children,
-    className
+    children
 }: {
     children: React.ReactNode;
-    className?: string;
 }) {
-    return (
-        <div className={cn("space-y-5 flex-grow", className)}>{children}</div>
-    );
+    return <div className="space-y-5 flex-grow">{children}</div>;
 }
 
 export function SettingsSectionFooter({
@@ -209,22 +169,10 @@ export function SettingsSectionFooter({
 
 export function SettingsSectionGrid({
     children,
-    cols = 4,
-    className
+    cols
 }: {
     children: React.ReactNode;
-    cols?: number;
-    className?: string;
+    cols: number;
 }) {
-    return (
-        <div
-            style={{
-                // @ts-expect-error
-                "--cols": `repeat(${cols}, minmax(0, 1fr))`
-            }}
-            className={cn(`grid md:grid-cols-(--cols) gap-6`, className)}
-        >
-            {children}
-        </div>
-    );
+    return <div className={`grid md:grid-cols-${cols} gap-6`}>{children}</div>;
 }

src/lib/pullEnv.ts

@@ -1,3 +1,4 @@
+import { build } from "@server/build";
 import { Env } from "./types/env";
 
 export function pullEnv(): Env {
@@ -34,9 +35,7 @@ export function pullEnv(): Env {
                         : false
             },
             identityProviderMode: process.env.IDENTITY_PROVIDER_MODE as
-                | "org"
-                | "global"
-                | undefined
+                "org" | "global" | undefined
         },
         email: {
             emailEnabled: process.env.EMAIL_ENABLED === "true" ? true : false