Improve cert retreival and new newt combined certs

fix labels dropdown flicker if no changes applied

server/db/pg/schema/schema.ts

@@ -18,7 +18,7 @@ export const domains = pgTable("domains", {
     domainId: varchar("domainId").primaryKey(),
     baseDomain: varchar("baseDomain").notNull(),
     configManaged: boolean("configManaged").notNull().default(false),
-    type: varchar("type").$type<"ns" | "cname" | "wildcard">(),
+    type: varchar("type"), // "ns", "cname", "wildcard"
     verified: boolean("verified").notNull().default(false),
     failed: boolean("failed").notNull().default(false),
     tries: integer("tries").notNull().default(0),

server/db/sqlite/schema/schema.ts

@@ -15,7 +15,7 @@ export const domains = sqliteTable("domains", {
     configManaged: integer("configManaged", { mode: "boolean" })
         .notNull()
         .default(false),
-    type: text("type").$type<"ns" | "cname" | "wildcard">(),
+    type: text("type"), // "ns", "cname", "wildcard"
     verified: integer("verified", { mode: "boolean" }).notNull().default(false),
     failed: integer("failed", { mode: "boolean" }).notNull().default(false),
     tries: integer("tries").notNull().default(0),

server/lib/certificates.ts

@@ -5,6 +5,7 @@ export async function getValidCertificatesForDomains(
     Array<{
         id: number;
         domain: string;
+        queriedDomain: string;
         wildcard: boolean | null;
         certFile: string | null;
         keyFile: string | null;

server/lib/clientVersionChecks.ts

@@ -18,3 +18,19 @@ export function canCompress(
         return false;
     }
 }
+
+// Whether this newt client understands `tlsCertId` references into the
+// sync message's `certs` array, instead of requiring each target to carry
+// its own inline `tlsCert`/`tlsKey` PEM data. Bump the version floor here to
+// match whatever release first ships the newt-side support.
+export function supportsCertReferences(
+    clientVersion: string | null | undefined
+): boolean {
+    try {
+        if (!clientVersion) return false;
+        if (!semver.valid(clientVersion)) return false;
+        return semver.gte(clientVersion, "1.16.0");
+    } catch {
+        return false;
+    }
+}

server/lib/ip.ts

@@ -5,6 +5,7 @@ import config from "@server/lib/config";
 import z from "zod";
 import logger from "@server/logger";
 import semver from "semver";
+import { createHash } from "crypto";
 import { getValidCertificatesForDomains } from "#dynamic/lib/certificates";
 import { lockManager } from "#dynamic/lib/lock";
 
@@ -648,21 +649,101 @@ export type SubnetProxyTargetV2 = {
     httpTargets?: HTTPTarget[];
     tlsCert?: string;
     tlsKey?: string;
+    tlsCertId?: string; // references an entry in the sync message's top-level `certs` array instead of inlining tlsCert/tlsKey
 };
 
+export type CertRef = { id: string; cert: string; key: string };
+
+/**
+ * Replaces each target's inline tlsCert/tlsKey with a tlsCertId reference
+ * into a deduplicated certs array, so that many targets sharing the same
+ * certificate (e.g. a wildcard cert used by thousands of site resources)
+ * only need that certificate sent once per sync message.
+ */
+export function dedupeCertsForTargets(
+    targetsV2: SubnetProxyTargetV2[]
+): { targets: SubnetProxyTargetV2[]; certs: CertRef[] } {
+    const idByContent = new Map<string, string>();
+    const certs: CertRef[] = [];
+
+    const targets = targetsV2.map((target) => {
+        if (!target.tlsCert || !target.tlsKey) {
+            return target;
+        }
+
+        const contentKey = `${target.tlsCert}|${target.tlsKey}`;
+        let id = idByContent.get(contentKey);
+        if (!id) {
+            id = createHash("sha1").update(contentKey).digest("hex").slice(0, 16);
+            idByContent.set(contentKey, id);
+            certs.push({ id, cert: target.tlsCert, key: target.tlsKey });
+        }
+
+        const { tlsCert, tlsKey, ...rest } = target;
+        return { ...rest, tlsCertId: id };
+    });
+
+    return { targets, certs };
+}
+
 export type HTTPTarget = {
     destAddr: string; // must be an IP or hostname
     destPort: number;
     scheme: "http" | "https";
 };
 
+export type CertByDomain = Map<string, { certFile: string; keyFile: string }>;
+
+/**
+ * Fetches the TLS certificates for every enabled, SSL-enabled HTTP site
+ * resource's fullDomain in a single batched call, instead of one call per
+ * resource. Many resources commonly resolve to the very same certificate
+ * (e.g. a wildcard covering the org's domain), so batching turns what would
+ * be N concurrent DB/cache round-trips into one, and a lookup failure fails
+ * loudly for the whole batch rather than silently dropping the cert on a
+ * random subset of otherwise-identical resources under load.
+ */
+export async function batchFetchCertsForSiteResources(
+    allSiteResources: SiteResource[]
+): Promise<CertByDomain> {
+    const domains = new Set(
+        allSiteResources
+            .filter((r) => r.enabled && r.mode === "http" && r.ssl && r.fullDomain)
+            .map((r) => r.fullDomain as string)
+    );
+
+    const certByDomain: CertByDomain = new Map();
+    if (domains.size === 0) {
+        return certByDomain;
+    }
+
+    try {
+        const certResults = await getValidCertificatesForDomains(domains, true);
+        for (const cert of certResults) {
+            if (cert.certFile && cert.keyFile) {
+                certByDomain.set(cert.queriedDomain, {
+                    certFile: cert.certFile,
+                    keyFile: cert.keyFile
+                });
+            }
+        }
+    } catch (err) {
+        logger.error(
+            `Failed to batch-retrieve certificates for ${domains.size} domain(s): ${err}`
+        );
+    }
+
+    return certByDomain;
+}
+
 export async function generateSubnetProxyTargetV2(
     siteResource: SiteResource,
     clients: {
         clientId: number;
         pubKey: string | null;
         subnet: string | null;
-    }[]
+    }[],
+    certByDomain?: CertByDomain
 ): Promise<SubnetProxyTargetV2[] | undefined> {
     if (!siteResource.enabled) {
         logger.debug(
@@ -750,6 +831,22 @@ export async function generateSubnetProxyTargetV2(
         let tlsKey: string | undefined;
 
         if (siteResource.ssl && siteResource.fullDomain) {
+            if (certByDomain) {
+                // Caller batch-fetched certs for all resources up front (the
+                // common, high-scale path) — just look up this resource's
+                // domain rather than issuing its own DB/cache round-trip.
+                const cert = certByDomain.get(siteResource.fullDomain);
+                if (cert) {
+                    tlsCert = cert.certFile;
+                    tlsKey = cert.keyFile;
+                } else {
+                    logger.warn(
+                        `No valid certificate found for SSL site resource ${siteResource.siteResourceId} with domain ${siteResource.fullDomain}`
+                    );
+                }
+            } else {
+                // No batched map supplied by the caller — fall back to a
+                // single-domain lookup for this resource alone.
                 try {
                     const certs = await getValidCertificatesForDomains(
                         new Set([siteResource.fullDomain]),
@@ -769,6 +866,7 @@ export async function generateSubnetProxyTargetV2(
                     );
                 }
             }
+        }
 
         targets.push({
             sourcePrefixes: [],

server/lib/statusHistory.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { db, logsDb, statusHistory } from "@server/db";
-import { and, eq, gte, lt, asc, desc, inArray, max, sql } from "drizzle-orm";
+import { and, eq, gte, lt, asc, desc } from "drizzle-orm";
 import { regionalCache as cache } from "#dynamic/lib/cache";
 
 const STATUS_HISTORY_CACHE_TTL = 60; // seconds
@@ -41,7 +41,6 @@ export async function getCachedStatusHistory(
         return cached;
     }
 
-    console.time(`[getCachedStatusHistory/${entityType}=${entityId}]`);
     // Anchor to local midnight (UTC when tzOffsetMinutes is 0) so the query
     // window aligns with stable calendar days for the requesting client
     const todayMidnightSec = localMidnightSec(tzOffsetMinutes);
@@ -77,14 +76,12 @@ export async function getCachedStatusHistory(
 
     const priorStatus = lastKnownEvent?.status ?? null;
 
-    console.time(`[computeBuckets/${entityType}=${entityId}]`);
     const { buckets, totalDowntime } = computeBuckets(
         events,
         days,
         priorStatus,
         tzOffsetMinutes
     );
-    console.timeEnd(`[computeBuckets/${entityType}=${entityId}]`);
     const totalWindow = days * 86400;
     const overallUptime =
         totalWindow > 0
@@ -99,7 +96,6 @@ export async function getCachedStatusHistory(
         totalDowntimeSeconds: totalDowntime
     };
 
-    console.timeEnd(`[getCachedStatusHistory/${entityType}=${entityId}]`);
     await cache.set(cacheKey, result, STATUS_HISTORY_CACHE_TTL);
     return result;
 }
@@ -268,7 +264,9 @@ export function computeBuckets(
 
         // Shift by the client's offset before formatting so the label reflects
         // their local calendar date rather than the UTC date of dayStartSec
-        const dateStr = new Date((dayStartSec + tzOffsetMinutes * 60) * 1000)
+        const dateStr = new Date(
+            (dayStartSec + tzOffsetMinutes * 60) * 1000
+        )
             .toISOString()
             .slice(0, 10);
 
@@ -303,133 +301,6 @@ export function computeBuckets(
             status
         });
     }
+
     return { buckets, totalDowntime };
 }
-
-export type BatchedStatusHistoryResponse = Record<
-    string,
-    StatusHistoryResponse
->;
-
-export async function getBatchedStatusHistory(
-    entityType: string,
-    entityIds: number[],
-    days: number,
-    tzOffsetMinutes: number = 0
-): Promise<BatchedStatusHistoryResponse> {
-    console.time(
-        `[getBatchedStatusHistory/${entityType}=(${entityIds.join(" ,")})]`
-    );
-
-    // Anchor to local midnight (UTC when tzOffsetMinutes is 0) so the query
-    // window aligns with stable calendar days for the requesting client
-    const todayMidnightSec = localMidnightSec(tzOffsetMinutes);
-    const startSec = todayMidnightSec - days * 86400;
-
-    const events = await logsDb
-        .select()
-        .from(statusHistory)
-        .where(
-            and(
-                eq(statusHistory.entityType, entityType),
-                inArray(statusHistory.entityId, entityIds),
-                gte(statusHistory.timestamp, startSec)
-            )
-        )
-        .orderBy(asc(statusHistory.timestamp));
-
-    // Fetch the last known state before the window so that entities that
-    // haven't changed status recently still show the correct status rather
-    // than appearing as "no_data".
-
-    /**
-     * If we used only postgres, we would have used `SELECT DISTINCT ON` to get the
-     * latest event for each `entityId`,
-     * but it doesn't work on SQLite, so instead we use a subquery,
-     * the `ROW_NUMBER() OVER PARTITION` allows to assign a number
-     * to each row ordered by the timestamp, the number 1 is the first one appearing in
-     * the specified order, then the next and more, we only want the highest timestamp,
-     * so we get for `row_number=1`
-     */
-    const lastKnowEventsSub = logsDb
-        .select({
-            entityId: statusHistory.entityId,
-            status: statusHistory.status,
-            timestamp: statusHistory.timestamp,
-            row_number:
-                sql<number>`ROW_NUMBER() OVER (PARTITION BY ${statusHistory.entityId} ORDER BY ${statusHistory.timestamp} DESC)`.as(
-                    "row_number"
-                )
-        })
-        .from(statusHistory)
-        .where(
-            and(
-                eq(statusHistory.entityType, entityType),
-                inArray(statusHistory.entityId, entityIds),
-                lt(statusHistory.timestamp, startSec)
-            )
-        )
-        .as("sub");
-
-    const lastKnownEvents = await logsDb
-        .select({
-            entityId: lastKnowEventsSub.entityId,
-            status: lastKnowEventsSub.status,
-            timestamp: lastKnowEventsSub.timestamp
-        })
-        .from(lastKnowEventsSub)
-        .where(eq(lastKnowEventsSub.row_number, 1));
-
-    const eventStatusMap: Record<
-        number,
-        {
-            events: typeof events;
-            lastKnownEvent: (typeof lastKnownEvents)[number] | null;
-        }
-    > = {};
-
-    for (const entityId of entityIds) {
-        eventStatusMap[entityId] = {
-            events: events.filter((ev) => ev.entityId === entityId),
-            lastKnownEvent:
-                lastKnownEvents.find((ev) => ev.entityId === entityId) ?? null
-        };
-    }
-
-    const result: BatchedStatusHistoryResponse = {};
-
-    console.time(`[computeBuckets/${entityType}=(${entityIds.join(" ,")})]`);
-    for (const entityId in eventStatusMap) {
-        const event = eventStatusMap[Number(entityId)];
-        const priorStatus = event.lastKnownEvent?.status ?? null;
-
-        const { buckets, totalDowntime } = computeBuckets(
-            event.events,
-            days,
-            priorStatus,
-            tzOffsetMinutes
-        );
-        const totalWindow = days * 86400;
-        const overallUptime =
-            totalWindow > 0
-                ? Math.max(
-                      0,
-                      ((totalWindow - totalDowntime) / totalWindow) * 100
-                  )
-                : 100;
-
-        result[entityId] = {
-            entityType,
-            entityId: Number(entityId),
-            days: buckets,
-            overallUptimePercent: Math.round(overallUptime * 100) / 100,
-            totalDowntimeSeconds: totalDowntime
-        };
-    }
-    console.timeEnd(`[computeBuckets/${entityType}=(${entityIds.join(" ,")})]`);
-
-    console.timeEnd(
-        `[getBatchedStatusHistory/${entityType}=(${entityIds.join(" ,")})]`
-    );
-    return result;
-}

server/private/routers/certificates/getBatchedCertificates.ts

@@ -1,190 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-import { certificates, db, domains, orgDomains } from "@server/db";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { type GetBatchedCertificateResponse } from "@server/routers/certificates/types";
-import HttpCode from "@server/types/HttpCode";
-import { and, eq, inArray, or } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-
-const getCertificateParamSchema = z.strictObject({
-    orgId: z.string()
-});
-
-const getCertificateQuerySchema = z.object({
-    domains: z.preprocess(
-        (val) => {
-            if (val === undefined || val === null || val === "") {
-                return undefined;
-            }
-            if (Array.isArray(val)) {
-                return val;
-            }
-            // the array is returned as this
-            if (typeof val === "string") {
-                return val.split(",");
-            }
-            return undefined;
-        },
-        z.array(z.string().min(1).max(255))
-    )
-});
-
-async function query(orgId: string, domainList: string[]) {
-    // Try to get CNAME certificates first
-    let existingCertificates = await db
-        .select({
-            certId: certificates.certId,
-            domain: certificates.domain,
-            wildcard: certificates.wildcard,
-            status: certificates.status,
-            expiresAt: certificates.expiresAt,
-            lastRenewalAttempt: certificates.lastRenewalAttempt,
-            createdAt: certificates.createdAt,
-            updatedAt: certificates.updatedAt,
-            errorMessage: certificates.errorMessage,
-            renewalCount: certificates.renewalCount,
-            domainId: domains.domainId,
-            domainType: domains.type
-        })
-        .from(certificates)
-        .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-        .innerJoin(
-            orgDomains,
-            and(
-                eq(domains.domainId, orgDomains.domainId),
-                eq(orgDomains.orgId, orgId)
-            )
-        )
-        .where(and(inArray(certificates.domain, domainList)));
-
-    // All non resolved domain certificates might be `ns` or `wildcard`,
-    // which means exact domain certificates do not
-    const nonAvailableCertificates = existingCertificates
-        .filter((cert) => !domainList.includes(cert.domain))
-        .map((cert) => cert.domain);
-
-    if (nonAvailableCertificates.length > 0) {
-        const domainLevelDownSet = new Set<string>();
-        const wildcardDomainSet = new Set<string>();
-
-        for (const domain of nonAvailableCertificates) {
-            const domainLevelDown = domain.split(".").slice(1).join(".");
-            const wildcardPrefixed = `*.${domainLevelDown}`;
-            domainLevelDownSet.add(domainLevelDown);
-            wildcardDomainSet.add(wildcardPrefixed);
-        }
-
-        // Need to map the certificates to each domain
-        const wildcardCertificates = await db
-            .select({
-                certId: certificates.certId,
-                domain: certificates.domain,
-                wildcard: certificates.wildcard,
-                status: certificates.status,
-                expiresAt: certificates.expiresAt,
-                lastRenewalAttempt: certificates.lastRenewalAttempt,
-                createdAt: certificates.createdAt,
-                updatedAt: certificates.updatedAt,
-                errorMessage: certificates.errorMessage,
-                renewalCount: certificates.renewalCount,
-                domainId: domains.domainId,
-                domainType: domains.type
-            })
-            .from(certificates)
-            .innerJoin(domains, eq(certificates.domainId, domains.domainId))
-            .innerJoin(
-                orgDomains,
-                and(
-                    eq(domains.domainId, orgDomains.domainId),
-                    eq(orgDomains.orgId, orgId)
-                )
-            )
-            .where(
-                and(
-                    eq(certificates.wildcard, true),
-                    or(
-                        inArray(certificates.domain, [...domainLevelDownSet]),
-                        inArray(certificates.domain, [...wildcardDomainSet])
-                    )
-                )
-            );
-
-        existingCertificates.push(...wildcardCertificates);
-    }
-
-    const certificateMap: Record<string, any> = {};
-    for (const domain of domainList) {
-        const domainLevelDown = domain.split(".").slice(1).join(".");
-        const wildcardPrefixed = `*.${domainLevelDown}`;
-        certificateMap[domain] =
-            existingCertificates.find(
-                (cert) =>
-                    cert.domain === domain ||
-                    cert.domain === domainLevelDown ||
-                    cert.domain === wildcardPrefixed
-            ) ?? null;
-    }
-
-    return certificateMap;
-}
-
-export async function getBatchedCertificates(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedParams = getCertificateParamSchema.safeParse(req.params);
-        if (!parsedParams.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedParams.error).toString()
-                )
-            );
-        }
-
-        const { orgId } = parsedParams.data;
-        const parsedQuery = getCertificateQuerySchema.safeParse(req.query);
-        if (!parsedQuery.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedQuery.error).toString()
-                )
-            );
-        }
-
-        const { domains } = parsedQuery.data;
-
-        const cert = await query(orgId, domains);
-
-        return response<GetBatchedCertificateResponse>(res, {
-            data: cert,
-            success: true,
-            error: false,
-            message: "Certificates retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/certificates/index.ts

@@ -14,4 +14,3 @@
 export * from "./getCertificate";
 export * from "./restartCertificate";
 export * from "./syncCertToNewts";
-export * from "./getBatchedCertificates";

server/private/routers/certificates/restartCertificate.ts

@@ -11,16 +11,18 @@
  * This file is not licensed under the AGPLv3.
  */
 
-import { certificates, db } from "@server/db";
+import { Request, Response, NextFunction } from "express";
-import response from "@server/lib/response";
-import logger from "@server/logger";
-import { registry } from "@server/openApi";
-import HttpCode from "@server/types/HttpCode";
-import { eq } from "drizzle-orm";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
 import { z } from "zod";
+import { certificates, db } from "@server/db";
+import { sites } from "@server/db";
+import { eq, and } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import stoi from "@server/lib/stoi";
 import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
 
 const restartCertificateParamsSchema = z.strictObject({
     certId: z.coerce.number().int().positive(),

server/private/routers/external.ts

@@ -175,13 +175,6 @@ authenticated.get(
     certificates.getCertificate
 );
 
-authenticated.get(
-    "/org/:orgId/batched-certificates",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.getCertificate),
-    certificates.getBatchedCertificates
-);
-
 authenticated.post(
     "/org/:orgId/certificate/:certId/restart",
     verifyValidLicense,
@@ -860,14 +853,6 @@ authenticated.get(
     healthChecks.getHealthCheckStatusHistory
 );
 
-authenticated.get(
-    "/org/:orgId/health-check-status-histories",
-    verifyValidLicense,
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.getTarget),
-    healthChecks.getBatchedHealthCheckStatusHistory
-);
-
 authenticated.get(
     "/client/:clientId/verify-associations-cache",
     verifyClientAccess,

server/private/routers/healthChecks/getBatchedStatusHistory.ts

@@ -1,96 +0,0 @@
-/*
- * This file is part of a proprietary work.
- *
- * Copyright (c) 2025-2026 Fossorial, Inc.
- * All rights reserved.
- *
- * This file is licensed under the Fossorial Commercial License.
- * You may not use this file except in compliance with the License.
- * Unauthorized use, copying, modification, or distribution is strictly prohibited.
- *
- * This file is not licensed under the AGPLv3.
- */
-
-import response from "@server/lib/response";
-import {
-    getBatchedStatusHistory,
-    type BatchedStatusHistoryResponse
-} from "@server/lib/statusHistory";
-import logger from "@server/logger";
-import HttpCode from "@server/types/HttpCode";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-
-const healthCheckIdParamsSchema = z.object({
-    days: z
-        .string()
-        .optional()
-        .transform((v) => (v ? parseInt(v, 10) : 90)),
-    // Minutes to add to UTC to get the requesting client's local time
-    // (e.g. Australia/Sydney standard time is 600). Optional and
-    // defaults to 0 (UTC) so older clients keep the prior behavior.
-    tzOffsetMinutes: z
-        .string()
-        .optional()
-        .transform((v) => (v ? parseInt(v, 10) : 0)),
-    healthCheckIds: z
-        .preprocess((val) => {
-            if (val === undefined || val === null || val === "") {
-                return undefined;
-            }
-            const raw = Array.isArray(val) ? val : [val];
-            const nums = raw
-                .map((v) =>
-                    typeof v === "string" ? parseInt(v, 10) : Number(v)
-                )
-                .filter((n) => Number.isInteger(n) && n > 0);
-            const unique = [...new Set(nums)];
-            return unique.length ? unique : undefined;
-        }, z.array(z.number().int().positive()))
-        .openapi({
-            description: "Filter by healthCheckIds (repeat query param)"
-        })
-});
-
-export async function getBatchedHealthCheckStatusHistory(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedQuery = healthCheckIdParamsSchema.safeParse(req.query);
-        if (!parsedQuery.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedQuery.error).toString()
-                )
-            );
-        }
-
-        const entityType = "health_check";
-        const { days, healthCheckIds, tzOffsetMinutes } = parsedQuery.data;
-
-        const data = await getBatchedStatusHistory(
-            entityType,
-            healthCheckIds,
-            days,
-            tzOffsetMinutes
-        );
-
-        return response<BatchedStatusHistoryResponse>(res, {
-            data,
-            success: true,
-            error: false,
-            message: "Status history retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/private/routers/healthChecks/index.ts

@@ -16,4 +16,3 @@ export * from "./createHealthCheck";
 export * from "./updateHealthCheck";
 export * from "./deleteHealthCheck";
 export * from "./getStatusHistory";
-export * from "./getBatchedStatusHistory";

server/routers/certificates/types.ts

@@ -1,11 +1,9 @@
-import type { Domain } from "@server/db";
-
 export type GetCertificateResponse = {
     certId: number;
     domain: string;
     domainId: string;
     wildcard: boolean;
-    domainType: Domain["type"];
+    domainType: string;
     status: string; // pending, requested, valid, expired, failed
     expiresAt: string | null;
     lastRenewalAttempt: Date | null;
@@ -14,8 +12,3 @@ export type GetCertificateResponse = {
     errorMessage?: string | null;
     renewalCount: number;
 };
-
-export type GetBatchedCertificateResponse = Record<
-    string,
-    GetCertificateResponse | null
->;

server/routers/external.ts

@@ -319,13 +319,6 @@ authenticated.get(
     site.getSiteStatusHistory
 );
 
-authenticated.get(
-    "/org/:orgId/site-status-histories",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.listSites),
-    site.getBatchedSiteStatusHistory
-);
-
 // Site Resource endpoints
 authenticated.put(
     "/org/:orgId/site-resource",
@@ -476,13 +469,6 @@ authenticated.get(
     resource.getResourceStatusHistory
 );
 
-authenticated.get(
-    "/org/:orgId/resource-status-histories",
-    verifyOrgAccess,
-    verifyUserHasAction(ActionsEnum.listResources),
-    resource.getBatchedResourceStatusHistory
-);
-
 authenticated.get(
     "/org/:orgId/resources",
     verifyOrgAccess,

server/routers/newt/buildConfiguration.ts

@@ -19,6 +19,7 @@ import { eq, and, inArray } from "drizzle-orm";
 import config from "@server/lib/config";
 import { decrypt } from "@server/lib/crypto";
 import {
+    batchFetchCertsForSiteResources,
     formatEndpoint,
     generateSubnetProxyTargetV2,
     SubnetProxyTargetV2
@@ -206,11 +207,18 @@ export async function buildClientConfigurationForNewtClient(
         });
     }
 
+    // Batch-fetch certs for every SSL-enabled HTTP resource's domain in one
+    // call rather than letting each resource fetch its own — with thousands
+    // of resources this avoids a concurrent DB/cache stampede for what is
+    // often the very same (e.g. wildcard) certificate.
+    const certByDomain = await batchFetchCertsForSiteResources(allSiteResources);
+
     const resourceTargetsArr = await Promise.all(
         allSiteResources.map((resource) =>
             generateSubnetProxyTargetV2(
                 resource,
-                clientsByResourceId.get(resource.siteResourceId) ?? []
+                clientsByResourceId.get(resource.siteResourceId) ?? [],
+                certByDomain
             )
         )
     );

server/routers/newt/certs.ts

@@ -0,0 +1,75 @@
+import { sendToClient } from "#dynamic/routers/ws";
+import logger from "@server/logger";
+import {
+    canCompress,
+    supportsCertReferences
+} from "@server/lib/clientVersionChecks";
+import { CertRef } from "@server/lib/ip";
+
+/**
+ * Pushes an incremental set of certs to a newt client outside of a full
+ * newt/sync or newt/wg/receive-config, e.g. after a certificate renewal so
+ * that every target referencing it (by tlsCertId) picks up the new material
+ * without waiting for the next full resync.
+ */
+export async function sendCertsAdd(
+    newtId: string,
+    certs: CertRef[],
+    version?: string | null
+) {
+    if (certs.length === 0) {
+        return;
+    }
+
+    if (!supportsCertReferences(version)) {
+        logger.debug(
+            `Newt ${newtId} (version ${version}) does not support cert references, skipping certs/add`
+        );
+        return;
+    }
+
+    await sendToClient(
+        newtId,
+        {
+            type: "newt/certs/add",
+            data: certs
+        },
+        {
+            incrementConfigVersion: true,
+            compress: canCompress(version, "newt")
+        }
+    );
+}
+
+/**
+ * Tells a newt client to drop the given cert IDs, e.g. once the server knows
+ * no target references them anymore.
+ */
+export async function sendCertsRemove(
+    newtId: string,
+    certIds: string[],
+    version?: string | null
+) {
+    if (certIds.length === 0) {
+        return;
+    }
+
+    if (!supportsCertReferences(version)) {
+        logger.debug(
+            `Newt ${newtId} (version ${version}) does not support cert references, skipping certs/remove`
+        );
+        return;
+    }
+
+    await sendToClient(
+        newtId,
+        {
+            type: "newt/certs/remove",
+            data: { ids: certIds }
+        },
+        {
+            incrementConfigVersion: true,
+            compress: canCompress(version, "newt")
+        }
+    );
+}

server/routers/newt/handleNewtGetConfigMessage.ts

@@ -7,7 +7,11 @@ import { eq } from "drizzle-orm";
 import { sendToExitNode } from "#dynamic/lib/exitNodes";
 import { buildClientConfigurationForNewtClient } from "./buildConfiguration";
 import { convertTargetsIfNecessary } from "../client/targets";
-import { canCompress } from "@server/lib/clientVersionChecks";
+import {
+    canCompress,
+    supportsCertReferences
+} from "@server/lib/clientVersionChecks";
+import { dedupeCertsForTargets } from "@server/lib/ip";
 import config from "@server/lib/config";
 import { waitForSiteRebuildIdle } from "@server/lib/rebuildClientAssociations";
 
@@ -119,7 +123,16 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
         exitNode
     );
 
-    const targetsToSend = await convertTargetsIfNecessary(newt.newtId, targets); // for backward compatibility with old newt versions that don't support the new target format
+    // Older newt clients only understand inline tlsCert/tlsKey on each
+    // target, so only switch to certId references once we know the client
+    // can resolve them.
+    let dedupedTargets = targets;
+    let certs: { id: string; cert: string; key: string }[] = [];
+    if (supportsCertReferences(newt.version)) {
+        ({ targets: dedupedTargets, certs } = dedupeCertsForTargets(targets));
+    }
+
+    const targetsToSend = await convertTargetsIfNecessary(newt.newtId, dedupedTargets); // for backward compatibility with old newt versions that don't support the new target format
 
     return {
         message: {
@@ -128,6 +141,7 @@ export const handleNewtGetConfigMessage: MessageHandler = async (context) => {
                 ipAddress: site.address,
                 peers,
                 targets: targetsToSend,
+                certs,
                 chainId: chainId
             }
         },

server/routers/newt/sync.ts

@@ -6,7 +6,11 @@ import {
     buildClientConfigurationForNewtClient,
     buildTargetConfigurationForNewtClient
 } from "./buildConfiguration";
-import { canCompress } from "@server/lib/clientVersionChecks";
+import {
+    canCompress,
+    supportsCertReferences
+} from "@server/lib/clientVersionChecks";
+import { dedupeCertsForTargets } from "@server/lib/ip";
 
 export async function sendNewtSyncMessage(newt: Newt, site: Site) {
     const {
@@ -28,6 +32,16 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
         site,
         exitNode
     );
+
+    // Older newt clients only understand inline tlsCert/tlsKey on each
+    // target, so only switch to certId references once we know the client
+    // can resolve them.
+    let clientTargets = targets;
+    let certs: { id: string; cert: string; key: string }[] = [];
+    if (supportsCertReferences(newt.version)) {
+        ({ targets: clientTargets, certs } = dedupeCertsForTargets(targets));
+    }
+
     await sendToClient(
         newt.newtId,
         {
@@ -39,7 +53,8 @@ export async function sendNewtSyncMessage(newt: Newt, site: Site) {
                 },
                 healthCheckTargets: validHealthCheckTargets,
                 peers: peers,
-                clientTargets: targets,
+                clientTargets: clientTargets,
+                certs: certs,
                 browserGatewayTargets: browserGatewayTargets,
                 remoteExitNodeSubnets: remoteExitNodeSubnets
             }

server/routers/resource/getBatchedStatusHistory.ts

@@ -1,83 +0,0 @@
-import response from "@server/lib/response";
-import {
-    getBatchedStatusHistory,
-    type BatchedStatusHistoryResponse
-} from "@server/lib/statusHistory";
-import logger from "@server/logger";
-import HttpCode from "@server/types/HttpCode";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-
-const resourceIdParamsSchema = z.object({
-    days: z
-        .string()
-        .optional()
-        .transform((v) => (v ? parseInt(v, 10) : 90)),
-    // Minutes to add to UTC to get the requesting client's local time
-    // (e.g. Australia/Sydney standard time is 600). Optional and
-    // defaults to 0 (UTC) so older clients keep the prior behavior.
-    tzOffsetMinutes: z
-        .string()
-        .optional()
-        .transform((v) => (v ? parseInt(v, 10) : 0)),
-    resourceIds: z
-        .preprocess((val) => {
-            if (val === undefined || val === null || val === "") {
-                return undefined;
-            }
-            const raw = Array.isArray(val) ? val : [val];
-            const nums = raw
-                .map((v) =>
-                    typeof v === "string" ? parseInt(v, 10) : Number(v)
-                )
-                .filter((n) => Number.isInteger(n) && n > 0);
-            const unique = [...new Set(nums)];
-            return unique.length ? unique : undefined;
-        }, z.array(z.number().int().positive()))
-        .openapi({
-            description: "Filter by resourceIds (repeat query param)"
-        })
-});
-
-export async function getBatchedResourceStatusHistory(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedQuery = resourceIdParamsSchema.safeParse(req.query);
-        if (!parsedQuery.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedQuery.error).toString()
-                )
-            );
-        }
-
-        const entityType = "resource";
-        const { days, resourceIds, tzOffsetMinutes } = parsedQuery.data;
-
-        const data = await getBatchedStatusHistory(
-            entityType,
-            resourceIds,
-            days,
-            tzOffsetMinutes
-        );
-
-        return response<BatchedStatusHistoryResponse>(res, {
-            data,
-            success: true,
-            error: false,
-            message: "Status history retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/resource/index.ts

@@ -33,5 +33,4 @@ export * from "./removeUserFromResource";
 export * from "./listAllResourceNames";
 export * from "./removeEmailFromResourceWhitelist";
 export * from "./getStatusHistory";
-export * from "./getBatchedStatusHistory";
 export * from "./getResourcePolicies";

server/routers/site/getBatchedStatusHistory.ts

@@ -1,83 +0,0 @@
-import response from "@server/lib/response";
-import {
-    getBatchedStatusHistory,
-    type BatchedStatusHistoryResponse
-} from "@server/lib/statusHistory";
-import logger from "@server/logger";
-import HttpCode from "@server/types/HttpCode";
-import { NextFunction, Request, Response } from "express";
-import createHttpError from "http-errors";
-import { z } from "zod";
-import { fromError } from "zod-validation-error";
-
-const siteIdParamsSchema = z.object({
-    days: z
-        .string()
-        .optional()
-        .transform((v) => (v ? parseInt(v, 10) : 90)),
-    // Minutes to add to UTC to get the requesting client's local time
-    // (e.g. Australia/Sydney standard time is 600). Optional and
-    // defaults to 0 (UTC) so older clients keep the prior behavior.
-    tzOffsetMinutes: z
-        .string()
-        .optional()
-        .transform((v) => (v ? parseInt(v, 10) : 0)),
-    siteIds: z
-        .preprocess((val) => {
-            if (val === undefined || val === null || val === "") {
-                return undefined;
-            }
-            const raw = Array.isArray(val) ? val : [val];
-            const nums = raw
-                .map((v) =>
-                    typeof v === "string" ? parseInt(v, 10) : Number(v)
-                )
-                .filter((n) => Number.isInteger(n) && n > 0);
-            const unique = [...new Set(nums)];
-            return unique.length ? unique : undefined;
-        }, z.array(z.number().int().positive()))
-        .openapi({
-            description: "Filter by siteIds (repeat query param)"
-        })
-});
-
-export async function getBatchedSiteStatusHistory(
-    req: Request,
-    res: Response,
-    next: NextFunction
-): Promise<any> {
-    try {
-        const parsedQuery = siteIdParamsSchema.safeParse(req.query);
-        if (!parsedQuery.success) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    fromError(parsedQuery.error).toString()
-                )
-            );
-        }
-
-        const entityType = "site";
-        const { days, siteIds, tzOffsetMinutes } = parsedQuery.data;
-
-        const data = await getBatchedStatusHistory(
-            entityType,
-            siteIds,
-            days,
-            tzOffsetMinutes
-        );
-
-        return response<BatchedStatusHistoryResponse>(res, {
-            data,
-            success: true,
-            error: false,
-            message: "Status history retrieved successfully",
-            status: HttpCode.OK
-        });
-    } catch (error) {
-        logger.error(error);
-        return next(
-            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
-        );
-    }
-}

server/routers/site/index.ts

@@ -1,6 +1,5 @@
 export * from "./getSite";
 export * from "./getStatusHistory";
-export * from "./getBatchedStatusHistory";
 export * from "./createSite";
 export * from "./deleteSite";
 export * from "./updateSite";

src/components/HealthChecksTable.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { UptimeMiniBar } from "@app/components/UptimeMiniBar";
+import UptimeMiniBar from "@app/components/UptimeMiniBar";
 
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
 import HealthCheckCredenza, {
@@ -51,8 +51,6 @@ import { usePaidStatus } from "@app/hooks/usePaidStatus";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { cn } from "@app/lib/cn";
 import { dataTableFilterPopoverContentClassName } from "@app/lib/dataTableFilterPopover";
-import { orgQueries } from "@app/lib/queries";
-import { useQuery } from "@tanstack/react-query";
 
 type StandaloneHealthChecksTableProps = {
     orgId: string;
@@ -83,8 +81,6 @@ function formatTarget(row: HealthCheckRow): string {
     return `${scheme}://${host}${port}${path}`;
 }
 
-const HEALTH_CHECK_STATUS_HISTORY_DAYS = 30;
-
 export default function HealthChecksTable({
     orgId,
     healthChecks,
@@ -161,20 +157,6 @@ export default function HealthChecksTable({
 
     const rows = healthChecks;
 
-    const healthCheckIds = useMemo(
-        () => rows.map((r) => r.targetHealthCheckId),
-        [rows]
-    );
-
-    const statusHistoryQuery = useQuery({
-        ...orgQueries.batchedHealthCheckStatusHistory({
-            orgId,
-            healthCheckIds,
-            days: HEALTH_CHECK_STATUS_HISTORY_DAYS
-        }),
-        enabled: healthCheckIds.length > 0
-    });
-
     function refreshList() {
         startRefresh(() => {
             router.refresh();
@@ -565,13 +547,9 @@ export default function HealthChecksTable({
             cell: ({ row }) => {
                 return (
                     <UptimeMiniBar
-                        isLoading={statusHistoryQuery.isLoading}
+                        orgId={orgId}
-                        data={
+                        healthCheckId={row.original.targetHealthCheckId}
-                            statusHistoryQuery.data?.[
+                        days={30}
-                                row.original.targetHealthCheckId
-                            ]
-                        }
-                        days={HEALTH_CHECK_STATUS_HISTORY_DAYS}
                     />
                 );
             }

src/components/PublicResourcesTable.tsx

@@ -31,13 +31,10 @@ import { toast } from "@app/hooks/useToast";
 import { createApiClient, formatAxiosError } from "@app/lib/api";
 import { cn } from "@app/lib/cn";
 import { dataTableFilterPopoverContentClassName } from "@app/lib/dataTableFilterPopover";
-import { durationToMs } from "@app/lib/durationToMs";
-import { orgQueries } from "@app/lib/queries";
 import { getNextSortOrder, getSortDirection } from "@app/lib/sortColumn";
 import { build } from "@server/build";
 import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import { UpdateResourceResponse } from "@server/routers/resource";
-import { useQuery } from "@tanstack/react-query";
 import type { PaginationState } from "@tanstack/react-table";
 import { AxiosResponse } from "axios";
 import {
@@ -72,7 +69,7 @@ import { useDebouncedCallback } from "use-debounce";
 import z from "zod";
 import { ColumnFilterButton } from "./ColumnFilterButton";
 import { ControlledDataTable } from "./ui/controlled-data-table";
-import { UptimeMiniBar } from "./UptimeMiniBar";
+import UptimeMiniBar from "./UptimeMiniBar";
 import { type SelectedLabel } from "./labels-selector";
 import { LabelColumnFilterButton } from "./LabelColumnFilterButton";
 import { useLocalLabels } from "@app/hooks/useLocalLabels";
@@ -130,8 +127,6 @@ const booleanSearchFilterSchema = z
     .optional()
     .catch(undefined);
 
-const RESOURCE_STATUS_HISTORY_DAYS = 30;
-
 export default function PublicResourcesTable({
     resources,
     orgId,
@@ -160,35 +155,6 @@ export default function PublicResourcesTable({
     const [isRefreshing, startTransition] = useTransition();
     const [isNavigatingToAddPage, startNavigation] = useTransition();
 
-    // Only http resources show an uptime bar, so don't ask for the others
-    const statusHistoryResourceIds = useMemo(
-        () => resources.filter((r) => r.mode === "http").map((r) => r.id),
-        [resources]
-    );
-
-    // Domain list
-    const resourceDomains = useMemo(
-        () => resources.map((r) => r.fullDomain).filter(Boolean) as string[],
-        [resources]
-    );
-
-    const statusHistoryQuery = useQuery({
-        ...orgQueries.batchedResourceStatusHistory({
-            orgId,
-            resourceIds: statusHistoryResourceIds,
-            days: RESOURCE_STATUS_HISTORY_DAYS
-        }),
-        enabled: statusHistoryResourceIds.length > 0
-    });
-
-    const domainCertificatesQuery = useQuery({
-        ...orgQueries.batchedDomainCertificates({
-            orgId,
-            domains: resourceDomains
-        }),
-        enabled: resourceDomains.length > 0
-    });
-
     const refreshData = () => {
         startTransition(() => {
             try {
@@ -441,11 +407,7 @@ export default function PublicResourcesTable({
                         return <span>-</span>;
                     }
                     return (
-                        <UptimeMiniBar
+                        <UptimeMiniBar resourceId={resourceRow.id} days={30} />
-                            isLoading={statusHistoryQuery.isLoading}
-                            data={statusHistoryQuery.data?.[resourceRow.id]}
-                            days={RESOURCE_STATUS_HISTORY_DAYS}
-                        />
                     );
                 }
             },
@@ -663,13 +625,7 @@ export default function PublicResourcesTable({
         ];
 
         return cols;
-    }, [
+    }, [orgId, t, searchParams]);
-        orgId,
-        t,
-        searchParams,
-        statusHistoryQuery.data,
-        statusHistoryQuery.isLoading
-    ]);
 
     function handleFilterChange(
         column: string,

src/components/ResourceAccessCertIndicator.tsx

@@ -22,7 +22,6 @@ type ResourceAccessCertIndicatorProps = {
     orgId: string;
     domainId: string;
     fullDomain: string;
-    initialCertValue?: any;
 };
 
 function getStatusColor(status: string) {

src/components/SitesTable.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import ConfirmDeleteDialog from "@app/components/ConfirmDeleteDialog";
-import { UptimeMiniBar } from "@app/components/UptimeMiniBar";
+import UptimeMiniBar from "@app/components/UptimeMiniBar";
 
 import {
     Credenza,
@@ -52,12 +52,12 @@ import {
 } from "./ui/controlled-data-table";
 
 import { useOptimisticLabels } from "@app/hooks/useOptimisticLabels";
-import { durationToMs } from "@app/lib/durationToMs";
+import { usePaidStatus } from "@app/hooks/usePaidStatus";
-import { orgQueries, productUpdatesQueries } from "@app/lib/queries";
-import { useQuery } from "@tanstack/react-query";
-import semver from "semver";
 import { LabelColumnFilterButton } from "./LabelColumnFilterButton";
 import { LabelsTableCell } from "./LabelsTableCell";
+import { useQuery } from "@tanstack/react-query";
+import { productUpdatesQueries } from "@app/lib/queries";
+import semver from "semver";
 
 export type SiteRow = {
     id: number;
@@ -89,8 +89,6 @@ type SitesTableProps = {
     rowCount: number;
 };
 
-const SITE_STATUS_HISTORY_DAYS = 30;
-
 export default function SitesTable({
     sites,
     orgId,
@@ -114,16 +112,7 @@ export default function SitesTable({
     const [isRefreshing, startTransition] = useTransition();
     const [isNavigatingToAddPage, startNavigation] = useTransition();
 
-    const siteIds = sites.map((s) => s.id);
+    const { isPaidUser } = usePaidStatus();
-
-    const statusHistoryQuery = useQuery({
-        ...orgQueries.batchedSiteStatusHistory({
-            orgId,
-            siteIds,
-            days: SITE_STATUS_HISTORY_DAYS
-        }),
-        enabled: siteIds.length > 0
-    });
 
     const api = createApiClient(useEnvContext());
     const t = useTranslations();
@@ -307,14 +296,7 @@ export default function SitesTable({
                     if (originalRow.type == "local") {
                         return <span>-</span>;
                     }
-                    const data = statusHistoryQuery.data?.[row.original.id];
+                    return <UptimeMiniBar siteId={originalRow.id} days={30} />;
-                    return (
-                        <UptimeMiniBar
-                            isLoading={statusHistoryQuery.isLoading}
-                            data={data}
-                            days={SITE_STATUS_HISTORY_DAYS}
-                        />
-                    );
                 }
             },
             {
@@ -377,11 +359,14 @@ export default function SitesTable({
                 cell: ({ row }) => {
                     const originalRow = row.original;
 
-                    const updateAvailable = Boolean(
+                    let updateAvailable = Boolean(
                         latestNewtVersion &&
                             originalRow.newtVersion &&
                             semver.valid(originalRow.newtVersion) &&
-                        semver.lt(originalRow.newtVersion, latestNewtVersion)
+                            semver.lt(
+                                originalRow.newtVersion,
+                                latestNewtVersion
+                            )
                     );
 
                     if (originalRow.type === "newt") {

src/components/UptimeMiniBar.tsx

@@ -1,14 +1,15 @@
 "use client";
 
+import { useQuery } from "@tanstack/react-query";
+import { orgQueries } from "@app/lib/queries";
 import {
     Tooltip,
     TooltipContent,
     TooltipTrigger
 } from "@app/components/ui/tooltip";
+import { useEnvContext } from "@app/hooks/useEnvContext";
+import { createApiClient } from "@app/lib/api";
 import { cn } from "@app/lib/cn";
-import { orgQueries } from "@app/lib/queries";
-import type { StatusHistoryResponse } from "@server/lib/statusHistory";
-import { useQuery } from "@tanstack/react-query";
 import { useTranslations } from "next-intl";
 
 function formatDuration(seconds: number): string {
@@ -45,16 +46,21 @@ type UptimeMiniBarProps = {
     days?: number;
 };
 
-export default function UptimeMiniBarWrapper({
+export default function UptimeMiniBar({
     orgId,
     siteId,
     resourceId,
     healthCheckId,
     days = 30
 }: UptimeMiniBarProps) {
+    const t = useTranslations();
+    const api = createApiClient(useEnvContext());
+
     const siteQuery = useQuery({
         ...orgQueries.siteStatusHistory({ siteId: siteId ?? 0, days }),
-        enabled: siteId != null
+        enabled: siteId != null,
+        meta: { api },
+        staleTime: 5 * 60 * 1000
     });
 
     const hcQuery = useQuery({
@@ -63,12 +69,16 @@ export default function UptimeMiniBarWrapper({
             healthCheckId: healthCheckId ?? 0,
             days
         }),
-        enabled: healthCheckId != null && siteId == null && resourceId == null
+        enabled: healthCheckId != null && siteId == null && resourceId == null,
+        meta: { api },
+        staleTime: 5 * 60 * 1000
     });
 
     const resourceQuery = useQuery({
         ...orgQueries.resourceStatusHistory({ resourceId, days }),
-        enabled: resourceId != null && siteId == null && healthCheckId == null
+        enabled: resourceId != null && siteId == null && healthCheckId == null,
+        meta: { api },
+        staleTime: 5 * 60 * 1000
     });
 
     const { data, isLoading } =
@@ -78,22 +88,6 @@ export default function UptimeMiniBarWrapper({
               ? resourceQuery
               : hcQuery;
 
-    return <UptimeMiniBar data={data} isLoading={isLoading} days={days} />;
-}
-
-type UptimeMiniBarUIProps = {
-    data?: StatusHistoryResponse;
-    isLoading?: boolean;
-    days?: number;
-};
-
-export function UptimeMiniBar({
-    data,
-    isLoading,
-    days = 30
-}: UptimeMiniBarUIProps) {
-    const t = useTranslations();
-
     if (isLoading) {
         return (
             <div className="flex items-center gap-2">
@@ -144,8 +138,7 @@ export function UptimeMiniBar({
                                 {formatDate(day.date)}
                             </div>
                             <div className="text-xs text-primary-foreground/80">
-                                {day.status === "no_data" ||
+                                {day.status === "no_data" || day.status === "unknown"
-                                day.status === "unknown"
                                     ? t("uptimeNoData")
                                     : `${day.uptimePercent.toFixed(1)}% ${t("uptimeSuffix")}`}
                             </div>

src/hooks/useCertificate.ts

@@ -5,8 +5,6 @@ import { AxiosResponse } from "axios";
 import { GetCertificateResponse } from "@server/routers/certificates/types";
 import { createApiClient } from "@app/lib/api";
 import { useEnvContext } from "@app/hooks/useEnvContext";
-import { useQuery } from "@tanstack/react-query";
-import { domainQueries } from "@app/lib/queries";
 
 type UseCertificateProps = {
     orgId: string;
@@ -15,7 +13,6 @@ type UseCertificateProps = {
     autoFetch?: boolean;
     polling?: boolean;
     pollingInterval?: number;
-    initialCertValue?: GetCertificateResponse | null;
 };
 
 type UseCertificateReturn = {
@@ -25,63 +22,51 @@ type UseCertificateReturn = {
     refreshing: boolean;
     fetchCert: (showLoading?: boolean) => Promise<void>;
     refreshCert: () => Promise<void>;
-    // clearCert: () => void;
+    clearCert: () => void;
 };
 
 export function useCertificate({
     orgId,
     domainId,
     fullDomain,
-    initialCertValue = null,
     autoFetch = true,
     polling = false,
     pollingInterval = 5000
 }: UseCertificateProps): UseCertificateReturn {
     const api = createApiClient(useEnvContext());
 
-    // const [cert, setCert] = useState<GetCertificateResponse | null>(
+    const [cert, setCert] = useState<GetCertificateResponse | null>(null);
-    //     initialCertValue
+    const [certLoading, setCertLoading] = useState(false);
-    // );
-    // const [certLoading, setCertLoading] = useState(false);
     const [certError, setCertError] = useState<string | null>(null);
     const [refreshing, setRefreshing] = useState(false);
 
-    const query = useQuery({
+    const fetchCert = useCallback(
-        ...domainQueries.getCertificate({
+        async (showLoading = true) => {
-            orgId,
+            if (!orgId || !domainId || !fullDomain) return;
-            domainId,
-            domain: fullDomain
-        }),
-        initialData: initialCertValue
-    });
 
-    // const fetchCert = useCallback(
+            if (showLoading) {
-    //     async (showLoading = true) => {
+                setCertLoading(true);
-    //         if (!orgId || !domainId || !fullDomain) return;
+            }
-
+            try {
-    //         if (showLoading) {
+                const res = await api.get<
-    //             setCertLoading(true);
+                    AxiosResponse<GetCertificateResponse>
-    //         }
+                >(`/org/${orgId}/certificate/${domainId}/${fullDomain}`);
-    //         try {
+                const certData = res.data.data;
-    //             const res = await api.get<
+                if (certData) {
-    //                 AxiosResponse<GetCertificateResponse>
+                    setCertError(null);
-    //             >(`/org/${orgId}/certificate/${domainId}/${fullDomain}`);
+                    setCert(certData);
-    //             const certData = res.data.data;
+                }
-    //             if (certData) {
+            } catch (error: any) {
-    //                 setCertError(null);
+                console.error("Failed to fetch certificate:", error);
-    //                 setCert(certData);
+                setCertError("Failed");
-    //             }
+            } finally {
-    //         } catch (error: any) {
+                if (showLoading) {
-    //             console.error("Failed to fetch certificate:", error);
+                    setCertLoading(false);
-    //             setCertError("Failed");
+                }
-    //         } finally {
+            }
-    //             if (showLoading) {
+        },
-    //                 setCertLoading(false);
+        [api, orgId, domainId, fullDomain]
-    //             }
+    );
-    //         }
-    //     },
-    //     [api, orgId, domainId, fullDomain]
-    // );
 
     const refreshCert = useCallback(async () => {
         if (!cert) return;
@@ -111,11 +96,11 @@ export function useCertificate({
     }, []);
 
     // Auto-fetch on mount if enabled
-    // useEffect(() => {
+    useEffect(() => {
-    //     if (autoFetch && orgId && domainId && fullDomain) {
+        if (autoFetch && orgId && domainId && fullDomain) {
-    //         fetchCert();
+            fetchCert();
-    //     }
+        }
-    // }, [autoFetch, orgId, domainId, fullDomain, fetchCert]);
+    }, [autoFetch, orgId, domainId, fullDomain, fetchCert]);
 
     useEffect(() => {
         if (!polling || !orgId || !domainId || !fullDomain) return;
@@ -147,12 +132,12 @@ export function useCertificate({
     }, [polling, orgId, domainId, fullDomain, pollingInterval, fetchCert]);
 
     return {
-        cert: query.data,
+        cert,
-        certLoading: query.isLoading,
+        certLoading,
         certError,
         refreshing,
-        fetchCert: query.refetch,
+        fetchCert,
-        refreshCert
+        refreshCert,
-        // clearCert
+        clearCert
     };
 }

src/hooks/useOptimisticLabels.ts

@@ -95,7 +95,10 @@ export function useOptimisticLabels({
     }
 
     async function refresh() {
+        // Only refresh if the labels have been modified
+        if (pendingActions.length > 0) {
             router.refresh();
+        }
         setPendingActions([]);
     }
 

src/lib/queries.ts

@@ -47,10 +47,7 @@ import { remote } from "./api";
 import { durationToMs } from "./durationToMs";
 import type { ListOrgLabelsResponse } from "@server/routers/labels/types";
 import { ListHealthChecksResponse } from "@server/routers/healthChecks/types";
-import {
+import { StatusHistoryResponse } from "@server/lib/statusHistory";
-    StatusHistoryResponse,
-    type BatchedStatusHistoryResponse
-} from "@server/lib/statusHistory";
 import type { ListResourcePoliciesResponse } from "@server/routers/resource/types";
 import type { GetResourcePolicyResponse } from "@server/routers/policy";
 import type {
@@ -69,7 +66,6 @@ import type { GetResourceAuthInfoResponse } from "@server/routers/resource/getRe
 import type { GetSiteResourceResponse } from "@server/routers/siteResource/getSiteResource";
 import type { LauncherQueryFilters } from "@app/lib/launcherSearchParams";
 import { buildLauncherSearchParams } from "@app/lib/launcherSearchParams";
-import type { GetCertificateResponse } from "@server/routers/certificates/types";
 
 export type { LauncherQueryFilters } from "@app/lib/launcherSearchParams";
 export { buildLauncherSearchParams } from "@app/lib/launcherSearchParams";
@@ -644,143 +640,6 @@ export const orgQueries = {
                 };
             }
         }),
-    batchedSiteStatusHistory: ({
-        siteIds,
-        orgId,
-        days = 90
-    }: {
-        orgId: string;
-        siteIds: number[];
-        days?: number;
-    }) =>
-        queryOptions({
-            queryKey: [
-                "ORG",
-                orgId,
-                "BATCHED_SITE_STATUS_HISTORY",
-                siteIds,
-                days
-            ] as const,
-            queryFn: async ({ signal, meta }) => {
-                // Negated because getTimezoneOffset() returns UTC - local,
-                // while the API expects minutes to add to UTC to get local
-                const tzOffsetMinutes = -new Date().getTimezoneOffset();
-                const sp = new URLSearchParams([
-                    ["days", days.toString()],
-                    ["tzOffsetMinutes", tzOffsetMinutes.toString()],
-                    ...siteIds.map((id) => ["siteIds", id.toString()])
-                ]);
-
-                const res = await meta!.api.get<
-                    AxiosResponse<BatchedStatusHistoryResponse>
-                >(`/org/${orgId}/site-status-histories?${sp.toString()}`, {
-                    signal
-                });
-                return res.data.data;
-            },
-            staleTime: durationToMs(5, "seconds")
-        }),
-    batchedHealthCheckStatusHistory: ({
-        healthCheckIds,
-        orgId,
-        days = 90
-    }: {
-        orgId: string;
-        healthCheckIds: number[];
-        days?: number;
-    }) =>
-        queryOptions({
-            queryKey: [
-                "ORG",
-                orgId,
-                "BATCHED_HEALTH_CHECK_STATUS_HISTORY",
-                healthCheckIds,
-                days
-            ] as const,
-            queryFn: async ({ signal, meta }) => {
-                // Negated because getTimezoneOffset() returns UTC - local,
-                // while the API expects minutes to add to UTC to get local
-                const tzOffsetMinutes = -new Date().getTimezoneOffset();
-                const sp = new URLSearchParams([
-                    ["days", days.toString()],
-                    ["tzOffsetMinutes", tzOffsetMinutes.toString()],
-                    ...healthCheckIds.map((id) => [
-                        "healthCheckIds",
-                        id.toString()
-                    ])
-                ]);
-
-                const res = await meta!.api.get<
-                    AxiosResponse<BatchedStatusHistoryResponse>
-                >(
-                    `/org/${orgId}/health-check-status-histories?${sp.toString()}`,
-                    { signal }
-                );
-                return res.data.data;
-            },
-            staleTime: durationToMs(5, "seconds")
-        }),
-    batchedDomainCertificates: ({
-        domains,
-        orgId
-    }: {
-        orgId: string;
-        domains: string[];
-    }) =>
-        queryOptions({
-            queryKey: ["ORG", orgId, "BATCHED_CERTIFICATES", domains] as const,
-            queryFn: async ({ signal, meta }) => {
-                // Negated because getTimezoneOffset() returns UTC - local,
-                // while the API expects minutes to add to UTC to get local
-                const sp = new URLSearchParams([
-                    ...domains.map((domain) => ["domains", domain.toString()])
-                ]);
-
-                const res = await meta!.api.get<
-                    AxiosResponse<BatchedStatusHistoryResponse>
-                >(`/org/${orgId}/batched-certificates?${sp.toString()}`, {
-                    signal
-                });
-                return res.data.data;
-            },
-            staleTime: durationToMs(5, "seconds")
-        }),
-    batchedResourceStatusHistory: ({
-        resourceIds,
-        orgId,
-        days = 90
-    }: {
-        orgId: string;
-        resourceIds: number[];
-        days?: number;
-    }) =>
-        queryOptions({
-            queryKey: [
-                "ORG",
-                orgId,
-                "BATCHED_RESOURCE_STATUS_HISTORY",
-                resourceIds,
-                days
-            ] as const,
-            queryFn: async ({ signal, meta }) => {
-                // Negated because getTimezoneOffset() returns UTC - local,
-                // while the API expects minutes to add to UTC to get local
-                const tzOffsetMinutes = -new Date().getTimezoneOffset();
-                const sp = new URLSearchParams([
-                    ["days", days.toString()],
-                    ["tzOffsetMinutes", tzOffsetMinutes.toString()],
-                    ...resourceIds.map((id) => ["resourceIds", id.toString()])
-                ]);
-
-                const res = await meta!.api.get<
-                    AxiosResponse<BatchedStatusHistoryResponse>
-                >(`/org/${orgId}/resource-status-histories?${sp.toString()}`, {
-                    signal
-                });
-                return res.data.data;
-            },
-            staleTime: durationToMs(5, "seconds")
-        }),
     siteStatusHistory: ({
         siteId,
         days = 90
@@ -790,7 +649,6 @@ export const orgQueries = {
     }) =>
         queryOptions({
             queryKey: ["SITE_STATUS_HISTORY", siteId, days] as const,
-            staleTime: durationToMs(5, "seconds"),
             queryFn: async ({ signal, meta }) => {
                 const tzOffsetMinutes = -new Date().getTimezoneOffset();
                 const res = await meta!.api.get<
@@ -812,7 +670,6 @@ export const orgQueries = {
     }) =>
         queryOptions({
             queryKey: ["RESOURCE_STATUS_HISTORY", resourceId, days] as const,
-            staleTime: durationToMs(5, "seconds"),
             queryFn: async ({ signal, meta }) => {
                 const tzOffsetMinutes = -new Date().getTimezoneOffset();
                 const res = await meta!.api.get<
@@ -835,7 +692,6 @@ export const orgQueries = {
         days?: number;
     }) =>
         queryOptions({
-            staleTime: durationToMs(5, "seconds"),
             queryKey: [
                 "HC_STATUS_HISTORY",
                 orgId,
@@ -1381,34 +1237,6 @@ export const approvalQueries = {
 };
 
 export const domainQueries = {
-    getCertificate: ({
-        orgId,
-        domainId,
-        domain
-    }: {
-        orgId: string;
-        domainId: string;
-        domain: string;
-    }) =>
-        queryOptions({
-            queryKey: [
-                "ORG",
-                orgId,
-                "DOMAIN",
-                domainId,
-                "CERTIFICATE"
-            ] as const,
-            queryFn: async ({ signal, meta }) => {
-                const res = await meta!.api.get<
-                    AxiosResponse<GetCertificateResponse | null>
-                >(`/org/${orgId}/certificate/${domainId}/${domain}`, {
-                    signal
-                });
-                if (res.status === 404) return null;
-                return res.data.data;
-            },
-            staleTime: durationToMs(1, "minutes")
-        }),
     getDomain: ({ orgId, domainId }: { orgId: string; domainId: string }) =>
         queryOptions({
             queryKey: ["ORG", orgId, "DOMAIN", domainId] as const,