Handle a failed peer fetch, blocked storage and an unvalidated VNC port

Surfaces the two bundle parameters added to the management API: an
anonymization level (Default/Strict, shown when anonymization is enabled)
and an optional upload service URL that overrides the default upload
server. The upload URL is validated as an https URL before the job can be
submitted; both fields are omitted from the request when left at their
defaults so the peer applies its own.

.eslintrc.json

@@ -1,13 +0,0 @@
-{
-  "extends": ["next/core-web-vitals","prettier"],
-  "plugins": ["simple-import-sort"],
-  "rules": {
-    "simple-import-sort/imports": [
-      "warn",
-      {
-        "groups": [["^\\u0000", "^@?\\w", "^[^.]", "^\\."]]
-      }
-    ],
-    "simple-import-sort/exports": "warn"
-  }
-}

.github/workflows/build_and_push.yml

@@ -39,7 +39,7 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           repository: netbirdio/IronRDP
-          latest: true
+          tag: v0.0.2
           fileName: "*.ts"
           out-file-path: 'public/ironrdp-pkg'
 
@@ -48,7 +48,7 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           repository: netbirdio/IronRDP
-          latest: true
+          tag: v0.0.2
           fileName: "*.js"
           out-file-path: 'public/ironrdp-pkg'
 
@@ -57,7 +57,7 @@ jobs:
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           repository: netbirdio/IronRDP
-          latest: true
+          tag: v0.0.2
           fileName: "ironrdp_web_bg.wasm"
           out-file-path: 'public/ironrdp-pkg'
 
@@ -99,12 +99,14 @@ jobs:
             type=sha
 
       - name: Log in to Docker Hub
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.NB_DOCKER_USER }}
           password: ${{ secrets.NB_DOCKER_TOKEN }}
 
       - name: Log in to the GitHub Container registry
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -116,11 +118,12 @@ jobs:
         with:
           context: .
           file: docker/Dockerfile
-          push: true
+          push: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
           platforms: linux/amd64,linux/arm64,linux/arm
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
-      - run: |
+      - if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        run: |
           echo '### Pushed tags' >> $GITHUB_STEP_SUMMARY
           echo '${{ steps.meta.outputs.tags }}' >> $GITHUB_STEP_SUMMARY

.github/workflows/bump-netbird.yml

@@ -0,0 +1,81 @@
+name: Bump netbird wasm client
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'NetBird release tag (e.g. v0.78.0)'
+        required: true
+        type: string
+
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.tag }}
+  cancel-in-progress: false
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          token: ${{ secrets.NETBIRD_DEV_BOT_GITHUB_TOKEN }}
+
+      - name: Configure git
+        run: |
+          git config --global user.email "dev@netbird.io"
+          git config --global user.name "netbirddev"
+
+      # The tag rides in env and is validated before use, so a crafted dispatch
+      # input cannot expand into shell source or reach the sed expression.
+      - name: Update the default wasm path
+        id: bump
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Refusing tag '$TAG': expected vMAJOR.MINOR.PATCH"
+            exit 1
+          fi
+
+          sed -i "s|https://pkgs.netbird.io/wasm/client/v[0-9.]*|https://pkgs.netbird.io/wasm/client/${TAG}|" src/utils/config.ts
+
+          branch="bump-netbird-wasm-${TAG#v}"
+          echo "branch=${branch}" >> "$GITHUB_OUTPUT"
+
+          # The branch name is derived from the tag, so a re-dispatch of the
+          # same release would collide with the branch and pull request an
+          # earlier run left behind.
+          if git ls-remote --exit-code --heads origin "${branch}" >/dev/null 2>&1; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Branch ${branch} already exists, ${TAG} was handled by an earlier run"
+            exit 0
+          fi
+
+          git checkout -b "${branch}"
+          git add src/utils/config.ts
+          if git diff --cached --quiet; then
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            echo "Default wasm path already at ${TAG}, nothing to do"
+            exit 0
+          fi
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+          git commit -m "Bump the WASM client to ${TAG}"
+          git push --set-upstream origin "${branch}"
+
+      - name: Create pull request
+        if: steps.bump.outputs.skip != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.NETBIRD_DEV_BOT_GITHUB_TOKEN }}
+          TAG: ${{ inputs.tag }}
+          BRANCH: ${{ steps.bump.outputs.branch }}
+        run: |
+          gh pr create \
+            --base main \
+            --head "$BRANCH" \
+            --title "Bump the WASM client to ${TAG}" \
+            --body "Automated wasm path bump triggered by netbird release ${TAG}."

.github/workflows/e2e-test.yml

@@ -101,17 +101,61 @@ jobs:
           echo "Using reverse-proxy tag: $TAG"
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
-      - name: Setup test environment
+      - name: Restore geolocation database cache
+        id: geo-cache
+        uses: actions/cache/restore@v4
+        with:
+          path: e2e/environment/geo-cache
+          key: geolite-dbs-v1
+
+      - name: Build dashboard and set up test environment
         env:
           MANAGEMENT_IMAGE_TAG: ${{ steps.management_tag.outputs.tag }}
           REVERSE_PROXY_IMAGE_TAG: ${{ steps.reverse_proxy_tag.outputs.tag }}
-        run: cd ./e2e/environment && bash create-test-env.sh
+        # The docker environment (image pulls, Zitadel bootstrap) is
+        # network-bound and the Next build is CPU-bound, so they overlap.
+        # The build reads .test-config.json via the @/config/test alias,
+        # and create-test-env.sh renders that file only after the Zitadel
+        # bootstrap — so the build waits for it before starting.
+        run: |
+          (cd ./e2e/environment && bash create-test-env.sh) > env-setup.log 2>&1 &
+          ENV_PID=$!
+          until [ -s .test-config.json ] && jq empty .test-config.json 2>/dev/null; do
+            if ! kill -0 "$ENV_PID" 2>/dev/null; then break; fi
+            sleep 2
+          done
+          if ! [ -s .test-config.json ]; then
+            echo "::error::create-test-env.sh exited before rendering .test-config.json"
+            cat env-setup.log
+            exit 1
+          fi
+          # Lowest CPU priority: the containers must win the scheduler, or
+          # the build can starve management past the proxy-registration wait.
+          if ! nice -n 19 env APP_ENV=test npx next build; then
+            kill "$ENV_PID" 2>/dev/null || true
+            exit 1
+          fi
+          if ! wait "$ENV_PID"; then
+            echo "::error::Test environment setup failed"
+            cat env-setup.log
+            exit 1
+          fi
+          cat env-setup.log
+
+      # Saved right after env setup rather than in a post step, so a later
+      # test failure doesn't lose the cache.
+      - name: Save geolocation database cache
+        if: always() && steps.geo-cache.outputs.cache-hit != 'true' && hashFiles('e2e/environment/geo-cache/**') != ''
+        uses: actions/cache/save@v4
+        with:
+          path: e2e/environment/geo-cache
+          key: geolite-dbs-v1
 
       - name: Run Playwright tests
         id: playwright
         run: |
           set -o pipefail
-          npm run test:ci 2>&1 | tee playwright-output.log
+          npx playwright test --config=e2e/playwright.config.ts 2>&1 | tee playwright-output.log
 
       - name: Append Playwright summary to job summary
         if: always() && hashFiles('e2e/test-results/results.json') != ''

.github/workflows/sync-deploy-templates.yml

@@ -0,0 +1,34 @@
+name: Sync deploy templates to S3
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "templates/reverse-proxy/**"
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.DEPLOY_TEMPLATES_ROLE_ARN }}
+          aws-region: eu-central-1
+
+      - name: Validate CloudFormation template
+        run: |
+          aws cloudformation validate-template \
+            --template-body file://templates/reverse-proxy/netbird-proxy-cfn.yaml
+
+      - name: Upload CloudFormation template
+        run: |
+          aws s3 cp templates/reverse-proxy/netbird-proxy-cfn.yaml \
+            s3://netbird-deploy-templates/templates/netbird-proxy-cfn.yaml

.github/workflows/test-cloud-deploy.yml

@@ -0,0 +1,78 @@
+name: Test cloud deploy config
+
+on:
+  pull_request:
+    paths:
+      - "docker/init_react_envs.sh"
+      - "templates/reverse-proxy/**"
+      - "src/modules/reverse-proxy/clusters/ClusterCloudDeploy.tsx"
+      - ".github/workflows/test-cloud-deploy.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  csp-connect-src:
+    name: CSP allows cloud provider APIs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install nginx
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y nginx gettext-base
+
+      - name: Prepare nginx layout expected by the init script
+        run: |
+          sudo mkdir -p /etc/nginx/http.d /usr/share/nginx/html
+          echo 'add_header Content-Security-Policy "placeholder" always;' | sudo tee /etc/nginx/http.d/default.conf
+          sudo touch /usr/share/nginx/html/OidcTrustedDomains.js.tmpl
+          sudo systemctl start nginx
+
+      - name: Run init script with production-like env
+        env:
+          AUTH_AUTHORITY: https://auth.example.com
+          AUTH_CLIENT_ID: test-client
+          AUTH_AUDIENCE: test-audience
+          AUTH_SUPPORTED_SCOPES: openid profile email
+          USE_AUTH0: "false"
+          NETBIRD_MGMT_API_ENDPOINT: https://api.example.com
+        run: sudo -E bash docker/init_react_envs.sh
+
+      - name: Assert provider APIs are in connect-src
+        run: |
+          CSP=$(grep -o 'Content-Security-Policy "[^"]*"' /etc/nginx/http.d/default.conf)
+          echo "Generated CSP: $CSP"
+          CONNECT_SRC=$(echo "$CSP" | sed 's/.*connect-src \([^;]*\);.*/\1/')
+          echo "connect-src: $CONNECT_SRC"
+          status=0
+          for origin in https://api.hetzner.cloud https://api.digitalocean.com; do
+            if echo "$CONNECT_SRC" | grep -qF "$origin"; then
+              echo "OK: $origin"
+            else
+              echo "MISSING in connect-src: $origin"
+              status=1
+            fi
+          done
+          exit $status
+
+  cfn-template-url:
+    name: CloudFormation template URL is live
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Extract template URL from component and check it
+        run: |
+          URL=$(grep -o 'https://[^"]*netbird-proxy-cfn\.yaml' src/modules/reverse-proxy/clusters/ClusterCloudDeploy.tsx)
+          echo "CFN_TEMPLATE_URL: $URL"
+          test -n "$URL"
+          # Non-blocking: the template is published by sync-deploy-templates on
+          # the default branch, so it may not exist yet for a PR that only edits
+          # the URL. Warn instead of failing the check.
+          if curl -sfI "$URL" >/dev/null; then
+            echo "OK: template URL is live"
+          else
+            echo "::warning::CloudFormation template URL is not reachable yet: $URL"
+          fi

.github/workflows/unit-tests.yml

@@ -0,0 +1,32 @@
+name: Unit Tests
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+# Cancel superseded runs on the same ref so a new push doesn't queue behind an
+# outdated one (mirrors build_and_push.yml).
+concurrency:
+  group: unit-tests-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  vitest:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: setup-node
+        uses: actions/setup-node@v5
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run unit tests
+        run: npm run test:unit

.gitignore

@@ -44,6 +44,7 @@ e2e/test-results/
 e2e/playwright-report/
 /test-results/
 /playwright-report/
+playwright-report*.zip
 .configs/.local-config.zitadel.json
 .configs/.staging-config.json
 .configs/.temp-config.json

announcements.json

@@ -1,8 +1,8 @@
 [
   {
-    "tag": "Preview",
-    "text": "The new NetBird desktop app is here - now available as a 0.75 release candidate.",
-    "link": "https://github.com/netbirdio/netbird/discussions/6483",
+    "tag": "New",
+    "text": "The new NetBird desktop app is here - now available in the v0.75 release.",
+    "link": "https://netbird.io/knowledge-hub/netbird-v0-75-new-desktop-app",
     "linkText": "Learn more",
     "variant": "important",
     "isExternal": true,

docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.14
+FROM alpine:3.24
 
 RUN apk add --no-cache bash curl less ca-certificates git tzdata zip gettext \
     nginx curl supervisor certbot-nginx && \

docker/init_react_envs.sh

@@ -80,7 +80,7 @@ echo "NetBird latest version: ${NETBIRD_LATEST_VERSION}"
 FIRST_PARTY_CSP="pkgs.netbird.io"
 FIRST_PARTY_CSP_CONNECT_SRC="wss://*.netbird.io"
 THIRD_PARTY_CSP="*.licdn.com *.linkedin.com *.vector.co *.sibforms.com *.hotjar.com *.hotjar.io *.redditstatic.com pixel-config.reddit.com *.clarity.ms c.bing.com *.microsoft.com googleads.g.doubleclick.net pagead2.googlesyndication.com www.google.com www.googleadservices.com *.google-analytics.com *.googletagmanager.com analytics.google.com *.hubapi.com *.hs-banner.com *.hubspot.com *.hubspot.net js.hs-analytics.com *.hsforms.net *.hscollectedforms.net *.hs-analytics.net *.hsforms.com track.hubspot.com *.hsadspixel.net static.hsappstatic.net"
-THIRD_PARTY_CSP_CONNECT_SRC="https://api.github.com/repos/netbirdio/netbird/releases/latest https://raw.githubusercontent.com/netbirdio/dashboard/ wss://ws.hotjar.com"
+THIRD_PARTY_CSP_CONNECT_SRC="https://api.github.com/repos/netbirdio/netbird/releases/latest https://raw.githubusercontent.com/netbirdio/dashboard/ wss://ws.hotjar.com https://api.hetzner.cloud https://api.digitalocean.com"
 THIRD_PARTY_CSP_SCRIPT_SRC="'sha256-7knV6EIjKUvCpYWE2rCYx8dYV2WCNb2bpTuitFXzBcA=' *.hs-scripts.com"
 
 CSP_DOMAINS=""
@@ -141,8 +141,18 @@ CSP_CONNECT_SRC=$(echo $CSP_CONNECT_SRC | tr ' ' '\n' | sort -u | tr '\n' ' ' |
 CSP_FRAME_SRC=$(echo $CSP_FRAME_SRC | tr ' ' '\n' | sort -u | tr '\n' ' ' | sed 's/ $//')
 CSP_SCRIPT_SRC=$(echo $CSP_SCRIPT_SRC | tr ' ' '\n' | sort -u | tr '\n' ' ' | sed 's/ $//')
 
+# upgrade-insecure-requests tells the browser to rewrite every http subresource,
+# fetch and WebSocket to https/wss. That is correct for https deployments but breaks
+# plain-http ones (e.g. local or self-hosted over http), where it would rewrite the
+# working http/ws endpoints to unreachable https/wss. Emit it only when the backend
+# is served over https, matching the ws:// vs wss:// scheme logic above.
+CSP_UPGRADE_INSECURE=" upgrade-insecure-requests;"
+if [[ "$NETBIRD_MGMT_API_ENDPOINT" == http://* || "$AUTH_AUTHORITY" == http://* ]]; then
+    CSP_UPGRADE_INSECURE=""
+fi
+
 # Update CSP in nginx config
-CSP_POLICY="default-src 'none'; connect-src 'self' $CSP_CONNECT_SRC; frame-src 'self' $CSP_FRAME_SRC; script-src 'self' 'wasm-unsafe-eval' $CSP_SCRIPT_SRC; font-src 'self'; img-src * data:; manifest-src 'self'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests;"
+CSP_POLICY="default-src 'none'; connect-src 'self' $CSP_CONNECT_SRC; frame-src 'self' $CSP_FRAME_SRC; script-src 'self' 'wasm-unsafe-eval' $CSP_SCRIPT_SRC; font-src 'self'; img-src * data:; manifest-src 'self'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; base-uri 'self'; form-action 'self';$CSP_UPGRADE_INSECURE"
 CSP_HEADER="add_header Content-Security-Policy \"$CSP_POLICY\" always;"
 
 echo "CSP header: $CSP_HEADER"
@@ -161,4 +171,25 @@ for f in $(grep -R -l AUTH_SUPPORTED_SCOPES /usr/share/nginx/html); do
     cp "$f" "$f".copy
     envsubst "$ENV_STR" < "$f".copy > "$f"
     rm "$f".copy
-done
+done
+
+# Reload nginx so the patched CSP header takes effect.
+# supervisord starts nginx (priority 100) before this script (priority 201) and
+# never reloads it, so without this nginx keeps serving the static default.conf
+# CSP that has no connect-src, breaking OIDC discovery over plain HTTP.
+reloaded=false
+for i in $(seq 1 10); do
+    if nginx -s reload 2>/dev/null; then
+        echo "Reloaded nginx to apply updated CSP configuration"
+        reloaded=true
+        break
+    fi
+    echo "Waiting for nginx to be ready before reload (attempt $i)..."
+    sleep 1
+done
+
+if [[ "$reloaded" != true ]]; then
+    echo "Failed to reload nginx after patching CSP header" >&2
+    nginx -t || true
+    exit 1
+fi

e2e/CLAUDE.md

@@ -218,6 +218,7 @@ await visitByNavigation(page, "Policies");         // Click child
 | Notifications | `settings-notifications-email.spec.ts`, `settings-notifications-slack.spec.ts`, `settings-notifications-webhook.spec.ts` | `@notifications` |
 | Team | `team-users.spec.ts`, `team-service-users.spec.ts`, `team-users-approval-and-billing.spec.ts` | `@team` |
 | Setup Keys | `setup-keys.spec.ts` | `@setup-keys` |
+| Control Center | `control-center-*.spec.ts` (`-draft`, `-draft-connections`, `-draft-matrix`, `-draft-extras`, `-draft-install`, `-draft-remove`, `-draft-shortcuts`, `-deploy`, `-drilldown`, `-live`, `-peers`) | `@control-center` |
 
 ## Debugging
 

e2e/environment/.gitignore

@@ -1,6 +1,7 @@
 # Ignore zitadel environment
 .env
 Caddyfile
+agentgateway-stub.Caddyfile
 management.json
 turnserver.conf
 zitadel.env
@@ -9,4 +10,6 @@ proxy-no-ports.env
 proxy-certs/
 proxy-certs-no-ports/
 docker-compose.yml
-/machinekey
+/machinekey
+geo-cache/
+geo-dump/

e2e/environment/clean-test-env.sh

@@ -19,7 +19,7 @@ check_docker_compose() {
 DOCKER_COMPOSE_COMMAND=$(check_docker_compose)
 
 $DOCKER_COMPOSE_COMMAND down --volumes
-rm -f docker-compose.yml Caddyfile zitadel.env .env dashboard.env machinekey/zitadel-admin-sa.token turnserver.conf management.json proxy.env proxy-no-ports.env
+rm -f docker-compose.yml Caddyfile agentgateway-stub.Caddyfile zitadel.env .env dashboard.env machinekey/zitadel-admin-sa.token turnserver.conf management.json proxy.env proxy-no-ports.env
 rm -rf proxy-certs proxy-certs-no-ports
 rm -f ../../.test-config.json ../playwright.env.json
 rm -f ../fixtures/auth/owner.json ../fixtures/auth/user.json

e2e/environment/create-test-env.sh

@@ -61,7 +61,13 @@ wait_proxy_cluster() {
   SERVICE_NAME=${1:-reverse-proxy}
   echo -n "Waiting for $SERVICE_NAME to register with management "
   set +e
-  local attempts=60
+  # 480s: management downloads its geolocation databases on first boot
+  # (the proxy specs need /locations/countries, so it cannot be disabled
+  # there), and a slow pkgs.netbird.io can stall that well past the old
+  # 120s budget. The proxies skip their download entirely via
+  # NB_PROXY_DISABLE_GEOLOCATION. The loop exits as soon as the sync
+  # lands, so healthy runs pay nothing.
+  local attempts=240
   local i
   for ((i = 1; i <= attempts; i++)); do
     if $DOCKER_COMPOSE_COMMAND logs "$SERVICE_NAME" 2>&1 | grep -q "Initial mapping sync complete"; then
@@ -526,7 +532,7 @@ initEnvironment() {
     echo "Generated files already exist, if you want to reinitialize the environment, please remove them first."
     echo "You can use the following commands:"
     echo "  $DOCKER_COMPOSE_COMMAND down --volumes # to remove all containers and volumes"
-    echo "  rm -f docker-compose.yml Caddyfile zitadel.env dashboard.env machinekey/zitadel-admin-sa.token turnserver.conf management.json proxy.env proxy-no-ports.env && rm -rf proxy-certs proxy-certs-no-ports"
+    echo "  rm -f docker-compose.yml Caddyfile agentgateway-stub.Caddyfile zitadel.env dashboard.env machinekey/zitadel-admin-sa.token turnserver.conf management.json proxy.env proxy-no-ports.env && rm -rf proxy-certs proxy-certs-no-ports"
     echo "Be aware that this will remove all data from the database, and you will have to reconfigure the dashboard."
     exit 1
   fi
@@ -534,6 +540,7 @@ initEnvironment() {
   echo Rendering initial files...
   renderDockerCompose > docker-compose.yml
   renderCaddyfile > Caddyfile
+  renderAgentGatewayStub > agentgateway-stub.Caddyfile
   renderZitadelEnv > zitadel.env
   echo "" > turnserver.conf
   echo "" > management.json
@@ -589,6 +596,8 @@ initEnvironment() {
   echo -e "\nCreating proxy access tokens...\n"
   init_proxy_tokens
 
+  exportGeoDatabases
+
   echo -e "\nStarting reverse proxy services...\n"
   $DOCKER_COMPOSE_COMMAND up -d reverse-proxy reverse-proxy-no-ports
 
@@ -604,6 +613,30 @@ initEnvironment() {
   echo "Password: $ZITADEL_ADMIN_PASSWORD" | tee -a .env
 }
 
+# Saving an Agent Network provider makes management call the upstream and
+# refuses the save unless it answers a model listing, so a provider spec needs
+# a reachable OpenAI-compatible endpoint. agentgateway is self-hosted and has
+# no public one; this stub stands in for it, inside the compose network where
+# management can reach it and without depending on a vendor being up.
+renderAgentGatewayStub() {
+  cat <<'EOF'
+{
+	admin off
+	auto_https off
+}
+
+:8088 {
+	handle /v1/models {
+		header Content-Type application/json
+		respond `{"object":"list","data":[{"id":"agentgateway-e2e-model","object":"model","owned_by":"netbird-e2e"}]}` 200
+	}
+	handle {
+		respond 404
+	}
+}
+EOF
+}
+
 renderCaddyfile() {
   cat <<EOF
 {
@@ -760,7 +793,41 @@ ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE=$ZIDATE_TOKEN_EXPIRATION_DA
 EOF
 }
 
+# Copies management's geolocation databases out of its data volume into
+# ./geo-cache so CI can cache them across runs. Management has finished
+# loading them by the time its API serves requests. A no-op when the
+# cache already holds both files, and never fatal: a failed export just
+# means the next run downloads again.
+exportGeoDatabases() {
+  mkdir -p geo-cache
+  if compgen -G "geo-cache/GeoLite2-City_*.mmdb" > /dev/null \
+    && compgen -G "geo-cache/geonames_*.db" > /dev/null; then
+    return
+  fi
+  echo -e "\nExporting geolocation databases for caching...\n"
+  rm -rf geo-dump
+  if $DOCKER_COMPOSE_COMMAND cp management:/var/lib/netbird ./geo-dump; then
+    cp geo-dump/GeoLite2-City_*.mmdb geo-dump/geonames_*.db geo-cache/ 2>/dev/null \
+      || echo "WARN: no geolocation databases found in management data dir"
+    rm -rf geo-dump
+  else
+    echo "WARN: could not copy management data dir; geolocation databases not cached"
+  fi
+}
+
 renderDockerCompose() {
+  # Cached geolocation databases (restored by CI into ./geo-cache) are
+  # mounted into management's data dir so it skips the slow first-boot
+  # download from pkgs.netbird.io. With no cache the mounts are omitted
+  # and management downloads as before.
+  local geo_mounts=""
+  local f
+  for f in geo-cache/GeoLite2-City_*.mmdb geo-cache/geonames_*.db; do
+    [ -f "$f" ] || continue
+    geo_mounts+="
+      - ./${f}:/var/lib/netbird/$(basename "$f")"
+  done
+
   cat <<EOF
 version: "3.4"
 services:
@@ -776,6 +843,15 @@ services:
     volumes:
       - netbird_caddy_data:/data
       - ./Caddyfile:/etc/caddy/Caddyfile
+  # Stand-in upstream for the Agent Network provider specs: answers the model
+  # listing management probes before it accepts a provider save. Reachable
+  # only from inside the compose network, at http://agentgateway-stub:8088.
+  agentgateway-stub:
+    image: caddy
+    restart: unless-stopped
+    networks: [ netbird ]
+    volumes:
+      - ./agentgateway-stub.Caddyfile:/etc/caddy/Caddyfile
   # Management
   management:
     image: ghcr.io/netbirdio/management-cloud:${MANAGEMENT_IMAGE_TAG}
@@ -794,7 +870,7 @@ services:
      - NB_TRAFFIC_FLOW_INTERVAL=20s
      - NB_SINGLE_INSTANCE_MODE=true
     volumes:
-      - netbird_management:/var/lib/netbird
+      - netbird_management:/var/lib/netbird${geo_mounts}
       - ./management.json:/etc/netbird/management.json
     command: [
       "--port", "80",
@@ -845,6 +921,11 @@ services:
     networks: [netbird]
     env_file:
       - ./proxy.env
+    environment:
+      # No spec exercises country-based enforcement, and skipping the
+      # GeoLite2 download removes a startup stall of up to 2 minutes
+      # when pkgs.netbird.io is slow.
+      - NB_PROXY_DISABLE_GEOLOCATION=true
     volumes:
       - ./proxy-certs:/certs:ro
     command: [
@@ -866,6 +947,9 @@ services:
     networks: [netbird]
     env_file:
       - ./proxy-no-ports.env
+    environment:
+      # See the primary proxy: no spec needs geo enforcement.
+      - NB_PROXY_DISABLE_GEOLOCATION=true
     volumes:
       # Distinct cert dir so this proxy has a distinct identity from the
       # primary proxy; a shared cert makes both register under the same

e2e/helpers/auth.ts

@@ -20,7 +20,11 @@ const credentials: Record<TestUser, { username: string; password: string }> = {
 /**
  * Navigate to the app, authenticate via Zitadel, and wait for the app to load.
  */
-export async function loginToApp(page: Page, user: TestUser = "owner") {
+export async function loginToApp(
+  page: Page,
+  user: TestUser = "owner",
+  opts: { expectOnboarding?: boolean } = {},
+) {
   const { username, password } = credentials[user];
 
   await page.goto("/");
@@ -39,7 +43,9 @@ export async function loginToApp(page: Page, user: TestUser = "owner") {
   const which = await Promise.race([
     appReady.waitFor({ timeout: 20_000 }).then(() => "app" as const),
     setupModal.waitFor({ timeout: 20_000 }).then(() => "modal" as const),
-    approvalPending.waitFor({ timeout: 20_000 }).then(() => "approval" as const),
+    approvalPending
+      .waitFor({ timeout: 20_000 })
+      .then(() => "approval" as const),
     onboarding.waitFor({ timeout: 20_000 }).then(() => "onboarding" as const),
     selectAccount.waitFor({ timeout: 20_000 }).then(() => "select" as const),
     loginInput.waitFor({ timeout: 20_000 }).then(() => "login" as const),
@@ -51,6 +57,9 @@ export async function loginToApp(page: Page, user: TestUser = "owner") {
   }
 
   if (which === "modal") {
+    // Onboarding tests render a full-screen overlay over the setup modal;
+    // clicking modal-close would be pointer-intercepted, so leave it be.
+    if (opts.expectOnboarding) return;
     await setupModal.getByTestId("modal-close").click();
     await expect(setupModal).not.toBeVisible();
     return;
@@ -89,8 +98,12 @@ export async function loginToApp(page: Page, user: TestUser = "owner") {
     onboarding.waitFor({ timeout: 15_000 }),
   ]);
 
-  // Dismiss setup modal if present
-  if (await setupModal.isVisible().catch(() => false)) {
+  // Dismiss setup modal if present, unless an onboarding overlay is expected
+  // on top of it (clicking through it would be pointer-intercepted).
+  if (
+    !opts.expectOnboarding &&
+    (await setupModal.isVisible().catch(() => false))
+  ) {
     await setupModal.getByTestId("modal-close").click();
     await expect(setupModal).not.toBeVisible();
   }
@@ -104,7 +117,15 @@ export async function loginToApp(page: Page, user: TestUser = "owner") {
  * Use this instead of page.goto() for in-app navigation after loginToApp().
  */
 export async function navigateTo(page: Page, path: string) {
-  await page.goto(path, { waitUntil: "domcontentloaded" });
+  // A client-side route update still in flight from the previous test (the
+  // dashboard page is shared per worker) aborts the navigation. Retry once —
+  // by then the app-driven navigation has landed.
+  try {
+    await page.goto(path, { waitUntil: "domcontentloaded" });
+  } catch (e) {
+    if (!String(e).includes("ERR_ABORTED")) throw e;
+    await page.goto(path, { waitUntil: "domcontentloaded" });
+  }
   const modal = page.getByTestId("setup-netbird-modal");
   try {
     await modal.waitFor({ state: "visible", timeout: 3_000 });