Merge pull request #2607 from zerotier/dependabot-fixes

Fix Dependabot alerts: remove unused testcontainers, bump serde_with
2026-09-22 15:29:03 -07:00 · 2026-07-22 12:25:34 -07:00 · 2026-07-20 13:02:38 +02:00 · 2026-06-29 11:55:55 -07:00 · 2026-06-29 11:13:40 -07:00 · 2026-06-26 13:33:07 -07:00
1433 changed files with 11140 additions and 193528 deletions
@@ -4,72 +4,71 @@ BreakBeforeBraces: Stroustrup
 IndentWidth: 4
 TabWidth: 4
 AlignAfterOpenBracket: AlwaysBreak
-AlignConsecutiveMacros: 'true'
-AlignConsecutiveAssignments: 'false'
-AlignConsecutiveDeclarations: 'false'
+AlignConsecutiveMacros: "true"
+AlignConsecutiveAssignments: "false"
+AlignConsecutiveDeclarations: "false"
 AlignEscapedNewlines: Right
-AlignOperands: 'true'
-AlignTrailingComments: 'true'
-AllowAllArgumentsOnNextLine: 'false'
-AllowAllConstructorInitializersOnNextLine: 'false'
-AllowAllParametersOfDeclarationOnNextLine: 'false'
-AllowShortBlocksOnASingleLine: 'true'
-AllowShortCaseLabelsOnASingleLine: 'false'
+AlignOperands: "true"
+AlignTrailingComments: "true"
+AllowAllArgumentsOnNextLine: "false"
+AllowAllConstructorInitializersOnNextLine: "false"
+AllowAllParametersOfDeclarationOnNextLine: "false"
+AllowShortBlocksOnASingleLine: "true"
+AllowShortCaseLabelsOnASingleLine: "false"
 AllowShortFunctionsOnASingleLine: None
 AllowShortIfStatementsOnASingleLine: Never
 AlwaysBreakAfterReturnType: None
-BinPackArguments: 'false'
-BinPackParameters: 'false'
+BinPackArguments: "true"
+BinPackParameters: OnePerLine
 BreakBeforeBinaryOperators: NonAssignment
-BreakBeforeTernaryOperators: 'true'
+BreakBeforeTernaryOperators: "true"
 BreakConstructorInitializers: BeforeComma
 BreakInheritanceList: BeforeComma
-CompactNamespaces: 'false'
-ConstructorInitializerAllOnOneLineOrOnePerLine: 'true'
-ConstructorInitializerIndentWidth: '4'
-ContinuationIndentWidth: '4'
-Cpp11BracedListStyle: 'false'
-FixNamespaceComments: 'true'
+CompactNamespaces: "false"
+ConstructorInitializerAllOnOneLineOrOnePerLine: "true"
+ConstructorInitializerIndentWidth: "4"
+ContinuationIndentWidth: "4"
+Cpp11BracedListStyle: "false"
+FixNamespaceComments: "true"
 IncludeBlocks: Regroup
-IndentCaseLabels: 'true'
+IndentCaseLabels: "true"
 IndentPPDirectives: None
-IndentWrappedFunctionNames: 'false'
-KeepEmptyLinesAtTheStartOfBlocks: 'false'
-MaxEmptyLinesToKeep: '1'
+IndentWrappedFunctionNames: "false"
+KeepEmptyLinesAtTheStartOfBlocks: "false"
+MaxEmptyLinesToKeep: "1"
 NamespaceIndentation: None
 PointerAlignment: Left
-ReflowComments: 'true'
-SortIncludes: 'true'
-SortUsingDeclarations: 'true'
-SpaceAfterCStyleCast: 'false'
-SpaceAfterLogicalNot: 'true'
-SpaceAfterTemplateKeyword: 'true'
-SpaceBeforeAssignmentOperators: 'true'
-SpaceBeforeCpp11BracedList: 'true'
-SpaceBeforeCtorInitializerColon: 'true'
-SpaceBeforeInheritanceColon: 'true'
+ReflowComments: "true"
+SortIncludes: "true"
+SortUsingDeclarations: "true"
+SpaceAfterCStyleCast: "false"
+SpaceAfterLogicalNot: "true"
+SpaceAfterTemplateKeyword: "true"
+SpaceBeforeAssignmentOperators: "true"
+SpaceBeforeCpp11BracedList: "true"
+SpaceBeforeCtorInitializerColon: "true"
+SpaceBeforeInheritanceColon: "true"
 SpaceBeforeParens: ControlStatements
-SpaceBeforeRangeBasedForLoopColon: 'true'
-SpaceInEmptyParentheses: 'false'
-SpacesBeforeTrailingComments: '3'
-SpacesInAngles: 'false'
-SpacesInCStyleCastParentheses: 'false'
-SpacesInContainerLiterals: 'true'
-SpacesInParentheses: 'false'
-SpacesInSquareBrackets: 'false'
-UseTab: 'Always'
+SpaceBeforeRangeBasedForLoopColon: "true"
+SpaceInEmptyParentheses: "false"
+SpacesBeforeTrailingComments: "3"
+SpacesInAngles: "false"
+SpacesInCStyleCastParentheses: "false"
+SpacesInContainerLiterals: "true"
+SpacesInParentheses: "false"
+SpacesInSquareBrackets: "false"
+UseTab: "Always"

 ---
 Language: Cpp
 Standard: Cpp03
-ColumnLimit: '240'
+ColumnLimit: "120"
 ---
 Language: ObjC
-ColumnLimit: '240'
+ColumnLimit: "120"
 ---
 Language: Java
-ColumnLimit: '240'
+ColumnLimit: "120"
 ---
 Language: CSharp
-ColumnLimit: '240'
-...
+ColumnLimit: "120"
@@ -1,2 +1,12 @@
 .git/
 workspace/
+# Local from-source dependency builds (scripts/bootstrap-deps.sh) and CMake output;
+# never ship these into an image -- they are host-specific and large.
+.deps/
+.deps-build/
+build/
+build-*/
+out/
+# Dockerfiles are supplied via -f; keeping them out of the context means editing
+# them does not invalidate the COPY layers (and the heavy build cache).
+ext/central-controller-docker/Dockerfile*
@@ -90,7 +90,7 @@ jobs:


  build_windows:
-    runs-on: windows-latest
+    runs-on: windows-2022
    steps:
    - name: gitconfig
      run: |
@@ -102,7 +102,7 @@ jobs:
      uses: dtolnay/rust-toolchain@stable
      with:
        toolchain: stable
-        target: aarch64-apple-darwin
+        targets: x86_64-pc-windows-msvc
        components: rustfmt, clippy
    - name: Set up cargo cache
      uses: Swatinem/rust-cache@v2
@@ -0,0 +1,104 @@
+# on:
+#     workflow_dispatch:
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  central_controller:
+    name: Central Controller Build
+    strategy:
+      matrix:
+        runner: [gha-runner-x64, gha-runner-arm64]
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: checkout
+        uses: actions/checkout@v6
+
+      - name: GCP Auth
+        uses: google-github-actions/auth@v3
+        with:
+          credentials_json: ${{ secrets.DOCKER_REGISTRY_WRITER}}
+
+      - name: Set up GCloud CLI
+        uses: google-github-actions/setup-gcloud@v3
+        with:
+          # v3 no longer uses the tool cache by default; restore the prior caching
+          # behavior on these self-hosted runners (perf: avoids re-fetching the SDK).
+          cache: true
+
+      - name: Docker Auth
+        run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
+
+      - name: Get branch name and sanitize
+        id: branch
+        run: |
+          BRANCH_NAME="${GITHUB_REF##*/}"
+          SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
+          echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
+
+      - name: Get short git commit SHA
+        id: sha
+        run: |
+          calculatedSha=$(git rev-parse --short ${{ github.sha }})
+          echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build & Push Docker Image
+        # Registry layer cache (mode=max) so the expensive builder stage -- which
+        # builds opentelemetry-cpp + google-cloud-cpp from source -- is reused across
+        # runs and fresh runners. The cache invalidates automatically when the
+        # bootstrap inputs change. Cache is per-arch (the deps layer is arch-specific).
+        run: |
+          CACHE=us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller-buildcache:${{ runner.arch }}
+          docker buildx build \
+            -t us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-${{ runner.arch }} \
+            -f ext/central-controller-docker/Dockerfile \
+            --cache-from type=registry,ref=$CACHE \
+            --cache-to type=registry,ref=$CACHE,mode=max \
+            --provenance false \
+            --push .
+
+  multi-arch-docker:
+    runs-on: gha-runner-x64
+    needs: central_controller
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: GCP Auth
+        uses: google-github-actions/auth@v3
+        with:
+          credentials_json: ${{ secrets.DOCKER_REGISTRY_WRITER}}
+
+      - name: Set up GCloud CLI
+        uses: google-github-actions/setup-gcloud@v3
+        with:
+          # v3 no longer uses the tool cache by default; restore the prior caching
+          # behavior on these self-hosted runners (perf: avoids re-fetching the SDK).
+          cache: true
+
+      - name: Docker Auth
+        run: gcloud auth configure-docker us-central1-docker.pkg.dev --quiet
+
+      - name: Get branch name and sanitize
+        id: branch
+        run: |
+          BRANCH_NAME="${GITHUB_REF##*/}"
+          SANITIZED_BRANCH="${BRANCH_NAME//\//-}"
+          echo "branch_name=$SANITIZED_BRANCH" >> $GITHUB_OUTPUT
+
+      - name: Get short git commit SHA
+        id: sha
+        run: |
+          calculatedSha=$(git rev-parse --short ${{ github.sha }})
+          echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
+
+      - name: Create and push multi-arch manifest
+        run: |
+          docker manifest create us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }} \
+            --amend us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-X64 \
+            --amend us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}-ARM64
+          docker manifest push us-central1-docker.pkg.dev/zerotier-421eb9/docker-images/ztcentral-controller:${{ env.COMMIT_SHORT_SHA }}-${{ steps.branch.outputs.branch_name }}
@@ -12,26 +12,25 @@ jobs:
        git config --global core.autocrlf input

    - name: checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
      with:
        fetch-depth: 0

    - name: Install Rust
-      uses: actions-rs/toolchain@v1
+      uses: dtolnay/rust-toolchain@stable
      with:
        toolchain: stable
-        target: x86_64-unknown-linux-gnu
-        override: true
+        targets: x86_64-unknown-linux-gnu
        components: rustfmt, clippy

    - name: Set up cargo cache
      uses: Swatinem/rust-cache@v2
      continue-on-error: false
      with:
-        key: ${{ runner.os }}-cargo-${{ hashFiles('zeroidc//Cargo.lock') }}
+        key: ${{ runner.os }}-cargo-${{ hashFiles('rustybits//Cargo.lock') }}
        shared-key: ${{ runner.os }}-cargo-
        workspaces: |
-          zeroidc/
+          rustybits/

    - name: validate-1m-linux
      env:
@@ -91,6 +91,7 @@ debian/zerotier-one*.debhelper
 debian/*.log
 debian/zerotier-one.substvars
 root-watcher/config.json
+build/

 # Java/Android/JNI build droppings
 java/obj/
@@ -106,6 +107,7 @@ windows/WinUI/bin/
 windows/ZeroTierOne/Debug/
 /ext/installfiles/windows/chocolatey/zerotier-one/*.nupkg

+
 # Miscellaneous mac/Xcode droppings
 .Trashes
 *.swp
@@ -141,3 +143,11 @@ __pycache__
 *.pyc
 *_source.tar.bz2
 snap/.snapcraft
+build/
+
+# Local dependency bootstrap output (scripts/bootstrap-deps.sh): the install
+# prefix and the build/clone scratch dir. Large + host-specific; never commit.
+.deps/
+.deps-build/
+
+.claude/*.local.*
@@ -0,0 +1,28 @@
+# Central Controller build dependencies for macOS development.
+#
+#   brew bundle            # install the deps below
+#   ZT_CONTROLLER_DEPS=1 scripts/bootstrap-deps.sh   # build the two pinned controller deps (full OTel + google-cloud-cpp)
+#
+# The two version-sensitive C++ libraries (opentelemetry-cpp, google-cloud-cpp)
+# are NOT taken from Homebrew -- they are pinned and built from source by
+# scripts/bootstrap-deps.sh so every dev/CI machine uses the same versions
+# (the role conda previously filled). Everything below is stable enough to take
+# from Homebrew.
+
+brew "cmake"
+brew "ninja"
+brew "pkg-config"
+brew "rustup-init"      # then: rustup-init -y && rustup default stable
+
+brew "libpqxx"
+brew "libpq"           # keg-only; add $(brew --prefix libpq) to CMAKE_PREFIX_PATH so find_package(PostgreSQL) resolves
+brew "hiredis"
+brew "jemalloc"
+brew "nlohmann-json"
+brew "openssl@3"
+brew "abseil"
+brew "protobuf"
+brew "grpc"
+brew "googletest"      # google-cloud-cpp requires GTest/GMock at configure (builds its *_mocks libs)
+brew "curl"
+brew "inja"
@@ -0,0 +1,167 @@
+{
+  "version": 3,
+  "cmakeMinimumRequired": { "major": 3, "minor": 21, "patch": 0 },
+  "configurePresets": [
+    {
+      "name": "unix-base",
+      "hidden": true,
+      "generator": "Unix Makefiles",
+      "binaryDir": "${sourceDir}/build-${presetName}",
+      "cacheVariables": {
+        "CMAKE_PREFIX_PATH": "${sourceDir}/.deps",
+        "CMAKE_BUILD_TYPE": "Release"
+      }
+    },
+    {
+      "name": "linux-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Linux" }
+    },
+    {
+      "name": "macos-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Darwin" },
+      "cacheVariables": {
+        "CMAKE_PREFIX_PATH": "${sourceDir}/.deps;$env{HOMEBREW_PREFIX};$env{HOMEBREW_PREFIX}/opt/openssl@3;$env{HOMEBREW_PREFIX}/opt/libpq"
+      }
+    },
+
+    { "name": "linux-release",            "inherits": "linux-base", "displayName": "Linux daemon (Release)" },
+    { "name": "linux-debug",              "inherits": "linux-base", "displayName": "Linux daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "linux-controller-release", "inherits": "linux-base", "displayName": "Linux Central Controller (Release)", "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON" } },
+    { "name": "linux-controller-debug",   "inherits": "linux-base", "displayName": "Linux Central Controller (Debug)",   "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON", "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "linux-free-release",       "inherits": "linux-base", "displayName": "Linux daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "linux-free-debug",         "inherits": "linux-base", "displayName": "Linux daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    { "name": "macos-release",            "inherits": "macos-base", "displayName": "macOS daemon (Release)" },
+    { "name": "macos-debug",              "inherits": "macos-base", "displayName": "macOS daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "macos-controller-release", "inherits": "macos-base", "displayName": "macOS Central Controller (Release)", "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON" } },
+    { "name": "macos-controller-debug",   "inherits": "macos-base", "displayName": "macOS Central Controller (Debug)",   "cacheVariables": { "ZT1_CENTRAL_CONTROLLER": "ON", "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "macos-free-release",       "inherits": "macos-base", "displayName": "macOS daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "macos-free-debug",         "inherits": "macos-base", "displayName": "macOS daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "macos-universal-release",  "inherits": "macos-base", "displayName": "macOS universal daemon (arm64 + x86_64, Release)", "cacheVariables": { "CMAKE_OSX_ARCHITECTURES": "arm64;x86_64" } },
+    { "name": "macos-universal-debug",    "inherits": "macos-base", "displayName": "macOS universal daemon (arm64 + x86_64, Debug)",   "cacheVariables": { "CMAKE_OSX_ARCHITECTURES": "arm64;x86_64", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    {
+      "name": "freebsd-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "FreeBSD" }
+    },
+    {
+      "name": "openbsd-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "OpenBSD" }
+    },
+    {
+      "name": "netbsd-base",
+      "hidden": true,
+      "inherits": "unix-base",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "NetBSD" }
+    },
+
+    { "name": "freebsd-release",          "inherits": "freebsd-base", "displayName": "FreeBSD daemon (Release)" },
+    { "name": "freebsd-debug",            "inherits": "freebsd-base", "displayName": "FreeBSD daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "freebsd-free-release",     "inherits": "freebsd-base", "displayName": "FreeBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "freebsd-free-debug",       "inherits": "freebsd-base", "displayName": "FreeBSD daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    { "name": "openbsd-release",          "inherits": "openbsd-base", "displayName": "OpenBSD daemon (Release)" },
+    { "name": "openbsd-debug",            "inherits": "openbsd-base", "displayName": "OpenBSD daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "openbsd-free-release",     "inherits": "openbsd-base", "displayName": "OpenBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "openbsd-free-debug",       "inherits": "openbsd-base", "displayName": "OpenBSD daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    { "name": "netbsd-release",           "inherits": "netbsd-base", "displayName": "NetBSD daemon (Release)" },
+    { "name": "netbsd-debug",             "inherits": "netbsd-base", "displayName": "NetBSD daemon (Debug)",   "cacheVariables": { "CMAKE_BUILD_TYPE": "Debug" } },
+    { "name": "netbsd-free-release",      "inherits": "netbsd-base", "displayName": "NetBSD daemon, free / no controller (Release)", "cacheVariables": { "ZT_NONFREE": "OFF" } },
+    { "name": "netbsd-free-debug",        "inherits": "netbsd-base", "displayName": "NetBSD daemon, free / no controller (Debug)",   "cacheVariables": { "ZT_NONFREE": "OFF", "CMAKE_BUILD_TYPE": "Debug" } },
+
+    {
+      "name": "windows-x64",
+      "displayName": "Windows x64 daemon (MSVC + vcpkg)",
+      "generator": "Visual Studio 17 2022",
+      "architecture": "x64",
+      "binaryDir": "${sourceDir}/build-${presetName}",
+      "condition": { "type": "equals", "lhs": "${hostSystemName}", "rhs": "Windows" },
+      "cacheVariables": {
+        "CMAKE_TOOLCHAIN_FILE": "$env{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake",
+        "VCPKG_TARGET_TRIPLET": "x64-windows-static",
+        "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/x64"
+      }
+    },
+    {
+      "name": "windows-arm64",
+      "inherits": "windows-x64",
+      "displayName": "Windows ARM64 daemon (MSVC + vcpkg)",
+      "architecture": "ARM64",
+      "cacheVariables": { "VCPKG_TARGET_TRIPLET": "arm64-windows-static", "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/ARM64" }
+    },
+    {
+      "name": "windows-x86",
+      "inherits": "windows-x64",
+      "displayName": "Windows x86 daemon (MSVC + vcpkg)",
+      "architecture": "Win32",
+      "cacheVariables": { "VCPKG_TARGET_TRIPLET": "x86-windows-static", "CMAKE_PREFIX_PATH": "${sourceDir}/.deps/Win32" }
+    },
+    {
+      "name": "windows-x64-free",
+      "inherits": "windows-x64",
+      "displayName": "Windows x64 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
+      "cacheVariables": { "ZT_NONFREE": "OFF" }
+    },
+    {
+      "name": "windows-arm64-free",
+      "inherits": "windows-arm64",
+      "displayName": "Windows ARM64 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
+      "cacheVariables": { "ZT_NONFREE": "OFF" }
+    },
+    {
+      "name": "windows-x86-free",
+      "inherits": "windows-x86",
+      "displayName": "Windows x86 daemon (free / ZT_NONFREE=OFF, no bundled controller)",
+      "cacheVariables": { "ZT_NONFREE": "OFF" }
+    }
+  ],
+  "buildPresets": [
+    { "name": "linux-release",            "configurePreset": "linux-release" },
+    { "name": "linux-debug",              "configurePreset": "linux-debug" },
+    { "name": "linux-controller-release", "configurePreset": "linux-controller-release" },
+    { "name": "linux-controller-debug",   "configurePreset": "linux-controller-debug" },
+    { "name": "linux-free-release",       "configurePreset": "linux-free-release" },
+    { "name": "linux-free-debug",         "configurePreset": "linux-free-debug" },
+    { "name": "macos-release",            "configurePreset": "macos-release" },
+    { "name": "macos-debug",              "configurePreset": "macos-debug" },
+    { "name": "macos-controller-release", "configurePreset": "macos-controller-release" },
+    { "name": "macos-controller-debug",   "configurePreset": "macos-controller-debug" },
+    { "name": "macos-free-release",       "configurePreset": "macos-free-release" },
+    { "name": "macos-free-debug",         "configurePreset": "macos-free-debug" },
+    { "name": "macos-universal-release",  "configurePreset": "macos-universal-release" },
+    { "name": "macos-universal-debug",    "configurePreset": "macos-universal-debug" },
+    { "name": "freebsd-release",          "configurePreset": "freebsd-release" },
+    { "name": "freebsd-debug",            "configurePreset": "freebsd-debug" },
+    { "name": "freebsd-free-release",     "configurePreset": "freebsd-free-release" },
+    { "name": "freebsd-free-debug",       "configurePreset": "freebsd-free-debug" },
+    { "name": "openbsd-release",          "configurePreset": "openbsd-release" },
+    { "name": "openbsd-debug",            "configurePreset": "openbsd-debug" },
+    { "name": "openbsd-free-release",     "configurePreset": "openbsd-free-release" },
+    { "name": "openbsd-free-debug",       "configurePreset": "openbsd-free-debug" },
+    { "name": "netbsd-release",           "configurePreset": "netbsd-release" },
+    { "name": "netbsd-debug",             "configurePreset": "netbsd-debug" },
+    { "name": "netbsd-free-release",      "configurePreset": "netbsd-free-release" },
+    { "name": "netbsd-free-debug",        "configurePreset": "netbsd-free-debug" },
+    { "name": "windows-x64-release",        "configurePreset": "windows-x64",        "configuration": "Release" },
+    { "name": "windows-x64-debug",          "configurePreset": "windows-x64",        "configuration": "Debug" },
+    { "name": "windows-arm64-release",      "configurePreset": "windows-arm64",      "configuration": "Release" },
+    { "name": "windows-arm64-debug",        "configurePreset": "windows-arm64",      "configuration": "Debug" },
+    { "name": "windows-x86-release",        "configurePreset": "windows-x86",        "configuration": "Release" },
+    { "name": "windows-x86-debug",          "configurePreset": "windows-x86",        "configuration": "Debug" },
+    { "name": "windows-x64-free-release",   "configurePreset": "windows-x64-free",   "configuration": "Release" },
+    { "name": "windows-x64-free-debug",     "configurePreset": "windows-x64-free",   "configuration": "Debug" },
+    { "name": "windows-arm64-free-release", "configurePreset": "windows-arm64-free", "configuration": "Release" },
+    { "name": "windows-arm64-free-debug",   "configurePreset": "windows-arm64-free", "configuration": "Debug" },
+    { "name": "windows-x86-free-release",   "configurePreset": "windows-x86-free",   "configuration": "Release" },
+    { "name": "windows-x86-free-debug",     "configurePreset": "windows-x86-free",   "configuration": "Debug" }
+  ]
+}
@@ -1,197 +1,32 @@
-ZeroTier - Global Area Networking
-======
+# ZeroTier - Global Area Networking

-*This document is written for a software developer audience. For information on using ZeroTier, see the: [Website](https://www.zerotier.com), [Documentation Site](https://docs.zerotier.com), and [Discussion Forum](https://discuss.zerotier.com).*
+## Quick Links
+
+* [ZeroTier Documentation](https://docs.zerotier.com) - **Start here for downloads, installation, and usage**
+* [How to build](build.md) - **Build instructions and platform requirements**
+* [Corporate Site](https://www.zerotier.com/)
+* [Downloads](https://www.zerotier.com/download/)
+* [Service API Reference](service/README.md)
+* [Network Controller](nonfree/controller/README.md)
+* [Commercial Support](https://www.zerotier.com/contact)
+* [License Information](#license)
+
+## About

 ZeroTier is a smart programmable Ethernet switch for planet Earth. It allows all networked devices, VMs, containers, and applications to communicate as if they all reside in the same physical data center or cloud region.

-This is accomplished by combining a cryptographically addressed and secure peer to peer network (termed VL1) with an Ethernet emulation layer somewhat similar to VXLAN (termed VL2). Our VL2 Ethernet virtualization layer includes advanced enterprise SDN features like fine grained access control rules for network micro-segmentation and security monitoring.
+This is accomplished by combining a cryptographically addressed and secure peer-to-peer network (termed VL1) with an Ethernet emulation layer somewhat similar to VXLAN (termed VL2). Our VL2 Ethernet virtualization layer includes advanced enterprise SDN features like fine grained access control rules for network micro-segmentation and security monitoring.

-All ZeroTier traffic is encrypted end-to-end using secret keys that only you control. Most traffic flows peer to peer, though we offer free (but slow) relaying for users who cannot establish peer to peer connections.
+All ZeroTier traffic is encrypted end-to-end using secret keys that only you control. Most traffic flows peer-to-peer, though we offer free (but slow) relaying for users who cannot establish peer-to-peer connections.

-The goals and design principles of ZeroTier are inspired by among other things the original [Google BeyondCorp](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43231.pdf) paper and the [Jericho Forum](https://en.wikipedia.org/wiki/Jericho_Forum) with its notion of "deperimeterization."
+Apps for Android and iOS are available for free in the Google Play and Apple app stores.

-Visit [ZeroTier's site](https://www.zerotier.com/) for more information and [pre-built binary packages](https://www.zerotier.com/download/). Apps for Android and iOS are available for free in the Google Play and Apple app stores.
+For repository layout, build instructions, platform requirements, and information about running ZeroTier, see [build.md](build.md).

-ZeroTier is licensed under the [BSL version 1.1](https://mariadb.com/bsl11/). See [LICENSE.txt](LICENSE.txt) and the [ZeroTier pricing page](https://www.zerotier.com/pricing) for details. ZeroTier is free to use internally in businesses and academic institutions and for non-commercial purposes. Certain types of commercial use such as building closed-source apps and devices based on ZeroTier or offering ZeroTier network controllers and network management as a SaaS service require a commercial license.
+## License

-A small amount of third party code is also included in ZeroTier and is not subject to our BSL license. See [AUTHORS.md](AUTHORS.md) for a list of third party code, where it is included, and the licenses that apply to it. All of the third party code in ZeroTier is liberally licensed (MIT, BSD, Apache, public domain, etc.).
+See [LICENSE-MPL.txt](LICENSE-MPL.txt) for all code in node/, osdep/. service/, and everywhere else except ext/ and nonfree/.

-### Getting Started
+See [nonfree/LICENSE.md](nonfree/LICENSE.md) for all non-free ("source available") portions of this repository.

-Everything in the ZeroTier world is controlled by two types of identifier: 40-bit/10-digit *ZeroTier addresses* and 64-bit/16-digit *network IDs*. These identifiers are easily distinguished by their length. A ZeroTier address identifies a node or "device" (laptop, phone, server, VM, app, etc.) while a network ID identifies a virtual Ethernet network that can be joined by devices.
-
-ZeroTier addresses can be thought of as port numbers on an enormous planet-wide enterprise Ethernet smart switch supporting VLANs. Network IDs are VLAN IDs to which these ports may be assigned. A single port can be assigned to more than one VLAN.
-
-A ZeroTier address looks like `8056c2e21c` and a network ID looks like `8056c2e21c000001`. Network IDs are composed of the ZeroTier address of that network's primary controller and an arbitrary 24-bit ID that identifies the network on this controller. Network controllers are roughly analogous to SDN controllers in SDN protocols like [OpenFlow](https://en.wikipedia.org/wiki/OpenFlow), though as with the analogy between VXLAN and VL2 this should not be read to imply that the protocols or design are the same. You can use our convenient and inexpensive SaaS hosted controllers at [my.zerotier.com](https://my.zerotier.com/) or [run your own controller](controller/) if you don't mind messing around with JSON configuration files or writing scripts to do so.
-
-### Project Layout
-
-The base path contains the ZeroTier One service main entry point (`one.cpp`), self test code, makefiles, etc.
-
- - `artwork/`: icons, logos, etc.
- - `attic/`: old stuff and experimental code that we want to keep around for reference.
- - `controller/`: the reference network controller implementation, which is built and included by default on desktop and server build targets.
- - `debian/`: files for building Debian packages on Linux.
- - `doc/`: manual pages and other documentation.
- - `ext/`: third party libraries, binaries that we ship for convenience on some platforms (Mac and Windows), and installation support files.
- - `include/`: include files for the ZeroTier core.
- - `java/`: a JNI wrapper used with our Android mobile app. (The whole Android app is not open source but may be made so in the future.)
- - `node/`: the ZeroTier virtual Ethernet switch core, which is designed to be entirely separate from the rest of the code and able to be built as a stand-alone OS-independent library. Note to developers: do not use C++11 features in here, since we want this to build on old embedded platforms that lack C++11 support. C++11 can be used elsewhere.
- - `osdep/`: code to support and integrate with OSes, including platform-specific stuff only built for certain targets.
- - `rule-compiler/`: JavaScript rules language compiler for defining network-level rules.
- - `service/`: the ZeroTier One service, which wraps the ZeroTier core and provides VPN-like connectivity to virtual networks for desktops, laptops, servers, VMs, and containers.
- - `windows/`: Visual Studio solution files, Windows service code, and the Windows task bar app UI.
- - `zeroidc/`: OIDC implementation used by ZeroTier service to log into SSO-enabled networks. (This part is written in Rust, and more Rust will be appearing in this repository in the future.)
-
-### Contributing
-
-Please do pull requests off of the `dev` branch.
-
-Releases are done by merging `dev` into `main` and then tagging and doing builds. 
-
-### Build and Platform Notes
-
-To build on Mac and Linux just type `make`. On FreeBSD and OpenBSD `gmake` (GNU make) is required and can be installed from packages or ports. For Windows there is a Visual Studio solution in `windows/`.
-
- - **Mac**
-   - Xcode command line tools for macOS 10.13 or newer are required.
-   - Rust for x86_64 and ARM64 targets *if SSO is enabled in the build*.
- - **Linux**
-   - The minimum compiler versions required are GCC/G++ 8.x or CLANG/CLANG++ 5.x.
-   - Linux makefiles automatically detect and prefer clang/clang++ if present as it produces smaller and slightly faster binaries in most cases. You can override by supplying CC and CXX variables on the make command line.
-   - Rust for x86_64 and ARM64 targets *if SSO is enabled in the build*.
- - **Windows**
-   - Visual Studio 2022 on Windows 10 or newer.
-   - Rust for x86_64 and ARM64 targets *if SSO is enabled in the build*.
- - **FreeBSD**
-   - GNU make is required. Type `gmake` to build.
-   - `binutils` is required.  Type `pkg install binutils` to install.
-   - Rust for x86_64 and ARM64 targets *if SSO is enabled in the build*.
- - **OpenBSD**
-   - There is a limit of four network memberships on OpenBSD as there are only four tap devices (`/dev/tap0` through `/dev/tap3`).
-   - GNU make is required. Type `gmake` to build.
-   - Rust for x86_64 and ARM64 targets *if SSO is enabled in the build*.
-
-Typing `make selftest` will build a *zerotier-selftest* binary which unit tests various internals and reports on a few aspects of the build environment. It's a good idea to try this on novel platforms or architectures.
-
-### Running
-
-Running *zerotier-one* with `-h` option will show help.
-
-On Linux and BSD, if you built from source, you can start the service with:
-
-    sudo ./zerotier-one -d
-
-On most distributions, macOS, and Windows, the installer will start the service and set it up to start on boot.
-
-A home folder for your system will automatically be created.
-
-The service is controlled via the JSON API, which by default is available at `127.0.0.1:9993`. It also listens on `0.0.0.0:9993` which is only usable if `allowManagementFrom` is properly configured in `local.conf`. We include a *zerotier-cli* command line utility to make API calls for standard things like joining and leaving networks. The *authtoken.secret* file in the home folder contains the secret token for accessing this API. See [service/README.md](service/README.md) for API documentation.
-
-Here's where home folders live (by default) on each OS:
-
- * **Linux**: `/var/lib/zerotier-one`
- * **FreeBSD** / **OpenBSD**: `/var/db/zerotier-one`
- * **Mac**: `/Library/Application Support/ZeroTier/One`
- * **Windows**: `\ProgramData\ZeroTier\One` (That's the default. The base 'shared app data' folder might be different if Windows is installed with a non-standard drive letter assignment or layout.)
-
-### Basic Troubleshooting
-
-For most users, it just works.
-
-If you are running a local system firewall, we recommend adding a rules permitting zerotier. If you installed binaries for Windows this should be done automatically. Other platforms might require manual editing of local firewall rules depending on your configuration.
-
-See the [documentation site](https://docs.zerotier.com/zerotier/troubleshooting) for more information.
-
-The Mac firewall can be found under "Security" in System Preferences. Linux has a variety of firewall configuration systems and tools.
-
-On CentOS check `/etc/sysconfig/iptables` for IPTables rules. For other distributions consult your distribution's documentation. You'll also have to check the UIs or documentation for commercial third party firewall applications like Little Snitch (Mac), McAfee Firewall Enterprise (Windows), etc. if you are running any of those. Some corporate environments might have centrally managed firewall software, so you might also have to contact IT.
-
-ZeroTier One peers will automatically locate each other and communicate directly over a local wired LAN *if UDP port 9993 inbound is open*. If that port is filtered, they won't be able to see each others' LAN announcement packets. If you're experiencing poor performance between devices on the same physical network, check their firewall settings. Without LAN auto-location peers must attempt "loopback" NAT traversal, which sometimes fails and in any case requires that every packet traverse your external router twice.
-
-Users behind certain types of firewalls and "symmetric" NAT devices may not be able to connect to external peers directly at all. ZeroTier has limited support for port prediction and will *attempt* to traverse symmetric NATs, but this doesn't always work. If P2P connectivity fails you'll be bouncing UDP packets off our relay servers resulting in slower performance. Some NAT router(s) have a configurable NAT mode, and setting this to "full cone" will eliminate this problem. If you do this you may also see a magical improvement for things like VoIP phones, Skype, BitTorrent, WebRTC, certain games, etc., since all of these use NAT traversal techniques similar to ours.
-
-If a firewall between you and the Internet blocks ZeroTier's UDP traffic, you will fall back to last-resort TCP tunneling to rootservers over port 443 (https impersonation). This will work almost anywhere but is *very slow* compared to UDP or direct peer to peer connectivity.
-
-Additional help can be found in our [knowledge base](https://zerotier.atlassian.net/wiki/spaces/SD/overview).
-
-### Prometheus Metrics
-
-Prometheus Metrics are available at the `/metrics` API endpoint.  This endpoint is protected by an API key stored in `metricstoken.secret` to prevent unwanted information leakage.  Information that could be gleaned from the metrics include joined networks and peers your instance is talking to. 
-
-Access control is via the ZeroTier control interface itself and `metricstoken.secret`. This can be sent as a bearer auth token, via the `X-ZT1-Auth` HTTP header field, or appended to the URL as `?auth=<token>`. You can see the current metrics via `cURL` with the following command:
-
-    // Linux
-    curl -H "X-ZT1-Auth: $(sudo cat /var/lib/zerotier-one/metricstoken.secret)" http://localhost:9993/metrics
-
-    // macOS
-    curl -H "X-ZT1-Auth: $(sudo cat /Library/Application\ Support/ZeroTier/One/metricstoken.secret)" http://localhost:9993/metrics
-
-    // Windows PowerShell (Admin)
-    Invoke-RestMethod -Headers @{'X-ZT1-Auth' = "$(Get-Content C:\ProgramData\ZeroTier\One\metricstoken.secret)"; } -Uri http://localhost:9993/metrics
-
-To configure a scrape job in Prometheus on the machine ZeroTier is running on, add this to your Prometheus `scrape_config`:
-
-    - job_name: zerotier-one
-      honor_labels: true
-      scrape_interval: 15s
-      metrics_path: /metrics
-      static_configs:
-      - targets:
-        - 127.0.0.1:9993
-        labels:
-          group: zerotier-one
-          node_id: $YOUR_10_CHARACTER_NODE_ID
-      authorization:
-        credentials: $YOUR_METRICS_TOKEN_SECRET
-
-If neither of these methods are desirable, it is probably possible to distribute metrics via [Prometheus Proxy](https://github.com/pambrose/prometheus-proxy) or some other tool.  Note: We have not tested this internally, but will probably work with the correct configuration.
-
-Metrics are also available on disk in ZeroTier's working directory:
-
-   // Linux
-   /var/lib/zerotier-one/metrics.prom
-
-   // macOS
-   /Library/Application\ Support/ZeroTier/One/metrics.prom
-
-   //Windows
-   C:\ProgramData\ZeroTier\One\metrics.prom
-
-#### Available Metrics
-
-| Metric Name | Labels | Metric Type | Description |
-| ---         | ---    | ---         | ---         |
-| zt_packet | packet_type, direction | Counter | ZeroTier packet type counts |
-| zt_packet_error | error_type, direction | Counter | ZeroTier packet errors|
-| zt_data | protocol, direction | Counter | number of bytes ZeroTier has transmitted or received |
-| zt_num_networks | | Gauge | number of networks this instance is joined to |
-| zt_network_multicast_groups_subscribed | network_id | Gauge | number of multicast groups networks are subscribed to |
-| zt_network_packets | network_id, direction | Counter | number of incoming/outgoing packets per network |
-| zt_peer_latency | node_id | Histogram | peer latency (ms) |
-| zt_peer_path_count | node_id, status | Gauge | number of paths to peer |
-| zt_peer_packets | node_id, direction | Counter | number of packets to/from a peer |
-| zt_peer_packet_errors | node_id | Counter | number of incoming packet errors from a peer |
-
-If there are other metrics you'd like to see tracked, ask us in an Issue or send us a Pull Request!
-
-### HTTP / App server
-
-There is a static http file server suitable for hosting Single Page Apps at http://localhost:9993/app/<app-path>
-
-Use `zerotier-cli info -j` to find your zerotier-one service's homeDir
-
-``` sh
-cd $ZT_HOME
-sudo mkdir -p app/app1
-sudo mkdir -p app/appB
-echo '<html><meta charset=utf-8><title>appA</title><body><h1>hello world A' | sudo tee app/appA/index.html 
-echo '<html><meta charset=utf-8><title>app2</title><body><h1>hello world 2' | sudo tee app/app2/index.html 
-curl -sL http://localhost:9993/app/appA http://localhost:9993/app/app2 
-```
-
-Then visit [http://localhost:9993/app/app1/](http://localhost:9993/app/app1/) and [http://localhost:9993/app/appB/](http://localhost:9993/app/appB/)
-
-Requests to paths don't exist return the app root index.html, as is customary for SPAs. 
-If you want, you can write some javascript that talks to the service or controller [api](https://docs.zerotier.com/service/v1).
+Code in ext/ is external code included for build convenience or backward compatibility and retains its original license.
@@ -1,6 +1,21 @@
 ZeroTier Release Notes
 ======

+## 2026-05-20 -- Version 1.16.2
+ 
+  * Fixed line endings for the zttap300.inf for the Windows ARM x64 install.
+  * Internal updates to the central controller (CV1) including schema changes and a multi-architecture Docker build pipeline.
+  * Increased `ZT_MAX_NETWORK_SPECIALISTS` from 256 to 512 to accommodate users with large networks that exceeded the previous limit. The network config dictionary capacity was raised correspondingly.
+  * Resolved intermittent multi-minute delays when leaving one network and joining another under Windows.
+  * Compiler warning cleanup across the codebase, covering GCC 14, Clang 18, and Clang 21.
+
+## 2025-12-22 -- Version 1.16.1
+ 
+  * Metrics collection is now disabled by default. It can be enabled via the `enableMetrics` setting in `local.conf`.
+  * Fix for an issue where metrics were not being recorded while running in daemon mode.
+  * Fix debug dumpfile being written to the root directory.
+  * Minor bug fixes in Mac and BSD tun/tap code.
+
 ## 2025-08-21 -- Version 1.16.0

  * License Changes
@@ -0,0 +1,161 @@
+# ZeroTier Build and Project Information
+
+## Build and Platform Notes
+
+### Basic Build Instructions
+
+To build on Mac and Linux just type `make`. On FreeBSD and OpenBSD `gmake` (GNU make) is required and can be installed from packages or ports. For Windows there is a Visual Studio solution in `windows/`.
+
+### Platform Requirements
+
+#### Mac
+- Xcode command line tools for macOS 10.13 or newer are required.
+- Rust for x86_64 and ARM64 targets *if SSO is enabled in the build*.
+
+#### Linux
+- The minimum compiler versions required are GCC/G++ 8.x or CLANG/CLANG++ 5.x.
+- Linux makefiles automatically detect and prefer clang/clang++ if present as it produces smaller and slightly faster binaries in most cases. You can override by supplying CC and CXX variables on the make command line.
+- Rust for x86_64 and ARM64 targets *if SSO is enabled in the build*.
+
+#### Windows
+- Visual Studio 2022 on Windows 10 or newer.
+- Rust for x86_64 and ARM64 targets *if SSO is enabled in the build*.
+
+#### FreeBSD
+- GNU make is required. Type `gmake` to build.
+- `binutils` is required. Type `pkg install binutils` to install.
+- Rust for x86_64 and ARM64 targets *if SSO is enabled in the build*.
+
+#### OpenBSD
+- There is a limit of four network memberships on OpenBSD as there are only four tap devices (`/dev/tap0` through `/dev/tap3`).
+- GNU make is required. Type `gmake` to build.
+- Rust for x86_64 and ARM64 targets *if SSO is enabled in the build*.
+
+### Building with CMake (optional)
+
+> **Note:** CMake is an *alternative* build path, offered as a convenience. The official
+> builds are still produced by the platform makefiles (above) and the Visual Studio solution
+> in `windows/`.
+
+#### Prerequisites
+
+- **CMake** 3.15 or newer.
+- The same compiler/toolchain (and Rust, if SSO is enabled) as the makefile build for your
+  platform — see *Platform Requirements* above.
+- The header-only **OpenTelemetry API** must be present on `CMAKE_PREFIX_PATH`. Populate it
+  into `./.deps` by running the bootstrap script once, in its **default** (quick, header-only)
+  mode — i.e. *without* `ZT_CONTROLLER_DEPS=1`, which is the heavyweight controller-only path:
+
+  ```bash
+  scripts/bootstrap-deps.sh    # default mode: header-only OTel API into ./.deps
+  ```
+
+  The script prints the exact `-DCMAKE_PREFIX_PATH` to use when it finishes.
+
+#### Free vs. default (non-free) builds
+
+By default the daemon is built **with the bundled FileDB network controller**, which lives
+under `nonfree/` and is "source available" (non-free) — this matches what ships in official
+builds (`ZT_NONFREE=ON`). To produce a **purely free** daemon (MPL-2.0 `node/`, `osdep/`,
+`service/` only, with no `nonfree/` code compiled or linked), set **`-DZT_NONFREE=OFF`** — or
+use one of the `*-free-*` presets, which set it for you.
+
+#### Using presets (recommended)
+
+`cmake --list-presets` shows the presets for your OS. The daemon presets are:
+
+| Preset | Build |
+| --- | --- |
+| `macos-release` / `linux-release` | Default daemon (**includes** the non-free bundled controller) |
+| `macos-free-release` / `linux-free-release` | **Free** daemon (`ZT_NONFREE=OFF`, no non-free code) |
+| `macos-debug` / `linux-debug` (and `*-free-debug`) | Debug variants of the above |
+| `macos-universal-release` | macOS universal (arm64 + x86_64) daemon |
+| `freebsd-release` / `openbsd-release` / `netbsd-release` (and `*-free-release`, `*-debug`) | BSD daemon / free variant |
+| `windows-x64-release` (and `windows-x64-free`) | Windows daemon / free variant |
+
+```bash
+# Default (non-free) daemon:
+cmake --preset macos-release
+cmake --build --preset macos-release
+
+# Purely free daemon:
+cmake --preset macos-free-release
+cmake --build --preset macos-free-release
+```
+
+Each preset builds into its own directory, `build-<presetName>/`, so the binary lands at e.g.
+`build-macos-free-release/zerotier-one`. (macOS/Linux presets use single-config Unix Makefiles,
+so the build type is baked into the preset name — there's no `Release/` subdirectory.)
+
+#### Manual invocation
+
+The equivalent without presets:
+
+```bash
+# Default (non-free) daemon — .deps holds the OTel API from bootstrap-deps.sh:
+cmake -DCMAKE_PREFIX_PATH="$PWD/.deps" -S . -B build
+cmake --build build -j8
+
+# Purely free daemon:
+cmake -DZT_NONFREE=OFF -DCMAKE_PREFIX_PATH="$PWD/.deps" -S . -B build
+cmake --build build -j8
+```
+
+The binary is `build/zerotier-one`. (On macOS, append the Homebrew prefixes to
+`CMAKE_PREFIX_PATH` if your dependencies come from Homebrew, as the presets do.)
+
+### Testing
+
+Typing `make selftest` will build a *zerotier-selftest* binary which unit tests various internals and reports on a few aspects of the build environment. It's a good idea to try this on novel platforms or architectures.
+
+## Running ZeroTier
+
+Running *zerotier-one* with `-h` option will show help.
+
+On Linux and BSD, if you built from source, you can start the service with:
+
+    sudo ./zerotier-one -d
+
+On most distributions, macOS, and Windows, the installer will start the service and set it up to start on boot.
+
+A home folder for your system will automatically be created.
+
+The service is controlled via the JSON API, which by default is available at `127.0.0.1:9993`. It also listens on `0.0.0.0:9993` which is only usable if `allowManagementFrom` is properly configured in `local.conf`. We include a *zerotier-cli* command line utility to make API calls for standard things like joining and leaving networks. The *authtoken.secret* file in the home folder contains the secret token for accessing this API. See [service/README.md](service/README.md) for API documentation.
+
+## Directory Structure
+
+### Home Folder Locations
+
+ZeroTier stores its configuration and state files in platform-specific locations:
+
+* **Linux**: `/var/lib/zerotier-one`
+* **FreeBSD** / **OpenBSD**: `/var/db/zerotier-one`
+* **Mac**: `/Library/Application Support/ZeroTier/One`
+* **Windows**: `\ProgramData\ZeroTier\One` (That's the default. The base 'shared app data' folder might be different if Windows is installed with a non-standard drive letter assignment or layout.)
+
+### Project Structure
+
+The repository is organized as follows:
+
+- **node/** - Core ZeroTier networking code
+- **osdep/** - Operating system dependent code  
+- **service/** - Service implementation and API
+- **controller/** - Network controller implementation
+- **ext/** - External code included for build convenience (retains original licenses)
+- **nonfree/** - Source available (non-free) portions
+- **windows/** - Windows-specific Visual Studio solution files
+
+### Build System
+
+The project supports various build targets and platforms:
+- Standard build: `make`
+- Self-test build: `make selftest`
+- Platform-specific requirements:
+  - FreeBSD/OpenBSD: Use `gmake` (GNU make)
+  - Windows: Visual Studio solution in `windows/`
+
+### License Structure
+
+- **node/**, **osdep/**, **service/**: Licensed under MPL-2.0 (see LICENSE-MPL.txt)
+- **nonfree/**: Non-free "source available" code (see nonfree/LICENSE.md)
+- **ext/**: External code with original licenses retained
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -e
+
+cmake -DCMAKE_BUILD_TYPE=Release -DZT1_CENTRAL_CONTROLLER=1 -DCMAKE_INSTALL_PREFIX=$PWD -S . -B build/ -DCMAKE_INSTALL_PREFIX=$(shell pwd)/build-out
+cmake --build build/ --target all -j4 --verbose
+
+ARCH=$(uname -m)
+if [ "$ARCH" = "x86_64" ]; then
+    ARCH="amd64"
+elif [ "$ARCH" = "aarch64" ]; then
+    ARCH="arm64"
+fi
+
+if [ -z "$TARGET_DOCKER_REPO" ]; then
+    TARGET_DOCKER_REPO="us-central1-docker.pkg.dev/zerotier-421eb9/docker-images"
+fi
+
+docker build -platform linux/$ARCH -t $TARGET_DOCKER_REPO/ztcentral-controller:$(git rev-parse --short HEAD)-$ARCH -f ext/central-controller/docker/Dockerfile.central-controller . --load --push
@@ -0,0 +1,28 @@
+
+set(FETCHCONTENT_QUIET OFF)
+
+FetchContent_Declare(
+    cpp-httplib
+    GIT_REPOSITORY https://github.com/yhirose/cpp-httplib.git
+    # v0.47.0+: supports 32-bit Windows. v0.25.0 had a `#warning` refusing 32-bit
+    # Windows that MSVC's default preprocessor escalates to a fatal C1021 (breaks
+    # the windows-x86 build).
+    GIT_TAG v0.47.0
+    GIT_SHALLOW ON
+)
+set(BUILD_SHARED_LIBS OFF CACHE INTERNAL "")
+set(HTTPLIB_COMPILE OFF CACHE INTERNAL "")
+set(HTTPLIB_USE_ZLIB_IF_AVAILABLE ON CACHE INTERNAL "Use zlib if available")
+set(HTTPLIB_USE_BROTLI_IF_AVAILABLE ON CACHE INTERNAL "Use brotli if available")
+# The ZeroTier control plane is plain HTTP on localhost (no httplib SSLServer/SSLClient
+# anywhere), and outbound SSO/OIDC TLS lives in rustybits (native-tls), so httplib never
+# needs OpenSSL. Keeping this ON would link OpenSSL purely as dead weight -- which also
+# blocks universal macOS builds (Homebrew OpenSSL is single-arch).
+set(HTTPLIB_USE_OPENSSL_IF_AVAILABLE OFF CACHE INTERNAL "ZeroTier uses httplib for plain HTTP only")
+set(HTTPLIB_USE_ZSTD_IF_AVAILABLE ON CACHE INTERNAL "Use zstd if available")
+FetchContent_MakeAvailable(cpp-httplib)
+
+if (NOT TARGET httplib::httplib)
+     message(FATAL_ERROR "A required cpp-httplib target (cpp-httplib) was not imported")
+endif()
+
@@ -0,0 +1,18 @@
+# inja -- header-only C++ templating engine used by service/OneService.cpp
+# (`#include <inja/inja.hpp>`). Homebrew ships no usable CMake config and Debian
+# has no package, so we vendor the headers via FetchContent. We populate the
+# source only and skip inja's own CMakeLists (its build/test/json machinery) by
+# pointing SOURCE_SUBDIR at a non-existent directory. inja consumes
+# nlohmann::json, which the build already provides via find_package(nlohmann_json)
+# and links into the targets that use inja; we only need inja's headers on the
+# include path here (header-only, no link), matching the previous conda setup.
+include(FetchContent)
+FetchContent_Declare(inja
+    GIT_REPOSITORY https://github.com/pantor/inja.git
+    GIT_TAG v3.4.0
+    GIT_SHALLOW ON
+    SOURCE_SUBDIR _skip_inja_cmakelists_)   # populate only; no add_subdirectory
+FetchContent_MakeAvailable(inja)
+
+# inja ships an amalgamated header under single_include/inja/inja.hpp.
+include_directories("${inja_SOURCE_DIR}/single_include")
@@ -0,0 +1,32 @@
+set(FETCHCONTENT_QUIET OFF)
+
+FetchContent_Declare(
+    miniupnpc
+    URL https://github.com/miniupnp/miniupnp/releases/download/miniupnpc_2_3_3/miniupnpc-2.3.3.tar.gz
+    DOWNLOAD_EXTRACT_TIMESTAMP TRUE
+)
+set(UPNPC_BUILD_TESTS FALSE CACHE INTERNAL "Build tests" FORCE)
+set(UPNPC_BUILD_SHARED FALSE CACHE INTERNAL "Build shared library" FORCE)
+set(UPNPC_BUILD_STATIC TRUE CACHE INTERNAL "Build static library" FORCE)
+set(UPNPC_BUILD_SAMPLE FALSE CACHE INTERNAL "Build sample" FORCE)
+
+FetchContent_MakeAvailable(miniupnpc)
+
+if (NOT TARGET miniupnpc::miniupnpc)
+     message(FATAL_ERROR "A required miniupnpc target (miniupnpc::miniupnpc) was not imported")
+endif()
+add_definitions(-DZT_USE_MINIUPNPC)
+
+FetchContent_Declare(
+    libnatpmp
+    GIT_REPOSITORY https://github.com/miniupnp/libnatpmp.git
+    GIT_TAG master
+    GIT_SHALLOW ON
+    PATCH_COMMAND git apply ${CMAKE_SOURCE_DIR}/ext/cmake-patches/libnatpmp.patch
+    UPDATE_DISCONNECTED TRUE
+)
+FetchContent_MakeAvailable(libnatpmp)
+
+if (NOT TARGET natpmp)
+     message(FATAL_ERROR "A required libnatpmp target (natpmp) was not imported")
+endif()
@@ -0,0 +1,28 @@
+set(FETCHCONTENT_QUIET OFF)
+
+FetchContent_Declare(
+    redis-plus-plus
+    GIT_REPOSITORY https://github.com/sewenew/redis-plus-plus.git
+    GIT_TAG 1.3.15
+    GIT_SHALLOW ON
+)
+set(REDIS_PLUS_PLUS_BUILD_STATIC ON CACHE INTERNAL "Build static library" FORCE)
+# We only link redis++::redis++_static, so skip the unused shared library.
+set(REDIS_PLUS_PLUS_BUILD_SHARED OFF CACHE INTERNAL "Build shared library" FORCE)
+set(REDIS_PLUS_PLUS_BUILD_TEST OFF CACHE INTERNAL "Build tests" FORCE)
+set(REDIS_PLUS_PLUS_BUILD_STATIC_WITH_PIC ON CACHE INTERNAL "Build static library with PIC" FORCE)
+set(BUILD_SHARED_LIBS OFF CACHE INTERNAL "Build shared libraries" FORCE)
+
+FetchContent_MakeAvailable(redis-plus-plus)
+if(NOT TARGET redis++::redis++_static)
+    message(FATAL_ERROR "A required redis-plus-plus target (redis++::redis++_static) was not imported")
+endif()
+
+# redis++'s static library calls into hiredis but does not propagate that
+# dependency to consumers, so the final link fails with undefined hiredis
+# symbols (redisAppendCommand, redisFree, freeReplyObject, ...). Attach hiredis
+# to the static target's interface. find_library (not find_package(hiredis))
+# because Debian's libhiredis-dev ships no CMake config.
+find_library(HIREDIS_LIB hiredis REQUIRED)
+target_link_libraries(redis++_static INTERFACE ${HIREDIS_LIB})
+message(STATUS "redis-plus-plus imported (hiredis: ${HIREDIS_LIB})")
@@ -1,3 +1,9 @@
+zerotier-one (1.16.2) unstable; urgency=medium
+
+  * See RELEASE-NOTES.md for release notes.
+
+ -- Adam Ierymenko <adam.ierymenko@zerotier.com>  Wed, 27 May 2026 01:00:00 -0700
+
 zerotier-one (1.16.0-2) unstable; urgency=medium

  * Fix build settings to include controller.
@@ -0,0 +1,12 @@
+cmake_minimum_required(VERSION 3.13)
+project(ext)
+
+file(GLOB_RECURSE PROM_CORE_HEADERS ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/core/include/*.h )
+set(PROMETHEUS_CPP_LITE_HEADERS ${PROM_CORE_HEADERS} ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/simpleapi/include)
+
+
+add_library(prometheus-cpp-lite INTERFACE)
+target_sources(prometheus-cpp-lite INTERFACE ${PROMETHEUS_CPP_LITE_HEADERS})
+target_include_directories(prometheus-cpp-lite INTERFACE ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/simpleapi/include ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/core/include)
+add_custom_target(prometheus-cpp-lite-ide SOURCES ${PROMETHEUS_CPP_LITE_HEADERS})
+set(prometheus-cpp-lite_INCLUDE ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/simpleapi/include ${CMAKE_CURRENT_SOURCE_DIR}/prometheus-cpp-lite-1.0/core/include PARENT_SCOPE)
@@ -1,21 +1,68 @@
-# Dockerfile for ZeroTier Central Controllers
-FROM registry.zerotier.com/zerotier/ctlbuild:2025-07-14 AS builder
-ADD . /ZeroTierOne
-RUN export PATH=$PATH:~/.cargo/bin && cd ZeroTierOne && make clean && make central-controller -j8
+# Central Controller -- conda-free, CMake-based, Debian trixie. Multi-stage:
+#   builder  : apt deps + scripts/bootstrap-deps.sh (OTel 1.27 + google-cloud-cpp
+#              2.38 from source) + CMake build of zerotier-one
+#   go_base  : golang-migrate
+#   runtime  : slim trixie with exactly the runtime libs the binary needs
+#
+# Build (context = repo root, see .dockerignore):
+#   docker build -f ext/central-controller-docker/Dockerfile -t ztctl .
+FROM debian:trixie AS builder

-FROM golang:bookworm AS go_base
-RUN go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@latest
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        build-essential cmake ninja-build git pkg-config ca-certificates curl \
+        libpqxx-dev libpq-dev libhiredis-dev libjemalloc-dev nlohmann-json3-dev \
+        libabsl-dev libprotobuf-dev protobuf-compiler protobuf-compiler-grpc libgrpc++-dev \
+        libgtest-dev libgmock-dev libssl-dev libcurl4-openssl-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+        | sh -s -- -y --default-toolchain 1.89.0 --profile minimal
+ENV PATH="/root/.cargo/bin:${PATH}"
+
+WORKDIR /ZeroTierOne
+
+# Pinned from-source deps -> /opt/zt-deps, against apt's abseil/protobuf/grpc.
+# ZT_CONTROLLER_DEPS=1 builds the full controller set (OTel SDK + OTLP exporters +
+# google-cloud-cpp); without it the script only builds the header-only OTel API.
+# Copy only the bootstrap script first so this expensive layer stays cached across
+# changes to the rest of the tree.
+COPY scripts/bootstrap-deps.sh scripts/bootstrap-deps.sh
+RUN ZT_CONTROLLER_DEPS=1 bash scripts/bootstrap-deps.sh /opt/zt-deps
+
+COPY . .
+RUN cmake -DCMAKE_BUILD_TYPE=Release -DZT1_CENTRAL_CONTROLLER=1 \
+        -DCMAKE_PREFIX_PATH=/opt/zt-deps -S . -B build-cmake -G Ninja \
+    && cmake --build build-cmake -j"$(nproc)"
+
+# Compute the exact runtime apt packages the binary links (robust against the
+# trixie t64 package renames). The two non-apt OTel proto .so's are copied
+# explicitly in the runtime stage, so dpkg-S misses there are expected.
+# readlink -f resolves the usrmerge /lib -> /usr/lib symlinks so dpkg -S can
+# attribute each .so to its package (and naturally picks up the trixie t64 names).
+RUN ldd build-cmake/zerotier-one | awk '/=> \//{print $3}' | xargs -r readlink -f \
+        | xargs -r dpkg -S 2>/dev/null | cut -d: -f1 | tr ',' '\n' | sort -u > /opt/runtime-pkgs.txt \
+    && echo "--- runtime packages ---" && cat /opt/runtime-pkgs.txt
+
+# ---------------------------------------------------------------------------
+FROM golang:1.24-bookworm AS go_base
+RUN GOFLAGS='-p=1' go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@latest
+
+# ---------------------------------------------------------------------------
+FROM debian:trixie AS runtime
+COPY --from=builder /opt/runtime-pkgs.txt /opt/runtime-pkgs.txt
+RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+        $(cat /opt/runtime-pkgs.txt) \
+        libjemalloc2 postgresql-client netcat-openbsd ca-certificates \
+    && rm -rf /var/lib/apt/lists/* /opt/runtime-pkgs.txt
+
+COPY --from=builder /ZeroTierOne/build-cmake/zerotier-one /usr/local/bin/zerotier-one
+# The only dynamically-linked from-source libs (OTel/gcloud are otherwise static).
+COPY --from=builder /opt/zt-deps/lib/libopentelemetry_proto.so /opt/zt-deps/lib/libopentelemetry_proto_grpc.so /usr/local/lib/
+RUN echo /usr/local/lib > /etc/ld.so.conf.d/zerotier.conf && ldconfig

-FROM registry.zerotier.com/zerotier/ctlrun:2025-07-14 AS run_base
-COPY --from=builder /ZeroTierOne/zerotier-one /usr/local/bin/zerotier-one
-COPY --from=builder /ZeroTierOne/ext/opentelemetry-cpp-1.21.0/localinstall/lib/*.so /usr/local/lib64/
 COPY --from=go_base /go/bin/migrate /usr/local/bin/migrate
 COPY ext/central-controller-docker/migrations /migrations
+COPY ext/central-controller-docker/main.sh /main.sh
+RUN chmod +x /usr/local/bin/zerotier-one /usr/local/bin/migrate /main.sh

-RUN chmod a+x /usr/local/bin/zerotier-one
-RUN echo "/usr/local/lib64" > /etc/ld.so.conf.d/usr-local-lib64.conf && ldconfig
-
-ADD ext/central-controller-docker/main.sh /
-RUN chmod a+x /main.sh
-
-ENTRYPOINT /main.sh
+ENTRYPOINT ["/main.sh"]