[DOCs/operators]: Release notes for v2025.19 kase (#6157 )

* add release and operators notes * bump up version * fix location in csv to USA * bump up stats * typo fix
change migration and bump version
2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00 · 2025-10-31 09:02:13 +00:00
1027 changed files with 20720 additions and 77766 deletions
@@ -1,5 +1,2 @@
 nym-validator-rewarder/.sqlx/** diff=nodiff
 nym-node-status-api/nym-node-status-api/.sqlx/** diff=nodiff
-
-# Use bd merge for beads JSONL files
-.beads/beads.jsonl merge=beads
@@ -25,7 +25,7 @@ Steps to reproduce the behaviour, if you're familiar with BDD syntax, please wri

 *An example:*
 - Given I was setting up a mix-node following the instructions in the docs
- And I successfully bonded my node via the wallet
+- And I successfully bonded my node via the the wallet
 - When I went to start my mixnode
 - Then I was presented with an error

@@ -9,7 +9,7 @@ jobs:

    steps:
      - name: Checkout Repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Set up Build Environment
        run: sudo apt-get update && sudo apt-get install -y make dpkg-dev
@@ -25,14 +25,14 @@ jobs:
          echo "file2=$(ls nym-vpn*.deb)" >> $GITHUB_ENV

      - name: Upload nym-repo-setup
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.file1 }}
          path: ppa/packages/nym-repo-setup*.deb
          retention-days: 10

      - name: Upload nym-vpn
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.file2 }}
          path: ppa/packages/nym-vpn*.deb
@@ -10,7 +10,7 @@ jobs:
      run:
        working-directory: documentation/docs
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
      - name: Install pip3
@@ -21,16 +21,16 @@ jobs:
        run: sudo apt-get install -y rsync
      - uses: rlespinasse/github-slug-action@v3.x
      - name: Setup pnpm
-        uses: pnpm/action-setup@v4.2.0
+        uses: pnpm/action-setup@v4.1.0
        with:
          version: 9
      - uses: actions/setup-node@v4
        with:
          node-version: 20
-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
@@ -37,16 +37,16 @@ jobs:

    runs-on: ${{ matrix.platform }}
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install jq vim libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
        continue-on-error: true

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Branch name
        run: echo running on branch ${GITHUB_REF##*/}
@@ -12,7 +12,7 @@ jobs:
  build:
    runs-on: ubuntu-22.04
    steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
    - name: Install rsync
      run: sudo apt-get install rsync
      continue-on-error: true
@@ -28,7 +28,7 @@ jobs:
      CARGO_TERM_COLOR: always
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Prepare build output directory
        shell: bash
@@ -46,10 +46,10 @@ jobs:
        run: |
          echo "RUSTFLAGS=--cfg tokio_unstable" >> $GITHUB_ENV
          echo "CARGO_FEATURES=--features tokio-console" >> $GITHUB_ENV
-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Build all binaries
        uses: actions-rs/cargo@v1
@@ -71,7 +71,7 @@ jobs:

      - name: Upload Artifact
        if: github.event_name == 'workflow_dispatch'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
        with:
          name: nym-binaries-artifacts
          path: |
@@ -15,13 +15,13 @@ jobs:
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          target: wasm32-unknown-unknown
          override: true
          components: rustfmt, clippy
@@ -8,13 +8,10 @@ on:
      - 'gateway/**'
      - 'integrations/**'
      - 'nym-api/**'
-      - 'nym-authenticator-client/**'
      - 'nym-credential-proxy/**'
-      - 'nym-ip-packet-client/**'
      - 'nym-network-monitor/**'
      - 'nym-node/**'
      - 'nym-node-status-api/**'
-      - 'nym-registration-client/**'
      - 'nym-statistics-api/**'
      - 'nym-outfox/**'
      - 'nym-validator-rewarder/**'
@@ -54,13 +51,13 @@ jobs:
        if: contains(matrix.os, 'linux')

      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          override: true
          components: rustfmt, clippy

@@ -17,7 +17,7 @@ jobs:
          - licenses bans sources

    steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
    - uses: EmbarkStudios/cargo-deny-action@v2
      with:
        log-level: warn
@@ -13,10 +13,10 @@ jobs:
    runs-on: arc-linux-latest-dind
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.50.1
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -10,13 +10,13 @@ env:

 jobs:
  check-if-tag-exists:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.50.1
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -16,12 +16,12 @@ jobs:
      CARGO_TERM_COLOR: always
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Generate the schema
        run: make contract-schema
@@ -17,7 +17,7 @@ jobs:
    env:
      CARGO_TERM_COLOR: always
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Prepare build output directory
        shell: bash
@@ -22,7 +22,7 @@ jobs:
      CARGO_TERM_COLOR: always
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Setup rust
        uses: actions-rs/toolchain@v1
@@ -17,7 +17,7 @@ jobs:
      run:
        working-directory: documentation/docs
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler git python3 && sudo apt-get update --fix-missing
      - name: Install pip3
@@ -28,16 +28,16 @@ jobs:
        run: sudo apt-get install -y rsync
      - uses: rlespinasse/github-slug-action@v3.x
      - name: Setup pnpm
-        uses: pnpm/action-setup@v4.2.0
+        uses: pnpm/action-setup@v4.1.0
        with:
          version: 9
      - uses: actions/setup-node@v4
        with:
          node-version: 20
-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
@@ -6,42 +6,45 @@ on:
    paths:
      - "ts-packages/**"
      - "sdk/typescript/**"
+      - "nym-connect/desktop/src/**"
+      - "nym-connect/desktop/package.json"
      - "nym-wallet/src/**"
      - "nym-wallet/package.json"
-      - "explorer-v2/**"
+      - "explorer/**"
      - ".github/workflows/ci-lint-typescript.yml"

 jobs:
  build:
-    runs-on: arc-linux-latest
+    runs-on: ubuntu-22.04
    env:
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      - uses: rlespinasse/github-slug-action@v3.x

      - uses: actions/setup-node@v4
        with:
          node-version: 20
-
      - name: Setup yarn
        run: npm install -g yarn

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh

      - name: Install wasm-opt
-        run: cargo install wasm-opt
+        uses: ./.github/actions/install-wasm-opt
+        with:
+          version: '116'

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
        with:
-          go-version: "1.24.6"
+          go-version: "1.23.7"

      - name: Install
        run: yarn
@@ -49,11 +52,7 @@ jobs:
      - name: Build packages
        run: yarn build:ci

-      - name: Install again
-        run: yarn
-
      - name: Lint
        run: yarn lint
-
      - name: Typecheck with tsc
        run: yarn tsc
@@ -25,13 +25,13 @@ jobs:
        continue-on-error: true

      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          override: true
          components: rustfmt, clippy

@@ -8,9 +8,9 @@ on:

 jobs:
  build:
-    runs-on: arc-linux-latest-dind
+    runs-on: custom-linux
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Install rsync
        run: sudo apt-get install rsync
@@ -25,10 +25,10 @@ jobs:
      - name: Setup yarn
        run: npm install -g yarn

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
@@ -16,7 +16,7 @@ jobs:
      CARGO_TERM_COLOR: always
      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
@@ -25,13 +25,13 @@ jobs:
      - uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          target: wasm32-unknown-unknown
          override: true
          components: rustfmt, clippy

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
        with:
          go-version: "1.24.6"

@@ -10,10 +10,10 @@ jobs:
    name: SonarQube
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of analysis
      - name: SonarQube Scan
-        uses: SonarSource/sonarqube-scan-action@v7
+        uses: SonarSource/sonarqube-scan-action@v5
        env:
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -30,11 +30,11 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Setup Pages
        uses: actions/configure-pages@v5
      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@v3
        with:
          # Upload entire repository
          path: './ppa'
@@ -8,6 +8,6 @@ jobs:
    steps:
    - uses: actions/first-interaction@v3
      with:
-        repo_token: ${{ secrets.GITHUB_TOKEN }}
-        issue_message: 'Thank you for raising this issue'
-        pr_message: 'Thank you for making this first PR'
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        issue-message: 'Thank you for raising this issue'
+        pr-message: 'Thank you for making this first PR'
@@ -19,7 +19,7 @@ jobs:
    continue-on-error: true
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
@@ -101,7 +101,7 @@ jobs:
      - name: Collect jobs status
        uses: technote-space/workflow-conclusion-action@v3
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: install npm
        uses: actions/setup-node@v4
        if: env.WORKFLOW_CONCLUSION == 'failure'
@@ -15,7 +15,7 @@ jobs:
      output1: ${{ steps.step2.outputs.latest_release }}
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set output variable to latest release branch
@@ -28,7 +28,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup git user
@@ -47,7 +47,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Setup git user
@@ -18,7 +18,7 @@ jobs:
    continue-on-error: true
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
@@ -28,7 +28,7 @@ jobs:
        uses: actions-rs/toolchain@v1
        with:
          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          override: true
          components: rustfmt, clippy

@@ -63,7 +63,7 @@ jobs:
      - name: Collect jobs status
        uses: technote-space/workflow-conclusion-action@v3
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: install npm
        uses: actions/setup-node@v4
        if: env.WORKFLOW_CONCLUSION == 'failure'
@@ -8,11 +8,11 @@ jobs:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
      - name: Install cargo deny
        run: cargo install --locked cargo-deny
      - name: Run cargo deny
@@ -20,7 +20,7 @@ jobs:
          find . -name Cargo.toml -exec cargo deny --manifest-path {} check \
            advisories -A advisory-not-detected  --hide-inclusion-graph \; &> \
            >(uniq  &> .github/workflows/support-files/notifications/deny.message )
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v4
        with:
          name: report
          path: .github/workflows/support-files/notifications/deny.message
@@ -29,9 +29,9 @@ jobs:
    runs-on: custom-linux
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Download report from previous job
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v5
        with:
          name: report
          path: .github/workflows/support-files/notifications
@@ -15,12 +15,12 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Rust
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          override: true

      - name: Install dependencies
@@ -42,7 +42,7 @@ jobs:
      cli_version: ${{ steps.binary-versions.outputs.cli_version }}

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install ripgrep libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools
@@ -53,10 +53,10 @@ jobs:
          echo 'RUSTFLAGS="--cfg tokio_unstable"' >> $GITHUB_ENV
        if: github.event_name == 'workflow_dispatch' && inputs.add_tokio_unstable == true

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: 1.88.0
          override: true

      - name: Build all binaries
@@ -66,7 +66,7 @@ jobs:
          args: --workspace --release ${{ env.CARGO_FEATURES }}
  
      - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
        with:
          name: my-artifact
          path: |
@@ -9,12 +9,11 @@ jobs:
    if: ${{ (startsWith(github.ref, 'refs/tags/nym-contracts-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
          target: wasm32-unknown-unknown
          override: true

@@ -27,14 +26,14 @@ jobs:
        run: make contracts

      - name: Upload Mixnet Contract Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
        with:
          name: mixnet_contract.wasm
          path: contracts/target/wasm32-unknown-unknown/release/mixnet_contract.wasm
          retention-days: 5

      - name: Upload Vesting Contract Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
        with:
          name: vesting_contract.wasm
          path: contracts/target/wasm32-unknown-unknown/release/vesting_contract.wasm
@@ -21,17 +21,17 @@ jobs:
      release_tag: ${{ github.ref_name }}

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Node
        uses: actions/setup-node@v4
        with:
          node-version: 21
          
-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
          
      - name: Add Rust target for x86_64-apple-darwin
        run: rustup target add x86_64-apple-darwin
@@ -108,7 +108,7 @@ jobs:
          cd -

      - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
        with:
          name: nym-wallet.app.tar.gz
          path: nym-wallet/target/x86_64-apple-darwin/release/bundle/macos/nym-wallet.app.tar.gz
@@ -18,7 +18,7 @@ jobs:
      release_tag: ${{ github.ref_name }}
      
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
      
      - name: Install system dependencies
        run: |
@@ -33,10 +33,10 @@ jobs:
          node-version: 21
          cache: 'yarn'
      
-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable
      
      - name: Install project dependencies
        shell: bash
@@ -97,7 +97,7 @@ jobs:
          fi
      
      - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
        with:
          name: nym-wallet-appimage.tar.gz
          path: |
@@ -27,12 +27,12 @@ jobs:
      release_tag: ${{ github.ref_name }}

    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

-      - name: Install Rust toolchain
+      - name: Install Rust stable
        uses: dtolnay/rust-toolchain@stable
        with:
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
+          toolchain: stable

      - name: Setup MSBuild.exe
        uses: microsoft/setup-msbuild@v2
@@ -128,7 +128,7 @@ jobs:
          find . -name "*.msi" -type f

      - name: Upload Artifact
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
        with:
          name: nym-wallet.msi
          path: |
@@ -22,7 +22,7 @@ jobs:

    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Install Java
        uses: actions/setup-java@v5
@@ -76,7 +76,7 @@ jobs:
            apk/nyms5-arch64-release.apk

      - name: Upload APKs
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@v4
        with:
          name: nyms5-apk-arch64
          path: |
@@ -89,9 +89,9 @@ jobs:
    runs-on: custom-linux
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - name: Download binary artifact
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v5
        with:
          name: nyms5-apk-arch64
          path: apk
@@ -4,9 +4,9 @@ on:

 jobs:
  publish:
-    runs-on: ubuntu-latest
+    runs-on: arc-ubuntu-22.04
    steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4

      - name: Install Node
        uses: actions/setup-node@v4
@@ -17,13 +17,10 @@ jobs:
      - name: Setup yarn
        run: npm install -g yarn

-      - name: Install rust toolchain
+      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          profile: minimal
-          toolchain: ${{ vars.REQUIRED_RUSTC_VERSION }}
-          override: true
-          components: rustfmt, clippy
+          toolchain: stable

      - name: Install wasm-pack
        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
@@ -32,9 +29,9 @@ jobs:
        run: cargo install wasm-opt

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v5
        with:
-          go-version: "1.24.6"
+          go-version: "1.23.7"

      - name: Install dependencies
        run: yarn
@@ -18,7 +18,7 @@ jobs:
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.50.1
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-credential-proxy/Cargo.toml
@@ -8,7 +8,7 @@ env:

 jobs:
  build-container:
-    runs-on: arc-linux-latest-dind
+    runs-on: arc-ubuntu-22.04-dind
    steps:
      - name: Login to Harbor
        uses: docker/login-action@v3
@@ -18,7 +18,7 @@ jobs:
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.50.1
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -18,7 +18,7 @@ jobs:
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.50.1
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-network-monitor/Cargo.toml
@@ -3,6 +3,11 @@ name: Build and upload Node Status agent container to harbor.nymte.ch
 on:
  workflow_dispatch:
    inputs:
+      gateway_probe_git_ref:
+        type: string
+        default: nym-vpn-core-v1.4.0
+        required: true
+        description: Which gateway probe git ref to build the image with
      release_image:
        description: 'Tag image as a release'
        required: true
@@ -25,7 +30,7 @@ jobs:
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -38,6 +43,16 @@ jobs:
          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
          echo "result=$VERSION" >> $GITHUB_OUTPUT

+      - name: cleanup-gateway-probe-ref
+        id: cleanup_gateway_probe_ref
+        run: |
+          GATEWAY_PROBE_GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }}
+          GIT_REF_SLUG="${GATEWAY_PROBE_GIT_REF//\//-}"
+          echo "git_ref=${GIT_REF_SLUG}" >> $GITHUB_OUTPUT
+
+      - name: Set GIT_TAG variable
+        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
+
      - name: Initialize RELEASE_TAG
        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
      
@@ -46,12 +61,24 @@ jobs:
        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
      
      - name: Set IMAGE_NAME_AND_TAGS variable
-        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
        
      - name: New env vars
-        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
+
+      # - name: Remove existing tag if exists
+      #   run: |
+      #     if git rev-parse $${{ env.GIT_TAG }} >/dev/null 2>&1; then
+      #       git push --delete origin $${{ env.GIT_TAG }}
+      #       git tag -d $${{ env.GIT_TAG }}
+      #     fi
+
+      # - name: Create tag
+      #   run: |
+      #     git tag -a $${{ env.GIT_TAG }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
+      #     git push origin $${{ env.GIT_TAG }}

      - name: BuildAndPushImageOnHarbor
        run: |
-          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -24,7 +24,7 @@ jobs:
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -18,7 +18,7 @@ jobs:
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.50.1
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/nym-api/Cargo.toml
@@ -18,7 +18,7 @@ jobs:
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.50.1
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -18,7 +18,7 @@ jobs:
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.50.1
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -18,7 +18,7 @@ jobs:
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.50.1
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -18,7 +18,7 @@ jobs:
          password: ${{ secrets.HARBOR_ROBOT_SECRET }}

      - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4

      - name: Configure git identity
        run: |
@@ -26,7 +26,7 @@ jobs:
          git config --global user.name "Lawrence Stalder"

      - name: Get version from cargo.toml
-        uses: mikefarah/yq@v4.50.1
+        uses: mikefarah/yq@v4.47.1
        id: get_version
        with:
          cmd: yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml
@@ -20,7 +20,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
@@ -30,7 +30,7 @@ jobs:
        with:
          release-tag-or-name-or-id: ${{ inputs.release_tag }}

-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@v4
        with:
          name: Asset Hashes
          path: hashes.json
@@ -63,15 +63,3 @@ nym-api/redocly/formatted-openapi.json

 **/settings.sql
 **/enter_db.sh
-
-*.profraw
-.beads
-CLAUDE.md
-docs
-.claude
-.superego
-
-# Superego (machine-specific paths)
-.superego/
-.claude/hooks/superego/
-.claude/settings.json
@@ -4,100 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

-## [2025.21-mozzarella] (2025-11-25)
-
- [bugfix] Tunnel not waiting on MixnetClient to shut down cleanly ([#6225])
- bugfix: fix credential proxy upgrade mode attestation url arg ([#6202])
- HTTP API resilience enable & domain rotation conditions ([#6200])
- Remove debug feature from http-macro spec in gateway probe ([#6195])
- DNS relibility and troubleshooting  ([#6179])
- [bugfix] Distinguish authenticator errors by credential spent ([#6176])
- Typescript SDK 1.4.1 ([#6146])
- Enable URL rotation and retries for mixnet gateway init ([#6126])
- Feature/credential proxy jwt ([#5957])
-
-[#6225]: https://github.com/nymtech/nym/pull/6225
-[#6202]: https://github.com/nymtech/nym/pull/6202
-[#6200]: https://github.com/nymtech/nym/pull/6200
-[#6195]: https://github.com/nymtech/nym/pull/6195
-[#6179]: https://github.com/nymtech/nym/pull/6179
-[#6176]: https://github.com/nymtech/nym/pull/6176
-[#6146]: https://github.com/nymtech/nym/pull/6146
-[#6126]: https://github.com/nymtech/nym/pull/6126
-[#5957]: https://github.com/nymtech/nym/pull/5957
-
-## [2025.20-leerdammer] (2025-11-12)
-
- Max/tweak ts sdk actions ([#6185])
- chore: resolve clippy 1.91 warnings ([#6168])
- [chore] Remove unused dependencies ([#6151])
- Use typed-builder for registration client builder config ([#6150])
- tommy is too quick ([#6149])
- configurable mixnet client startup timeout ([#6148])
- [Feature/operators]: QUIC bridge deployment script v2 ([#6145])
- Bugfix: Add circuit breaker ([#6143])
- bugfix: update internal owner address in transferred share ([#6139])
- Update quic_bridge_deployment.sh for IPv4 and .deb package ([#6138])
- feat: expose more explicit new_with_fronted_urls builder for http API client ([#6136])
- bugfix: update stored epoch share when changing ownership ([#6135])
- Domain fronting ([#6134])
- bugfix: update stored epoch share when changing announce address ([#6131])
-
-[#6185]: https://github.com/nymtech/nym/pull/6185
-[#6168]: https://github.com/nymtech/nym/pull/6168
-[#6151]: https://github.com/nymtech/nym/pull/6151
-[#6150]: https://github.com/nymtech/nym/pull/6150
-[#6149]: https://github.com/nymtech/nym/pull/6149
-[#6148]: https://github.com/nymtech/nym/pull/6148
-[#6145]: https://github.com/nymtech/nym/pull/6145
-[#6143]: https://github.com/nymtech/nym/pull/6143
-[#6139]: https://github.com/nymtech/nym/pull/6139
-[#6138]: https://github.com/nymtech/nym/pull/6138
-[#6136]: https://github.com/nymtech/nym/pull/6136
-[#6135]: https://github.com/nymtech/nym/pull/6135
-[#6134]: https://github.com/nymtech/nym/pull/6134
-[#6131]: https://github.com/nymtech/nym/pull/6131
-
-## [2025.19-kase] (2025-10-30)
-
- update ns agent workflow ([#6154])
- Cherry pick - request #6143 from nymtech/bugfix/mix-tx-closed-v2 ([#6153])
- bugfix: nym-credential-proxy query params parsing regression ([#6121])
- bugfix: revert some dep updates introduced in #6043 ([#6120])
- Skip ipv6 metadata endpoint request ([#6118])
- update to no longer use 1mb files ([#6117])
- chore: restore pending dkg contract state migration ([#6116])
- Revert "Propagate cancel token to mixnet client" ([#6115])
- Update dirs to 6.0 ([#6109])
- Propagate cancel token to mixnet client ([#6105])
- bugfix: retrieve and update ticketbook in the same query ([#6101])
- bugfix: include network name in the default gateway probe config path ([#6100])
- Bugfix/incompatibility fixes ([#6099])
- [DOCs/operators] QUIC deployment script & docs ([#6098])
- bugfix: testnet manager 02sql migration ([#6096])
- feat: move gateway probe to monorepo (and update to rust edition 2024) ([#6094])
- bugfix: use custom topology provider for list of init gateways ([#6092])
- Max/fix wasm client + build commands ([#6043])
-
-[#6154]: https://github.com/nymtech/nym/pull/6154
-[#6153]: https://github.com/nymtech/nym/pull/6153
-[#6121]: https://github.com/nymtech/nym/pull/6121
-[#6120]: https://github.com/nymtech/nym/pull/6120
-[#6118]: https://github.com/nymtech/nym/pull/6118
-[#6117]: https://github.com/nymtech/nym/pull/6117
-[#6116]: https://github.com/nymtech/nym/pull/6116
-[#6115]: https://github.com/nymtech/nym/pull/6115
-[#6109]: https://github.com/nymtech/nym/pull/6109
-[#6105]: https://github.com/nymtech/nym/pull/6105
-[#6101]: https://github.com/nymtech/nym/pull/6101
-[#6100]: https://github.com/nymtech/nym/pull/6100
-[#6099]: https://github.com/nymtech/nym/pull/6099
-[#6098]: https://github.com/nymtech/nym/pull/6098
-[#6096]: https://github.com/nymtech/nym/pull/6096
-[#6094]: https://github.com/nymtech/nym/pull/6094
-[#6092]: https://github.com/nymtech/nym/pull/6092
-[#6043]: https://github.com/nymtech/nym/pull/6043
-
 ## [2025.18-jarlsberg] (2025-10-14)

 - ns-api: add descriptions to dVPN gateway responses ([#6102])
@@ -0,0 +1,686 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+Nym is a privacy platform that uses mixnet technology to protect against metadata surveillance. The platform consists of several key components:
+- Mixnet nodes (mixnodes) for packet mixing
+- Gateways (entry/exit points for the network)
+- Clients for interacting with the network
+- Network monitoring tools
+- Validators for network consensus
+- Various service providers and integrations
+
+## Build Commands
+
+### Rust Components
+
+```bash
+# Default build (debug)
+cargo build
+
+# Release build
+cargo build --release
+
+# Build a specific package
+cargo build -p <package-name>
+
+# Build main components
+make build
+
+# Build release versions of main binaries and contracts
+make build-release
+
+# Build specific binaries
+make build-nym-cli
+cargo build -p nym-node --release
+cargo build -p nym-api --release
+```
+
+### Testing
+
+```bash
+# Run clippy, unit tests, and formatting
+make test
+
+# Run all tests including slow tests
+make test-all
+
+# Run clippy on all workspaces
+make clippy
+
+# Run unit tests for a specific package
+cargo test -p <package-name>
+
+# Run only expensive/ignored tests
+cargo test --workspace -- --ignored
+
+# Run API tests
+dotenv -f envs/sandbox.env -- cargo test --test public-api-tests
+
+# Run tests with specific log level
+RUST_LOG=debug cargo test -p <package-name>
+
+# Run specific test scripts
+./nym-node/tests/test_apis.sh
+./scripts/wireguard-exit-policy/exit-policy-tests.sh
+```
+
+### Linting and Formatting
+
+```bash
+# Run rustfmt on all code
+make fmt
+
+# Check formatting without modifying
+cargo fmt --all -- --check
+
+# Run clippy with all targets
+cargo clippy --workspace --all-targets -- -D warnings
+
+# TypeScript linting
+yarn lint
+yarn lint:fix
+yarn types:lint:fix
+
+# Check dependencies for security/licensing issues
+cargo deny check
+```
+
+### WASM Components
+
+```bash
+# Build all WASM components
+make sdk-wasm-build
+
+# Build TypeScript SDK
+yarn build:sdk
+npx lerna run --scope @nymproject/sdk build --stream
+
+# Build and test WASM components
+make sdk-wasm
+
+# Build specific WASM packages
+cd wasm/client && make
+cd wasm/mix-fetch && make
+cd wasm/node-tester && make
+```
+
+### Contract Development
+
+```bash
+# Build all contracts
+make contracts
+
+# Build contracts in release mode
+make build-release-contracts
+
+# Generate contract schemas
+make contract-schema
+
+# Run wasm-opt on contracts
+make wasm-opt-contracts
+
+# Check contracts with cosmwasm-check
+make cosmwasm-check-contracts
+```
+
+### Running Components
+
+```bash
+# Run nym-node as a mixnode
+cargo run -p nym-node -- run --mode mixnode
+
+# Run nym-node as a gateway
+cargo run -p nym-node -- run --mode gateway
+
+# Run the network monitor
+cargo run -p nym-network-monitor
+
+# Run the API server
+cargo run -p nym-api
+
+# Run with specific environment
+dotenv -f envs/sandbox.env -- cargo run -p nym-api
+
+# Start a local network
+./scripts/localnet_start.sh
+```
+
+## Architecture
+
+The Nym platform consists of various components organized as a monorepo:
+
+1. **Core Mixnet Infrastructure**:
+   - `nym-node`: Core binary supporting mixnode and gateway modes
+   - `common/nymsphinx`: Implementation of the Sphinx packet format
+   - `common/topology`: Network topology management
+   - `common/types`: Shared data types across components
+
+2. **Network Monitoring**:
+   - `nym-network-monitor`: Monitors the network's reliability and performance
+   - `nym-api`: API server for network stats and monitoring data
+   - Metrics tracking for nodes, routes, and overall network health
+
+3. **Client Implementations**:
+   - `clients/native`: Native Rust client implementation
+   - `clients/socks5`: SOCKS5 proxy client for standard applications
+   - `wasm`: WebAssembly client implementations (for browsers)
+   - `nym-connect`: Desktop and mobile clients
+
+4. **Blockchain & Smart Contracts**:
+   - `common/cosmwasm-smart-contracts`: Smart contract implementations
+   - `contracts`: CosmWasm contracts for the Nym network
+   - `common/ledger`: Blockchain integration
+
+5. **Utilities & Tools**:
+   - `tools`: Various CLI tools and utilities
+   - `sdk`: SDKs for different languages and platforms
+   - `documentation`: Documentation generation and management
+
+## Packet System
+
+Nym uses a modified Sphinx packet format for its mixnet:
+
+1. **Message Chunking**:
+   - Messages are divided into "sets" and "fragments"
+   - Each fragment fits in a single Sphinx packet
+   - The `common/nymsphinx/chunking` module handles message fragmentation
+
+2. **Routing**:
+   - Packets traverse through 3 layers of mixnodes
+   - Routing information is encrypted in layers (onion routing)
+   - The final gateway receives and processes the messages
+
+3. **Monitoring**:
+   - Monitoring system tracks packet delivery through the network
+   - Routes are analyzed for reliability statistics
+   - Node performance metrics are collected
+
+## Network Protocol
+
+Nym implements the Loopix mixnet design with several key privacy features:
+
+1. **Continuous-time Mixing**:
+   - Each mixnode delays messages independently with an exponential distribution
+   - This creates random reordering of packets, destroying timing correlations
+   - Offers better anonymity properties than batch mixing approaches
+
+2. **Cover Traffic**:
+   - Clients and nodes generate dummy "loop" packets that circulate through the network
+   - These packets are indistinguishable from real traffic
+   - Creates a baseline level of traffic that hides actual communication patterns
+   - Provides unobservability (hiding when and how much real traffic is being sent)
+
+3. **Stratified Network Architecture**:
+   - Traffic flows through Entry Gateway → 3 Mixnode Layers → Exit Gateway
+   - Path selection is independent per-message (unlike Tor)
+   - Each node connects only to adjacent layers
+
+4. **Anonymous Replies**:
+   - Single-Use Reply Blocks (SURBs) allow receiving messages without revealing identity
+   - Enables bidirectional communication while maintaining privacy
+
+## Network Monitoring Architecture
+
+The network monitoring system is a core component that measures mixnet reliability:
+
+1. The `nym-network-monitor` sends test packets through the network
+2. These packets follow predefined routes through multiple mixnodes
+3. Metrics are collected about:
+   - Successful and failed packet deliveries
+   - Node reliability (percentage of successful packet handling)
+   - Route reliability (which specific route combinations work best)
+4. Results are stored in the database and used by `nym-api` to:
+   - Present node performance statistics
+   - Determine network rewards
+   - Provide route selection guidance to clients
+
+In the current branch, metrics collection is being enhanced with a fanout approach to submit to multiple API endpoints.
+
+## Development Environment
+
+### Required Dependencies
+
+- Rust toolchain (stable, 1.80+)
+- Node.js (v20+) and yarn for TypeScript components
+- SQLite for local database development
+- PostgreSQL for API database (optional, for full API functionality)
+- CosmWasm tools for contract development
+- For building contracts: `wasm-opt` tool from `binaryen`
+- Python 3.8+ for some scripts
+- Docker (optional, for containerized development)
+- protoc (Protocol Buffers compiler) for some components
+
+### Environment Configurations
+
+The `envs/` directory contains pre-configured environments:
+
+#### Available Environments
+
+- **`local.env`**: Local development environment
+  - Points to local services (localhost)
+  - Uses test mnemonics and keys
+  - Ideal for testing without external dependencies
+
+- **`sandbox.env`**: Sandbox test network
+  - Public test network with real nodes
+  - Test tokens available from faucet
+  - Contract addresses for sandbox deployment
+  - API: https://sandbox-nym-api1.nymtech.net
+
+- **`mainnet.env`**: Production mainnet
+  - Real network with real tokens
+  - Production contract addresses
+  - API: https://validator.nymtech.net
+  - Use with caution!
+
+- **`canary.env`**: Canary deployment
+  - Pre-release testing environment
+  - Tests new features before mainnet
+
+- **`mainnet-local-api.env`**: Hybrid environment
+  - Uses mainnet contracts but local API
+  - Useful for API development against mainnet data
+
+#### Key Environment Variables
+
+```bash
+# Network configuration
+NETWORK_NAME=sandbox              # Network identifier
+BECH32_PREFIX=n                   # Address prefix (n for sandbox, n for mainnet)
+NYM_API=https://sandbox-nym-api1.nymtech.net/api
+NYXD=https://rpc.sandbox.nymtech.net
+NYM_API_NETWORK=sandbox
+
+# Contract addresses (network-specific)
+MIXNET_CONTRACT_ADDRESS=n1xr3rq8yvd7qplsw5yx90ftsr2zdhg4e9z60h5duusgxpv72hud3sjkxkav
+VESTING_CONTRACT_ADDRESS=n1unyuj8qnmygvzuex3dwmg9yzt9alhvyeat0uu0jedg2wj33efl5qackslz
+# ... other contract addresses
+
+# Mnemonic for testing (NEVER use in production)
+MNEMONIC="clutch captain shoe salt awake harvest setup primary inmate ugly among become"
+
+# API Keys and tokens
+IPINFO_API_TOKEN=your_token_here
+AUTHENTICATOR_PASSWORD=password_here
+
+# Logging
+RUST_LOG=info                    # Options: error, warn, info, debug, trace
+RUST_BACKTRACE=1                # Enable backtraces
+
+# Database
+DATABASE_URL=postgresql://user:pass@localhost/nym_api
+```
+
+#### Using Environment Files
+
+```bash
+# Load environment and run command
+dotenv -f envs/sandbox.env -- cargo run -p nym-api
+
+# Export to shell
+source envs/sandbox.env
+
+# Use with make targets
+dotenv -f envs/sandbox.env -- make run-api-tests
+```
+
+## Initial Setup
+
+### First Time Setup
+
+1. **Install Prerequisites**
+   ```bash
+   # Install Rust
+   curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
+   
+   # Install Node.js and yarn
+   # Via nvm (recommended):
+   curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash
+   nvm install 20
+   npm install -g yarn
+   
+   # Install build tools
+   # Ubuntu/Debian:
+   sudo apt-get install build-essential pkg-config libssl-dev protobuf-compiler libpq-dev
+   
+   # macOS:
+   brew install protobuf postgresql
+   
+   # Install wasm-opt for contract builds
+   npm install -g wasm-opt
+   
+   # Add wasm target for Rust
+   rustup target add wasm32-unknown-unknown
+   ```
+
+2. **Clone and Setup Repository**
+   ```bash
+   git clone https://github.com/nymtech/nym.git
+   cd nym/nym
+   
+   # Install JavaScript dependencies
+   yarn install
+   
+   # Build the project
+   make build
+   ```
+
+3. **Database Setup (Optional, for API development)**
+   ```bash
+   # Install PostgreSQL
+   # Create database
+   createdb nym_api
+   
+   # Run migrations (from nym-api directory)
+   cd nym-api
+   sqlx migrate run
+   ```
+
+### Quick Start
+
+```bash
+# Run a mixnode locally
+dotenv -f envs/sandbox.env -- cargo run -p nym-node -- run --mode mixnode --id my-mixnode
+
+# Run a gateway locally
+dotenv -f envs/sandbox.env -- cargo run -p nym-node -- run --mode gateway --id my-gateway
+
+# Run the API server
+dotenv -f envs/sandbox.env -- cargo run -p nym-api
+
+# Run a client
+cargo run -p nym-client -- init --id my-client
+cargo run -p nym-client -- run --id my-client
+```
+
+## CI/CD Pipeline
+
+The project uses GitHub Actions for CI/CD with several key workflows:
+
+1. **Build and Test**:
+   - `ci-build.yml`: Main build workflow for Rust components
+   - Tests are run on multiple platforms (Linux, Windows, macOS)
+   - Includes formatting check (rustfmt) and linting (clippy)
+
+2. **Release Process**:
+   - Binary artifacts are published on release tags
+   - Multiple platform builds are created
+
+3. **Documentation**:
+   - Documentation is automatically built and deployed
+
+## Database Structure
+
+The system uses SQLite databases with tables like:
+- `mixnode_status`: Status information about mixnodes
+- `gateway_status`: Status information about gateways
+- `routes`: Route performance information (success/failure of specific paths)
+- `monitor_run`: Information about monitoring test runs
+
+## Development Workflows
+
+### Running a Node
+
+To run the mixnode or gateway:
+
+```bash
+# Run nym-node as a mixnode with specified identity
+cargo run -p nym-node -- run --mode mixnode --id my-mixnode
+
+# Run nym-node as a gateway
+cargo run -p nym-node -- run --mode gateway --id my-gateway
+```
+
+### Configuration
+
+Nodes can be configured with files in various locations:
+- Command-line arguments
+- Environment variables
+- `.env` files specified with `--config-env-file`
+
+### Monitoring
+
+To monitor the health of your node:
+- View logs for real-time information
+- Use the node's HTTP API for status information
+- Check the explorer for public node statistics
+
+## Common Libraries
+
+- `common/types`: Shared data types across all components
+- `common/crypto`: Cryptographic primitives and wrappers
+- `common/client-core`: Core client functionality
+- `common/gateway-client`: Client-gateway communication
+- `common/task`: Task management and concurrency utilities
+- `common/nymsphinx`: Sphinx packet implementation for mixnet
+- `common/topology`: Network topology management
+- `common/credentials`: Credential system for privacy-preserving authentication
+- `common/bandwidth-controller`: Bandwidth management and accounting
+
+## Code Conventions
+
+- Error handling: Use anyhow/thiserror for structured error handling
+- Logging: Use the tracing framework for logging and diagnostics
+- State management: Generally use Tokio/futures for async code
+- Configuration: Use the config crate and env vars with defaults
+- Database: Use sqlx for type-safe database queries
+- Follow clippy recommendations and rustfmt formatting
+- Use semantic commit messages: feat, fix, docs, refactor, test, chore
+
+## When Making Changes
+
+- Run `make test` before submitting PRs
+- Follow Rust naming conventions
+- Use `clippy` to check for common issues
+- Update SQLx query caches when modifying DB queries: `cargo sqlx prepare`
+- Consider backward compatibility for protocol changes
+- Use lefthook pre-commit hooks for TypeScript formatting
+- Run `cargo deny check` to verify dependency compliance
+- Test against both sandbox and local environments when possible
+- Update relevant documentation and CHANGELOG.md
+
+## Development Tools
+
+### Useful Cargo Commands
+
+```bash
+# Check for outdated dependencies
+cargo outdated
+
+# Analyze binary size
+cargo bloat --release -p nym-node
+
+# Generate dependency graph
+cargo tree -p nym-api
+
+# Run with instrumentation
+cargo run --features profiling -p nym-node
+
+# Check for security advisories
+cargo audit
+```
+
+### Database Tools
+
+```bash
+# SQLx CLI for migrations
+cargo install sqlx-cli
+
+# Create new migration
+cd nym-api && sqlx migrate add <migration_name>
+
+# Prepare query metadata for offline compilation
+cargo sqlx prepare --workspace
+
+# View database schema
+./nym-api/enter_db.sh
+```
+
+### Development Scripts
+
+- `scripts/build_topology.py`: Generate network topology files
+- `scripts/node_api_check.py`: Verify node API endpoints
+- `scripts/network_tunnel_manager.sh`: Manage network tunnels
+- `scripts/localnet_start.sh`: Start a local test network
+- Various deployment scripts in `deployment/` for different environments
+
+## Debugging
+
+- Enable more verbose logging with the RUST_LOG environment variable:
+  ```
+  RUST_LOG=debug,nym_node=trace cargo run -p nym-node -- run --mode mixnode
+  ```
+- Use the HTTP API endpoints for status information
+- Check monitoring data in the database for network performance metrics
+- For complex issues, use tracing tools to follow packet flow
+- Enable backtraces: `RUST_BACKTRACE=full`
+- For WASM debugging: Use browser developer tools with source maps
+
+## Deployment and Advanced Configurations
+
+### Deployment Structure
+
+The `deployment/` directory contains Ansible playbooks and configurations for various deployment scenarios:
+
+- **`aws/`**: AWS-specific deployment configurations
+- **`mixnode/`**: Mixnode deployment playbooks
+- **`gateway/`**: Gateway deployment playbooks
+- **`validator/`**: Validator node deployment
+- **`sandbox-v2/`**: Complete sandbox environment setup
+- **`big-dipper-2/`**: Block explorer deployment
+
+### Sandbox V2 Deployment
+
+The sandbox-v2 deployment (`deployment/sandbox-v2/`) provides a complete test environment:
+
+```bash
+# Key playbooks:
+- deploy.yaml              # Main deployment orchestrator
+- deploy-mixnodes.yaml    # Deploy mixnodes
+- deploy-gateways.yaml    # Deploy gateways
+- deploy-validators.yaml  # Deploy validator nodes
+- deploy-nym-api.yaml     # Deploy API services
+```
+
+### Custom Environment Setup
+
+To create a custom environment:
+
+1. Copy an existing env file: `cp envs/sandbox.env envs/custom.env`
+2. Modify the network endpoints and contract addresses
+3. Update the `NETWORK_NAME` to your identifier
+4. Set appropriate mnemonics and keys (use fresh ones for production!)
+
+### Contract Addresses
+
+Contract addresses are network-specific and defined in environment files:
+- Mixnet contract: Manages mixnode/gateway registry
+- Vesting contract: Handles token vesting schedules
+- Coconut contracts: Privacy-preserving credentials
+- Name service: Human-readable address mapping
+- Ecash contract: Electronic cash functionality
+
+### Local Network Setup
+
+For a completely local network:
+```bash
+# Start local chain
+./scripts/localnet_start.sh
+
+# Deploy contracts
+cd contracts
+make deploy-local
+
+# Start nodes with local config
+dotenv -f envs/local.env -- cargo run -p nym-node -- run --mode mixnode
+```
+
+## Common Issues and Troubleshooting
+
+### Database Issues
+
+- When modifying database queries, you must update SQLx query caches:
+  ```bash
+  cargo sqlx prepare
+  ```
+- If you see SQLx errors about missing query files, this is likely the cause
+- For "database is locked" errors with SQLite, ensure only one process accesses the DB
+- For PostgreSQL connection issues, verify DATABASE_URL and that the server is running
+
+### API Connection Issues
+
+- Check the environment variables pointing to the APIs (NYM_API, NYXD)
+- Verify network connectivity and API health endpoints
+- For authentication issues, check node keys and credentials
+- Common endpoints to verify:
+  - API health: `$NYM_API/health`
+  - Chain status: `$NYXD/status`
+  - Contract info: `$NYXD/cosmwasm/wasm/v1/contract/$CONTRACT_ADDRESS`
+
+### Build Problems
+
+- Clean dependencies with `cargo clean` for a fresh build
+- Check for compatible Rust version (1.80+ recommended)
+- For smart contract builds, ensure wasm-opt is installed: `npm install -g wasm-opt`
+- For cross-compilation issues, check target-specific dependencies
+- WASM build issues: Ensure wasm32-unknown-unknown target is installed:
+  ```bash
+  rustup target add wasm32-unknown-unknown
+  ```
+- For "cannot find -lpq" errors, install PostgreSQL development files:
+  ```bash
+  # Ubuntu/Debian
+  sudo apt-get install libpq-dev
+  # macOS
+  brew install postgresql
+  ```
+
+### Environment Issues
+
+- Contract address mismatches: Ensure you're using the correct environment file
+- "Account sequence mismatch": The account nonce is out of sync, wait and retry
+- Token decimal issues: Sandbox uses different decimal places than mainnet
+- API version mismatches: Ensure your local API version matches the network
+- "Insufficient funds": Get test tokens from faucet (sandbox) or check balance
+- Gateway/mixnode bonding issues: Verify minimum stake requirements
+
+## Working with Routes and Monitoring
+
+1. Route monitoring metrics are stored in a `routes` table with:
+   - Layer node IDs (layer1, layer2, layer3, gw)
+   - Success flag (boolean)
+   - Timestamp
+
+2. To analyze routes:
+   - Check `NetworkAccount` and `AccountingRoute` in `nym-network-monitor/src/accounting.rs`
+   - View monitoring logic in `common/nymsphinx/chunking/monitoring.rs`
+   - Observe how routes are submitted to the database in the `submit_accounting_routes_to_db` function
+
+## Performance Optimization
+
+### Profiling and Benchmarking
+
+```bash
+# Run benchmarks
+cargo bench -p nym-node
+
+# Profile with perf (Linux)
+cargo build --release --features profiling
+perf record --call-graph=dwarf ./target/release/nym-node run --mode mixnode
+perf report
+
+# Generate flamegraph
+cargo install flamegraph
+cargo flamegraph --bin nym-node -- run --mode mixnode
+```
+
+### Common Performance Considerations
+
+- Use bounded channels for backpressure
+- Batch database operations where possible
+- Monitor memory usage with `RUST_LOG=nym_node::metrics=debug`
+- Use connection pooling for database connections
+- Consider using `jemalloc` for better memory allocation performance
@@ -72,10 +72,6 @@ members = [
    "common/nym-cache",
    "common/nym-connection-monitor",
    "common/nym-id",
-    "common/nym-kcp",
-    "common/nym-lp",
-    "common/nym-lp-common",
-    "common/nym-kkt",
    "common/nym-metrics",
    "common/nym_offline_compact_ecash",
    "common/nymnoise",
@@ -91,9 +87,7 @@ members = [
    "common/nymsphinx/params",
    "common/nymsphinx/routing",
    "common/nymsphinx/types",
-    "common/nyxd-scraper-sqlite",
-    "common/nyxd-scraper-psql",
-    "common/nyxd-scraper-shared",
+    "common/nyxd-scraper",
    "common/pemstore",
    "common/registration",
    "common/serde-helpers",
@@ -130,7 +124,6 @@ members = [
    "nym-credential-proxy/nym-credential-proxy",
    "nym-credential-proxy/nym-credential-proxy-requests",
    "nym-credential-proxy/vpn-api-lib-wasm",
-    "nym-data-observatory",
    "nym-ip-packet-client",
    "nym-network-monitor",
    "nym-node",
@@ -157,14 +150,13 @@ members = [
    "tools/internal/contract-state-importer/importer-cli",
    "tools/internal/contract-state-importer/importer-contract",
    "tools/internal/mixnet-connectivity-check",
-    #    "tools/internal/sdk-version-bump",
+    # "tools/internal/sdk-version-bump",
    "tools/internal/ssl-inject",
    "tools/internal/testnet-manager",
    "tools/internal/testnet-manager/dkg-bypass-contract",
    "tools/internal/validator-status-check",
    "tools/nym-cli",
    "tools/nym-id-cli",
-    "tools/nym-lp-client",
    "tools/nym-nr-query",
    "tools/nymvisor",
    "tools/ts-rs-cli",
@@ -173,14 +165,12 @@ members = [
    "wasm/mix-fetch",
    "wasm/node-tester",
    "wasm/zknym-lib",
-    "nym-gateway-probe",
-    "integration-tests", "common/nym-lp-transport",
+    "nym-gateway-probe"
 ]

 default-members = [
    "clients/native",
    "clients/socks5",
-    "nym-authenticator-client",
    "nym-api",
    "nym-credential-proxy/nym-credential-proxy",
    "nym-node",
@@ -192,7 +182,6 @@ default-members = [
    "service-providers/ip-packet-router",
    "service-providers/network-requester",
    "tools/nymvisor",
-    "nym-registration-client"
 ]

 exclude = ["contracts", "nym-wallet", "cpu-cycles"]
@@ -214,7 +203,6 @@ aes = "0.8.1"
 aes-gcm = "0.10.1"
 aes-gcm-siv = "0.11.1"
 ammonia = "4"
-ansi_term = "0.12"
 anyhow = "1.0.98"
 arc-swap = "1.7.1"
 argon2 = "0.5.0"
@@ -254,7 +242,6 @@ criterion = "0.5"
 csv = "1.3.1"
 ctr = "0.9.1"
 cupid = "0.6.1"
-curve25519-dalek = "4.1.3"
 dashmap = "5.5.3"
 # We want https://github.com/DefGuard/wireguard-rs/pull/64 , but there's no crates.io release being pushed out anymore
 defguard_wireguard_rs = { git = "https://github.com/DefGuard/wireguard-rs.git", rev = "v0.4.7" }
@@ -275,10 +262,9 @@ futures = "0.3.31"
 futures-util = "0.3"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
-glob = "0.3"
 handlebars = "3.5.5"
 hex = "0.4.3"
-hickory-resolver = "0.25.2"
+hickory-resolver = "0.25"
 hkdf = "0.12.3"
 hmac = "0.12.1"
 http = "1"
@@ -295,9 +281,7 @@ inventory = "0.3.21"
 ip_network = "0.4.1"
 ipnetwork = "0.20"
 itertools = "0.14.0"
-jwt-simple = { version = "0.12.12", default-features = false, features = [
-    "pure-rust",
-] }
+jwt-simple = { version = "0.12.12", default-features = false, features = ["pure-rust"] }
 k256 = "0.13"
 lazy_static = "1.5.0"
 ledger-transport = "0.10.0"
@@ -307,7 +291,6 @@ mime = "0.3.17"
 moka = { version = "0.12", features = ["future"] }
 nix = "0.27.1"
 notify = "5.1.0"
-num_enum = "0.7.5"
 once_cell = "1.21.3"
 opentelemetry = "0.19.0"
 opentelemetry-jaeger = "0.18.0"
@@ -338,7 +321,7 @@ serde_repr = "0.1"
 serde_with = "3.9.0"
 serde_yaml = "0.9.25"
 serde_plain = "1.0.2"
-sha2 = "0.10.3"
+sha2 = "0.10.9"
 si-scale = "0.2.3"
 snow = "0.9.6"
 sphinx-packet = "=0.6.0"
@@ -354,7 +337,6 @@ test-with = { version = "0.15.4", default-features = false }
 tempfile = "3.20"
 thiserror = "2.0"
 time = "0.3.41"
-tls_codec = "0.4.1"
 tokio = "1.47"
 tokio-postgres = "0.7"
 tokio-stream = "0.1.17"
@@ -364,11 +346,11 @@ tokio-tungstenite = { version = "0.20.1" }
 tokio-util = "0.7.15"
 toml = "0.8.22"
 tower = "0.5.2"
-tower-http = "0.6.6"
+tower-http = "0.5.2"
 tracing = "0.1.41"
 tracing-log = "0.2"
 tracing-opentelemetry = "0.19.0"
-tracing-subscriber = "0.3.20"
+tracing-subscriber = "0.3.19"
 tracing-tree = "0.2.2"
 tracing-indicatif = "0.3.9"
 tracing-test = "0.2.5"
@@ -415,9 +397,7 @@ cw-multi-test = "=2.3.2"
 bip32 = { version = "0.5.3", default-features = false }


-cosmrs = { version = "0.22.0" }
-cosmos-sdk-proto = { version = "0.27.0" }
-ibc-proto = { version = "0.52.0" }
+cosmrs = { version = "0.21.1" }
 tendermint = "0.40.4"
 tendermint-rpc = "0.40.4"
 prost = { version = "0.13", default-features = false }
@@ -473,11 +453,6 @@ opt-level = 'z'
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(tokio_unstable)'] }

 [workspace.lints.clippy]
-suspicious = "deny"
-complexity = "deny"
-perf = "deny"
-style = "deny"
-
 unwrap_used = "deny"
 expect_used = "deny"
 todo = "deny"
@@ -107,16 +107,16 @@ sdk-wasm-build:
 	$(MAKE) -C nym-browser-extension/storage wasm-pack
 	$(MAKE) -C wasm/client
 	$(MAKE) -C wasm/node-tester
-	$(MAKE) -C wasm/mix-fetch
+	# $(MAKE) -C wasm/mix-fetch
 	$(MAKE) -C wasm/zknym-lib
 	# $(MAKE) -C wasm/full-nym-wasm

 # run this from npm/yarn to ensure tools are in the path, e.g. yarn build:sdk from root of repo
 sdk-typescript-build:
 	npx lerna run --scope @nymproject/sdk build --stream
-	npx lerna run --scope @nymproject/mix-fetch build --stream
-	npx lerna run --scope @nymproject/node-tester build --stream
-	yarn --cwd sdk/typescript/codegen/contract-clients build
+	# npx lerna run --scope @nymproject/mix-fetch build --stream
+	# npx lerna run --scope @nymproject/node-tester build --stream
+	# yarn --cwd sdk/typescript/codegen/contract-clients build

 # NOTE: These targets are part of the main workspace (but not as wasm32-unknown-unknown)
 WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm zknym-lib
@@ -1,191 +0,0 @@
-# config file for ansible -- http://ansible.com/
-# ==============================================
-
-# nearly all parameters can be overridden in ansible-playbook 
-# or with command line flags. ansible will read ANSIBLE_CONFIG,
-# ansible.cfg in the current working directory, .ansible.cfg in
-# the home directory or /etc/ansible/ansible.cfg, whichever it
-# finds first
-
-[defaults]
-# some basic default values...
-
-inventory       = inventory/all
-#library        = /usr/share/my_modules/
-remote_tmp     = $HOME/.ansible/tmp
-pattern        = *
-forks          = 5
-poll_interval  = 15
-transport      = smart
-remote_port    = 22
-module_lang    = C
-
-# plays will gather facts by default, which contain information about
-# the remote system.
-#
-# smart - gather by default, but don't regather if already gathered
-# implicit - gather by default, turn off with gather_facts: False
-# explicit - do not gather by default, must say gather_facts: True
-gathering = implicit
-
-# additional paths to search for roles in, colon separated
-roles_path    = ../roles
-
-# uncomment this to disable SSH key host checking
-host_key_checking = False
-
-# what flags to pass to sudo
-#sudo_flags = -H
-
-# SSH timeout
-timeout = 100
-
-# default user to use for playbooks if user is not specified
-# (/usr/bin/ansible will use current user as default)
-#remote_user = root
-
-# logging is off by default unless this path is defined
-# if so defined, consider logrotate
-#log_path = /var/log/ansible.log
-
-# default module name for /usr/bin/ansible
-#module_name = command
-
-# use this shell for commands executed under sudo
-# you may need to change this to bin/bash in rare instances
-# if sudo is constrained
-#executable = /bin/sh
-
-# if inventory variables overlap, does the higher precedence one win
-# or are hash values merged together?  The default is 'replace' but
-# this can also be set to 'merge'.
-#hash_behaviour = replace
-
-# list any Jinja2 extensions to enable here:
-#jinja2_extensions = jinja2.ext.do,jinja2.ext.i18n
-
-# if set, always use this private key file for authentication, same as 
-# if passing --private -key to ansible or ansible-playbook
-#private_key_file = /path/to/file
-
-# format of string {{ ansible_managed }} available within Jinja2 
-# templates indicates to users editing templates files will be replaced.
-# replacing {file}, {host} and {uid} and strftime codes with proper values.
-ansible_managed = Ansible managed: {file} modified on %Y-%m-%d %H:%M:%S by {uid} on {host}
-
-# by default, ansible-playbook will display "Skipping [host]" if it determines a task
-# should not be run on a host.  Set this to "False" if you don't want to see these "Skipping" 
-# messages. NOTE: the task header will still be shown regardless of whether or not the 
-# task is skipped.
-#display_skipped_hosts = True
-
-# by default (as of 1.3), Ansible will raise errors when attempting to dereference 
-# Jinja2 variables that are not set in templates or action lines. Uncomment this line
-# to revert the behavior to pre-1.3.
-#error_on_undefined_vars = False
-
-# by default (as of 1.6), Ansible may display warnings based on the configuration of the
-# system running ansible itself. This may include warnings about 3rd party packages or
-# other conditions that should be resolved if possible.
-# to disable these warnings, set the following value to False:
-#system_warnings = True
-
-# by default (as of 1.4), Ansible may display deprecation warnings for language
-# features that should no longer be used and will be removed in future versions.
-# to disable these warnings, set the following value to False:
-#deprecation_warnings = True
-
-# (as of 1.8), Ansible can optionally warn when usage of the shell and
-# command module appear to be simplified by using a default Ansible module
-# instead.  These warnings can be silenced by adjusting the following
-# setting or adding warn=yes or warn=no to the end of the command line 
-# parameter string.  This will for example suggest using the git module
-# instead of shelling out to the git command.
-# command_warnings = False
-
-
-# set plugin path directories here, separate with colons
-action_plugins     = ../../other/plugins/action
-callback_plugins   = ../../other/plugins/callback
-connection_plugins = ../../other/plugins/connection
-lookup_plugins     = ../../other/plugins/lookup
-vars_plugins       = ../../other/plugins/vars
-filter_plugins     = ../../other/plugins/filter
-
-# by default callbacks are not loaded for /bin/ansible, enable this if you
-# want, for example, a notification or logging callback to also apply to 
-# /bin/ansible runs
-#bin_ansible_callbacks = False
-
-
-# don't like cows?  that's unfortunate.
-# set to 1 if you don't want cowsay support or export ANSIBLE_NOCOWS=1 
-#nocows = 1
-
-# don't like colors either?
-# set to 1 if you don't want colors, or export ANSIBLE_NOCOLOR=1
-#nocolor = 1
-
-# the CA certificate path used for validating SSL certs. This path 
-# should exist on the controlling node, not the target nodes
-# common locations:
-# RHEL/CentOS: /etc/pki/tls/certs/ca-bundle.crt
-# Fedora     : /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
-# Ubuntu     : /usr/share/ca-certificates/cacert.org/cacert.org.crt
-#ca_file_path = 
-
-# the http user-agent string to use when fetching urls. Some web server
-# operators block the default urllib user agent as it is frequently used
-# by malicious attacks/scripts, so we set it to something unique to 
-# avoid issues.
-#http_user_agent = ansible-agent
-
-# if set to a persistant type (not 'memory', for example 'redis') fact values
-# from previous runs in Ansible will be stored.  This may be useful when
-# wanting to use, for example, IP information from one group of servers
-# without having to talk to them in the same playbook run to get their
-# current IP information.
-fact_caching = memory
-
-[paramiko_connection]
-
-# uncomment this line to cause the paramiko connection plugin to not record new host
-# keys encountered.  Increases performance on new host additions.  Setting works independently of the
-# host key checking setting above.
-#record_host_keys=False
-
-# by default, Ansible requests a pseudo-terminal for commands executed under sudo. Uncomment this
-# line to disable this behaviour.
-#pty=False
-
-[ssh_connection]
-
-# ssh arguments to use
-# Leaving off ControlPersist will result in poor performance, so use 
-# paramiko on older platforms rather than removing it
-#ssh_args = -o ControlMaster=auto -o ControlPersist=60s
-
-# The path to use for the ControlPath sockets. This defaults to
-# "%(directory)s/ansible-ssh-%%h-%%p-%%r", however on some systems with
-# very long hostnames or very long path names (caused by long user names or 
-# deeply nested home directories) this can exceed the character limit on
-# file socket names (108 characters for most platforms). In that case, you 
-# may wish to shorten the string below.
-# 
-# Example: 
-# control_path = %(directory)s/%%h-%%r
-#control_path = %(directory)s/ansible-ssh-%%h-%%p-%%r
-
-# Enabling pipelining reduces the number of SSH operations required to 
-# execute a module on the remote server. This can result in a significant 
-# performance improvement when enabled, however when using "sudo:" you must 
-# first disable 'requiretty' in /etc/sudoers
-#
-# By default, this option is disabled to preserve compatibility with
-# sudoers configurations that have requiretty (the default on many distros).
-# 
-#pipelining = False
-
-# if True, make ansible use scp if the connection type is ssh 
-# (default is sftp)
-scp_if_ssh = True
@@ -1,8 +0,0 @@
---
- name: Nym node bonding / post-installation
-  hosts: all    # or a specific host/group
-  gather_facts: false
-  serial: 1  
-
-  roles:
-    - role: postinstall
@@ -1,10 +0,0 @@
---
- name: "Deploy Nym node"
-  hosts: all    # or a specific host/group
-  become: true
-  roles:
-    - base
-    - nym
-    - nginx
-    - tunnel # comment out for mixnode
-    - quic   # comment out for mixnode or non-wireguard gateway
@@ -1,44 +0,0 @@
---
-ansible_ssh_private_key_file: ~/.ssh/<SSH_KEY>
-
-# nym_version: "v2025.21-mozzarella"
-#
-# NOTE:
-# if you want to pin Nym to a specific version instead of using the
-# latest release from GitHub in /tasks/main.yml then
-# uncomment the line above and set the tag
-
-cli_url: "https://github.com/nymtech/nym/releases/download/nym-binaries-{{ nym_version }}/nym-cli"
-tunnel_manager_url: "https://github.com/nymtech/nym/raw/refs/heads/develop/scripts/nym-node-setup/network-tunnel-manager.sh"
-quic_bridge_deployment_url: "https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/nym-node-setup/quic_bridge_deployment.sh"
-
-# NOTE: These values will be used globally unless overwritten per node in inventory/all
-ansible_user: root                         # used for ssh, like `ssh root@nym-exit.ch-1.mynodes.net`
-email: "<EMAIL>"                           # used in certbot, description.toml and landing page
-website: "<WEBSITE>"                       # it is used in the description.toml
-description: "<NODE_PUBLIC_DESCRIPTION>"   # or define per node in inventory/all
-
-# NOTE: Set these vars if you want them globally for all nodes
-# Per node changes in inventory/all will overwrite these global ones:
-hostname: ""                                # this is a fallback, keep it and setup hostname per node in inventory/all
-# moniker: "<MONIKER>"                      # if not setup here not in inventory/all it get's derived from the hostname
-# mode: <MODE>                              # entry-gateway/exit-gateway/mixnode
-# wireguard_enabled: <WIREGUARD_ENABLED>    # true/false
-
-# NOTE: Possible vars to incule on landing page, etc.
-# operator_name: "<OPERATOR_NAME>"
-
-packages:
-  - tmux
-  - speedtest-cli
-  - nano
-  - htop
-  - git
-  - zip
-  - nala
-  - curl
-  - neovim
-  - ca-certificates
-  - jq
-  - wget
-  - ufw
@@ -1,34 +0,0 @@
-[nym_nodes]
-# READ CONFIGURATION GUIDE:
-# https://nym.com//docs/operators/orchestration/ansible#configuration
-
-# VARIABLES INFO
-# required vars to set values per node: 
-# `ansible_host`, `hostname`, `location`
-
-# global vars can be set in the group_vars/all.yml, for example:
-# `email`, `ansible_user`, `moniker`, `description`,  `mode`, `wireguard_enabled`
-# othersise they must be set per node!
-
-############
-# TEMPLATE #
-############
-# node1 ansible_host=<YOUR_SERVER_IP> ansible_user=<USER> hostname=<HOSTNAME> location=<LOCATION> email=<EMAIL> mode=<MODE> wireguard_enabled=<true/false> moniker=<MONIKER> description=<DESCRIPTION>
-
-# remove all comments and exchange the <VARIABLES> with your real values for each node
-# without <> brackets
-
-# PRIORITY ORDER
-# anything setup globaly can be overwritten in this file per node  
-# if provided here, it takes priority over the global setting
-
-# EXAMPLES
-# exit + wireguard gateway:
-# node2 ansible_host=11.12.13.14 hostname=nym-exit.ch-1.mydomain.net mode=exit-gateway location=CH wireguard_enabled=true
-
-# entry gateway, no wireguard:
-# node3 ansible_host=12.13.14.15 hostname=nym-entry.ch-2.mydomain.net mode=entry-gateway location=CH wireguard_enabled=false
-
-# NOTE:
-# all examples above don't have defined user, email nor description as we use the definition from group_vars/main.yml without an attempt of overwriting it
-# all examples above don't have moniker defined as there is a function in /templates/description.toml.j2 deriving it from the hostname
@@ -1,9 +0,0 @@
---
- name: "Upgrade Nym node"
-  hosts: all    # or a specific host/group or limit via -l on CLI (ansible-playbook playbooks/upgrade.yml -l mynode1)
-  become: true
-  serial: 1
-  
-  roles:
-    - base
-    - upgrade
@@ -1,23 +0,0 @@
---
- name: Set hostname
-  hostname:
-    name: "{{ hostname }}"
-  when: hostname is defined and hostname | length > 0
-
- name: Install aptitude
-  apt:
-    name: aptitude
-    update_cache: yes
-    state: present
-    force_apt_get: yes
-
- name: Update packages
-  apt:
-    update_cache: yes
-    upgrade: yes
-
- name: Install essential packages
-  package:
-    name: "{{ packages }}"
-    state: latest
-    update_cache: yes
@@ -1,10 +0,0 @@
---
- name: Reload nginx
-  service:
-    name: nginx
-    state: reloaded
-
- name: Restart nginx
-  service:
-    name: nginx
-    state: restarted
@@ -1,173 +0,0 @@
---
- name: Install nginx and certbot
-  apt:
-    name:
-      - nginx
-      - certbot
-      - python3-certbot-nginx
-    state: present
-    update_cache: yes
-
- name: Ensure nginx snippets directory exists
-  file:
-    path: /etc/nginx/snippets
-    state: directory
-    mode: "0755"
-
-# own SSL defaults - don't rely on certbot files
- name: Install Nym SSL options snippet
-  copy:
-    dest: /etc/nginx/snippets/nym-ssl-options.conf
-    mode: "0644"
-    content: |
-      ssl_session_cache shared:NYMSSL:10m;
-      ssl_session_timeout 1d;
-      ssl_session_tickets off;
-
-      ssl_protocols TLSv1.2 TLSv1.3;
-      ssl_prefer_server_ciphers off;
-
-      # Reasonable modern cipher set (works across Ubuntu nginx builds)
-      ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305";
-
-      # OCSP stapling is nice but can break if resolver isn't set; keep minimal here.
-  notify: Restart nginx
-
- name: Ensure web root directory exists
-  file:
-    path: "/var/www/{{ hostname }}"
-    state: directory
-    mode: "0755"
-
- name: Deploy landing page
-  template:
-    src: landing.html.j2
-    dest: "/var/www/{{ hostname }}/index.html"
-    mode: "0644"
-  notify: Restart nginx
-
-# remove default site - safe on fresh + redeploy
- name: Disable default nginx site symlink
-  file:
-    path: /etc/nginx/sites-enabled/default
-    state: absent
-  notify: Restart nginx
-
- name: Remove default nginx site definition if present
-  file:
-    path: /etc/nginx/sites-available/default
-    state: absent
-  notify: Restart nginx
-
-# always deploy/enable HTTP vhost
- name: Deploy HTTP vhost
-  template:
-    src: nginx-site.conf.j2
-    dest: "/etc/nginx/sites-available/{{ hostname }}"
-    mode: "0644"
-  notify: Restart nginx
-
- name: Enable HTTP vhost (force correct symlink)
-  file:
-    src: "/etc/nginx/sites-available/{{ hostname }}"
-    dest: "/etc/nginx/sites-enabled/{{ hostname }}"
-    state: link
-    force: true
-  notify: Restart nginx
-
-# detect if cert exists already
- name: Check whether certificate exists
-  stat:
-    path: "/etc/letsencrypt/live/{{ hostname }}/fullchain.pem"
-  register: le_cert
-
-# if cert does NOT exist yet, ensure SSL/WSS are NOT enabled
- name: Ensure SSL and WSS vhosts are disabled until cert exists
-  file:
-    path: "{{ item }}"
-    state: absent
-  loop:
-    - "/etc/nginx/sites-enabled/{{ hostname }}-ssl"
-    - "/etc/nginx/sites-enabled/nym-wss-config"
-  when: not le_cert.stat.exists
-  notify: Restart nginx
-
- name: Ensure nginx is enabled and running (needed for ACME http-01)
-  service:
-    name: nginx
-    state: started
-    enabled: yes
-
- name: Validate nginx configuration (HTTP stage)
-  command: nginx -t
-  changed_when: false
-
- name: Flush handlers (ensure HTTP is active before certbot)
-  meta: flush_handlers
-
-# certbot strategy:
-# - if cert exists: webroot - doesn't touch nginx
-# - else:  --nginx works first-time; may touch nginx
- name: Obtain/renew certificate
-  command:
-    cmd: >-
-      {% if le_cert.stat.exists %}
-      certbot certonly --webroot
-      -w /var/www/{{ hostname }}
-      --non-interactive --agree-tos --keep-until-expiring
-      -m {{ email }} -d {{ hostname }}
-      {% else %}
-      certbot --nginx
-      --non-interactive --agree-tos --redirect
-      -m {{ email }} -d {{ hostname }}
-      {% endif %}
-  register: certbot_result
-  failed_when: false
-
-# re-check cert after certbot attempt
- name: Re-check whether certificate exists after certbot
-  stat:
-    path: "/etc/letsencrypt/live/{{ hostname }}/fullchain.pem"
-  register: le_cert_after
-
-# only deploy/enable SSL & WSS if cert exists
- name: Deploy HTTPS vhost for {{ hostname }}
-  template:
-    src: nginx-site-ssl.conf.j2
-    dest: "/etc/nginx/sites-available/{{ hostname }}-ssl"
-    mode: "0644"
-  when: le_cert_after.stat.exists
-  notify: Restart nginx
-
- name: Enable HTTPS vhost (force correct symlink)
-  file:
-    src: "/etc/nginx/sites-available/{{ hostname }}-ssl"
-    dest: "/etc/nginx/sites-enabled/{{ hostname }}-ssl"
-    state: link
-    force: true
-  when: le_cert_after.stat.exists
-  notify: Restart nginx
-
- name: Deploy WSS vhost
-  template:
-    src: wss-config.conf.j2
-    dest: "/etc/nginx/sites-available/nym-wss-config"
-    mode: "0644"
-  when: le_cert_after.stat.exists
-  notify: Restart nginx
-
- name: Enable WSS vhost (force correct symlink)
-  file:
-    src: "/etc/nginx/sites-available/nym-wss-config"
-    dest: "/etc/nginx/sites-enabled/nym-wss-config"
-    state: link
-    force: true
-  when: le_cert_after.stat.exists
-  notify: Restart nginx
-
- name: Validate nginx configuration (final)
-  command: nginx -t
-  changed_when: false
-
- name: Flush handlers (apply restart after successful tests)
-  meta: flush_handlers
@@ -1,218 +0,0 @@
-<!DOCTYPE html>
-<html lang="en-US">
-<head>
-<meta charset="UTF-8">
-<title>This is a NYM Exit Gateway</title>
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<link rel="icon" type="image/png" href="">
-
-<style>
-:root {
-  /* font + theme tokens */
-  font-family: Consolas, "Ubuntu Mono", Menlo, "DejaVu Sans Mono", monospace;
-  --background-color: #242B2D;
-  --text-color: #FFFFFF;
-  --link-color: #07ff94;
-  --title-color: #07ff94;
-}
-
-html {
-  background: var(--background-color);
-}
-
-body {
-  margin-left: auto;
-  margin-right: auto;
-  padding-left: 5vw;
-  padding-right: 5vw;
-  max-width: 1000px;
-  color: var(--text-color); /* default text color */
-}
-
-h1 {
-  font-size: 55px;
-  text-align: center;
-  color: var(--title-color);
-}
-
-p {
-  color: var(--text-color);
-}
-
-p, a {
-  font-size: 20px;
-}
-
-a {
-  color: var(--link-color);
-  text-decoration: none;
-}
-
-a:hover {
-  filter: brightness(.8);
-  text-decoration: underline;
-}
-
-.links {
-  display: flex;
-  flex-wrap: wrap;
-  justify-content: space-evenly;
-}
-
-.links > a {
-  margin: 10px;
-  white-space: nowrap;
-}
-</style>
-</head>
-
-<body>
-<main>
-  <h1>This is a NYM Exit Gateway</h1>
-
-
-  <p>
-    You are most likely accessing this website because you've had some issue with
-    the traffic coming from this IP. This router is part of the <a
-    href="https://nym.com/">NYM project</a>, which is
-    dedicated to <a href="https://nym.com/about/mission">create</a> outstanding
-    privacy software that is legally compliant without sacrificing integrity or
-    having any backdoors.
-    This router IP should be generating no other traffic, unless it has been
-    compromised.
-  </p>
-
-  <p><strong>
-    If you are a representative of a company who feels that this router is being
-    used to violate the DMCA, please be aware that this machine does not host or
-    contain any illegal content. Also be aware that network infrastructure
-    maintainers are not liable for the type of content that passes over their
-    equipment, in accordance with <a
-    href="https://www.law.cornell.edu/uscode/text/17/512">DMCA
-    "safe harbor" provisions</a>. In other words, you will have just as much luck
-    sending a takedown notice to the Internet backbone providers.
-  </strong></p>
-
-  <p>
-    Nym Network is operated by a decentralised community of node operators
-    and stakers. Nym Network is trustless, meaning that no parts of the system
-    nor its operators have access to information that might compromise the privacy
-    of users. Nym software enacts a strict principle of data minimisation and has
-    no back doors. The Nym mixnet works by encrypting packets in several layers
-    and relaying those through a multi-layered network called a mixnet,  eventually
-    letting the traffic exit the Nym mixnet through an exit gateway like this one.
-    This design makes it impossible for a service to know which user is connecting to it,
-    since it can only see the IP-address of the Nym exit gateway:
-  </p>
-
-  <p style="text-align:center;margin:40px 0">
-    <svg xmlns="http://www.w3.org/2000/svg" width="500" viewBox="0 0 490.28 293.73" style="width:100%;max-width:600px" role="img" aria-label="Diagram of how a user connects through the Nym network">
-      <desc>Illustration showing how a user might connect to a service through the Nym Network. The user first sends their data through three daisy-chained encrypted Nym nodes that exist on three different continents. Then the last Nym node in the chain connects to the target service over the normal internet.</desc>
-      <defs>
-        <style>
-          .t {
-            fill: var(--text-color);
-            stroke: var(--text-color);
-          }
-        </style>
-      </defs>
-      <!-- (SVG content left unchanged) -->
-      <path fill="#6fc8b7" d="M257.89 69.4c-6.61-6.36-10.62-7.73-18.36-8.62-7.97-1.83-20.06-7.99-24.17-.67-3.29 5.85-18.2 12.3-16.87 2.08.92-7.03 11.06-13.28 17-17.37 8.69-5.99 24.97-2.87 26.1-10.28 1.04-6.86-8.33-13.22-8.55-2.3-.38 12.84-19.62 2.24-8.73-6.2 8.92-6.9 16.05-9.02 25.61-6.15 12.37 4.83 25.58-2.05 33.73-.71 12.37-2.01 24.69-5.25 37.39-3.96 13 .43 24.08-.14 37.06.63 9.8 1.58 16.5 2.87 26.37 3.6 6.6.48 17.68-.82 24.3 1.9 8.3 4.24.44 10.94-6.89 11.8-8.79 1.05-23.59-1.19-26.6 1.86-5.8 7.41 10.75 5.68 11.27 14.54.57 9.45-5.42 9.38-8.72 16-2.7 4.2.3 13.93-1.18 18.45-1.85 5.64-19.64 4.47-14.7 14.4 4.16 8.34 1.17 19.14-10.33 12.02-5.88-3.65-9.85-22.04-15.66-21.9-11.06.27-11.37 13.18-12.7 17.52-1.3 4.27-3.79 2.33-6-.63-3.54-4.76-7.75-14.22-12.01-17.32-6.12-4.46-10.75-1.17-15.55 2.83-5.63 4.69-8.78 7.82-7.46 16.5.78 9.1-12.9 15.84-14.98 24.09-2.61 10.32-2.57 22.12-8.81 31.47-4 5.98-14.03 20.12-21.27 14.97-7.5-5.34-7.22-14.6-9.56-23.08-2.5-9.02.6-17.35-2.57-26.2-2.45-6.82-6.23-14.54-13.01-13.24-6.5.92-15.08 1.38-19.23-2.97-5.65-5.93-6-10.1-6.61-18.56 1.65-6.94 5.79-12.64 10.38-18.63 3.4-4.42 17.45-10.39 25.26-7.83 10.35 3.38 17.43 10.5 28.95 8.57 3.12-.53 9.14-4.65 7.1-6.62zm-145.6 37.27c-4.96-1.27-11.57 1.13-11.8 6.94-1.48 5.59-4.82 10.62-5.8 16.32.56 6.42 4.34 12.02 8.18 16.97 3.72 3.85 8.58 7.37 9.3 13.1 1.24 5.88 1.6 11.92 2.28 17.87.34 9.37.95 19.67 7.29 27.16 4.26 3.83 8.4-2.15 6.52-6.3-.54-4.54-.6-9.11 1.01-13.27 4.2-6.7 7.32-10.57 12.44-16.64 5.6-7.16 12.74-11.75 14-20.9.56-4.26 5.72-13.86 1.7-16.72-3.14-2.3-15.83-4-18.86-6.49-2.36-1.71-3.86-9.2-9.86-12.07-4.91-3.1-10.28-6.73-16.4-5.97zm11.16-49.42c6.13-2.93 10.58-4.77 14.61-10.25 3.5-4.28 2.46-12.62-2.59-15.45-7.27-3.22-13.08 5.78-18.81 8.71-5.96 4.2-12.07-5.48-6.44-10.6 5.53-4.13.38-9.2-5.66-8.48-6.12.8-12.48-1.45-18.6-1.73-5.3-.7-10.13-1-15.45-1.37-5.37-.05-16.51-2.23-25.13.87-5.42 1.79-12.5 5.3-16.73 9.06-4.85 4.2.2 7.56 5.54 7.45 5.3-.22 16.8-5.36 20.16.98 3.68 8.13-5.82 18.29-5.2 26.69.1 6.2 3.37 11 4.74 16.98 1.62 5.94 6.17 10.45 10 15.14 4.7 5.06 13.06 6.3 19.53 8.23 7.46.14 3.34-9.23 3.01-14.11 1.77-7.15 8.49-7.82 12.68-13.5 7.14-7.72 16.41-13.4 24.34-18.62zM190.88 3.1c-4.69 0-13.33.04-18.17-.34-7.65.12-13.1-.62-19.48-1.09-3.67.39-9.09 3.34-5.28 7.04 3.8.94 7.32 4.92 7.1 9.31 1.32 4.68 1.2 11.96 6.53 13.88 4.76-.2 7.12-7.6 11.93-8.25 6.85-2.05 12.5-4.58 17.87-9.09 2.48-2.76 7.94-6.38 5.26-10.33-1.55-1.31-2.18-.64-5.76-1.13zm178.81 157.37c-2.66 10.08-5.88 24.97 9.4 15.43 7.97-5.72 12.58-2.02 17.47 1.15.5.43 2.65 9.2 7.19 8.53 5.43-2.1 11.55-5.1 14.96-11.2 2.6-4.62 3.6-12.39 2.76-13.22-3.18-3.43-6.24-11.03-7.7-15.1-.76-2.14-2.24-2.6-2.74-.4-2.82 12.85-6.04 1.22-10.12-.05-8.2-1.67-29.62 7.17-31.22 14.86z"/>
-      <g fill="none">
-        <path stroke="#cf63a6" stroke-linecap="round" stroke-width="2.76" d="M135.2 140.58c61.4-3.82 115.95-118.83 151.45-103.33"/>
-        <path stroke="#cf63a6" stroke-linecap="round" stroke-width="2.76" d="M74.43 46.66c38.15 8.21 64.05 42.26 60.78 93.92M286.65 37.25c-9.6 39.44-3.57 57.12-35.64 91.98"/>
-        <path stroke="#e4c101" stroke-dasharray="9.06,2.265" stroke-width="2.27" d="M397.92 162.52c-31.38 1.26-90.89-53.54-148.3-36.17"/>
-        <path stroke="#cf63a6" stroke-linecap="round" stroke-width="2.77" d="M17.6 245.88c14.35 0 14.4.05 28-.03"/>
-        <path stroke="#e3bf01" stroke-dasharray="9.06,2.265" stroke-width="2.27" d="M46.26 274.14c-17.52-.12-16.68.08-30.34.07"/>
-      </g>
-      <g transform="translate(120.8 -35.81)">
-        <circle cx="509.78" cy="68.74" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
-        <circle cx="440.95" cy="251.87" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
-        <circle cx="212.62" cy="272.19" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
-        <circle cx="92.12" cy="87.56" r="18.12" fill="#240a3b" transform="translate(-93.3 38.03) scale(.50637)"/>
-        <circle cx="730.88" cy="315.83" r="18.12" fill="#67727b" transform="translate(-93.3 38.03) scale(.50637)"/>
-        <circle cx="-102.85" cy="282.18" r="9.18" fill="#240a3b"/>
-        <circle cx="-102.85" cy="309.94" r="9.18" fill="#67727b"/>
-      </g>
-      <g class="t">
-        <text xml:space="preserve" x="-24.76" y="10.37" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="-24.76" y="10.37">The user</tspan></text>
-        <text xml:space="preserve" x="150.63" y="196.62" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="150.63" y="196.62">This server</tspan></text>
-        <text xml:space="preserve" x="346.39" y="202.63" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="346.39" y="202.63">Your service</tspan></text>
-        <text xml:space="preserve" x="34.52" y="249.07" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="34.52" y="249.07">Nym network link</tspan></text>
-        <text xml:space="preserve" x="34.13" y="276.05" stroke-width=".26" font-size="16.93" font-weight="700" style="line-height:1.25" transform="translate(27.79 2.5)" word-spacing="0"><tspan x="34.13" y="276.05">Unencrypted link</tspan></text>
-        <path fill="none" stroke-linecap="round" stroke-width="1.67" d="M222.6 184.1c-2.6-15.27 8.95-23.6 18.43-38.86m186.75 45.61c-.68-10.17-9.4-17.68-18.08-23.49"/>
-        <path fill="none" stroke-linecap="round" stroke-width="1.67" d="M240.99 153.41c.35-3.41 1.19-6.17.04-8.17m-7.15 5.48c1.83-2.8 4.58-4.45 7.15-5.48"/>
-        <path fill="none" stroke-linecap="round" stroke-width="1.67" d="M412.43 173.21c-2.2-3.15-2.54-3.85-2.73-5.85m0 0c2.46-.65 3.85.01 6.67 1.24M61.62 40.8C48.89 36.98 36.45 27.54 36.9 18.96M61.62 40.8c.05-2.58-3.58-4.8-5.25-5.26m-2.65 6.04c1.8.54 6.8 1.31 7.9-.78"/>
-        <path fill="none" stroke-linecap="round" stroke-linejoin="round" stroke-width="2.44" d="M1.22 229.4h247.74v63.1H1.22z"/>
-      </g>
-    </svg>
-  </p>
-
-  <p><a href="https://nym.com/about/mixnet">Read more about how Nym works.</a></p>
-
-  <p>
-    Nym relies on a growing ecosystem of users, developers and researcher partners
-    aligned with the mission to make sure Nym software is running, remains usable
-    and solves real problems. While Nym is not designed for malicious computer
-    users, it is true that they can use the network for malicious ends. This
-    is largely because criminals and hackers have significantly better access to
-    privacy and anonymity than do the regular users whom they prey upon. Criminals
-    can and do build, sell, and trade far larger and more powerful networks than
-    Nym on a daily basis. Thus, in the mind of this operator, the social need for
-    easily accessible censorship-resistant private, anonymous communication trumps
-    the risk of unskilled bad actors, who are almost always more easily uncovered
-    by traditional police work than by extensive monitoring and surveillance anyway.
-  </p>
-
-  <p>
-    In terms of applicable law, the best way to understand Nym is to consider it a
-    network of routers operating as common carriers, much like the Internet
-    backbone. However, unlike the Internet backbone routers, Nym mixnodes do not
-    contain identifiable routing information about the source of a packet and do
-    mix the user internet traffic with that of other users, making communications
-    private and protecting not just the user content but the metadata
-    (user's IP address, who the user talks to, when, where, from what device and
-    more) and no single Nym node can determine both the origin and destination
-    of a given transmission.
-  </p>
-
-  <p>
-    As such, there is nothing the operator of this Exit Gateway can do to help you
-    track the connection further. This Exit Gateway maintains no logs of any of the
-    Nym Network, so there is little that can be done to trace either legitimate or
-    illegitimate traffic and most importantly the operator cannot tell apart one from
-    the other because of the cryptography design making such selection impossible
-    for the operator. Attempts to seize this router will accomplish nothing.
-  </p>
-
-  <p>
-    To decentralise and enable privacy for a broad range of services, this
-    Exit Gateway adopts an <a href="https://nymtech.net/.wellknown/network-requester/exit-policy.txt">Exit Policy</a>
-    serving as a safeguard.
-  </p>
-
-  <p>
-    That being said, if you still have a complaint about the router, you may email the
-    <a href="mailto:{{ email }}">maintainer</a>. If complaints are related to a particular service that is being abused,
-    the maintainer will submit that to the NYM Operators Community in order to add it to the Exit Policy cited above.
-    The community governance can only blacklist entire IP:port destinations across the entire network.
-  </p>
-
-  <p>
-    You also have the option of blocking this IP address and others on the Nym network if you so desire.
-    The Nym project provides a <a href="https://nym.com/explorer">
-    web service</a> to fetch a list of all IP addresses of Nym Gateway Exit nodes that allow exiting to a
-    specified IP:port combination. Please be considerate when using these options.
-  </p>
-  <p style="text-align:center">
-    <img
-      class="logo"
-      src="https://raw.githubusercontent.com/nymtech/websites/main/www/nym.com/public/images/Nym_meta_Image.png"
-      alt=""
-      style="max-width:320px;width:100%;height:auto"
-      onerror="this.onerror=null;this.src='/images/nym_logo.png';"
-    />
-  </p>
-</main>
-</body>
-</html>
@@ -1,17 +0,0 @@
-server {
-    listen 443 ssl http2;
-    listen [::]:443 ssl http2;
-
-    server_name {{ hostname }};
-
-    ssl_certificate     /etc/letsencrypt/live/{{ hostname }}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/{{ hostname }}/privkey.pem;
-    include /etc/nginx/snippets/nym-ssl-options.conf;
-
-    location / {
-        proxy_pass http://127.0.0.1:8080;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-}
@@ -1,18 +0,0 @@
-server {
-    listen 80;
-    listen [::]:80;
-
-    server_name {{ hostname }};
-
-    root /var/www/{{ hostname }};
-    index index.html;
-
-    location ^~ /.well-known/acme-challenge/ {
-        default_type "text/plain";
-        try_files $uri =404;
-    }
-
-    location / {
-        return 301 https://$host$request_uri;
-    }
-}
@@ -1,34 +0,0 @@
-server {
-    listen 9001 ssl http2;
-    listen [::]:9001 ssl http2;
-
-    server_name {{ hostname }};
-
-    ssl_certificate     /etc/letsencrypt/live/{{ hostname }}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/{{ hostname }}/privkey.pem;
-    include /etc/nginx/snippets/nym-ssl-options.conf;
-
-    access_log /var/log/nginx/access.log;
-    error_log  /var/log/nginx/error.log;
-
-    location /favicon.ico {
-        return 204;
-        access_log off;
-        log_not_found off;
-    }
-
-    location / {
-        add_header 'Access-Control-Allow-Origin' '*' always;
-        add_header 'Access-Control-Allow-Credentials' 'true' always;
-        add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS, HEAD' always;
-        add_header 'Access-Control-Allow-Headers' '*' always;
-
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "Upgrade";
-        proxy_set_header X-Forwarded-For $remote_addr;
-
-        proxy_pass http://localhost:9000;
-        proxy_intercept_errors on;
-    }
-}
@@ -1,36 +0,0 @@
---
-# Where binaries live
-nym_install_dir: /root/nym-binaries
-
-# nym-node run arguments (defaults, can be overridden per host/group)
-http_bind_address: "0.0.0.0:8080"        # maps to --http-bind-address
-mixnet_bind_address: "0.0.0.0:1789"      # maps to --mixnet-bind-address
-
-# Landing page base dir, hostname is appended in the task
-landing_page_assets_base_dir: "/var/www"
-
-# Flag toggles
-# accept_operator_terms: true              # controls --accept-operator-terms-and-conditions
-nym_write_flag: true                     # controls -w
-nym_init_only_flag: true                 # controls --init-only
-wss_port: 9001                           # controlls --announce-wss-port
-
-# Optional: extra flags if you want to append more later
-nym_extra_flags: ""
-
-# CLI URL (nym_version can be set elsewhere / via GitHub API)
-nym_cli_url: "https://github.com/nymtech/nym/releases/download/{{ nym_version }}/nym-cli"
-
-# UFW
-nym_ufw_enable: true
-
-nym_ufw_rules:
-  - { port: 22,    proto: tcp }
-  - { port: 80,    proto: tcp }
-  - { port: 443,   proto: tcp }
-  - { port: 1789,  proto: tcp }
-  - { port: 1790,  proto: tcp }
-  - { port: 8080,  proto: tcp }
-  - { port: 9000,  proto: tcp }
-  - { port: 9001,  proto: tcp }
-  - { port: 51822, proto: udp }
@@ -1 +0,0 @@
-#!/bin/bash
@@ -1,4 +0,0 @@
---
- name: Reload systemd
-  systemd:
-    daemon_reload: yes
@@ -1,38 +0,0 @@
---
-# useful when the host is behind a NAT
- name: Fetch the public IP address
-  command: "curl -4 canhazip.com"
-  register: ipv4
-  changed_when: false
-  failed_when: false
-
- name: Set public IP address
-  set_fact:
-    public_ip: "{{ ipv4.stdout | default(ansible_default_ipv4.address) }}"
-
- name: Initialize nym node
-  # delete the part from --hostname onward if you run  mode=mixnode only
-  command:
-    cmd: >
-      {{ nym_install_dir }}/nym-node run
-      --mode {{ mode }}
-      --public-ips {{ public_ip }}
-      --http-bind-address {{ http_bind_address }}
-      --mixnet-bind-address {{ mixnet_bind_address }}
-      --location {{ location }}
-      {% if accept_operator_terms %}--accept-operator-terms-and-conditions{% endif %}
-
-      {{ nym_extra_flags }}
-
-      --hostname {{ hostname }}
-      --wireguard-enabled {{ (wireguard_enabled | default('false') | bool) | ternary('true','false') }}
-      --landing-page-assets-path {{ landing_page_assets_base_dir }}/{{ hostname }}/
-      {% if nym_write_flag %}-w{% endif %}
-      {% if nym_init_only_flag %}--init-only{% endif %}
-      --announce-wss-port {{ wss_port }}
-
-
- name: Update nym description
-  template:
-    src: description.toml.j2
-    dest: /root/.nym/nym-nodes/default-nym-node/data/description.toml
@@ -1,35 +0,0 @@
---
- name: Ensure UFW is installed
-  apt:
-    name: ufw
-    state: present
-    update_cache: yes
-  when: nym_ufw_enable
-
-
- name: Configure UFW rules
-  ufw:
-    rule: allow
-    port: "{{ item.port }}"
-    proto: "{{ item.proto }}"
-    comment: "{{ item.comment | default(omit) }}"
-  loop: "{{ nym_ufw_rules }}"
-  loop_control:
-    label: "{{ item.port }}/{{ item.proto }}"
-  when:
-    - nym_ufw_enable
-    - item.when | default(true)
-
- name: Allow bandwidth/topup rule inside WG tunnel
-  command: >
-    ufw allow in on nymwg to any port 51830 proto tcp comment 'bandwidth queries/topup'
-  changed_when: false
-  when:
-    - nym_ufw_enable
-    - (wireguard_enabled | default(false) | bool)
-
- name: Enable UFW
-  ufw:
-    state: enabled
-  when:
-    nym_ufw_enable
@@ -1,34 +0,0 @@
---
- name: Create nym directory
-  file:
-    path: "{{ nym_install_dir }}"
-    state: directory
-    mode: "0755"
-
- name: Get latest Nym release metadata
-  uri:
-    url: https://api.github.com/repos/nymtech/nym/releases/latest
-    return_content: yes
-  register: latest_release
-  when: nym_version is not defined or nym_version == 'latest'
-
- name: Set nym_version from GitHub API
-  set_fact:
-    nym_version: "{{ latest_release.json.tag_name }}"
-  when: nym_version is not defined or nym_version == 'latest'
-
- name: Set binary URL
-  set_fact:
-    binary_url: "https://github.com/nymtech/nym/releases/download/{{ nym_version }}/nym-node"
-
- name: Download nym-node binary
-  get_url:
-    url: "{{ binary_url }}"
-    dest: "{{ nym_install_dir }}/nym-node"
-    mode: "0755"
-
- name: Download nym-cli binary
-  get_url:
-    url: "{{ nym_cli_url }}"
-    dest: "{{ nym_install_dir }}/nym-cli"
-    mode: "0755"
@@ -1,12 +0,0 @@
---
- name: Install Nym binaries
-  import_tasks: install.yml
-
- name: Configure Nym node
-  import_tasks: config.yml
-
- name: Configure firewall for Nym
-  import_tasks: firewall.yml
-
- name: Configure and start Nym service
-  import_tasks: service.yml
@@ -1,15 +0,0 @@
---
- name: Template systemd service
-  tags: systemctl
-  template:
-    src: nym-node.service.j2
-    dest: /etc/systemd/system/nym-node.service
-  notify: Reload systemd
-
- name: Enable and start nym service
-  tags: systemctl
-  systemd:
-    name: nym-node
-    enabled: yes
-    state: started
-    daemon_reload: yes
@@ -1,20 +0,0 @@
-{# Priority:
-   1. Use moniker if provided in inventory
-   2. Else strip "nym-exit." prefix if hostname starts with it
-   3. Else use hostname unchanged
-#}
-
-{% if moniker is defined and moniker | length > 0 %}
-    {% set moniker_final = moniker %}
-{% else %}
-    {% if hostname is defined and hostname.startswith('nym-exit.') %}
-        {% set moniker_final = hostname | regex_replace('^nym-exit\\.', '') %}
-    {% else %}
-        {% set moniker_final = hostname %}
-    {% endif %}
-{% endif %}
-
-moniker = "{{ moniker_final }}"
-website = " {{ website }}"
-security_contact = "{{ email }}"
-details = "{{ description }}"
@@ -1,15 +0,0 @@
-[Unit]
-Description=Nym Node
-StartLimitInterval=350
-StartLimitBurst=10
-
-[Service]
-User={{ ansible_user }}
-LimitNOFILE=65536
-ExecStart=/root/nym-binaries/nym-node run --mode {{ mode }} --accept-operator-terms-and-conditions --wireguard-enabled {{ (wireguard_enabled | default(false) | bool) | ternary('true','false') }}
-KillSignal=SIGINT
-Restart=on-failure
-RestartSec=30
-
-[Install]
-WantedBy=multi-user.target
@@ -1,49 +0,0 @@
- name: Show which node is being bonded
-  tags: bonding
-  debug:
-    msg: "Bonding Nym node: {{ hostname }}"
-
- name: Get bonding details
-  tags: bonding
-  command: "/root/nym-binaries/nym-node bonding-information"
-  register: bondinfo
-  changed_when: false
-
- name: Display bonding info
-  tags: bonding
-  debug:
-    msg: "{{ item }}"
-  loop: "{{ bondinfo.stdout_lines }}"
-
-
- name: Prompt operator to generate contract message in wallet
-  tags: bonding
-  pause:
-    prompt: |
-      ** Using the bonding information above:
-
-      1. Open your wallet  
-      2. Go to Bonding section
-      3. Fill Hostname and Identity key from the message printed above
-      4. Copy the CONTRACT MESSAGE that your wallet displays  
-      5. Paste it below and press Enter
-
-      Paste CONTRACT MESSAGE here:
-  register: contract_msg_input
-
- name: Sign bonding contract message on the node
-  tags: bonding
-  command:
-    argv:
-      - /root/nym-binaries/nym-node
-      - sign
-      - --contract-msg
-      - "{{ contract_msg_input.user_input }}"
-      - --output
-      - json
-  register: sign_output
-
- name: Display full signed message exactly as returned
-  tags: bonding
-  debug:
-    msg: "{{ sign_output.stdout }}"
@@ -1,16 +0,0 @@
- name: Download quic_bridge_deployment.sh
-  tags: quic bridge deployment
-  get_url:
-    url: "{{ quic_bridge_deployment_url }}"
-    dest: "/root/nym-binaries/quic_bridge_deployment.sh"
-    mode: "0755"
-
- name: Configure tunnel manager
-  tags: quic bridge deployment
-  become: true
-  command:
-    cmd: "/root/nym-binaries/quic_bridge_deployment.sh {{ item }}"
-  environment:
-    NONINTERACTIVE: "1"
-  loop:
-    - full_bridge_setup
@@ -1,11 +0,0 @@
---
- name: Configure tunnel manager
-  tags:
-    - network_tunnel_manager
-  become: true
-  command:
-    cmd: "/root/nym-binaries/network-tunnel-manager.sh {{ item }}"
-  loop:
-    - complete_networking_configuration
-  register: tunnel_mgr
-  failed_when: false
@@ -1,10 +0,0 @@
-nym_binary_dir: /root/nym-binaries
-nym_binary_path: "{{ nym_binary_dir }}/nym-node"
-nym_backup_dir: "{{ nym_binary_dir }}/bak"
-nym_backup_path: "{{ nym_backup_dir }}/nym-node"
-nym_service_name: nym-node
-
-# nym_version: "v2025.21-mozzarella"
-# Optional: set this to pin a specific release tag in (e.g. v2025.21-mozzarella)
-# otherwise the GitHub “latest” release is used
-
@@ -1,30 +0,0 @@
- name: Get latest Nym release metadata
-  uri:
-    url: https://api.github.com/repos/nymtech/nym/releases/latest
-    return_content: yes
-  register: latest_release
-  when: nym_version is not defined and not ansible_check_mode
-
- name: Set nym_version from GitHub API
-  set_fact:
-    nym_version: "{{ latest_release.json.tag_name }}"
-  when: nym_version is not defined and not ansible_check_mode
-
- name: Show target Nym version tag
-  debug:
-    msg: "Target Nym release tag: {{ nym_version | default('latest (check-mode)') }}"
-
- name: Generate binary_url from version
-  set_fact:
-    binary_url: >-
-      https://github.com/nymtech/nym/releases/download/{{ nym_version }}/nym-node
-  when: not ansible_check_mode
-
- name: Download nym-node binary
-  get_url:
-    url: "{{ binary_url }}"
-    dest: "{{ nym_binary_path }}"
-    mode: "0755"
-  register: download_result
-  failed_when: false
-  when: not ansible_check_mode
@@ -1,122 +0,0 @@
-# run --version on the new binary
- name: Check new nym-node version
-  command:
-    argv:
-      - "{{ nym_binary_path }}"
-      - --version
-  register: nym_new_version_cmd
-  failed_when: false
-  changed_when: false
-  when: not ansible_check_mode
-
-# show the full stdout so we don’t depend on regex parsing at all
-# show full upgraded version output, line by line
- name: Show upgraded nym-node version info
-  debug:
-    msg: >-
-      {{
-        [
-          "New nym-node --version rc: " ~ (nym_new_version_cmd.rc | default('unset') | string),
-          "New nym-node --version output:"
-        ]
-        + (nym_new_version_cmd.stdout_lines | default([]))
-      }}
-  when: not ansible_check_mode
-
-# decide if upgrade is successful
-# success means: the binary executed without an error (rc == 0)
- name: Determine if upgrade is successful
-  set_fact:
-    upgrade_ok: "{{ (nym_new_version_cmd.rc | default(1)) == 0 }}"
-  when: not ansible_check_mode
-
-# show the decision for debugging
- name: Debug upgrade_ok decision
-  debug:
-    msg:
-      - "upgrade_ok: {{ upgrade_ok }}"
-  when: not ansible_check_mode
-
-#########
-# success
-#########
-
-# show the full version output to the user, line-by-line
- name: Show upgraded nym-node version info
-  debug:
-    msg:
-      - "Upgraded nym-node version output:"
-      - "{{ nym_new_version_cmd.stdout_lines | default([]) }}"
-  when: not ansible_check_mode and upgrade_ok | default(false)
-
-
-# remove backup
- name: Remove backup after successful upgrade
-  file:
-    path: "{{ nym_backup_path }}"
-    state: absent
-  when:
-    - not ansible_check_mode
-    - upgrade_ok | default(false)
-    - nym_node_bin.stat.exists | default(false)
-
-# restart service
- name: Restart nym-node service after successful upgrade
-  systemd:
-    name: "{{ nym_service_name }}"
-    state: restarted
-  when: not ansible_check_mode and upgrade_ok | default(false)
-
-# report success
- name: Report successful upgrade
-  debug:
-    msg: >-
-      Upgrade successful. nym-node binary executed correctly and the service has been restarted.
-  when: not ansible_check_mode and upgrade_ok | default(false)
-
-#########
-# failure
-#########
-
- name: Restore previous nym-node binary after failed upgrade
-  copy:
-    src: "{{ nym_backup_path }}"
-    dest: "{{ nym_binary_path }}"
-    mode: "0755"
-    remote_src: true
-  when:
-    - not ansible_check_mode
-    - (upgrade_ok | default(false)) == false
-    - nym_node_bin.stat.exists | default(false)
-
- name: Remove backup after rollback
-  file:
-    path: "{{ nym_backup_path }}"
-    state: absent
-  when:
-    - not ansible_check_mode
-    - (upgrade_ok | default(false)) == false
-    - nym_node_bin.stat.exists | default(false)
-
-# always restart the service with the restored binary
- name: Restart nym-node service with previous version after failed upgrade
-  systemd:
-    name: "{{ nym_service_name }}"
-    state: restarted
-  when:
-    - not ansible_check_mode
-    - (upgrade_ok | default(false)) == false
-    - nym_node_bin.stat.exists | default(false)
-
- name: Report failed upgrade and rollback
-  debug:
-    msg: >-
-      Upgrade NOT successful. The previous nym-node binary has been restored
-      and the nym-node service has been restarted with the old version.
-  when: not ansible_check_mode and (upgrade_ok | default(false)) == false
-
-# optional: hard-fail the play for CI environments
-#- name: fail the play to signal upgrade failure
-#  fail:
-#    msg: "nym-node upgrade failed; rolled back to previous binary."
-#  when: not ansible_check_mode and (upgrade_ok | default(false)) == false
@@ -1,8 +0,0 @@
- name: Prepare for nym-node upgrade (backup, stop service)
-  include_tasks: prepare.yml
-
- name: Fetch and install latest nym-node binary
-  include_tasks: fetch_latest.yml
-
- name: Verify new nym-node and finalize (restart or rollback)
-  include_tasks: finalize.yml
@@ -1,69 +0,0 @@
-# stop service before touching the binary
- name: Stop nym-node service
-  systemd:
-    name: "{{ nym_service_name }}"
-    state: stopped
-  when: not ansible_check_mode
-
-# check if the current binary exists
- name: Check existing nym-node binary
-  stat:
-    path: "{{ nym_binary_path }}"
-  register: nym_node_bin
-
-# capture current nym-node version (if present)
- name: Capture current nym-node version (if present)
-  command:
-    argv:
-      - "{{ nym_binary_path }}"
-      - --version
-  register: nym_current_version_cmd
-  failed_when: false
-  changed_when: false
-  when:
-    - nym_node_bin.stat.exists
-    - not ansible_check_mode
-
-# show full current version output instead of trying to parse it
-# show full current version output, line by line
- name: Show current nym-node version info
-  debug:
-    msg: >-
-      {{
-        [
-          "Current nym-node --version rc: " ~ (nym_current_version_cmd.rc | default('unset') | string),
-          "Current nym-node --version output:"
-        ]
-        + (nym_current_version_cmd.stdout_lines | default([]))
-      }}
-  when:
-    - nym_node_bin.stat.exists
-    - not ansible_check_mode
-
-# ensure backup directory exists
- name: Ensure backup directory exists
-  file:
-    path: "{{ nym_backup_dir }}"
-    state: directory
-    mode: "0755"
-  when: not ansible_check_mode
-
-# backup existing nym-node binary
- name: Backup existing nym-node binary
-  copy:
-    src: "{{ nym_binary_path }}"
-    dest: "{{ nym_backup_path }}"
-    remote_src: true
-    mode: "0755"
-  when:
-    - not ansible_check_mode
-    - nym_node_bin.stat.exists
-
-# remove current nym-node binary
- name: Remove current nym-node binary
-  file:
-    path: "{{ nym_binary_path }}"
-    state: absent
-  when:
-    - not ansible_check_mode
-    - nym_node_bin.stat.exists
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.67"
+version = "1.1.64"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -2594,9 +2594,9 @@
      }
    },
    "node_modules/node-forge": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.2.tgz",
-      "integrity": "sha512-6xKiQ+cph9KImrRh0VsjH2d8/GXA4FIMlgU4B757iI1ApvcyA9VlouP0yZJha01V+huImO+kKMU7ih+2+E14fw==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.0.tgz",
+      "integrity": "sha512-08ARB91bUi6zNKzVmaj3QO7cr397uiDT2nJ63cHjyNtCTWIgvS47j3eT0WfzUwS9+6Z5YshRaoasFkXCKrIYbA==",
      "dev": true,
      "engines": {
        "node": ">= 6.13.0"
@@ -6494,9 +6494,9 @@
      }
    },
    "node-forge": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.2.tgz",
-      "integrity": "sha512-6xKiQ+cph9KImrRh0VsjH2d8/GXA4FIMlgU4B757iI1ApvcyA9VlouP0yZJha01V+huImO+kKMU7ih+2+E14fw==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.3.0.tgz",
+      "integrity": "sha512-08ARB91bUi6zNKzVmaj3QO7cr397uiDT2nJ63cHjyNtCTWIgvS47j3eT0WfzUwS9+6Z5YshRaoasFkXCKrIYbA==",
      "dev": true
    },
    "node-releases": {
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.67"
+version = "1.1.64"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -16,7 +16,6 @@ serde = { workspace = true, features = ["derive"] }
 semver = { workspace = true }
 strum_macros = { workspace = true }
 thiserror = { workspace = true }
-tracing = { workspace = true }

 nym-credentials-interface = { path = "../credentials-interface" }
 nym-crypto = { path = "../crypto", features = ["asymmetric"] }
@@ -30,13 +29,7 @@ hmac = { workspace = true, optional = true }
 sha2 = { workspace = true, optional = true }
 x25519-dalek = { workspace = true, features = ["static_secrets"] }

-[dev-dependencies]
-nym-test-utils = { path = "../test-utils" }
-
 [features]
 default = ["verify"]
 # this is moved to a separate feature as we really need clients to import it (especially, *cough*, wasm)
 verify = ["hmac", "sha2"]
-
-[lints]
-workspace = true
@@ -6,11 +6,9 @@ use nym_wireguard_types::PeerPublicKey;

 use crate::{
    AuthenticatorVersion, Error,
-    traits::{
-        FinalMessage, InitMessage, QueryBandwidthMessage, TopUpMessage, UpgradeModeMessage,
-        Versionable,
-    },
-    v2, v3, v4, v5, v6,
+    latest::registration::IpPair,
+    traits::{FinalMessage, InitMessage, QueryBandwidthMessage, TopUpMessage, Versionable},
+    v2, v3, v4, v5,
 };

 // This is very redundant with AuthenticatorRequest and I reckon they could be smooshed.
@@ -21,293 +19,6 @@ pub enum ClientMessage {
    Final(Box<dyn FinalMessage + Send + Sync + 'static>),
    Query(Box<dyn QueryBandwidthMessage + Send + Sync + 'static>),
    TopUp(Box<dyn TopUpMessage + Send + Sync + 'static>),
-    UpgradeModeCheck(Box<dyn UpgradeModeMessage + Send + Sync + 'static>),
-}
-
-pub struct SerialisedRequest {
-    pub bytes: Vec<u8>,
-    pub request_id: u64,
-}
-
-impl SerialisedRequest {
-    pub fn new(bytes: Vec<u8>, request_id: u64) -> Self {
-        Self { bytes, request_id }
-    }
-}
-
-impl ClientMessage {
-    fn serialise_v1(&self) -> Result<SerialisedRequest, Error> {
-        Err(Error::UnsupportedVersion)
-    }
-
-    fn serialise_v2(&self, reply_to: Recipient) -> Result<SerialisedRequest, Error> {
-        use v2::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
-            request::AuthenticatorRequest,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(
-                    InitMessage {
-                        pub_key: init_message.pub_key(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(
-                    FinalMessage {
-                        gateway_client: GatewayClient {
-                            pub_key: final_message.gateway_client_pub_key(),
-                            private_ip: final_message
-                                .gateway_client_ipv4()
-                                .ok_or(Error::UnsupportedMessage)?
-                                .into(),
-                            mac: ClientMac::new(final_message.gateway_client_mac()),
-                        },
-                        credential: final_message
-                            .credential()
-                            .and_then(|c| c.credential.into_zk_nym())
-                            .map(|c| *c),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) =
-                    AuthenticatorRequest::new_query_request(query_message.pub_key(), reply_to);
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            _ => Err(Error::UnsupportedMessage),
-        }
-    }
-
-    fn serialise_v3(&self, reply_to: Recipient) -> Result<SerialisedRequest, Error> {
-        use v3::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
-            request::AuthenticatorRequest,
-            topup::TopUpMessage,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(
-                    InitMessage {
-                        pub_key: init_message.pub_key(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(
-                    FinalMessage {
-                        gateway_client: GatewayClient {
-                            pub_key: final_message.gateway_client_pub_key(),
-                            private_ip: final_message
-                                .gateway_client_ipv4()
-                                .ok_or(Error::UnsupportedMessage)?
-                                .into(),
-                            mac: ClientMac::new(final_message.gateway_client_mac()),
-                        },
-                        credential: final_message
-                            .credential()
-                            .and_then(|c| c.credential.into_zk_nym())
-                            .map(|c| *c),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) =
-                    AuthenticatorRequest::new_query_request(query_message.pub_key(), reply_to);
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::TopUp(top_up_message) => {
-                let (req, id) = AuthenticatorRequest::new_topup_request(
-                    TopUpMessage {
-                        pub_key: top_up_message.pub_key(),
-                        credential: top_up_message.credential(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            _ => Err(Error::UnsupportedMessage),
-        }
-    }
-
-    fn serialise_v4(&self, reply_to: Recipient) -> Result<SerialisedRequest, Error> {
-        use v4::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage, IpPair},
-            request::AuthenticatorRequest,
-            topup::TopUpMessage,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(
-                    InitMessage {
-                        pub_key: init_message.pub_key(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(
-                    FinalMessage {
-                        gateway_client: GatewayClient {
-                            pub_key: final_message.gateway_client_pub_key(),
-                            private_ips: IpPair {
-                                ipv4: final_message
-                                    .gateway_client_ipv4()
-                                    .ok_or(Error::UnsupportedMessage)?,
-                                ipv6: final_message
-                                    .gateway_client_ipv6()
-                                    .ok_or(Error::UnsupportedMessage)?,
-                            },
-                            mac: ClientMac::new(final_message.gateway_client_mac()),
-                        },
-                        credential: final_message
-                            .credential()
-                            .and_then(|c| c.credential.into_zk_nym())
-                            .map(|c| *c),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) =
-                    AuthenticatorRequest::new_query_request(query_message.pub_key(), reply_to);
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::TopUp(top_up_message) => {
-                let (req, id) = AuthenticatorRequest::new_topup_request(
-                    TopUpMessage {
-                        pub_key: top_up_message.pub_key(),
-                        credential: top_up_message.credential(),
-                    },
-                    reply_to,
-                );
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            _ => Err(Error::UnsupportedMessage),
-        }
-    }
-
-    fn serialise_v5(&self) -> Result<SerialisedRequest, Error> {
-        use v5::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage, IpPair},
-            request::AuthenticatorRequest,
-            topup::TopUpMessage,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(InitMessage {
-                    pub_key: init_message.pub_key(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(FinalMessage {
-                    gateway_client: GatewayClient {
-                        pub_key: final_message.gateway_client_pub_key(),
-                        private_ips: IpPair {
-                            ipv4: final_message
-                                .gateway_client_ipv4()
-                                .ok_or(Error::UnsupportedMessage)?,
-                            ipv6: final_message
-                                .gateway_client_ipv6()
-                                .ok_or(Error::UnsupportedMessage)?,
-                        },
-                        mac: ClientMac::new(final_message.gateway_client_mac()),
-                    },
-                    credential: final_message
-                        .credential()
-                        .and_then(|c| c.credential.into_zk_nym())
-                        .map(|c| *c),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) = AuthenticatorRequest::new_query_request(query_message.pub_key());
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::TopUp(top_up_message) => {
-                let (req, id) = AuthenticatorRequest::new_topup_request(TopUpMessage {
-                    pub_key: top_up_message.pub_key(),
-                    credential: top_up_message.credential(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            _ => Err(Error::UnsupportedMessage),
-        }
-    }
-
-    fn serialise_v6(&self) -> Result<SerialisedRequest, Error> {
-        use v6::{
-            registration::{ClientMac, FinalMessage, GatewayClient, InitMessage, IpPair},
-            request::AuthenticatorRequest,
-            topup::TopUpMessage,
-            upgrade_mode_check::UpgradeModeCheckRequest,
-        };
-        match self {
-            ClientMessage::Initial(init_message) => {
-                let (req, id) = AuthenticatorRequest::new_initial_request(InitMessage {
-                    pub_key: init_message.pub_key(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Final(final_message) => {
-                let (req, id) = AuthenticatorRequest::new_final_request(FinalMessage {
-                    gateway_client: GatewayClient {
-                        pub_key: final_message.gateway_client_pub_key(),
-                        private_ips: IpPair {
-                            ipv4: final_message
-                                .gateway_client_ipv4()
-                                .ok_or(Error::UnsupportedMessage)?,
-                            ipv6: final_message
-                                .gateway_client_ipv6()
-                                .ok_or(Error::UnsupportedMessage)?,
-                        },
-                        mac: ClientMac::new(final_message.gateway_client_mac()),
-                    },
-                    credential: final_message.credential(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::Query(query_message) => {
-                let (req, id) = AuthenticatorRequest::new_query_request(query_message.pub_key());
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::TopUp(top_up_message) => {
-                let (req, id) = AuthenticatorRequest::new_topup_request(TopUpMessage {
-                    pub_key: top_up_message.pub_key(),
-                    credential: top_up_message.credential(),
-                });
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-            ClientMessage::UpgradeModeCheck(upgrade_mode_check) => {
-                // currently JWT is the only emergency credential option
-                let Some(upgrade_mode_jwt) =
-                    upgrade_mode_check.upgrade_mode_global_attestation_jwt()
-                else {
-                    return Err(Error::conversion(
-                        "no valid known upgrade mode check variants",
-                    ));
-                };
-                let msg = UpgradeModeCheckRequest::UpgradeModeJwt {
-                    token: upgrade_mode_jwt,
-                };
-
-                let (req, id) = AuthenticatorRequest::new_upgrade_mode_check_request(msg);
-                Ok(SerialisedRequest::new(req.to_bytes()?, id))
-            }
-        }
-    }
 }

 impl ClientMessage {
@@ -316,7 +27,7 @@ impl ClientMessage {
        match self {
            Self::Final(msg) => msg.credential().is_some(),
            Self::TopUp(_) => true,
-            Self::Initial(_) | Self::Query(_) | Self::UpgradeModeCheck(_) => false,
+            Self::Initial(_) | Self::Query(_) => false,
        }
    }

@@ -326,18 +37,208 @@ impl ClientMessage {
            ClientMessage::Final(msg) => msg.version(),
            ClientMessage::Query(msg) => msg.version(),
            ClientMessage::TopUp(msg) => msg.version(),
-            ClientMessage::UpgradeModeCheck(msg) => msg.version(),
        }
    }

-    pub fn bytes(&self, reply_to: Recipient) -> Result<SerialisedRequest, Error> {
+    pub fn bytes(&self, reply_to: Recipient) -> Result<(Vec<u8>, u64), Error> {
        match self.version() {
-            AuthenticatorVersion::V1 => self.serialise_v1(),
-            AuthenticatorVersion::V2 => self.serialise_v2(reply_to),
-            AuthenticatorVersion::V3 => self.serialise_v3(reply_to),
-            AuthenticatorVersion::V4 => self.serialise_v4(reply_to),
-            AuthenticatorVersion::V5 => self.serialise_v5(),
-            AuthenticatorVersion::V6 => self.serialise_v6(),
+            AuthenticatorVersion::V1 => Err(Error::UnsupportedVersion),
+            AuthenticatorVersion::V2 => {
+                use v2::{
+                    registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
+                    request::AuthenticatorRequest,
+                };
+                match self {
+                    ClientMessage::Initial(init_message) => {
+                        let (req, id) = AuthenticatorRequest::new_initial_request(
+                            InitMessage {
+                                pub_key: init_message.pub_key(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Final(final_message) => {
+                        let (req, id) = AuthenticatorRequest::new_final_request(
+                            FinalMessage {
+                                gateway_client: GatewayClient {
+                                    pub_key: final_message.gateway_client_pub_key(),
+                                    private_ip: final_message
+                                        .gateway_client_ipv4()
+                                        .ok_or(Error::UnsupportedMessage)?
+                                        .into(),
+                                    mac: ClientMac::new(final_message.gateway_client_mac()),
+                                },
+                                credential: final_message.credential(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Query(query_message) => {
+                        let (req, id) = AuthenticatorRequest::new_query_request(
+                            query_message.pub_key(),
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    _ => Err(Error::UnsupportedMessage),
+                }
+            }
+            AuthenticatorVersion::V3 => {
+                use v3::{
+                    registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
+                    request::AuthenticatorRequest,
+                    topup::TopUpMessage,
+                };
+                match self {
+                    ClientMessage::Initial(init_message) => {
+                        let (req, id) = AuthenticatorRequest::new_initial_request(
+                            InitMessage {
+                                pub_key: init_message.pub_key(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Final(final_message) => {
+                        let (req, id) = AuthenticatorRequest::new_final_request(
+                            FinalMessage {
+                                gateway_client: GatewayClient {
+                                    pub_key: final_message.gateway_client_pub_key(),
+                                    private_ip: final_message
+                                        .gateway_client_ipv4()
+                                        .ok_or(Error::UnsupportedMessage)?
+                                        .into(),
+                                    mac: ClientMac::new(final_message.gateway_client_mac()),
+                                },
+                                credential: final_message.credential(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Query(query_message) => {
+                        let (req, id) = AuthenticatorRequest::new_query_request(
+                            query_message.pub_key(),
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::TopUp(top_up_message) => {
+                        let (req, id) = AuthenticatorRequest::new_topup_request(
+                            TopUpMessage {
+                                pub_key: top_up_message.pub_key(),
+                                credential: top_up_message.credential(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                }
+            }
+            AuthenticatorVersion::V4 => {
+                use v4::{
+                    registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
+                    request::AuthenticatorRequest,
+                    topup::TopUpMessage,
+                };
+                match self {
+                    ClientMessage::Initial(init_message) => {
+                        let (req, id) = AuthenticatorRequest::new_initial_request(
+                            InitMessage {
+                                pub_key: init_message.pub_key(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Final(final_message) => {
+                        let (req, id) = AuthenticatorRequest::new_final_request(
+                            FinalMessage {
+                                gateway_client: GatewayClient {
+                                    pub_key: final_message.gateway_client_pub_key(),
+                                    private_ips: IpPair {
+                                        ipv4: final_message
+                                            .gateway_client_ipv4()
+                                            .ok_or(Error::UnsupportedMessage)?,
+                                        ipv6: final_message
+                                            .gateway_client_ipv6()
+                                            .ok_or(Error::UnsupportedMessage)?,
+                                    }
+                                    .into(),
+                                    mac: ClientMac::new(final_message.gateway_client_mac()),
+                                },
+                                credential: final_message.credential(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Query(query_message) => {
+                        let (req, id) = AuthenticatorRequest::new_query_request(
+                            query_message.pub_key(),
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::TopUp(top_up_message) => {
+                        let (req, id) = AuthenticatorRequest::new_topup_request(
+                            TopUpMessage {
+                                pub_key: top_up_message.pub_key(),
+                                credential: top_up_message.credential(),
+                            },
+                            reply_to,
+                        );
+                        Ok((req.to_bytes()?, id))
+                    }
+                }
+            }
+            AuthenticatorVersion::V5 => {
+                use v5::{
+                    registration::{ClientMac, FinalMessage, GatewayClient, InitMessage},
+                    request::AuthenticatorRequest,
+                    topup::TopUpMessage,
+                };
+                match self {
+                    ClientMessage::Initial(init_message) => {
+                        let (req, id) = AuthenticatorRequest::new_initial_request(InitMessage {
+                            pub_key: init_message.pub_key(),
+                        });
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Final(final_message) => {
+                        let (req, id) = AuthenticatorRequest::new_final_request(FinalMessage {
+                            gateway_client: GatewayClient {
+                                pub_key: final_message.gateway_client_pub_key(),
+                                private_ips: IpPair {
+                                    ipv4: final_message
+                                        .gateway_client_ipv4()
+                                        .ok_or(Error::UnsupportedMessage)?,
+                                    ipv6: final_message
+                                        .gateway_client_ipv6()
+                                        .ok_or(Error::UnsupportedMessage)?,
+                                },
+                                mac: ClientMac::new(final_message.gateway_client_mac()),
+                            },
+                            credential: final_message.credential(),
+                        });
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::Query(query_message) => {
+                        let (req, id) =
+                            AuthenticatorRequest::new_query_request(query_message.pub_key());
+                        Ok((req.to_bytes()?, id))
+                    }
+                    ClientMessage::TopUp(top_up_message) => {
+                        let (req, id) = AuthenticatorRequest::new_topup_request(TopUpMessage {
+                            pub_key: top_up_message.pub_key(),
+                            credential: top_up_message.credential(),
+                        });
+                        Ok((req.to_bytes()?, id))
+                    }
+                }
+            }
            AuthenticatorVersion::UNKNOWN => Err(Error::UnknownVersion),
        }
    }
@@ -346,7 +247,7 @@ impl ClientMessage {
        use AuthenticatorVersion::*;
        match self.version() {
            V1 | V2 | V3 | V4 => false,
-            V5 | V6 => true,
+            V5 => true,
            UNKNOWN => true,
        }
    }
@@ -1,7 +1,6 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use std::fmt::Display;
 use thiserror::Error;

 #[derive(Debug, Error)]
@@ -38,13 +37,3 @@ pub enum Error {
    #[error(transparent)]
    Bincode(#[from] bincode::Error),
 }
-
-impl Error {
-    pub fn conversion(msg: impl Into<String>) -> Self {
-        Error::Conversion(msg.into())
-    }
-
-    pub fn conversion_display(msg: impl Display) -> Self {
-        Error::Conversion(msg.to_string())
-    }
-}
@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: Apache-2.0

 pub mod client_message;
-pub mod models;
 pub mod request;
 pub mod response;
 pub mod traits;
@@ -11,14 +10,13 @@ pub mod v2;
 pub mod v3;
 pub mod v4;
 pub mod v5;
-pub mod v6;

 mod error;
 mod util;
 mod version;

 pub use error::Error;
-pub use v6 as latest;
+pub use v5 as latest;
 pub use version::AuthenticatorVersion;

 pub const CURRENT_VERSION: u8 = latest::VERSION;
@@ -1,58 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_credentials_interface::{
-    BandwidthCredential, CredentialSpendingData, TicketType, UnknownTicketType,
-};
-use serde::{Deserialize, Serialize};
-
-#[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq)]
-pub enum CurrentUpgradeModeStatus {
-    Enabled,
-    Disabled,
-    // everything pre-v6
-    Unknown,
-}
-
-impl CurrentUpgradeModeStatus {
-    pub fn is_enabled(&self) -> bool {
-        matches!(self, CurrentUpgradeModeStatus::Enabled)
-    }
-}
-
-impl From<bool> for CurrentUpgradeModeStatus {
-    fn from(value: bool) -> Self {
-        if value {
-            CurrentUpgradeModeStatus::Enabled
-        } else {
-            CurrentUpgradeModeStatus::Disabled
-        }
-    }
-}
-
-impl From<CurrentUpgradeModeStatus> for Option<bool> {
-    fn from(value: CurrentUpgradeModeStatus) -> Self {
-        match value {
-            CurrentUpgradeModeStatus::Enabled => Some(true),
-            CurrentUpgradeModeStatus::Disabled => Some(false),
-            CurrentUpgradeModeStatus::Unknown => None,
-        }
-    }
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct BandwidthClaim {
-    pub credential: BandwidthCredential,
-    pub kind: TicketType,
-}
-
-impl TryFrom<CredentialSpendingData> for BandwidthClaim {
-    type Error = UnknownTicketType;
-
-    fn try_from(credential: CredentialSpendingData) -> Result<Self, Self::Error> {
-        Ok(BandwidthClaim {
-            kind: TicketType::try_from_encoded(credential.payment.t_type)?,
-            credential: BandwidthCredential::from(credential),
-        })
-    }
-}
@@ -4,10 +4,8 @@
 use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
 use nym_sphinx::addressing::Recipient;

-use crate::traits::{
-    FinalMessage, InitMessage, QueryBandwidthMessage, TopUpMessage, UpgradeModeMessage,
-};
-use crate::{v1, v2, v3, v4, v5, v6};
+use crate::traits::{FinalMessage, InitMessage, QueryBandwidthMessage, TopUpMessage};
+use crate::{v1, v2, v3, v4, v5};

 #[derive(Debug)]
 pub enum AuthenticatorRequest {
@@ -35,11 +33,6 @@ pub enum AuthenticatorRequest {
        reply_to: Option<Recipient>,
        request_id: u64,
    },
-    CheckUpgradeMode {
-        msg: Box<dyn UpgradeModeMessage + Send + Sync + 'static>,
-        protocol: Protocol,
-        request_id: u64,
-    },
 }

 impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
@@ -209,45 +202,3 @@ impl From<v5::request::AuthenticatorRequest> for AuthenticatorRequest {
        }
    }
 }
-
-impl From<v6::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v6::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v6::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: value.protocol,
-                reply_to: None,
-                request_id: value.request_id,
-            },
-            v6::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
-                msg: final_message,
-                protocol: value.protocol,
-                reply_to: None,
-                request_id: value.request_id,
-            },
-            v6::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: value.protocol,
-                    reply_to: None,
-                    request_id: value.request_id,
-                }
-            }
-            v6::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-                Self::TopUpBandwidth {
-                    msg: top_up_message,
-                    protocol: value.protocol,
-                    reply_to: None,
-                    request_id: value.request_id,
-                }
-            }
-            v6::request::AuthenticatorRequestData::CheckUpgradeMode(upgrade_mode_check_msg) => {
-                Self::CheckUpgradeMode {
-                    msg: Box::new(upgrade_mode_check_msg),
-                    protocol: value.protocol,
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}
@@ -1,12 +1,11 @@
 // Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::models::CurrentUpgradeModeStatus;
 use crate::traits::{
    Id, PendingRegistrationResponse, RegisteredResponse, RemainingBandwidthResponse,
-    TopUpBandwidthResponse, UpgradeModeStatus,
+    TopUpBandwidthResponse,
 };
-use crate::{v2, v3, v4, v5, v6};
+use crate::{v2, v3, v4, v5};

 #[derive(Debug)]
 pub enum AuthenticatorResponse {
@@ -14,29 +13,6 @@ pub enum AuthenticatorResponse {
    Registered(Box<dyn RegisteredResponse + Send + Sync + 'static>),
    RemainingBandwidth(Box<dyn RemainingBandwidthResponse + Send + Sync + 'static>),
    TopUpBandwidth(Box<dyn TopUpBandwidthResponse + Send + Sync + 'static>),
-    UpgradeMode(Box<dyn UpgradeModeStatus + Send + Sync + 'static>),
-}
-
-impl UpgradeModeStatus for AuthenticatorResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        match self {
-            AuthenticatorResponse::PendingRegistration(pending_registration_response) => {
-                pending_registration_response.upgrade_mode_status()
-            }
-            AuthenticatorResponse::Registered(registered_response) => {
-                registered_response.upgrade_mode_status()
-            }
-            AuthenticatorResponse::RemainingBandwidth(remaining_bandwidth_response) => {
-                remaining_bandwidth_response.upgrade_mode_status()
-            }
-            AuthenticatorResponse::TopUpBandwidth(top_up_bandwidth_response) => {
-                top_up_bandwidth_response.upgrade_mode_status()
-            }
-            AuthenticatorResponse::UpgradeMode(upgrade_mode_response) => {
-                upgrade_mode_response.upgrade_mode_status()
-            }
-        }
-    }
 }

 impl Id for AuthenticatorResponse {
@@ -52,7 +28,6 @@ impl Id for AuthenticatorResponse {
            AuthenticatorResponse::TopUpBandwidth(top_up_bandwidth_response) => {
                top_up_bandwidth_response.id()
            }
-            AuthenticatorResponse::UpgradeMode(upgrade_mode_response) => upgrade_mode_response.id(),
        }
    }
 }
@@ -129,25 +104,3 @@ impl From<v5::response::AuthenticatorResponse> for AuthenticatorResponse {
        }
    }
 }
-
-impl From<v6::response::AuthenticatorResponse> for AuthenticatorResponse {
-    fn from(value: v6::response::AuthenticatorResponse) -> Self {
-        match value.data {
-            v6::response::AuthenticatorResponseData::PendingRegistration(
-                pending_registration_response,
-            ) => Self::PendingRegistration(Box::new(pending_registration_response)),
-            v6::response::AuthenticatorResponseData::Registered(registered_response) => {
-                Self::Registered(Box::new(registered_response))
-            }
-            v6::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => Self::RemainingBandwidth(Box::new(remaining_bandwidth_response)),
-            v6::response::AuthenticatorResponseData::TopUpBandwidth(top_up_bandwidth_response) => {
-                Self::TopUpBandwidth(Box::new(top_up_bandwidth_response))
-            }
-            v6::response::AuthenticatorResponseData::UpgradeMode(upgrade_mode_check_response) => {
-                Self::UpgradeMode(Box::new(upgrade_mode_check_response))
-            }
-        }
-    }
-}
@@ -1,15 +1,15 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use crate::latest::registration::IpPair;
-use crate::models::{BandwidthClaim, CurrentUpgradeModeStatus};
-use crate::{AuthenticatorVersion, Error, v1, v2, v3, v4, v5, v6};
-use nym_credentials_interface::CredentialSpendingData;
-use nym_crypto::asymmetric::x25519;
-use nym_wireguard_types::PeerPublicKey;
 use std::fmt;
 use std::net::{Ipv4Addr, Ipv6Addr};
-use tracing::error;
+
+use nym_credentials_interface::CredentialSpendingData;
+use nym_crypto::asymmetric::x25519::PrivateKey;
+use nym_wireguard_types::PeerPublicKey;
+
+use crate::latest::registration::IpPair;
+use crate::{AuthenticatorVersion, Error, v1, v2, v3, v4, v5};

 pub trait Versionable {
    fn version(&self) -> AuthenticatorVersion;
@@ -51,12 +51,6 @@ impl Versionable for v5::registration::InitMessage {
    }
 }

-impl Versionable for v6::registration::InitMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V6
-    }
-}
-
 impl Versionable for v2::registration::FinalMessage {
    fn version(&self) -> AuthenticatorVersion {
        AuthenticatorVersion::V2
@@ -81,12 +75,6 @@ impl Versionable for v5::registration::FinalMessage {
    }
 }

-impl Versionable for v6::registration::FinalMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V6
-    }
-}
-
 impl Versionable for PeerPublicKey {
    fn version(&self) -> AuthenticatorVersion {
        AuthenticatorVersion::V3
@@ -110,158 +98,6 @@ impl Versionable for v5::topup::TopUpMessage {
        AuthenticatorVersion::V5
    }
 }
-impl Versionable for v6::topup::TopUpMessage {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V6
-    }
-}
-
-impl Versionable for v6::upgrade_mode_check::UpgradeModeCheckRequest {
-    fn version(&self) -> AuthenticatorVersion {
-        AuthenticatorVersion::V6
-    }
-}
-
-pub trait UpgradeModeStatus: Id + fmt::Debug {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus;
-}
-
-impl UpgradeModeStatus for v1::response::PendingRegistrationResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v1::response::RegisteredResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v1::response::RemainingBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v2::response::PendingRegistrationResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v2::response::RegisteredResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v2::response::RemainingBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-impl UpgradeModeStatus for v3::response::PendingRegistrationResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v3::response::RegisteredResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v3::response::RemainingBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v3::response::TopUpBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v4::response::PendingRegistrationResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v4::response::RegisteredResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v4::response::RemainingBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v4::response::TopUpBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v5::response::PendingRegistrationResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v5::response::RegisteredResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v5::response::RemainingBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v5::response::TopUpBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        CurrentUpgradeModeStatus::Unknown
-    }
-}
-
-impl UpgradeModeStatus for v6::response::PendingRegistrationResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        self.upgrade_mode_enabled.into()
-    }
-}
-
-impl UpgradeModeStatus for v6::response::RegisteredResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        self.upgrade_mode_enabled.into()
-    }
-}
-
-impl UpgradeModeStatus for v6::response::RemainingBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        self.upgrade_mode_enabled.into()
-    }
-}
-
-impl UpgradeModeStatus for v6::response::TopUpBandwidthResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        self.upgrade_mode_enabled.into()
-    }
-}
-
-impl UpgradeModeStatus for v6::response::UpgradeModeResponse {
-    fn upgrade_mode_status(&self) -> CurrentUpgradeModeStatus {
-        self.upgrade_mode_enabled.into()
-    }
-}

 pub trait InitMessage: Versionable + fmt::Debug {
    fn pub_key(&self) -> PeerPublicKey;
@@ -297,20 +133,14 @@ impl InitMessage for v5::registration::InitMessage {
    }
 }

-impl InitMessage for v6::registration::InitMessage {
-    fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-}
-
 pub trait FinalMessage: Versionable + fmt::Debug {
    fn gateway_client_pub_key(&self) -> PeerPublicKey;
-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error>;
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error>;
    fn private_ips(&self) -> IpPair;
    fn gateway_client_ipv4(&self) -> Option<Ipv4Addr>;
    fn gateway_client_ipv6(&self) -> Option<Ipv6Addr>;
    fn gateway_client_mac(&self) -> Vec<u8>;
-    fn credential(&self) -> Option<BandwidthClaim>;
+    fn credential(&self) -> Option<CredentialSpendingData>;
 }

 impl FinalMessage for v1::GatewayClient {
@@ -318,7 +148,7 @@ impl FinalMessage for v1::GatewayClient {
        self.pub_key
    }

-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error> {
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
        self.verify(private_key, nonce)
    }

@@ -341,7 +171,7 @@ impl FinalMessage for v1::GatewayClient {
        self.mac.to_vec()
    }

-    fn credential(&self) -> Option<BandwidthClaim> {
+    fn credential(&self) -> Option<CredentialSpendingData> {
        None
    }
 }
@@ -351,7 +181,7 @@ impl FinalMessage for v2::registration::FinalMessage {
        self.gateway_client.pub_key
    }

-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error> {
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
        self.gateway_client.verify(private_key, nonce)
    }

@@ -374,12 +204,8 @@ impl FinalMessage for v2::registration::FinalMessage {
        self.gateway_client.mac.to_vec()
    }

-    fn credential(&self) -> Option<BandwidthClaim> {
-        self.credential.clone().and_then(|c| {
-            c.try_into()
-                .inspect_err(|err| error!("credential conversion error: {err}"))
-                .ok()
-        })
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
    }
 }

@@ -388,7 +214,7 @@ impl FinalMessage for v3::registration::FinalMessage {
        self.gateway_client.pub_key
    }

-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error> {
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
        self.gateway_client.verify(private_key, nonce)
    }

@@ -411,12 +237,8 @@ impl FinalMessage for v3::registration::FinalMessage {
        self.gateway_client.mac.to_vec()
    }

-    fn credential(&self) -> Option<BandwidthClaim> {
-        self.credential.clone().and_then(|c| {
-            c.try_into()
-                .inspect_err(|err| error!("credential conversion error: {err}"))
-                .ok()
-        })
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
    }
 }

@@ -425,42 +247,7 @@ impl FinalMessage for v4::registration::FinalMessage {
        self.gateway_client.pub_key
    }

-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error> {
-        self.gateway_client.verify(private_key, nonce)
-    }
-
-    fn private_ips(&self) -> IpPair {
-        // v4 -> v5 -> v6
-        v5::registration::IpPair::from(self.gateway_client.private_ips).into()
-    }
-
-    fn gateway_client_ipv4(&self) -> Option<Ipv4Addr> {
-        Some(self.gateway_client.private_ips.ipv4)
-    }
-
-    fn gateway_client_ipv6(&self) -> Option<Ipv6Addr> {
-        Some(self.gateway_client.private_ips.ipv6)
-    }
-
-    fn gateway_client_mac(&self) -> Vec<u8> {
-        self.gateway_client.mac.to_vec()
-    }
-
-    fn credential(&self) -> Option<BandwidthClaim> {
-        self.credential.clone().and_then(|c| {
-            c.try_into()
-                .inspect_err(|err| error!("credential conversion error: {err}"))
-                .ok()
-        })
-    }
-}
-
-impl FinalMessage for v5::registration::FinalMessage {
-    fn gateway_client_pub_key(&self) -> PeerPublicKey {
-        self.gateway_client.pub_key
-    }
-
-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error> {
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
        self.gateway_client.verify(private_key, nonce)
    }

@@ -480,21 +267,17 @@ impl FinalMessage for v5::registration::FinalMessage {
        self.gateway_client.mac.to_vec()
    }

-    fn credential(&self) -> Option<BandwidthClaim> {
-        self.credential.clone().and_then(|c| {
-            c.try_into()
-                .inspect_err(|err| error!("credential conversion error: {err}"))
-                .ok()
-        })
+    fn credential(&self) -> Option<CredentialSpendingData> {
+        self.credential.clone()
    }
 }

-impl FinalMessage for v6::registration::FinalMessage {
+impl FinalMessage for v5::registration::FinalMessage {
    fn gateway_client_pub_key(&self) -> PeerPublicKey {
        self.gateway_client.pub_key
    }

-    fn verify(&self, private_key: &x25519::PrivateKey, nonce: u64) -> Result<(), Error> {
+    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
        self.gateway_client.verify(private_key, nonce)
    }

@@ -514,7 +297,7 @@ impl FinalMessage for v6::registration::FinalMessage {
        self.gateway_client.mac.to_vec()
    }

-    fn credential(&self) -> Option<BandwidthClaim> {
+    fn credential(&self) -> Option<CredentialSpendingData> {
        self.credential.clone()
    }
 }
@@ -564,42 +347,10 @@ impl TopUpMessage for v5::topup::TopUpMessage {
    }
 }

-impl TopUpMessage for v6::topup::TopUpMessage {
-    fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-
-    fn credential(&self) -> CredentialSpendingData {
-        self.credential.clone()
-    }
-}
-
-pub trait UpgradeModeMessage: Versionable + fmt::Debug {
-    // the idea is to expose different types of emergency credentials here,
-    // like upgrade mode JWT, emergency threshold credential issued by signers, etc.
-    fn upgrade_mode_global_attestation_jwt(&self) -> Option<String>;
-}
-
-impl UpgradeModeMessage for v6::upgrade_mode_check::UpgradeModeCheckRequest {
-    fn upgrade_mode_global_attestation_jwt(&self) -> Option<String> {
-        use v6::upgrade_mode_check::UpgradeModeCheckRequest;
-
-        match self {
-            UpgradeModeCheckRequest::UpgradeModeJwt { token } => Some(token.clone()),
-        }
-    }
-}
-
 pub trait Id {
    fn id(&self) -> u64;
 }

-impl Id for v1::response::PendingRegistrationResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
 impl Id for v2::response::PendingRegistrationResponse {
    fn id(&self) -> u64 {
        self.request_id
@@ -624,18 +375,6 @@ impl Id for v5::response::PendingRegistrationResponse {
    }
 }

-impl Id for v6::response::PendingRegistrationResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v1::response::RegisteredResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
 impl Id for v2::response::RegisteredResponse {
    fn id(&self) -> u64 {
        self.request_id
@@ -660,18 +399,6 @@ impl Id for v5::response::RegisteredResponse {
    }
 }

-impl Id for v6::response::RegisteredResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v1::response::RemainingBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
 impl Id for v2::response::RemainingBandwidthResponse {
    fn id(&self) -> u64 {
        self.request_id
@@ -696,12 +423,6 @@ impl Id for v5::response::RemainingBandwidthResponse {
    }
 }

-impl Id for v6::response::RemainingBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
 impl Id for v3::response::TopUpBandwidthResponse {
    fn id(&self) -> u64 {
        self.request_id
@@ -720,28 +441,11 @@ impl Id for v5::response::TopUpBandwidthResponse {
    }
 }

-impl Id for v6::response::TopUpBandwidthResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-impl Id for v6::response::UpgradeModeResponse {
-    fn id(&self) -> u64 {
-        self.request_id
-    }
-}
-
-pub trait PendingRegistrationResponse: Id + UpgradeModeStatus + fmt::Debug {
+pub trait PendingRegistrationResponse: Id + fmt::Debug {
    fn nonce(&self) -> u64;
-    fn verify(&self, gateway_key: &x25519::PrivateKey) -> Result<(), Error>;
+    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error>;
    fn pub_key(&self) -> PeerPublicKey;
    fn private_ips(&self) -> IpPair;
-    fn finalise_registration(
-        &self,
-        private_key: &x25519::PrivateKey,
-        credential: Option<BandwidthClaim>,
-    ) -> Box<dyn FinalMessage + Send + Sync>;
 }

 impl PendingRegistrationResponse for v2::response::PendingRegistrationResponse {
@@ -749,7 +453,7 @@ impl PendingRegistrationResponse for v2::response::PendingRegistrationResponse {
        self.reply.nonce
    }

-    fn verify(&self, gateway_key: &x25519::PrivateKey) -> Result<(), Error> {
+    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error> {
        self.reply.gateway_data.verify(gateway_key, self.nonce())
    }

@@ -760,22 +464,6 @@ impl PendingRegistrationResponse for v2::response::PendingRegistrationResponse {
    fn private_ips(&self) -> IpPair {
        self.reply.gateway_data.private_ip.into()
    }
-
-    fn finalise_registration(
-        &self,
-        private_key: &x25519::PrivateKey,
-        credential: Option<BandwidthClaim>,
-    ) -> Box<dyn FinalMessage + Send + Sync> {
-        Box::new(v2::registration::FinalMessage {
-            gateway_client: v2::registration::GatewayClient::new(
-                private_key,
-                self.pub_key().inner(),
-                self.private_ips().ipv4.into(),
-                self.nonce(),
-            ),
-            credential: credential.and_then(|b| b.credential.into_zk_nym().map(|c| *c)),
-        })
-    }
 }

 impl PendingRegistrationResponse for v3::response::PendingRegistrationResponse {
@@ -783,7 +471,7 @@ impl PendingRegistrationResponse for v3::response::PendingRegistrationResponse {
        self.reply.nonce
    }

-    fn verify(&self, gateway_key: &x25519::PrivateKey) -> Result<(), Error> {
+    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error> {
        self.reply.gateway_data.verify(gateway_key, self.nonce())
    }

@@ -794,22 +482,6 @@ impl PendingRegistrationResponse for v3::response::PendingRegistrationResponse {
    fn private_ips(&self) -> IpPair {
        self.reply.gateway_data.private_ip.into()
    }
-
-    fn finalise_registration(
-        &self,
-        private_key: &x25519::PrivateKey,
-        credential: Option<BandwidthClaim>,
-    ) -> Box<dyn FinalMessage + Send + Sync> {
-        Box::new(v3::registration::FinalMessage {
-            gateway_client: v3::registration::GatewayClient::new(
-                private_key,
-                self.pub_key().inner(),
-                self.private_ips().ipv4.into(),
-                self.nonce(),
-            ),
-            credential: credential.and_then(|b| b.credential.into_zk_nym().map(|c| *c)),
-        })
-    }
 }

 impl PendingRegistrationResponse for v4::response::PendingRegistrationResponse {
@@ -817,42 +489,7 @@ impl PendingRegistrationResponse for v4::response::PendingRegistrationResponse {
        self.reply.nonce
    }

-    fn verify(&self, gateway_key: &x25519::PrivateKey) -> Result<(), Error> {
-        self.reply.gateway_data.verify(gateway_key, self.nonce())
-    }
-
-    fn pub_key(&self) -> PeerPublicKey {
-        self.reply.gateway_data.pub_key
-    }
-
-    fn private_ips(&self) -> IpPair {
-        // v4 -> v5 -> v6
-        v5::registration::IpPair::from(self.reply.gateway_data.private_ips).into()
-    }
-
-    fn finalise_registration(
-        &self,
-        private_key: &x25519::PrivateKey,
-        credential: Option<BandwidthClaim>,
-    ) -> Box<dyn FinalMessage + Send + Sync> {
-        Box::new(v4::registration::FinalMessage {
-            gateway_client: v4::registration::GatewayClient::new(
-                private_key,
-                self.pub_key().inner(),
-                self.reply.gateway_data.private_ips,
-                self.nonce(),
-            ),
-            credential: credential.and_then(|b| b.credential.into_zk_nym().map(|c| *c)),
-        })
-    }
-}
-
-impl PendingRegistrationResponse for v5::response::PendingRegistrationResponse {
-    fn nonce(&self) -> u64 {
-        self.reply.nonce
-    }
-
-    fn verify(&self, gateway_key: &x25519::PrivateKey) -> Result<(), Error> {
+    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error> {
        self.reply.gateway_data.verify(gateway_key, self.nonce())
    }

@@ -863,30 +500,14 @@ impl PendingRegistrationResponse for v5::response::PendingRegistrationResponse {
    fn private_ips(&self) -> IpPair {
        self.reply.gateway_data.private_ips.into()
    }
-
-    fn finalise_registration(
-        &self,
-        private_key: &x25519::PrivateKey,
-        credential: Option<BandwidthClaim>,
-    ) -> Box<dyn FinalMessage + Send + Sync> {
-        Box::new(v5::registration::FinalMessage {
-            gateway_client: v5::registration::GatewayClient::new(
-                private_key,
-                self.pub_key().inner(),
-                self.reply.gateway_data.private_ips,
-                self.nonce(),
-            ),
-            credential: credential.and_then(|b| b.credential.into_zk_nym().map(|c| *c)),
-        })
-    }
 }

-impl PendingRegistrationResponse for v6::response::PendingRegistrationResponse {
+impl PendingRegistrationResponse for v5::response::PendingRegistrationResponse {
    fn nonce(&self) -> u64 {
        self.reply.nonce
    }

-    fn verify(&self, gateway_key: &x25519::PrivateKey) -> Result<(), Error> {
+    fn verify(&self, gateway_key: &PrivateKey) -> std::result::Result<(), Error> {
        self.reply.gateway_data.verify(gateway_key, self.nonce())
    }

@@ -897,25 +518,9 @@ impl PendingRegistrationResponse for v6::response::PendingRegistrationResponse {
    fn private_ips(&self) -> IpPair {
        self.reply.gateway_data.private_ips
    }
-
-    fn finalise_registration(
-        &self,
-        private_key: &x25519::PrivateKey,
-        credential: Option<BandwidthClaim>,
-    ) -> Box<dyn FinalMessage + Send + Sync> {
-        Box::new(v6::registration::FinalMessage {
-            gateway_client: v6::registration::GatewayClient::new(
-                private_key,
-                self.pub_key().inner(),
-                self.reply.gateway_data.private_ips,
-                self.nonce(),
-            ),
-            credential,
-        })
-    }
 }

-pub trait RegisteredResponse: Id + UpgradeModeStatus + fmt::Debug {
+pub trait RegisteredResponse: Id + fmt::Debug {
    fn private_ips(&self) -> IpPair;
    fn pub_key(&self) -> PeerPublicKey;
    fn wg_port(&self) -> u16;
@@ -950,8 +555,7 @@ impl RegisteredResponse for v3::response::RegisteredResponse {
 }
 impl RegisteredResponse for v4::response::RegisteredResponse {
    fn private_ips(&self) -> IpPair {
-        // v4 -> v5 -> v6
-        v5::registration::IpPair::from(self.reply.private_ips).into()
+        self.reply.private_ips.into()
    }

    fn pub_key(&self) -> PeerPublicKey {
@@ -964,20 +568,6 @@ impl RegisteredResponse for v4::response::RegisteredResponse {
 }

 impl RegisteredResponse for v5::response::RegisteredResponse {
-    fn private_ips(&self) -> IpPair {
-        self.reply.private_ips.into()
-    }
-
-    fn pub_key(&self) -> PeerPublicKey {
-        self.reply.pub_key
-    }
-
-    fn wg_port(&self) -> u16 {
-        self.reply.wg_port
-    }
-}
-
-impl RegisteredResponse for v6::response::RegisteredResponse {
    fn private_ips(&self) -> IpPair {
        self.reply.private_ips
    }
@@ -991,7 +581,7 @@ impl RegisteredResponse for v6::response::RegisteredResponse {
    }
 }

-pub trait RemainingBandwidthResponse: Id + UpgradeModeStatus + fmt::Debug {
+pub trait RemainingBandwidthResponse: Id + fmt::Debug {
    fn available_bandwidth(&self) -> Option<i64>;
 }

@@ -1019,13 +609,7 @@ impl RemainingBandwidthResponse for v5::response::RemainingBandwidthResponse {
    }
 }

-impl RemainingBandwidthResponse for v6::response::RemainingBandwidthResponse {
-    fn available_bandwidth(&self) -> Option<i64> {
-        self.reply.as_ref().map(|r| r.available_bandwidth)
-    }
-}
-
-pub trait TopUpBandwidthResponse: Id + UpgradeModeStatus + fmt::Debug {
+pub trait TopUpBandwidthResponse: Id + fmt::Debug {
    fn available_bandwidth(&self) -> i64;
 }

@@ -1046,9 +630,3 @@ impl TopUpBandwidthResponse for v5::response::TopUpBandwidthResponse {
        self.reply.available_bandwidth
    }
 }
-
-impl TopUpBandwidthResponse for v6::response::TopUpBandwidthResponse {
-    fn available_bandwidth(&self) -> i64 {
-        self.reply.available_bandwidth
-    }
-}
@@ -48,7 +48,7 @@ pub struct RegistrationData {
 }

 #[derive(Serialize, Deserialize, Debug, Clone)]
-pub struct RegisteredData {
+pub struct RegistredData {
    pub pub_key: PeerPublicKey,
    pub private_ip: IpAddr,
    pub wg_port: u16,
@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_sphinx::addressing::Recipient;
 use serde::{Deserialize, Serialize};

@@ -34,7 +34,7 @@ impl AuthenticatorResponse {
    }

    pub fn new_registered(
-        registred_data: RegisteredData,
+        registred_data: RegistredData,
        reply_to: Recipient,
        request_id: u64,
    ) -> Self {
@@ -108,7 +108,7 @@ pub struct PendingRegistrationResponse {
 pub struct RegisteredResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
-    pub reply: RegisteredData,
+    pub reply: RegistredData,
 }

 #[derive(Clone, Debug, Serialize, Deserialize)]
@@ -154,8 +154,8 @@ impl From<v2::registration::RegistrationData> for v1::registration::Registration
    }
 }

-impl From<v2::registration::RegisteredData> for v1::registration::RegisteredData {
-    fn from(value: v2::registration::RegisteredData) -> Self {
+impl From<v2::registration::RegistredData> for v1::registration::RegistredData {
+    fn from(value: v2::registration::RegistredData) -> Self {
        Self {
            pub_key: value.pub_key,
            private_ip: value.private_ip,
@@ -58,7 +58,7 @@ pub struct RegistrationData {
 }

 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegisteredData {
+pub struct RegistredData {
    pub pub_key: PeerPublicKey,
    pub private_ip: IpAddr,
    pub wg_port: u16,
@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use super::registration::{RegisteredData, RegistrationData, RemainingBandwidthData};
+use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
 use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
 use nym_sphinx::addressing::Recipient;
 use serde::{Deserialize, Serialize};
@@ -38,7 +38,7 @@ impl AuthenticatorResponse {
    }

    pub fn new_registered(
-        registred_data: RegisteredData,
+        registred_data: RegistredData,
        reply_to: Recipient,
        request_id: u64,
    ) -> Self {
@@ -118,7 +118,7 @@ pub struct PendingRegistrationResponse {
 pub struct RegisteredResponse {
    pub request_id: u64,
    pub reply_to: Recipient,
-    pub reply: RegisteredData,
+    pub reply: RegistredData,
 }

 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
@@ -299,8 +299,8 @@ impl From<v2::registration::RegistrationData> for v3::registration::Registration
    }
 }

-impl From<v3::registration::RegisteredData> for v2::registration::RegisteredData {
-    fn from(value: v3::registration::RegisteredData) -> Self {
+impl From<v3::registration::RegistredData> for v2::registration::RegistredData {
+    fn from(value: v3::registration::RegistredData) -> Self {
        Self {
            pub_key: value.pub_key,
            private_ip: value.private_ip,
@@ -309,8 +309,8 @@ impl From<v3::registration::RegisteredData> for v2::registration::RegisteredData
    }
 }

-impl From<v2::registration::RegisteredData> for v3::registration::RegisteredData {
-    fn from(value: v2::registration::RegisteredData) -> Self {
+impl From<v2::registration::RegistredData> for v3::registration::RegistredData {
+    fn from(value: v2::registration::RegistredData) -> Self {
        Self {
            pub_key: value.pub_key,
            private_ip: value.private_ip,
@@ -674,7 +674,7 @@ mod tests {
        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
        let private_ip = IpAddr::from_str("10.10.10.10").unwrap();
        let wg_port = 51822;
-        let registred_data = v2::registration::RegisteredData {
+        let registred_data = v2::registration::RegistredData {
            pub_key,
            private_ip,
            wg_port,
@@ -701,7 +701,7 @@ mod tests {
            v3::response::AuthenticatorResponseData::Registered(v3::response::RegisteredResponse {
                request_id,
                reply_to,
-                reply: v3::registration::RegisteredData {
+                reply: v3::registration::RegistredData {
                    wg_port,
                    pub_key,
                    private_ip
@@ -715,7 +715,7 @@ mod tests {
        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
        let private_ip = IpAddr::from_str("10.10.10.10").unwrap();
        let wg_port = 51822;
-        let registred_data = v3::registration::RegisteredData {
+        let registred_data = v3::registration::RegistredData {
            pub_key,
            private_ip,
            wg_port,
@@ -742,7 +742,7 @@ mod tests {
            v2::response::AuthenticatorResponseData::Registered(v2::response::RegisteredResponse {
                request_id,
                reply_to,
-                reply: v2::registration::RegisteredData {
+                reply: v2::registration::RegistredData {
                    wg_port,
                    pub_key,
                    private_ip
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
import this	340960d957	[DOCs/operators]: Release notes for v2025.19 kase (#6157 ) * add release and operators notes * bump up version * fix location in csv to USA * bump up stats * typo fix	2025-10-31 09:02:13 +00:00
Mark Sinclair	554e446208	change migration and bump version	2025-10-31 09:02:13 +00:00
Mark Sinclair	a6325b922a	bump version to rc	2025-10-31 09:02:13 +00:00
Mark Sinclair	fae4768b99	add tracing output	2025-10-31 09:02:13 +00:00
Mark Sinclair	2689a4dbd8	clippy	2025-10-31 09:02:13 +00:00
Mark Sinclair	02e40ccaef	save custom_http_port to db	2025-10-31 09:02:13 +00:00
Mark Sinclair	b216338364	allow NS API to run once for scraping for troubleshooting and debugging	2025-10-31 09:02:13 +00:00
Mark Sinclair	4a83bb9ba8	wip	2025-10-31 09:02:13 +00:00
Mark Sinclair	66ec3b037f	ns-api: fix scraping bug when operator specifies custom node HTTP API port in bond	2025-10-31 09:02:13 +00:00
import this	168baa5071	[Feature/operators]: QUIC bridge deployment script v2 (#6145 ) * new quick deployment script * docs tweak * update script to use .deb postinst * final clean - ready to go * correct nym-node config dir search with a fallback	2025-10-31 09:02:13 +00:00
Simon Wicky	7aef468839	remove unused deps (#6151 )	2025-10-31 09:02:12 +00:00
Simon Wicky	cb3ccd7f7e	use typed builder (#6150 )	2025-10-31 09:02:12 +00:00
Simon Wicky	16509dbace	allow overwriting existing sdk shutdown manager	2025-10-31 09:02:12 +00:00
Simon Wicky	b907ccbd5b	typo	2025-10-31 09:02:12 +00:00
Simon Wicky	7b3194d7d2	calling for shutdown from the MixTrafficController	2025-10-31 09:02:12 +00:00
Jędrzej Stuczyński	0b81edfc66	using same hierarchy of trackers for client shutdown control	2025-10-31 09:02:12 +00:00
Tommy Verrall	8c6150e5ef	Internal comments	2025-10-31 09:02:12 +00:00
Tommy Verrall	46164a389a	Fix comments	2025-10-31 09:02:12 +00:00
Tommy Verrall	96d256b48f	Better message to come in the PR description	2025-10-31 09:02:12 +00:00
Simon Wicky	f98b93f60e	tommy is too quick	2025-10-31 09:02:12 +00:00
Simon Wicky	0f6c356f39	configurable mixnet client startup timeout	2025-10-31 09:02:12 +00:00
p17o	cf3f5d9a53	Update quic_bridge_deployment.sh for IPv4 and .deb package (#6138 ) Updated ping commands to explicitly use IPv4 and adjusted file permission checks with sudo. Changed the forward address prompt to specify IPv4 and modified the binary download process to fetch and install the latest .deb release URL automatically.	2025-10-31 09:02:12 +00:00
Jędrzej Stuczyński	2f47e6349a	bugfix: update internal owner address in transferred share (#6139 )	2025-10-31 09:02:12 +00:00
Tommy Verrall	4b2b5390d3	Last failing test - fix	2025-10-31 09:02:12 +00:00
Tommy Verrall	734ff63f6d	Use explicit Vec<ApiUrl> handling in BaseClientBuilder - Replace NymNetworkDetails with explicit API URL handling - Fix deprecated from_network() usage and improve fallback logic - Add URL validation and remove unused backwards compatibility	2025-10-31 09:02:11 +00:00
Tommy Verrall	910c24e7da	Actually commit the recommended changes	2025-10-31 09:02:11 +00:00
Tommy Verrall	c96b73172a	Fix broken tests in CI	2025-10-31 09:02:11 +00:00
Tommy Verrall	823c2c7262	Replace deprecated from_network() with new_with_fronted_urls()	2025-10-31 09:02:11 +00:00
Jędrzej Stuczyński	03d1b72a9e	feat: expose more explicit new_with_fronted_urls builder for http API client (#6136 )	2025-10-31 09:02:10 +00:00
Jędrzej Stuczyński	066669440f	bugfix: update stored epoch share when changing ownership (#6135 )	2025-10-31 09:01:27 +00:00
Jędrzej Stuczyński	9fb3443fd1	bugfix: update stored epoch share when changing announce address (#6131 ) * bugfix: update stored epoch share when changing announce address * chore: remove placeholder legacy mixnode bonding test [mixnet contract]	2025-10-31 09:01:27 +00:00
Tommy Verrall	cd89a590b5	Fix new_from_env() to populate nym_api_urls for domain fronting	2025-10-31 09:01:27 +00:00
Tommy Verrall	06cb8bd969	fix all clippy messages	2025-10-31 09:01:27 +00:00
Tommy Verrall	c72fef169c	Add more tests for retry logic	2025-10-31 09:01:27 +00:00
Tommy Verrall	3c27eb41b8	Fix confusing tracing logs	2025-10-31 09:01:27 +00:00
Tommy Verrall	2428374fe7	Fix retries - this is working	2025-10-31 09:01:27 +00:00
Tommy Verrall	5a491f0a7e	Add configuration-based domain fronting support Changes: - Add network_details field to BaseClientBuilder (optional, backwards compatible) - Add with_network_details() method for opt-in domain fronting - Update construct_nym_api_client() to use from_network() when network_details provided - Enable network-defaults feature in nym-client-core Cargo.toml - SDK passes network_details to BaseClientBuilder	2025-10-31 09:01:27 +00:00
Tommy Verrall	530f9ccb6f	Fix CI issues	2025-10-31 09:01:26 +00:00
Tommy Verrall	2228a81d43	Allow clippy::enum_variant_names for BuilderConfigError	2025-10-31 09:01:26 +00:00
Tommy Verrall	c8a1b53071	Improve error handling Changes: - Replace String error with BuilderConfigError enum in BuilderConfigBuilder - Update tests to use pattern matching instead of string assertions	2025-10-31 09:01:26 +00:00
Tommy Verrall	b896aaaed1	- Add DEFAULT_NYM_API_RETRIES constant (replaces magic number 3) - Run cargo fmt on all affected packages - All clippy warnings resolved	2025-10-31 09:01:26 +00:00
Tommy Verrall	828ffc6710	not sure what happened but it's fixed	2025-10-31 09:01:26 +00:00
Andy Duplain	05cdb27029	VPN-4262: Update `Url` to return `url` and `front` fields. The VPN client is using the `Url` type alot now and in order to avoid double URL-parsing we would like the content of the `Url` type exposed.	2025-10-31 09:01:26 +00:00
Tommy Verrall	3f29d3eba5	Add accessor methods for Url internals Add inner_url() and fronts() accessor methods to nym_http_api_client::Url for VPN client integration	2025-10-31 09:01:22 +00:00
Tommy Verrall	aa2c41dc41	Merge resolution	2025-10-31 09:01:02 +00:00
Tommy Verrall	048de771ab	Remove tests for removed with_nym_api_client method These tests were referencing with_nym_api_client() which was removed when cleaning domain fronting code from this branch	2025-10-31 09:01:02 +00:00
Tommy Verrall	e1b06f02f3	Add optional builder pattern for BuilderConfig (non-breaking) Addresses @jstuczyn's feedback about too many arguments by adding BuilderConfigBuilder as an alternative to the existing new() method.	2025-10-31 09:01:02 +00:00
Tommy Verrall	b5b8b8f224	fix conversion type && make the retry count configurable	2025-10-31 09:01:02 +00:00
Tommy Verrall	2d7141dfb1	Revert node filtering changes per Andrew's feedback Andrew clarified that get_basic_entry_assigned_nodes_v2() already filters by supported_roles.entry	2025-10-31 09:01:02 +00:00
Tommy Verrall	a07522258f	Remove domain fronting code to keep gateway changes only This branch now contains only gateway registration improvements: - Multiple URL fallback support in gateways_for_init() - Get all entry-capable nodes for registration - Performance and code quality improvements	2025-10-31 09:00:17 +00:00
Tommy Verrall	547a441002	Address PR feedback: simplify code and reduce log noise - Reverted all changes to topology_control/nym_api_provider.rs - Changed info/warn logs to debug for custom client messages - Removed unused _rng parameter from gateways_for_init() - Simplified URL builder to always use new_with_urls()	2025-10-31 09:00:17 +00:00
Tommy Verrall	93208fb5e0	Fix clippy warnings: use arrays instead of vec! in tests	2025-10-31 09:00:17 +00:00
Bogdan-Ștefan Neacşu	c9b50dd979	Introduce event backchannel (#6119 ) * Introduce even backchannel * Rust fmt * Rename Event to MixnetClientEvent * Use unbounded_send for events * Remove unused file * Remove mut borrow * Event hierarchy and mixnet client intermediary * Export MixTrafficEvent in sdk	2025-10-31 09:00:15 +00:00
Jędrzej Stuczyński	74cdfd5d94	Merge pull request #6099 from nymtech/bugfix/incompatibility-fixes Bugfix/incompatibility fixes	2025-10-31 08:59:40 +00:00
Jędrzej Stuczyński	953e813f0e	Bugfix/bloomfilters purge (#6089 ) * remove all old bloomfilters upon starting binary * remove old bloomfilter file upon purging secondary data	2025-10-31 08:59:38 +00:00
Tommy Verrall	29cf5058a6	feat: pass custom HTTP client through SDK stack for domain fronting - Add with_nym_api_client() to BaseClientBuilder, MixnetClientBuilder, and RegistrationClientBuilderConfig - Modify nym_api_provider to fetch all nodes then filter by supported_roles.entry (fixes metadata inconsistency) - Update helpers.rs to build HTTP client with all nym_apis URLs and retries for fallback support - Fix SDK to use entry_capable_nodes() instead of entry_gateways() for broader gateway selection This enables domain fronting and URL rotation throughout the entire SDK stack, improving censorship resistance and connection reliability. All changes are backward compatible - custom client is optional.	2025-10-31 08:57:08 +00:00
Tommy Verrall	a2856552d8	enable URL rotation and retries for mixnet gateway init	2025-10-31 08:57:08 +00:00
Andrej Mihajlov	a33c603471	Update dirs to 6.0	2025-10-31 08:57:08 +00:00
Jędrzej Stuczyński	a9f9266992	bugfix: nym-credential-proxy query params parsing regression (#6121 )	2025-10-31 08:57:08 +00:00
Tommy Verrall	cf34d0d24a	Skip ipv6 metadata endpoint request (#6118 ) Co-authored-by: Tommy Verrall <tommy@nymtech.net>	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	5fa7b0a709	bugfix: revert some dep updates introduced in #6043 (#6120 )	2025-10-31 08:57:07 +00:00
Andrej Mihajlov	e232b4fd24	Revert "Propagate cancel token to mixnet client" This reverts commit `50a259d454`.	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	609f174e8d	chore: restore pending dkg contract state migration (#6116 ) since it has not yet been run on mainnet	2025-10-31 08:57:07 +00:00
benedetta davico	a0f4627647	Update lib.go	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	258f8f5f5d	bugfix: retrieve and update ticketbook in the same query (#6101 ) * bugfix: retrieve and update ticketbook in the same query * bump up NS version * Update Cargo.toml * remove SKIP LOCKED part of the query --------- Co-authored-by: benedetta davico <46782255+benedettadavico@users.noreply.github.com>	2025-10-31 08:57:07 +00:00
mfahampshire	38220e05f1	DOCS Jarlsberg Release (#6111 ) * First pass release notes * build info	2025-10-31 08:57:07 +00:00
Andrej Mihajlov	6250ebe235	Propagate cancel token to mixnet client	2025-10-31 08:57:07 +00:00
mfahampshire	a55323c0e2	Patch for operators to open wg metadata port (#6106 )	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	baa8ac3610	bugfix: use custom topology provider for list of init gateways (#6092 )	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	933da11e8f	bugfix: include network name in the default gateway probe config path (#6100 )	2025-10-31 08:57:07 +00:00
Jędrzej Stuczyński	0469036da4	feat: expose obtaining reference to Mnemonic from DirectSecp256k1HdWallet (#6083 ) * feat: expose obtaining reference to Mnemonic from DirectSecp256k1HdWallet * updated getters for stringified mnemonic	2025-10-31 08:57:07 +00:00
Georgio Nicolas	63f9a856fa	Another offering for Clippy	2025-10-31 08:57:07 +00:00
Georgio Nicolas	c068948c62	Offerings for clippy	2025-10-31 08:57:06 +00:00
Georgio Nicolas	0105f9fa5e	Precompute BSGS table	2025-10-31 08:57:06 +00:00
Georgio Nicolas	004c737965	Use LazyLock to precompute generators	2025-10-31 08:57:06 +00:00
Georgio Nicolas	549121ca32	Fix clippy suggestion	2025-10-31 08:57:06 +00:00
Georgio Nicolas	3f2278dafc	Fix zeroization	2025-10-31 08:57:06 +00:00
Georgio Nicolas	25ce0ac814	replace unsafe static values by function calls	2025-10-31 08:57:06 +00:00
Mark Sinclair	38d313a101	ns-api: add descriptions to dVPN gateway responses (#6102 ) * ns-api: add descriptions to dVPN gateway responses * clippy * fmt --------- Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com>	2025-10-31 08:57:06 +00:00
import this	f67bc0ead5	[DOCs/operators] QUIC deployment script & docs (#6098 ) * add quic_bridge_deployment.sh * create a snippet with quick install steps * add quic deployment to changelog * add quic deployment to node config page * add version compatibility callout * last edits and scraped stats update * correct name of QUIC snippet * fix naming * fix naming * re-run python-prebuild.sh aka time-now updated * attempt to fix vercel build the hard way * rerun npm * build with pnpm * restore lock file and rebuild w pnpm * chore: update pnpm lockfile * attempt to fix build * attempt to fix runtime builds * update ci-docs run OS	2025-10-31 08:57:06 +00:00
Mark Sinclair	90aaa3572d	Update ci-docs.yml	2025-10-31 08:57:06 +00:00
Mark Sinclair	ecc61e4a4a	NS API: use new probe download filesize and milliseconds field (#6097 ) * use milliseconds field * change score thresholds * bump to version 4.0.8 * NS API: adjust score categories (#6103) * testing scores * test version * Update Cargo.toml --------- Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com> Co-authored-by: benedetta davico <46782255+benedettadavico@users.noreply.github.com>	2025-10-31 08:57:06 +00:00
Jędrzej Stuczyński	22ac4919e5	bugfix: testnet manager 02sql migration (#6096 )	2025-10-31 08:57:06 +00:00
Jędrzej Stuczyński	a1e7cc8e87	chore: remove unnecessary closure in 'calculate_score' inside node-status-api	2025-10-31 08:57:06 +00:00
Mark Sinclair	57df00637c	ns-api: use download files size from probes instead of parsing filenames	2025-10-31 08:57:06 +00:00
Jędrzej Stuczyński	c7eb3bdb7b	moved nym-gateway-probe to monorepo and updated rust-edition to 2024 (#6094 ) dont build netstack in CI additional rust 2024 fixes fixes removed temp.rs first round of cleanup removed duplicated NS types moved gateway probe to the monorepo	2025-10-31 08:57:05 +00:00
Mark Sinclair	8f9b704541	ns-api: add new fields for probe output for query_metadata and download file size and duration in ms (#6091 ) Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com>	2025-10-31 08:56:49 +00:00
Mark Sinclair	6a956c790a	NS API: clamp `load` to `offline` when score is `offline` and add `mixnet_score` field to preformance_v2 (#6076 ) * ns-api: when `score` is `Offline`, clamp `load` to `Offline` * ns-api: bump version * ns-api: add mixnet score field to performance_v2 struct --------- Co-authored-by: Mark Sinclair <mmsinclair@users.noreply.github.com>	2025-10-31 08:56:49 +00:00
mfahampshire	2ff5c7221a	Max/fix wasm client + build commands (#6043 ) * Debug logging * Yield based logging * Reintroduce non-dummy task manager, try add counting for BatchMessageSender, a couple of compiler target introductions on use statements. * Fixed time runtime err * Uncomment forgetme/rememberme * remove diffs from debug * missed commented out forgetme * yet more forgetme comments * * Added missing clientreqestsender clone to wasm client to stop premature drop & busyloop * Removed hacky mem::forget fix * Remove debug panic_hook * Conditional import + use of wasm_utils::console_log * add wasm_util dep * Commenting out or removing debug logging * Remove missed comment * cleanup gitignore * clippy * update go version in ci * removed unused deps * add clippy ignore * remove mixfetch from ci build * add minifetch fix * comment out unused ts builds * stop contract clients killing ci for the moment * wasm target locking for imports * Either remove console_log! macro or introduce cfg(debug_assertions) * downgrade netlink * debug assertions for console_log import * modify config logging (debug -> normal) * remove clone for client_request_sender + grab directly in struct creation * reintroduce debug print for config in debug mode * remove ood / unused custom topology from worker example file * clippy * clippy - ignore todo() tests * modified humantime test in line with new parsing rules	2025-10-31 08:56:49 +00:00