Connections timeout after 5 minutes due to IPv6 DNS queries failing on IPv6-disabled networks

[bugfix] Distinguish authenticator errors by credential spent (#6176 ) (#6192 )
* distinguish authenticator errors by credential spent * nitpicking fixes * fix CI to see those changes * error naming Co-authored-by: Simon Wicky <simon@nymtech.net>
2025-11-14 11:55:38 +01:00 · 2025-11-12 14:13:09 +02:00 · 2025-11-12 12:47:46 +01:00 · 2025-11-12 12:06:37 +01:00 · 2025-11-12 08:39:48 +01:00 · 2025-11-06 17:35:58 -07:00
49 changed files with 1132 additions and 308 deletions
@@ -8,10 +8,13 @@ on:
      - 'gateway/**'
      - 'integrations/**'
      - 'nym-api/**'
+      - 'nym-authenticator-client/**'
      - 'nym-credential-proxy/**'
+      - 'nym-ip-packet-client/**'
      - 'nym-network-monitor/**'
      - 'nym-node/**'
      - 'nym-node-status-api/**'
+      - 'nym-registration-client/**'
      - 'nym-statistics-api/**'
      - 'nym-outfox/**'
      - 'nym-validator-rewarder/**'
@@ -3,11 +3,6 @@ name: Build and upload Node Status agent container to harbor.nymte.ch
 on:
  workflow_dispatch:
    inputs:
-      gateway_probe_git_ref:
-        type: string
-        default: nym-vpn-core-v1.4.0
-        required: true
-        description: Which gateway probe git ref to build the image with
      release_image:
        description: 'Tag image as a release'
        required: true
@@ -43,16 +38,6 @@ jobs:
          VERSION=$(yq -oy '.package.version' ${{ env.WORKING_DIRECTORY }}/Cargo.toml)
          echo "result=$VERSION" >> $GITHUB_OUTPUT

-      - name: cleanup-gateway-probe-ref
-        id: cleanup_gateway_probe_ref
-        run: |
-          GATEWAY_PROBE_GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }}
-          GIT_REF_SLUG="${GATEWAY_PROBE_GIT_REF//\//-}"
-          echo "git_ref=${GIT_REF_SLUG}" >> $GITHUB_OUTPUT
-
-      - name: Set GIT_TAG variable
-        run: echo "GIT_TAG=${{ env.WORKING_DIRECTORY }}-${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
-
      - name: Initialize RELEASE_TAG
        run: echo "RELEASE_TAG=" >> $GITHUB_ENV
      
@@ -61,24 +46,12 @@ jobs:
        run: echo "RELEASE_TAG=golden-" >> $GITHUB_ENV
      
      - name: Set IMAGE_NAME_AND_TAGS variable
-        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}" >> $GITHUB_ENV
+        run: echo "IMAGE_NAME_AND_TAGS=${{ env.CONTAINER_NAME }}:${{ env.RELEASE_TAG }}${{ steps.get_version.outputs.result }}" >> $GITHUB_ENV
        
      - name: New env vars
-        run: echo "RELEASE_TAG='$RELEASE_TAG' GIT_TAG='$GIT_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        
-
-      # - name: Remove existing tag if exists
-      #   run: |
-      #     if git rev-parse $${{ env.GIT_TAG }} >/dev/null 2>&1; then
-      #       git push --delete origin $${{ env.GIT_TAG }}
-      #       git tag -d $${{ env.GIT_TAG }}
-      #     fi
-
-      # - name: Create tag
-      #   run: |
-      #     git tag -a $${{ env.GIT_TAG }} -m "Version ${{ steps.get_version.outputs.result }}-${{ steps.cleanup_gateway_probe_ref.outputs.git_ref }}"
-      #     git push origin $${{ env.GIT_TAG }}
+        run: echo "RELEASE_TAG='$RELEASE_TAG' IMAGE_NAME_AND_TAGS='$IMAGE_NAME_AND_TAGS'"        

      - name: BuildAndPushImageOnHarbor
        run: |
-          docker build --build-arg GIT_REF=${{ github.event.inputs.gateway_probe_git_ref }} -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
+          docker build -f ${{ env.WORKING_DIRECTORY }}/Dockerfile . -t harbor.nymte.ch/nym/${{ env.IMAGE_NAME_AND_TAGS }}
          docker push harbor.nymte.ch/nym/${{ env.CONTAINER_NAME }} --all-tags
@@ -4,6 +4,78 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

+## [2025.20-leerdammer] (2025-11-12)
+
+- Max/tweak ts sdk actions ([#6185])
+- chore: resolve clippy 1.91 warnings ([#6168])
+- [chore] Remove unused dependencies ([#6151])
+- Use typed-builder for registration client builder config ([#6150])
+- tommy is too quick ([#6149])
+- configurable mixnet client startup timeout ([#6148])
+- [Feature/operators]: QUIC bridge deployment script v2 ([#6145])
+- Bugfix: Add circuit breaker ([#6143])
+- bugfix: update internal owner address in transferred share ([#6139])
+- Update quic_bridge_deployment.sh for IPv4 and .deb package ([#6138])
+- feat: expose more explicit new_with_fronted_urls builder for http API client ([#6136])
+- bugfix: update stored epoch share when changing ownership ([#6135])
+- Domain fronting ([#6134])
+- bugfix: update stored epoch share when changing announce address ([#6131])
+
+[#6185]: https://github.com/nymtech/nym/pull/6185
+[#6168]: https://github.com/nymtech/nym/pull/6168
+[#6151]: https://github.com/nymtech/nym/pull/6151
+[#6150]: https://github.com/nymtech/nym/pull/6150
+[#6149]: https://github.com/nymtech/nym/pull/6149
+[#6148]: https://github.com/nymtech/nym/pull/6148
+[#6145]: https://github.com/nymtech/nym/pull/6145
+[#6143]: https://github.com/nymtech/nym/pull/6143
+[#6139]: https://github.com/nymtech/nym/pull/6139
+[#6138]: https://github.com/nymtech/nym/pull/6138
+[#6136]: https://github.com/nymtech/nym/pull/6136
+[#6135]: https://github.com/nymtech/nym/pull/6135
+[#6134]: https://github.com/nymtech/nym/pull/6134
+[#6131]: https://github.com/nymtech/nym/pull/6131
+
+## [2025.19-kase] (2025-10-30)
+
+- update ns agent workflow ([#6154])
+- Cherry pick - request #6143 from nymtech/bugfix/mix-tx-closed-v2 ([#6153])
+- bugfix: nym-credential-proxy query params parsing regression ([#6121])
+- bugfix: revert some dep updates introduced in #6043 ([#6120])
+- Skip ipv6 metadata endpoint request ([#6118])
+- update to no longer use 1mb files ([#6117])
+- chore: restore pending dkg contract state migration ([#6116])
+- Revert "Propagate cancel token to mixnet client" ([#6115])
+- Update dirs to 6.0 ([#6109])
+- Propagate cancel token to mixnet client ([#6105])
+- bugfix: retrieve and update ticketbook in the same query ([#6101])
+- bugfix: include network name in the default gateway probe config path ([#6100])
+- Bugfix/incompatibility fixes ([#6099])
+- [DOCs/operators] QUIC deployment script & docs ([#6098])
+- bugfix: testnet manager 02sql migration ([#6096])
+- feat: move gateway probe to monorepo (and update to rust edition 2024) ([#6094])
+- bugfix: use custom topology provider for list of init gateways ([#6092])
+- Max/fix wasm client + build commands ([#6043])
+
+[#6154]: https://github.com/nymtech/nym/pull/6154
+[#6153]: https://github.com/nymtech/nym/pull/6153
+[#6121]: https://github.com/nymtech/nym/pull/6121
+[#6120]: https://github.com/nymtech/nym/pull/6120
+[#6118]: https://github.com/nymtech/nym/pull/6118
+[#6117]: https://github.com/nymtech/nym/pull/6117
+[#6116]: https://github.com/nymtech/nym/pull/6116
+[#6115]: https://github.com/nymtech/nym/pull/6115
+[#6109]: https://github.com/nymtech/nym/pull/6109
+[#6105]: https://github.com/nymtech/nym/pull/6105
+[#6101]: https://github.com/nymtech/nym/pull/6101
+[#6100]: https://github.com/nymtech/nym/pull/6100
+[#6099]: https://github.com/nymtech/nym/pull/6099
+[#6098]: https://github.com/nymtech/nym/pull/6098
+[#6096]: https://github.com/nymtech/nym/pull/6096
+[#6094]: https://github.com/nymtech/nym/pull/6094
+[#6092]: https://github.com/nymtech/nym/pull/6092
+[#6043]: https://github.com/nymtech/nym/pull/6043
+
 ## [2025.18-jarlsberg] (2025-10-14)

 - ns-api: add descriptions to dVPN gateway responses ([#6102])
@@ -133,9 +133,9 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"

 [[package]]
 name = "ammonia"
-version = "4.1.1"
+version = "4.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6b346764dd0814805de8abf899fe03065bcee69bb1a4771c785817e39f3978f"
+checksum = "17e913097e1a2124b46746c980134e8c954bc17a6a59bb3fde96f088d126dde6"
 dependencies = [
 "cssparser",
 "html5ever",
@@ -4824,7 +4824,7 @@ dependencies = [

 [[package]]
 name = "nym-api"
-version = "1.1.67"
+version = "1.1.69"
 dependencies = [
 "anyhow",
 "async-trait",
@@ -5050,7 +5050,7 @@ dependencies = [

 [[package]]
 name = "nym-cli"
-version = "1.1.64"
+version = "1.1.66"
 dependencies = [
 "anyhow",
 "base64 0.22.1",
@@ -5133,7 +5133,7 @@ dependencies = [

 [[package]]
 name = "nym-client"
-version = "1.1.64"
+version = "1.1.66"
 dependencies = [
 "bs58",
 "clap",
@@ -6050,6 +6050,7 @@ dependencies = [
 "thiserror 2.0.12",
 "tokio",
 "tracing",
+ "tracing-subscriber",
 "url",
 "wasmtimer",
 ]
@@ -6354,7 +6355,7 @@ dependencies = [

 [[package]]
 name = "nym-network-requester"
-version = "1.1.65"
+version = "1.1.67"
 dependencies = [
 "addr",
 "anyhow",
@@ -6404,7 +6405,7 @@ dependencies = [

 [[package]]
 name = "nym-node"
-version = "1.19.0"
+version = "1.21.0"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -6546,7 +6547,7 @@ dependencies = [

 [[package]]
 name = "nym-node-status-api"
-version = "4.0.10"
+version = "4.0.11-rc1"
 dependencies = [
 "ammonia",
 "anyhow",
@@ -6931,7 +6932,7 @@ dependencies = [

 [[package]]
 name = "nym-socks5-client"
-version = "1.1.64"
+version = "1.1.66"
 dependencies = [
 "bs58",
 "clap",
@@ -7670,7 +7671,7 @@ dependencies = [

 [[package]]
 name = "nymvisor"
-version = "0.1.29"
+version = "0.1.31"
 dependencies = [
 "anyhow",
 "bytes",
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.64"
+version = "1.1.66"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.64"
+version = "1.1.66"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -45,7 +45,7 @@ pub enum ClientCoreError {

    #[cfg(not(target_arch = "wasm32"))]
    #[error("resolution failed: {0}")]
-    ResolutionFailed(#[from] nym_http_api_client::HickoryDnsError),
+    ResolutionFailed(#[from] nym_http_api_client::ResolveError),

    #[error("no gateways on network")]
    NoGatewaysOnNetwork,
@@ -441,7 +441,7 @@ mod tests {

    #[test]
    fn test_multiple_urls_prepared_for_retries() {
-        let urls = vec![
+        let urls = [
            Url::parse("https://api1.nym.com").unwrap(),
            Url::parse("https://api2.nym.com").unwrap(),
            Url::parse("https://api3.nym.com").unwrap(),
@@ -30,7 +30,6 @@ pub(crate) async fn connect_async(
            resolver
                .resolve_str(domain)
                .await?
-                .into_iter()
                .map(|a| SocketAddr::new(a, port))
                .collect()
        }
@@ -39,7 +39,6 @@ pub(crate) async fn connect_async(
            resolver
                .resolve_str(domain)
                .await?
-                .into_iter()
                .map(|a| SocketAddr::new(a, port))
                .collect()
        }
@@ -54,7 +54,7 @@ pub enum GatewayClientError {

    #[cfg(not(target_arch = "wasm32"))]
    #[error("resolution failed: {0}")]
-    ResolutionFailed(#[from] nym_http_api_client::HickoryDnsError),
+    ResolutionFailed(#[from] nym_http_api_client::ResolveError),

    #[error("No shared key was provided or obtained")]
    NoSharedKeyAvailable,
@@ -241,23 +241,28 @@ impl Epoch {
 //
 // Note: It's important that the variant ordering is not changed otherwise it would mess up the derived `PartialOrd`
 #[cw_serde]
-#[derive(Copy)]
+#[derive(Copy, Default)]
 pub enum EpochState {
+    #[default]
    WaitingInitialisation,
-    PublicKeySubmission { resharing: bool },
-    DealingExchange { resharing: bool },
-    VerificationKeySubmission { resharing: bool },
-    VerificationKeyValidation { resharing: bool },
-    VerificationKeyFinalization { resharing: bool },
+    PublicKeySubmission {
+        resharing: bool,
+    },
+    DealingExchange {
+        resharing: bool,
+    },
+    VerificationKeySubmission {
+        resharing: bool,
+    },
+    VerificationKeyValidation {
+        resharing: bool,
+    },
+    VerificationKeyFinalization {
+        resharing: bool,
+    },
    InProgress,
 }

-impl Default for EpochState {
-    fn default() -> Self {
-        Self::WaitingInitialisation
-    }
-}
-
 impl Display for EpochState {
    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
        match self {
@@ -246,7 +246,7 @@ mod tests {
        let _exp_date_sigs = generate_expiration_date_signatures(
            sig_req.expiration_date.ecash_unix_timestamp(),
            &[signing_keys.secret_key()],
-            &vec![signing_keys.verification_key()],
+            &[signing_keys.verification_key()],
            &signing_keys.verification_key(),
            &[1],
        )?;
@@ -263,7 +263,7 @@ mod tests {

        let wallet = issuance.aggregate_signature_shares(
            &signing_keys.verification_key(),
-            &vec![partial_wallet],
+            &[partial_wallet],
            sig_req,
        )?;

@@ -82,7 +82,7 @@ mod tests {
        let exp_date_sigs = generate_expiration_date_signatures(
            sig_req.expiration_date.ecash_unix_timestamp(),
            &[keypair.secret_key()],
-            &vec![keypair.verification_key()],
+            &[keypair.verification_key()],
            &keypair.verification_key(),
            &[keypair.index.unwrap()],
        )
@@ -106,14 +106,14 @@ mod tests {
            .unwrap();

        let wallet = issuance
-            .aggregate_signature_shares(&keypair.verification_key(), &vec![partial_wallet], sig_req)
+            .aggregate_signature_shares(&keypair.verification_key(), &[partial_wallet], sig_req)
            .unwrap();

        let mut issued = issuance.into_issued_ticketbook(wallet, 1);
        let coin_indices_signatures = generate_coin_indices_signatures(
            nym_credentials_interface::ecash_parameters(),
            &[keypair.secret_key()],
-            &vec![keypair.verification_key()],
+            &[keypair.verification_key()],
            &keypair.verification_key(),
            &[keypair.index.unwrap()],
        )
@@ -32,7 +32,7 @@ thiserror = { workspace = true }
 tracing = { workspace = true }
 itertools = { workspace = true }
 inventory = { workspace = true }
-
+tokio = { workspace = true, features = ["rt", "macros", "time"] }
 # used for decoding text responses (they were already implicitly included)
 bytes = { workspace = true }
 encoding_rs = { workspace = true }
@@ -52,5 +52,4 @@ workspace = true
 features = ["tokio"]

 [dev-dependencies]
-tokio = { workspace = true, features = ["rt", "macros"] }
-
+tracing-subscriber.workspace = true
@@ -30,19 +30,26 @@
 use crate::ClientBuilder;

 use std::{
-    net::SocketAddr,
+    collections::HashMap,
+    net::{IpAddr, SocketAddr},
+    str::FromStr,
    sync::{Arc, LazyLock},
+    time::Duration,
 };

 use hickory_resolver::{
-    ResolveError, TokioResolver,
+    TokioResolver,
    config::{LookupIpStrategy, NameServerConfigGroup, ResolverConfig, ServerOrderingStrategy},
-    lookup_ip::{LookupIp, LookupIpIntoIter},
+    lookup_ip::LookupIpIntoIter,
    name_server::TokioConnectionProvider,
 };
 use once_cell::sync::OnceCell;
 use reqwest::dns::{Addrs, Name, Resolve, Resolving};
-use tracing::warn;
+use tracing::*;
+
+mod constants;
+mod static_resolver;
+pub use static_resolver::*;

 impl ClientBuilder {
    /// Override the DNS resolver implementation used by the underlying http client.
@@ -59,10 +66,6 @@ impl ClientBuilder {
    }
 }

-struct SocketAddrs {
-    iter: LookupIpIntoIter,
-}
-
 // n.b. static items do not call [`Drop`] on program termination, so this won't be deallocated.
 // this is fine, as the OS can deallocate the terminated program faster than we can free memory
 // but tools like valgrind might report "memory leaks" as it isn't obvious this is intentional.
@@ -72,11 +75,17 @@ static SHARED_RESOLVER: LazyLock<HickoryDnsResolver> = LazyLock::new(|| {
 });

 #[derive(Debug, thiserror::Error)]
-#[error("hickory-dns resolver error: {hickory_error}")]
+#[allow(missing_docs)]
 /// Error occurring while resolving a hostname into an IP address.
-pub struct HickoryDnsError {
-    #[from]
-    hickory_error: ResolveError,
+pub enum ResolveError {
+    #[error("invalid name: {0}")]
+    InvalidNameError(String),
+    #[error("hickory-dns resolver error: {0}")]
+    ResolveError(#[from] hickory_resolver::ResolveError),
+    #[error("high level lookup timed out")]
+    Timeout,
+    #[error("hostname not found in static lookup table")]
+    StaticLookupMiss,
 }

 /// Wrapper around an `AsyncResolver`, which implements the `Resolve` trait.
@@ -87,69 +96,118 @@ pub struct HickoryDnsError {
 /// The default initialization uses a shared underlying `AsyncResolver`. If a thread local resolver
 /// is required use `thread_resolver()` to build a resolver with an independently instantiated
 /// internal `AsyncResolver`.
-#[derive(Debug, Default, Clone)]
+#[derive(Debug, Clone)]
 pub struct HickoryDnsResolver {
    // Since we might not have been called in the context of a
    // Tokio Runtime in initialization, so we must delay the actual
    // construction of the resolver.
    state: Arc<OnceCell<TokioResolver>>,
    fallback: Option<Arc<OnceCell<TokioResolver>>>,
+    static_base: Option<Arc<OnceCell<StaticResolver>>>,
    dont_use_shared: bool,
+    /// Overall timeout for dns lookup associated with any individual host resolution. For example,
+    /// use of retries, server_ordering_strategy, etc. ends absolutely if this timeout is reached.
+    overall_dns_timeout: Duration,
+}
+
+impl Default for HickoryDnsResolver {
+    fn default() -> Self {
+        Self {
+            state: Default::default(),
+            // Disable system resolver fallback by default - often blocked by firewalls in VPN environments
+            // Enable static fallback for known domains
+            fallback: None,
+            static_base: Some(Default::default()),
+            dont_use_shared: Default::default(),
+            overall_dns_timeout: Duration::from_secs(10),
+        }
+    }
 }

 impl Resolve for HickoryDnsResolver {
    fn resolve(&self, name: Name) -> Resolving {
        let resolver = self.state.clone();
        let maybe_fallback = self.fallback.clone();
+        let maybe_static = self.static_base.clone();
        let independent = self.dont_use_shared;
+        let overall_dns_timeout = self.overall_dns_timeout;
        Box::pin(async move {
-            let resolver = resolver.get_or_try_init(|| {
-                // using a closure here is slightly gross, but this makes sure that if the
-                // lazy-init returns an error it can be handled by the client
-                if independent {
-                    new_resolver()
-                } else {
-                    Ok(SHARED_RESOLVER.state.get_or_try_init(new_resolver)?.clone())
-                }
-            })?;
+            resolve(
+                name,
+                resolver,
+                maybe_fallback,
+                maybe_static,
+                independent,
+                overall_dns_timeout,
+            )
+            .await
+            .map_err(|e| Box::new(e) as Box<dyn std::error::Error + Send + Sync>)
+        })
+    }
+}

-            // try the primary DNS resolver that we set up (DoH or DoT or whatever)
-            let lookup = match resolver.lookup_ip(name.as_str()).await {
-                Ok(res) => res,
-                Err(e) => {
-                    if let Some(ref fallback) = maybe_fallback {
-                        // on failure use the fall back system configured DNS resolver
-                        if !e.is_no_records_found() {
-                            warn!("primary DNS failed w/ error {e}: using system fallback");
-                        }
-                        let resolver = fallback.get_or_try_init(|| {
-                            // using a closure here is slightly gross, but this makes sure that if the
-                            // lazy-init returns an error it can be handled by the client
-                            if independent {
-                                new_resolver_system()
-                            } else {
-                                Ok(SHARED_RESOLVER
-                                    .fallback
-                                    .as_ref()
-                                    .ok_or(e)? // if the shared resolver has no fallback return the original error
-                                    .get_or_try_init(new_resolver_system)?
-                                    .clone())
-                            }
-                        })?;
-
-                        resolver.lookup_ip(name.as_str()).await?
-                    } else {
-                        return Err(e.into());
-                    }
-                }
-            };
+async fn resolve(
+    name: Name,
+    resolver: Arc<OnceCell<TokioResolver>>,
+    maybe_fallback: Option<Arc<OnceCell<TokioResolver>>>,
+    maybe_static: Option<Arc<OnceCell<StaticResolver>>>,
+    independent: bool,
+    overall_dns_timeout: Duration,
+) -> Result<Addrs, ResolveError> {
+    let resolver = resolver.get_or_try_init(|| HickoryDnsResolver::new_resolver(independent))?;

+    // Attempt a lookup using the primary resolver
+    let resolve_fut = tokio::time::timeout(overall_dns_timeout, resolver.lookup_ip(name.as_str()));
+    let primary_err = match resolve_fut.await {
+        Err(_) => ResolveError::Timeout,
+        Ok(Ok(lookup)) => {
            let addrs: Addrs = Box::new(SocketAddrs {
                iter: lookup.into_iter(),
            });
-            Ok(addrs)
-        })
+            return Ok(addrs);
+        }
+        Ok(Err(e)) => {
+            // on failure use the fall back system configured DNS resolver
+            if !e.is_no_records_found() {
+                warn!("primary DNS failed w/ error: {e}");
+            }
+            e.into()
+        }
+    };
+
+    // If the primary resolver encountered an error, attempt a lookup using the fallback
+    // resolver if one is configured.
+    if let Some(ref fallback) = maybe_fallback {
+        let resolver =
+            fallback.get_or_try_init(|| HickoryDnsResolver::new_resolver_system(independent))?;
+
+        let resolve_fut =
+            tokio::time::timeout(overall_dns_timeout, resolver.lookup_ip(name.as_str()));
+        if let Ok(Ok(lookup)) = resolve_fut.await {
+            let addrs: Addrs = Box::new(SocketAddrs {
+                iter: lookup.into_iter(),
+            });
+            return Ok(addrs);
+        }
    }
+
+    // If no record has been found and a static map of fallback addresses is configured
+    // check the table for our entry
+    if let Some(ref static_resolver) = maybe_static {
+        debug!("checking static");
+        let resolver =
+            static_resolver.get_or_init(|| HickoryDnsResolver::new_static_fallback(independent));
+
+        if let Ok(addrs) = resolver.resolve(name).await {
+            return Ok(addrs);
+        }
+    }
+
+    Err(primary_err)
+}
+
+struct SocketAddrs {
+    iter: LookupIpIntoIter,
 }

 impl Iterator for SocketAddrs {
@@ -162,28 +220,22 @@ impl Iterator for SocketAddrs {

 impl HickoryDnsResolver {
    /// Attempt to resolve a domain name to a set of ['IpAddr']s
-    pub async fn resolve_str(&self, name: &str) -> Result<LookupIp, HickoryDnsError> {
-        let resolver = self.state.get_or_try_init(|| self.new_resolver())?;
-
-        // try the primary DNS resolver that we set up (DoH or DoT or whatever)
-        let lookup = match resolver.lookup_ip(name).await {
-            Ok(res) => res,
-            Err(e) => {
-                if let Some(ref fallback) = self.fallback {
-                    // on failure use the fall back system configured DNS resolver
-                    if !e.is_no_records_found() {
-                        warn!("primary DNS failed w/ error {e}: using system fallback");
-                    }
-
-                    let resolver = fallback.get_or_try_init(|| self.new_resolver_system())?;
-                    resolver.lookup_ip(name).await?
-                } else {
-                    return Err(e.into());
-                }
-            }
-        };
-
-        Ok(lookup)
+    pub async fn resolve_str(
+        &self,
+        name: &str,
+    ) -> Result<impl Iterator<Item = IpAddr> + use<>, ResolveError> {
+        let n =
+            Name::from_str(name).map_err(|_| ResolveError::InvalidNameError(name.to_string()))?;
+        resolve(
+            n,
+            self.state.clone(),
+            self.fallback.clone(),
+            self.static_base.clone(),
+            self.dont_use_shared,
+            self.overall_dns_timeout,
+        )
+        .await
+        .map(|addrs| addrs.map(|socket_addr| socket_addr.ip()))
    }

    /// Create a (lazy-initialized) resolver that is not shared across threads.
@@ -194,16 +246,20 @@ impl HickoryDnsResolver {
        }
    }

-    fn new_resolver(&self) -> Result<TokioResolver, HickoryDnsError> {
-        if self.dont_use_shared {
+    fn new_resolver(dont_use_shared: bool) -> Result<TokioResolver, ResolveError> {
+        // using a closure here is slightly gross, but this makes sure that if the
+        // lazy-init returns an error it can be handled by the client
+        if dont_use_shared {
            new_resolver()
        } else {
            Ok(SHARED_RESOLVER.state.get_or_try_init(new_resolver)?.clone())
        }
    }

-    fn new_resolver_system(&self) -> Result<TokioResolver, HickoryDnsError> {
-        if self.dont_use_shared || SHARED_RESOLVER.fallback.is_none() {
+    fn new_resolver_system(dont_use_shared: bool) -> Result<TokioResolver, ResolveError> {
+        // using a closure here is slightly gross, but this makes sure that if the
+        // lazy-init returns an error it can be handled by the client
+        if dont_use_shared || SHARED_RESOLVER.fallback.is_none() {
            new_resolver_system()
        } else {
            Ok(SHARED_RESOLVER
@@ -215,8 +271,18 @@ impl HickoryDnsResolver {
        }
    }

+    fn new_static_fallback(dont_use_shared: bool) -> StaticResolver {
+        if !dont_use_shared && let Some(ref shared_resolver) = SHARED_RESOLVER.static_base {
+            shared_resolver
+                .get_or_init(new_default_static_fallback)
+                .clone()
+        } else {
+            new_default_static_fallback()
+        }
+    }
+
    /// Enable fallback to the system default resolver if the primary (DoX) resolver fails
-    pub fn enable_system_fallback(&mut self) -> Result<(), HickoryDnsError> {
+    pub fn enable_system_fallback(&mut self) -> Result<(), ResolveError> {
        self.fallback = Some(Default::default());
        let _ = self
            .fallback
@@ -231,22 +297,52 @@ impl HickoryDnsResolver {
    pub fn disable_system_fallback(&mut self) {
        self.fallback = None;
    }
+
+    /// Get the current map of hostname to address in use by the fallback static lookup if one
+    /// exists.
+    pub fn get_static_fallbacks(&self) -> Option<HashMap<String, Vec<IpAddr>>> {
+        Some(self.static_base.as_ref()?.get()?.get_addrs())
+    }
+
+    /// Set (or overwrite) the map of addresses used in the fallback static hostname lookup
+    pub fn set_static_fallbacks(&mut self, addrs: HashMap<String, Vec<IpAddr>>) {
+        let cell = OnceCell::new();
+        cell.set(StaticResolver::new(addrs))
+            .expect("infallible assign");
+        self.static_base = Some(Arc::new(cell));
+    }
 }

 /// Create a new resolver with a custom DoT based configuration. The options are overridden to look
 /// up for both IPv4 and IPv6 addresses to work with "happy eyeballs" algorithm.
-fn new_resolver() -> Result<TokioResolver, HickoryDnsError> {
+///
+/// Timeout Defaults to 5 seconds
+/// Number of retries after lookup failure before giving up Defaults to 2
+///
+/// Caches successfully resolved addresses for 30 minutes to prevent continual use of remote lookup.
+/// This resolver is intended to be used for OUR API endpoints that do not rapidly rotate IPs.
+fn new_resolver() -> Result<TokioResolver, ResolveError> {
+    info!("building new configured resolver");
+
    let mut name_servers = NameServerConfigGroup::quad9_tls();
    name_servers.merge(NameServerConfigGroup::quad9_https());
    name_servers.merge(NameServerConfigGroup::cloudflare_tls());
    name_servers.merge(NameServerConfigGroup::cloudflare_https());

+    configure_and_build_resolver(name_servers)
+}
+
+fn configure_and_build_resolver(
+    name_servers: NameServerConfigGroup,
+) -> Result<TokioResolver, ResolveError> {
    let config = ResolverConfig::from_parts(None, Vec::new(), name_servers);
    let mut resolver_builder =
        TokioResolver::builder_with_config(config, TokioConnectionProvider::default());

-    resolver_builder.options_mut().ip_strategy = LookupIpStrategy::Ipv4AndIpv6;
+    resolver_builder.options_mut().ip_strategy = get_ip_strategy();
    resolver_builder.options_mut().server_ordering_strategy = ServerOrderingStrategy::RoundRobin;
+    // Cache successful responses for queries received by this resolver for 30 min minimum.
+    resolver_builder.options_mut().positive_min_ttl = Some(Duration::from_secs(1800));

    Ok(resolver_builder.build())
 }
@@ -254,20 +350,54 @@ fn new_resolver() -> Result<TokioResolver, HickoryDnsError> {
 /// Create a new resolver with the default configuration, which reads from the system DNS config
 /// (i.e. `/etc/resolve.conf` in unix). The options are overridden to look up for both IPv4 and IPv6
 /// addresses to work with "happy eyeballs" algorithm.
-fn new_resolver_system() -> Result<TokioResolver, HickoryDnsError> {
+fn new_resolver_system() -> Result<TokioResolver, ResolveError> {
    let mut resolver_builder = TokioResolver::builder_tokio()?;
-    resolver_builder.options_mut().ip_strategy = LookupIpStrategy::Ipv4AndIpv6;
+    resolver_builder.options_mut().ip_strategy = get_ip_strategy();

    Ok(resolver_builder.build())
 }

+fn new_default_static_fallback() -> StaticResolver {
+    StaticResolver::new(constants::default_static_addrs())
+}
+
+/// Check if IPv6 stack is available for DNS resolution.
+fn should_use_ipv6_dns() -> bool {
+    use std::net::UdpSocket;
+
+    match UdpSocket::bind("[::]:0") {
+        Ok(_) => {
+            debug!("IPv6 stack available - enabling dual-stack DNS");
+            true
+        }
+        Err(e) => {
+            debug!("IPv6 unavailable ({}), using IPv4-only DNS", e);
+            false
+        }
+    }
+}
+
+/// Get DNS lookup strategy based on IPv6 availability.
+fn get_ip_strategy() -> LookupIpStrategy {
+    if should_use_ipv6_dns() {
+        debug!("Using dual-stack DNS (IPv4 + IPv6)");
+        LookupIpStrategy::Ipv4AndIpv6
+    } else {
+        debug!("Using IPv4-only DNS");
+        LookupIpStrategy::Ipv4Only
+    }
+}
+
 #[cfg(test)]
 mod test {
    use super::*;
+    use itertools::Itertools;
+    use std::collections::HashMap;

    #[tokio::test]
-    async fn reqwest_hickory_doh() {
-        let resolver = HickoryDnsResolver::default();
+    async fn reqwest_with_custom_dns() {
+        let var_name = HickoryDnsResolver::default();
+        let resolver = var_name;
        let client = reqwest::ClientBuilder::new()
            .dns_resolver(resolver.into())
            .build()
@@ -286,7 +416,7 @@ mod test {
    }

    #[tokio::test]
-    async fn dns_lookup() -> Result<(), HickoryDnsError> {
+    async fn dns_lookup() -> Result<(), ResolveError> {
        let resolver = HickoryDnsResolver::default();

        let domain = "ifconfig.me";
@@ -296,4 +426,153 @@ mod test {

        Ok(())
    }
+
+    #[tokio::test]
+    async fn static_resolver_as_fallback() -> Result<(), ResolveError> {
+        let example_domain = "non-existent.nymvpn.com";
+        let mut resolver = HickoryDnsResolver {
+            ..Default::default()
+        };
+
+        let result = resolver.resolve_str(example_domain).await;
+        assert!(result.is_err()); // should be NXDomain
+
+        resolver.static_base = Some(Default::default());
+
+        let mut addr_map = HashMap::new();
+        let example_ip4: IpAddr = "10.10.10.10".parse().unwrap();
+        let example_ip6: IpAddr = "dead::beef".parse().unwrap();
+        addr_map.insert(example_domain.to_string(), vec![example_ip4, example_ip6]);
+
+        resolver.set_static_fallbacks(addr_map);
+
+        let mut addrs = resolver.resolve_str(example_domain).await?;
+        assert!(addrs.contains(&example_ip4));
+        assert!(addrs.contains(&example_ip6));
+        Ok(())
+    }
+
+    #[test]
+    fn default_resolver_fallback_config() {
+        let resolver = HickoryDnsResolver::default();
+        assert!(
+            resolver.fallback.is_none(),
+            "system fallback should be disabled by default for VPN environments"
+        );
+        assert!(
+            resolver.static_base.is_some(),
+            "static fallback should be enabled by default"
+        );
+    }
+
+    #[test]
+    fn ipv6_detection_returns_valid_strategy() {
+        let strategy = get_ip_strategy();
+        match strategy {
+            LookupIpStrategy::Ipv4Only | LookupIpStrategy::Ipv4AndIpv6 => {}
+            _ => panic!("Unexpected IP strategy returned: {:?}", strategy),
+        }
+    }
+
+    #[test]
+    fn ipv6_dns_detection_is_consistent() {
+        let first_result = should_use_ipv6_dns();
+        let second_result = should_use_ipv6_dns();
+        assert_eq!(first_result, second_result);
+    }
+}
+
+#[cfg(test)]
+mod failure_test {
+    use super::*;
+    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+
+    /// IP addresses guaranteed to fail attempts to resolve
+    ///
+    /// Addresses drawn from blocks set off by RFC5737 (ipv4) and RFC3849 (ipv6)
+    const GUARANTEED_BROKEN_IPS_1: &[IpAddr] = &[
+        IpAddr::V4(Ipv4Addr::new(192, 0, 2, 1)),
+        IpAddr::V4(Ipv4Addr::new(198, 51, 100, 1)),
+        IpAddr::V6(Ipv6Addr::new(0x2001, 0x0db8, 0, 0, 0, 0, 0, 0x1111)),
+        IpAddr::V6(Ipv6Addr::new(0x2001, 0x0db8, 0, 0, 0, 0, 0, 0x1001)),
+    ];
+
+    // Create a resolver that behaves the same as the custom configured router, except for the fact
+    // that it is guaranteed to fail.
+    fn build_broken_resolver() -> Result<TokioResolver, ResolveError> {
+        info!("building new faulty resolver");
+
+        let mut broken_ns_group = NameServerConfigGroup::from_ips_tls(
+            GUARANTEED_BROKEN_IPS_1,
+            853,
+            "cloudflare-dns.com".to_string(),
+            true,
+        );
+        let broken_ns_https = NameServerConfigGroup::from_ips_https(
+            GUARANTEED_BROKEN_IPS_1,
+            443,
+            "cloudflare-dns.com".to_string(),
+            true,
+        );
+        broken_ns_group.merge(broken_ns_https);
+
+        configure_and_build_resolver(broken_ns_group)
+    }
+
+    #[tokio::test]
+    async fn dns_lookup_failures() -> Result<(), ResolveError> {
+        let time_start = std::time::Instant::now();
+
+        let r = OnceCell::new();
+        r.set(build_broken_resolver().expect("failed to build resolver"))
+            .expect("broken resolver init error");
+
+        // create a new resolver that won't mess with the shared resolver used by other tests
+        let resolver = HickoryDnsResolver {
+            dont_use_shared: true,
+            state: Arc::new(r),
+            overall_dns_timeout: Duration::from_secs(5),
+            ..Default::default()
+        };
+        build_broken_resolver()?;
+        let domain = "ifconfig.me";
+        let result = resolver.resolve_str(domain).await;
+        assert!(result.is_err_and(|e| matches!(e, ResolveError::Timeout)));
+
+        let duration = time_start.elapsed();
+        assert!(duration < resolver.overall_dns_timeout + Duration::from_secs(1));
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn fallback_to_static() -> Result<(), ResolveError> {
+        let r = OnceCell::new();
+        r.set(build_broken_resolver().expect("failed to build resolver"))
+            .expect("broken resolver init error");
+
+        // create a new resolver that won't mess with the shared resolver used by other tests
+        let resolver = HickoryDnsResolver {
+            dont_use_shared: true,
+            state: Arc::new(r),
+            static_base: Some(Default::default()),
+            overall_dns_timeout: Duration::from_secs(5),
+            ..Default::default()
+        };
+        build_broken_resolver()?;
+
+        // successful lookup using fallback to static resolver
+        let domain = "nymvpn.com";
+        let _ = resolver
+            .resolve_str(domain)
+            .await
+            .expect("failed to resolve address in static lookup");
+
+        // unsuccessful lookup - primary times out, and not in
+        let domain = "non-existent.nymtech.net";
+        let result = resolver.resolve_str(domain).await;
+        assert!(result.is_err_and(|e| matches!(e, ResolveError::Timeout)));
+
+        Ok(())
+    }
 }
@@ -0,0 +1,73 @@
+#![allow(missing_docs)]
+
+use std::collections::HashMap;
+use std::net::{IpAddr, Ipv4Addr};
+
+pub const NYM_API_DOMAIN: &str = "validator.nymtech.net";
+pub const NYM_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(212, 71, 233, 232))];
+
+pub const NYM_VPN_API_DOMAIN: &str = "nymvpn.com";
+pub const NYM_VPN_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(76, 76, 21, 21))];
+
+pub const NYM_FRONTDOOR_VERCEL_DOMAIN: &str = "nym-frontdoor.vercel.app";
+pub const NYM_FRONTDOOR_VERCEL_IPS: &[IpAddr] = &[
+    IpAddr::V4(Ipv4Addr::new(64, 29, 17, 195)),
+    IpAddr::V4(Ipv4Addr::new(216, 198, 79, 195)),
+];
+
+pub const NYM_FRONTDOOR_FASTLY_DOMAIN: &str = "nym-frontdoor.global.ssl.fastly.net";
+pub const NYM_FRONTDOOR_FASTLY_IPS: &[IpAddr] = &[
+    IpAddr::V4(Ipv4Addr::new(151, 101, 193, 194)),
+    IpAddr::V4(Ipv4Addr::new(151, 101, 129, 194)),
+    IpAddr::V4(Ipv4Addr::new(151, 101, 1, 194)),
+    IpAddr::V4(Ipv4Addr::new(151, 101, 65, 194)),
+];
+
+pub const NYMVPN_FRONTDOOR_FASTLY_DOMAIN: &str = "nymvpn-frontdoor.global.ssl.fastly.net";
+pub const NYMVPN_FRONTDOOR_FASTLY_IPS: &[IpAddr] = &[
+    IpAddr::V4(Ipv4Addr::new(151, 101, 193, 194)),
+    IpAddr::V4(Ipv4Addr::new(151, 101, 129, 194)),
+    IpAddr::V4(Ipv4Addr::new(151, 101, 1, 194)),
+    IpAddr::V4(Ipv4Addr::new(151, 101, 65, 194)),
+];
+
+pub const VERCEL_APP_DOMAIN: &str = "vercel.app";
+pub const VERCEL_APP_IPS: &[IpAddr] = &[
+    IpAddr::V4(Ipv4Addr::new(64, 29, 17, 195)),
+    IpAddr::V4(Ipv4Addr::new(216, 198, 79, 195)),
+];
+
+pub const VERCEL_COM_DOMAIN: &str = "vercel.com";
+pub const VERCEL_COM_IPS: &[IpAddr] = &[
+    IpAddr::V4(Ipv4Addr::new(198, 169, 2, 129)),
+    IpAddr::V4(Ipv4Addr::new(198, 169, 1, 193)),
+];
+
+pub const NYM_COM_DOMAIN: &str = "nym.com";
+pub const NYM_COM_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(76, 76, 21, 22))];
+
+pub const NYM_STATS_API_DOMAIN: &str = "nym-statistics-api.nymtech.cc";
+pub const NYM_STATS_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(91, 92, 153, 96))];
+
+pub fn default_static_addrs() -> HashMap<String, Vec<IpAddr>> {
+    let mut m = HashMap::new();
+    m.insert(NYM_API_DOMAIN.to_string(), NYM_API_IPS.to_vec());
+    m.insert(NYM_VPN_API_DOMAIN.to_string(), NYM_VPN_API_IPS.to_vec());
+    m.insert(
+        NYM_FRONTDOOR_VERCEL_DOMAIN.to_string(),
+        NYM_FRONTDOOR_VERCEL_IPS.to_vec(),
+    );
+    m.insert(
+        NYM_FRONTDOOR_FASTLY_DOMAIN.to_string(),
+        NYM_FRONTDOOR_FASTLY_IPS.to_vec(),
+    );
+    m.insert(
+        NYMVPN_FRONTDOOR_FASTLY_DOMAIN.to_string(),
+        NYMVPN_FRONTDOOR_FASTLY_IPS.to_vec(),
+    );
+    m.insert(VERCEL_APP_DOMAIN.to_string(), VERCEL_APP_IPS.to_vec());
+    m.insert(VERCEL_COM_DOMAIN.to_string(), VERCEL_COM_IPS.to_vec());
+    m.insert(NYM_COM_DOMAIN.to_string(), NYM_COM_IPS.to_vec());
+    m.insert(NYM_STATS_API_DOMAIN.to_string(), NYM_STATS_API_IPS.to_vec());
+    m
+}
@@ -0,0 +1,89 @@
+use crate::dns::ResolveError;
+
+use std::{
+    collections::HashMap,
+    net::{IpAddr, SocketAddr},
+    sync::{Arc, Mutex},
+};
+
+use reqwest::dns::{Addrs, Name, Resolve, Resolving};
+use tracing::*;
+
+#[derive(Debug, Default, Clone)]
+pub struct StaticResolver {
+    static_addr_map: Arc<Mutex<HashMap<String, Vec<IpAddr>>>>,
+}
+
+impl StaticResolver {
+    pub fn new(static_entries: HashMap<String, Vec<IpAddr>>) -> StaticResolver {
+        debug!("building static resolver");
+        Self {
+            static_addr_map: Arc::new(Mutex::new(static_entries)),
+        }
+    }
+
+    pub fn get_addrs(&self) -> HashMap<String, Vec<IpAddr>> {
+        self.static_addr_map.lock().unwrap().clone()
+    }
+}
+
+impl Resolve for StaticResolver {
+    fn resolve(&self, name: Name) -> Resolving {
+        debug!("looking up {name:?} in static resolver");
+        let addr_map = self.static_addr_map.clone();
+        Box::pin(async move {
+            let addr_map = addr_map.lock().unwrap();
+            let lookup = match addr_map.get(name.as_str()) {
+                None => return Err(ResolveError::StaticLookupMiss.into()),
+                Some(addrs) => addrs,
+            };
+            let addrs: Addrs = Box::new(
+                lookup
+                    .clone()
+                    .into_iter()
+                    .map(|ip_addr| SocketAddr::new(ip_addr, 0)),
+            );
+
+            Ok(addrs)
+        })
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use itertools::Itertools;
+
+    use super::*;
+    use std::error::Error as StdError;
+    use std::str::FromStr;
+
+    #[tokio::test]
+    async fn lookup_using_static_resolver() -> Result<(), Box<dyn StdError + Send + Sync>> {
+        let example_domain = String::from("static.nymvpn.com");
+
+        // lookup for domain for which there is no entry
+        let resolver = StaticResolver::new(HashMap::new());
+
+        let url = reqwest::dns::Name::from_str(&example_domain).unwrap();
+        let result = resolver.resolve(url).await;
+        assert!(result.is_err());
+        match result {
+            Ok(_) => panic!("lookup with empty map should fail"),
+            Err(e) => assert_eq!(e.to_string(), ResolveError::StaticLookupMiss.to_string()),
+        }
+
+        // Successful lookup
+        let mut addr_map = HashMap::new();
+        let example_ip4: IpAddr = "10.10.10.10".parse().unwrap();
+        let example_ip6: IpAddr = "dead::beef".parse().unwrap();
+        addr_map.insert(example_domain.clone(), vec![example_ip4, example_ip6]);
+
+        let url = reqwest::dns::Name::from_str(&example_domain).unwrap();
+        let resolver = StaticResolver::new(addr_map);
+        let mut addrs = resolver.resolve(url).await?;
+        assert!(addrs.contains(&SocketAddr::new(example_ip4, 0)));
+        assert!(addrs.contains(&SocketAddr::new(example_ip6, 0)));
+
+        Ok(())
+    }
+}
@@ -179,7 +179,7 @@ mod dns;
 mod path;

 #[cfg(not(target_arch = "wasm32"))]
-pub use dns::{HickoryDnsError, HickoryDnsResolver};
+pub use dns::{HickoryDnsResolver, ResolveError};

 // helper for generating user agent based on binary information
 #[cfg(not(target_arch = "wasm32"))]
@@ -1 +1 @@
-Tuesday, October 14th 2025, 11:34:14 UTC
+Thursday, October 30th 2025, 13:00:59 UTC
@@ -11,7 +11,7 @@ options:
  --no_routing_history  Display node stats without routing history
  --no_verloc_metrics   Display node stats without verloc metrics
  -m, --markdown        Display results in markdown format
-  -o, --output [OUTPUT]
+  -o [OUTPUT], --output [OUTPUT]
                        Save results to file (in current dir or supply with
                        path without filename)
 ```
@@ -18,23 +18,23 @@
 | [Hostslick](https://hostslick.com)                                                                                   | Netherlands, Germany                                                                                                                                | Yes, on by default                   | Yes                                                | Good amount of bandwidth for the price. Make sure you open the ticket if you want to run Exit node                                                                                                                  | 07/2024            |
 | [Incognet](https://incognet.io)                                                                                      | Netherlands and USA                                                                                                                                 | Yes, on by default                   | Yes                                                | They allow Tor exit nodes but you must adhere to their rules https://incognet.io/tor-exits                                                                                                                          | 07/2024            |
 | [Incognet](https://incognet.io/kansas-city-dedicated-servers)                                                        | USA, Netherlands                                                                                                                                    | Yes                                  | nan                                                | nan                                                                                                                                                                                                                 | 07/2025            |
-| [Ionos](https://www.ionos.com/servers/amd-servers)                                                                   | US, DE, UK, ESP, FR                                                                                                                                 | nan                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
+| [Ionos](https://www.ionos.com/servers/amd-servers)                                                                   | USA, DE, UK, ESP, FR                                                                                                                                | nan                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
 | [IsHosting](https://ishosting.com/en)                                                                                | Brazil, Netherlands                                                                                                                                 | Yes, based on ticket                 | Yes                                                | Expensive                                                                                                                                                                                                           | 05/2024            |
-| [Leaseweb](https://www.leaseweb.com/en/configure/vc/product/entityKey/DEDSER02_NEW_ORDER_BUSINESS_R740XD-24SFF-6134) | US, NL, DE, UK, CA, SG, JP, AUS, HK                                                                                                                 | nan                                  | No                                                 | KYC mandatory                                                                                                                                                                                                       | 07/2025            |
+| [Leaseweb](https://www.leaseweb.com/en/configure/vc/product/entityKey/DEDSER02_NEW_ORDER_BUSINESS_R740XD-24SFF-6134) | USA, NL, DE, UK, CA, SG, JP, AUS, HK                                                                                                                | nan                                  | No                                                 | KYC mandatory                                                                                                                                                                                                       | 07/2025            |
 | [Linode](https://linode.com)                                                                                         | USA, Canada, Japan, India, Indonesia, Sweden, Netherlands, Germany, Brazil, France, UK, Australia, Italy                                            | Yes out of the box                   | No, only through [BitLAunch](https://bitlaunch.io) | IPv6 sometimes need to be re-added in Networking tab, no reboot needed                                                                                                                                              | 05/2024            |
 | [LiteServer](https://liteserver.nl)                                                                                  | Netherlands                                                                                                                                         | Yes, on by default                   | Yes                                                | Very reliable Dutch provider. They do allow Relay nodes but for Exit nodes you need to contact them. Always check T&C https://liteserver.nl/legal                                                                   | 07/2024            |
 | [Lowendbox](https://lowendbox.com/category/dedicated-servers)                                                        |                                                                                                                                                     |                                      |                                                    | Just an aggregator with good offers                                                                                                                                                                                 | 07/2025            |
 | [M247](https://m247.com/eu/services/host/dedicated-servers/)                                                         | UK, Austria, Br, Sw, Jp, Poland, Fr, USA, Netherlands                                                                                               | Yes                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
-| [Mebilcom](https://www.melbicom.net/dedicatedserver/)                                                                | NL, US, DE, UAE, NG, ESP, IN, IT, FR, LT, SG, BG, LV, PL                                                                                            | nan                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
+| [Mebilcom](https://www.melbicom.net/dedicatedserver/)                                                                | NL, USA, DE, UAE, NG, ESP, IN, IT, FR, LT, SG, BG, LV, PL                                                                                           | nan                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
 | [Mevspace](https://mevspace.com)                                                                                     | Poland                                                                                                                                              | Yes, on by default                   | Yes                                                | Flexible Polish providers with 3 DCs in Poland. They do allow Tor Exit nodes but you may need a dedicated server for this. Make sure you open a ticket to check. As of today's date, they have 48h for 1 EUR tariff | 07/2024            |
 | [Misaka](https://www.misaka.io/)                                                                                     | South Africa                                                                                                                                        | Yes, native support                  | No                                                 | Very Expensive                                                                                                                                                                                                      | 05/2024            |
 | [NiceVPS](https://nicevps.net/)                                                                                      | Netherlands                                                                                                                                         | Yes                                  | nan                                                | nan                                                                                                                                                                                                                 | 07/2025            |
 | [Njalla](https://nja.la)                                                                                             | Sweden                                                                                                                                              | Yes                                  | Yes                                                | Privacy vandguards! The biggest VPS 45 is 3 cores only, but it works better than many “larger” servers on the market.                                                                                               | 05/2024            |
 | [OVH](https://us.ovhcloud.com/bare-metal/rise/rise-3/)                                                               | USA, DE, FR, UK, PL, CA                                                                                                                             |                                      | No                                                 | Not all locations always available                                                                                                                                                                                  | 07/2025            |
-| [Oneprovider](https://oneprovider.com/en/dedicated-servers/ipv6)                                                     | PL, FR, NL, UA, US, BG, RO, DK, ESP, NO, CZ, RS, IE, IT, UK, HU, CH, SK, AT, BE, BA, HK, JP, SG, LU, AU, SWE, UAE, BR, CR, MX, GR, CL, MA, AR       | Yes                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
+| [Oneprovider](https://oneprovider.com/en/dedicated-servers/ipv6)                                                     | PL, FR, NL, UA, USA, BG, RO, DK, ESP, NO, CZ, RS, IE, IT, UK, HU, CH, SK, AT, BE, BA, HK, JP, SG, LU, AU, SWE, UAE, BR, CR, MX, GR, CL, MA, AR      | Yes                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
 | [PrivateLayer](https://privatelayer.com)                                                                             | Swiss                                                                                                                                               | Yes                                  | Yes                                                | Slow customer response                                                                                                                                                                                              | 07/2025            |
 | [Privex](https://www.privex.io/tor-exit-policy/)                                                                     | USA, Germany, Sweden                                                                                                                                | Yes                                  | Yes                                                | nan                                                                                                                                                                                                                 | 07/2025            |
-| [Psychz](https://www.psychz.net)                                                                                     | US, UK, Brazil, Japan, Russia, South Africa and many more                                                                                           | Yes                                  | nan                                                | nan                                                                                                                                                                                                                 | 07/2025            |
+| [Psychz](https://www.psychz.net)                                                                                     | USA, UK, Brazil, Japan, Russia, South Africa and many more                                                                                          | Yes                                  | nan                                                | nan                                                                                                                                                                                                                 | 07/2025            |
 | [RDP](https://rdp.sh)                                                                                                | Netherlands, USA, Poland                                                                                                                            | Yes, on by default                   | Yes                                                | German provider. Exit nodes are allowed, policy is here https://rdp.sh/docs/faq/tor ports 25,465,587 must be closed. Make sure you open a ticket before running an exit node.                                       | 07/2024            |
 | [Servermania](https://www.servermania.com/dedicated-servers-hosting.htm)                                             | USA, Canada                                                                                                                                         | nan                                  | No                                                 | nan                                                                                                                                                                                                                 | 07/2025            |
 | [Svea](https://svea.net/vps)                                                                                         | Sweden                                                                                                                                              | Yes                                  | nan                                                | nan                                                                                                                                                                                                                 | 07/2025            |
@@ -21,11 +21,11 @@
 [Lowendbox](https://lowendbox.com/category/dedicated-servers), , , ,Just an aggregator with good offers,07/2025
 [Thundervm](https://thundervm.com/en/hosting/dedicated-server),"USA, UK, France, Italy, Switzerland, Netherlands",,Yes, ,07/2025
 [OVH](https://us.ovhcloud.com/bare-metal/rise/rise-3/),"USA, DE, FR, UK, PL, CA", ,No,Not all locations always available,07/2025
-[Mebilcom](https://www.melbicom.net/dedicatedserver/),"NL, US, DE, UAE, NG, ESP, IN, IT, FR, LT, SG, BG, LV, PL",,No,,07/2025
+[Mebilcom](https://www.melbicom.net/dedicatedserver/),"NL, USA, DE, UAE, NG, ESP, IN, IT, FR, LT, SG, BG, LV, PL",,No,,07/2025
 [Servermania](https://www.servermania.com/dedicated-servers-hosting.htm),"USA, Canada",,No,,07/2025
-[Oneprovider](https://oneprovider.com/en/dedicated-servers/ipv6),"PL, FR, NL, UA, US, BG, RO, DK, ESP, NO, CZ, RS, IE, IT, UK, HU, CH, SK, AT, BE, BA, HK, JP, SG, LU, AU, SWE, UAE, BR, CR, MX, GR, CL, MA, AR",Yes,No,,07/2025
-[Ionos](https://www.ionos.com/servers/amd-servers),"US, DE, UK, ESP, FR",,No,,07/2025
-[Leaseweb](https://www.leaseweb.com/en/configure/vc/product/entityKey/DEDSER02_NEW_ORDER_BUSINESS_R740XD-24SFF-6134),"US, NL, DE, UK, CA, SG, JP, AUS, HK",,No,KYC mandatory,07/2025
+[Oneprovider](https://oneprovider.com/en/dedicated-servers/ipv6),"PL, FR, NL, UA, USA, BG, RO, DK, ESP, NO, CZ, RS, IE, IT, UK, HU, CH, SK, AT, BE, BA, HK, JP, SG, LU, AU, SWE, UAE, BR, CR, MX, GR, CL, MA, AR",Yes,No,,07/2025
+[Ionos](https://www.ionos.com/servers/amd-servers),"USA, DE, UK, ESP, FR",,No,,07/2025
+[Leaseweb](https://www.leaseweb.com/en/configure/vc/product/entityKey/DEDSER02_NEW_ORDER_BUSINESS_R740XD-24SFF-6134),"USA, NL, DE, UK, CA, SG, JP, AUS, HK",,No,KYC mandatory,07/2025
 [M247](https://m247.com/eu/services/host/dedicated-servers/),"UK, Austria, Br, Sw, Jp, Poland, Fr, USA, Netherlands",Yes,No,,07/2025
 [Hostroyale](https://hostroyale.com/hosting/dedicated-server/),Various countries with different pricing,, Yes,,07/2025
 [DataPacket](https://www.datapacket.com/pricing),"NL, GR, SK, BE, RO, HU, DK, IE, DE, UA, PT, GB, ES, FR, IT, NO, CZ, BG, SE, AT, PL, HR, CH, USA, CO, AR, PE, MX, CL, TR, ZA, NG, IL, HK, AU, SG, JP",Yes,,,07/2025
@@ -35,7 +35,7 @@
 [Colocall](https://www.colocall.net/),Ukraine,Yes,,,07/2025
 [Incognet](https://incognet.io/kansas-city-dedicated-servers),"USA, Netherlands",Yes,,,07/2025
 [FranTech](https://my.frantech.ca),USA,Yes,,,07/2025
-[Psychz](https://www.psychz.net),"US, UK, Brazil, Japan, Russia, South Africa and many more",Yes,,,07/2025
+[Psychz](https://www.psychz.net),"USA, UK, Brazil, Japan, Russia, South Africa and many more",Yes,,,07/2025
 [Fsit](https://www.fsit.com/server/vps-vserver-kvm),Swiss,Yes,Yes,,07/2025
 [NiceVPS](https://nicevps.net/),Netherlands,Yes,,,07/2025
 [Dataclub](https://www.dataclub.eu/),"Latvia, Sweden, Netherlands",Yes,,,07/2027
@@ -49,6 +49,90 @@ This page displays a full list of all the changes during our release cycle from

 <VarInfo />

+## `v2025.19-kase`
+
+- [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.19-kase)
+- [`nym-node`](nodes/nym-node.mdx) version `1.20.0`
+
+```sh
+nym-node
+Binary Name:        nym-node
+Build Timestamp:    2025-10-30T12:43:37.933354749Z
+Build Version:      1.20.0
+Commit SHA:         75a6d3426bd18dca600ad1cfa39b0a3c4f319c69
+Commit Date:        2025-10-30T11:59:32.000000000+01:00
+Commit Branch:      HEAD
+rustc Version:      1.88.0
+rustc Channel:      stable
+cargo Profile:      release
+```
+
+### Operators Updates & Tools
+
+<Callout type="info" emoji="ℹ️">
+**When this platform release becomes latest, we would like to ask operators ruuning any Gateway mode of `nym-node`, to use new version of [QUIC brige deployment tool](https://github.com/nymtech/nym/blob/develop/scripts/nym-node-setup/quic_bridge_deployment.sh)and install QUIC `nym-bridge` on their server, following [these steps](#quic-transport-bridge-deployment).**
+</Callout>
+
+Alongside this platform release we are happy to introduce several improvements and new tools for node operators.
+
+- [Updated version of QUIC brige deployment tool](https://github.com/nymtech/nym/blob/develop/scripts/nym-node-setup/quic_bridge_deployment.sh), **if you run a `nym-node` in any Gateway mode, please install QUIC on your server, following [these steps](#quic-transport-bridge-deployment)**
+
+- [New **Nym Node Status Dashboard**](https://node-status.nym.com)
+
+- [New **Harbourmaster** aka ***Nym Node Status Observatory***](https://harbourmaster.nymtech.net)
+
+
+
+### Features
+
+- [Propagate cancel token to mixnet client](https://github.com/nymtech/nym/pull/6105): Ensures cancellation token propagation to mixnet client
+
+- [[DOCs/operators] QUIC deployment script & docs](https://github.com/nymtech/nym/pull/6098): Script and documentation for QUIC deployment, referencing `nym-bridges` repository  
+
+- [Move gateway probe to monorepo (Rust edition 2024)](https://github.com/nymtech/nym/pull/6094): Moves `nym-gateway-probe` and related packages into monorepo, updates to Rust 2024 edition
+
+- [Expose reference to Mnemonic from `DirectSecp256k1HdWallet`](https://github.com/nymtech/nym/pull/6083): Adds safer accessors for mnemonic references and deprecates unsafe cloning
+
+### Bugfix
+
+- [Cherry pick - request #6143 from nymtech/bugfix/mix-tx-closed-v2](https://github.com/nymtech/nym/pull/6153): Add circuit breaker  
+<AccordionTemplate name={<TestingSteps/>}>
+ **Summary:**
+- Network-requester started successfully  
+- SOCKS5 client started successfully  
+- Traffic was proxied through the mixnet  
+- Shutdown was clean  
+- No 'channel closed (outside of shutdown!)' errors  
+</AccordionTemplate>
+
+- [`nym-credential-proxy` query params parsing regression](https://github.com/nymtech/nym/pull/6121): Fix query deserialization issue with `serde_urlencoded` breaking compatibility with VPN API
+
+- [Revert some dep updates introduced in #6043](https://github.com/nymtech/nym/pull/6120): Revert dependency updates that broke ANSI escape characters within tracing output
+
+- [Skip IPv6 metadata endpoint request](https://github.com/nymtech/nym/pull/6118): Skip querying IPv4-only metadata endpoints during IPv6 probing tests
+
+- [Revert "Propagate cancel token to mixnet client"](https://github.com/nymtech/nym/pull/6115): Reverts earlier change due to premature mixnet exit issues
+
+- [Retrieve and update ticketbook in the same query](https://github.com/nymtech/nym/pull/6101): Fix concurrency issue with multiple agents retrieving ticketbooks simultaneously
+
+- [Include network name in default gateway probe config path](https://github.com/nymtech/nym/pull/6100): Prevents reuse of credentials across different networks
+
+- [Incompatibility fixes](https://github.com/nymtech/nym/pull/6099): Fixes several incompatibilities, including initialization and build mismatches
+
+- [Testnet manager `02sql` migration](https://github.com/nymtech/nym/pull/6096): Fix invalid FK constraint blocking SQL migration
+
+- [Use custom topology provider for list of init gateways](https://github.com/nymtech/nym/pull/6092): Fixes SDK bug where clients ignored custom topology provider on registration
+
+- [Fix `WASM` client + build commands](https://github.com/nymtech/nym/pull/6043): Fixes WASM client hang and runtime time-related issues; improves internal dev testing stability
+
+### Refactors & Maintenance
+
+- [Update to no longer use 1mb files](https://github.com/nymtech/nym/pull/6117)
+
+- [Restore pending DKG contract state migration](https://github.com/nymtech/nym/pull/6116)
+
+- [Update `dirs` to `6.0`](https://github.com/nymtech/nym/pull/6109): Minor dependency update, safe for compatibility
+
 ## `v2025.18-jarlsberg`

 - [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.18-jarlsberg)
@@ -21,13 +21,13 @@ This documentation page provides a guide on how to set up and run a [NYM NODE](.
 ```sh
 nym-node
 Binary Name:        nym-node
-Build Timestamp:    2025-10-15T09:04:32.043934599Z
-Build Version:      1.19.0
-Commit SHA:         2235a6e1477bea7368ee5443a298f544deb63504
-Commit Date:        2025-10-15T10:22:16.000000000+02:00
-Commit Branch:      master
-rustc Version:      1.92.0-nightly
-rustc Channel:      nightly
+Build Timestamp:    2025-10-30T12:43:37.933354749Z
+Build Version:      1.20.0
+Commit SHA:         75a6d3426bd18dca600ad1cfa39b0a3c4f319c69
+Commit Date:        2025-10-30T11:59:32.000000000+01:00
+Commit Branch:      HEAD
+rustc Version:      1.88.0
+rustc Channel:      stable
 cargo Profile:      release
 ```

@@ -4,7 +4,7 @@
 [package]
 name = "nym-api"
 license = "GPL-3.0"
-version = "1.1.67"
+version = "1.1.69"
 authors.workspace = true
 edition = "2021"
 rust-version.workspace = true
@@ -2,7 +2,7 @@ use nym_credentials_interface::TicketType;
 use nym_sdk::mixnet::InputMessage;

 #[derive(thiserror::Error, Debug)]
-pub enum Error {
+pub enum AuthenticationClientError {
    #[error("mixnet client stopped returning responses")]
    NoMixnetMessagesReceived,

@@ -42,10 +42,19 @@ pub enum Error {

    #[error("unknown authenticator version number")]
    UnsupportedAuthenticatorVersion,
+}

-    #[error("failed to wait on AuthenticatorClientListener")]
-    FailedToJoinOnTask(#[from] tokio::task::JoinError),
+#[derive(thiserror::Error, Debug)]
+pub enum RegistrationError {
+    #[error(transparent)]
+    NoCredentialSent(AuthenticationClientError), // This intentionnally doesn't use `from` to avoid random ? operator to land here when they shouldn't
+
+    #[error("an error occured after a credential was sent : {source}")]
+    CredentialSent {
+        #[source]
+        source: AuthenticationClientError,
+    },
 }

 // Result type based on our error type
-pub type Result<T> = std::result::Result<T, Error>;
+pub(crate) type Result<T> = std::result::Result<T, AuthenticationClientError>;
@@ -6,11 +6,11 @@ use nym_bandwidth_controller::{BandwidthTicketProvider, DEFAULT_TICKETS_TO_SPEND
 use nym_crypto::asymmetric::x25519::KeyPair;
 use nym_registration_common::GatewayData;
 use std::net::{IpAddr, SocketAddr};
-use std::str::FromStr;
 use std::sync::Arc;
 use std::time::Duration;
 use tracing::{debug, error, trace};

+use crate::error::Result;
 use crate::mixnet_listener::{MixnetMessageBroadcastReceiver, MixnetMessageInputSender};
 use nym_authenticator_requests::{
    AuthenticatorVersion, client_message::ClientMessage, response::AuthenticatorResponse,
@@ -25,7 +25,7 @@ mod error;
 mod helpers;
 mod mixnet_listener;

-pub use crate::error::{Error, Result};
+pub use crate::error::{AuthenticationClientError, RegistrationError};
 pub use crate::mixnet_listener::{AuthClientMixnetListener, AuthClientMixnetListenerHandle};

 pub struct AuthenticatorClient {
@@ -91,7 +91,7 @@ impl AuthenticatorClient {
        self.mixnet_sender
            .send(input_message)
            .await
-            .map_err(|e| Error::SendMixnetMessage(Box::new(e)))?;
+            .map_err(|e| AuthenticationClientError::SendMixnetMessage(Box::new(e)))?;

        Ok(request_id)
    }
@@ -104,11 +104,11 @@ impl AuthenticatorClient {
            tokio::select! {
                _ = &mut timeout => {
                    error!("Timed out waiting for reply to connect request");
-                    return Err(Error::TimeoutWaitingForConnectResponse);
+                    return Err(AuthenticationClientError::TimeoutWaitingForConnectResponse);
                }
                msg = self.mixnet_listener.recv() => match msg {
                    Err(_) => {
-                        return Err(Error::NoMixnetMessagesReceived);
+                        return Err(AuthenticationClientError::NoMixnetMessagesReceived);
                    }
                    Ok(msg) => {
                        let Some(header) = msg.message.first_chunk::<2>() else {
@@ -131,12 +131,12 @@ impl AuthenticatorClient {
                        // Then we deserialize the message
                        debug!("AuthClient: got message while waiting for connect response with version {version:?}");
                        let ret: Result<AuthenticatorResponse> = match version {
-                            AuthenticatorVersion::V1 => Err(Error::UnsupportedVersion),
+                            AuthenticatorVersion::V1 => Err(AuthenticationClientError::UnsupportedVersion),
                            AuthenticatorVersion::V2 => v2::response::AuthenticatorResponse::from_reconstructed_message(&msg).map(Into::into).map_err(Into::into),
                            AuthenticatorVersion::V3 => v3::response::AuthenticatorResponse::from_reconstructed_message(&msg).map(Into::into).map_err(Into::into),
                            AuthenticatorVersion::V4 => v4::response::AuthenticatorResponse::from_reconstructed_message(&msg).map(Into::into).map_err(Into::into),
                            AuthenticatorVersion::V5 => v5::response::AuthenticatorResponse::from_reconstructed_message(&msg).map(Into::into).map_err(Into::into),
-                            AuthenticatorVersion::UNKNOWN => Err(Error::UnknownVersion),
+                            AuthenticatorVersion::UNKNOWN => Err(AuthenticationClientError::UnknownVersion),
                        };
                        let Ok(response) = ret else {
                            // This is ok, it's likely just one of our self-pings
@@ -158,10 +158,14 @@ impl AuthenticatorClient {
        &mut self,
        controller: &dyn BandwidthTicketProvider,
        ticketbook_type: TicketType,
-    ) -> Result<GatewayData> {
+    ) -> std::result::Result<GatewayData, RegistrationError> {
        debug!("Registering with the wg gateway...");
        let init_message = match self.auth_version {
-            AuthenticatorVersion::V1 => return Err(Error::UnsupportedAuthenticatorVersion),
+            AuthenticatorVersion::V1 | AuthenticatorVersion::UNKNOWN => {
+                return Err(RegistrationError::NoCredentialSent(
+                    AuthenticationClientError::UnsupportedAuthenticatorVersion,
+                ));
+            }
            AuthenticatorVersion::V2 => {
                ClientMessage::Initial(Box::new(v2::registration::InitMessage {
                    pub_key: PeerPublicKey::new(self.keypair.public_key().to_bytes().into()),
@@ -182,16 +186,20 @@ impl AuthenticatorClient {
                    pub_key: PeerPublicKey::new(self.keypair.public_key().to_bytes().into()),
                }))
            }
-            AuthenticatorVersion::UNKNOWN => return Err(Error::UnsupportedAuthenticatorVersion),
        };
        trace!("sending init msg to {}: {:?}", &self.ip_addr, &init_message);
-        let response = self.send_and_wait_for_response(&init_message).await?;
+        let response = self
+            .send_and_wait_for_response(&init_message)
+            .await
+            .map_err(RegistrationError::NoCredentialSent)?;
        let registered_data = match response {
            AuthenticatorResponse::PendingRegistration(pending_registration_response) => {
                // Unwrap since we have already checked that we have the keypair.
                debug!("Verifying data");
                if let Err(e) = pending_registration_response.verify(self.keypair.private_key()) {
-                    return Err(Error::VerificationFailed(e));
+                    return Err(RegistrationError::NoCredentialSent(
+                        AuthenticationClientError::VerificationFailed(e),
+                    ));
                }

                trace!(
@@ -199,6 +207,7 @@ impl AuthenticatorClient {
                    &self.ip_addr, &pending_registration_response
                );

+                // This call takes care of updating the credential count in storage, so failure of this must be counted as credential waste
                let credential = Some(
                    controller
                        .get_ecash_ticket(
@@ -207,15 +216,21 @@ impl AuthenticatorClient {
                            DEFAULT_TICKETS_TO_SPEND,
                        )
                        .await
-                        .map_err(|source| Error::GetTicket {
-                            ticketbook_type,
-                            source,
+                        .map_err(|source| RegistrationError::CredentialSent {
+                            source: AuthenticationClientError::GetTicket {
+                                ticketbook_type,
+                                source,
+                            },
                        })?
                        .data,
                );

                let finalized_message = match self.auth_version {
-                    AuthenticatorVersion::V1 => return Err(Error::UnsupportedAuthenticatorVersion),
+                    AuthenticatorVersion::V1 | AuthenticatorVersion::UNKNOWN => {
+                        return Err(RegistrationError::CredentialSent {
+                            source: AuthenticationClientError::UnsupportedAuthenticatorVersion,
+                        });
+                    }
                    AuthenticatorVersion::V2 => {
                        ClientMessage::Final(Box::new(v2::registration::FinalMessage {
                            gateway_client: v2::registration::GatewayClient::new(
@@ -260,23 +275,29 @@ impl AuthenticatorClient {
                            credential,
                        }))
                    }
-                    AuthenticatorVersion::UNKNOWN => {
-                        return Err(Error::UnsupportedAuthenticatorVersion);
-                    }
                };
                trace!(
                    "sending final msg to {}: {:?}",
                    &self.ip_addr, &finalized_message
                );

-                let response = self.send_and_wait_for_response(&finalized_message).await?;
+                let response = self
+                    .send_and_wait_for_response(&finalized_message)
+                    .await
+                    .map_err(|source| RegistrationError::CredentialSent { source })?;
                let AuthenticatorResponse::Registered(registered_response) = response else {
-                    return Err(Error::InvalidGatewayAuthResponse);
+                    return Err(RegistrationError::CredentialSent {
+                        source: AuthenticationClientError::InvalidGatewayAuthResponse,
+                    });
                };
                registered_response
            }
            AuthenticatorResponse::Registered(registered_response) => registered_response,
-            _ => return Err(Error::InvalidGatewayAuthResponse),
+            _ => {
+                return Err(RegistrationError::NoCredentialSent(
+                    AuthenticationClientError::InvalidGatewayAuthResponse,
+                ));
+            }
        };

        trace!(
@@ -286,12 +307,7 @@ impl AuthenticatorClient {

        let gateway_data = GatewayData {
            public_key: registered_data.pub_key().inner().into(),
-            endpoint: SocketAddr::from_str(&format!(
-                "{}:{}",
-                self.ip_addr,
-                registered_data.wg_port()
-            ))
-            .map_err(Error::FailedToParseEntryGatewaySocketAddr)?,
+            endpoint: SocketAddr::new(self.ip_addr, registered_data.wg_port()),
            private_ipv4: registered_data.private_ips().ipv4,
            private_ipv6: registered_data.private_ips().ipv6,
        };
@@ -299,9 +315,12 @@ impl AuthenticatorClient {
        Ok(gateway_data)
    }

+    // This is up to the caller to know nothing is ever spent there
    pub async fn query_bandwidth(&mut self) -> Result<Option<i64>> {
        let query_message = match self.auth_version {
-            AuthenticatorVersion::V1 => return Err(Error::UnsupportedAuthenticatorVersion),
+            AuthenticatorVersion::V1 => {
+                return Err(AuthenticationClientError::UnsupportedAuthenticatorVersion);
+            }
            AuthenticatorVersion::V2 => ClientMessage::Query(Box::new(QueryMessageImpl {
                pub_key: PeerPublicKey::new(self.keypair.public_key().to_bytes().into()),
                version: AuthenticatorVersion::V2,
@@ -318,7 +337,9 @@ impl AuthenticatorClient {
                pub_key: PeerPublicKey::new(self.keypair.public_key().to_bytes().into()),
                version: AuthenticatorVersion::V5,
            })),
-            AuthenticatorVersion::UNKNOWN => return Err(Error::UnsupportedAuthenticatorVersion),
+            AuthenticatorVersion::UNKNOWN => {
+                return Err(AuthenticationClientError::UnsupportedAuthenticatorVersion);
+            }
        };
        let response = self.send_and_wait_for_response(&query_message).await?;

@@ -332,7 +353,7 @@ impl AuthenticatorClient {
                    return Ok(None);
                }
            }
-            _ => return Err(Error::InvalidGatewayAuthResponse),
+            _ => return Err(AuthenticationClientError::InvalidGatewayAuthResponse),
        };

        let remaining_pretty = if available_bandwidth > 1024 * 1024 {
@@ -347,13 +368,13 @@ impl AuthenticatorClient {
        );
        if available_bandwidth < 1024 * 1024 {
            tracing::warn!(
-                            "Remaining bandwidth is under 1 MB. The wireguard mode will get suspended after that until tomorrow, UTC time. The client might shutdown with timeout soon
-            "
-                        );
+                "Remaining bandwidth is under 1 MB. The wireguard mode will get suspended after that until tomorrow, UTC time. The client might shutdown with timeout soon"
+            );
        }
        Ok(Some(available_bandwidth))
    }

+    // Since the caller provides the credential, it knows it is spent
    pub async fn top_up(&mut self, credential: CredentialSpendingData) -> Result<i64> {
        let top_up_message = match self.auth_version {
            AuthenticatorVersion::V3 => ClientMessage::TopUp(Box::new(v3::topup::TopUpMessage {
@@ -371,7 +392,7 @@ impl AuthenticatorClient {
                credential,
            })),
            AuthenticatorVersion::V1 | AuthenticatorVersion::V2 | AuthenticatorVersion::UNKNOWN => {
-                return Err(Error::UnsupportedAuthenticatorVersion);
+                return Err(AuthenticationClientError::UnsupportedAuthenticatorVersion);
            }
        };
        let response = self.send_and_wait_for_response(&top_up_message).await?;
@@ -380,7 +401,7 @@ impl AuthenticatorClient {
            AuthenticatorResponse::TopUpBandwidth(top_up_bandwidth_response) => {
                top_up_bandwidth_response.available_bandwidth()
            }
-            _ => return Err(Error::InvalidGatewayAuthResponse),
+            _ => return Err(AuthenticationClientError::InvalidGatewayAuthResponse),
        };

        Ok(remaining_bandwidth)
@@ -1,21 +1,17 @@
 # this will only work with VPN, otherwise remove the harbor part
 FROM harbor.nymte.ch/dockerhub/rust:latest AS builder

-ARG GIT_REF=main
-
 RUN apt update && apt install -yy libdbus-1-dev pkg-config libclang-dev

 # Install go
 RUN wget https://go.dev/dl/go1.22.5.linux-amd64.tar.gz -O go.tar.gz
 RUN tar -xzvf go.tar.gz -C /usr/local
-
-RUN git clone https://github.com/nymtech/nym-vpn-client /usr/src/nym-vpn-client
-RUN cd /usr/src/nym-vpn-client && git checkout $GIT_REF
 ENV PATH=/go/bin:/usr/local/go/bin:$PATH
-WORKDIR /usr/src/nym-vpn-client/nym-vpn-core
-RUN cargo build --release --package nym-gateway-probe

 COPY ./ /usr/src/nym
+WORKDIR /usr/src/nym
+RUN cargo build --release --package nym-gateway-probe
+
 WORKDIR /usr/src/nym/nym-node-status-api/nym-node-status-agent
 RUN cargo build --release

@@ -35,7 +31,7 @@ RUN apt-get update && apt-get install -y ca-certificates
 WORKDIR /nym

 COPY --from=builder /usr/src/nym/target/release/nym-node-status-agent ./
-COPY --from=builder /usr/src/nym-vpn-client/nym-vpn-core/target/release/nym-gateway-probe ./
+COPY --from=builder /usr/src/nym/target/release/nym-gateway-probe ./
 COPY --from=builder /usr/src/nym/nym-node-status-api/nym-node-status-agent/entrypoint.sh ./
 RUN chmod +x /nym/entrypoint.sh

@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT\n            node_id,\n            ed25519_identity_pubkey,\n            total_stake,\n            ip_addresses as \"ip_addresses!: serde_json::Value\",\n            mix_port,\n            x25519_sphinx_pubkey,\n            node_role as \"node_role: serde_json::Value\",\n            supported_roles as \"supported_roles: serde_json::Value\",\n            entry as \"entry: serde_json::Value\",\n            performance,\n            self_described as \"self_described: serde_json::Value\",\n            bond_info as \"bond_info: serde_json::Value\"\n        FROM\n            nym_nodes\n        ORDER BY\n            node_id\n        ",
+  "query": "SELECT\n            node_id,\n            ed25519_identity_pubkey,\n            total_stake,\n            ip_addresses as \"ip_addresses!: serde_json::Value\",\n            mix_port,\n            x25519_sphinx_pubkey,\n            node_role as \"node_role: serde_json::Value\",\n            supported_roles as \"supported_roles: serde_json::Value\",\n            entry as \"entry: serde_json::Value\",\n            performance,\n            self_described as \"self_described: serde_json::Value\",\n            bond_info as \"bond_info: serde_json::Value\",\n            http_api_port\n        FROM\n            nym_nodes\n        WHERE\n            self_described IS NOT NULL\n        AND\n            bond_info IS NOT NULL\n        ",
  "describe": {
    "columns": [
      {
@@ -62,6 +62,11 @@
        "ordinal": 11,
        "name": "bond_info: serde_json::Value",
        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 12,
+        "name": "http_api_port",
+        "type_info": "Int4"
      }
    ],
    "parameters": {
@@ -79,8 +84,9 @@
      true,
      false,
      true,
+      true,
      true
    ]
  },
-  "hash": "c48d04fc3de59dd484f0a63d40336ced54e08785f77e9ef85f3157d004ec85dc"
+  "hash": "0b51df277ed66c6553f66af9b135342dee177abc1c92e4a89147de3c22d3d1a5"
 }
@@ -1,6 +1,6 @@
 {
  "db_name": "PostgreSQL",
-  "query": "SELECT\n            node_id,\n            ed25519_identity_pubkey,\n            total_stake,\n            ip_addresses as \"ip_addresses!: serde_json::Value\",\n            mix_port,\n            x25519_sphinx_pubkey,\n            node_role as \"node_role: serde_json::Value\",\n            supported_roles as \"supported_roles: serde_json::Value\",\n            entry as \"entry: serde_json::Value\",\n            performance,\n            self_described as \"self_described: serde_json::Value\",\n            bond_info as \"bond_info: serde_json::Value\"\n        FROM\n            nym_nodes\n        WHERE\n            self_described IS NOT NULL\n        AND\n            bond_info IS NOT NULL\n        ",
+  "query": "SELECT\n            node_id,\n            ed25519_identity_pubkey,\n            total_stake,\n            ip_addresses as \"ip_addresses!: serde_json::Value\",\n            mix_port,\n            x25519_sphinx_pubkey,\n            node_role as \"node_role: serde_json::Value\",\n            supported_roles as \"supported_roles: serde_json::Value\",\n            entry as \"entry: serde_json::Value\",\n            performance,\n            self_described as \"self_described: serde_json::Value\",\n            bond_info as \"bond_info: serde_json::Value\",\n            http_api_port\n        FROM\n            nym_nodes\n        ORDER BY\n            node_id\n        ",
  "describe": {
    "columns": [
      {
@@ -62,6 +62,11 @@
        "ordinal": 11,
        "name": "bond_info: serde_json::Value",
        "type_info": "Jsonb"
+      },
+      {
+        "ordinal": 12,
+        "name": "http_api_port",
+        "type_info": "Int4"
      }
    ],
    "parameters": {
@@ -79,8 +84,9 @@
      true,
      false,
      true,
+      true,
      true
    ]
  },
-  "hash": "283f49a65c7d70bf271702ff6a5c7ad6e68c81932d295ff18ed198c54706a57c"
+  "hash": "3ddc12cc4e1796b787a50c40560d2bd71d1cfe5f5265e6f161b3122d1317a421"
 }
@@ -1,26 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO nym_nodes\n                (node_id, ed25519_identity_pubkey,\n                    total_stake,\n                    ip_addresses, mix_port,\n                    x25519_sphinx_pubkey, node_role,\n                    supported_roles, entry,\n                    self_described,\n                    bond_info,\n                    performance, last_updated_utc\n                )\n                VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)\n                ON CONFLICT(node_id) DO UPDATE SET\n                ed25519_identity_pubkey=excluded.ed25519_identity_pubkey,\n                ip_addresses=excluded.ip_addresses,\n                mix_port=excluded.mix_port,\n                x25519_sphinx_pubkey=excluded.x25519_sphinx_pubkey,\n                node_role=excluded.node_role,\n                supported_roles=excluded.supported_roles,\n                entry=excluded.entry,\n                self_described=excluded.self_described,\n                bond_info=excluded.bond_info,\n                performance=excluded.performance,\n                last_updated_utc=excluded.last_updated_utc\n                ;",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Int4",
-        "Varchar",
-        "Int8",
-        "Jsonb",
-        "Int4",
-        "Varchar",
-        "Jsonb",
-        "Jsonb",
-        "Jsonb",
-        "Jsonb",
-        "Jsonb",
-        "Varchar",
-        "Int4"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "b010fb91828f7e4f0b72bdfe3b58b2abb437cccdb6ebd2e1087cc822ed737b0e"
-}
@@ -0,0 +1,27 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "INSERT INTO nym_nodes\n                (node_id, ed25519_identity_pubkey,\n                    total_stake,\n                    ip_addresses, mix_port,\n                    x25519_sphinx_pubkey, node_role,\n                    supported_roles, entry,\n                    self_described,\n                    bond_info,\n                    performance, last_updated_utc, http_api_port\n                )\n                VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)\n                ON CONFLICT(node_id) DO UPDATE SET\n                ed25519_identity_pubkey=excluded.ed25519_identity_pubkey,\n                ip_addresses=excluded.ip_addresses,\n                mix_port=excluded.mix_port,\n                x25519_sphinx_pubkey=excluded.x25519_sphinx_pubkey,\n                node_role=excluded.node_role,\n                supported_roles=excluded.supported_roles,\n                entry=excluded.entry,\n                self_described=excluded.self_described,\n                bond_info=excluded.bond_info,\n                performance=excluded.performance,\n                last_updated_utc=excluded.last_updated_utc,\n                http_api_port=excluded.http_api_port\n                ;",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Int4",
+        "Varchar",
+        "Int8",
+        "Jsonb",
+        "Int4",
+        "Varchar",
+        "Jsonb",
+        "Jsonb",
+        "Jsonb",
+        "Jsonb",
+        "Jsonb",
+        "Varchar",
+        "Int4",
+        "Int4"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "dde9aff827c34086077927bbe33fa3d5c939e7122ba7c88b78a353f00b271ec2"
+}
@@ -3,7 +3,7 @@

 [package]
 name = "nym-node-status-api"
-version = "4.0.10"
+version = "4.0.11-rc1"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true
@@ -0,0 +1,2 @@
+ALTER TABLE nym_nodes
+    ADD COLUMN IF NOT EXISTS http_api_port INTEGER;
@@ -1,5 +1,5 @@
 use crate::ticketbook_manager::TicketbookManagerConfig;
-use clap::Parser;
+use clap::{Parser, Subcommand};
 use nym_bin_common::bin_info;
 use nym_credential_proxy_lib::shared_state::ecash_state::TicketType;
 use reqwest::Url;
@@ -105,6 +105,19 @@ pub(crate) struct Cli {

    #[clap(flatten)]
    pub(crate) ticketbook: TicketbookArgs,
+
+    #[command(subcommand)]
+    pub(crate) command: Option<Commands>,
+}
+
+#[derive(Subcommand, Debug)]
+pub(crate) enum Commands {
+    /// Scrape a single node and output detailed debug logs
+    ScrapeNode {
+        /// The id of the node to scrape
+        #[arg(long)]
+        node_id: i64,
+    },
 }

 #[derive(Debug, Parser)]
@@ -381,7 +381,7 @@ impl ScrapeNodeKind {
 pub(crate) struct ScraperNodeInfo {
    pub node_kind: ScrapeNodeKind,
    pub hosts: Vec<String>,
-    pub http_api_port: i64,
+    pub http_api_port: Option<u16>,
 }

 impl ScraperNodeInfo {
@@ -395,8 +395,21 @@ impl ScraperNodeInfo {
                format!("http://{}", host),
            ]);

-            if self.http_api_port != DEFAULT_NYM_NODE_HTTP_PORT as i64 {
-                urls.insert(0, format!("http://{}:{}", host, self.http_api_port));
+            if let Some(custom_http_api_port) = self.http_api_port {
+                urls = Vec::new();
+                for host in &self.hosts {
+                    urls.append(&mut vec![format!(
+                        "http://{}:{}",
+                        host, custom_http_api_port
+                    )]);
+                }
+
+                // do not fall back to default ports, if the operator sets a custom http api port
+                // in their bond, use it and error out if it's not available
+                // this will correctly handle cases where some operators run multiple nodes
+                // on a single IP address and assign different custom http port apis at bond time
+
+                // urls.insert(0, format!("http://{}:{}", host, custom_http_api_port));
            }
        }

@@ -423,6 +436,7 @@ pub(crate) struct NymNodeDto {
    pub performance: String,
    pub self_described: Option<serde_json::Value>,
    pub bond_info: Option<serde_json::Value>,
+    pub http_api_port: Option<i32>,
 }

 #[allow(dead_code)] // it's not dead code but clippy doesn't detect usage in sqlx macros
@@ -440,6 +454,7 @@ pub(crate) struct NymNodeInsertRecord {
    pub entry: Option<serde_json::Value>,
    pub self_described: Option<serde_json::Value>,
    pub bond_info: Option<serde_json::Value>,
+    pub http_api_port: Option<i32>,
    pub last_updated_utc: i64,
 }

@@ -456,6 +471,12 @@ impl NymNodeInsertRecord {
            .map(|info| decimal_to_i64(info.total_stake()))
            .unwrap_or(0);
        let entry = serialize_opt_to_value!(skimmed_node.entry)?;
+        let http_api_port = bond_info.and_then(|bond| {
+            bond.bond_information
+                .node
+                .custom_http_port
+                .map(|port| port as i32)
+        });
        let bond_info = serialize_opt_to_value!(bond_info)?;
        let self_described = serialize_opt_to_value!(self_described)?;

@@ -472,6 +493,7 @@ impl NymNodeInsertRecord {
            entry,
            self_described,
            bond_info,
+            http_api_port,
            last_updated_utc: now,
        };

@@ -35,7 +35,8 @@ pub(crate) async fn get_all_nym_nodes(pool: &DbPool) -> anyhow::Result<Vec<NymNo
            entry as "entry: serde_json::Value",
            performance,
            self_described as "self_described: serde_json::Value",
-            bond_info as "bond_info: serde_json::Value"
+            bond_info as "bond_info: serde_json::Value",
+            http_api_port
        FROM
            nym_nodes
        ORDER BY
@@ -72,7 +73,8 @@ pub(crate) async fn get_described_bonded_nym_nodes(
            entry as "entry: serde_json::Value",
            performance,
            self_described as "self_described: serde_json::Value",
-            bond_info as "bond_info: serde_json::Value"
+            bond_info as "bond_info: serde_json::Value",
+            http_api_port
        FROM
            nym_nodes
        WHERE
@@ -115,9 +117,9 @@ pub(crate) async fn update_nym_nodes(
                    supported_roles, entry,
                    self_described,
                    bond_info,
-                    performance, last_updated_utc
+                    performance, last_updated_utc, http_api_port
                )
-                VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
+                VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)
                ON CONFLICT(node_id) DO UPDATE SET
                ed25519_identity_pubkey=excluded.ed25519_identity_pubkey,
                ip_addresses=excluded.ip_addresses,
@@ -129,7 +131,8 @@ pub(crate) async fn update_nym_nodes(
                self_described=excluded.self_described,
                bond_info=excluded.bond_info,
                performance=excluded.performance,
-                last_updated_utc=excluded.last_updated_utc
+                last_updated_utc=excluded.last_updated_utc,
+                http_api_port=excluded.http_api_port
                ;",
            record.node_id,
            record.ed25519_identity_pubkey,
@@ -144,6 +147,7 @@ pub(crate) async fn update_nym_nodes(
            record.bond_info,
            record.performance,
            record.last_updated_utc as i32,
+            record.http_api_port,
        )
        .execute(&mut *tx)
        .await
@@ -21,10 +21,11 @@ pub(crate) async fn get_nodes_for_scraping(pool: &DbPool) -> Result<Vec<ScraperN
    let skimmed_nodes = queries::get_described_bonded_nym_nodes(pool)
        .await
        .map(|nodes_dto| {
-            nodes_dto.into_iter().filter_map(|node| {
-                let node_id = node.node_id;
-                match SkimmedNode::try_from(node) {
-                    Ok(node) => Some(node),
+            nodes_dto.into_iter().filter_map(|node_dto| {
+                let node_id = node_dto.node_id;
+                let http_api_port = node_dto.http_api_port;
+                match SkimmedNode::try_from(node_dto) {
+                    Ok(node) => Some((node, http_api_port)),
                    Err(e) => {
                        tracing::error!("Failed to decode node_id={}: {}", node_id, e);
                        None
@@ -33,7 +34,7 @@ pub(crate) async fn get_nodes_for_scraping(pool: &DbPool) -> Result<Vec<ScraperN
            })
        })?;

-    skimmed_nodes.for_each(|node| {
+    skimmed_nodes.for_each(|(node, http_api_port)| {
        // TODO: relies on polyfilling: Nym nodes table might contain legacy mixnodes
        // as well. Categorize them here.
        let node_kind = if gateway_keys.contains(&node.ed25519_identity_pubkey.to_base58_string()) {
@@ -54,7 +55,7 @@ pub(crate) async fn get_nodes_for_scraping(pool: &DbPool) -> Result<Vec<ScraperN
                .into_iter()
                .map(|ip| ip.to_string())
                .collect::<Vec<_>>(),
-            http_api_port: node.mix_port.into(),
+            http_api_port: http_api_port.map(|port| port as u16),
        })
    });

@@ -138,6 +138,7 @@ mod db_tests {
            performance: "1.0".to_string(),
            self_described: None,
            bond_info: None,
+            http_api_port: None,
        };

        let skimmed_node: nym_validator_client::nym_api::SkimmedNode =
@@ -362,22 +363,42 @@ fn test_scraper_node_info_contact_addresses() {
    let node_info = ScraperNodeInfo {
        node_kind: ScrapeNodeKind::MixingNymNode { node_id: 123 },
        hosts: vec!["1.1.1.1".to_string(), "example.com".to_string()],
-        http_api_port: 8080,
+        http_api_port: None,
    };

    let addresses = node_info.contact_addresses();

    // Should generate multiple URLs for each host
-    // Custom port (8080) should be inserted at the beginning
+    // When no custom port is specified only default ports should be used
    assert!(addresses.contains(&"http://1.1.1.1:8080".to_string()));
-    assert!(addresses.contains(&"http://example.com:8080".to_string()));
    assert!(addresses.contains(&"http://1.1.1.1:8000".to_string()));
    assert!(addresses.contains(&"https://1.1.1.1".to_string()));
+    assert!(addresses.contains(&"http://1.1.1.1".to_string()));
    assert!(addresses.contains(&"http://example.com:8000".to_string()));
    // Check that URLs follow the expected pattern
    assert!(addresses.len() >= 8); // At least 4 URLs per host
 }

+#[test]
+fn test_scraper_node_info_contact_addresses_with_custom_http_api_port() {
+    use crate::db::models::{ScrapeNodeKind, ScraperNodeInfo};
+
+    let node_info = ScraperNodeInfo {
+        node_kind: ScrapeNodeKind::MixingNymNode { node_id: 123 },
+        hosts: vec!["1.1.1.1".to_string(), "example.com".to_string()],
+        http_api_port: Some(4444),
+    };
+
+    let addresses = node_info.contact_addresses();
+
+    // Should generate multiple URLs for each host
+    // Custom port (4444) should be the only port in the list
+    assert!(addresses.contains(&"http://1.1.1.1:4444".to_string()));
+    assert!(addresses.contains(&"http://example.com:4444".to_string()));
+    // Check that URLs follow the expected pattern
+    assert!(addresses.len() >= 2); // At least 4 URLs per host
+}
+
 #[test]
 fn test_scrape_node_kind_node_id() {
    use crate::db::models::ScrapeNodeKind;
@@ -414,6 +435,7 @@ fn test_nym_node_dto_with_invalid_keys() {
        performance: "1.0".to_string(),
        self_described: None,
        bond_info: None,
+        http_api_port: None,
    };

    let result: Result<nym_validator_client::nym_api::SkimmedNode, _> = nym_node_dto.try_into();
@@ -451,6 +473,7 @@ fn test_nym_node_dto_with_invalid_performance() {
        performance: "invalid_percent".to_string(),
        self_described: None,
        bond_info: None,
+        http_api_port: None,
    };

    let result: Result<nym_validator_client::nym_api::SkimmedNode, _> = nym_node_dto.try_into();
@@ -1,4 +1,6 @@
+use crate::cli::Commands;
 use crate::monitor::DelegationsCache;
+use crate::node_scraper::helpers::scrape_and_store_description_by_node_id;
 use crate::ticketbook_manager::TicketbookManager;
 use crate::ticketbook_manager::state::TicketbookManagerState;
 use clap::Parser;
@@ -40,11 +42,49 @@ async fn main() -> anyhow::Result<()> {
    tracing::info!("Registered {} agent keys", agent_key_list.len());

    let connection_url = args.database_url.clone();
-    tracing::debug!("Using config:\n{:#?}", args);
+    if std::env::var("SHOW_CONFIG").ok().is_some() {
+        tracing::debug!("Using config:\n{:#?}", args);
+    }

    let storage = db::Storage::init(connection_url, args.sqlx_busy_timeout_s).await?;
    let db_pool = storage.pool_owned();

+    // node geocache is shared between node monitor and HTTP server
+    let geocache = moka::future::Cache::builder()
+        .time_to_live(args.geodata_ttl)
+        .build();
+    let delegations_cache = DelegationsCache::new();
+
+    let client_config = nym_validator_client::nyxd::Config::try_from_nym_network_details(
+        &nym_network_defaults::NymNetworkDetails::new_from_env(),
+    )?;
+    let nyxd_client = NyxdClient::connect(client_config.clone(), args.nyxd_addr.as_str())
+        .map_err(|err| anyhow::anyhow!("Couldn't connect: {}", err))?;
+
+    match args.command {
+        Some(Commands::ScrapeNode { node_id }) => {
+            if std::env::var("RUN_ONCE_INIT_NODES").ok().is_some() {
+                let geocache_clone = geocache.clone();
+                let delegations_cache_clone = Arc::clone(&delegations_cache);
+                monitor::run_once(
+                    db_pool.clone(),
+                    args.nym_api_client_timeout,
+                    nyxd_client,
+                    args.ipinfo_api_token,
+                    geocache_clone,
+                    delegations_cache_clone,
+                )
+                .await?;
+            }
+            tracing::info!("Scraping node with id {node_id}...");
+            scrape_and_store_description_by_node_id(&db_pool, node_id).await?;
+            return Ok(());
+        }
+        None => {
+            // default behaviour
+        }
+    }
+
    // Start the node scraper
    let scraper = node_scraper::DescriptionScraper::new(storage.pool_owned());
    shutdown_manager.spawn_with_shutdown(async move {
@@ -58,20 +98,9 @@ async fn main() -> anyhow::Result<()> {
        scraper.start().await;
    });

-    // node geocache is shared between node monitor and HTTP server
-    let geocache = moka::future::Cache::builder()
-        .time_to_live(args.geodata_ttl)
-        .build();
-    let delegations_cache = DelegationsCache::new();
-
    // Start the monitor
    let geocache_clone = geocache.clone();
    let delegations_cache_clone = Arc::clone(&delegations_cache);
-    let client_config = nym_validator_client::nyxd::Config::try_from_nym_network_details(
-        &nym_network_defaults::NymNetworkDetails::new_from_env(),
-    )?;
-    let nyxd_client = NyxdClient::connect(client_config.clone(), args.nyxd_addr.as_str())
-        .map_err(|err| anyhow::anyhow!("Couldn't connect: {}", err))?;

    shutdown_manager.spawn_with_shutdown(async move {
        monitor::run_in_background(
@@ -68,7 +68,7 @@ pub(crate) async fn run_in_background(
    loop {
        tracing::info!("Refreshing node info...");

-        if let Err(e) = monitor.run().await {
+        if let Err(e) = monitor.run(false).await {
            tracing::error!(
                "Monitor run failed: {e}, retrying in {}s...",
                MONITOR_FAILURE_RETRY_DELAY.as_secs()
@@ -84,8 +84,33 @@ pub(crate) async fn run_in_background(
    }
 }

+#[instrument(level = "debug", name = "data_monitor", skip_all)]
+pub(crate) async fn run_once(
+    db_pool: DbPool,
+    nym_api_client_timeout: Duration,
+    nyxd_client: nym_validator_client::QueryHttpRpcNyxdClient,
+    ipinfo_api_token: String,
+    geocache: NodeGeoCache,
+    node_delegations: Arc<RwLock<DelegationsCache>>,
+) -> anyhow::Result<()> {
+    let ipinfo = IpInfoClient::new(ipinfo_api_token.clone());
+
+    let mut monitor = Monitor {
+        db_pool,
+        network_details: nym_network_defaults::NymNetworkDetails::new_from_env(),
+        nym_api_client_timeout,
+        nyxd_client,
+        ipinfo,
+        geocache,
+        node_delegations,
+    };
+
+    tracing::info!("Refreshing node info...");
+    monitor.run(true).await
+}
+
 impl Monitor {
-    async fn run(&mut self) -> anyhow::Result<()> {
+    async fn run(&mut self, exit_early: bool) -> anyhow::Result<()> {
        self.check_ipinfo_bandwidth().await;

        let default_api_url = self
@@ -153,6 +178,11 @@ impl Monitor {
                tracing::debug!("{} nym nodes written to DB!", inserted);
            })?;

+        // stop here if running once
+        if exit_early {
+            return Ok(());
+        }
+
        // refresh geodata for all nodes
        for node_description in described_nodes.values() {
            self.location_cached(node_description).await;
@@ -118,6 +118,17 @@ pub fn sanitize_description(
    }
 }

+pub async fn scrape_and_store_description_by_node_id(pool: &DbPool, node_id: i64) -> Result<()> {
+    let nodes = crate::db::queries::get_nodes_for_scraping(pool).await?;
+    match nodes.iter().find(|n| *n.node_kind.node_id() == node_id) {
+        Some(node) => Ok(scrape_and_store_description(pool, node.clone()).await?),
+        None => {
+            error!("Could not find node with id {node_id}");
+            Err(anyhow!("Could not find node with id {node_id}"))
+        }
+    }
+}
+
 pub async fn scrape_and_store_description(pool: &DbPool, node: ScraperNodeInfo) -> Result<()> {
    let client = build_client()?;
    let urls = node.contact_addresses();
@@ -152,7 +163,13 @@ pub async fn scrape_and_store_description(pool: &DbPool, node: ScraperNodeInfo)
        anyhow::anyhow!("Failed to fetch description from any URL: {}", err_msg)
    })?;

-    let sanitized_description = sanitize_description(description, *node.node_id());
+    let sanitized_description = sanitize_description(description.clone(), *node.node_id());
+
+    trace!("tried_url_list = {tried_url_list:?}");
+    trace!("ndoe_id = {}", node.node_id());
+    trace!("description = {:?}", description);
+    trace!("sanitized_description = {:?}", sanitized_description);
+
    insert_scraped_node_description(pool, &node.node_kind, &sanitized_description).await?;

    Ok(())
@@ -3,7 +3,7 @@

 [package]
 name = "nym-node"
-version = "1.19.0"
+version = "1.21.0"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true
@@ -35,19 +35,85 @@ pub enum RegistrationClientError {
    #[error("timeout connecting the mixnet client")]
    Timeout(#[from] tokio::time::error::Elapsed),

-    #[error("failed to register wireguard with the gateway for {gateway_id}")]
-    EntryGatewayRegisterWireguard {
+    #[error(
+        "failed to register wireguard with the gateway for {gateway_id}, no credential was sent"
+    )]
+    WireguardEntryRegistration {
        gateway_id: String,
        authenticator_address: Box<nym_sdk::mixnet::Recipient>,
        #[source]
-        source: Box<nym_authenticator_client::Error>,
+        source: Box<nym_authenticator_client::AuthenticationClientError>,
    },

-    #[error("failed to register wireguard with the gateway for {gateway_id}")]
-    ExitGatewayRegisterWireguard {
+    #[error(
+        "failed to register wireguard with the gateway for {gateway_id}, no credential was sent"
+    )]
+    WireguardExitRegistration {
        gateway_id: String,
        authenticator_address: Box<nym_sdk::mixnet::Recipient>,
        #[source]
-        source: Box<nym_authenticator_client::Error>,
+        source: Box<nym_authenticator_client::AuthenticationClientError>,
+    },
+
+    #[error(
+        "failed to register wireguard with the gateway for {gateway_id}, a credential was sent"
+    )]
+    WireguardEntryRegistrationCredentialSent {
+        gateway_id: String,
+        authenticator_address: Box<nym_sdk::mixnet::Recipient>,
+        #[source]
+        source: Box<nym_authenticator_client::AuthenticationClientError>,
+    },
+
+    #[error(
+        "failed to register wireguard with the gateway for {gateway_id}, a credential was sent"
+    )]
+    WireguardExitRegistrationCredentialSent {
+        gateway_id: String,
+        authenticator_address: Box<nym_sdk::mixnet::Recipient>,
+        #[source]
+        source: Box<nym_authenticator_client::AuthenticationClientError>,
    },
 }
+
+impl RegistrationClientError {
+    pub fn from_authenticator_error(
+        error: nym_authenticator_client::RegistrationError,
+        gateway_id: String,
+        authenticator_address: nym_sdk::mixnet::Recipient,
+        entry: bool,
+    ) -> Self {
+        match error {
+            nym_authenticator_client::RegistrationError::NoCredentialSent(source) => {
+                if entry {
+                    Self::WireguardEntryRegistration {
+                        gateway_id,
+                        authenticator_address: Box::new(authenticator_address),
+                        source: Box::new(source),
+                    }
+                } else {
+                    Self::WireguardExitRegistration {
+                        gateway_id,
+                        authenticator_address: Box::new(authenticator_address),
+                        source: Box::new(source),
+                    }
+                }
+            }
+            nym_authenticator_client::RegistrationError::CredentialSent { source } => {
+                if entry {
+                    Self::WireguardEntryRegistrationCredentialSent {
+                        gateway_id,
+                        authenticator_address: Box::new(authenticator_address),
+                        source: Box::new(source),
+                    }
+                } else {
+                    Self::WireguardExitRegistrationCredentialSent {
+                        gateway_id,
+                        authenticator_address: Box::new(authenticator_address),
+                        source: Box::new(source),
+                    }
+                }
+            }
+        }
+    }
+}
@@ -162,20 +162,22 @@ impl RegistrationClient {

        let entry = entry.map_err(|source| RegistrationError {
            mixnet_client: None,
-            source: RegistrationClientError::EntryGatewayRegisterWireguard {
-                gateway_id: self.config.entry.node.identity.to_base58_string(),
-                authenticator_address: Box::new(entry_auth_address),
-                source: Box::new(source),
-            },
+            source: RegistrationClientError::from_authenticator_error(
+                source,
+                self.config.entry.node.identity.to_base58_string(),
+                entry_auth_address,
+                true,
+            ),
        })?;

        let exit = exit.map_err(|source| RegistrationError {
            mixnet_client: None,
-            source: RegistrationClientError::EntryGatewayRegisterWireguard {
-                gateway_id: self.config.exit.node.identity.to_base58_string(),
-                authenticator_address: Box::new(exit_auth_address),
-                source: Box::new(source),
-            },
+            source: RegistrationClientError::from_authenticator_error(
+                source,
+                self.config.exit.node.identity.to_base58_string(),
+                exit_auth_address,
+                false,
+            ),
        })?;

        Ok(RegistrationResult::Wireguard(Box::new(
@@ -4,7 +4,7 @@
 [package]
 name = "nym-network-requester"
 license = "GPL-3.0"
-version = "1.1.65"
+version = "1.1.67"
 authors.workspace = true
 edition.workspace = true
 rust-version = "1.85"
@@ -1,6 +1,6 @@
 [package]
 name = "nym-cli"
-version = "1.1.64"
+version = "1.1.66"
 authors.workspace = true
 edition = "2021"
 license.workspace = true
@@ -1,6 +1,6 @@
 [package]
 name = "nymvisor"
-version = "0.1.29"
+version = "0.1.31"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true
Author	SHA1	Message	Date
Tommy Verrall	afc37988e3	Connections timeout after 5 minutes due to IPv6 DNS queries failing on IPv6-disabled networks	2025-11-14 11:55:38 +01:00
Bogdan-Ștefan Neacşu	18b0943846	[bugfix] Distinguish authenticator errors by credential spent (#6176 ) (#6192 ) * distinguish authenticator errors by credential spent * nitpicking fixes * fix CI to see those changes * error naming Co-authored-by: Simon Wicky <simon@nymtech.net>	2025-11-12 14:13:09 +02:00
Tommy Verrall	15223fb19f	Merge pull request #6190 from nymtech/dns-debug-fig Dns debug fig	2025-11-12 12:47:46 +01:00
Tommy Verrall	90886091ee	Fix clippy	2025-11-12 12:06:37 +01:00
benedettadavico	babf113fe5	update changelog	2025-11-12 08:39:48 +01:00
jmwample	fc2bd74d75	fix change in interface	2025-11-06 17:35:58 -07:00
Jack Wampler	b21c43b106	Implement Static DNS fallback (#6178 )	2025-11-06 17:08:33 -07:00
Jack Wampler	f7a9e22cf3	DNS Reliability Fixes (#6175 )	2025-11-06 17:08:33 -07:00
benedettadavico	0d7487f530	bump versions	2025-10-31 13:24:27 +01:00
Jędrzej Stuczyński	378f32e6d7	disconnect mixnet client if registration fails (#6169 ) Co-authored-by: Simon Wicky <simon@nymtech.net>	2025-10-31 12:07:22 +00:00
Jędrzej Stuczyński	3e9b8d237f	Merge pull request #6168 from nymtech/chore/clippy-1.91 chore: resolve clippy 1.91 warnings	2025-10-31 12:00:55 +00:00
Jędrzej Stuczyński	f5a4dbc555	removed useless use of vec!	2025-10-31 11:42:42 +00:00
Jędrzej Stuczyński	4480534e4d	derived Default impl for EpochState	2025-10-31 11:39:58 +00:00
Jędrzej Stuczyński	d355f9d752	Merge pull request #6167 from nymtech/master master -> develop	2025-10-31 11:38:15 +00:00
Jędrzej Stuczyński	9f3a370496	Merge pull request #6166 from nymtech/merge/release/2025.19-kase-cherry-picked release/2025.19 kase into master	2025-10-31 11:28:51 +00:00
Jędrzej Stuczyński	e4adc5d954	Merge pull request #6165 from nymtech/release/2025.19-kase-cherry-picked release/2025.19 kase into develop	2025-10-31 11:28:44 +00:00
Jędrzej Stuczyński	00373b70e2	Merge branch 'master' into merge/release/2025.19-kase-cherry-picked	2025-10-31 10:54:29 +00:00
benedettadavico	65f2017422	update changelog	2025-10-31 10:47:36 +00:00
benedettadavico	192f258463	update workflow	2025-10-31 10:47:34 +00:00
Tommy Verrall	a5eee7444b	Merge pull request #6143 from nymtech/bugfix/mix-tx-closed-v2 Bugfix: Add circuit breaker	2025-10-31 10:47:20 +00:00
benedettadavico	6abd7e7352	bump versions	2025-10-31 10:47:10 +00:00
Jędrzej Stuczyński	3306ca5357	merge 'master' into 'develop'	2025-10-30 17:43:42 +00:00
Jędrzej Stuczyński	9c2ccead0e	Merge branch 'master' into merge/master/develop	2025-10-30 17:30:39 +00:00
import this	b7aeb51362	[DOCs/operators]: Release notes for v2025.19 kase (#6157 ) * add release and operators notes * bump up version * fix location in csv to USA * bump up stats * typo fix	2025-10-30 16:21:04 +00:00
benedetta davico	e9e725defe	Merge pull request #6093 from nymtech/bugfix/ns-api-node-custom-http-api-port ns-api: fix scraping bug when operator specifies custom node HTTP API port in bond	2025-10-30 16:49:02 +01:00
Mark Sinclair	17d11f201e	change migration and bump version	2025-10-17 15:04:53 +01:00
Mark Sinclair	fef7e42eb4	bump version to rc	2025-10-17 14:56:02 +01:00
Mark Sinclair	ceeeb6211b	add tracing output	2025-10-17 14:52:59 +01:00
Mark Sinclair	cd77b1032f	clippy	2025-10-17 14:48:40 +01:00
Mark Sinclair	6bbb14f12f	save custom_http_port to db	2025-10-17 14:48:40 +01:00
Mark Sinclair	de8030d85a	allow NS API to run once for scraping for troubleshooting and debugging	2025-10-17 14:48:40 +01:00
Mark Sinclair	e18e64bf21	wip	2025-10-17 14:48:40 +01:00
Mark Sinclair	a50c9ac3fb	ns-api: fix scraping bug when operator specifies custom node HTTP API port in bond	2025-10-17 14:48:39 +01:00
benedetta davico	2235a6e147	Merge pull request #6113 from nymtech/release/2025.18-jarlsberg Merge release/2025.18-jarlsberg to master	2025-10-15 10:22:16 +02:00
benedettadavico	db6defa122	update changelog	2025-10-14 12:07:26 +02:00
Jędrzej Stuczyński	df7768dec0	Bugfix/bloomfilters purge (#6089 ) * remove all old bloomfilters upon starting binary * remove old bloomfilter file upon purging secondary data	2025-10-06 14:02:32 +01:00
benedettadavico	f3a449b7cc	bump versions	2025-10-06 14:38:00 +02:00
benedetta davico	cf21593ffa	Merge pull request #6080 from nymtech/release/2025.17-isabirra Merge release/2025.17-isabirra to master	2025-10-02 16:06:41 +02:00
benedetta davico	f0d8dabb9f	Merge pull request #6042 from nymtech/release/2025.16-halloumi Merge release/2025.16-halloumi to master	2025-09-17 14:20:19 +02:00
benedetta davico	f105bcbafe	Merge pull request #5968 from nymtech/release/2025.15-gruyere merge gruyere to master	2025-08-21 12:20:35 +02:00
benedetta davico	dc0f4af2c1	Merge pull request #5937 from nymtech/release/2025.14-feta	2025-08-13 11:12:19 +02:00
benedetta davico	2a621e07a8	Merge pull request #5907 from nymtech/release/2025.13-emmental Merge release/2025.13-emmental to master	2025-07-22 16:23:44 +02:00
benedetta davico	485aeebabd	Merge pull request #5886 from nymtech/release/2025.12-dolcelatte Merge release/2025.12-dolcelatte to master	2025-07-09 15:25:16 +02:00
benedetta davico	3b726bada9	Merge pull request #5839 from nymtech/release/2025.11-cheddar merge release/2025.11-cheddar to master	2025-06-11 13:09:43 +02:00
benedetta davico	1d1b2e17d2	Merge pull request #5807 from nymtech/release/2025.10-brie	2025-05-28 09:38:15 +02:00
benedetta davico	b5b2dbdfd8	Merge pull request #5776 from nymtech/release/2025.9-appenzeller Release/2025.9-appenzeller to master	2025-05-16 13:23:10 +02:00
benedetta davico	82806f47d8	Merge pull request #5735 from nymtech/release/2025.8-tourist Merge release/2025.8-tourist to master	2025-05-05 12:11:39 +02:00
benedetta davico	c6f85cf23e	Merge pull request #5727 from nymtech/release/2025.7-tex Merge tex to master	2025-04-22 10:50:43 +02:00
benedetta davico	ed8de7234d	Merge pull request #5672 from nymtech/release/2025.6-chuckles Merge release/2025.6-chuckles into master	2025-04-02 10:34:51 +02:00
benedetta davico	e25d83b047	Merge pull request #5641 from nymtech/release/2025.5-chokito Merge chokito to master	2025-03-24 10:14:50 +01:00
Jędrzej Stuczyński	9974d480b5	Merge pull request #5574 from nymtech/release/2025.4-dorina-patched Release/2025.4-dorina-patched to master	2025-03-11 10:37:06 +00:00
benedetta davico	2211f13cdd	Merge pull request #5551 from nymtech/release/2025.4-dorina Merge release/2025.4-dorina to master	2025-03-04 13:55:27 +01:00
benedetta davico	4505f18a02	Merge pull request #5485 from nymtech/release/2025.3-ruta Release/2025.3 ruta to master	2025-02-18 10:08:08 +01:00
benedetta davico	a717a18948	Merge pull request #5430 from nymtech/release/2025.2-hu Merge release/2025.2-hu to master	2025-02-06 13:58:55 +01:00