Revert "chore: workspace global panic preventing lints (#5512 )"

This reverts commit 6ac6747cc7.
chore: workspace global panic preventing lints (#5512 )
2025-02-26 10:30:22 +00:00 · 2025-02-26 10:30:14 +00:00
264 changed files with 2950 additions and 9759 deletions
@@ -26,7 +26,6 @@ jobs:
    runs-on: ${{ matrix.platform }}
    env:
      CARGO_TERM_COLOR: always
-      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
      - uses: actions/checkout@v4

@@ -12,7 +12,6 @@ jobs:
    runs-on: arc-ubuntu-22.04
    env:
      CARGO_TERM_COLOR: always
-      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
      - name: Check out repository code
        uses: actions/checkout@v4
@@ -37,7 +37,6 @@ jobs:
    env:
      CARGO_TERM_COLOR: always
      IPINFO_API_TOKEN: ${{ secrets.IPINFO_API_TOKEN }}
-      RUSTUP_PERMIT_COPY_RENAME: 1
    steps:
      - name: Install Dependencies (Linux)
        run: sudo apt-get update && sudo apt-get -y install libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools protobuf-compiler
@@ -4,118 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://

 ## [Unreleased]

-## [2025.4-dorina-patched] (2025-03-06)
-
- use legacy crypto for constructing SURB headers ([#5579])
- bugfix: make sure to correctly decode response content when putting it into error message ([#5571])
- Tweak surb management to be more conservative ([#5570])
- Deserialize v5 authenticator requests ([#5568])
- chore: additional logs when attempting to load ecash keys ([#5567])
- add full response body to error message upon decoding failure ([#5566])
- hotfix: ensure we bail on merkle leaves insertion upon missing data ([#5565])
- feature: v2 authentication request (#5537) ([#5563])
- Create authenticator v5 request/response types ([#5561])
-
-[#5579]: https://github.com/nymtech/nym/pull/5579
-[#5571]: https://github.com/nymtech/nym/pull/5571
-[#5570]: https://github.com/nymtech/nym/pull/5570
-[#5568]: https://github.com/nymtech/nym/pull/5568
-[#5567]: https://github.com/nymtech/nym/pull/5567
-[#5566]: https://github.com/nymtech/nym/pull/5566
-[#5565]: https://github.com/nymtech/nym/pull/5565
-[#5563]: https://github.com/nymtech/nym/pull/5563
-[#5561]: https://github.com/nymtech/nym/pull/5561
-
-## [2025.4-dorina] (2025-03-04)
-
- fixed sphinx version metrics registration ([#5546])
- Feature/chain status api ([#5539])
- Add SURBs soft threshold ([#5535])
- Simplify IPR v8 ([#5532])
- Shared instance for DNS AsyncResolver ([#5523])
- merge #5512 again after reverting due to incorrect rebase ([#5520])
- cherry-pick 17d3ff2d775f61aee381d90a304ed416c08f33fc onto dorina ([#5519])
- cherry-pick 6e5d0dac1b75413c5f09122b0d953f8ec6ef48df onto dorina ([#5518])
- chore: workspace global panic preventing lints ([#5512])
- bugfix: dont query for ecash apis unless necessary when spending ticketbooks ([#5508])
- bugfix: bound check when recovering a reply SURB ([#5502])
- chore: removed all old coconut code ([#5500])
- IPR request types v8 ([#5498])
- Support static routes for HTTP requests ([#5487])
- build(deps): bump the patch-updates group across 1 directory with 3 updates ([#5482])
- added missing import to doctest ([#5480])
- adjusted TestSetup::new_complex to ensure bonded node's existence ([#5478])
- Trigger contracts CI on main workspace Cargo changes ([#5477])
- build(deps): bump http from 1.1.0 to 1.2.0 ([#5472])
- build(deps): bump utoipa-swagger-ui from 8.0.3 to 8.1.0 ([#5471])
- build(deps): bump colored from 2.1.0 to 2.2.0 ([#5470])
- build(deps): bump celes from 2.4.0 to 2.5.0 ([#5469])
- build(deps): bump the patch-updates group with 2 updates ([#5467])
- build(deps): bump elliptic from 6.5.4 to 6.6.1 in /docker/typescript_client/upload_contract ([#5463])
- Run cargo autoinherit ([#5460])
- Fix clippy::precedence ([#5457])
- Provide Interval context with node descriptor endpoints ([#5456])
- fix: update fx average rate calcs to ignore 0 values ([#5454])
- Feature/add gbp currency ([#5453])
- Add helper to extract a list of sqlite files with journal files wal/shm ([#5452])
- Add a middleware layer to the nym api allowing for data compression ([#5451])
- Condense core API functionalities and enable gzip decompression for reqwest payloads ([#5450])
- build(deps): bump uniffi_build from 0.25.3 to 0.29.0 ([#5448])
- Upgrade tower to 0.5.2 ([#5446])
- build(deps): bump hickory-proto from 0.24.2 to 0.24.3 ([#5444])
- Seedable clients ([#5440])
- build(deps): bump the patch-updates group across 1 directory with 10 updates ([#5439])
- Remove all recv_with_delay and add shutdown condition to loops in client-core ([#5435])
- Disable the test for checking the remaining bandwidth in nym-node-status-api ([#5425])
- Dz nym node stats ([#5418])
- build(deps): bump hyper from 1.4.1 to 1.6.0 ([#5416])
- build(deps): bump publicsuffix from 2.2.3 to 2.3.0 ([#5367])
- Nymnode entrypoint docker ([#5300])
-
-[#5546]: https://github.com/nymtech/nym/pull/5546
-[#5539]: https://github.com/nymtech/nym/pull/5539
-[#5535]: https://github.com/nymtech/nym/pull/5535
-[#5532]: https://github.com/nymtech/nym/pull/5532
-[#5523]: https://github.com/nymtech/nym/pull/5523
-[#5520]: https://github.com/nymtech/nym/pull/5520
-[#5519]: https://github.com/nymtech/nym/pull/5519
-[#5518]: https://github.com/nymtech/nym/pull/5518
-[#5512]: https://github.com/nymtech/nym/pull/5512
-[#5508]: https://github.com/nymtech/nym/pull/5508
-[#5502]: https://github.com/nymtech/nym/pull/5502
-[#5500]: https://github.com/nymtech/nym/pull/5500
-[#5498]: https://github.com/nymtech/nym/pull/5498
-[#5487]: https://github.com/nymtech/nym/pull/5487
-[#5482]: https://github.com/nymtech/nym/pull/5482
-[#5480]: https://github.com/nymtech/nym/pull/5480
-[#5478]: https://github.com/nymtech/nym/pull/5478
-[#5477]: https://github.com/nymtech/nym/pull/5477
-[#5472]: https://github.com/nymtech/nym/pull/5472
-[#5471]: https://github.com/nymtech/nym/pull/5471
-[#5470]: https://github.com/nymtech/nym/pull/5470
-[#5469]: https://github.com/nymtech/nym/pull/5469
-[#5467]: https://github.com/nymtech/nym/pull/5467
-[#5463]: https://github.com/nymtech/nym/pull/5463
-[#5460]: https://github.com/nymtech/nym/pull/5460
-[#5457]: https://github.com/nymtech/nym/pull/5457
-[#5456]: https://github.com/nymtech/nym/pull/5456
-[#5454]: https://github.com/nymtech/nym/pull/5454
-[#5453]: https://github.com/nymtech/nym/pull/5453
-[#5452]: https://github.com/nymtech/nym/pull/5452
-[#5451]: https://github.com/nymtech/nym/pull/5451
-[#5450]: https://github.com/nymtech/nym/pull/5450
-[#5448]: https://github.com/nymtech/nym/pull/5448
-[#5446]: https://github.com/nymtech/nym/pull/5446
-[#5444]: https://github.com/nymtech/nym/pull/5444
-[#5440]: https://github.com/nymtech/nym/pull/5440
-[#5439]: https://github.com/nymtech/nym/pull/5439
-[#5435]: https://github.com/nymtech/nym/pull/5435
-[#5425]: https://github.com/nymtech/nym/pull/5425
-[#5418]: https://github.com/nymtech/nym/pull/5418
-[#5416]: https://github.com/nymtech/nym/pull/5416
-[#5367]: https://github.com/nymtech/nym/pull/5367
-[#5300]: https://github.com/nymtech/nym/pull/5300
-
 ## [2025.3-ruta] (2025-02-10)

 - Push down forget me to client configs ([#5431])
@@ -191,10 +191,10 @@ aes = "0.8.1"
 aes-gcm = "0.10.1"
 aes-gcm-siv = "0.11.1"
 ammonia = "4"
-anyhow = "1.0.97"
+anyhow = "1.0.95"
 arc-swap = "1.7.1"
 argon2 = "0.5.0"
-async-trait = "0.1.87"
+async-trait = "0.1.86"
 axum = "0.7.5"
 axum-client-ip = "0.6.1"
 axum-extra = "0.9.4"
@@ -205,24 +205,24 @@ bincode = "1.3.3"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
 bit-vec = "0.7.0"                                     # can we unify those?
 bitvec = "1.0.0"
-blake3 = "1.6.1"
+blake3 = "1.5.5"
 bloomfilter = "1.0.14"
 bs58 = "0.5.1"
 bytecodec = "0.4.15"
-bytes = "1.10.1"
+bytes = "1.7.2"
 cargo_metadata = "0.18.1"
 celes = "2.5.0"
 cfg-if = "1.0.0"
 chacha20 = "0.9.0"
 chacha20poly1305 = "0.10.1"
-chrono = "0.4.40"
+chrono = "0.4.39"
 cipher = "0.4.3"
-clap = "4.5.31"
+clap = "4.5.30"
 clap_complete = "4.5"
 clap_complete_fig = "4.5"
 colored = "2.2"
 comfy-table = "7.1.4"
-console = "0.15.11"
+console = "0.15.10"
 console-subscriber = "0.1.1"
 console_error_panic_hook = "0.1"
 const-str = "0.5.6"
@@ -241,23 +241,22 @@ doc-comment = "0.3"
 dotenvy = "0.15.6"
 ecdsa = "0.16"
 ed25519-dalek = "2.1"
-encoding_rs = "0.8.35"
 env_logger = "0.11.6"
 envy = "0.4"
 etherparse = "0.13.0"
 eyre = "0.6.9"
 fastrand = "2.1.1"
-flate2 = "1.1.0"
+flate2 = "1.0.35"
 futures = "0.3.31"
 futures-util = "0.3"
 generic-array = "0.14.7"
 getrandom = "0.2.10"
-getset = "0.1.5"
+getset = "0.1.4"
 handlebars = "3.5.5"
 headers = "0.4.0"
 hex = "0.4.3"
 hex-literal = "0.3.3"
-hickory-resolver = "0.24.4"
+hickory-resolver = "0.24.3"
 hkdf = "0.12.3"
 hmac = "0.12.1"
 http = "1"
@@ -273,7 +272,7 @@ inquire = "0.6.2"
 ip_network = "0.4.1"
 ipnetwork = "0.20"
 isocountry = "0.3.2"
-itertools = "0.14.0"
+itertools = "0.13.0"
 k256 = "0.13"
 lazy_static = "1.5.0"
 ledger-transport = "0.10.0"
@@ -310,19 +309,19 @@ rocket_cors = "0.6.0"
 rocket_okapi = "0.8.0"
 rs_merkle = "1.4.2"
 safer-ffi = "0.1.13"
-schemars = "0.8.22"
-semver = "1.0.26"
-serde = "1.0.219"
-serde_bytes = "0.11.17"
+schemars = "0.8.21"
+semver = "1.0.25"
+serde = "1.0.217"
+serde_bytes = "0.11.15"
 serde_derive = "1.0"
-serde_json = "1.0.140"
+serde_json = "1.0.138"
 serde_json_path = "0.7.2"
 serde_repr = "0.1"
 serde_with = "3.9.0"
 serde_yaml = "0.9.25"
 sha2 = "0.10.8"
 si-scale = "0.2.3"
-sphinx-packet = "=0.3.2"
+sphinx-packet = "0.3.1"
 sqlx = "0.7.4"
 strum = "0.26"
 strum_macros = "0.26"
@@ -330,11 +329,11 @@ subtle-encoding = "0.5"
 syn = "1"
 sysinfo = "0.33.0"
 tap = "1.0.1"
-tar = "0.4.44"
-tempfile = "3.18"
+tar = "0.4.43"
+tempfile = "3.15"
 thiserror = "2.0"
-time = "0.3.39"
-tokio = "1.44"
+time = "0.3.37"
+tokio = "1.43"
 tokio-postgres = "0.7"
 tokio-stream = "0.1.17"
 tokio-test = "0.4.4"
@@ -372,7 +371,7 @@ prometheus = { version = "0.13.0" }
 # plus to make our live easier we need serde support from https://github.com/zkcrypto/bls12_381/pull/125
 bls12_381 = { git = "https://github.com/jstuczyn/bls12_381", default-features = false, branch = "temp/experimental-serdect" }
 group = { version = "0.13.0", default-features = false }
-ff = { version = "0.13.1", default-features = false }
+ff = { version = "0.13.0", default-features = false }
 subtle = "2.5.0"

 # cosmwasm-related
@@ -438,13 +437,3 @@ opt-level = 'z'
 [profile.release.package.mix-fetch-wasm]
 # lto = true
 opt-level = 'z'
-
-[workspace.lints.clippy]
-unwrap_used = "deny"
-expect_used = "deny"
-todo = "deny"
-dbg_macro = "deny"
-exit = "deny"
-panic = "deny"
-unimplemented = "deny"
-unreachable = "deny"
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.50"
+version = "1.1.49"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.50"
+version = "1.1.49"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
@@ -1,3 +1,2 @@
 allow-unwrap-in-tests = true
 allow-expect-in-tests = true
-allow-panic-in-tests = true
@@ -6,15 +6,14 @@ pub mod v1;
 pub mod v2;
 pub mod v3;
 pub mod v4;
-pub mod v5;

 mod error;
 mod util;

 pub use error::Error;
-pub use v5 as latest;
+pub use v4 as latest;

-pub const CURRENT_VERSION: u8 = 5;
+pub const CURRENT_VERSION: u8 = 4;

 fn make_bincode_serializer() -> impl bincode::Options {
    use bincode::Options;
@@ -8,8 +8,8 @@ use nym_sphinx::addressing::clients::Recipient;
 use nym_wireguard_types::PeerPublicKey;

 use crate::{
-    v1, v2, v3, v4,
-    v5::{self, registration::IpPair},
+    v1, v2, v3,
+    v4::{self, registration::IpPair},
    Error,
 };

@@ -19,7 +19,6 @@ pub enum AuthenticatorVersion {
    V2,
    V3,
    V4,
-    V5,
    UNKNOWN,
 }

@@ -35,8 +34,6 @@ impl From<Protocol> for AuthenticatorVersion {
            AuthenticatorVersion::V3
        } else if value.version == v4::VERSION {
            AuthenticatorVersion::V4
-        } else if value.version == v5::VERSION {
-            AuthenticatorVersion::V5
        } else {
            AuthenticatorVersion::UNKNOWN
        }
@@ -71,12 +68,6 @@ impl InitMessage for v4::registration::InitMessage {
    }
 }

-impl InitMessage for v5::registration::InitMessage {
-    fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-}
-
 pub trait FinalMessage {
    fn pub_key(&self) -> PeerPublicKey;
    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error>;
@@ -147,24 +138,6 @@ impl FinalMessage for v4::registration::FinalMessage {
        self.gateway_client.verify(private_key, nonce)
    }

-    fn private_ips(&self) -> IpPair {
-        self.gateway_client.private_ips.into()
-    }
-
-    fn credential(&self) -> Option<CredentialSpendingData> {
-        self.credential.clone()
-    }
-}
-
-impl FinalMessage for v5::registration::FinalMessage {
-    fn pub_key(&self) -> PeerPublicKey {
-        self.gateway_client.pub_key
-    }
-
-    fn verify(&self, private_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
-        self.gateway_client.verify(private_key, nonce)
-    }
-
    fn private_ips(&self) -> IpPair {
        self.gateway_client.private_ips
    }
@@ -209,39 +182,29 @@ impl TopUpMessage for v4::topup::TopUpMessage {
    }
 }

-impl TopUpMessage for v5::topup::TopUpMessage {
-    fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-
-    fn credential(&self) -> CredentialSpendingData {
-        self.credential.clone()
-    }
-}
-
 pub enum AuthenticatorRequest {
    Initial {
        msg: Box<dyn InitMessage + Send + Sync + 'static>,
        protocol: Protocol,
-        reply_to: Option<Recipient>,
+        reply_to: Recipient,
        request_id: u64,
    },
    Final {
        msg: Box<dyn FinalMessage + Send + Sync + 'static>,
        protocol: Protocol,
-        reply_to: Option<Recipient>,
+        reply_to: Recipient,
        request_id: u64,
    },
    QueryBandwidth {
        msg: Box<dyn QueryBandwidthMessage + Send + Sync + 'static>,
        protocol: Protocol,
-        reply_to: Option<Recipient>,
+        reply_to: Recipient,
        request_id: u64,
    },
    TopUpBandwidth {
        msg: Box<dyn TopUpMessage + Send + Sync + 'static>,
        protocol: Protocol,
-        reply_to: Option<Recipient>,
+        reply_to: Recipient,
        request_id: u64,
    },
 }
@@ -255,7 +218,7 @@ impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
                    version: value.version,
                    service_provider_type: ServiceProviderType::Authenticator,
                },
-                reply_to: Some(value.reply_to),
+                reply_to: value.reply_to,
                request_id: value.request_id,
            },
            v1::request::AuthenticatorRequestData::Final(gateway_client) => Self::Final {
@@ -264,7 +227,7 @@ impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
                    version: value.version,
                    service_provider_type: ServiceProviderType::Authenticator,
                },
-                reply_to: Some(value.reply_to),
+                reply_to: value.reply_to,
                request_id: value.request_id,
            },
            v1::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
@@ -274,7 +237,7 @@ impl From<v1::request::AuthenticatorRequest> for AuthenticatorRequest {
                        version: value.version,
                        service_provider_type: ServiceProviderType::Authenticator,
                    },
-                    reply_to: Some(value.reply_to),
+                    reply_to: value.reply_to,
                    request_id: value.request_id,
                }
            }
@@ -288,20 +251,20 @@ impl From<v2::request::AuthenticatorRequest> for AuthenticatorRequest {
            v2::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
                msg: Box::new(init_message),
                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
+                reply_to: value.reply_to,
                request_id: value.request_id,
            },
            v2::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
                msg: final_message,
                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
+                reply_to: value.reply_to,
                request_id: value.request_id,
            },
            v2::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
                Self::QueryBandwidth {
                    msg: Box::new(peer_public_key),
                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
+                    reply_to: value.reply_to,
                    request_id: value.request_id,
                }
            }
@@ -315,20 +278,20 @@ impl From<v3::request::AuthenticatorRequest> for AuthenticatorRequest {
            v3::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
                msg: Box::new(init_message),
                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
+                reply_to: value.reply_to,
                request_id: value.request_id,
            },
            v3::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
                msg: final_message,
                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
+                reply_to: value.reply_to,
                request_id: value.request_id,
            },
            v3::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
                Self::QueryBandwidth {
                    msg: Box::new(peer_public_key),
                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
+                    reply_to: value.reply_to,
                    request_id: value.request_id,
                }
            }
@@ -336,7 +299,7 @@ impl From<v3::request::AuthenticatorRequest> for AuthenticatorRequest {
                Self::TopUpBandwidth {
                    msg: top_up_message,
                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
+                    reply_to: value.reply_to,
                    request_id: value.request_id,
                }
            }
@@ -350,20 +313,20 @@ impl From<v4::request::AuthenticatorRequest> for AuthenticatorRequest {
            v4::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
                msg: Box::new(init_message),
                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
+                reply_to: value.reply_to,
                request_id: value.request_id,
            },
            v4::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
                msg: final_message,
                protocol: value.protocol,
-                reply_to: Some(value.reply_to),
+                reply_to: value.reply_to,
                request_id: value.request_id,
            },
            v4::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
                Self::QueryBandwidth {
                    msg: Box::new(peer_public_key),
                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
+                    reply_to: value.reply_to,
                    request_id: value.request_id,
                }
            }
@@ -371,42 +334,7 @@ impl From<v4::request::AuthenticatorRequest> for AuthenticatorRequest {
                Self::TopUpBandwidth {
                    msg: top_up_message,
                    protocol: value.protocol,
-                    reply_to: Some(value.reply_to),
-                    request_id: value.request_id,
-                }
-            }
-        }
-    }
-}
-
-impl From<v5::request::AuthenticatorRequest> for AuthenticatorRequest {
-    fn from(value: v5::request::AuthenticatorRequest) -> Self {
-        match value.data {
-            v5::request::AuthenticatorRequestData::Initial(init_message) => Self::Initial {
-                msg: Box::new(init_message),
-                protocol: value.protocol,
-                reply_to: None,
-                request_id: value.request_id,
-            },
-            v5::request::AuthenticatorRequestData::Final(final_message) => Self::Final {
-                msg: final_message,
-                protocol: value.protocol,
-                reply_to: None,
-                request_id: value.request_id,
-            },
-            v5::request::AuthenticatorRequestData::QueryBandwidth(peer_public_key) => {
-                Self::QueryBandwidth {
-                    msg: Box::new(peer_public_key),
-                    protocol: value.protocol,
-                    reply_to: None,
-                    request_id: value.request_id,
-                }
-            }
-            v5::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-                Self::TopUpBandwidth {
-                    msg: top_up_message,
-                    protocol: value.protocol,
-                    reply_to: None,
+                    reply_to: value.reply_to,
                    request_id: value.request_id,
                }
            }
@@ -1,478 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
-
-use crate::{v4, v5};
-
-impl From<v4::request::AuthenticatorRequest> for v5::request::AuthenticatorRequest {
-    fn from(authenticator_request: v4::request::AuthenticatorRequest) -> Self {
-        Self {
-            protocol: Protocol {
-                version: 5,
-                service_provider_type: ServiceProviderType::Authenticator,
-            },
-            data: authenticator_request.data.into(),
-            request_id: authenticator_request.request_id,
-        }
-    }
-}
-
-impl From<v4::request::AuthenticatorRequestData> for v5::request::AuthenticatorRequestData {
-    fn from(authenticator_request_data: v4::request::AuthenticatorRequestData) -> Self {
-        match authenticator_request_data {
-            v4::request::AuthenticatorRequestData::Initial(init_msg) => {
-                v5::request::AuthenticatorRequestData::Initial(init_msg.into())
-            }
-            v4::request::AuthenticatorRequestData::Final(final_msg) => {
-                v5::request::AuthenticatorRequestData::Final(Box::new((*final_msg).into()))
-            }
-            v4::request::AuthenticatorRequestData::QueryBandwidth(pub_key) => {
-                v5::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
-            }
-            v4::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message) => {
-                v5::request::AuthenticatorRequestData::TopUpBandwidth(top_up_message.into())
-            }
-        }
-    }
-}
-
-impl From<v4::registration::InitMessage> for v5::registration::InitMessage {
-    fn from(init_msg: v4::registration::InitMessage) -> Self {
-        Self {
-            pub_key: init_msg.pub_key,
-        }
-    }
-}
-
-impl From<v4::registration::FinalMessage> for v5::registration::FinalMessage {
-    fn from(final_msg: v4::registration::FinalMessage) -> Self {
-        Self {
-            gateway_client: final_msg.gateway_client.into(),
-            credential: final_msg.credential,
-        }
-    }
-}
-
-impl From<v4::registration::GatewayClient> for v5::registration::GatewayClient {
-    fn from(gateway_client: v4::registration::GatewayClient) -> Self {
-        Self {
-            pub_key: gateway_client.pub_key,
-            private_ips: gateway_client.private_ips.into(),
-            mac: gateway_client.mac.into(),
-        }
-    }
-}
-
-impl From<v5::registration::GatewayClient> for v4::registration::GatewayClient {
-    fn from(gateway_client: v5::registration::GatewayClient) -> Self {
-        Self {
-            pub_key: gateway_client.pub_key,
-            private_ips: gateway_client.private_ips.into(),
-            mac: gateway_client.mac.into(),
-        }
-    }
-}
-
-impl From<v4::registration::ClientMac> for v5::registration::ClientMac {
-    fn from(client_mac: v4::registration::ClientMac) -> Self {
-        Self::new((*client_mac).clone())
-    }
-}
-
-impl From<v5::registration::ClientMac> for v4::registration::ClientMac {
-    fn from(client_mac: v5::registration::ClientMac) -> Self {
-        Self::new((*client_mac).clone())
-    }
-}
-
-impl From<Box<v4::topup::TopUpMessage>> for Box<v5::topup::TopUpMessage> {
-    fn from(top_up_message: Box<v4::topup::TopUpMessage>) -> Self {
-        Box::new(v5::topup::TopUpMessage {
-            pub_key: top_up_message.pub_key,
-            credential: top_up_message.credential,
-        })
-    }
-}
-
-impl From<v4::response::AuthenticatorResponse> for v5::response::AuthenticatorResponse {
-    fn from(value: v4::response::AuthenticatorResponse) -> Self {
-        Self {
-            protocol: Protocol {
-                version: 5,
-                service_provider_type: value.protocol.service_provider_type,
-            },
-            data: value.data.into(),
-        }
-    }
-}
-
-impl From<v4::response::AuthenticatorResponseData> for v5::response::AuthenticatorResponseData {
-    fn from(authenticator_response_data: v4::response::AuthenticatorResponseData) -> Self {
-        match authenticator_response_data {
-            v4::response::AuthenticatorResponseData::PendingRegistration(pending_response) => {
-                v5::response::AuthenticatorResponseData::PendingRegistration(
-                    pending_response.into(),
-                )
-            }
-            v4::response::AuthenticatorResponseData::Registered(registered_response) => {
-                v5::response::AuthenticatorResponseData::Registered(registered_response.into())
-            }
-            v4::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response,
-            ) => v5::response::AuthenticatorResponseData::RemainingBandwidth(
-                remaining_bandwidth_response.into(),
-            ),
-            v4::response::AuthenticatorResponseData::TopUpBandwidth(top_up_response) => {
-                v5::response::AuthenticatorResponseData::TopUpBandwidth(top_up_response.into())
-            }
-        }
-    }
-}
-
-impl From<v4::response::RegisteredResponse> for v5::response::RegisteredResponse {
-    fn from(value: v4::response::RegisteredResponse) -> Self {
-        Self {
-            request_id: value.request_id,
-            reply: value.reply.into(),
-        }
-    }
-}
-
-impl From<v4::response::PendingRegistrationResponse> for v5::response::PendingRegistrationResponse {
-    fn from(value: v4::response::PendingRegistrationResponse) -> Self {
-        Self {
-            request_id: value.request_id,
-            reply: value.reply.into(),
-        }
-    }
-}
-
-impl From<v4::registration::RegistrationData> for v5::registration::RegistrationData {
-    fn from(value: v4::registration::RegistrationData) -> Self {
-        Self {
-            nonce: value.nonce,
-            gateway_data: value.gateway_data.into(),
-            wg_port: value.wg_port,
-        }
-    }
-}
-
-impl From<v5::registration::RegistrationData> for v4::registration::RegistrationData {
-    fn from(value: v5::registration::RegistrationData) -> Self {
-        Self {
-            nonce: value.nonce,
-            gateway_data: value.gateway_data.into(),
-            wg_port: value.wg_port,
-        }
-    }
-}
-
-impl From<v4::response::RemainingBandwidthResponse> for v5::response::RemainingBandwidthResponse {
-    fn from(value: v4::response::RemainingBandwidthResponse) -> Self {
-        Self {
-            request_id: value.request_id,
-            reply: value.reply.map(Into::into),
-        }
-    }
-}
-
-impl From<v4::response::TopUpBandwidthResponse> for v5::response::TopUpBandwidthResponse {
-    fn from(value: v4::response::TopUpBandwidthResponse) -> Self {
-        Self {
-            request_id: value.request_id,
-            reply: value.reply.into(),
-        }
-    }
-}
-
-impl From<v4::registration::RegistredData> for v5::registration::RegistredData {
-    fn from(value: v4::registration::RegistredData) -> Self {
-        Self {
-            pub_key: value.pub_key,
-            private_ips: value.private_ips.into(),
-            wg_port: value.wg_port,
-        }
-    }
-}
-
-impl From<v4::registration::RemainingBandwidthData> for v5::registration::RemainingBandwidthData {
-    fn from(value: v4::registration::RemainingBandwidthData) -> Self {
-        Self {
-            available_bandwidth: value.available_bandwidth,
-        }
-    }
-}
-
-impl From<v4::registration::IpPair> for v5::registration::IpPair {
-    fn from(value: v4::registration::IpPair) -> Self {
-        Self {
-            ipv4: value.ipv4,
-            ipv6: value.ipv6,
-        }
-    }
-}
-
-impl From<v5::registration::IpPair> for v4::registration::IpPair {
-    fn from(value: v5::registration::IpPair) -> Self {
-        Self {
-            ipv4: value.ipv4,
-            ipv6: value.ipv6,
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::{
-        net::{Ipv4Addr, Ipv6Addr},
-        str::FromStr,
-    };
-
-    use nym_credentials_interface::CredentialSpendingData;
-    use nym_crypto::asymmetric::encryption::PrivateKey;
-    use nym_sphinx::addressing::Recipient;
-    use nym_wireguard_types::PeerPublicKey;
-    use x25519_dalek::PublicKey;
-
-    use super::*;
-    use crate::{
-        util::tests::{CREDENTIAL_BYTES, RECIPIENT},
-        v4,
-    };
-
-    #[test]
-    fn upgrade_initial_req() {
-        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
-        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
-
-        let (msg, _) = v4::request::AuthenticatorRequest::new_initial_request(
-            v4::registration::InitMessage::new(pub_key),
-            reply_to,
-        );
-        let upgraded_msg = v5::request::AuthenticatorRequest::from(msg);
-
-        assert_eq!(
-            upgraded_msg.protocol,
-            Protocol {
-                version: 5,
-                service_provider_type: ServiceProviderType::Authenticator
-            }
-        );
-        assert_eq!(
-            upgraded_msg.data,
-            v5::request::AuthenticatorRequestData::Initial(v5::registration::InitMessage {
-                pub_key
-            })
-        );
-    }
-
-    #[test]
-    fn upgrade_final_req() {
-        let mut rng = rand::thread_rng();
-
-        let local_secret = PrivateKey::new(&mut rng);
-        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
-        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
-        let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
-        let ips = v4::registration::IpPair::new(ipv4, ipv6);
-        let nonce = 42;
-        let gateway_client = v4::registration::GatewayClient::new(
-            &local_secret,
-            (&remote_secret).into(),
-            ips,
-            nonce,
-        );
-        let credential = Some(CredentialSpendingData::try_from_bytes(&CREDENTIAL_BYTES).unwrap());
-        let final_message = v4::registration::FinalMessage {
-            gateway_client: gateway_client.clone(),
-            credential: credential.clone(),
-        };
-        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
-
-        let (msg, _) =
-            v4::request::AuthenticatorRequest::new_final_request(final_message, reply_to);
-        let upgraded_msg = v5::request::AuthenticatorRequest::from(msg);
-
-        assert_eq!(
-            upgraded_msg.protocol,
-            Protocol {
-                version: 5,
-                service_provider_type: ServiceProviderType::Authenticator
-            }
-        );
-        assert_eq!(
-            upgraded_msg.data,
-            v5::request::AuthenticatorRequestData::Final(Box::new(
-                v5::registration::FinalMessage {
-                    gateway_client: v5::registration::GatewayClient::new(
-                        &local_secret,
-                        (&remote_secret).into(),
-                        v5::registration::IpPair::new(ipv4, ipv6),
-                        nonce
-                    ),
-                    credential
-                }
-            ))
-        );
-    }
-
-    #[test]
-    fn upgrade_query_req() {
-        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
-        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
-
-        let (msg, _) = v4::request::AuthenticatorRequest::new_query_request(pub_key, reply_to);
-        let upgraded_msg = v5::request::AuthenticatorRequest::from(msg);
-
-        assert_eq!(
-            upgraded_msg.protocol,
-            Protocol {
-                version: 5,
-                service_provider_type: ServiceProviderType::Authenticator
-            }
-        );
-        assert_eq!(
-            upgraded_msg.data,
-            v5::request::AuthenticatorRequestData::QueryBandwidth(pub_key)
-        );
-    }
-
-    #[test]
-    fn upgrade_pending_reg_resp() {
-        let mut rng = rand::thread_rng();
-
-        let local_secret = PrivateKey::new(&mut rng);
-        let remote_secret = x25519_dalek::StaticSecret::random_from_rng(&mut rng);
-        let ipv4 = Ipv4Addr::from_str("10.10.10.10").unwrap();
-        let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
-        let ips = v4::registration::IpPair::new(ipv4, ipv6);
-        let nonce = 42;
-        let wg_port = 51822;
-        let gateway_data = v4::registration::GatewayClient::new(
-            &local_secret,
-            (&remote_secret).into(),
-            ips,
-            nonce,
-        );
-        let registration_data = v4::registration::RegistrationData {
-            nonce,
-            gateway_data,
-            wg_port,
-        };
-        let request_id = 123;
-        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
-
-        let msg = v4::response::AuthenticatorResponse::new_pending_registration_success(
-            registration_data,
-            request_id,
-            reply_to,
-        );
-        let upgraded_msg = v5::response::AuthenticatorResponse::from(msg);
-
-        assert_eq!(
-            upgraded_msg.protocol,
-            Protocol {
-                version: 5,
-                service_provider_type: ServiceProviderType::Authenticator
-            }
-        );
-
-        assert_eq!(
-            upgraded_msg.data,
-            v5::response::AuthenticatorResponseData::PendingRegistration(
-                v5::response::PendingRegistrationResponse {
-                    request_id,
-                    reply: v5::registration::RegistrationData {
-                        nonce,
-                        gateway_data: v5::registration::GatewayClient::new(
-                            &local_secret,
-                            (&remote_secret).into(),
-                            v5::registration::IpPair::new(ipv4, ipv6),
-                            nonce
-                        ),
-                        wg_port
-                    }
-                }
-            )
-        );
-    }
-
-    #[test]
-    fn upgrade_registered_resp() {
-        let pub_key = PeerPublicKey::new(PublicKey::from([0; 32]));
-        let ipv4 = Ipv4Addr::from_str("10.1.10.10").unwrap();
-        let ipv6 = Ipv6Addr::from_str("fc01::a0a").unwrap();
-        let private_ips = v4::registration::IpPair::new(ipv4, ipv6);
-        let wg_port = 51822;
-        let registred_data = v4::registration::RegistredData {
-            pub_key,
-            private_ips,
-            wg_port,
-        };
-        let request_id = 123;
-        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
-
-        let msg = v4::response::AuthenticatorResponse::new_registered(
-            registred_data,
-            reply_to,
-            request_id,
-        );
-        let upgraded_msg = v5::response::AuthenticatorResponse::from(msg);
-
-        assert_eq!(
-            upgraded_msg.protocol,
-            Protocol {
-                version: 5,
-                service_provider_type: ServiceProviderType::Authenticator
-            }
-        );
-        assert_eq!(
-            upgraded_msg.data,
-            v5::response::AuthenticatorResponseData::Registered(v5::response::RegisteredResponse {
-                request_id,
-                reply: v5::registration::RegistredData {
-                    wg_port,
-                    pub_key,
-                    private_ips: v5::registration::IpPair::new(ipv4, ipv6)
-                }
-            })
-        );
-    }
-
-    #[test]
-    fn upgrade_remaining_bandwidth_resp() {
-        let available_bandwidth = 42;
-        let remaining_bandwidth_data = Some(v4::registration::RemainingBandwidthData {
-            available_bandwidth,
-        });
-        let request_id = 123;
-        let reply_to = Recipient::try_from_base58_string(RECIPIENT).unwrap();
-
-        let msg = v4::response::AuthenticatorResponse::new_remaining_bandwidth(
-            remaining_bandwidth_data,
-            reply_to,
-            request_id,
-        );
-        let upgraded_msg = v5::response::AuthenticatorResponse::from(msg);
-
-        assert_eq!(
-            upgraded_msg.protocol,
-            Protocol {
-                version: 5,
-                service_provider_type: ServiceProviderType::Authenticator
-            }
-        );
-        assert_eq!(
-            upgraded_msg.data,
-            v5::response::AuthenticatorResponseData::RemainingBandwidth(
-                v5::response::RemainingBandwidthResponse {
-                    request_id,
-                    reply: Some(v5::registration::RemainingBandwidthData {
-                        available_bandwidth,
-                    })
-                }
-            )
-        );
-    }
-}
@@ -1,10 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-pub mod conversion;
-pub mod registration;
-pub mod request;
-pub mod response;
-pub mod topup;
-
-pub const VERSION: u8 = 5;
@@ -1,287 +0,0 @@
-// -2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::error::Error;
-use base64::{engine::general_purpose, Engine};
-use nym_credentials_interface::CredentialSpendingData;
-use nym_network_defaults::constants::{WG_TUN_DEVICE_IP_ADDRESS_V4, WG_TUN_DEVICE_IP_ADDRESS_V6};
-use nym_wireguard_types::PeerPublicKey;
-use serde::{Deserialize, Serialize};
-use std::collections::HashMap;
-use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
-use std::time::SystemTime;
-use std::{fmt, ops::Deref, str::FromStr};
-
-#[cfg(feature = "verify")]
-use hmac::{Hmac, Mac};
-#[cfg(feature = "verify")]
-use nym_crypto::asymmetric::encryption::PrivateKey;
-#[cfg(feature = "verify")]
-use sha2::Sha256;
-
-pub type PendingRegistrations = HashMap<PeerPublicKey, RegistrationData>;
-pub type PrivateIPs = HashMap<IpPair, Taken>;
-
-#[cfg(feature = "verify")]
-pub type HmacSha256 = Hmac<Sha256>;
-
-pub type Nonce = u64;
-pub type Taken = Option<SystemTime>;
-
-pub const BANDWIDTH_CAP_PER_DAY: u64 = 250 * 1024 * 1024 * 1024; // 250 GB
-
-#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
-pub struct IpPair {
-    pub ipv4: Ipv4Addr,
-    pub ipv6: Ipv6Addr,
-}
-
-impl IpPair {
-    pub fn new(ipv4: Ipv4Addr, ipv6: Ipv6Addr) -> Self {
-        IpPair { ipv4, ipv6 }
-    }
-}
-
-impl From<(Ipv4Addr, Ipv6Addr)> for IpPair {
-    fn from((ipv4, ipv6): (Ipv4Addr, Ipv6Addr)) -> Self {
-        IpPair { ipv4, ipv6 }
-    }
-}
-
-impl fmt::Display for IpPair {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "({}, {})", self.ipv4, self.ipv6)
-    }
-}
-
-impl From<IpAddr> for IpPair {
-    fn from(value: IpAddr) -> Self {
-        let (before_last_byte, last_byte) = match value {
-            std::net::IpAddr::V4(ipv4_addr) => (ipv4_addr.octets()[2], ipv4_addr.octets()[3]),
-            std::net::IpAddr::V6(ipv6_addr) => (ipv6_addr.octets()[14], ipv6_addr.octets()[15]),
-        };
-        let last_bytes = ((before_last_byte as u16) << 8) | last_byte as u16;
-        let ipv4 = Ipv4Addr::new(
-            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[0],
-            WG_TUN_DEVICE_IP_ADDRESS_V4.octets()[1],
-            before_last_byte,
-            last_byte,
-        );
-        let ipv6 = Ipv6Addr::new(
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[0],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[1],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[2],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[3],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[4],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[5],
-            WG_TUN_DEVICE_IP_ADDRESS_V6.segments()[6],
-            last_bytes,
-        );
-        IpPair::new(ipv4, ipv6)
-    }
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct InitMessage {
-    /// Base64 encoded x25519 public key
-    pub pub_key: PeerPublicKey,
-}
-
-impl InitMessage {
-    pub fn new(pub_key: PeerPublicKey) -> Self {
-        InitMessage { pub_key }
-    }
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct FinalMessage {
-    /// Gateway client data
-    pub gateway_client: GatewayClient,
-
-    /// Ecash credential
-    pub credential: Option<CredentialSpendingData>,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegistrationData {
-    pub nonce: u64,
-    pub gateway_data: GatewayClient,
-    pub wg_port: u16,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RegistredData {
-    pub pub_key: PeerPublicKey,
-    pub private_ips: IpPair,
-    pub wg_port: u16,
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct RemainingBandwidthData {
-    pub available_bandwidth: i64,
-}
-
-/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
-/// Gateway/Nym node can then verify pub_key payload using the same process
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct GatewayClient {
-    /// Base64 encoded x25519 public key
-    pub pub_key: PeerPublicKey,
-
-    /// Assigned private IPs (v4 and v6)
-    pub private_ips: IpPair,
-
-    /// Sha256 hmac on the data (alongside the prior nonce)
-    pub mac: ClientMac,
-}
-
-impl GatewayClient {
-    #[cfg(feature = "verify")]
-    pub fn new(
-        local_secret: &PrivateKey,
-        remote_public: x25519_dalek::PublicKey,
-        private_ips: IpPair,
-        nonce: u64,
-    ) -> Self {
-        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
-        #[allow(clippy::expect_used)]
-        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
-        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
-
-        let dh = static_secret.diffie_hellman(&remote_public);
-
-        // TODO: change that to use our nym_crypto::hmac module instead
-        #[allow(clippy::expect_used)]
-        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
-            .expect("x25519 shared secret is always 32 bytes long");
-
-        mac.update(local_public.as_bytes());
-        mac.update(private_ips.to_string().as_bytes());
-        mac.update(&nonce.to_le_bytes());
-
-        GatewayClient {
-            pub_key: PeerPublicKey::new(local_public),
-            private_ips,
-            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
-        }
-    }
-
-    // Reusable secret should be gateways Wireguard PK
-    // Client should perform this step when generating its payload, using its own WG PK
-    #[cfg(feature = "verify")]
-    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
-        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
-        #[allow(clippy::expect_used)]
-        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
-
-        let dh = static_secret.diffie_hellman(&self.pub_key);
-
-        // TODO: change that to use our nym_crypto::hmac module instead
-        #[allow(clippy::expect_used)]
-        let mut mac = HmacSha256::new_from_slice(dh.as_bytes())
-            .expect("x25519 shared secret is always 32 bytes long");
-
-        mac.update(self.pub_key.as_bytes());
-        mac.update(self.private_ips.to_string().as_bytes());
-        mac.update(&nonce.to_le_bytes());
-
-        mac.verify_slice(&self.mac)
-            .map_err(|source| Error::FailedClientMacVerification {
-                client: self.pub_key.to_string(),
-                source,
-            })
-    }
-
-    pub fn pub_key(&self) -> PeerPublicKey {
-        self.pub_key
-    }
-}
-
-// TODO: change the inner type into generic array of size HmacSha256::OutputSize
-// TODO2: rely on our internal crypto/hmac
-#[derive(Debug, Clone, PartialEq)]
-pub struct ClientMac(Vec<u8>);
-
-impl fmt::Display for ClientMac {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(f, "{}", general_purpose::STANDARD.encode(&self.0))
-    }
-}
-
-impl ClientMac {
-    #[allow(dead_code)]
-    pub fn new(mac: Vec<u8>) -> Self {
-        ClientMac(mac)
-    }
-}
-
-impl Deref for ClientMac {
-    type Target = Vec<u8>;
-
-    fn deref(&self) -> &Self::Target {
-        &self.0
-    }
-}
-
-impl FromStr for ClientMac {
-    type Err = Error;
-
-    fn from_str(s: &str) -> Result<Self, Self::Err> {
-        let mac_bytes: Vec<u8> =
-            general_purpose::STANDARD
-                .decode(s)
-                .map_err(|source| Error::MalformedClientMac {
-                    mac: s.to_string(),
-                    source,
-                })?;
-
-        Ok(ClientMac(mac_bytes))
-    }
-}
-
-impl Serialize for ClientMac {
-    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
-        let encoded_key = general_purpose::STANDARD.encode(self.0.clone());
-        serializer.serialize_str(&encoded_key)
-    }
-}
-
-impl<'de> Deserialize<'de> for ClientMac {
-    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
-        let encoded_key = String::deserialize(deserializer)?;
-        ClientMac::from_str(&encoded_key).map_err(serde::de::Error::custom)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use nym_crypto::asymmetric::encryption;
-
-    #[test]
-    fn create_ip_pair() {
-        let ipv4: IpAddr = Ipv4Addr::from_str("10.1.10.50").unwrap().into();
-        let ipv6: IpAddr = Ipv6Addr::from_str("fc01::0a32").unwrap().into();
-
-        assert_eq!(IpPair::from(ipv4), IpPair::from(ipv6));
-    }
-
-    #[test]
-    #[cfg(feature = "verify")]
-    fn client_request_roundtrip() {
-        let mut rng = rand::thread_rng();
-
-        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
-        let client_key_pair = encryption::KeyPair::new(&mut rng);
-
-        let nonce = 1234567890;
-
-        let client = GatewayClient::new(
-            client_key_pair.private_key(),
-            x25519_dalek::PublicKey::from(gateway_key_pair.public_key().to_bytes()),
-            IpPair::new("10.0.0.42".parse().unwrap(), "fc00::42".parse().unwrap()),
-            nonce,
-        );
-        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
-    }
-}
@@ -1,132 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use super::{
-    registration::{FinalMessage, InitMessage},
-    topup::TopUpMessage,
-};
-use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
-use nym_wireguard_types::PeerPublicKey;
-use serde::{Deserialize, Serialize};
-
-use crate::make_bincode_serializer;
-
-use super::VERSION;
-
-fn generate_random() -> u64 {
-    use rand::RngCore;
-    let mut rng = rand::rngs::OsRng;
-    rng.next_u64()
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct AuthenticatorRequest {
-    pub protocol: Protocol,
-    pub data: AuthenticatorRequestData,
-    pub request_id: u64,
-}
-
-impl AuthenticatorRequest {
-    pub fn from_reconstructed_message(
-        message: &nym_sphinx::receiver::ReconstructedMessage,
-    ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
-    }
-
-    pub fn new_initial_request(init_message: InitMessage) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: Protocol {
-                    service_provider_type: ServiceProviderType::Authenticator,
-                    version: VERSION,
-                },
-                data: AuthenticatorRequestData::Initial(init_message),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_final_request(final_message: FinalMessage) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: Protocol {
-                    service_provider_type: ServiceProviderType::Authenticator,
-                    version: VERSION,
-                },
-                data: AuthenticatorRequestData::Final(Box::new(final_message)),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_query_request(peer_public_key: PeerPublicKey) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: Protocol {
-                    service_provider_type: ServiceProviderType::Authenticator,
-                    version: VERSION,
-                },
-                data: AuthenticatorRequestData::QueryBandwidth(peer_public_key),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_topup_request(top_up_message: TopUpMessage) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                protocol: Protocol {
-                    service_provider_type: ServiceProviderType::Authenticator,
-                    version: VERSION,
-                },
-                data: AuthenticatorRequestData::TopUpBandwidth(Box::new(top_up_message)),
-                request_id,
-            },
-            request_id,
-        )
-    }
-
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().serialize(self)
-    }
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub enum AuthenticatorRequestData {
-    Initial(InitMessage),
-    Final(Box<FinalMessage>),
-    QueryBandwidth(PeerPublicKey),
-    TopUpBandwidth(Box<TopUpMessage>),
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::str::FromStr;
-
-    #[test]
-    fn check_first_bytes_protocol() {
-        let version = 5;
-        let data = AuthenticatorRequest {
-            protocol: Protocol {
-                version,
-                service_provider_type: ServiceProviderType::Authenticator,
-            },
-            data: AuthenticatorRequestData::Initial(InitMessage::new(
-                PeerPublicKey::from_str("yvNUDpT5l7W/xDhiu6HkqTHDQwbs/B3J5UrLmORl1EQ=").unwrap(),
-            )),
-            request_id: 1,
-        };
-        let bytes = *data.to_bytes().unwrap().first_chunk::<2>().unwrap();
-        assert_eq!(bytes, [version, ServiceProviderType::Authenticator as u8]);
-    }
-}
@@ -1,132 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use super::registration::{RegistrationData, RegistredData, RemainingBandwidthData};
-use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
-use serde::{Deserialize, Serialize};
-
-use crate::make_bincode_serializer;
-
-use super::VERSION;
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct AuthenticatorResponse {
-    pub protocol: Protocol,
-    pub data: AuthenticatorResponseData,
-}
-
-impl AuthenticatorResponse {
-    pub fn new_pending_registration_success(
-        registration_data: RegistrationData,
-        request_id: u64,
-    ) -> Self {
-        Self {
-            protocol: Protocol {
-                service_provider_type: ServiceProviderType::Authenticator,
-                version: VERSION,
-            },
-            data: AuthenticatorResponseData::PendingRegistration(PendingRegistrationResponse {
-                reply: registration_data,
-                request_id,
-            }),
-        }
-    }
-
-    pub fn new_registered(registred_data: RegistredData, request_id: u64) -> Self {
-        Self {
-            protocol: Protocol {
-                service_provider_type: ServiceProviderType::Authenticator,
-                version: VERSION,
-            },
-            data: AuthenticatorResponseData::Registered(RegisteredResponse {
-                reply: registred_data,
-                request_id,
-            }),
-        }
-    }
-
-    pub fn new_remaining_bandwidth(
-        remaining_bandwidth_data: Option<RemainingBandwidthData>,
-        request_id: u64,
-    ) -> Self {
-        Self {
-            protocol: Protocol {
-                service_provider_type: ServiceProviderType::Authenticator,
-                version: VERSION,
-            },
-            data: AuthenticatorResponseData::RemainingBandwidth(RemainingBandwidthResponse {
-                reply: remaining_bandwidth_data,
-                request_id,
-            }),
-        }
-    }
-
-    pub fn new_topup_bandwidth(
-        remaining_bandwidth_data: RemainingBandwidthData,
-        request_id: u64,
-    ) -> Self {
-        Self {
-            protocol: Protocol {
-                service_provider_type: ServiceProviderType::Authenticator,
-                version: VERSION,
-            },
-            data: AuthenticatorResponseData::TopUpBandwidth(TopUpBandwidthResponse {
-                reply: remaining_bandwidth_data,
-                request_id,
-            }),
-        }
-    }
-
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().serialize(self)
-    }
-
-    pub fn from_reconstructed_message(
-        message: &nym_sphinx::receiver::ReconstructedMessage,
-    ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
-    }
-
-    pub fn id(&self) -> Option<u64> {
-        match &self.data {
-            AuthenticatorResponseData::PendingRegistration(response) => Some(response.request_id),
-            AuthenticatorResponseData::Registered(response) => Some(response.request_id),
-            AuthenticatorResponseData::RemainingBandwidth(response) => Some(response.request_id),
-            AuthenticatorResponseData::TopUpBandwidth(response) => Some(response.request_id),
-        }
-    }
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub enum AuthenticatorResponseData {
-    PendingRegistration(PendingRegistrationResponse),
-    Registered(RegisteredResponse),
-    RemainingBandwidth(RemainingBandwidthResponse),
-    TopUpBandwidth(TopUpBandwidthResponse),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct PendingRegistrationResponse {
-    pub request_id: u64,
-    pub reply: RegistrationData,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct RegisteredResponse {
-    pub request_id: u64,
-    pub reply: RegistredData,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct RemainingBandwidthResponse {
-    pub request_id: u64,
-    pub reply: Option<RemainingBandwidthData>,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct TopUpBandwidthResponse {
-    pub request_id: u64,
-    pub reply: RemainingBandwidthData,
-}
@@ -1,15 +0,0 @@
-// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_credentials_interface::CredentialSpendingData;
-use nym_wireguard_types::PeerPublicKey;
-use serde::{Deserialize, Serialize};
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq)]
-pub struct TopUpMessage {
-    /// Base64 encoded x25519 public key
-    pub pub_key: PeerPublicKey,
-
-    /// Ecash credential
-    pub credential: CredentialSpendingData,
-}
@@ -45,12 +45,11 @@ const DEFAULT_COVER_TRAFFIC_PRIMARY_SIZE_RATIO: f64 = 0.70;
 // clients/client-core/src/client/replies/reply_storage/surb_storage.rs
 const DEFAULT_MINIMUM_REPLY_SURB_STORAGE_THRESHOLD: usize = 10;
 const DEFAULT_MAXIMUM_REPLY_SURB_STORAGE_THRESHOLD: usize = 200;
-const DEFAULT_MINIMUM_REPLY_SURB_THRESHOLD_BUFFER: usize = 0;

 // define how much to request at once
 // clients/client-core/src/client/replies/reply_controller.rs
 const DEFAULT_MINIMUM_REPLY_SURB_REQUEST_SIZE: u32 = 10;
-const DEFAULT_MAXIMUM_REPLY_SURB_REQUEST_SIZE: u32 = 50;
+const DEFAULT_MAXIMUM_REPLY_SURB_REQUEST_SIZE: u32 = 100;

 const DEFAULT_MAXIMUM_ALLOWED_SURB_REQUEST_SIZE: u32 = 500;

@@ -622,10 +621,6 @@ pub struct ReplySurbs {
    /// Defines the maximum number of reply surbs the client wants to keep in its storage at any times.
    pub maximum_reply_surb_storage_threshold: usize,

-    /// Defines the soft threshold ontop of the minimum reply surb storage threshold for when the client
-    /// should proactively request additional reply surbs.
-    pub minimum_reply_surb_threshold_buffer: usize,
-
    /// Defines the minimum number of reply surbs the client would request.
    pub minimum_reply_surb_request_size: u32,

@@ -658,9 +653,6 @@ pub struct ReplySurbs {
    /// Specifies the number of mixnet hops the packet should go through. If not specified, then
    /// the default value is used.
    pub surb_mix_hops: Option<u8>,
-
-    /// Specifies if we should reset all the sender tags on startup
-    pub fresh_sender_tags: bool,
 }

 impl Default for ReplySurbs {
@@ -668,7 +660,6 @@ impl Default for ReplySurbs {
        ReplySurbs {
            minimum_reply_surb_storage_threshold: DEFAULT_MINIMUM_REPLY_SURB_STORAGE_THRESHOLD,
            maximum_reply_surb_storage_threshold: DEFAULT_MAXIMUM_REPLY_SURB_STORAGE_THRESHOLD,
-            minimum_reply_surb_threshold_buffer: DEFAULT_MINIMUM_REPLY_SURB_THRESHOLD_BUFFER,
            minimum_reply_surb_request_size: DEFAULT_MINIMUM_REPLY_SURB_REQUEST_SIZE,
            maximum_reply_surb_request_size: DEFAULT_MAXIMUM_REPLY_SURB_REQUEST_SIZE,
            maximum_allowed_reply_surb_request_size: DEFAULT_MAXIMUM_ALLOWED_SURB_REQUEST_SIZE,
@@ -678,7 +669,6 @@ impl Default for ReplySurbs {
            maximum_reply_surb_age: DEFAULT_MAXIMUM_REPLY_SURB_AGE,
            maximum_reply_key_age: DEFAULT_MAXIMUM_REPLY_KEY_AGE,
            surb_mix_hops: None,
-            fresh_sender_tags: false,
        }
    }
 }
@@ -181,7 +181,6 @@ impl From<ConfigV5> for Config {
                    maximum_reply_surb_age: value.debug.reply_surbs.maximum_reply_surb_age,
                    maximum_reply_key_age: value.debug.reply_surbs.maximum_reply_key_age,
                    surb_mix_hops: value.debug.reply_surbs.surb_mix_hops,
-                    ..Default::default()
                },
                ..Default::default()
            },
@@ -88,7 +88,7 @@ pub async fn setup_fs_reply_surb_backend<P: AsRef<Path>>(
    let db_path = db_path.as_ref();
    if db_path.exists() {
        info!("loading existing surb database");
-        match fs_backend::Backend::try_load(db_path, surb_config.fresh_sender_tags).await {
+        match fs_backend::Backend::try_load(db_path).await {
            Ok(backend) => Ok(backend),
            Err(err) => {
                error!("failed to setup persistent storage backend for our reply needs: {err}. We're going to create a fresh database instead. This behaviour might change in the future");
@@ -33,12 +33,10 @@ pub enum PreparationError {
    #[error(transparent)]
    NymTopologyError(#[from] NymTopologyError),

-    #[error("message too long for a single SURB, splitting into {fragments} fragments.")]
+    #[error("The received message cannot be sent using a single reply surb. It ended up getting split into {fragments} fragments.")]
    MessageTooLongForSingleSurb { fragments: usize },

-    #[error(
-        "not enough reply SURBs to send the message, available: {available} required: {required}."
-    )]
+    #[error("Not enough reply SURBs to send the message. We have {available} available and require at least {required}.")]
    NotEnoughSurbs { available: usize, required: usize },
 }

@@ -517,25 +517,17 @@ where
        use crate::error::ClientCoreStatusMessage;

        let packets = self.transmission_buffer.total_size();
-        let lanes = self.transmission_buffer.lanes();
+        let backlog = self.transmission_buffer.total_size_in_bytes() as f64 / 1024.0;
+        let lanes = self.transmission_buffer.num_lanes();
        let mult = self.sending_delay_controller.current_multiplier();
        let delay = self.current_average_message_sending_delay().as_millis();
-
-        let lane_status = lanes
-            .iter()
-            .map(|lane_name| {
-                let lane_length = self.transmission_buffer.lane_length(lane_name).unwrap_or(0);
-                format!("{lane_name:?}: {lane_length}")
-            })
-            .collect::<Vec<String>>()
-            .join(", ");
-
        let status_str = if self.config.traffic.disable_main_poisson_packet_distribution {
-            format!("Packet backlog: {lane_status}, no delay")
+            format!("Packet backlog: {backlog:.2} kiB ({packets}), {lanes} lanes, no delay")
        } else {
-            format!("Packet backlog: {lane_status}, avg delay: {delay}ms ({mult})")
+            format!(
+                "Packet backlog: {backlog:.2} kiB ({packets}), {lanes} lanes, avg delay: {delay}ms ({mult})"
+            )
        };
-
        if packets > 1000 {
            log::warn!("{status_str}");
        } else if packets > 0 {
@@ -102,7 +102,6 @@ where
        fragments: I,
        lane: TransmissionLane,
    ) {
-        trace!("buffering pending replies for {recipient}");
        self.pending_replies
            .entry(*recipient)
            .or_insert_with(TransmissionBuffer::new)
@@ -114,7 +113,6 @@ where
        recipient: &AnonymousSenderTag,
        fragments: Vec<(TransmissionLane, Fragment)>,
    ) {
-        trace!("re-inserting pending replies for {recipient}");
        // the buffer should ALWAYS exist at this point, if it doesn't, it's a bug...
        self.pending_replies
            .entry(*recipient)
@@ -127,7 +125,6 @@ where
        recipient: &AnonymousSenderTag,
        data: Vec<Arc<PendingAcknowledgement>>,
    ) {
-        trace!("re-inserting pending retransmissions for {recipient}");
        // the underlying entry MUST exist as we've just got data from there
        let map_entry = self
            .pending_retransmissions
@@ -145,7 +142,7 @@ where
    }

    fn should_request_more_surbs(&self, target: &AnonymousSenderTag) -> bool {
-        trace!("checking if we should request more surbs from {target}");
+        trace!("checking if we should request more surbs from {:?}", target);

        let pending_queue_size = self
            .pending_replies
@@ -161,6 +158,11 @@ where

        let total_queue = pending_queue_size + retransmission_queue;

+        // simple as that - there's absolutely nothing to retransmit
+        if total_queue == 0 {
+            return false;
+        }
+
        let available_surbs = self
            .full_reply_storage
            .surbs_storage_ref()
@@ -177,27 +179,11 @@ where
            .full_reply_storage
            .surbs_storage_ref()
            .max_surb_threshold();
-        let min_surbs_threshold_buffer =
-            self.config.reply_surbs.minimum_reply_surb_threshold_buffer;

-        // After clearing the queue, we want to have at least `min_surbs_threshold` surbs available
-        // and reserved for requesting additional surbs, and in addition to that we also want to
-        // have `min_surbs_threshold_buffer` surbs available proactively.
-        let target_surbs_after_clearing_queue = min_surbs_threshold + min_surbs_threshold_buffer;
+        debug!("total queue size: {total_queue} = pending data {pending_queue_size} + pending retransmission {retransmission_queue}, available surbs: {available_surbs} pending surbs: {pending_surbs} threshold range: {min_surbs_threshold}..{max_surbs_threshold}");

-        // Check if we have enough surbs to handle the total queue and maintain minimum thresholds
-        let total_required_surbs = total_queue + target_surbs_after_clearing_queue;
-        let total_available_surbs = pending_surbs + available_surbs;
-
-        debug!("total queue size: {total_queue} = pending data {pending_queue_size} + pending retransmission {retransmission_queue}, available surbs: {available_surbs} pending surbs: {pending_surbs} threshold range: {min_surbs_threshold}..+{min_surbs_threshold_buffer}..{max_surbs_threshold}");
-
-        // We should request more surbs if:
-        // 1. We haven't hit the maximum surb threshold, and
-        // 2. We don't have enough surbs to handle the queue plus minimum thresholds
-        let is_below_max_threshold = total_available_surbs < max_surbs_threshold;
-        let is_below_required_surbs = total_available_surbs < total_required_surbs;
-
-        is_below_max_threshold && is_below_required_surbs
+        (pending_surbs + available_surbs) < max_surbs_threshold
+            && (pending_surbs + available_surbs) < (total_queue + min_surbs_threshold)
    }

    async fn handle_send_reply(
@@ -258,10 +244,6 @@ where
                        &recipient_tag,
                    );
                    warn!("failed to send reply to {recipient_tag}: {err}");
-                    info!(
-                        "buffering {no_fragments} fragments for {recipient_tag}",
-                        no_fragments = to_send.len()
-                    );
                    self.insert_pending_replies(&recipient_tag, to_send, lane);
                }
            }
@@ -269,13 +251,6 @@ where

        // if there's leftover data we didn't send because we didn't have enough (or any) surbs - buffer it
        if !fragments.is_empty() {
-            // Ideally we should have enough surbs above the minimum threshold to handle sending
-            // new replies without having to first request more surbs. That's why I'd like to log
-            // these cases as they might indicate a problem with the surb management.
-            debug!(
-                "buffering {no_fragments} fragments for {recipient_tag}",
-                no_fragments = fragments.len()
-            );
            self.insert_pending_replies(&recipient_tag, fragments, lane);
        }

@@ -290,7 +265,6 @@ where
        target: AnonymousSenderTag,
        amount: u32,
    ) -> Result<(), PreparationError> {
-        debug!("requesting {amount} additional reply surbs for {target}");
        let reply_surb = self
            .full_reply_storage
            .surbs_storage_ref()
@@ -712,7 +686,7 @@ where
    // it should take into consideration the average latency, sending rate and queue size.
    // it should request as many surbs as it takes to saturate its sending rate before next batch arrives
    async fn request_reply_surbs_for_queue_clearing(&mut self, target: AnonymousSenderTag) {
-        trace!("requesting surbs for queue clearing");
+        trace!("requesting surbs for queues clearing");

        let pending_queue_size = self
            .pending_replies
@@ -726,18 +700,17 @@ where
            .map(|pending_queue| pending_queue.len())
            .unwrap_or_default();

-        let min_surbs_buffer = self.config.reply_surbs.minimum_reply_surb_threshold_buffer as u32;
-
        let total_queue = (pending_queue_size + retransmission_queue) as u32;

-        // To proactively request additional surbs, we aim to have a buffer of extra surbs in our
-        // storage.
-        let total_queue_with_buffer = total_queue + min_surbs_buffer;
+        if total_queue == 0 {
+            trace!("the pending queues for {:?} are already empty", target);
+            return;
+        }

        let request_size = min(
            self.config.reply_surbs.maximum_reply_surb_request_size,
            max(
-                total_queue_with_buffer,
+                total_queue,
                self.config.reply_surbs.minimum_reply_surb_request_size,
            ),
        );
@@ -746,7 +719,7 @@ where
            .request_additional_reply_surbs(target, request_size)
            .await
        {
-            info!("{err}")
+            warn!("failed to request additional surbs... - {err}")
        }
    }

@@ -58,8 +58,8 @@ impl<T> TransmissionBuffer<T> {
    }

    #[cfg(not(target_arch = "wasm32"))]
-    pub(crate) fn lanes(&self) -> Vec<TransmissionLane> {
-        self.buffer.keys().cloned().collect()
+    pub(crate) fn num_lanes(&self) -> usize {
+        self.buffer.keys().count()
    }

    pub(crate) fn lane_length(&self, lane: &TransmissionLane) -> Option<usize> {
@@ -83,7 +83,6 @@ impl<T> TransmissionBuffer<T> {
    }

    #[cfg(not(target_arch = "wasm32"))]
-    #[allow(unused)]
    pub(crate) fn total_size_in_bytes(&self) -> usize
    where
        T: SizedData,
@@ -10,7 +10,7 @@ use crate::{
    CombinedReplyStorage, ReceivedReplySurbsMap, ReplyStorageBackend, SentReplyKeys, UsedSenderTags,
 };
 use async_trait::async_trait;
-use log::{debug, error, info, warn};
+use log::{error, info, warn};
 use nym_sphinx::anonymous_replies::requests::AnonymousSenderTag;
 use std::fs;
 use std::path::{Path, PathBuf};
@@ -52,10 +52,7 @@ impl Backend {
        Ok(backend)
    }

-    pub async fn try_load<P: AsRef<Path>>(
-        database_path: P,
-        fresh_sender_tags: bool,
-    ) -> Result<Self, StorageError> {
+    pub async fn try_load<P: AsRef<Path>>(database_path: P) -> Result<Self, StorageError> {
        let owned_path: PathBuf = database_path.as_ref().into();
        if owned_path.file_name().is_none() {
            return Err(StorageError::DatabasePathWithoutFilename {
@@ -121,9 +118,6 @@ impl Backend {
        if days > 2 {
            info!("it's been over {days} days and {hours} hours since we last used our data store. our used sender tags are already outdated - we're going to purge them now.");
            manager.delete_all_tags().await?;
-        } else if fresh_sender_tags {
-            debug!("starting with fresh sender tags");
-            manager.delete_all_tags().await?;
        }

        Ok(Backend {
@@ -20,8 +20,8 @@ use nym_credentials_interface::TicketType;
 use nym_crypto::asymmetric::identity;
 use nym_gateway_requests::registration::handshake::client_handshake;
 use nym_gateway_requests::{
-    BinaryRequest, ClientControlRequest, ClientRequest, GatewayProtocolVersionExt,
-    SensitiveServerResponse, ServerResponse, SharedGatewayKey, SharedSymmetricKey,
+    BinaryRequest, ClientControlRequest, ClientRequest, SensitiveServerResponse, ServerResponse,
+    SharedGatewayKey, SharedSymmetricKey, AES_GCM_SIV_PROTOCOL_VERSION,
    CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION, CURRENT_PROTOCOL_VERSION,
 };
 use nym_sphinx::forwarding::packet::MixPacket;
@@ -204,15 +204,15 @@ impl<C, St> GatewayClient<C, St> {
            "Attemting to establish connection to gateway at: {}",
            self.gateway_address
        );
-        let (ws_stream, _) = connect_async(
-            &self.gateway_address,
-            #[cfg(unix)]
-            self.connection_fd_callback.clone(),
-        )
-        .await?;
+        let (ws_stream, _) = connect_async(&self.gateway_address).await?;

        self.connection = SocketState::Available(Box::new(ws_stream));

+        #[cfg(unix)]
+        if let (Some(callback), Some(fd)) = (self.connection_fd_callback.as_ref(), self.ws_fd()) {
+            callback.as_ref()(fd);
+        }
+
        Ok(())
    }

@@ -563,10 +563,28 @@ impl<C, St> GatewayClient<C, St> {
        Ok(zeroizing_updated_key)
    }

-    async fn send_authenticate_request_and_handle_response(
-        &mut self,
-        msg: ClientControlRequest,
-    ) -> Result<(), GatewayClientError> {
+    async fn authenticate(&mut self) -> Result<(), GatewayClientError> {
+        let Some(shared_key) = self.shared_key.as_ref() else {
+            return Err(GatewayClientError::NoSharedKeyAvailable);
+        };
+
+        if !self.connection.is_established() {
+            return Err(GatewayClientError::ConnectionNotEstablished);
+        }
+        debug!("authenticating with gateway");
+
+        let self_address = self
+            .local_identity
+            .as_ref()
+            .public_key()
+            .derive_destination_address();
+
+        let msg = ClientControlRequest::new_authenticate(
+            self_address,
+            shared_key,
+            self.cfg.bandwidth.require_tickets,
+        )?;
+
        match self.send_websocket_message(msg).await? {
            ServerResponse::Authenticate {
                protocol_version,
@@ -590,51 +608,6 @@ impl<C, St> GatewayClient<C, St> {
        }
    }

-    async fn authenticate_v1(&mut self) -> Result<(), GatewayClientError> {
-        debug!("using v1 authentication");
-
-        let Some(shared_key) = self.shared_key.as_ref() else {
-            return Err(GatewayClientError::NoSharedKeyAvailable);
-        };
-
-        let self_address = self
-            .local_identity
-            .public_key()
-            .derive_destination_address();
-
-        let msg = ClientControlRequest::new_authenticate(
-            self_address,
-            shared_key,
-            self.cfg.bandwidth.require_tickets,
-        )?;
-        self.send_authenticate_request_and_handle_response(msg)
-            .await
-    }
-
-    async fn authenticate_v2(&mut self) -> Result<(), GatewayClientError> {
-        debug!("using v2 authentication");
-        let Some(shared_key) = self.shared_key.as_ref() else {
-            return Err(GatewayClientError::NoSharedKeyAvailable);
-        };
-
-        let msg = ClientControlRequest::new_authenticate_v2(shared_key, &self.local_identity)?;
-        self.send_authenticate_request_and_handle_response(msg)
-            .await
-    }
-
-    async fn authenticate(&mut self, use_v2: bool) -> Result<(), GatewayClientError> {
-        if !self.connection.is_established() {
-            return Err(GatewayClientError::ConnectionNotEstablished);
-        }
-        debug!("authenticating with gateway");
-
-        if use_v2 {
-            self.authenticate_v2().await
-        } else {
-            self.authenticate_v1().await
-        }
-    }
-
    /// Helper method to either call register or authenticate based on self.shared_key value
    #[instrument(skip_all,
        fields(
@@ -650,25 +623,19 @@ impl<C, St> GatewayClient<C, St> {
        }

        // 1. check gateway's protocol version
-        let gw_protocol = match self.get_gateway_protocol().await {
-            Ok(protocol) => Some(protocol),
+        let supports_aes_gcm_siv = match self.get_gateway_protocol().await {
+            Ok(protocol) => protocol >= AES_GCM_SIV_PROTOCOL_VERSION,
            Err(_) => {
                // if we failed to send the request, it means the gateway is running the old binary,
                // so it has reset our connection - we have to reconnect
                self.establish_connection().await?;
-                None
+                false
            }
        };

-        let supports_aes_gcm_siv = gw_protocol.supports_aes256_gcm_siv();
-        let supports_auth_v2 = gw_protocol.supports_authenticate_v2();
-
        if !supports_aes_gcm_siv {
            warn!("this gateway is on an old version that doesn't support AES256-GCM-SIV");
        }
-        if !supports_auth_v2 {
-            warn!("this gateway is on an old version that doesn't support authentication v2")
-        }

        if self.authenticated {
            debug!("Already authenticated");
@@ -683,7 +650,7 @@ impl<C, St> GatewayClient<C, St> {
        }

        if self.shared_key.is_some() {
-            self.authenticate(supports_auth_v2).await?;
+            self.authenticate().await?;

            if self.authenticated {
                // if we are authenticated it means we MUST have an associated shared_key
@@ -1016,8 +983,7 @@ impl<C, St> GatewayClient<C, St> {
        }

        // if we're reconnecting, because we lost connection, we need to re-authenticate the connection
-        self.authenticate(self.negotiated_protocol.supports_authenticate_v2())
-            .await?;
+        self.authenticate().await?;

        // this call is NON-blocking
        self.start_listening_for_mixnet_messages()?;
@@ -1,11 +1,6 @@
 use crate::error::GatewayClientError;

 use nym_http_api_client::HickoryDnsResolver;
-#[cfg(unix)]
-use std::{
-    os::fd::{AsRawFd, RawFd},
-    sync::Arc,
-};
 use tokio::net::TcpStream;
 use tokio_tungstenite::{MaybeTlsStream, WebSocketStream};
 use tungstenite::handshake::client::Response;
@@ -16,10 +11,7 @@ use std::net::SocketAddr;
 #[cfg(not(target_arch = "wasm32"))]
 pub(crate) async fn connect_async(
    endpoint: &str,
-    #[cfg(unix)] connection_fd_callback: Option<Arc<dyn Fn(RawFd) + Send + Sync>>,
 ) -> Result<(WebSocketStream<MaybeTlsStream<TcpStream>>, Response), GatewayClientError> {
-    use tokio::net::TcpSocket;
-
    let resolver = HickoryDnsResolver::default();
    let uri =
        Url::parse(endpoint).map_err(|_| GatewayClientError::InvalidUrl(endpoint.to_owned()))?;
@@ -45,41 +37,14 @@ pub(crate) async fn connect_async(
        }
    };

-    let mut stream = Err(GatewayClientError::NoEndpointForConnection {
-        address: endpoint.to_owned(),
-    });
-    for sock_addr in sock_addrs {
-        let socket = if sock_addr.is_ipv4() {
-            TcpSocket::new_v4()
-        } else {
-            TcpSocket::new_v6()
-        }
-        .map_err(|err| GatewayClientError::NetworkConnectionFailed {
+    let stream = TcpStream::connect(&sock_addrs[..]).await.map_err(|error| {
+        GatewayClientError::NetworkConnectionFailed {
            address: endpoint.to_owned(),
-            source: err.into(),
-        })?;
-
-        #[cfg(unix)]
-        if let Some(callback) = connection_fd_callback.as_ref() {
-            callback.as_ref()(socket.as_raw_fd());
+            source: error.into(),
        }
+    })?;

-        match socket.connect(sock_addr).await {
-            Ok(s) => {
-                stream = Ok(s);
-                break;
-            }
-            Err(err) => {
-                stream = Err(GatewayClientError::NetworkConnectionFailed {
-                    address: endpoint.to_owned(),
-                    source: err.into(),
-                });
-                continue;
-            }
-        }
-    }
-
-    tokio_tungstenite::client_async_tls(endpoint, stream?)
+    tokio_tungstenite::client_async_tls(endpoint, stream)
        .await
        .map_err(|error| GatewayClientError::NetworkConnectionFailed {
            address: endpoint.to_owned(),
@@ -43,9 +43,6 @@ pub enum GatewayClientError {
    #[error("connection failed: {address}: {source}")]
    NetworkConnectionFailed { address: String, source: WsError },

-    #[error("no socket address for endpoint: {address}")]
-    NoEndpointForConnection { address: String },
-
    #[error("Invalid URL: {0}")]
    InvalidUrl(String),

@@ -23,12 +23,11 @@ use nym_api_requests::models::{
    NymNodeDescription, RewardEstimationResponse, StakeSaturationResponse,
 };
 use nym_api_requests::models::{LegacyDescribedGateway, MixNodeBondAnnotated};
-use nym_api_requests::nym_nodes::{NodesByAddressesResponse, SkimmedNode};
+use nym_api_requests::nym_nodes::SkimmedNode;
 use nym_coconut_dkg_common::types::EpochId;
 use nym_ecash_contract_common::deposit::DepositId;
 use nym_http_api_client::UserAgent;
 use nym_network_defaults::NymNetworkDetails;
-use std::net::IpAddr;
 use time::Date;
 use url::Url;

@@ -711,11 +710,4 @@ impl NymApiClient {
            .issued_ticketbooks_challenge(expiration_date, deposits)
            .await?)
    }
-
-    pub async fn nodes_by_addresses(
-        &self,
-        addresses: Vec<IpAddr>,
-    ) -> Result<NodesByAddressesResponse, ValidatorClientError> {
-        Ok(self.nym_api.nodes_by_addresses(addresses).await?)
-    }
 }
@@ -15,9 +15,7 @@ use nym_api_requests::models::{
    AnnotationResponse, ApiHealthResponse, LegacyDescribedMixNode, NodePerformanceResponse,
    NodeRefreshBody, NymNodeDescription, PerformanceHistoryResponse, RewardedSetResponse,
 };
-use nym_api_requests::nym_nodes::{
-    NodesByAddressesRequestBody, NodesByAddressesResponse, PaginatedCachedNodesResponse,
-};
+use nym_api_requests::nym_nodes::PaginatedCachedNodesResponse;
 use nym_api_requests::pagination::PaginatedResponse;
 pub use nym_api_requests::{
    ecash::{
@@ -42,7 +40,6 @@ pub use nym_http_api_client::Client;
 use nym_http_api_client::{ApiClient, NO_PARAMS};
 use nym_mixnet_contract_common::mixnode::MixNodeDetails;
 use nym_mixnet_contract_common::{GatewayBond, IdentityKeyRef, NodeId, NymNodeDetails};
-use std::net::IpAddr;
 use time::format_description::BorrowedFormatItem;
 use time::Date;
 use tracing::instrument;
@@ -1018,23 +1015,6 @@ pub trait NymApiClientExt: ApiClient {
        .await
    }

-    async fn nodes_by_addresses(
-        &self,
-        addresses: Vec<IpAddr>,
-    ) -> Result<NodesByAddressesResponse, NymAPIError> {
-        self.post_json(
-            &[
-                routes::API_VERSION,
-                "unstable",
-                routes::NYM_NODES_ROUTES,
-                routes::nym_nodes::BY_ADDRESSES,
-            ],
-            NO_PARAMS,
-            &NodesByAddressesRequestBody { addresses },
-        )
-        .await
-    }
-
    #[instrument(level = "debug", skip(self))]
    async fn get_network_details(&self) -> Result<NymNetworkDetailsResponse, NymAPIError> {
        self.get_json(
@@ -43,7 +43,6 @@ pub mod nym_nodes {
    pub const NYM_NODES_BONDED: &str = "bonded";
    pub const NYM_NODES_REWARDED_SET: &str = "rewarded-set";
    pub const NYM_NODES_REFRESH_DESCRIBED: &str = "refresh-described";
-    pub const BY_ADDRESSES: &str = "by-addresses";
 }

 pub const STATUS_ROUTES: &str = "status";
@@ -28,6 +28,7 @@ use nym_network_defaults::{ChainDetails, NymNetworkDetails};
 use serde::{de::DeserializeOwned, Serialize};
 use std::fmt::Debug;
 use std::time::SystemTime;
+use tendermint_rpc::endpoint::block::Response as BlockResponse;
 use tendermint_rpc::endpoint::*;
 use tendermint_rpc::{Error as TendermintRpcError, Order};
 use url::Url;
@@ -62,7 +63,6 @@ pub use cw3;
 pub use cw4;
 pub use cw_controllers;
 pub use fee::{gas_price::GasPrice, GasAdjustable, GasAdjustment};
-pub use tendermint_rpc::endpoint::block::Response as BlockResponse;
 pub use tendermint_rpc::{
    endpoint::{tx::Response as TxResponse, validators::Response as ValidatorResponse},
    query::Query,
@@ -25,6 +25,15 @@ pub fn in6addr_any_init() -> IpAddr {
    IpAddr::V6(Ipv6Addr::UNSPECIFIED)
 }

+/// Helper for providing binding warnings if node tries to bind to any of those
+pub const SPECIAL_ADDRESSES: &[IpAddr] = &[
+    IpAddr::V4(Ipv4Addr::LOCALHOST),
+    IpAddr::V4(Ipv4Addr::UNSPECIFIED),
+    IpAddr::V4(Ipv4Addr::BROADCAST),
+    IpAddr::V6(Ipv6Addr::LOCALHOST),
+    IpAddr::V6(Ipv6Addr::UNSPECIFIED),
+];
+
 // TODO: is it really part of 'Config'?
 pub trait OptionalSet {
    /// If the value is available (i.e. `Some`), the provided closure is applied.
@@ -43,7 +43,4 @@ serde = ["dep:serde", "serde_bytes", "ed25519-dalek/serde", "x25519-dalek/serde"
 asymmetric = ["x25519-dalek", "ed25519-dalek", "zeroize"]
 hashing = ["blake3", "digest", "hkdf", "hmac", "generic-array", "sha2"]
 stream_cipher = ["aes", "ctr", "cipher", "generic-array"]
-sphinx = ["nym-sphinx-types/sphinx"]
-
-[lints]
-workspace = true
+sphinx = ["nym-sphinx-types/sphinx"]
@@ -16,11 +16,8 @@ pub fn compute_keyed_hmac<D>(key: &[u8], data: &[u8]) -> HmacOutput<D>
 where
    D: Digest + BlockSizeUser,
 {
-    // SAFETY: hmac is fine with keys of any size; if they're smaller than the block size of the underlying
-    // digest, they're padded with 0. if they're larger they're hashed and padded
-    // the reason for `Result` return type is due to the trait definition
-    #[allow(clippy::unwrap_used)]
-    let mut hmac = SimpleHmac::<D>::new_from_slice(key).unwrap();
+    let mut hmac = SimpleHmac::<D>::new_from_slice(key)
+        .expect("HMAC was instantiated with a key of an invalid size!");
    hmac.update(data);
    hmac.finalize()
 }
@@ -30,11 +27,8 @@ pub fn recompute_keyed_hmac_and_verify_tag<D>(key: &[u8], data: &[u8], tag: &[u8
 where
    D: Digest + BlockSizeUser,
 {
-    // SAFETY: hmac is fine with keys of any size; if they're smaller than the block size of the underlying
-    // digest, they're padded with 0. if they're larger they're hashed and padded
-    // the reason for `Result` return type is due to the trait definition
-    #[allow(clippy::unwrap_used)]
-    let mut hmac = SimpleHmac::<D>::new_from_slice(key).unwrap();
+    let mut hmac = SimpleHmac::<D>::new_from_slice(key)
+        .expect("HMAC was instantiated with a key of an invalid size!");
    hmac.update(data);

    let tag_arr = Output::<D>::from_slice(tag);
@@ -27,16 +27,12 @@ where
    // after performing diffie-hellman we don't care about the private component anymore
    let dh_result = ephemeral_keypair.private_key().diffie_hellman(remote_key);

-    // SAFETY: while this is a relatively weak assumption, it's unlikely that any stream cipher has `C::key_size()`
-    // larger than 255 * chunk_size of the digest (so for example keys larger than 8160 bytes if sh256 is used)
-    #[allow(clippy::expect_used)]
+    // there is no reason for this to fail as our okm is expected to be only C::KeySize bytes
    let okm = hkdf::extract_then_expand::<D>(None, &dh_result, None, C::key_size())
        .expect("somehow too long okm was provided");

-    // SAFETY: the generated okm has exactly `C::key_size()` elements,
-    // so this call is safe
-    #[allow(clippy::unwrap_used)]
-    let derived_shared_key = Key::<C>::from_exact_iter(okm).unwrap();
+    let derived_shared_key =
+        Key::<C>::from_exact_iter(okm).expect("okm was expanded to incorrect length!");

    (ephemeral_keypair, derived_shared_key)
 }
@@ -52,14 +48,9 @@ where
 {
    let dh_result = local_key.diffie_hellman(remote_key);

-    // SAFETY: while this is a relatively weak assumption, it's unlikely that any stream cipher has `C::key_size()`
-    // larger than 255 * chunk_size of the digest (so for example keys larger than 8160 bytes if sh256 is used)
-    #[allow(clippy::expect_used)]
+    // there is no reason for this to fail as our okm is expected to be only C::KeySize bytes
    let okm = hkdf::extract_then_expand::<D>(None, &dh_result, None, C::key_size())
        .expect("somehow too long okm was provided");

-    // SAFETY: the generated okm has exactly `C::key_size()` elements,
-    // so this call is safe
-    #[allow(clippy::unwrap_used)]
-    Key::<C>::from_exact_iter(okm).unwrap()
+    Key::<C>::from_exact_iter(okm).expect("okm was expanded to incorrect length!")
 }
@@ -60,15 +60,20 @@ where
    Iv::<C>::default()
 }

-pub fn try_iv_from_slice<C>(b: &[u8]) -> Option<&IV<C>>
+pub fn iv_from_slice<C>(b: &[u8]) -> &IV<C>
 where
    C: IvSizeUser,
 {
    if b.len() != C::iv_size() {
-        None
-    } else {
-        Some(IV::<C>::from_slice(b))
+        // `from_slice` would have caused a panic about this issue anyway.
+        // Now we at least have slightly more information
+        panic!(
+            "Tried to convert {} bytes to IV. Expected {}",
+            b.len(),
+            C::iv_size()
+        )
    }
+    IV::<C>::from_slice(b)
 }

 // TODO: there's really no way to use more parts of the keystream if it was required at some point.
@@ -20,14 +20,11 @@ serde_json = { workspace = true }
 strum = { workspace = true }
 thiserror = { workspace = true }
 tracing = { workspace = true, features = ["log"] }
-time = { workspace = true }
-subtle = { workspace = true }
 zeroize = { workspace = true }

 nym-crypto = { path = "../crypto", features = ["aead", "hashing"] }
 nym-pemstore = { path = "../pemstore" }
 nym-sphinx = { path = "../nymsphinx" }
-nym-serde-helpers = { path = "../serde-helpers", features = ["base64"] }
 nym-task = { path = "../task" }

 nym-credentials = { path = "../credentials" }
@@ -15,12 +15,6 @@ use thiserror::Error;
 // this is no longer constant size due to the differences in ciphertext between aes128ctr and aes256gcm-siv (inclusion of tag)
 pub struct EncryptedAddressBytes(Vec<u8>);

-impl From<Vec<u8>> for EncryptedAddressBytes {
-    fn from(encrypted_address: Vec<u8>) -> Self {
-        EncryptedAddressBytes(encrypted_address)
-    }
-}
-
 #[derive(Debug, Error)]
 pub enum EncryptedAddressConversionError {
    #[error("Failed to decode the encrypted address - {0}")]
@@ -19,7 +19,7 @@ pub use shared_key::{
    SharedGatewayKey, SharedKeyConversionError, SharedKeyUsageError, SharedSymmetricKey,
 };

-pub const CURRENT_PROTOCOL_VERSION: u8 = AUTHENTICATE_V2_PROTOCOL_VERSION;
+pub const CURRENT_PROTOCOL_VERSION: u8 = AES_GCM_SIV_PROTOCOL_VERSION;

 /// Defines the current version of the communication protocol between gateway and clients.
 /// It has to be incremented for any breaking change.
@@ -27,29 +27,10 @@ pub const CURRENT_PROTOCOL_VERSION: u8 = AUTHENTICATE_V2_PROTOCOL_VERSION;
 // 1 - initial release
 // 2 - changes to client credentials structure
 // 3 - change to AES-GCM-SIV and non-zero IVs
-// 4 - introduction of v2 authentication protocol to prevent reply attacks
 pub const INITIAL_PROTOCOL_VERSION: u8 = 1;
 pub const CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION: u8 = 2;
 pub const AES_GCM_SIV_PROTOCOL_VERSION: u8 = 3;
-pub const AUTHENTICATE_V2_PROTOCOL_VERSION: u8 = 4;

 // TODO: could using `Mac` trait here for OutputSize backfire?
 // Should hmac itself be exposed, imported and used instead?
 pub type LegacyGatewayMacSize = <GatewayIntegrityHmacAlgorithm as OutputSizeUser>::OutputSize;
-
-pub trait GatewayProtocolVersionExt {
-    fn supports_aes256_gcm_siv(&self) -> bool;
-    fn supports_authenticate_v2(&self) -> bool;
-}
-
-impl GatewayProtocolVersionExt for Option<u8> {
-    fn supports_aes256_gcm_siv(&self) -> bool {
-        let Some(protocol) = *self else { return false };
-        protocol >= AES_GCM_SIV_PROTOCOL_VERSION
-    }
-
-    fn supports_authenticate_v2(&self) -> bool {
-        let Some(protocol) = *self else { return false };
-        protocol >= AUTHENTICATE_V2_PROTOCOL_VERSION
-    }
-}
@@ -3,7 +3,6 @@

 use crate::SharedKeyUsageError;
 use nym_credentials_interface::CompactEcashError;
-use nym_crypto::asymmetric::ed25519::SignatureError;
 use nym_sphinx::addressing::nodes::NymNodeRoutingAddressError;
 use nym_sphinx::forwarding::packet::MixPacketFormattingError;
 use nym_sphinx::params::packet_sizes::PacketSize;
@@ -93,34 +92,7 @@ pub enum GatewayRequestsError {
    #[error("the provided [v1] credential has invalid number of parameters - {0}")]
    InvalidNumberOfEmbededParameters(u32),

-    #[error("failed to authenticate the client: {0}")]
-    Authentication(#[from] AuthenticationFailure),
-
    // variant to catch legacy errors
    #[error("{0}")]
    Other(String),
 }
-
-#[derive(Debug, Error)]
-pub enum AuthenticationFailure {
-    #[error(transparent)]
-    KeyUsageFailure(#[from] SharedKeyUsageError),
-
-    #[error("failed to verify provided address ciphertext")]
-    MalformedCiphertext,
-
-    #[error("failed to verify request signature")]
-    InvalidSignature(#[from] SignatureError),
-
-    #[error("provided request timestamp is in the future")]
-    RequestTimestampInFuture,
-
-    #[error("the client is not registered")]
-    NotRegistered,
-
-    #[error("the provided request is too stale to process")]
-    StaleRequest,
-
-    #[error("the provided request timestamp is smaller or equal to a one previously used")]
-    RequestReuse,
-}
@@ -2,21 +2,16 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::models::CredentialSpendingRequest;
-use crate::text_request::authenticate::AuthenticateRequest;
 use crate::{
    GatewayRequestsError, SharedGatewayKey, SymmetricKey, AES_GCM_SIV_PROTOCOL_VERSION,
-    AUTHENTICATE_V2_PROTOCOL_VERSION, CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION,
-    INITIAL_PROTOCOL_VERSION,
+    CREDENTIAL_UPDATE_V2_PROTOCOL_VERSION, INITIAL_PROTOCOL_VERSION,
 };
 use nym_credentials_interface::CredentialSpendingData;
-use nym_crypto::asymmetric::ed25519;
 use nym_sphinx::DestinationAddressBytes;
 use serde::{Deserialize, Serialize};
 use std::str::FromStr;
 use tungstenite::Message;

-pub mod authenticate;
-
 // wrapper for all encrypted requests for ease of use
 #[derive(Serialize, Deserialize, Debug, Clone)]
 #[non_exhaustive]
@@ -73,9 +68,6 @@ pub enum ClientControlRequest {
        enc_address: String,
        iv: String,
    },
-
-    AuthenticateV2(Box<AuthenticateRequest>),
-
    #[serde(alias = "handshakePayload")]
    RegisterHandshakeInitRequest {
        #[serde(default)]
@@ -131,22 +123,9 @@ impl ClientControlRequest {
        })
    }

-    pub fn new_authenticate_v2(
-        shared_key: &SharedGatewayKey,
-        identity_keys: &ed25519::KeyPair,
-    ) -> Result<Self, GatewayRequestsError> {
-        // if we're using v2 authentication, we must announce at least that protocol version
-        let protocol_version = AUTHENTICATE_V2_PROTOCOL_VERSION;
-
-        Ok(ClientControlRequest::AuthenticateV2(Box::new(
-            AuthenticateRequest::new(protocol_version, shared_key, identity_keys)?,
-        )))
-    }
-
    pub fn name(&self) -> String {
        match self {
            ClientControlRequest::Authenticate { .. } => "Authenticate".to_string(),
-            ClientControlRequest::AuthenticateV2(..) => "AuthenticateV2".to_string(),
            ClientControlRequest::RegisterHandshakeInitRequest { .. } => {
                "RegisterHandshakeInitRequest".to_string()
            }
@@ -1,142 +0,0 @@
-// Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: GPL-3.0-only
-
-use crate::{AuthenticationFailure, GatewayRequestsError, SharedGatewayKey};
-use nym_crypto::asymmetric::ed25519;
-use serde::{Deserialize, Serialize};
-use std::iter;
-use std::time::Duration;
-use subtle::ConstantTimeEq;
-use time::OffsetDateTime;
-
-#[derive(Serialize, Deserialize, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct AuthenticateRequest {
-    #[serde(flatten)]
-    pub content: AuthenticateRequestContent,
-
-    pub request_signature: ed25519::Signature,
-}
-
-impl AuthenticateRequest {
-    pub fn new(
-        protocol_version: u8,
-        shared_key: &SharedGatewayKey,
-        identity_keys: &ed25519::KeyPair,
-    ) -> Result<AuthenticateRequest, GatewayRequestsError> {
-        let content = AuthenticateRequestContent::new(
-            protocol_version,
-            shared_key,
-            *identity_keys.public_key(),
-        )?;
-        let plaintext = content.plaintext();
-        let request_signature = identity_keys.private_key().sign(&plaintext);
-
-        Ok(AuthenticateRequest {
-            content,
-            request_signature,
-        })
-    }
-
-    pub fn verify_timestamp(&self, max_request_age: Duration) -> Result<(), AuthenticationFailure> {
-        let now = OffsetDateTime::now_utc();
-        if self.content.request_timestamp() + max_request_age < now {
-            return Err(AuthenticationFailure::StaleRequest);
-        }
-        if self.content.request_timestamp() > now {
-            return Err(AuthenticationFailure::RequestTimestampInFuture);
-        }
-        Ok(())
-    }
-
-    pub fn ensure_timestamp_not_reused(
-        &self,
-        previous: OffsetDateTime,
-    ) -> Result<(), AuthenticationFailure> {
-        if self.content.request_timestamp() <= previous {
-            return Err(AuthenticationFailure::RequestReuse);
-        }
-        Ok(())
-    }
-
-    pub fn verify_ciphertext(
-        &self,
-        shared_key: &SharedGatewayKey,
-    ) -> Result<(), AuthenticationFailure> {
-        let expected = shared_key.encrypt(
-            self.content
-                .client_identity
-                .derive_destination_address()
-                .as_bytes_ref(),
-            Some(&self.content.nonce),
-        )?;
-
-        if !bool::from(expected.ct_eq(&self.content.address_ciphertext)) {
-            return Err(AuthenticationFailure::MalformedCiphertext);
-        }
-        Ok(())
-    }
-
-    pub fn verify_signature(&self) -> Result<(), AuthenticationFailure> {
-        let plaintext = self.content.plaintext();
-        self.content
-            .client_identity
-            .verify(plaintext, &self.request_signature)
-            .map_err(Into::into)
-    }
-}
-
-#[derive(Serialize, Deserialize, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct AuthenticateRequestContent {
-    pub protocol_version: u8,
-
-    // this is identical to the client's address
-    pub client_identity: ed25519::PublicKey,
-
-    #[serde(with = "nym_serde_helpers::base64")]
-    pub address_ciphertext: Vec<u8>,
-
-    #[serde(with = "nym_serde_helpers::base64")]
-    pub nonce: Vec<u8>,
-
-    pub request_unix_timestamp: u64,
-}
-
-impl AuthenticateRequestContent {
-    fn new(
-        protocol_version: u8,
-        shared_key: &SharedGatewayKey,
-        client_identity: ed25519::PublicKey,
-    ) -> Result<AuthenticateRequestContent, GatewayRequestsError> {
-        let nonce = shared_key.random_nonce_or_iv();
-        let destination_address = client_identity.derive_destination_address();
-
-        let address_ciphertext =
-            shared_key.encrypt(destination_address.as_bytes_ref(), Some(&nonce))?;
-        let now = OffsetDateTime::now_utc();
-        Ok(AuthenticateRequestContent {
-            protocol_version,
-            client_identity,
-            address_ciphertext,
-            nonce,
-            request_unix_timestamp: now.unix_timestamp() as u64, // SAFETY: we're running this in post 1970...
-        })
-    }
-}
-
-impl AuthenticateRequestContent {
-    pub fn plaintext(&self) -> Vec<u8> {
-        iter::once(self.protocol_version)
-            .chain(self.client_identity.to_bytes())
-            .chain(self.address_ciphertext.iter().copied())
-            .chain(self.nonce.iter().copied())
-            .chain(self.request_unix_timestamp.to_be_bytes())
-            .collect()
-    }
-
-    pub fn request_timestamp(&self) -> OffsetDateTime {
-        OffsetDateTime::from_unix_timestamp(self.request_unix_timestamp as i64)
-            .unwrap_or(OffsetDateTime::UNIX_EPOCH)
-    }
-}
@@ -1,7 +0,0 @@
-/*
- * Copyright 2025 - Nym Technologies SA <contact@nymtech.net>
- * SPDX-License-Identifier: GPL-3.0-only
- */
-
-ALTER TABLE shared_keys
-    ADD COLUMN last_used_authentication TIMESTAMP WITHOUT TIME ZONE;
@@ -200,20 +200,6 @@ impl GatewayStorage {
        Ok(())
    }

-    pub async fn update_last_used_authentication_timestamp(
-        &self,
-        client_id: i64,
-        last_used_authentication_timestamp: OffsetDateTime,
-    ) -> Result<(), GatewayStorageError> {
-        self.shared_key_manager
-            .update_last_used_authentication_timestamp(
-                client_id,
-                last_used_authentication_timestamp,
-            )
-            .await?;
-        Ok(())
-    }
-
    pub async fn get_client(&self, client_id: i64) -> Result<Option<Client>, GatewayStorageError> {
        let client = self.client_manager.get_client(client_id).await?;
        Ok(client)
@@ -14,13 +14,13 @@ pub struct Client {

 #[derive(FromRow)]
 pub struct PersistedSharedKeys {
+    #[allow(dead_code)]
    pub client_id: i64,

    #[allow(dead_code)]
    pub client_address_bs58: String,
    pub derived_aes128_ctr_blake3_hmac_keys_bs58: Option<String>,
    pub derived_aes256_gcm_siv_key: Option<Vec<u8>>,
-    pub last_used_authentication: Option<OffsetDateTime>,
 }

 impl TryFrom<PersistedSharedKeys> for SharedGatewayKey {
@@ -2,7 +2,6 @@
 // SPDX-License-Identifier: GPL-3.0-only

 use crate::models::PersistedSharedKeys;
-use time::OffsetDateTime;

 #[derive(Clone)]
 pub(crate) struct SharedKeysManager {
@@ -69,22 +68,6 @@ impl SharedKeysManager {
        Ok(())
    }

-    pub(crate) async fn update_last_used_authentication_timestamp(
-        &self,
-        client_id: i64,
-        last_used: OffsetDateTime,
-    ) -> Result<(), sqlx::Error> {
-        sqlx::query!(
-            "UPDATE shared_keys SET last_used_authentication = ? WHERE client_id = ?;",
-            last_used,
-            client_id
-        )
-        .execute(&self.connection_pool)
-        .await?;
-
-        Ok(())
-    }
-
    /// Tries to retrieve shared keys stored for the particular client.
    ///
    /// # Arguments
@@ -94,10 +77,13 @@ impl SharedKeysManager {
        &self,
        client_address_bs58: &str,
    ) -> Result<Option<PersistedSharedKeys>, sqlx::Error> {
-        sqlx::query_as("SELECT * FROM shared_keys WHERE client_address_bs58 = ?")
-            .bind(client_address_bs58)
-            .fetch_optional(&self.connection_pool)
-            .await
+        sqlx::query_as!(
+            PersistedSharedKeys,
+            "SELECT * FROM shared_keys WHERE client_address_bs58 = ?",
+            client_address_bs58
+        )
+        .fetch_optional(&self.connection_pool)
+        .await
    }

    /// Removes from the database shared keys derived with the particular client.
@@ -21,12 +21,6 @@ serde_json = { workspace = true }
 thiserror = { workspace = true }
 tracing = { workspace = true }

-# used for decoding text responses (they were already implicitly included)
-bytes = { workspace = true }
-encoding_rs = { workspace = true }
-mime = { workspace = true }
-
-
 nym-bin-common = { path = "../bin-common" }

 [target."cfg(not(target_arch = \"wasm32\"))".dependencies]
@@ -38,4 +32,4 @@ workspace = true
 features = ["tokio"]

 [dev-dependencies]
-tokio = { workspace = true, features = ["rt", "macros"] }
+tokio = { workspace = true, features=["rt", "macros"] }
@@ -13,18 +13,15 @@

 use crate::ClientBuilder;

-use std::{
-    net::SocketAddr,
-    sync::{Arc, LazyLock},
-};
+use std::{net::SocketAddr, sync::Arc};

+use hickory_resolver::lookup_ip::LookupIp;
 use hickory_resolver::{
    config::{LookupIpStrategy, NameServerConfigGroup, ResolverConfig, ResolverOpts},
    error::ResolveError,
    lookup_ip::LookupIpIntoIter,
    TokioAsyncResolver,
 };
-use hickory_resolver::{error::ResolveErrorKind, lookup_ip::LookupIp};
 use once_cell::sync::OnceCell;
 use reqwest::dns::{Addrs, Name, Resolve, Resolving};
 use tracing::warn;
@@ -41,14 +38,6 @@ struct SocketAddrs {
    iter: LookupIpIntoIter,
 }

-// n.b. static items do not call [`Drop`] on program termination, so this won't be deallocated.
-// this is fine, as the OS can deallocate the terminated program faster than we can free memory
-// but tools like valgrind might report "memory leaks" as it isn't obvious this is intentional.
-static SHARED_RESOLVER: LazyLock<HickoryDnsResolver> = LazyLock::new(|| {
-    tracing::debug!("Initializing shared DNS resolver");
-    HickoryDnsResolver::default()
-});
-
 #[derive(Debug, thiserror::Error)]
 #[error("hickory-dns resolver error: {hickory_error}")]
 /// Error occurring while resolving a hostname into an IP address.
@@ -58,62 +47,29 @@ pub struct HickoryDnsError {
 }

 /// Wrapper around an `AsyncResolver`, which implements the `Resolve` trait.
-///
-/// Typical use involves instantiating using the `Default` implementation and then resolving using
-/// methods or trait implementations.
-///
-/// The default initialization uses a shared underlying `AsyncResolver`. If a thread local resolver
-/// is required use `thread_resolver()` to build a resolver with an independently instantiated
-/// internal `AsyncResolver`.
 #[derive(Debug, Default, Clone)]
 pub struct HickoryDnsResolver {
-    // Since we might not have been called in the context of a
-    // Tokio Runtime in initialization, so we must delay the actual
-    // construction of the resolver.
+    /// Since we might not have been called in the context of a
+    /// Tokio Runtime in initialization, so we must delay the actual
+    /// construction of the resolver.
    state: Arc<OnceCell<TokioAsyncResolver>>,
    fallback: Arc<OnceCell<TokioAsyncResolver>>,
-    dont_use_shared: bool,
 }

 impl Resolve for HickoryDnsResolver {
    fn resolve(&self, name: Name) -> Resolving {
        let resolver = self.state.clone();
        let fallback = self.fallback.clone();
-        let independent = self.dont_use_shared;
        Box::pin(async move {
-            let resolver = resolver.get_or_try_init(|| {
-                // using a closure here is slightly gross, but this makes sure that if the
-                // lazy-init returns an error it can be handled by the client
-                if independent {
-                    new_resolver()
-                } else {
-                    Ok(SHARED_RESOLVER.state.get_or_try_init(new_resolver)?.clone())
-                }
-            })?;
+            let resolver = resolver.get_or_try_init(new_resolver)?;

            // try the primary DNS resolver that we set up (DoH or DoT or whatever)
            let lookup = match resolver.lookup_ip(name.as_str()).await {
                Ok(res) => res,
                Err(e) => {
                    // on failure use the fall back system configured DNS resolver
-                    match e.kind() {
-                        ResolveErrorKind::NoRecordsFound { .. } => {}
-                        _ => {
-                            warn!("primary DNS failed w/ error {e}: using system fallback");
-                        }
-                    }
-                    let resolver = fallback.get_or_try_init(|| {
-                        // using a closure here is slightly gross, but this makes sure that if the
-                        // lazy-init returns an error it can be handled by the client
-                        if independent {
-                            new_resolver_system()
-                        } else {
-                            Ok(SHARED_RESOLVER
-                                .fallback
-                                .get_or_try_init(new_resolver_system)?
-                                .clone())
-                        }
-                    })?;
+                    warn!("primary DNS failed w/ error {e}: using system fallback");
+                    let resolver = fallback.get_or_try_init(new_resolver_system)?;
                    resolver.lookup_ip(name.as_str()).await?
                }
            };
@@ -137,55 +93,21 @@ impl Iterator for SocketAddrs {
 impl HickoryDnsResolver {
    /// Attempt to resolve a domain name to a set of ['IpAddr']s
    pub async fn resolve_str(&self, name: &str) -> Result<LookupIp, HickoryDnsError> {
-        let resolver = self.state.get_or_try_init(|| self.new_resolver())?;
+        let resolver = self.state.get_or_try_init(new_resolver)?;

        // try the primary DNS resolver that we set up (DoH or DoT or whatever)
        let lookup = match resolver.lookup_ip(name).await {
            Ok(res) => res,
            Err(e) => {
                // on failure use the fall back system configured DNS resolver
-                match e.kind() {
-                    ResolveErrorKind::NoRecordsFound { .. } => {}
-                    _ => {
-                        warn!("primary DNS failed w/ error {e}: using system fallback");
-                    }
-                }
-                let resolver = self
-                    .fallback
-                    .get_or_try_init(|| self.new_resolver_system())?;
+                warn!("primary DNS failed w/ error {e}: using system fallback");
+                let resolver = self.fallback.get_or_try_init(new_resolver_system)?;
                resolver.lookup_ip(name).await?
            }
        };

        Ok(lookup)
    }
-
-    /// Create a (lazy-initialized) resolver that is not shared across threads.
-    pub fn thread_resolver() -> Self {
-        Self {
-            dont_use_shared: true,
-            ..Default::default()
-        }
-    }
-
-    fn new_resolver(&self) -> Result<TokioAsyncResolver, HickoryDnsError> {
-        if self.dont_use_shared {
-            new_resolver()
-        } else {
-            Ok(SHARED_RESOLVER.state.get_or_try_init(new_resolver)?.clone())
-        }
-    }
-
-    fn new_resolver_system(&self) -> Result<TokioAsyncResolver, HickoryDnsError> {
-        if self.dont_use_shared {
-            new_resolver_system()
-        } else {
-            Ok(SHARED_RESOLVER
-                .fallback
-                .get_or_try_init(new_resolver_system)?
-                .clone())
-        }
-    }
 }

 /// Create a new resolver with a custom DoT based configuration. The options are overridden to look
@@ -147,13 +147,13 @@ use thiserror::Error;
 use tracing::{instrument, warn};
 use url::Url;

-use http::HeaderMap;
-pub use reqwest::IntoUrl;
 #[cfg(not(target_arch = "wasm32"))]
 use std::net::SocketAddr;
 #[cfg(not(target_arch = "wasm32"))]
 use std::sync::Arc;

+pub use reqwest::IntoUrl;
+
 mod user_agent;
 pub use user_agent::UserAgent;

@@ -210,12 +210,6 @@ pub enum HttpClientError<E: Display = String> {
    #[error("failed to resolve request. status: '{status}', additional error message: {error}")]
    EndpointFailure { status: StatusCode, error: E },

-    #[error("failed to decode response body: {source} from {content}")]
-    ResponseDecodeFailure {
-        source: serde_json::Error,
-        content: String,
-    },
-
    #[cfg(target_arch = "wasm32")]
    #[error("the request has timed out")]
    RequestTimeout,
@@ -855,26 +849,6 @@ fn sanitize_url<K: AsRef<str>, V: AsRef<str>>(
    url
 }

-fn decode_as_text(bytes: &bytes::Bytes, headers: HeaderMap) -> String {
-    use encoding_rs::{Encoding, UTF_8};
-    use mime::Mime;
-
-    let content_type = headers
-        .get(http::header::CONTENT_TYPE)
-        .and_then(|value| value.to_str().ok())
-        .and_then(|value| value.parse::<Mime>().ok());
-
-    let encoding_name = content_type
-        .as_ref()
-        .and_then(|mime| mime.get_param("charset").map(|charset| charset.as_str()))
-        .unwrap_or("utf-8");
-
-    let encoding = Encoding::for_label(encoding_name.as_bytes()).unwrap_or(UTF_8);
-
-    let (text, _, _) = encoding.decode(bytes);
-    text.into_owned()
-}
-
 /// Attempt to parse a json object from an HTTP response
 #[instrument(level = "debug", skip_all)]
 pub async fn parse_response<T, E>(res: Response, allow_empty: bool) -> Result<T, HttpClientError<E>>
@@ -890,23 +864,21 @@ where
            return Err(HttpClientError::EmptyResponse { status });
        }
    }
-    let headers = res.headers().clone();
-    tracing::trace!("headers: {:?}", headers);

    if res.status().is_success() {
-        // internally reqwest is first retrieving bytes and then performing parsing via serde_json
-        // (and similarly does the same thing for text())
-        let full = res.bytes().await?;
-        match serde_json::from_slice(&full) {
-            Ok(data) => Ok(data),
-            Err(err) => {
-                let content = decode_as_text(&full, headers);
-                Err(HttpClientError::ResponseDecodeFailure {
-                    source: err,
-                    content,
-                })
-            }
+        #[cfg(debug_assertions)]
+        {
+            let text = res.text().await.inspect_err(|err| {
+                tracing::error!("Couldn't even get response text: {err}");
+            })?;
+            tracing::trace!("Result:\n{:#?}", text);
+
+            serde_json::from_str(&text)
+                .map_err(|err| HttpClientError::GenericRequestFailure(err.to_string()))
        }
+
+        #[cfg(not(debug_assertions))]
+        Ok(res.json().await?)
    } else if res.status() == StatusCode::NOT_FOUND {
        Err(HttpClientError::NotFound)
    } else {
@@ -13,7 +13,6 @@ bincode = { workspace = true }
 bytes = { workspace = true }
 nym-bin-common = { path = "../bin-common" }
 nym-crypto = { path = "../crypto" }
-nym-service-provider-requests-common = { path = "../service-provider-requests-common" }
 nym-sphinx = { path = "../nymsphinx" }
 rand = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
@@ -2,18 +2,24 @@ use serde::{Deserialize, Serialize};
 use std::fmt::{Display, Formatter};
 use std::net::{Ipv4Addr, Ipv6Addr};

+// The current version of the protocol.
+// The idea here is that we add new request response types at least one version before we start
+// using them.
+// Also, depending on the version in the client connect message the IPR could respond with a
+// matching older version.
+pub use v6::request;
+pub use v6::response;
+
 pub mod codec;
-pub mod sign;
 pub mod v6;
 pub mod v7;
-pub mod v8;

 // version 3: initial version
 // version 4: IPv6 support
 // version 5: Add severity level to info response
 // version 6: Increase the available IPs
 // version 7: Add signature support (for the future)
-// version 8: Anonymous sends
+pub const CURRENT_VERSION: u8 = 6;

 #[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
 pub struct IpPair {
@@ -39,9 +45,3 @@ fn make_bincode_serializer() -> impl bincode::Options {
        .with_big_endian()
        .with_varint_encoding()
 }
-
-fn generate_random() -> u64 {
-    use rand::RngCore;
-    let mut rng = rand::rngs::OsRng;
-    rng.next_u64()
-}
@@ -0,0 +1,69 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::{v6, v7};
+
+impl From<v7::response::StaticConnectFailureReason> for v6::response::StaticConnectFailureReason {
+    fn from(failure: v7::response::StaticConnectFailureReason) -> Self {
+        match failure {
+            v7::response::StaticConnectFailureReason::RequestedIpAlreadyInUse => {
+                v6::response::StaticConnectFailureReason::RequestedIpAlreadyInUse
+            }
+            v7::response::StaticConnectFailureReason::RequestedNymAddressAlreadyInUse => {
+                v6::response::StaticConnectFailureReason::RequestedNymAddressAlreadyInUse
+            }
+            v7::response::StaticConnectFailureReason::OutOfDateTimestamp => {
+                v6::response::StaticConnectFailureReason::Other("out of date timestamp".to_string())
+            }
+            v7::response::StaticConnectFailureReason::Other(reason) => {
+                v6::response::StaticConnectFailureReason::Other(reason)
+            }
+        }
+    }
+}
+
+impl From<v7::response::DynamicConnectFailureReason> for v6::response::DynamicConnectFailureReason {
+    fn from(failure: v7::response::DynamicConnectFailureReason) -> Self {
+        match failure {
+            v7::response::DynamicConnectFailureReason::RequestedNymAddressAlreadyInUse => {
+                v6::response::DynamicConnectFailureReason::RequestedNymAddressAlreadyInUse
+            }
+            v7::response::DynamicConnectFailureReason::NoAvailableIp => {
+                v6::response::DynamicConnectFailureReason::NoAvailableIp
+            }
+            v7::response::DynamicConnectFailureReason::Other(err) => {
+                v6::response::DynamicConnectFailureReason::Other(err)
+            }
+        }
+    }
+}
+
+impl From<v7::response::InfoResponseReply> for v6::response::InfoResponseReply {
+    fn from(reply: v7::response::InfoResponseReply) -> Self {
+        match reply {
+            v7::response::InfoResponseReply::Generic { msg } => {
+                v6::response::InfoResponseReply::Generic { msg }
+            }
+            v7::response::InfoResponseReply::VersionMismatch {
+                request_version,
+                response_version,
+            } => v6::response::InfoResponseReply::VersionMismatch {
+                request_version,
+                response_version,
+            },
+            v7::response::InfoResponseReply::ExitPolicyFilterCheckFailed { dst } => {
+                v6::response::InfoResponseReply::ExitPolicyFilterCheckFailed { dst }
+            }
+        }
+    }
+}
+
+impl From<v7::response::InfoLevel> for v6::response::InfoLevel {
+    fn from(level: v7::response::InfoLevel) -> Self {
+        match level {
+            v7::response::InfoLevel::Info => v6::response::InfoLevel::Info,
+            v7::response::InfoLevel::Warn => v6::response::InfoLevel::Warn,
+            v7::response::InfoLevel::Error => v6::response::InfoLevel::Error,
+        }
+    }
+}
@@ -1,3 +1,4 @@
+pub mod conversion;
 pub mod request;
 pub mod response;

@@ -0,0 +1,125 @@
+use time::OffsetDateTime;
+
+use crate::{v6, v7};
+
+impl From<v6::request::IpPacketRequest> for v7::request::IpPacketRequest {
+    fn from(ip_packet_request: v6::request::IpPacketRequest) -> Self {
+        Self {
+            version: 7,
+            data: ip_packet_request.data.into(),
+        }
+    }
+}
+
+impl From<v6::request::IpPacketRequestData> for v7::request::IpPacketRequestData {
+    fn from(ip_packet_request_data: v6::request::IpPacketRequestData) -> Self {
+        match ip_packet_request_data {
+            v6::request::IpPacketRequestData::StaticConnect(r) => {
+                v7::request::IpPacketRequestData::StaticConnect(
+                    v7::request::SignedStaticConnectRequest {
+                        request: r.into(),
+                        signature: None,
+                    },
+                )
+            }
+            v6::request::IpPacketRequestData::DynamicConnect(r) => {
+                v7::request::IpPacketRequestData::DynamicConnect(
+                    v7::request::SignedDynamicConnectRequest {
+                        request: r.into(),
+                        signature: None,
+                    },
+                )
+            }
+            v6::request::IpPacketRequestData::Disconnect(r) => {
+                v7::request::IpPacketRequestData::Disconnect(v7::request::SignedDisconnectRequest {
+                    request: r.into(),
+                    signature: None,
+                })
+            }
+            v6::request::IpPacketRequestData::Data(r) => {
+                v7::request::IpPacketRequestData::Data(r.into())
+            }
+            v6::request::IpPacketRequestData::Ping(r) => {
+                v7::request::IpPacketRequestData::Ping(r.into())
+            }
+            v6::request::IpPacketRequestData::Health(r) => {
+                v7::request::IpPacketRequestData::Health(r.into())
+            }
+        }
+    }
+}
+
+impl From<v6::request::StaticConnectRequest> for v7::request::StaticConnectRequest {
+    fn from(static_connect_request: v6::request::StaticConnectRequest) -> Self {
+        Self {
+            request_id: static_connect_request.request_id,
+            ips: static_connect_request.ips,
+            reply_to: static_connect_request.reply_to,
+            reply_to_hops: static_connect_request.reply_to_hops,
+            reply_to_avg_mix_delays: static_connect_request.reply_to_avg_mix_delays,
+            buffer_timeout: static_connect_request.buffer_timeout,
+            timestamp: OffsetDateTime::now_utc(),
+        }
+    }
+}
+
+#[allow(deprecated)]
+impl From<v6::request::DynamicConnectRequest> for v7::request::DynamicConnectRequest {
+    fn from(dynamic_connect_request: v6::request::DynamicConnectRequest) -> Self {
+        Self {
+            request_id: dynamic_connect_request.request_id,
+            reply_to: dynamic_connect_request.reply_to,
+            reply_to_hops: dynamic_connect_request.reply_to_hops,
+            reply_to_avg_mix_delays: dynamic_connect_request.reply_to_avg_mix_delays,
+            buffer_timeout: dynamic_connect_request.buffer_timeout,
+            timestamp: OffsetDateTime::now_utc(),
+        }
+    }
+}
+
+impl From<v6::request::DisconnectRequest> for v7::request::SignedDisconnectRequest {
+    fn from(disconnect_request: v6::request::DisconnectRequest) -> Self {
+        Self {
+            request: disconnect_request.into(),
+            signature: None,
+        }
+    }
+}
+
+impl From<v6::request::DisconnectRequest> for v7::request::DisconnectRequest {
+    fn from(disconnect_request: v6::request::DisconnectRequest) -> Self {
+        Self {
+            request_id: disconnect_request.request_id,
+            reply_to: disconnect_request.reply_to,
+            timestamp: OffsetDateTime::now_utc(),
+        }
+    }
+}
+
+impl From<v6::request::DataRequest> for v7::request::DataRequest {
+    fn from(data_request: v6::request::DataRequest) -> Self {
+        Self {
+            ip_packets: data_request.ip_packets,
+        }
+    }
+}
+
+impl From<v6::request::PingRequest> for v7::request::PingRequest {
+    fn from(ping_request: v6::request::PingRequest) -> Self {
+        Self {
+            request_id: ping_request.request_id,
+            reply_to: ping_request.reply_to,
+            timestamp: OffsetDateTime::now_utc(),
+        }
+    }
+}
+
+impl From<v6::request::HealthRequest> for v7::request::HealthRequest {
+    fn from(health_request: v6::request::HealthRequest) -> Self {
+        Self {
+            request_id: health_request.request_id,
+            reply_to: health_request.reply_to,
+            timestamp: OffsetDateTime::now_utc(),
+        }
+    }
+}
@@ -1,4 +1,6 @@
+pub mod conversion;
 pub mod request;
 pub mod response;
+pub mod signature;

 pub const VERSION: u8 = 7;
@@ -1,18 +1,22 @@
-use std::fmt;
-
 use nym_crypto::asymmetric::identity;
 use nym_sphinx::addressing::clients::Recipient;
 use serde::{Deserialize, Serialize};
 use time::OffsetDateTime;

-use crate::{
-    sign::{SignatureError, SignedRequest},
-    IpPair,
+use crate::{make_bincode_serializer, IpPair};
+
+use super::{
+    signature::{SignatureError, SignedRequest},
+    VERSION,
 };

-use super::VERSION;
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}

-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+#[derive(Clone, Debug, Serialize, Deserialize)]
 pub struct IpPacketRequest {
    pub version: u8,
    pub data: IpPacketRequestData,
@@ -26,7 +30,7 @@ impl IpPacketRequest {
        reply_to_avg_mix_delays: Option<f64>,
        buffer_timeout: Option<u64>,
    ) -> (Self, u64) {
-        let request_id = crate::generate_random();
+        let request_id = generate_random();
        (
            Self {
                version: VERSION,
@@ -54,7 +58,7 @@ impl IpPacketRequest {
        reply_to_avg_mix_delays: Option<f64>,
        buffer_timeout: Option<u64>,
    ) -> (Self, u64) {
-        let request_id = crate::generate_random();
+        let request_id = generate_random();
        (
            Self {
                version: VERSION,
@@ -75,7 +79,7 @@ impl IpPacketRequest {
    }

    pub fn new_disconnect_request(reply_to: Recipient) -> (Self, u64) {
-        let request_id = crate::generate_random();
+        let request_id = generate_random();
        (
            Self {
                version: VERSION,
@@ -100,7 +104,7 @@ impl IpPacketRequest {
    }

    pub fn new_ping(reply_to: Recipient) -> (Self, u64) {
-        let request_id = crate::generate_random();
+        let request_id = generate_random();
        (
            Self {
                version: VERSION,
@@ -115,7 +119,7 @@ impl IpPacketRequest {
    }

    pub fn new_health_request(reply_to: Recipient) -> (Self, u64) {
-        let request_id = crate::generate_random();
+        let request_id = generate_random();
        (
            Self {
                version: VERSION,
@@ -151,27 +155,16 @@ impl IpPacketRequest {
        }
    }

-    pub fn verify(&self) -> Result<(), SignatureError> {
-        match &self.data {
-            IpPacketRequestData::StaticConnect(request) => request.verify(),
-            IpPacketRequestData::DynamicConnect(request) => request.verify(),
-            IpPacketRequestData::Disconnect(request) => request.verify(),
-            IpPacketRequestData::Data(_) => Ok(()),
-            IpPacketRequestData::Ping(_) => Ok(()),
-            IpPacketRequestData::Health(_) => Ok(()),
-        }
-    }
-
    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
        use bincode::Options;
-        crate::make_bincode_serializer().serialize(self)
+        make_bincode_serializer().serialize(self)
    }

    pub fn from_reconstructed_message(
        message: &nym_sphinx::receiver::ReconstructedMessage,
    ) -> Result<Self, bincode::Error> {
        use bincode::Options;
-        crate::make_bincode_serializer().deserialize(&message.message)
+        make_bincode_serializer().deserialize(&message.message)
    }
 }

@@ -186,19 +179,6 @@ pub enum IpPacketRequestData {
    Health(HealthRequest),
 }

-impl fmt::Display for IpPacketRequestData {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            IpPacketRequestData::StaticConnect(_) => write!(f, "StaticConnect"),
-            IpPacketRequestData::DynamicConnect(_) => write!(f, "DynamicConnect"),
-            IpPacketRequestData::Disconnect(_) => write!(f, "Disconnect"),
-            IpPacketRequestData::Data(_) => write!(f, "Data"),
-            IpPacketRequestData::Ping(_) => write!(f, "Ping"),
-            IpPacketRequestData::Health(_) => write!(f, "Health"),
-        }
-    }
-}
-
 impl IpPacketRequestData {
    pub fn add_signature(&mut self, signature: identity::Signature) -> Option<identity::Signature> {
        match self {
@@ -222,9 +202,9 @@ impl IpPacketRequestData {

    pub fn signable_request(&self) -> Option<Result<Vec<u8>, SignatureError>> {
        match self {
-            IpPacketRequestData::StaticConnect(request) => Some(request.request_as_bytes()),
-            IpPacketRequestData::DynamicConnect(request) => Some(request.request_as_bytes()),
-            IpPacketRequestData::Disconnect(request) => Some(request.request_as_bytes()),
+            IpPacketRequestData::StaticConnect(request) => Some(request.request()),
+            IpPacketRequestData::DynamicConnect(request) => Some(request.request()),
+            IpPacketRequestData::Disconnect(request) => Some(request.request()),
            IpPacketRequestData::Data(_) => None,
            IpPacketRequestData::Ping(_) => None,
            IpPacketRequestData::Health(_) => None,
@@ -262,7 +242,7 @@ pub struct StaticConnectRequest {
 impl StaticConnectRequest {
    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
        use bincode::Options;
-        crate::make_bincode_serializer().serialize(self)
+        make_bincode_serializer().serialize(self)
    }
 }

@@ -273,11 +253,11 @@ pub struct SignedStaticConnectRequest {
 }

 impl SignedRequest for SignedStaticConnectRequest {
-    fn identity(&self) -> Option<&identity::PublicKey> {
-        Some(self.request.reply_to.identity())
+    fn identity(&self) -> &identity::PublicKey {
+        self.request.reply_to.identity()
    }

-    fn request_as_bytes(&self) -> Result<Vec<u8>, SignatureError> {
+    fn request(&self) -> Result<Vec<u8>, SignatureError> {
        self.request
            .to_bytes()
            .map_err(|error| SignatureError::RequestSerializationError {
@@ -326,7 +306,7 @@ pub struct DynamicConnectRequest {
 impl DynamicConnectRequest {
    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
        use bincode::Options;
-        crate::make_bincode_serializer().serialize(self)
+        make_bincode_serializer().serialize(self)
    }
 }

@@ -337,11 +317,11 @@ pub struct SignedDynamicConnectRequest {
 }

 impl SignedRequest for SignedDynamicConnectRequest {
-    fn identity(&self) -> Option<&identity::PublicKey> {
-        Some(self.request.reply_to.identity())
+    fn identity(&self) -> &identity::PublicKey {
+        self.request.reply_to.identity()
    }

-    fn request_as_bytes(&self) -> Result<Vec<u8>, SignatureError> {
+    fn request(&self) -> Result<Vec<u8>, SignatureError> {
        self.request
            .to_bytes()
            .map_err(|error| SignatureError::RequestSerializationError {
@@ -375,7 +355,7 @@ pub struct DisconnectRequest {
 impl DisconnectRequest {
    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
        use bincode::Options;
-        crate::make_bincode_serializer().serialize(self)
+        make_bincode_serializer().serialize(self)
    }
 }

@@ -386,11 +366,11 @@ pub struct SignedDisconnectRequest {
 }

 impl SignedRequest for SignedDisconnectRequest {
-    fn identity(&self) -> Option<&identity::PublicKey> {
-        Some(self.request.reply_to.identity())
+    fn identity(&self) -> &identity::PublicKey {
+        self.request.reply_to.identity()
    }

-    fn request_as_bytes(&self) -> Result<Vec<u8>, SignatureError> {
+    fn request(&self) -> Result<Vec<u8>, SignatureError> {
        self.request
            .to_bytes()
            .map_err(|error| SignatureError::RequestSerializationError {
@@ -1,7 +1,6 @@
 use std::time::Duration;

-use nym_crypto::asymmetric::ed25519;
-use time::OffsetDateTime;
+use nym_crypto::asymmetric::identity;

 // For reply protection, if a request is older than this, it will be rejected
 const MAX_REQUEST_AGE: Duration = Duration::from_secs(10);
@@ -23,37 +22,29 @@ pub enum SignatureError {
    #[error("signature verification failed")]
    VerificationFailed {
        message: String,
-        error: ed25519::SignatureError,
+        error: identity::SignatureError,
    },
 }

 pub trait SignedRequest {
-    fn identity(&self) -> Option<&ed25519::PublicKey>;
+    fn identity(&self) -> &identity::PublicKey;

-    fn request_as_bytes(&self) -> Result<Vec<u8>, SignatureError>;
+    fn request(&self) -> Result<Vec<u8>, SignatureError>;

-    fn signature(&self) -> Option<&ed25519::Signature>;
+    fn signature(&self) -> Option<&identity::Signature>;

-    fn timestamp(&self) -> OffsetDateTime;
+    fn timestamp(&self) -> time::OffsetDateTime;

    fn verify(&self) -> Result<(), SignatureError> {
-        let identity = match self.identity() {
-            Some(identity) => identity,
-            None => {
-                // If we are not revealing our identity, we don't need to verify anything
-                return Ok(());
-            }
-        };
-
        if let Some(signature) = self.signature() {
            // First check that the request is recent enough
-            if OffsetDateTime::now_utc() - self.timestamp() > MAX_REQUEST_AGE {
+            if time::OffsetDateTime::now_utc() - self.timestamp() > MAX_REQUEST_AGE {
                return Err(SignatureError::RequestOutOfDate);
            }

-            let request_as_bytes = self.request_as_bytes()?;
+            let request_as_bytes = self.request()?;

-            identity
+            self.identity()
                .verify(request_as_bytes, signature)
                .map_err(|error| SignatureError::VerificationFailed {
                    message: "signature verification failed".to_string(),
@@ -1,4 +0,0 @@
-pub mod request;
-pub mod response;
-
-pub const VERSION: u8 = 8;
@@ -1,304 +0,0 @@
-use std::fmt;
-
-use nym_service_provider_requests_common::{Protocol, ServiceProviderType};
-use serde::{Deserialize, Serialize};
-use time::OffsetDateTime;
-
-use super::VERSION;
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct IpPacketRequest {
-    pub protocol: Protocol,
-    pub data: IpPacketRequestData,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub enum IpPacketRequestData {
-    Data(DataRequest),
-    Control(Box<ControlRequest>),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub enum ControlRequest {
-    Connect(ConnectRequest),
-    Disconnect(DisconnectRequest),
-    Ping(PingRequest),
-    Health(HealthRequest),
-}
-
-// A data request is when the client wants to send an IP packet to a destination.
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct DataRequest {
-    pub ip_packets: bytes::Bytes,
-}
-
-// A dynamic connect request is when the client does not provide the internal IP address it will use
-// on the ip packet router, and instead requests one to be assigned to it.
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct ConnectRequest {
-    pub request_id: u64,
-
-    // The maximum time in milliseconds the IPR should wait when filling up a mix packet
-    // with ip packets.
-    pub buffer_timeout: Option<u64>,
-
-    // Timestamp of when the request was sent by the client.
-    pub timestamp: OffsetDateTime,
-}
-
-// A disconnect request is when the client wants to disconnect from the ip packet router and free
-// up the allocated IP address.
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct DisconnectRequest {
-    pub request_id: u64,
-
-    // Timestamp of when the request was sent by the client.
-    pub timestamp: OffsetDateTime,
-}
-
-// A ping request is when the client wants to check if the ip packet router is still alive.
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct PingRequest {
-    pub request_id: u64,
-
-    // Timestamp of when the request was sent by the client.
-    pub timestamp: OffsetDateTime,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct HealthRequest {
-    pub request_id: u64,
-
-    // Timestamp of when the request was sent by the client.
-    pub timestamp: OffsetDateTime,
-}
-
-impl IpPacketRequest {
-    pub fn new_connect_request(buffer_timeout: Option<u64>) -> (Self, u64) {
-        let protocol = Protocol {
-            version: VERSION,
-            service_provider_type: ServiceProviderType::IpPacketRouter,
-        };
-        let request_id = rand::random();
-        let timestamp = OffsetDateTime::now_utc();
-        let connect = ConnectRequest {
-            request_id,
-            buffer_timeout,
-            timestamp,
-        };
-        let request = Self {
-            protocol,
-            data: IpPacketRequestData::Control(Box::new(ControlRequest::Connect(connect))),
-        };
-        (request, request_id)
-    }
-
-    pub fn new_disconnect_request() -> (Self, u64) {
-        let protocol = Protocol {
-            version: VERSION,
-            service_provider_type: ServiceProviderType::IpPacketRouter,
-        };
-        let request_id = rand::random();
-        let timestamp = OffsetDateTime::now_utc();
-        let disconnect = DisconnectRequest {
-            request_id,
-            timestamp,
-        };
-        let request = Self {
-            protocol,
-            data: IpPacketRequestData::Control(Box::new(ControlRequest::Disconnect(disconnect))),
-        };
-        (request, request_id)
-    }
-
-    pub fn new_data_request(ip_packets: bytes::Bytes) -> Self {
-        Self {
-            protocol: Protocol {
-                version: VERSION,
-                service_provider_type: ServiceProviderType::IpPacketRouter,
-            },
-            data: IpPacketRequestData::Data(DataRequest { ip_packets }),
-        }
-    }
-
-    pub fn new_ping() -> (Self, u64) {
-        let protocol = Protocol {
-            version: VERSION,
-            service_provider_type: ServiceProviderType::IpPacketRouter,
-        };
-        let request_id = rand::random();
-        let timestamp = OffsetDateTime::now_utc();
-        let ping_request = PingRequest {
-            request_id,
-            timestamp,
-        };
-        let request = Self {
-            protocol,
-            data: IpPacketRequestData::Control(Box::new(ControlRequest::Ping(ping_request))),
-        };
-        (request, request_id)
-    }
-
-    pub fn new_health_request() -> (Self, u64) {
-        let protocol = Protocol {
-            version: VERSION,
-            service_provider_type: ServiceProviderType::IpPacketRouter,
-        };
-        let request_id = rand::random();
-        let timestamp = OffsetDateTime::now_utc();
-        let health_request = HealthRequest {
-            request_id,
-            timestamp,
-        };
-        let request = Self {
-            protocol,
-            data: IpPacketRequestData::Control(Box::new(ControlRequest::Health(health_request))),
-        };
-        (request, request_id)
-    }
-
-    pub fn id(&self) -> Option<u64> {
-        match self.data {
-            IpPacketRequestData::Control(ref c) => Some(c.id()),
-            IpPacketRequestData::Data(_) => None,
-        }
-    }
-
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        crate::make_bincode_serializer().serialize(self)
-    }
-
-    pub fn from_reconstructed_message(
-        message: &nym_sphinx::receiver::ReconstructedMessage,
-    ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        crate::make_bincode_serializer().deserialize(&message.message)
-    }
-}
-
-impl fmt::Display for IpPacketRequest {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        write!(
-            f,
-            "IpPacketRequest {{ version: {}, data: {} }}",
-            self.protocol.version, self.data
-        )
-    }
-}
-
-impl fmt::Display for IpPacketRequestData {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            IpPacketRequestData::Data(_) => write!(f, "Data"),
-            IpPacketRequestData::Control(c) => write!(f, "Control({})", c),
-        }
-    }
-}
-
-impl ControlRequest {
-    fn id(&self) -> u64 {
-        match self {
-            ControlRequest::Connect(request) => request.request_id,
-            ControlRequest::Disconnect(request) => request.request_id,
-            ControlRequest::Ping(request) => request.request_id,
-            ControlRequest::Health(request) => request.request_id,
-        }
-    }
-}
-
-impl fmt::Display for ControlRequest {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            ControlRequest::Connect(_) => write!(f, "Connect"),
-            ControlRequest::Disconnect(_) => write!(f, "Disconnect"),
-            ControlRequest::Ping(_) => write!(f, "Ping"),
-            ControlRequest::Health(_) => write!(f, "Health"),
-        }
-    }
-}
-
-impl ConnectRequest {
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        crate::make_bincode_serializer().serialize(self)
-    }
-}
-
-impl DisconnectRequest {
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        crate::make_bincode_serializer().serialize(self)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use time::macros::datetime;
-
-    use super::*;
-
-    #[test]
-    fn check_size_of_request() {
-        let connect = IpPacketRequest {
-            protocol: Protocol {
-                version: 4,
-                service_provider_type: ServiceProviderType::IpPacketRouter,
-            },
-            data: IpPacketRequestData::Control(Box::new(ControlRequest::Connect(ConnectRequest {
-                request_id: 123,
-                buffer_timeout: None,
-                timestamp: datetime!(2024-01-01 12:59:59.5 UTC),
-            }))),
-        };
-        assert_eq!(connect.to_bytes().unwrap().len(), 21);
-    }
-
-    #[test]
-    fn check_size_of_data() {
-        let data = IpPacketRequest {
-            protocol: Protocol {
-                version: 4,
-                service_provider_type: ServiceProviderType::IpPacketRouter,
-            },
-            data: IpPacketRequestData::Data(DataRequest {
-                ip_packets: bytes::Bytes::from(vec![1u8; 32]),
-            }),
-        };
-        assert_eq!(data.to_bytes().unwrap().len(), 36);
-    }
-
-    #[test]
-    fn serialize_and_deserialize_data_request() {
-        let data = IpPacketRequest {
-            protocol: Protocol {
-                version: 4,
-                service_provider_type: ServiceProviderType::IpPacketRouter,
-            },
-            data: IpPacketRequestData::Data(DataRequest {
-                ip_packets: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
-            }),
-        };
-
-        let serialized = data.to_bytes().unwrap();
-        let deserialized = IpPacketRequest::from_reconstructed_message(
-            &nym_sphinx::receiver::ReconstructedMessage {
-                message: serialized,
-                sender_tag: None,
-            },
-        )
-        .unwrap();
-
-        assert_eq!(deserialized.protocol.version, 4);
-        assert_eq!(
-            deserialized.protocol.service_provider_type,
-            ServiceProviderType::IpPacketRouter
-        );
-        assert_eq!(
-            deserialized.data,
-            IpPacketRequestData::Data(DataRequest {
-                ip_packets: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
-            })
-        );
-    }
-}
@@ -1,219 +0,0 @@
-use nym_bin_common::build_information::BinaryBuildInformationOwned;
-use serde::{Deserialize, Serialize};
-
-use crate::{make_bincode_serializer, IpPair};
-
-use super::VERSION;
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct IpPacketResponse {
-    pub version: u8,
-    pub data: IpPacketResponseData,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub enum IpPacketResponseData {
-    Data(DataResponse),
-    Control(Box<ControlResponse>),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct DataResponse {
-    pub ip_packet: bytes::Bytes,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub enum ControlResponse {
-    // Response for a connect request
-    Connect(ConnectResponse),
-
-    // Response for a disconnect initiqated by the client
-    Disconnect(DisconnectResponse),
-
-    // Message from the server that the client got disconnected without the client initiating it
-    UnrequestedDisconnect(UnrequestedDisconnect),
-
-    // Response to ping request
-    Pong(PongResponse),
-
-    // Response for a health request
-    Health(Box<HealthResponse>),
-
-    // Info response. This can be anything from informative messages to errors
-    Info(InfoResponse),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct ConnectResponse {
-    pub request_id: u64,
-    pub reply: ConnectResponseReply,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub enum ConnectResponseReply {
-    Success(ConnectSuccess),
-    Failure(ConnectFailureReason),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct ConnectSuccess {
-    pub ips: IpPair,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
-pub enum ConnectFailureReason {
-    #[error("client is already connected")]
-    ClientAlreadyConnected,
-
-    #[error("no available ip address")]
-    NoAvailableIp,
-
-    #[error("{0}")]
-    Other(String),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct DisconnectResponse {
-    pub request_id: u64,
-    pub reply: DisconnectResponseReply,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub enum DisconnectResponseReply {
-    Success,
-    Failure(DisconnectFailureReason),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
-pub enum DisconnectFailureReason {
-    #[error("client is not connected")]
-    ClientNotConnected,
-
-    #[error("{0}")]
-    Other(String),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct UnrequestedDisconnect {
-    pub reason: UnrequestedDisconnectReason,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
-pub enum UnrequestedDisconnectReason {
-    #[error("client mixnet traffic timeout")]
-    ClientMixnetTrafficTimeout,
-
-    #[error("client tun traffic timeout")]
-    ClientTunTrafficTimeout,
-
-    #[error("{0}")]
-    Other(String),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct PongResponse {
-    pub request_id: u64,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct HealthResponse {
-    pub request_id: u64,
-    pub reply: HealthResponseReply,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct HealthResponseReply {
-    // Return the binary build information of the IPR
-    pub build_info: BinaryBuildInformationOwned,
-
-    // Return if the IPR has performed a successful routing test.
-    pub routable: Option<bool>,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct InfoResponse {
-    pub request_id: u64,
-    pub reply: InfoResponseReply,
-    pub level: InfoLevel,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
-pub enum InfoResponseReply {
-    #[error("{msg}")]
-    Generic { msg: String },
-
-    #[error(
-        "version mismatch: response is v{request_version} and response is v{response_version}"
-    )]
-    VersionMismatch {
-        request_version: u8,
-        response_version: u8,
-    },
-
-    #[error("destination failed exit policy filter check: {dst}")]
-    ExitPolicyFilterCheckFailed { dst: String },
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub enum InfoLevel {
-    Info,
-    Warn,
-    Error,
-}
-
-impl IpPacketResponse {
-    pub fn new_ip_packet(ip_packet: bytes::Bytes) -> Self {
-        Self {
-            version: VERSION,
-            data: IpPacketResponseData::Data(DataResponse { ip_packet }),
-        }
-    }
-
-    pub fn id(&self) -> Option<u64> {
-        match &self.data {
-            IpPacketResponseData::Data(_) => None,
-            IpPacketResponseData::Control(response) => response.id(),
-        }
-    }
-
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().serialize(self)
-    }
-
-    pub fn from_reconstructed_message(
-        message: &nym_sphinx::receiver::ReconstructedMessage,
-    ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
-    }
-}
-
-impl IpPacketResponseData {
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().serialize(self)
-    }
-}
-
-impl ControlResponse {
-    fn id(&self) -> Option<u64> {
-        match self {
-            ControlResponse::Connect(response) => Some(response.request_id),
-            ControlResponse::Disconnect(response) => Some(response.request_id),
-            ControlResponse::UnrequestedDisconnect(_) => None,
-            ControlResponse::Pong(response) => Some(response.request_id),
-            ControlResponse::Health(response) => Some(response.request_id),
-            ControlResponse::Info(response) => Some(response.request_id),
-        }
-    }
-}
-
-impl ConnectResponseReply {
-    pub fn is_success(&self) -> bool {
-        match self {
-            ConnectResponseReply::Success(_) => true,
-            ConnectResponseReply::Failure(_) => false,
-        }
-    }
-}
@@ -2,9 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0

 use crate::AckKey;
-use nym_crypto::symmetric::stream_cipher::{
-    self, encrypt, random_iv, try_iv_from_slice, IvSizeUser,
-};
+use nym_crypto::symmetric::stream_cipher::{self, encrypt, iv_from_slice, random_iv, IvSizeUser};
 use nym_sphinx_params::{AckEncryptionAlgorithm, SerializedFragmentIdentifier, FRAG_ID_LEN};
 use rand::{CryptoRng, RngCore};

@@ -27,11 +25,7 @@ pub fn recover_identifier(
    iv_id_ciphertext: &[u8],
 ) -> Option<SerializedFragmentIdentifier> {
    let iv_size = AckEncryptionAlgorithm::iv_size();
-    if iv_id_ciphertext.len() < FRAG_ID_LEN + iv_size {
-        return None;
-    }
-
-    let iv = try_iv_from_slice::<AckEncryptionAlgorithm>(&iv_id_ciphertext[..iv_size])?;
+    let iv = iv_from_slice::<AckEncryptionAlgorithm>(&iv_id_ciphertext[..iv_size]);

    let id = stream_cipher::decrypt::<AckEncryptionAlgorithm>(
        key.inner(),
@@ -161,12 +161,6 @@ impl From<NymNodeRoutingAddress> for SocketAddr {
    }
 }

-impl AsRef<SocketAddr> for NymNodeRoutingAddress {
-    fn as_ref(&self) -> &SocketAddr {
-        &self.0
-    }
-}
-
 impl TryInto<NodeAddressBytes> for NymNodeRoutingAddress {
    type Error = NymNodeRoutingAddressError;

@@ -7,7 +7,7 @@ use nym_sphinx_addressing::clients::Recipient;
 use nym_sphinx_addressing::nodes::{NymNodeRoutingAddress, MAX_NODE_ADDRESS_UNPADDED_LEN};
 use nym_sphinx_params::packet_sizes::PacketSize;
 use nym_sphinx_params::{PacketType, ReplySurbKeyDigestAlgorithm};
-use nym_sphinx_types::{NymPacket, SURBMaterial, SphinxError, SURB, UPDATED_LEGACY_VERSION};
+use nym_sphinx_types::{NymPacket, SURBMaterial, SphinxError, SURB};
 use nym_topology::{NymRouteProvider, NymTopologyError};
 use rand::{CryptoRng, RngCore};
 use serde::de::{Error as SerdeError, Visitor};
@@ -101,8 +101,7 @@ impl ReplySurb {
        let delays = nym_sphinx_routing::generate_hop_delays(average_delay, route.len());
        let destination = recipient.as_sphinx_destination();

-        let surb_material =
-            SURBMaterial::new(route, delays, destination).with_version(UPDATED_LEGACY_VERSION);
+        let surb_material = SURBMaterial::new(route, delays, destination);

        // this can't fail as we know we have a valid route to gateway and have correct number of delays
        Ok(ReplySurb {
@@ -9,4 +9,3 @@ repository = { workspace = true }

 [dependencies]
 pem = { workspace = true }
-tracing = { workspace = true }
@@ -6,7 +6,6 @@ use pem::Pem;
 use std::fs::File;
 use std::io::{self, Read, Write};
 use std::path::{Path, PathBuf};
-use tracing::debug;

 pub mod traits;

@@ -47,10 +46,6 @@ where
    T: PemStorableKey,
    P: AsRef<Path>,
 {
-    debug!(
-        "attempting to load key with the following pem type: {}",
-        T::pem_type()
-    );
    let key_pem = read_pem_file(path)?;

    if T::pem_type() != key_pem.tag {
@@ -12,7 +12,3 @@ readme.workspace = true

 [dependencies]
 serde = { workspace = true, features = ["derive"] }
-thiserror.workspace = true
-
-[dev-dependencies]
-bincode.workspace = true
@@ -1,16 +1,8 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: Apache-2.0

-use std::fmt;
-
 use serde::{Deserialize, Serialize};

-#[derive(thiserror::Error, Debug)]
-pub enum ProtocolError {
-    #[error("invalid service provider type: {0}")]
-    InvalidServiceProviderType(u8),
-}
-
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 #[repr(u8)]
 pub enum ServiceProviderType {
@@ -19,103 +11,8 @@ pub enum ServiceProviderType {
    Authenticator = 2,
 }

-impl fmt::Display for ServiceProviderType {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        match self {
-            Self::NetworkRequester => write!(f, "NetworkRequester"),
-            Self::IpPacketRouter => write!(f, "IpPacketRouter"),
-            Self::Authenticator => write!(f, "Authenticator"),
-        }
-    }
-}
-
-impl TryFrom<u8> for ServiceProviderType {
-    type Error = ProtocolError;
-
-    fn try_from(value: u8) -> Result<Self, Self::Error> {
-        match value {
-            0 => Ok(Self::NetworkRequester),
-            1 => Ok(Self::IpPacketRouter),
-            2 => Ok(Self::Authenticator),
-            _ => Err(ProtocolError::InvalidServiceProviderType(value)),
-        }
-    }
-}
-
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 pub struct Protocol {
    pub version: u8,
    pub service_provider_type: ServiceProviderType,
 }
-
-impl TryFrom<&[u8; 2]> for Protocol {
-    type Error = ProtocolError;
-
-    fn try_from(bytes: &[u8; 2]) -> Result<Self, Self::Error> {
-        let version = bytes[0];
-        let service_provider_type = ServiceProviderType::try_from(bytes[1])
-            .map_err(|_| ProtocolError::InvalidServiceProviderType(bytes[1]))?;
-
-        Ok(Self {
-            version,
-            service_provider_type,
-        })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use bincode::Options;
-
-    fn make_bincode_serializer() -> impl bincode::Options {
-        bincode::DefaultOptions::new()
-            .with_big_endian()
-            .with_varint_encoding()
-    }
-
-    #[test]
-    fn protocol_serialization() {
-        let protocol = Protocol {
-            version: 4,
-            service_provider_type: ServiceProviderType::NetworkRequester,
-        };
-
-        let serialized = make_bincode_serializer().serialize(&protocol).unwrap();
-        let deserialized: Protocol = make_bincode_serializer().deserialize(&serialized).unwrap();
-
-        assert_eq!(protocol, deserialized);
-    }
-
-    #[test]
-    fn compact_serialization() {
-        let protocol = Protocol {
-            version: 4,
-            service_provider_type: ServiceProviderType::NetworkRequester,
-        };
-
-        let serialized = make_bincode_serializer().serialize(&protocol).unwrap();
-        assert_eq!(serialized.len(), 2);
-    }
-
-    #[test]
-    fn protocol_deserialization() {
-        let bytes = [4, ServiceProviderType::NetworkRequester as u8];
-        let deserialized = Protocol::try_from(&bytes).unwrap();
-
-        let expected = Protocol {
-            version: 4,
-            service_provider_type: ServiceProviderType::NetworkRequester,
-        };
-
-        assert_eq!(expected, deserialized);
-    }
-
-    #[test]
-    fn invalid_protocol_deserialization() {
-        let bytes = [4, 3];
-        let deserialized = Protocol::try_from(&bytes);
-
-        assert!(deserialized.is_err());
-    }
-}
@@ -254,15 +254,6 @@ impl NymTopology {
        }
    }

-    pub fn with_additional_nodes<N>(mut self, nodes: impl Iterator<Item = N>) -> Self
-    where
-        N: TryInto<RoutingNode>,
-        <N as TryInto<RoutingNode>>::Error: Display,
-    {
-        self.add_additional_nodes(nodes);
-        self
-    }
-
    pub fn has_node_details(&self, node_id: NodeId) -> bool {
        self.node_details.contains_key(&node_id)
    }
@@ -462,10 +462,6 @@ pub struct ReplySurbsWasm {
    /// Defines the maximum number of reply surbs the client wants to keep in its storage at any times.
    pub maximum_reply_surb_storage_threshold: usize,

-    /// Defines the soft threshold ontop of the minimum reply surb storage threshold for when the client
-    /// should proactively request additional reply surbs.
-    pub minimum_reply_surb_threshold_buffer: usize,
-
    /// Defines the minimum number of reply surbs the client would request.
    pub minimum_reply_surb_request_size: u32,

@@ -494,9 +490,6 @@ pub struct ReplySurbsWasm {
    /// Defines how many mix nodes the reply surb should go through.
    /// If not set, the default value is going to be used.
    pub surb_mix_hops: Option<u8>,
-
-    /// Specifies if we should reset all the sender tags on startup
-    pub fresh_sender_tags: bool,
 }

 impl Default for ReplySurbsWasm {
@@ -510,7 +503,6 @@ impl From<ReplySurbsWasm> for ConfigReplySurbs {
        ConfigReplySurbs {
            minimum_reply_surb_storage_threshold: reply_surbs.minimum_reply_surb_storage_threshold,
            maximum_reply_surb_storage_threshold: reply_surbs.maximum_reply_surb_storage_threshold,
-            minimum_reply_surb_threshold_buffer: reply_surbs.minimum_reply_surb_threshold_buffer,
            minimum_reply_surb_request_size: reply_surbs.minimum_reply_surb_request_size,
            maximum_reply_surb_request_size: reply_surbs.maximum_reply_surb_request_size,
            maximum_allowed_reply_surb_request_size: reply_surbs
@@ -528,7 +520,6 @@ impl From<ReplySurbsWasm> for ConfigReplySurbs {
                reply_surbs.maximum_reply_key_age_ms as u64,
            ),
            surb_mix_hops: reply_surbs.surb_mix_hops,
-            fresh_sender_tags: reply_surbs.fresh_sender_tags,
        }
    }
 }
@@ -538,7 +529,6 @@ impl From<ConfigReplySurbs> for ReplySurbsWasm {
        ReplySurbsWasm {
            minimum_reply_surb_storage_threshold: reply_surbs.minimum_reply_surb_storage_threshold,
            maximum_reply_surb_storage_threshold: reply_surbs.maximum_reply_surb_storage_threshold,
-            minimum_reply_surb_threshold_buffer: reply_surbs.minimum_reply_surb_threshold_buffer,
            minimum_reply_surb_request_size: reply_surbs.minimum_reply_surb_request_size,
            maximum_reply_surb_request_size: reply_surbs.maximum_reply_surb_request_size,
            maximum_allowed_reply_surb_request_size: reply_surbs
@@ -552,7 +542,6 @@ impl From<ConfigReplySurbs> for ReplySurbsWasm {
            maximum_reply_surb_age_ms: reply_surbs.maximum_reply_surb_age.as_millis() as u32,
            maximum_reply_key_age_ms: reply_surbs.maximum_reply_key_age.as_millis() as u32,
            surb_mix_hops: reply_surbs.surb_mix_hops,
-            fresh_sender_tags: reply_surbs.fresh_sender_tags,
        }
    }
 }
@@ -339,11 +339,6 @@ pub struct ReplySurbsWasmOverride {
    #[tsify(optional)]
    pub maximum_reply_surb_storage_threshold: Option<usize>,

-    /// Defines the soft threshold ontop of the minimum reply surb storage threshold for when the client
-    /// should proactively request additional reply surbs.
-    #[tsify(optional)]
-    pub minimum_reply_surb_threshold_buffer: Option<usize>,
-
    /// Defines the minimum number of reply surbs the client would request.
    #[tsify(optional)]
    pub minimum_reply_surb_request_size: Option<u32>,
@@ -378,9 +373,6 @@ pub struct ReplySurbsWasmOverride {

    #[tsify(optional)]
    pub surb_mix_hops: Option<u8>,
-
-    /// Specifies if we should reset all the sender tags on startup
-    pub fresh_sender_tags: bool,
 }

 impl From<ReplySurbsWasmOverride> for ReplySurbsWasm {
@@ -394,9 +386,6 @@ impl From<ReplySurbsWasmOverride> for ReplySurbsWasm {
            maximum_reply_surb_storage_threshold: value
                .maximum_reply_surb_storage_threshold
                .unwrap_or(def.maximum_reply_surb_storage_threshold),
-            minimum_reply_surb_threshold_buffer: value
-                .minimum_reply_surb_threshold_buffer
-                .unwrap_or(def.minimum_reply_surb_threshold_buffer),
            minimum_reply_surb_request_size: value
                .minimum_reply_surb_request_size
                .unwrap_or(def.minimum_reply_surb_request_size),
@@ -419,7 +408,6 @@ impl From<ReplySurbsWasmOverride> for ReplySurbsWasm {
                .maximum_reply_key_age_ms
                .unwrap_or(def.maximum_reply_key_age_ms),
            surb_mix_hops: value.surb_mix_hops,
-            fresh_sender_tags: value.fresh_sender_tags,
        }
    }
 }
@@ -1470,9 +1470,9 @@ checksum = "6ea1a2d0a644769cc99faa24c3ad26b379b786fe7c36fd3c546254801650e6dd"

 [[package]]
 name = "schemars"
-version = "0.8.22"
+version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fbf2ae1b8bc8e02df939598064d22402220cd5bbcca1c76f7d6a310974d5615"
+checksum = "09c024468a378b7e36765cd36702b7a90cc3cba11654f6685c8f233408e89e92"
 dependencies = [
 "dyn-clone",
 "schemars_derive",
@@ -1482,9 +1482,9 @@ dependencies = [

 [[package]]
 name = "schemars_derive"
-version = "0.8.22"
+version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32e265784ad618884abaea0600a9adf15393368d840e0222d101a072f3f7534d"
+checksum = "b1eee588578aff73f856ab961cd2f79e36bc45d7ded33a7562adba4667aecc0e"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -122,7 +122,6 @@ exceptions = [
    { allow = ["GPL-3.0"], crate = "nym-network-requester" },
    { allow = ["GPL-3.0"], crate = "nym-node" },
    { allow = ["GPL-3.0"], crate = "nym-validator-rewarder" },
-    { allow = ["GPL-3.0"], crate = "nym-ip-packet-router" },
 ]

 # Some crates don't have (easily) machine readable licensing information,
@@ -7,6 +7,4 @@ package-lock.json

 # local env files
 .env*.local
-.env
-
-scratch.md
+.env
@@ -1,10 +0,0 @@
- Run synchronization against [pool.ntp.org](https://www.ntppool.org/en/):
-```bash
-ntpdate -q pool.ntp.org
-```
- Enable `ntp` service, start and review the status:
-```bash
-systemctl enable --now ntp
-service ntp start
-service ntp status
-```
@@ -1 +1 @@
-808_623_916
+807_251_217
@@ -1 +1 @@
-0.68%
+0.64%
@@ -1 +1 @@
-42.157
+44.332
@@ -1 +1 @@
-1_028_488
+1_025_628
@@ -1 +1 @@
-404_311_958
+403_625_608
@@ -1,7 +1,7 @@
 | **Item**           | **Description**                                       |   **Amount in NYM** |
 |:-------------------|:------------------------------------------------------|--------------------:|
 | Total Supply       | Maximum amount of NYM token in existence              |       1_000_000_000 |
-| Mixmining Reserve  | Tokens releasing for operators rewards                |         191_376_083 |
+| Mixmining Reserve  | Tokens releasing for operators rewards                |         192_748_782 |
 | Vesting Tokens     | Tokens locked outside of cicrulation for future claim |                   0 |
-| Circulating Supply | Amount of unlocked tokens                             |         808_623_916 |
-| Stake Saturation   | Optimal size of node self-bond + delegation           |           1_028_488 |
+| Circulating Supply | Amount of unlocked tokens                             |         807_251_217 |
+| Stake Saturation   | Optimal size of node self-bond + delegation           |           1_025_628 |
@@ -1 +1 @@
-Tuesday, March 11th 2025, 11:04:18 UTC
+Monday, February 3rd 2025, 13:47:19 UTC
@@ -16,10 +16,8 @@ Options:
          If this is a brand new nym-node, specify whether it should only be initialised without actually running the subprocesses [env: NYMNODE_INIT_ONLY=]
      --local
          Flag specifying this node will be running in a local setting [env: NYMNODE_LOCAL=]
-      --mode [<MODE>...]
-          Specifies the current mode(s) of this nym-node [env: NYMNODE_MODE=] [possible values: mixnode, entry-gateway, exit-gateway, exit-providers-only]
-      --modes <MODES>
-          Specifies the current mode(s) of this nym-node as a single flag [env: NYMNODE_MODES=] [possible values: mixnode, entry-gateway, exit-gateway, exit-providers-only]
+      --mode <MODE>
+          Specifies the current mode of this nym-node [env: NYMNODE_MODE=] [possible values: mixnode, entry-gateway, exit-gateway]
  -w, --write-changes
          If this node has been initialised before, specify whether to write any new changes to the config file [env: NYMNODE_WRITE_CONFIG_CHANGES=]
      --bonding-information-output <BONDING_INFORMATION_OUTPUT>
@@ -33,7 +31,7 @@ Options:
      --location <LOCATION>
          Optional **physical** location of this node's server. Either full country name (e.g. 'Poland'), two-letter alpha2 (e.g. 'PL'), three-letter alpha3 (e.g. 'POL') or three-digit numeric-3 (e.g. '616') can be provided [env: NYMNODE_LOCATION=]
      --http-bind-address <HTTP_BIND_ADDRESS>
-          Socket address this node will use for binding its http API. default: `[::]:8080` [env: NYMNODE_HTTP_BIND_ADDRESS=]
+          Socket address this node will use for binding its http API. default: `0.0.0.0:8080` [env: NYMNODE_HTTP_BIND_ADDRESS=]
      --landing-page-assets-path <LANDING_PAGE_ASSETS_PATH>
          Path to assets directory of custom landing page of this node [env: NYMNODE_HTTP_LANDING_ASSETS=]
      --http-access-token <HTTP_ACCESS_TOKEN>
@@ -45,29 +43,27 @@ Options:
      --expose-crypto-hardware <EXPOSE_CRYPTO_HARDWARE>
          Specify whether detailed system crypto hardware information should be exposed. default: true [env: NYMNODE_HTTP_EXPOSE_CRYPTO_HARDWARE=] [possible values: true, false]
      --mixnet-bind-address <MIXNET_BIND_ADDRESS>
-          Address this node will bind to for listening for mixnet packets default: `[::]:1789` [env: NYMNODE_MIXNET_BIND_ADDRESS=]
+          Address this node will bind to for listening for mixnet packets default: `0.0.0.0:1789` [env: NYMNODE_MIXNET_BIND_ADDRESS=]
      --mixnet-announce-port <MIXNET_ANNOUNCE_PORT>
          If applicable, custom port announced in the self-described API that other clients and nodes will use. Useful when the node is behind a proxy [env: NYMNODE_MIXNET_ANNOUNCE_PORT=]
      --nym-api-urls <NYM_API_URLS>
          Addresses to nym APIs from which the node gets the view of the network [env: NYMNODE_NYM_APIS=]
      --nyxd-urls <NYXD_URLS>
          Addresses to nyxd chain endpoint which the node will use for chain interactions [env: NYMNODE_NYXD=]
-      --enable-console-logging <ENABLE_CONSOLE_LOGGING>
-          Specify whether running statistics of this node should be logged to the console [env: NYMNODE_ENABLE_CONSOLE_LOGGING=] [possible values: true, false]
      --wireguard-enabled <WIREGUARD_ENABLED>
          Specifies whether the wireguard service is enabled on this node [env: NYMNODE_WG_ENABLED=] [possible values: true, false]
      --wireguard-bind-address <WIREGUARD_BIND_ADDRESS>
-          Socket address this node will use for binding its wireguard interface. default: `[::]:51822` [env: NYMNODE_WG_BIND_ADDRESS=]
+          Socket address this node will use for binding its wireguard interface. default: `0.0.0.0:51822` [env: NYMNODE_WG_BIND_ADDRESS=]
      --wireguard-announced-port <WIREGUARD_ANNOUNCED_PORT>
          Port announced to external clients wishing to connect to the wireguard interface. Useful in the instances where the node is behind a proxy [env: NYMNODE_WG_ANNOUNCED_PORT=]
      --wireguard-private-network-prefix <WIREGUARD_PRIVATE_NETWORK_PREFIX>
          The prefix denoting the maximum number of the clients that can be connected via Wireguard. The maximum value for IPv4 is 32 and for IPv6 is 128 [env: NYMNODE_WG_PRIVATE_NETWORK_PREFIX=]
      --verloc-bind-address <VERLOC_BIND_ADDRESS>
-          Socket address this node will use for binding its verloc API. default: `[::]:1790` [env: NYMNODE_VERLOC_BIND_ADDRESS=]
+          Socket address this node will use for binding its verloc API. default: `0.0.0.0:1790` [env: NYMNODE_VERLOC_BIND_ADDRESS=]
      --verloc-announce-port <VERLOC_ANNOUNCE_PORT>
          If applicable, custom port announced in the self-described API that other clients and nodes will use. Useful when the node is behind a proxy [env: NYMNODE_VERLOC_ANNOUNCE_PORT=]
      --entry-bind-address <ENTRY_BIND_ADDRESS>
-          Socket address this node will use for binding its client websocket API. default: `[::]:9000` [env: NYMNODE_ENTRY_BIND_ADDRESS=]
+          Socket address this node will use for binding its client websocket API. default: `0.0.0.0:9000` [env: NYMNODE_ENTRY_BIND_ADDRESS=]
      --announce-ws-port <ANNOUNCE_WS_PORT>
          Custom announced port for listening for websocket client traffic. If unspecified, the value from the `bind_address` will be used instead [env: NYMNODE_ENTRY_ANNOUNCE_WS_PORT=]
      --announce-wss-port <ANNOUNCE_WSS_PORT>
@@ -1,5 +0,0 @@
-
-{
-  "mainnet":"Mainnet Endpoints",
-  "sandbox":"Sandbox Endpoints"
-}
@@ -1,5 +0,0 @@
-
-{
-  "mainnet":"Mainnet Endpoints",
-  "sandbox":"Sandbox Endpoints"
-}
@@ -1,8 +1,11 @@
 import { Callout } from 'nextra/components'

 # Node Status API
-The Node Status API serves information about individual `nym-nodes` in the Mixnet, such as which role they are operating in, statistics about them, services such as Network Requesters, as well as summaries of the state of the Mixnet.
+
+The Node Status API contains information about the network, its topology, and the routing scores of all nodes within it. It offers broadly similar information to the experimental [Habourmaster frontend](https://harbourmaster.nymtech.net/) but is stable where the Harbourmaster is subject to sudden changes as we modify and experiment with how we scrape and present data about the Mixnet infrastructure.

 <Callout type="info">
-We recommend that developers building applications such as explorers or analytics interfaces about the Mixnet run their own instance of the API, in order to promote a robust network of downstream services, and spread the load of API calls amongst as many endpoints as possible.
+People building applications or dashboards which requires information about nodes, their uptime, and their delegations should use this instead of Habourmaster.
 </Callout>
+
+The code for this service can be found [in our monorepo](https://github.com/nymtech/nym/tree/develop/nym-node-status-api). In the future we will encourage developers to run their own instance of this API in order to distribute endpoints and query load.
@@ -1,5 +0,0 @@
-{
-  "ns-api-run-deploy":"Run Instance",
-  "mainnet":"Mainnet Endpoints",
-  "sandbox":"Sandbox Endpoints"
-}
@@ -1,11 +1,9 @@
 import { RedocStandalone } from 'redoc';
-import { Callout } from 'nextra/components'

 The information below is generated with [Redoc](https://redocly.com/docs/redoc) consuming the OpenAPI spec found at [https://mainnet-node-status-api.nymtech.cc/api-docs/openapi.json](https://mainnet-node-status-api.nymtech.cc/api-docs/openapi.json) which is also used to generate the Swagger docs deployed at [https://mainnet-node-status-api.nymtech.cc/swagger/](https://mainnet-node-status-api.nymtech.cc/swagger/).

 <br /><br />

-
 <RedocStandalone
  specUrl="https://mainnet-node-status-api.nymtech.cc/api-docs/openapi.json"
  options={{
@@ -1,336 +0,0 @@
-import { Callout } from 'nextra/components'
-import { AccordionTemplate } from 'components/accordion-template.tsx'
-
-# NS API: Deployment Guide
-
-## Components
-The Node Status API is made up of 3 components:
- `nym-node-status-api`
- `nym-node-status-client`
- `nym-node-status-agent`
-
-The API stores its data in a local SQLite database. It periodically gets most of its data from a [NymAPI](./nym-api) instance, and for instances also running with the Gateway Probe, uses the stored topology to conduct performance probe tests.
-
-## Gateway Probe
-You can run the `nym-node-status-api` alone, but if you want to run probes for `nym-node`s running as Gateways, you have to also run the `nym-node-status-agent` (which consumes the `nym-node-status-client` lib). The probe will run a set of tests per Gateway node, and return the sort of results seen [here](https://harbourmaster.nymtech.net/gateway/23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb).
-
-## UI
-The API exposes a [Swagger](https://swagger.io/docs/) documentation UI by default on port `8000` (see an example [here](https://mainnet-node-status-api.nymtech.cc/swagger/)).
-
-Currently we are not shipping a custom UI component for the Node Status API. The [Harbourmaster](https://harbourmaster.nymtech.net/) frontend consumes this API, amongst other things, but this is an internal repo we use to experiment with new APIs and data on, so it is not public yet.
-
-<Callout type="info">
-We invite developers to roll their own UI for their Node Status API instance.
-</Callout>
-
-## Docker Images
-We will ship Docker images for both the `agent` and `api` in the future. There are Docker images for both in root of each corresponding crate ([`agent`](https://github.com/nymtech/nym/blob/09ea406c02e9a3beebc062f525e4ea1b4222dcbb/nym-node-status-api/nym-node-status-agent/Dockerfile), [`api`](https://github.com/nymtech/nym/blob/develop/nym-node-status-api/nym-node-status-api/Dockerfile)) which are used internally, which could be a starting point for developers to dockerize their instance for the moment.
-
-## Build
-### Prerequisites
- Rust
- SQLite
- Get an `ipinfo` key following instructions [here](https://github.com/ipinfo/rust?tab=readme-ov-file#getting-started).
-
-### Compilation
-```shell
-cargo build --release --package nym-node-status-api --package nym-node-status-agent --package nym-node-status-client
-```
-
-## Run
-Since the Node Status API depends on both flags and environmental variables, it might be easier to run the binary via a script like the one below - this this script essentially just `source`-s the defined `.env` file after exporting certain binary-specific variables, and then runs the binary. You can find the `.env` files [here](https://github.com/nymtech/nym/tree/master/envs).
-
-<Callout type="info">
-    All CLI flags are configurable as environmental variables and vice versa, so take the following scripts / setups as guides that you can change however best suits your setup. You can see all definitions [here](https://github.com/nymtech/nym/blob/develop/nym-node-status-api/nym-node-status-api/src/cli/mod.rs#L14).
-</Callout>
-
-```bash
-#!/bin/bash
-
-set -e
-
-export ENVIRONMENT=${ENVIRONMENT:-"mainnet"} # see nym/envs/ for all possible environments
-export NYM_API_CLIENT_TIMEOUT=60
-export NODE_STATUS_API_TESTRUN_REFRESH_INTERVAL=120
-export IPINFO_API_TOKEN=<YOUR_IPINFO_API_KEY>
-
-monorepo_root=<PATH/TO/NYM/>
-set -a
-source "${monorepo_root}/envs/${ENVIRONMENT}.env"
-echo ${monorepo_root}/envs/${ENVIRONMENT}.env
-set +a
-export RUST_LOG=${RUST_LOG:-debug} # debug is useful to check everything is working initially, but quite verbose
-
-echo "Verifying environment variables were properly sourced:"
-echo "RUST_LOG=${RUST_LOG}"
-echo "BECH32_PREFIX=${BECH32_PREFIX}"
-echo "NETWORK_NAME=${NETWORK_NAME}"
-
-<PATH/TO/>nym-node-status-api -- --ipinfo-api-token $IPINFO_API_TOKEN
-```
-
-### Functionality Without Gateway Probe
-Data will be restricted to information that doesn't involve Probe results; `routing` and `config` scores will be `0` and `last_probe` results `null`, as you can see in this snipped output of the `gateways` endpoint:
-
-<AccordionTemplate name="Output">
-```shell
-{
-      "gateway_identity_key": "23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb",
-      "bonded": true,
-      "performance": 99,
-      "self_described": {
-        "authenticator": {
-          "address": "6Gdtw13Fa46AvkqkHELZZCMKWASDodoJeK9APRNpjjdj.7ji8DDkpjA2AdgwK7wbZm8yi4xZGogGJeypBQt4hAw3P@23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb"
-        },
-        "auxiliary_details": {
-          "accepted_operator_terms_and_conditions": true,
-          "announce_ports": {
-            "mix_port": null,
-            "verloc_port": null
-          },
-          "location": null
-        },
-        "build_information": {
-          "binary_name": "nym-node",
-          "build_timestamp": "2025-02-13T11:49:34.670488195Z",
-          "build_version": "1.5.0",
-          "cargo_profile": "release",
-          "cargo_triple": "x86_64-unknown-linux-gnu",
-          "commit_branch": "HEAD",
-          "commit_sha": "a3e19b4563843055b305ea9a397eb1ad84b5c378",
-          "commit_timestamp": "2025-02-10T18:14:47.000000000+01:00",
-          "rustc_channel": "stable",
-          "rustc_version": "1.84.1"
-        },
-        "declared_role": {
-          "entry": true,
-          "exit_ipr": true,
-          "exit_nr": true,
-          "mixnode": false
-        },
-        "host_information": {
-          "hostname": "bwng1.bwnym.xyz",
-          "ip_address": [
-            "95.164.2.86"
-          ],
-          "keys": {
-            "ed25519": "23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb",
-            "x25519": "H6pFjqtdSVxkxEQ3wFnuSoobDAUqHx1bYMVJzPZdRByn",
-            "x25519_noise": null
-          }
-        },
-        "ip_packet_router": {
-          "address": "7ms2D2uYiTuhX6MKeVL5rz5usgehEoxAAovwYm9nJyBF.3siMjk3wTU7ykaXLNi9c7LpX8yonYKPCA4BQoMwhsfTV@23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb"
-        },
-        "last_polled": "2025-03-03 09:48:03.635274187 +00:00:00",
-        "mixnet_websockets": {
-          "ws_port": 9000,
-          "wss_port": 9001
-        },
-        "network_requester": {
-          "address": "HuNL1pFprNSKW6jdqppibXP5KNKCNJxDh7ivpYcoULN9.C62NahRTUf6kqpNtDVHXoVriQr6yyaU5LtxdgpbsGrtA@23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb",
-          "uses_exit_policy": true
-        },
-        "wireguard": {
-          "port": 51822,
-          "public_key": "6o8x9GitFjcrkjrJnivWaQCPnxXykQPYLneNr2FEB8Vq"
-        }
-      },
-      "explorer_pretty_bond": {
-        "identity_key": "23A7CSaBSA2L67PWuFTPXUnYrCdyVcB7ATYsjUsfdftb",
-        "location": {
-          "latitude": 52.5083,
-          "longitude": 5.475,
-          "two_letter_iso_country_code": "NL"
-        },
-        "owner": "n1cp5gq0apat6c7qmenqp5zjprn2vwvc7jl29j8r",
-        "pledge_amount": {
-          "amount": "100000000",
-          "denom": "unym"
-        }
-      },
-      "description": {
-        "moniker": "bwn_g1",
-        "website": "https://bwnym.xyz",
-        "security_contact": "bwnym@proton.me",
-        "details": "This gateway is part of the NYM project, which is dedicated to create outstanding privacy software that is legally compliant without sacrificing integrity or having any backdoors."
-      },
-      "last_probe_result": null,
-      "last_probe_log": null,
-      "last_testrun_utc": null,
-      "last_updated_utc": "2025-03-03T10:45:48+00:00",
-      "routing_score": 0.0,
-      "config_score": 0
-    },
-```
-</AccordionTemplate>
-
-If you have already run the API before, make sure to add the following to your script `--database-url "sqlite://node-status-api.sqlite?mode=rwc` so it will continue using the same DB.
-
-### Functionality with Gateway Probe
-If you want to enable Gateway node probes and have the NS API store that data, you need to periodically run the `nym-node-status-agent`, authenticated with your `nym-node-status-api` instance. Authentication is to make sure that only the `-agent` you are operating (or others you trust) are submitting data to your API instance.
-
-#### Compile Gateway Probe
-The `nym-node-status-agent` is a thin wrapper around the Gateway Probe binary which currently is in the NymVPN repo. `git checkout` to the most recent [release](https://github.com/nymtech/nym-vpn-client/releases), and compile the probe by following the [readme instructions](https://github.com/nymtech/nym-vpn-client/tree/develop/nym-vpn-core/crates/nym-gateway-probe). You will point the `-agent` at this binary when doing Probe testruns.
-
-#### Generate Keypair
-```shell
-<PATH/TO/>nym-node-status-agent generate-keypair --path <PATH/TO/KEY/FILE/TO/GENERATE>/<KEY_NAME>
-# e.g.
-# nym-node-status-agent generate-keypair --path ~/.ssh/ns-agent-key
-```
-
-You will then want to export the generated `public-key` so its accessible to the `nym-node-status-api` however you are setting your environmental variables, as `NODE_STATUS_API_AGENT_KEY_LIST`:
-
-```bash
-export NODE_STATUS_API_AGENT_KEY_LIST=<YOUR_KEY> # e.g. "H4z8kx5Kkf5JNQHfxaE1MwRndjDCD1C7HsVhHTFfBZ4J"
-```
-
-In this situation, you are probably only using one key. However, it is possible to set multiple keys as a comma seperated list, in case you wish to whitelist multiple `-agent`s to be able to submit to a single `-api` instance.
-
-#### Run the Node Status Agent
-```shell
-<PATH/TO/>nym-node-status-agent run-probe --server-address http://127.0.0.1 --server-port 8000 --ns-api-auth-key "<NS_AGENT_PRIVATE_KEY>" --probe-path <PATH/TO/> nym-gateway-probe
-```
-
-You will see a lot of output like so:
-
-<AccordionTemplate name="Output">
-```shell
-listen_port=48586
-public_key=3f95caf771b8a63b9bdae6c186f7aba2eae93483f1c82c0243b5e00c85b4ec26
-preshared_key=0000000000000000000000000000000000000000000000000000000000000000
-protocol_version=1
-endpoint=185.186.78.251:51822
-last_handshake_time_sec=0
-last_handshake_time_nsec=0
-tx_bytes=0
-rx_bytes=0
-persistent_keepalive_interval=0
-allowed_ip=0.0.0.0/0
-2025/03/03 18:58:28 Pinging nymtech.net seq=0
-2025/03/03 18:58:29 Ping latency: 44.503483ms
-2025/03/03 18:58:29 Pinging nymtech.net seq=1
-2025/03/03 18:58:29 Ping latency: 42.852414ms
-2025/03/03 18:58:29 Pinging nymtech.net seq=2
-2025/03/03 18:58:29 Ping latency: 43.627256ms
-2025/03/03 18:58:29 Pinging nymtech.net seq=3
-2025/03/03 18:58:29 Ping latency: 43.638839ms
-2025/03/03 18:58:29 Pinging nymtech.net seq=4
-2025/03/03 18:58:29 Ping latency: 43.345357ms
-2025/03/03 18:58:29 Pinging 1.1.1.1 seq=0
-2025/03/03 18:58:29 Ping latency: 46.327233ms
-2025/03/03 18:58:34 Pinging 1.1.1.1 seq=1
-2025/03/03 18:58:34 Ping latency: 46.273726ms
-2025/03/03 18:58:39 Pinging 1.1.1.1 seq=2
-2025/03/03 18:58:39 Ping latency: 46.542774ms
-2025/03/03 18:58:44 Pinging 1.1.1.1 seq=3
-2025/03/03 18:58:44 Ping latency: 45.663545ms
-2025/03/03 18:58:49 Pinging 1.1.1.1 seq=4
-2025/03/03 18:58:49 Ping latency: 43.803063ms
-2025/03/03 18:58:56 Downloaded file content length: 1.00 MB
-2025/03/03 18:58:56 Download duration: 1.308072386s
-2025/03/03 18:58:56 private_key=1083749e43f4f8fb008f3f7deef9107ef86a68969670ddbb9f07bf85f94fb564
-listen_port=39129
-public_key=3f95caf771b8a63b9bdae6c186f7aba2eae93483f1c82c0243b5e00c85b4ec26
-preshared_key=0000000000000000000000000000000000000000000000000000000000000000
-protocol_version=1
-endpoint=185.186.78.251:51822
-last_handshake_time_sec=0
-last_handshake_time_nsec=0
-tx_bytes=0
-rx_bytes=0
-persistent_keepalive_interval=0
-allowed_ip=::/0
-2025/03/03 18:58:56 Pinging ipv6.google.com seq=0
-2025/03/03 18:58:56 Ping latency: 42.839528ms
-2025/03/03 18:58:56 Pinging ipv6.google.com seq=1
-2025/03/03 18:58:56 Ping latency: 54.844651ms
-2025/03/03 18:58:56 Pinging ipv6.google.com seq=2
-2025/03/03 18:58:56 Ping latency: 51.23104ms
-2025/03/03 18:58:56 Pinging ipv6.google.com seq=3
-2025/03/03 18:58:56 Ping latency: 43.320409ms
-2025/03/03 18:58:56 Pinging ipv6.google.com seq=4
-2025/03/03 18:58:56 Ping latency: 63.517358ms
-2025/03/03 18:58:56 Pinging 2001:4860:4860::8888 seq=0
-2025/03/03 18:58:56 Ping latency: 54.682534ms
-2025/03/03 18:59:01 Pinging 2001:4860:4860::8888 seq=1
-2025/03/03 18:59:01 Ping latency: 55.56235ms
-2025/03/03 18:59:06 Pinging 2001:4860:4860::8888 seq=2
-2025/03/03 18:59:06 Ping latency: 55.970418ms
-2025/03/03 18:59:11 Pinging 2001:4860:4860::8888 seq=3
-2025/03/03 18:59:14 Failed to send ping: i/o timeout
-2025/03/03 18:59:19 Pinging 2001:4860:4860::8888 seq=4
-2025/03/03 18:59:22 Failed to send ping: i/o timeout
-2025/03/03 18:59:27 Pinging 2606:4700:4700::1111 seq=0
-2025/03/03 18:59:27 Ping latency: 45.072616ms
-2025/03/03 18:59:32 Pinging 2606:4700:4700::1111 seq=1
-2025/03/03 18:59:32 Ping latency: 44.357306ms
-2025/03/03 18:59:37 Pinging 2606:4700:4700::1111 seq=2
-2025/03/03 18:59:37 Ping latency: 44.013562ms
-2025/03/03 18:59:42 Pinging 2606:4700:4700::1111 seq=3
-2025/03/03 18:59:42 Ping latency: 46.94342ms
-2025/03/03 18:59:47 Pinging 2606:4700:4700::1111 seq=4
-2025/03/03 18:59:48 Ping latency: 43.372288ms
-2025/03/03 18:59:53 Pinging 2620:fe::fe seq=0
-2025/03/03 18:59:53 Ping latency: 42.164952ms
-2025/03/03 18:59:58 Pinging 2620:fe::fe seq=1
-2025/03/03 18:59:58 Ping latency: 42.295812ms
-2025/03/03 19:00:03 Pinging 2620:fe::fe seq=2
-2025/03/03 19:00:03 Ping latency: 43.117534ms
-2025/03/03 19:00:08 Pinging 2620:fe::fe seq=3
-2025/03/03 19:00:08 Ping latency: 44.26068ms
-2025/03/03 19:00:13 Pinging 2620:fe::fe seq=4
-2025/03/03 19:00:13 Ping latency: 45.29956ms
-2025/03/03 19:00:21 Downloaded file content length: 10.00 MB
-2025/03/03 19:00:21 Download duration: 3.39529252s
-```
-</AccordionTemplate>
-
-Whilst you can run the `-agent` directly, it might be easier to run multiple instances in parallel with a script like so:
-
-```bash
-#!/bin/bash
-
-set -eu
-export ENVIRONMENT=${ENVIRONMENT:-"mainnet"}
-
-probe_git_ref="nym-vpn-core-v1.4.0" # check for the most recent release
-monorepo_root=<PATH/TO/NYM/>
-
-set -a
-source "${monorepo_root}/envs/${ENVIRONMENT}.env"
-set +a
-
-export RUST_LOG="info"
-export NODE_STATUS_AGENT_SERVER_ADDRESS="http://127.0.0.1"
-export NODE_STATUS_AGENT_SERVER_PORT="8000"
-export NODE_STATUS_AGENT_AUTH_KEY=<NS_AGENT_PRIVATE_KEY>
-export NODE_STATUS_AGENT_PROBE_EXTRA_ARGS="netstack-download-timeout-sec=30,netstack-num-ping=2,netstack-send-timeout-sec=1,netstack-recv-timeout-sec=1"
-
-workers=${1:-1}
-echo "Running $workers workers in parallel"
-
-function swarm() {
-  local workers=$1
-
-  for ((i = 1; i <= workers; i++)); do
-    ${monorepo_root}/target/release/nym-node-status-agent run-probe --probe-path ~/<PATH/TO>/nym-vpn-client/nym-vpn-core/target/debug/nym-gateway-probe &
-  done
-
-  wait
-
-  echo "All agents completed"
-}
-
-swarm $workers
-```
-
-And run specifying the number of workers with `./<SCRIPT_NAME>.sh <NUMBER_OF_WORKERS>`.
-
-<Callout type="info">
-When running the probe, use logging level `RUST_LOG=info`. The Node Status API relies on that granularity for parsing probe results, and the logs grow incessantly if a lower level (e.g. `DEBUG`) is used.
-</Callout>
-
-### Ports
-By default the API listens on `8000`, so you will need to configure this post to be reachable on your remote server. You can modify this with the `--http_port` flag.
@@ -1,3 +0,0 @@
-{
-  "mainnet":"Mainnet Endpoints"
-}
@@ -47,218 +47,6 @@ This page displays a full list of all the changes during our release cycle from

 <VarInfo />

-## `v2025.4-dorina-patched`
-
-Patched version of `dorina` with a few fixes and tweaks to the release. We would like to ask `nym-node` operators to upgrade to this version as quickly as possible to implement the fixes across the network and improve general quality before NymVPN launch. 
-
- [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.4-dorina-patched)
- [`nym-node`](nodes/nym-node.mdx) version `1.6.2`
-
-```shell
-nym-node
-Binary Name:        nym-node
-Build Timestamp:    2025-03-06T20:32:36.922212778Z
-Build Version:      1.6.2
-Commit SHA:         247ebb7c4339de0a298a7fcb2574122a8306c3b8
-Commit Date:        2025-03-06T21:26:16.000000000+01:00
-Commit Branch:      HEAD
-rustc Version:      1.85.0
-rustc Channel:      stable
-cargo Profile:      release
-```
-
- Use legacy crypto for constructing SURB headers ([#5579])
- Bugfix: make sure to correctly decode response content when putting it into error message ([#5571])
- Tweak surb management to be more conservative ([#5570])
- Deserialize v5 authenticator requests ([#5568])
- Chore: additional logs when attempting to load ecash keys ([#5567])
- Add full response body to error message upon decoding failure ([#5566])
- Hotfix: ensure we bail on merkle leaves insertion upon missing data ([#5565])
- Feature: v2 authentication request (#5537) ([#5563])
- Create authenticator v5 request/response types ([#5561])
-
-[#5579]: https://github.com/nymtech/nym/pull/5579
-[#5571]: https://github.com/nymtech/nym/pull/5571
-[#5570]: https://github.com/nymtech/nym/pull/5570
-[#5568]: https://github.com/nymtech/nym/pull/5568
-[#5567]: https://github.com/nymtech/nym/pull/5567
-[#5566]: https://github.com/nymtech/nym/pull/5566
-[#5565]: https://github.com/nymtech/nym/pull/5565
-[#5563]: https://github.com/nymtech/nym/pull/5563
-[#5561]: https://github.com/nymtech/nym/pull/5561
-
-
-## `v2025.4-dorina`
- [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.4-dorina)
- [`nym-node`](nodes/nym-node.mdx) version `1.6.0`
-```shell
-Binary Name:        nym-node
-Build Timestamp:    2025-03-04T09:03:11.322601809Z
-Build Version:      1.6.0
-Commit SHA:         7060fa6dad58f17543f5086c73b1854ad1ceae60
-Commit Date:        2025-03-03T17:24:10.000000000Z
-Commit Branch:      release/2025.4-dorina
-rustc Version:      1.86.0-nightly
-rustc Channel:      nightly
-cargo Profile:      release
-```
-
-### Operators Updates & Tools
-
- New advanced [guide to virtualise a dedicated server](nodes/preliminary-steps/vps-setup/advanced), providing steps for experienced operators and aspiring sys-admins who seek for higher optimisation and better efficiency of their work orchestrating multiple nodes.
- New Service Grant program is being implemented by operators setting up new ~150 Exit Gateways following the updated [specs for `nym-node`](nodes#minimum-requirements)
-
-### Features
- [Feature/chain status api](https://github.com/nymtech/nym/pull/5539):
-this PR introduces `/v1/network/chain-status` endpoint on nym api to give basic information about the current block as seen by this API (with some caching) and updates `/health` endpoint to give stall information.
-
- [Add SURBs soft threshold](https://github.com/nymtech/nym/pull/5535): the IPR should try to keep a buffer of available SURBs to reduce latency.
-
- [Simplify IPR v8](https://github.com/nymtech/nym/pull/5532): purge stuff from IPR v8 to simplify; use protocol field in v8.
-
- [Shared instance for DNS AsyncResolver](https://github.com/nymtech/nym/pull/5523):
-make the `HickoryDnsResolver` use a shared instance by default to limit fd use. Now the multiple `nym_http_api_client::Client`s that get built should take advantage of a shared connection pool for DNS lookups. If for some reason a client does need an independent AsyncResolver this can still be done with the added `thread_resolver`  function.
-
- [cherry-pick 17d3ff2d775f61aee381d90a304ed416c08f33fc onto dorina](https://github.com/nymtech/nym/pull/5519)
-
- [cherry-pick 6e5d0dac1b75413c5f09122b0d953f8ec6ef48df onto dorina](https://github.com/nymtech/nym/pull/5518)
-
- [feat: add config option for maximum number of client connections](https://github.com/nymtech/nym/pull/5513)
-
- [IPR request types v8](https://github.com/nymtech/nym/pull/5498): Bump IPR request/response types to v8
-
- [Support static routes for HTTP requests](https://github.com/nymtech/nym/pull/5487)
-
- [added missing import to doctest](https://github.com/nymtech/nym/pull/5480)
-
- [adjusted TestSetup::new_complex to ensure bonded node's existence](https://github.com/nymtech/nym/pull/5478)
-
- [Trigger contracts CI on main workspace Cargo changes](https://github.com/nymtech/nym/pull/5477): since the contracts workspace depends on the common code in the main workspace, and since the contracts are critical to not have regressions in, trigger contracts CI on any changes to the workspace Cargo.toml and lock files.
-
- [Run cargo autoinherit](https://github.com/nymtech/nym/pull/5460): run `cargo autoinherit` to move a bunch of dependencies to the workspace level. `Cargo.lock` remains untouched.
-
- [Disable debug in wasm and wallet workflows too](https://github.com/nymtech/nym/pull/5459)
-
- [Fix clippy::precedence](https://github.com/nymtech/nym/pull/5457): fix clippy warnings for the Rust beta toolchain.
-
- [Provide Interval context with node descriptor endpoints](https://github.com/nymtech/nym/pull/5456): add current interval context information to existing enpoints using `build_skimmed_nodes_response` under the hood. This allows clients checking for a refresh to send the `epoch_uid` as a query parameter when fetching updates so the server can tell it that there have been no changes, instead of sending duplicate data over and over. The changes in this PR should be backwards compatible and never interfere with existing clients. The additions to the `NodeParams` are optional, so there is no error if a client does not send them. Old clients will not send `epoch_uid` by accident so they cannot accidentally clear their set of known nodes. In the response the status field is optional so if it is missing (e.g. if a new client talks to an old server) the connection still works. For old clients speaking to new servers, the json parsing will simply ignore extra information not included in the objects json spec.
-
-<AccordionTemplate name={<TestingSteps/>}>
-
- Made a request to the `/api/v1/unstable/nym-nodes/semi-skimmed` endpoint:
- - without entering an epoch_id
- - with entering the current epoch_id
- - with entering an old epoch_id
- - with entering a future epoch_id
- All results returned the same data, as expected
-
-</AccordionTemplate>
-
- [Feature/add gbp currency](https://github.com/nymtech/nym/pull/5453)
-
- [Add helper to extract a list of sqlite files with journal files wal/shm](https://github.com/nymtech/nym/pull/5452)
-
- [Add a middleware layer to the nym api allowing for data compression](https://github.com/nymtech/nym/pull/5451): after Testing in a minimal example, this does work as expected. Routes still default to plain encoding, however if a client indicates support for a compressed encoding using the `Accept-Encoding` header then the served response will be compressed with the appropriate `Content-Encoding` header. ([Proof-of-Concept](https://gist.github.com/jmwample/c15a983e804fc338fee3d1b037d216b0))
-
-<AccordionTemplate name={<TestingSteps/>}>
- Sent requests with and without Accept-Encoding: gzip to observe response behaviour
- Verified if responses included content-encoding: gzip when compression was requested
- Checked response file output to confirm actual compression occurred
-</AccordionTemplate>
-
- [Condense core API functionalities and enable gzip decompression for reqwest payloads](https://github.com/nymtech/nym/pull/5450): this PR is intended to take out variables from our usage of HTTP requests in the `nym-http-api-client`. To do this the PR: (1) adds the `ApiClientCore` trait with the minimal feature required to send a request, (2) turns all request sending into trait extension automatically implemented for any type that implements `ApiClientCore`. This has the benefit of consistent expected behavior for all clients using `nym-http-api-client`, including features added going forward. FOR EXAMPLE this pr adds a default header `"accept-encoding: gzip;q=1.0, *;q=0.5"` which indicates that compression is preferred whenever available. Other features to keep in mind here are things like configurable retries, domain fallbacks, etc. Note: the `Apiclient` interface could be simplified, but that would require refactoring our downstream usages of the API. For now this isn't necessary as `ApiClient` is implemented automatically so it costs nothing to have it this way. It just allows divergent usage in downstream crates.
-
-<AccordionTemplate name={<TestingSteps/>}>
- Measured nym-api response times before and after updating the API client using curl
- Checked if the client automatically decompressed Gzip responses
-</AccordionTemplate>
-
- [Seedable clients](https://github.com/nymtech/nym/pull/5440): Adds `DerivationMaterial` and accompanying methods to builders. `DerivationMaterial` encapsulates parameters for deterministic key derivation using HKDF (SHA-512). Use the `derive_secret()` method to generate a 32-byte secret. To prepare for a new derivation, call the `next()` method which increments the index. **It is the caller's responsibility to track and persist the derivation index if keys need to be rederived.**
-
-<AccordionTemplate name="Example">
-
- ```rust
- let master_key = [0u8; 32]; // your secret master key
- let salt = "unique-salt-value".to_string();
- let material = DerivationMaterial::new(master_key, 0, salt.as_bytes());
-
- // Derive a secret
- let secret = material.derive_secret().expect("Failed to derive secret");
-
- // Prepare for the next derivation
- let next_material = material.next();
- ```
-
-</AccordionTemplate>
-
- [Remove all recv_with_delay and add shutdown condition to loops in client-core](https://github.com/nymtech/nym/pull/5435): inside client-core we want to prepare the ground for moving a behaviour close to what we have in the vpn client. Remove all the recv_with_delay since we want to just stop. Add shutdown condition to all select loops to guard against the shutdown listener being polled inside the select blocks. Remove unwraps when sending on unbounded channels in case the receiver exits before the sender. Move `TaskClient` to be a member field so make it easier to wrap log errors in a shutdown check. Update all fork names to use underscore consistently, since the task separator is hyphen
-
-<AccordionTemplate name={<TestingSteps/>}>
- Validated that all binaries including `nym-node`, `nym-client`, `nym-network-requester`, and `nym-socks5-client` are behaving well without indicating the presence of any unexpected errors or crashes
-</AccordionTemplate>
-
- [Disable the test for checking the remaining bandwidth in nym-node-status-api](https://github.com/nymtech/nym/pull/5425): this check fails almost every time on CI, possibly due to rate limiting? It's not good to disable the check, but it's blocking CI as it stands now. Given that we have the check above for locating the ip, we at least have a little coverage.
-
- [Dz nym node stats](https://github.com/nymtech/nym/pull/5418): removed obsolete fields from stats (blacklisted mixnodes, blacklisted gateways, bonded mixnodes, bonded gateways). Introduced nym-node scraping, beside just mixnodes. `/mixnodes/stats` now returns data for nym-nodes as well, which results in much more accurate "packets mixed" stats.
-
- [Nymnode entrypoint docker](https://github.com/nymtech/nym/pull/5300)
-
-### Bugfix
- [bugfix: dont query for ecash apis unless necessary when spending ticketbooks](https://github.com/nymtech/nym/pull/5508)
-
- [bugfix: bound check when recovering a reply SURB](https://github.com/nymtech/nym/pull/5502)
-
- [fix: update fx average rate calcs to ignore 0 values](https://github.com/nymtech/nym/pull/5454)
-
-### Chore
- [chore: workspace global panic preventing lints](https://github.com/nymtech/nym/pull/5512)
-
- [chore: removed all old coconut code](https://github.com/nymtech/nym/pull/5500)
-
- [build(deps): bump the patch-updates group across 1 directory with 3 updates](https://github.com/nymtech/nym/pull/5482): updates `clap` from 4.5.28 to 4.5.30, updates `clap` from 4.5.28 to 4.5.30, updates `prost` from 0.13.4 to 0.13.5.
-
- [build(deps): bump http from 1.1.0 to 1.2.0](https://github.com/nymtech/nym/pull/5472)
-
- [build(deps): bump utoipa-swagger-ui from 8.0.3 to 8.1.0](https://github.com/nymtech/nym/pull/5471)
-
- [build(deps): bump colored from 2.1.0 to 2.2.0](https://github.com/nymtech/nym/pull/5470)
-
- [build(deps): bump celes from 2.4.0 to 2.5.0](https://github.com/nymtech/nym/pull/5469)
-
- [build(deps): bump the patch-updates group with 2 updates](https://github.com/nymtech/nym/pull/5467): updates `clap` from 4.5.28 to 4.5.29, updates `prost` from 0.13.4 to 0.13.5.
-
- [build(deps): bump elliptic from 6.5.4 to 6.6.1 in /docker/typescript_client/upload_contract](https://github.com/nymtech/nym/pull/5463): bumps [elliptic](https://github.com/indutny/elliptic) from 6.5.4 to 6.6.1.
-
- [build(deps): bump uniffi_build from 0.25.3 to 0.29.0](https://github.com/nymtech/nym/pull/5448)
-
- [Upgrade tower to 0.5.2](https://github.com/nymtech/nym/pull/5446)
-
- [build(deps): bump hickory-proto from 0.24.2 to 0.24.3 in /nym-wallet](https://github.com/nymtech/nym/pull/5445)
-
- [build(deps): bump hickory-proto from 0.24.2 to 0.24.3](https://github.com/nymtech/nym/pull/5444)
-
- [build(deps): bump the patch-updates group across 1 directory with 10 updates](https://github.com/nymtech/nym/pull/5439):
-Bumps the patch-updates group with 10 updates in the directory:
-
-| Package | From | To |
-| --- | --- | --- |
-| [async-trait](https://github.com/dtolnay/async-trait) | `0.1.85` | `0.1.86` |
-| [clap](https://github.com/clap-rs/clap) | `4.5.27` | `4.5.28` |
-| [comfy-table](https://github.com/nukesor/comfy-table) | `7.1.3` | `7.1.4` |
-| [hickory-resolver](https://github.com/hickory-dns/hickory-dns) | `0.24.2` | `0.24.3` |
-| [once_cell](https://github.com/matklad/once_cell) | `1.20.2` | `1.20.3` |
-| [pin-project](https://github.com/taiki-e/pin-project) | `1.1.8` | `1.1.9` |
-| [serde_json_path](https://github.com/hiltontj/serde_json_path) | `0.7.1` | `0.7.2` |
-| [toml](https://github.com/toml-rs/toml) | `0.8.19` | `0.8.20` |
-| [cosmrs](https://github.com/cosmos/cosmos-rust) | `0.21.0` | `0.21.1` |
-| [tokio-postgres](https://github.com/sfackler/rust-postgres) | `0.7.12` | `0.7.13` |
-
- [build(deps): bump openssl from 0.10.56 to 0.10.70 in /nym-wallet](https://github.com/nymtech/nym/pull/5422)
-
- [build(deps): bump hyper from 1.4.1 to 1.6.0](https://github.com/nymtech/nym/pull/5416)
-
- [build(deps): bump publicsuffix from 2.2.3 to 2.3.0](https://github.com/nymtech/nym/pull/5367)
-
 ## `v2025.3-ruta`

 - [Release Binaries](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.3-ruta)
@@ -309,7 +97,7 @@ As we announced in [`hu` release notes](#service-grant-program-v2), we are opene

 ##### Locations

-These locations and slots are approximate and constantly change based on new operators submissions. Please keep in mind that we are going to chose people with respect to empty slots in the given location at the time of their submission. In case of competing submissions in the same location we will take the one with better specs vs price ratio.
+These locations and slots are approximate and constantly change based on new operators submissions. Please keep in mind that we are going to chose people with respect to empty slots in the given location at the time of their submission. In case of competing submissions in the same location we will take the one with better specs vs price ratio. 

 | LOCATION       | SLOTS |
 | :--            | --:   |
@@ -363,7 +151,7 @@ These locations and slots are approximate and constantly change based on new ope

 - [Send shutdown instead of panic when reaching max fail](https://github.com/nymtech/nym/pull/5398): Remove a panic and an unwrap inside `client-core` that is hit occasionally in the vpn client. This is a change that can have wide ranging impact since it changes the task handling and it's inside `client-core`, which is used in many components and services, so preventing regressions is important.

- [Relocate a validator api function](https://github.com/nymtech/nym/pull/5401): Adds a function to the `nym-validator-client` crate that hits the network details endpoint and returns an object parsed from `json`. This was floating loose in the `nym-vpn-client` repo.
+- [Relocate a validator api function](https://github.com/nymtech/nym/pull/5401): Adds a function to the `nym-validator-client` crate that hits the network details endpoint and returns an object parsed from `json`. This was floating loose in the `nym-vpn-client` repo. 

 - [Bump the patch-updates group across 1 directory with 9 updates](https://github.com/nymtech/nym/pull/5406)

@@ -411,7 +199,7 @@ From `nym-node v1.3.0` operators can technically choose multiple functionalities

 - Updated maintenance guides to [backup](nodes/maintenance#backup-a-node), [restore](nodes/maintenance#restoring-a-node) and [move](nodes/maintenance#moving-a-node) a node, containing a new and important commands to backup and restore `clients.sqlite` database.

- [New explanation of `nym-node` functionalities](nodes/nym-node/setup#functionality-mode) describing how Gateways get selected in Mixnet mode and Wireguard mode.
+- [New explanation of `nym-node` functionalities](nodes/nym-node/setup#functionality-mode) describing how Gateways get selected in Mixnet mode and Wireguard mode. 

 <Callout type="warning">
 Wireguard nodes route data directly to the open internet. Therefore it exposes IP of operators server (VPS) to abuse complains. Before you decide to run a node with active wireguard routing, please read our [Community Counsel pages](community-counsel/exit-gateway) containing more information and some legal content.
@@ -435,7 +223,7 @@ We have been notified that a handful of nodes have been taken down by abuse repo
 - Join [Community legal counsel](https://nym.com/docs/operators/community-counsel) - our collective knowledge hub. Add your findings by opening a [Pull Request](https://nym.com/docs/operators/add-content)

 - While we are working on a new list of more friendly providers, consider to move away from these provides as soon as possible:
-
+    
    - Servinga / VPS2day (AS39378)
    - Frantech / Ponynet / BuyVM (AS53667)
    - OVH SAS / OVHcloud (AS16276)
@@ -445,7 +233,7 @@ We have been notified that a handful of nodes have been taken down by abuse repo
    - Psychz Networks (AS40676)
    - 1337 Services GmbH / RDP.sh (AS210558)

- Backup your nodes to have access to `.nym` directory locally. Follow [node](nodes/maintenance#backup-a-node) and [proxy configuration](nodes/maintenance#backup-proxy-configuration) backup guides to be able to [restore your node](nodes/maintenance#restoring-a-node) later on on another machine, without losing your delegation.
+- Backup your nodes to have access to `.nym` directory locally. Follow [node](nodes/maintenance#backup-a-node) and [proxy configuration](nodes/maintenance#backup-proxy-configuration) backup guides to be able to [restore your node](nodes/maintenance#restoring-a-node) later on on another machine, without losing your delegation.  

 - We would like to ask operators who use reverse proxy and a domain (required for Gateways) to start using a common convention starting with `nym-exit` for their nodes URL. The entire address should have this new format:
 ```
@@ -470,7 +258,7 @@ nym-exit.mysquad.org

 **The `NYM-EXIT` part in the beginning is what's important.**

- When registering a domain, check [Top Level Domain (TLD)](https://www.techopedia.com/definition/1348/top-level-domain-tld) terms and conditions. For example `.icu` is a no go. Having a wrong TLD may lead to your domain being taken away from you when facing a DMCA report.
+- When registering a domain, check [Top Level Domain (TLD)](https://www.techopedia.com/definition/1348/top-level-domain-tld) terms and conditions. For example `.icu` is a no go. Having a wrong TLD may lead to your domain being taken away from you when facing a DMCA report.  

 - Write a message to your provider and introduce your intention to run a Nym Node on their service
 <AccordionTemplate name="Email template: Introduce yourself to your VPS provider">
@@ -534,7 +322,7 @@ Undelegated due to high saturation:

 #### Service Grant Program v2

-Aside from delegating on top of nodes, Nym runs a Service Grant Program (SGP) to support Exit Gateway operators before they will be rewarded by collecting [zk-nym tickets](../network/cryptography/zk-nym) from users subscription. Operators included in SGP are long term active community members with the highest requirements on the technical setup and upgrading pace. We are about to start a second iteration of SGP very soon (SGPv2). The final slots and locations are yet to be concluded. Priority to participate in SGPv2 will be given to the current operators in SGP. Based on the number of slots, we will then determine how many more operators can sign up.
+Aside from delegating on top of nodes, Nym runs a Service Grant Program (SGP) to support Exit Gateway operators before they will be rewarded by collecting [zk-nym tickets](../network/cryptography/zk-nym) from users subscription. Operators included in SGP are long term active community members with the highest requirements on the technical setup and upgrading pace. We are about to start a second iteration of SGP very soon (SGPv2). The final slots and locations are yet to be concluded. Priority to participate in SGPv2 will be given to the current operators in SGP. Based on the number of slots, we will then determine how many more operators can sign up. 

 ##### Rules of SGPv2

@@ -542,7 +330,7 @@ Aside from delegating on top of nodes, Nym runs a Service Grant Program (SGP) to
 **We will share more info soon in the channels. The rules are not set in stone and could potentially be altered or updated in the future! Do *not* purchase new servers neither migrate your nodes just yet.**
 </Callout>

-As we finalising last details of *"Project Smoosh"*, where one binary - `nym-node` - can run as an `entry-gateway`, `mixnode` or `exit-gateway` in Mixnet mode as well as `entry-gateway` or `exit-gateway` in Wireguard mode, we plan to step up the game. SGPv2 grants will be higher if operators can meet new requirements.
+As we finalising last details of *"Project Smoosh"*, where one binary - `nym-node` - can run as an `entry-gateway`, `mixnode` or `exit-gateway` in Mixnet mode as well as `entry-gateway` or `exit-gateway` in Wireguard mode, we plan to step up the game. SGPv2 grants will be higher if operators can meet new requirements. 

 **Minimum Specs & Requirements**

@@ -614,7 +402,7 @@ These are minimum requirements to become a part of SGPv2. We aim to have nodes o

 - [build(deps): bump criterion from `0.4.0` to `0.5.1`](https://github.com/nymtech/nym/pull/4911): Bumps [criterion](https://github.com/bheisler/criterion.rs) from `0.4.0` to `0.5.1`.

- [NS API: add mixnet scraper](https://github.com/nymtech/nym/pull/5200)
+- [NS API: add mixnet scraper](https://github.com/nymtech/nym/pull/5200) 

 - [build(deps): bump http from `1.1.0` to `1.2.0`](https://github.com/nymtech/nym/pull/5228): Bumps [http](https://github.com/hyperium/http) from `1.1.0` to `1.2.0`.

@@ -622,41 +410,41 @@ These are minimum requirements to become a part of SGPv2. We aim to have nodes o

 - [Add windows to CI builds](https://github.com/nymtech/nym/pull/5269)

- [nym topology revamp](https://github.com/nymtech/nym/pull/5271): This PR changes the internals of the `NymTopology` to blur the lines between explicit mixnodes and gateways so that what used to be considered a "mixnode" could be a valid egress point of the network. `NymTopology` is no longer divided into `BTreeMap<MixLayer, Vec<mix::Node>>` and `Vec<gateway::Node>`. instead there's information about the current rewarded set (to support future VRF work) and a simple map of `HashMap<NodeId, RoutingNode>`. The new features are mostly controlled via 2 new flags/config values:
+- [nym topology revamp](https://github.com/nymtech/nym/pull/5271): This PR changes the internals of the `NymTopology` to blur the lines between explicit mixnodes and gateways so that what used to be considered a "mixnode" could be a valid egress point of the network. `NymTopology` is no longer divided into `BTreeMap<MixLayer, Vec<mix::Node>>` and `Vec<gateway::Node>`. instead there's information about the current rewarded set (to support future VRF work) and a simple map of `HashMap<NodeId, RoutingNode>`. The new features are mostly controlled via 2 new flags/config values: 
    - `use_extended_topology` that tells the client to retrieve **all** network nodes rather than the ones that got assigned "active" mixnode role (or support being a gateway)
    - `ignore_egress_epoch_role` that tells the client it's  fine to construct egress packets to nodes that are **not** assigned entry or exit gateway role
-
+ 
 - [Nyx Chain Watcher](https://github.com/nymtech/nym/pull/5274)

 - [Include `IPINFO_API_TOKEN` in nightly CI](https://github.com/nymtech/nym/pull/5285)

- [Move tun constants to network defaults](https://github.com/nymtech/nym/pull/5286):
+- [Move tun constants to network defaults](https://github.com/nymtech/nym/pull/5286): 
 <AccordionTemplate name={<TestingSteps/>}>
 1. **Regression Testing**:
- Verified no issues arose when running tests for the affected files.
- Tested TUN behaviour with new nym-nodes in the hu branch.
+- Verified no issues arose when running tests for the affected files.  
+- Tested TUN behaviour with new nym-nodes in the hu branch.  
+ 
+**Results**:  

-**Results**:
-
- **No bugs detected**.
- Tunnels are functioning as expected, with traffic routing and IP generation working seamlessly.
-</AccordionTemplate>
+- **No bugs detected**.  
+- Tunnels are functioning as expected, with traffic routing and IP generation working seamlessly.  
+</AccordionTemplate> 

 - [Add dependabot assignes for the root cargo ecosystem](https://github.com/nymtech/nym/pull/5297)

 - [build(deps): bump the patch-updates group across 1 directory with 35 updates](https://github.com/nymtech/nym/pull/5310): Bumps the `patch-updates` group with 33 updates

- [Periodically remove stale gateway messages](https://github.com/nymtech/nym/pull/5312): This PR introduces a simple task that removes gateway messages that haven't been retrieved in (by default) 24h.
+- [Periodically remove stale gateway messages](https://github.com/nymtech/nym/pull/5312): This PR introduces a simple task that removes gateway messages that haven't been retrieved in (by default) 24h.  
 <AccordionTemplate name={<TestingSteps/>}>
 **Automation Script for Data Cleanup Validation**

 Test Objective: Validate that the stale message cleanup mechanism in the database correctly removes records older than the configured threshold (24 hours).
-
+ 
 Test Setup:
 1. Environment:
    * SQLite database
    * Bash script: used to insert data.
-
+ 
 Steps Performed:
 1. Ran the insert_data.sh script to populate the database with test data:
    * Recent records inserted successfully.
@@ -664,8 +452,8 @@ Steps Performed:
 3. Confirmed that all 20 records (10 recent + 10 stale) were present.
 4. Allowed the system to run for 24 hours to trigger the cleanup mechanism.
 5. Queried the database again after 24 hours: sqlite3 gateway_storage.db "SELECT * FROM message_store;"
-6.
-
+6. 
+ 
 Expected Result:
 * All stale records (older than 24 hours) should be removed.
 * Recent records should remain in the database.
@@ -676,18 +464,18 @@ Actual Result:

 - [Use expect in geodata test to give error message on failure](https://github.com/nymtech/nym/pull/5314): Keep hitting this error on CI, from what I think is network hickup. But it's hard to tell form the log since the error is swallowed.  Explicitly unwrap the result so we get a more detailed error output.
 <AccordionTemplate name={<TestingSteps/>}>
-**Quick Code Review**
-
-**Summary**
+**Quick Code Review**  
+ 
+**Summary**  
 1. **CI Workflow**: Adjusted paths to optimise build triggers, avoiding unnecessary CI runs while ensuring coverage for key directories
 2. **Geolocation Test**: Improved error handling by replacing assertions with `.expect` for clearer debugging in API regression tests
-
-**Conclusion**
+ 
+**Conclusion**  

 Regression testing confirms everything works as intended. **Approved**.
 </AccordionTemplate>

- [`CancellationToken`-based shutdowns](https://github.com/nymtech/nym/pull/5325): This PR introduces scaffolding for using `CancellationToken` and `TaskTracker` for our graceful shutdowns rather than the existing `TaskClient` and `TaskManager`.
+- [`CancellationToken`-based shutdowns](https://github.com/nymtech/nym/pull/5325): This PR introduces scaffolding for using `CancellationToken` and `TaskTracker` for our graceful shutdowns rather than the existing `TaskClient` and `TaskManager`. 

 - [Introduce `/load` endpoint for self-reported quantised Nym Node load](https://github.com/nymtech/nym/pull/5326): This PR introduces a new `/load` endpoint on a `NymNode` to return its current load. It returns the following data:
 ```rust
@@ -717,7 +505,7 @@ The actual values  for`NodeLoad` are determined as follows:
    - Thus we calculate two additional auxiliary `Load` values, for memory usage and swap usage, i.e.: `used_memory / total_memory` and `used_swap / total_swap` respectively.
    - Then we check whether either of the `MemoryLoad` or `SwapLoad` is bigger than the current base `Load` of the machine we have determined, if so, it's increased by one tier / bucket. For example, say the current machine load is `Load::Low`, but the memory usage is at 90% (`Load::VeryHigh`). that would result in the reported `Load` being bumped up to `Load::Medium` instead. The same logic applies with swap load, **however, only if the total swap > 1GB**. this is to prevent weird edge cases where the machine has hardly any swap.
    - Finally, the `.total` `Load` uses the same "tier bumping" behaviour using the `.total` and `.network` loads, i.e. `if network > machine`, then `total = machine + 1`. for example if `machine` `Load` is `Load::Low`, but `network` `Load` is `Load::Medium`, then the `total` `Load` is set to `Load::Medium` instead.
-</AccordionTemplate>
+</AccordionTemplate> 

 - [Bump the `patch-updates` group with 8 updates](https://github.com/nymtech/nym/pull/5336)

@@ -729,29 +517,29 @@ The actual values  for`NodeLoad` are determined as follows:

 - [Bump mikefarah/yq from `4.44.6` to `4.45.1`](https://github.com/nymtech/nym/pull/5342)

- [Update `indexed_db_futures`](https://github.com/nymtech/nym/pull/5347): Updates the `indexed_db_futures` dependency to stop relying on the fork.
+- [Update `indexed_db_futures`](https://github.com/nymtech/nym/pull/5347): Updates the `indexed_db_futures` dependency to stop relying on the fork. 

 - [Refresh wasm sdk](https://github.com/nymtech/nym/pull/5353): This PR refreshes the wasm clients to make them usable in the current network

 - [Client gateway selection](https://github.com/nymtech/nym/pull/5358): Changed how gateway is selected.
    - For init the target gateway can't support mixing
    - For egress, unless `ignore_epoch_roles` is specified, the gateway can't be currently assigned to a mixing layer. But it can be standby or inactive
-
+    
 - [Exposed `NymApiClient` method for obtaining node performance history](https://github.com/nymtech/nym/pull/5360)

 - [Bind to `[::]` on `nym-node` for both IP versions](https://github.com/nymtech/nym/pull/5361)
 <AccordionTemplate name={<TestingSteps/>}>
 **IPv4 Configuration and Migration Testing**
-
+ 
 Testing Steps:
 - Initiated and ran a nym-node with version 1.3.1 on an IPv4-only machine, then updated it to the new 'hu', 1.4.0 version.
 - Initiated and ran a new nym-node with 'hu', 1.4.0 always on a machine with only IPv4.
 - Initiated and ran a new nym-node with 'hu', 1.4.0 on a machine with both IPv4 and IPv6 for regression testing.
-
+ 
 Results:
 - No functional issues during version updates.
 - Logged message on all versions: "no registered client for destination: ff02::2"
-
+ 
 Status: Pass
 </ AccordionTemplate>

@@ -766,10 +554,10 @@ Status: Pass
 - Ensured a client is able to select a node which aside from a gateway, can also act as a mixnode
 - Verified 'ignore_epoch_roles' is the default mode
 - _note; this is most likely not going to be a permanent solution_
-
+ 
 **Results:**
- Clients and topology are behaving correctly
-
+- Clients and topology are behaving correctly 
+  
 Status: Pass
 </ AccordionTemplate>

@@ -824,7 +612,7 @@ We are developing a design where operators can enable multiple modes, and let th
    - Moved top level `authenticator` section to `service_providers` so that it'd live alongside NR and IPR
    - Added general `debug` section
    - Added `metrics` section
- All documentation migrated to a new URL [nym.com/docs](https://nym.com/docs) alongside the rebranding of Nym organisation.
+- All documentation migrated to a new URL [nym.com/docs](https://nym.com/docs) alongside the rebranding of Nym organisation. 
    - Updated [network architecture diagrams](https://nym.com/docs/network/architecture)
    - New blow-by-blow mixnet [traffic flow](https://nym.com/docs/network/architecture) section
 - [Winter Nym Squad League started](https://forum.nym.com/t/nym-squad-league-farewell-fall-welcome-winter/977)
@@ -860,11 +648,11 @@ We are developing a design where operators can enable multiple modes, and let th
    - Everything in `mixnode` directory has been removed because there was nothing really left there. The mixing socket listener was unified in `nym-node` and similarly `verloc` was also moved there
    - `gateway` directory was similarly reduced in size. Now it also creates appropriate tasks as opposed to the whole gateway process. eventually it might also be further stripped, but today is not that day.
    - Removed the generic parameter on the `GatewayStorage` to simplify all the generics down the stack. it wasn't used anyway
-
+ 
 CLI:
    - Added `--modes` argument to specify all node modes with a single command (or `env` variable). for example: `--modes="mixnode,entry"`. Can't be used alongside `--modes`
    - Extended `--mode` argument to allow specifying it multiple times, for example: `--mode mixnode --mode entry`. can't be used alongside `--mode`
-
+ 
 Config changes:
    - Replaced `mode` with `modes` to allow setting the node to run with say, `entry` + `mixnode` roles simultaneously
    - Added `maximum_forward_packet_delay` to `mixnet.debug` section
@@ -889,17 +677,17 @@ Config changes:
 - [Remove unneeded async function annotation](https://github.com/nymtech/nym/pull/5246)
 - [Add control messages to `GatewayTransciver`](https://github.com/nymtech/nym/pull/5247)
 <AccordionTemplate name={<TestingSteps/>}>
-**Review and Testing: Forget Me Implementation**
+**Review and Testing: Forget Me Implementation**  

- Validated the encryption and delivery of `ForgetMe` control messages to the gateway
+- Validated the encryption and delivery of `ForgetMe` control messages to the gateway 
+ 
+**Testing: MixTrafficController Integration**  

-**Testing: MixTrafficController Integration**
-
- Verified that the `MixTrafficController` invokes `ForgetMe` logic correctly during shutdown
- Tested behaviour for gateway transceiver failures while sending control messages
-
-**Testing: Gateway Storage Updates**
- Confirmed successful deletion of client data (e.g., inbox messages, bandwidth allocations) from persistent storage
+- Verified that the `MixTrafficController` invokes `ForgetMe` logic correctly during shutdown  
+- Tested behaviour for gateway transceiver failures while sending control messages  
+ 
+**Testing: Gateway Storage Updates**  
+- Confirmed successful deletion of client data (e.g., inbox messages, bandwidth allocations) from persistent storage  
 </AccordionTemplate>

 - [Add conversion unit tests for auth msg](https://github.com/nymtech/nym/pull/5251)
@@ -916,13 +704,13 @@ Config changes:
 <AccordionTemplate name={<TestingSteps/>}>
 1. **Review File: `common/credential-storage/src/backends/sqlite.rs`**
 - Verified addition of `close` method for the SQLite backend
-
+ 
 2. **Review File: `common/credential-storage/src/ephemeral_storage.rs`**
 - Confirmed addition of `close` method for ephemeral storage with no action required
-
+ 
 3. **Review File: `common/credential-storage/src/persistent_storage/mod.rs`**
 - Ensured `close` method integration for persistent storage
-
+ 
 4. **Review File: `common/credential-storage/src/storage.rs`**
 - Verified updates to the `Storage` trait to include `close` and `cleanup_expired` methods
 </AccordionTemplate>
@@ -931,15 +719,15 @@ Config changes:
 <AccordionTemplate name={<TestingSteps/>}>
 1. **Review File: `common/network-defaults/src/constants.rs`**
 - Confirmed updated `mixnet_vpn` constants were added.
-
+ 
 2. **Review File: `service-providers/ip-packet-router/src/constants.rs`**
 - Checked replacement of legacy `TUN_*` constants with new `mixnet_vpn` constants.
 - Validated alignment of routing traffic configurations.
-
+ 
 3. **Review File: `service-providers/ip-packet-router/src/ip_packet_router.rs`**
 - Ensured new `nym_network_defaults::constants::mixnet_vpn` constants replaced old references.
 - Verified `TunDeviceConfig` consistency.
-
+ 
 4. **Review File: `service-providers/ip-packet-router/src/util/generate_new_ip.rs`**
 - Confirmed substitution of `TUN_DEVICE_*` constants with `NYM_TUN_DEVICE_*` constants.
 - Tested functionality for generating random IPs within subnet.
@@ -955,54 +743,54 @@ Config changes:
     - `nym_node_mixnet_ingress_excessive_delay_packets`
     - `nym_node_mixnet_ingress_forward_hop_packets_dropped`
     - `nym_node_mixnet_ingress_final_hop_packets_dropped`
-
+     
     - `nym_node_mixnet_ingress_forward_hop_packets_received_rate`
-     - `nym_node_mixnet_ingress_final_hop_packets_received_rate`
-     - `nym_node_mixnet_ingress_malformed_packets_received_rate`
-     - `nym_node_mixnet_ingress_excessive_delay_packets_rate`
+     - `nym_node_mixnet_ingress_final_hop_packets_received_rate`      
+     - `nym_node_mixnet_ingress_malformed_packets_received_rate`         
+     - `nym_node_mixnet_ingress_excessive_delay_packets_rate`       
     - `nym_node_mixnet_ingress_forward_hop_packets_dropped_rate`
     - `nym_node_mixnet_ingress_final_hop_packets_dropped_rate`
-
+ 
   - egress:
     - `nym_node_mixnet_egress_stored_on_disk_final_hop_packets`
     - `nym_node_mixnet_egress_forward_hop_packets_sent`
     - `nym_node_mixnet_egress_ack_packets_sent`
     - `nym_node_mixnet_egress_forward_hop_packets_dropped`
-
+     
     - `nym_node_mixnet_egress_forward_hop_packets_sent_rate`
     - `nym_node_mixnet_egress_ack_packets_sent_rate`
     - `nym_node_mixnet_egress_forward_hop_packets_dropped_rate`
-
+ 
 - client sessions
   - `nym_node_entry_client_sessions_unique_users`
   - `nym_node_entry_client_sessions_sessions_started`
   - `nym_node_entry_client_sessions_finished_sessions`
   - `nym_node_entry_client_sessions_durations_{TYP}` (histogram), for example `nym_node_entry_client_sessions_durations_vpn`
-
+ 
 - wireguard:
   - `nym_node_wireguard_bytes_rx`
   - `nym_node_wireguard_bytes_tx`
   - `nym_node_wireguard_bytes_total_peers`
   - `nym_node_wireguard_bytes_active_peers`
-
+   
   - `nym_node_wireguard_bytes_rx_rate`
   - `nym_node_wireguard_bytes_tx_rate`
-
-
+ 
+ 
 - network
   - `nym_node_network_active_ingress_mixnet_connections`
   - `nym_node_network_active_ingress_web_socket_connections`
   - `nym_node_network_active_egress_mixnet_connections`
-
+ 
 - process
   - `nym_node_process_forward_hop_packets_being_delayed`
   - `nym_node_process_packet_forwarder_queue_size`
   - `nym_node_process_topology_query_resolution_latency` (histogram)
   - `nym_node_process_final_hop_packets_pending_delivery`
-   - `nym_node_process_forward_hop_packets_pending_delivery`
+   - `nym_node_process_forward_hop_packets_pending_delivery` 
 </AccordionTemplate>

- [Amend 250gb limit](https://github.com/nymtech/nym/pull/5313): Change bandwidth cap to 250gb
+- [Amend 250gb limit](https://github.com/nymtech/nym/pull/5313): Change bandwidth cap to 250gb 
 - [Warn users if node is run in exit mode only](https://github.com/nymtech/nym/pull/5320): Throws a warning if node is run in "exit" mode only as by default, this will **NOT** enable entry capabilities, i.e. opening the websocket. thus making it ineligible for rewarded set selection (and rewards)
 - [Reduce log severity for number of packets being delayed](https://github.com/nymtech/nym/pull/5321)
 - [Apply 1.84 linter suggestions](https://github.com/nymtech/nym/pull/5330)
@@ -1018,7 +806,7 @@ Config changes:
 - [Make sure to apply gateway score filtering when choosing initial node](https://github.com/nymtech/nym/pull/5256)
 - [Fixed client session histogram buckets](https://github.com/nymtech/nym/pull/5316)
 - [Contract version assignment](https://github.com/nymtech/nym/pull/5318): This PR fixes updates to current nym-node version as well as introduces migration to fix the existing state of the mainnet contract
- - [Make sure refresh data key matches bond info](https://github.com/nymtech/nym/pull/5329): This is to forbid operators from reusing the same underlying identity key for multiple nodes by overwriting the describe data. the reported key has to always match what the node has bonded with (and the contract enforces uniqueness)
+ - [Make sure refresh data key matches bond info](https://github.com/nymtech/nym/pull/5329): This is to forbid operators from reusing the same underlying identity key for multiple nodes by overwriting the describe data. the reported key has to always match what the node has bonded with (and the contract enforces uniqueness) 

 ## Archived Changelog

@@ -128,15 +128,10 @@ mkdir -pv <PATH_TO_TARGET_DIRECTORY>

 ###### 2. Backup `clients.sqlite` database

-
 - Install `sqlite3`
 ```sh
 apt install sqlite3
 ```
- **Stop your node**
-```sh
-service nym-node stop
-```
 - Open sqlite CLI shell inside `clients.sqlite` database
 ```sh
 sqlite3 ~/.nym/nym-nodes/default-nym-node/data/clients.sqlite
@@ -156,14 +151,10 @@ sqlite3 ~/.nym/nym-nodes/default-nym-node/data/clients.sqlite
 scp -r <SOURCE_USER_NAME>@<SOURCE_HOST_ADDRESS>:~/.nym/nym-nodes/<ID> <PATH_TO_TARGET_DIRECTORY>
 ```

-###### 4. Verify the success of the backup & start your node
+###### 4. Verify the success of the backup

 The `scp` command should print logs, an operator can see directly whether it was successful or if it encountered any error. However, double check that all your needed configuration is in the backup target directory.

- Start your node
-```sh
-service nym-node start && journalctl -u nym-node -f
-```
 </Steps>

 Now you have everything needed to restore your `nym-node` on another server. If you are in a need of doing so, follow the steps in [*Restoring a node*](#restoring-a-node) chapter below.
@@ -369,7 +360,7 @@ mkdir ~/.nym/nym-nodes
 ```
 ###### 2. Backup `clients.sqlite` database

- **Stop your node**
+- Stop your node
 ```sh
 service nym-node stop
 ```
@@ -20,12 +20,12 @@ This documentation page provides a guide on how to set up and run a [NYM NODE](.
 ```sh
 nym-node
 Binary Name:        nym-node
-Build Timestamp:    2025-03-06T20:32:36.922212778Z
-Build Version:      1.6.2
-Commit SHA:         247ebb7c4339de0a298a7fcb2574122a8306c3b8
-Commit Date:        2025-03-06T21:26:16.000000000+01:00
+Build Timestamp:    2025-02-13T11:49:34.670488195Z
+Build Version:      1.5.0
+Commit SHA:         a3e19b4563843055b305ea9a397eb1ad84b5c378
+Commit Date:        2025-02-10T18:14:47.000000000+01:00
 Commit Branch:      HEAD
-rustc Version:      1.85.0
+rustc Version:      1.84.1
 rustc Channel:      stable
 cargo Profile:      release
 ```
@@ -3,9 +3,8 @@ import { VarInfo } from 'components/variable-info.tsx';
 import { Steps } from 'nextra/components';import { Tabs } from 'nextra/components';
 import { MyTab } from 'components/generic-tabs.tsx';
 import PortsNymNode from 'components/operators/snippets/ports-nym-node.mdx';
-import PortsValidator from 'components/operators/snippets/ports-validator.mdx';
-import NymNodeSpecs from 'components/operators/snippets/nym-node-specs.mdx';
-import NTPSync from 'components/operators/snippets/ntp-time-sync.mdx'
+import PortsValidator from 'components/operators/snippets/ports-validator.mdx'
+import NymNodeSpecs from 'components/operators/snippets/nym-node-specs.mdx'

 # VPS Setup & Configuration

@@ -43,18 +42,14 @@ apt update -y && apt --fix-broken install
 ```
 - Install dependencies
 ```sh
-apt -y install ca-certificates jq curl wget ufw jq tmux pkg-config build-essential libssl-dev git ntp ntpdate
+apt -y install ca-certificates jq curl wget ufw jq tmux pkg-config build-essential libssl-dev git
 ```
 - Double check ufw is installed correctly
 ```sh
 apt install ufw --fix-missing
 ```

-###### 2. Synchronize time of your server
-
-<NTPSync />
-
-###### 3. Configure your firewall using Uncomplicated Firewall (UFW)
+###### 2. Configure your firewall using Uncomplicated Firewall (UFW)

 For a `nym-node` or Nyx validator to recieve traffic, you need to open ports on the server. The following commands will allow you to set up a firewall using `ufw`.

@@ -75,7 +70,7 @@ ufw enable
 ufw status
 ```

-###### 4. Open all needed ports to have your firewall for `nym-node` working correctly
+###### 3. Open all needed ports to have your firewall for `nym-node` working correctly

 <div>
  <Tabs items={[
@@ -1,746 +0,0 @@
-
-import { Callout } from 'nextra/components';
-import { Tabs } from 'nextra/components';
-import { VarInfo } from 'components/variable-info.tsx';
-import { Steps } from 'nextra/components';
-import {Accordion, AccordionItem} from "@nextui-org/react";
-import { MyTab } from 'components/generic-tabs.tsx';
-import { AccordionTemplate } from 'components/accordion-template.tsx';
-
-# Advanced Server Administration
-
-This page is for experienced operators and aspiring sys-admins who seek for higher optimisation and better efficiency of their work managing Nym infrastructure. The steps shared on this page cannot be simply copy-pasted, they ask you for more attention and consideration all the way from choosing server and OS to specs per VM allocation.
-
-<VarInfo />
-
-## Virtualising a Dedicated Server
-
-Some operators or squads of operators orchestrate multiple Nym nodes. Among other benefits (which are out of scope of this page), these operators can decide to acquire one larger dedicated (or bare-metal) server with enough specs (CPU, RAM, storage, bandwidth and port speed) to meet [minimum requirements](../../../nodes#minimum-requirements) for multiple nodes run in parallel.
-
-This guide explains how to prepare your server in order to be able to host multiple nodes running on separated VMs.
-
-<Callout type="info">
-This guide is based on Ubuntu 22.04, in case you prefer another OS, you may have to do a bit of your own research to troubleshoot networking configuration and other parameters.
-</Callout>
-
-### Installing KVM on a Server with Ubuntu 22.04
-
-**KVM** stands for **Kernel-based Virtual Machine**. It is a virtualization technology for Linux that allows a user to run multiple virtual machines (VMs) on a single physical machine. KVM turns the Linux kernel into a hypervisor, enabling it to manage multiple virtualised systems.
-
-Follow the steps below to install KVM on Ubuntu 22.04 LTS.
-
-#### Prerequisites
-
-<Callout type="warning">
-Operators aiming to run Nym node as mixnet [Exit Gateway](../../../community-counsel/exit-gateway) or with wireguard enabled should familiarize themselves with the challenges possibly coming along `nym-node` operation, described in our [community counsel](../../../community-counsel) and follow up with [legal suggestions](../../../community-counsel/legal). Particularly important is to [introduce yourself](../../../community-counsel/legal#introduce-nym-node-to-your-provider) and your intentions to run a Nym node to your provider.
-
-This step is essential part of legal self defense because it may prevent your provider immediately shutting down your entire service (with all the VMs on it) when receiving first abuse report.
-
-Additionally, before purchasing a large server, **contact the provider and ask if the offered CPU supports Virtualization Technology (VT)**, without this feature you will not be able to proceed.
-</Callout>
-
-Start with obtaining a server with Ubuntu 22.04 LTS:
- Make sure that your server meets [minimum requirements](../vps-setup#nym-node---dedicated-server) multiplied by number of `nym-node` instance you aim to run on it.
- Most people rent a server from a provider and it comes with a pre-installed OS (in this guide we use Ubuntu 22.04). In case your choice is a bare-metal machine, you probably know what you are doing, there are some useful guides to install a new OS, like [this one on ostechnix.com](https://ostechnix.com/install-ubuntu-server/).
-
-Make sure thay your system actually supports hardware virtualisation:
- Check out the methods documented in [this guide by ostechnix.com](https://ostechnix.com/how-to-find-if-a-cpu-supports-virtualization-technology-vt/).
-
-Order enough IPv4 and IPv6 (static and public) addresses to have one of each for each planned VM plus one extra for the main machine.
-
-
-When you have your OS installed, validated CPU virtualisation support and obtained IP addresses, you can start configuring your VMs, following the steps below.
-
-> Note that the commands below require root permission. You can either go through the setup as `root` or use `sudo` prefix with the commands used in the guide. You can switch to `root` shell by entering one of these commands `sudo su` or `sudo -i`.
-<Steps>
-
-##### 1. Install KVM
-
- Install KVM and required components:
-```sh
-apt install qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils virtinst
-```
-<br/>
-<AccordionTemplate name="Component breakdown">
- `qemu-kvm`: Provides the core **KVM virtualization** support using QEMU.
- `libvirt-daemon-system`: Manages virtual machines via the **libvirt daemon**.
- `libvirt-clients` Provides command-line tools like `virsh` to manage VMs.
- `bridge-utils`: Enables **network bridging**, allowing VMs to communicate over the network.
- `virtinst`: Includes `virt-install` for **creating virtual machines** via CLI.
-</AccordionTemplate>
-
- Start the `libvertd` service:
-```sh
-systemctl enable libvirtd
-systemctl start libvirtd
-```
- Validate by checking status of `libvirt` service:
-```sh
-systemctl status libvirtd
-```
-<br/>
-<AccordionTemplate name="Console output">
-The command output should look similar to this one:
-```
-root@nym-exit:~# systemctl status libvirtd
-● libvirtd.service - Virtualization daemon
-     Loaded: loaded (/lib/systemd/system/libvirtd.service; enabled; vendor preset: enabled)
-     Active: active (running) since Thu 2025-02-27 14:25:28 MSK; 2min 1s ago
-TriggeredBy: ● libvirtd-ro.socket
-             ● libvirtd.socket
-             ● libvirtd-admin.socket
-       Docs: man:libvirtd(8)
-             https://libvirt.org
-   Main PID: 6232 (libvirtd)
-      Tasks: 21 (limit: 32768)
-     Memory: 11.8M
-        CPU: 852ms
-     CGroup: /system.slice/libvirtd.service
-             ├─6232 /usr/sbin/libvirtd
-             ├─6460 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
-             └─6461 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
-
-Feb 27 14:25:28 nym-exit.example.com systemd[1]: Started Virtualization daemon.
-Feb 27 14:25:30 nym-exit.example.com dnsmasq[6460]: started, version 2.90 cachesize 150
-Feb 27 14:25:30 nym-exit.example.com dnsmasq[6460]: compile time options: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset no-nftset auth cryptohash DNSSEC loop-detect inotify dump>
-Feb 27 14:25:30 nym-exit.example.com dnsmasq-dhcp[6460]: DHCP, IP range 192.168.122.2 -- 192.168.122.254, lease time 1h
-Feb 27 14:25:30 nym-exit.example.com dnsmasq-dhcp[6460]: DHCP, sockets bound exclusively to interface virbr0
-Feb 27 14:25:30 nym-exit.example.com dnsmasq[6460]: reading /etc/resolv.conf
-Feb 27 14:25:30 nym-exit.example.com dnsmasq[6460]: using nameserver 127.0.0.53#53
-Feb 27 14:25:30 nym-exit.example.com dnsmasq[6460]: read /etc/hosts - 8 names
-Feb 27 14:25:30 nym-exit.example.com dnsmasq[6460]: read /var/lib/libvirt/dnsmasq/default.addnhosts - 0 names
-Feb 27 14:25:30 nym-exit.example.com dnsmasq-dhcp[6460]: read /var/lib/libvirt/dnsmasq/default.hostsfile
-```
-</AccordionTemplate>
-
- In case you don't configure KVM as `root`, add your current user to the `kvm` and `libvirt` groups to enable VM creation and management using the `virsh` command-line tool or the `virt-manager` GUI:
-```bash
-usermod -aG kvm $USER
-usermod -aG libvirt $USER
-```
-
-##### 2. Setup Bridge Networking with KVM
-
-A **bridged network** lets VMs share the host’s network interface, allowing direct IPv4/IPv6 access like a physical machine.
-
-By default, KVM sets up a **private virtual bridge**, enabling VM-to-VM communication within the host. It provides its own subnet, DHCP, and NAT for external access.
-
-Check the IP of KVM’s default virtual interfaces with:
-
-```bash
-ip a
-```
-<br/>
-<AccordionTemplate name="Console output">
-The command output should look similar to this one:
-```
-root@nym-exit:~# ip a
-1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
-    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
-    inet 127.0.0.1/8 scope host lo
-       valid_lft forever preferred_lft forever
-    inet6 ::1/128 scope host
-       valid_lft forever preferred_lft forever
-2: eno1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
-    link/ether 14:02:ec:35:2e:14 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f0
-3: eno49: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
-    link/ether 38:63:bb:2e:9d:20 brd ff:ff:ff:ff:ff:ff
-    altname enp4s0f0
-    inet 31.222.238.222/24 brd 31.222.238.255 scope global eno49
-       valid_lft forever preferred_lft forever
-    inet6 fe80::3a63:bbff:fe2e:9d20/64 scope link
-       valid_lft forever preferred_lft forever
-4: eno2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
-    link/ether 14:02:ec:35:2e:15 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f1
-5: eno3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
-    link/ether 14:02:ec:35:2e:16 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f2
-6: eno50: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
-    link/ether 38:63:bb:2e:9d:24 brd ff:ff:ff:ff:ff:ff
-    altname enp4s0f1
-7: eno4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
-    link/ether 14:02:ec:35:2e:17 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f3
-8: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
-    link/ether 52:54:00:ac:d3:ba brd ff:ff:ff:ff:ff:ff
-    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
-       valid_lft forever preferred_lft forever
-```
-</AccordionTemplate>
-
-
-By default, KVM uses the `virbr0` network with `<IPv4_ADDRESS>.1/24`, assigning guest VMs IPs in the `<IPv4_ADDRESS>.0/24` range. The host OS is reachable at `<IPv4_ADDRESS>.1`, allowing SSH and file transfers (`scp`) between the host and guests.
-
-This setup works if you only access VMs from the host. However, remote systems on a different subnet (e.g., `<IPv4_ADDRESS_ALT>.0/24`) **cannot** reach the VMs.
-
-To enable external access, we need a *public bridge* that connects VMs to the host’s main network, using its DHCP. This ensures VMs get IPs in the same range as the host.
-
-Before configuring a public bridge, **disable Netfilter** on bridges for better performance and security, as it is enabled by default.
-
- Create a file located at `/etc/sysctl.d/bridge.conf`:
-```bash
-nano /etc/sysctl.d/bridge.conf
-
-# in case of using custom editor, replace nano in the syntax
-```
-
- Paste inside the following block, save and exit:
-```ini
-net.bridge.bridge-nf-call-ip6tables=0
-net.bridge.bridge-nf-call-iptables=0
-net.bridge.bridge-nf-call-arptables=0
-```
-
- Create a file `/etc/udev/rules.d/99-bridge.rules`:
-```bash
-nano /etc/udev/rules.d/99-bridge.rules
-```
-
- Paste this line, save and exit:
-```bash
-ACTION=="add", SUBSYSTEM=="module", KERNEL=="br_netfilter", RUN+="/sbin/sysctl -p /etc/sysctl.d/bridge.conf"
-```
-
-This disables Netfilter on bridges at startup. Save, exit, and reboot to apply changes.
-
- Disable KVM’s default networking. Find the default network interface with:
-```bash
-ip link
-```
-
-<br/>
-<AccordionTemplate name="Console output">
-The command output should look similar to this one:
-```
-root@nym-exit:~# ip link
-1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
-    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
-2: eno1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
-    link/ether 14:02:ec:35:2e:14 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f0
-3: eno2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
-    link/ether 14:02:ec:35:2e:15 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f1
-4: eno49: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
-    link/ether 38:63:bb:2e:9d:20 brd ff:ff:ff:ff:ff:ff
-    altname enp4s0f0
-5: eno3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
-    link/ether 14:02:ec:35:2e:16 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f2
-6: eno50: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
-    link/ether 38:63:bb:2e:9d:24 brd ff:ff:ff:ff:ff:ff
-    altname enp4s0f1
-7: eno4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
-    link/ether 14:02:ec:35:2e:17 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f3
-8: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000
-    link/ether 52:54:00:ac:d3:ba brd ff:ff:ff:ff:ff:ff
-```
-
-The `virbr0` interface is KVM’s default network. Note your physical interface’s MAC address (e.g., `eno49`). It's the only interface that is currently `UP` and running (`LOWER_UP` state). Other interfaces are `DOWN` and not in use.
-</AccordionTemplate>
-
- Remove the default KVM network:
-```bash
-virsh net-destroy default
-```
-
- Remove the default network configuration:
-```bash
-virsh net-undefine default
-```
-
- In case last two commands didn't work, try this:
-```bash
-ip link delete virbr0 type bridge
-```
-  Verify that the `virbr0` and `virbr0-nic` interfaces are deleted:
-```bash
-ip link
-```
-<AccordionTemplate name="Console output">
-The command output should look similar to this one:
-```
-root@nym-exit:~# ip link
-1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
-    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
-2: eno1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
-    link/ether 14:02:ec:35:2e:14 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f0
-3: eno2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
-    link/ether 14:02:ec:35:2e:15 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f1
-4: eno49: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
-    link/ether 38:63:bb:2e:9d:20 brd ff:ff:ff:ff:ff:ff
-    altname enp4s0f0
-5: eno3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
-    link/ether 14:02:ec:35:2e:16 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f2
-6: eno50: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
-    link/ether 38:63:bb:2e:9d:24 brd ff:ff:ff:ff:ff:ff
-    altname enp4s0f1
-7: eno4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
-    link/ether 14:02:ec:35:2e:17 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f3
-```
-KVM network is gone.
-</AccordionTemplate>
-
-
-##### 3. Setup KVM public bridge for new VMs
-
-To create a KVM network bridge on Ubuntu, edit a config file located in `/etc/netplan/` either called `00-installer.yaml` or `00-installer-config.yaml` and add the bridge details.
-
- Before you edit the file, make a backup to stay on the save side:
-```bash
-cp /etc/netplan/00-installer-config.yaml /etc/netplan/00-installer-config.yaml.bak
-# or
-cp /etc/netplan/00-installer.yaml /etc/netplan/00-installer.yaml.bak
-```
-
- Open `00-installer-config.yaml` or `00-installer.yaml.`config in a text editor:
-```bash
-nano /etc/netplan/00-installer.yaml
-# or
-nano /etc/netplan/00-installer-config.yaml
-```
-
- Edit the block below and paste it to the config file, save and exit:
-```ini
-#####################################################
-######## CHANGE ALL VARIABLES IN <> BRACKETS ########
-#####################################################
-
-# <INTERFACE> is your own one, you can get with command ip link show
-# <HOST> is your server main IPv4 address
-# <GATEWAY> value can be found by running: ip route | grep default
-
-
-# This is the network config written by 'subiquity'
-network:
-  version: 2
-  ethernets:
-    <INTERFACE>:
-      dhcp4: false
-      dhcp6: false
-
-  # Bridge interface configuration
-  bridges:
-    br0:
-      interfaces: [<INTERFACE>]
-      addresses: [<HOST>/24]
-      routes:
-        - to: default
-          via: <GATEWAY>
-      mtu: 1500
-      nameservers:
-        addresses:
-          - 8.8.8.8
-          - 1.1.1.1
-          - 77.88.8.8
-      parameters:
-        stp: false            # Disable STP unless multiple bridges exist
-        forward-delay: 15     # Can be shortened, 15 sec is a common default
-```
-
-<Callout type="warning">
-Ensure the indentation matches exactly as shown above. Incorrect spacing will prevent the bridged network interface from activating.
-</Callout>
-
- Validate `netplan` configuration without applying to prevent breaking network changes:
-```bash
-netplan generate
-
-# Correct configuration output will show nothing
-```
-
- Safety test your changes to catch syntax errors before applying:
-```bash
-netplan try
-```
-
- Apply your changes:
-```bash
-netplan --debug  apply
-```
-
- In case of proubems try some of these steps:
-<AccordionTemplate name="Netplan configuration troubleshooting">
- Validate YAML configuration, given that YAML is syntax sensitive:
-```bash
-apt install yamllint -y
-
-yamllint /etc/netplan/00-installer.yaml
-# or
-yamllint /etc/netplan/00-installer-config.yaml
-
-
-```
- Apply correct permissions:
-```bash
-chmod 600 /etc/netplan/00-installer.yaml
-chown root:root /etc/netplan/00-installer.yaml
-```
-
- Manually bring up the bridge:
-```bash
-ip link add name br0 type bridge
-ip link set br0 up
-ip a show br0
-```
-
- ensure `systemd-networkd` is enabled:
-```bash
-systemctl restart systemd-networkd
-systemctl status systemd-networkd
-# if inactive, enable it:
-systemctl enable --now systemd-networkd
-```
-</AccordionTemplate>
-
- If things went wrong, you can always revert from the backed up file:
-```bash
-cp /etc/netplan/00-installer-config.yaml.bak /etc/netplan/00-installer-config.yaml
-# or
-cp /etc/netplan/00-installer.yaml.bak /etc/netplan/00-installer.yaml
-# and
-netplan apply
-```
-
-<Callout type="warning">
-Using different IPs for your physical NIC and KVM bridge will disconnect SSH when applying changes. Reconnect using the bridge's new IP. If both share the same IP, no disruption occurs.
-</Callout>
-
-
- Verify that the IP address has been assigned to the bridge interface:
-```bash
-ip a
-```
-<AccordionTemplate name="Console output">
-The command output should look similar to this one:
-```
-root@nym-exit:~# ip a
-1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
-    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
-    inet 127.0.0.1/8 scope host lo
-       valid_lft forever preferred_lft forever
-    inet6 ::1/128 scope host
-       valid_lft forever preferred_lft forever
-2: eno1: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
-    link/ether 14:02:ec:35:2e:14 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f0
-3: eno2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
-    link/ether 14:02:ec:35:2e:15 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f1
-4: eno3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
-    link/ether 14:02:ec:35:2e:16 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f2
-5: eno49: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br0 state UP group default qlen 1000
-    link/ether 38:63:bb:2e:9d:20 brd ff:ff:ff:ff:ff:ff
-    altname enp4s0f0
-6: eno4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
-    link/ether 14:02:ec:35:2e:17 brd ff:ff:ff:ff:ff:ff
-    altname enp2s0f3
-7: eno50: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
-    link/ether 38:63:bb:2e:9d:24 brd ff:ff:ff:ff:ff:ff
-    altname enp4s0f1
-8: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
-    link/ether 46:50:aa:c0:49:a5 brd ff:ff:ff:ff:ff:ff
-    inet 31.222.238.222/24 brd 31.222.238.255 scope global br0
-       valid_lft forever preferred_lft forever
-    inet6 fe80::4450:aaff:fec0:49a5/64 scope link
-       valid_lft forever preferred_lft forever
-```
-The bridged interface `br0` now has the IP `<HOST>`, and `<INTERFACE>` shows `master br0`, indicating it is part of the bridge.
-</AccordionTemplate>
-
-Alternatively you can use `brctl` command to display the KVM bridge network status:
-```bash
-brctl show br0
-```
-
-##### 4. Add Bridge Network to KVM
-
- Configure KVM to use the bridge by creating `host-bridge.xml`, open a text editor and pate the block below:
-```bash
-nano host-bridge.xml
-```
-
-```xml
-<network>
-  <name>host-bridge</name>
-  <forward mode="bridge"/>
-  <bridge name="br0"/>
-</network>
-```
-
- Start the new bridge and set it as the default for VMs:
-```bash
-virsh net-define host-bridge.xml
-virsh net-start host-bridge
-virsh net-autostart host-bridge
-```
-
- Verify that the KVM bridge is active:
-```bash
-virsh net-list --all
-```
-<AccordionTemplate name="Console output">
-```bash
-root@nym-exit:~# virsh net-list --all
- Name          State    Autostart   Persistent
------------------------------------------------
- host-bridge   active   yes         yes
-```
-</AccordionTemplate>
-
-KVM bridge networking is successfully set up and active!
-
-Your KVM installation is now ready to deploy and manage VMs.
-
-</Steps>
-
-### Setting Up Virtual Machines
-
-After finishing the [installation of KVM](#installing-kvm-on-a-server-with-ubuntu-2204), we can move to the virtualisation configuration.
-
-> **The steps below will guide you through a setup of one VM, therefore you will have to repeat this process for each VM**. That also means that you have to be mindful of space and memory allocation.
-
-<Steps>
-##### 1. Install OS for VMs
-
-This is the OS on which the nodes themselves will run. You can chose any GNU/Linux of your preference.  For this guide we are going to be using Ubuntu 24.04 LTS (Noble Numbat) cloud image from [cloud-images.ubuntu.com](https://cloud-images.ubuntu.com/noble/current/).
-
- Download Ubuntu Cloud image:
-```bash
-wget https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img
-```
- Copy the image to to `/var/lib/libvirt/images/` asigning to it a name your VM
-```bash
-cp noble-server-cloudimg-amd64.img /var/lib/libvirt/images/<VM_NAME>.img
-
-# for example:
-# cp noble-server-cloudimg-amd64.img /var/lib/libvirt/images/ubuntu-1.img
-```
-
-##### 2. Create and resize a virtual machine
-
- Get `guestfs-tools` to be able to customize your login credentials:
-```bash
-apt install guestfs-tools
-```
-
- Define login credentials:
-```bash
-virt-customize -a /var/lib/libvirt/images/<VM_NAME>.img --root-password password:<PASSWORD>
-# for example
-# virt-customize -a /var/lib/libvirt/images/ubuntu-1.img --root-password password:makesuretosaveyourpasswordslocallytoapasswordmanager
-```
-
- Use `qemu-img` tool with a command `resize` to create a VM according your needs. You can see `qemu` [documentation page`](https://www.qemu.org/docs/master/tools/qemu-img.html) for more info on how to use it correctly.
-```bash
-qemu-img resize /var/lib/libvirt/images/<VM_NAME>.img +<SIZE_IN_GB>G
-# for example
-# qemu-img resize /var/lib/libvirt/images/ubuntu-1.img +100G
-```
-
- Resize it from within it after `virt-install` command:
-```bash
-virt-install \
--name <VM_NAME> \
--ram=<SIZE_IN_MB> \
--vcpus=<NUMBER_OF_VIRTUAL_CPUS> \
--cpu host \
--hvm \
--disk bus=virtio,path=/var/lib/libvirt/images/<VM_NAME>.img \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--osinfo <YOUR_CHOSEN_OS_NAME> \
--import
-```
-
- In our example we go with 4 GB RAM on the same machine as before:
-<br/>
-<AccordionTemplate name="Command example">
-```bash
-virt-install \
--name ubuntu-1 \
--ram=4096 \
--vcpus=4 \
--cpu host \
--hvm \
--disk bus=virtio,path=/var/lib/libvirt/images/ubuntu-1.img \
--network bridge=br0 \
--graphics none \
--console pty,target_type=serial \
--osinfo ubuntunoble \
--import
-```
-</AccordionTemplate>
-
- After loading you should see a login console, you can also initiate it by:
-```bash
-virsh console <VM_NAME>
-# for example
-# virsh console ubuntu-1
-```
-
- Log in to your new VM using your credentials.
-
-##### 3. Validate your setup
-
- Make sure the `root` disk has the expected space by running:
-```bash
-df -h
-```
-
- If not, run:
-```bash
-growpart /dev/vda 1
-resize2fs /dev/vda1
-```
-
-##### 4. Configure networking for the VM
-
-As this guide is based on a newer Ubuntu, we use `netplan`, this may be different on different OS.
-
- Open `/etc/netplan/01-network-config.yaml` in your favourite text editor:
-```bash
-nano /etc/netplan/01-network-config.yaml
-```
-
- Insert this config, using your correct IP configuration, save and exit:
-```ini
-network:
-  version: 2
-  renderer: networkd
-  ethernets:
-    <INTERFACE>:
-      dhcp4: false
-      dhcp6: false  # Set to true if you want automatic IPv6 assignment
-      addresses:
-        - <IPv4_VM>/24  # Assign IPv4 address to the VM
-        - <IPv6_VM>/64  # Assign IPv6 address to the VM
-      routes:
-        - to: default
-          via: <IPv4_GATEWAY_HOST_SERVER>  # IPv4 gateway (host machine)
-        - to: default
-          via: <IPv6_GATEWAY_HOST_SERVER>  # IPv6 gateway (host machine)
-      nameservers:
-        addresses:
-          - 1.1.1.1  # Cloudflare IPv4 DNS
-          - 8.8.8.8  # Google IPv4 DNS
-          - 2606:4700:4700::1111  # Cloudflare IPv6 DNS
-          - 2001:4860:4860::8888  # Google IPv6 DNS
-```
- Fix wide permissions on the config file:
-```bash
-chmod 600 /etc/netplan/01-network-config.yaml
-```
-
- Check if the config has any errors:
-```bash
-netplan generate
-```
-
- Apply the configuration:
-```bash
-netplan --debug  apply
-```
-
- Verify by checking if IPv4 and IPv6 are assigned correctly and if they route:
-```bash
-ip -4 a
-ip -6 a
-```
-```bash
-ip -4 r
-ip -6 r
-```
-```bash
-# to ping through IPv6, use:
-ping6 nym.com
-```
- You should be able to ping your new VM from a local machine:
-```bash
-ping <IPv4_VM>
-ping6 <IPv6_VM>
-```
-
-</Steps>
-
-Your VM should be working and fully routable. To be able to use it properly, we will create a direct SSH access to the VM.
-
-#### Configure VM SSH access
-
-<Steps>
-
-##### 1. Log in to your VM, update and upgrade your OS:
- Log in to your server using as `root` or as a non-root user with `sudo` privileges
-```bash
-apt update; apt upgrade
-```
-
-##### 2. Generate new host SSH keys
-
-Since we used a `cloud-init` image without an SSH server, we need to generate SSH host keys for client authentication and server identity verification. All of them will be saved to this location: `/etc/ssh/<KEY>`.
-
- Generate a new RSA host key:
-```bash
-ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key
-```
- Generate a new DSA host key:
-```bash
-ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key
-```
- Generate a new ECDSA host key:
-```bash
-ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key
-```
- Finally, generate a new ED25519 host key:
-```bash
-ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key
-```
-##### 3. Restart the SSH service on the server
- Run:
-```bash
-systemctl restart ssh.service
-```
-
-##### 4. Check if the SSH serice is active
- Run:
-```bash
-systemctl status ssh.service
-```
-
-##### 5. Create file `~/.ssh/authorized_keys` and add you public key:
- Create `.ssh` directory:
-```bash
-mkdir ~/.ssh
-```
-
- Open with your favourite text editor:
-```bash
-nano ~/.ssh/authorized_keys
-```
- Paste your SSH public key, save and exit
-
- In case of non-root, setup a correct ownership and permissions:
-```bash
-chmod 600 ~/.ssh/authorized_keys
-chmod 700 ~/.ssh
-chown : ~/.ssh
-```
-
-##### 5. Test by connecting via SSH
-
- Now you should be able to connect to the VM directly from your local terminal
-```bash
-ssh root@<IPv4> -i ~/.ssh/your_ssh_key
-```
-</Steps>
-
-Now your VM is almost ready for `nym-node` [setup](../../nym-node/setup). Before you proceed, ssh in and [configure all prerequisities](../vps-setup#vps-configuration) needed for `nym-node` installation and operation. 
@@ -1,7 +0,0 @@
-{
-  "git": {
-    "deploymentEnabled": {
-      "master": false
-    }
-  }
-}
@@ -1,6 +1,6 @@
 [package]
 name = "explorer-api"
-version = "1.1.48"
+version = "1.1.47"
 edition = "2021"
 license.workspace = true

@@ -101,9 +101,6 @@ pub struct Debug {
    pub maximum_open_connections: usize,

    pub zk_nym_tickets: ZkNymTicketHandlerDebug,
-
-    /// Defines the maximum age of a signed authentication request before it's deemed too stale to process.
-    pub maximum_auth_request_age: Duration,
 }

 #[derive(Debug, Clone)]
@@ -6,20 +6,11 @@ use crate::node::client_handling::embedded_clients::LocalEmbeddedClientHandle;
 use dashmap::DashMap;
 use nym_sphinx::DestinationAddressBytes;
 use std::sync::Arc;
-use time::OffsetDateTime;
 use tracing::warn;

-#[derive(Clone)]
-pub(crate) struct RemoteClientData {
-    // note, this does **NOT** indicate timestamp of when client connected
-    // it is (for v2 auth) timestamp the client **signed** when it created the request
-    pub(crate) session_request_timestamp: OffsetDateTime,
-    pub(crate) channels: ClientIncomingChannels,
-}
-
 enum ActiveClient {
    /// Handle to a remote client connected via a network socket.
-    Remote(RemoteClientData),
+    Remote(ClientIncomingChannels),

    /// Handle to a locally (inside the same process) running client.
    Embedded(LocalEmbeddedClientHandle),
@@ -28,14 +19,14 @@ enum ActiveClient {
 impl ActiveClient {
    fn get_sender_ref(&self) -> &MixMessageSender {
        match self {
-            ActiveClient::Remote(remote) => &remote.channels.mix_message_sender,
+            ActiveClient::Remote(remote) => &remote.mix_message_sender,
            ActiveClient::Embedded(embedded) => &embedded.mix_message_sender,
        }
    }

    fn get_sender(&self) -> MixMessageSender {
        match self {
-            ActiveClient::Remote(remote) => remote.channels.mix_message_sender.clone(),
+            ActiveClient::Remote(remote) => remote.mix_message_sender.clone(),
            ActiveClient::Embedded(embedded) => embedded.mix_message_sender.clone(),
        }
    }
@@ -87,18 +78,18 @@ impl ActiveClientsStore {
    pub(crate) fn get_remote_client(
        &self,
        address: DestinationAddressBytes,
-    ) -> Option<RemoteClientData> {
+    ) -> Option<ClientIncomingChannels> {
        let entry = self.inner.get(&address)?;
        let handle = entry.value();

-        let ActiveClient::Remote(remote) = handle else {
+        let ActiveClient::Remote(channels) = handle else {
            warn!("attempted to get a remote handle to a embedded network requester");
            return None;
        };

        // if the entry is stale, remove it from the map
-        if !remote.channels.mix_message_sender.is_closed() {
-            Some(remote.clone())
+        if !channels.mix_message_sender.is_closed() {
+            Some(channels.clone())
        } else {
            // drop the reference to the map to prevent deadlocks
            drop(entry);
@@ -146,14 +137,10 @@ impl ActiveClientsStore {
        client: DestinationAddressBytes,
        handle: MixMessageSender,
        is_active_request_sender: IsActiveRequestSender,
-        session_request_timestamp: OffsetDateTime,
    ) {
-        let entry = ActiveClient::Remote(RemoteClientData {
-            session_request_timestamp,
-            channels: ClientIncomingChannels {
-                mix_message_sender: handle,
-                is_active_request_sender,
-            },
+        let entry = ActiveClient::Remote(ClientIncomingChannels {
+            mix_message_sender: handle,
+            is_active_request_sender,
        });
        if self.inner.insert(client, entry).is_some() {
            panic!("inserted a duplicate remote client")
@@ -9,23 +9,15 @@ use nym_mixnet_client::forwarder::MixForwardingSender;
 use nym_node_metrics::events::MetricEventsSender;
 use nym_node_metrics::NymNodeMetrics;
 use std::sync::Arc;
-use std::time::Duration;
-
-#[derive(Clone)]
-pub(crate) struct Config {
-    pub(crate) enforce_zk_nym: bool,
-    pub(crate) max_auth_request_age: Duration,
-
-    pub(crate) bandwidth: BandwidthFlushingBehaviourConfig,
-}

 // I can see this being possible expanded with say storage or client store
 #[derive(Clone)]
 pub(crate) struct CommonHandlerState {
-    pub(crate) cfg: Config,
    pub(crate) ecash_verifier: Arc<EcashManager>,
    pub(crate) storage: GatewayStorage,
    pub(crate) local_identity: Arc<identity::KeyPair>,
+    pub(crate) only_coconut_credentials: bool,
+    pub(crate) bandwidth_cfg: BandwidthFlushingBehaviourConfig,
    pub(crate) metrics: NymNodeMetrics,
    pub(crate) metrics_sender: MetricEventsSender,
    pub(crate) outbound_mix_sender: MixForwardingSender,
--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .68%
 .64%
@@ -1 +1 @@
 .157
 .332