fix(linux): force Qt6 modules to link from bundled lib via rpath

2026-05-23 19:35:48 +03:00 · 2026-02-09 21:31:16 +04:00
711 changed files with 22220 additions and 53599 deletions
--- a/.clang-format-ignore
+++ b/.clang-format-ignore
@@ -2,7 +2,7 @@
 /client/3rd-prebuild
 /client/android
 /client/cmake
-/client/core/utils/serialization
+/client/core/serialization
 /client/daemon
 /client/fonts
 /client/images
--- a/.github/actions/apple-install-cert/action.yml
+++ b/.github/actions/apple-install-cert/action.yml
@@ -1,38 +0,0 @@
-# .github/actions/apple-install-cert/action.yml
-
-name: Setup apple keychain
-description: Creates and configures a temporary build keychain
-
-inputs:
-  keychain-path:
-    description: Path to the keychain
-    required: true
-  keychain-password:
-    description: Password to the keychain
-    required: true
-  cert-base64:
-    description: Base64-encoded certificate
-    required: true
-  cert-password:
-    description: Certificate password
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Create keychain
-      shell: bash
-      env:
-        KEYCHAIN_PATH: ${{ inputs.keychain-path }}
-        KEYCHAIN_PASSWORD: ${{ inputs.keychain-password }}
-        CERT_BASE64: ${{ inputs.cert-base64 }}
-        CERT_PASSWORD: ${{ inputs.cert-password }}
-      run: |
-        CERT_PATH=$(mktemp /tmp/cert_XXXXXX.p12)
-        trap "rm -f '$CERT_PATH'" EXIT
-
-        echo -n "$CERT_BASE64" | base64 --decode -o "$CERT_PATH"
-
-        security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
-        security import "$CERT_PATH" -k "$KEYCHAIN_PATH" -P "$CERT_PASSWORD" -A -t cert -f pkcs12
-        security set-key-partition-list -S apple-tool:,apple:,codesign: -k "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
--- a/.github/actions/apple-setup-keychain/AppleWWDRCAG3.cer
+++ b/.github/actions/apple-setup-keychain/AppleWWDRCAG3.cer
--- a/.github/actions/apple-setup-keychain/action.yml
+++ b/.github/actions/apple-setup-keychain/action.yml
@@ -1,57 +0,0 @@
-# .github/actions/apple-setup-keychain/action.yml
-
-name: Setup apple keychain
-description: Creates and configures a temporary build keychain
-
-inputs:
-  keychain-name:
-    description: Name of the keychain
-    required: false
-    default: "ci-amnezia"
-  keychain-password:
-    description: The keychain password
-    required: true
-  lock-timeout:
-    description: A timeout after exceeding which the keychain would be locked
-    required: false
-    default: "0"
-
-outputs:
-  keychain-path:
-    description: "Full path to the keychain created"
-    value: ${{ steps.setup.outputs.keychain-path }}
-  keychain-name:
-    description: "Actual name of the keychain created"
-    value: ${{ steps.setup.outputs.keychain-name }}
-
-runs:
-  using: composite
-  steps:
-    - name: Setup keychain
-      id: setup
-      shell: bash
-      env:
-        KEYCHAIN_NAME: ${{ inputs.keychain-name }}
-        KEYCHAIN_PASSWORD: ${{ inputs.keychain-password }}
-        LOCK_TIMEOUT: ${{ inputs.lock-timeout }}
-      run: |
-        KEYCHAIN_PATH="$HOME/Library/Keychains/$KEYCHAIN_NAME.keychain-db"
-
-        security create-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
-
-        if [[ "$LOCK_TIMEOUT" == "0" ]]; then
-          security set-keychain-settings "$KEYCHAIN_PATH"
-        else
-          security set-keychain-settings -u -t "$LOCK_TIMEOUT" "$KEYCHAIN_PATH"
-        fi
-
-        security unlock-keychain -p "$KEYCHAIN_PASSWORD" "$KEYCHAIN_PATH"
-
-        security import "${{ github.action_path }}/DeveloperIDG2CA.cer" -k "$KEYCHAIN_PATH" -A
-        security import "${{ github.action_path }}/AppleWWDRCAG3.cer" -k "$KEYCHAIN_PATH" -A
-
-        security list-keychains -d user -s "$KEYCHAIN_PATH"
-        security default-keychain -s "$KEYCHAIN_PATH"
-
-        echo "keychain-name=$KEYCHAIN_NAME" >> $GITHUB_OUTPUT
-        echo "keychain-path=$KEYCHAIN_PATH" >> $GITHUB_OUTPUT
--- a/.github/actions/apple-setup-provisioning-profile/action.yml
+++ b/.github/actions/apple-setup-provisioning-profile/action.yml
@@ -1,31 +0,0 @@
-# .github/actions/apple-setup-provisioning-profile/action.yml
-
-name: Setup provisioning profiles
-description: Decodes and installs provisioning profiles
-
-inputs:
-  provisioning_profile_base64:
-    description: Base64-encoded provisioning profile
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Setup provisioning profile
-      shell: bash
-      run: |
-        PROFILES_DIR="$HOME/Library/MobileDevice/Provisioning Profiles"
-        TEMP_FILE=$(mktemp)
-
-        echo "${{ inputs.provisioning_profile_base64 }}" | base64 --decode > "$TEMP_FILE"
-
-        PROFILE_UUID=$(grep UUID -A1 -a "$TEMP_FILE" | grep -io "[-A-F0-9]\{36\}")
-        if [[ -z "$PROFILE_UUID" ]]; then
-          echo "Failed to extract UUID from provisioning profile"
-          rm -f "$TEMP_FILE"
-          exit 1
-        fi
-
-        mkdir -p "$PROFILES_DIR"
-        mv "$TEMP_FILE" "$PROFILES_DIR/$PROFILE_UUID.mobileprovision"
-        echo "Installed profile: $PROFILE_UUID"
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,66 +9,14 @@ env:
  QT_MIRROR: https://mirrors.ocf.berkeley.edu/qt/ # https://download.qt.io/static/mirrorlist/

 jobs:
-  Detect-Changes:
-    runs-on: ubuntu-latest
-    outputs:
-      recipes_changed: ${{ steps.filter.outputs.recipes }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: dorny/paths-filter@v3
-        id: filter
-        with:
-          base: ${{ github.event.before }}
-          filters: |
-            recipes:
-              - 'recipes/**'
-              - 'conanfile.py'
-
-  Bake-Prebuilts-Linux:
-    runs-on: ubuntu-latest
-    needs: Detect-Changes
-    if: needs.Detect-Changes.outputs.recipes_changed == 'true'
-
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        submodules: 'true'
-        fetch-depth: 10
-
-    - uses: actions/setup-python@v6
-      with:
-        python-version: 3.14
-
-    - name: 'Install conan'
-      run: pip install "conan==2.26.2"
-
-    - name: 'Build dependencies'
-      shell: bash
-      run: |
-        for build_type in Release Debug; do
-          cmake -S . -B build -DPREBUILTS_ONLY=1 "-DCMAKE_BUILD_TYPE=$build_type"
-        done
-
-    - name: 'Authorize in remote'
-      run: conan remote login amnezia "${{ secrets.CONAN_USER }}" -p "${{ secrets.CONAN_PASSWORD }}"
-
-    - name: 'Upload baked prebuilts'
-      run: conan upload -r amnezia "*" -c
-
-# ------------------------------------------------------
-
  Build-Linux-Ubuntu:
    runs-on: android-runner

-    needs: Bake-Prebuilts-Linux
-    if: ${{ always() }}
-
    env:
      QT_VERSION: 6.10.1
      QIF_VERSION: 4.7
      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -90,18 +38,7 @@ jobs:
        set-env: 'true'
        aqtversion: '==3.3.0'       
        py7zrversion: '==0.22.*'  
-        extra: '--base ${{ env.QT_MIRROR }}'
-
-    - name: 'Setup python'
-      uses: actions/setup-python@v6
-      with:
-        python-version: 3.14
-      
-    - name: 'Install conan'
-      run: pip install "conan==2.26.2"
-
-    - name: 'Install system packages'
-      run: sudo apt-get install libxkbcommon-x11-0 libsecret-1-dev
+        extra: '--base ${{ env.QT_MIRROR }}' 

    - name: 'Get sources'
      uses: actions/checkout@v4
@@ -109,17 +46,38 @@ jobs:
        submodules: 'true'
        fetch-depth: 10

+    - name: 'Get version from CMakeLists.txt'
+      id: get_version
+      run: |
+        VERSION=$(grep 'set(AMNEZIAVPN_VERSION' CMakeLists.txt | sed -E 's/.*AMNEZIAVPN_VERSION ([0-9]+.[0-9]+.[0-9]+.[0-9]+)\)/\1/')
+        echo "VERSION=$VERSION" >> $GITHUB_ENV
+        echo "Version: $VERSION"
+
+    # - name: 'Setup ccache'
+    #   uses: hendrikmuhs/ccache-action@v1.2
+
    - name: 'Build project'
-      shell: bash
-      env:
-        QT_INSTALL_DIR: ${{ runner.temp }}
-      run: deploy/build.sh --generator Ninja --installer all
+      run: |
+        sudo apt-get install libxkbcommon-x11-0 libsecret-1-dev
+        export QT_BIN_DIR=${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/gcc_64/bin
+        export QIF_BIN_DIR=${{ runner.temp }}/Qt/Tools/QtInstallerFramework/${{ env.QIF_VERSION }}/bin
+        bash deploy/build_linux.sh
+
+    - name: 'Pack installer'
+      run: cd deploy && tar -cf AmneziaVPN_Linux_Installer.tar AmneziaVPN_Linux_Installer.bin && zip AmneziaVPN_${VERSION}_linux_x64.tar.zip AmneziaVPN_Linux_Installer.tar

    - name: 'Upload installer artifact'
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@v4
      with:
-        path: deploy/build/AmneziaVPN-*-Linux.run
-        archive: false
+        name: AmneziaVPN_${{ env.VERSION }}_linux_x64.tar.zip
+        path: deploy/AmneziaVPN_${{ env.VERSION }}_linux_x64.tar.zip
+        retention-days: 7
+
+    - name: 'Upload unpacked artifact'
+      uses: actions/upload-artifact@v4
+      with:
+        name: AmneziaVPN_Linux_unpacked
+        path: deploy/AppDir
        retention-days: 7

    - name: 'Upload translations artifact'
@@ -129,51 +87,17 @@ jobs:
        path: client/translations
        retention-days: 7

-# ------------------------------------------------------
-
-  Bake-Prebuilts-Windows:
-    runs-on: windows-latest
-    needs: Detect-Changes
-    if: needs.Detect-Changes.outputs.recipes_changed == 'true'
-
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        submodules: 'true'
-        fetch-depth: 10
-    
-    - uses: actions/setup-python@v6
-      with:
-        python-version: 3.14
-
-    - uses: ilammy/msvc-dev-cmd@v1
-
-    - name: 'Install conan'
-      run: pip install "conan==2.26.2"
-
-    - name: 'Build dependencies'
-      run: cmake -S . -B build -G "Visual Studio 17 2022" -DPREBUILTS_ONLY=1
-    
-    - name: 'Authorize in remote'
-      run: conan remote login amnezia "${{ secrets.CONAN_USER }}" -p "${{ secrets.CONAN_PASSWORD }}"
-
-    - name: 'Upload baked prebuilts'
-      run: conan upload -r amnezia "*" -c
-
 # ------------------------------------------------------

  Build-Windows:
    runs-on: windows-latest

-    needs: Bake-Prebuilts-Windows
-    if: ${{ always() }}
-
    env:
      QT_VERSION: 6.10.1
      QIF_VERSION: 4.7
+      BUILD_ARCH: 64
      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -187,6 +111,17 @@ jobs:
        submodules: 'true'
        fetch-depth: 10

+    - name: 'Get version from CMakeLists.txt'
+      id: get_version
+      shell: bash
+      run: |
+        VERSION=$(grep 'set(AMNEZIAVPN_VERSION' CMakeLists.txt | sed -E 's/.*AMNEZIAVPN_VERSION ([0-9]+.[0-9]+.[0-9]+.[0-9]+)\)/\1/')
+        echo "VERSION=$VERSION" >> $GITHUB_ENV
+        echo "Version: $VERSION"
+
+    # - name: 'Setup ccache'
+    #   uses: hendrikmuhs/ccache-action@v1.2
+
    - name: 'Install Qt'
      uses: jurplel/install-qt-action@v3
      with:
@@ -223,88 +158,52 @@ jobs:
        $wixBinDir = Join-Path $env:USERPROFILE ".dotnet\tools"
        echo "WIX_BIN_DIR=$wixBinDir" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

-    - name: 'Setup python'
-      uses: actions/setup-python@v6
-      with:
-        python-version: 3.14
-
-    - name: 'Install conan'
-      run: pip install "conan==2.26.2"
-
    - name: 'Build project'
      shell: cmd
-      env:
-        QT_INSTALL_DIR: ${{ runner.temp }}
      run: |
-        set WIX_ROOT_PATH="${{ env.USERPROFILE }}\.dotnet\tools"
-        deploy\build.bat --installer all
+        set BUILD_ARCH=${{ env.BUILD_ARCH }}
+        set QT_BIN_DIR="${{ runner.temp }}\\Qt\\${{ env.QT_VERSION }}\\msvc2022_64\\bin"
+        set QIF_BIN_DIR="${{ runner.temp }}\\Qt\\Tools\\QtInstallerFramework\\${{ env.QIF_VERSION }}\\bin"
+        set WIX_BIN_DIR=%USERPROFILE%\.dotnet\tools
+        call deploy\\build_windows.bat

-    - name: 'Upload WIX installer artifact'
-      uses: actions/upload-artifact@v7
+    - name: 'Rename Windows installer'
+      shell: cmd
+      run: |
+        copy AmneziaVPN_x${{ env.BUILD_ARCH }}.exe AmneziaVPN_%VERSION%_x64.exe
+
+    - name: 'Upload installer artifact'
+      uses: actions/upload-artifact@v4
      with:
-        path: deploy/build/AmneziaVPN-*-win64.msi
-        archive: false
-        retention-days: 7
-      
-    - name: 'Upload IFW installer artifact'
-      uses: actions/upload-artifact@v7
-      with:
-        path: deploy/build/AmneziaVPN-*-win64.exe
-        archive: false
+        name: AmneziaVPN_${{ env.VERSION }}_x64.exe
+        path: AmneziaVPN_${{ env.VERSION }}_x64.exe
        retention-days: 7

-# ------------------------------------------------------
-
-  Bake-Prebuilts-iOS:
-    runs-on: macos-latest
-    needs: Detect-Changes
-    if: needs.Detect-Changes.outputs.recipes_changed == 'true'
-
-    strategy:
-      matrix:
-        xcode-version: [26.0]
-
-    steps:
-    - uses: actions/checkout@v4
+    - name: 'Upload MSI installer artifact'
+      uses: actions/upload-artifact@v4
      with:
-        submodules: 'true'
-        fetch-depth: 10
-    
-    - uses: actions/setup-python@v6
+        name: AmneziaVPN_Windows_MSI_installer
+        path: AmneziaVPN_x${{ env.BUILD_ARCH }}.msi
+        retention-days: 7
+
+    - name: 'Upload unpacked artifact'
+      uses: actions/upload-artifact@v4
      with:
-        python-version: 3.14
-
-    - uses: maxim-lobanov/setup-xcode@v1
-      with:
-        xcode-version: ${{ matrix.xcode-version }}
-
-    - name: 'Install conan'
-      run: pip install "conan==2.26.2"
-
-    - name: 'Build dependencies'
-      run: cmake -S . -B build -G Xcode -DPREBUILTS_ONLY=1 -DCMAKE_SYSTEM_NAME=iOS -DCMAKE_OSX_SYSROOT=iphoneos
-    
-    - name: 'Authorize in remote'
-      run: conan remote login amnezia "${{ secrets.CONAN_USER }}" -p "${{ secrets.CONAN_PASSWORD }}"
-
-    - name: 'Upload baked prebuilts'
-      run: conan upload -r amnezia "*" -c
+        name: AmneziaVPN_Windows_unpacked
+        path: deploy\\build_${{ env.BUILD_ARCH }}\\client\\Release
+        retention-days: 7

 # ------------------------------------------------------

  Build-iOS:
    runs-on: macos-latest

-    needs: Bake-Prebuilts-iOS
-    if: ${{ always() }}
-
    env:
      QT_VERSION: 6.10.1
-      KEYCHAIN_PASSWORD: ""
-
+      CC: cc
+      CXX: c++
      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -312,35 +211,6 @@ jobs:
      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}

    steps:
-    - name: 'Get sources'
-      uses: actions/checkout@v4
-      with:
-        submodules: 'true'
-        fetch-depth: 10
-
-    - uses: ./.github/actions/apple-setup-keychain
-      id: setup-keychain
-      with:
-        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
-
-    - name: 'Install signing certificate'
-      uses: ./.github/actions/apple-install-cert
-      with:
-        keychain-path: ${{ steps.setup-keychain.outputs.keychain-path }}
-        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
-        cert-base64: ${{ secrets.IOS_SIGNING_CERT_BASE64 }}
-        cert-password: ${{ secrets.IOS_SIGNING_CERT_PASSWORD }}
-
-    - name: 'Install app provisioning profile'
-      uses: ./.github/actions/apple-setup-provisioning-profile
-      with:
-        provisioning_profile_base64: ${{ secrets.IOS_APP_PROVISIONING_PROFILE }}
-
-    - name: 'Install NE provisioning profile'
-      uses: ./.github/actions/apple-setup-provisioning-profile
-      with:
-        provisioning_profile_base64: ${{ secrets.IOS_NE_PROVISIONING_PROFILE }}
-
    - name: 'Setup xcode'
      uses: maxim-lobanov/setup-xcode@v1
      with:
@@ -370,80 +240,84 @@ jobs:
        set-env: 'true'
        extra: '--external 7z --base ${{ env.QT_MIRROR }}'

-    - name: 'Setup python'
-      uses: actions/setup-python@v6
+    - name: 'Install go'
+      uses: actions/setup-go@v5
      with:
-        python-version: 3.14
+        go-version: '1.24'
+        cache: false

-    - name: 'Install deps'
-      run: pip install "conan==2.26.2" jsonschema jinja2
+    - name: 'Setup gomobile'
+      run: |
+          export PATH=$PATH:~/go/bin
+          go install golang.org/x/mobile/cmd/gomobile@latest
+          gomobile init
+
+    - name: 'Get sources'
+      uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+        fetch-depth: 10
+
+    # - name: 'Setup ccache'
+    #   uses: hendrikmuhs/ccache-action@v1.2
+
+    - name: 'Install dependencies'
+      run: pip install jsonschema jinja2

    - name: 'Build project'
-      env:
-        QT_INSTALL_DIR: ${{ runner.temp }}
-        APPSTORE_CONNECT_KEY_ID: ${{ secrets.APPSTORE_CONNECT_KEY_ID }}
-        APPSTORE_CONNECT_ISSUER_ID: ${{ secrets.APPSTORE_CONNECT_ISSUER_ID }}
-        APPSTORE_CONNECT_PRIVATE_KEY: ${{ secrets.APPSTORE_CONNECT_PRIVATE_KEY }}
      run: |
-        sh deploy/build.sh -t ios | \
+        git submodule update --init --recursive
+        export QT_BIN_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/ios/bin"
+        export QT_MACOS_ROOT_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/macos"
+        export PATH=$PATH:~/go/bin
+        sh deploy/build_ios.sh | \
          sed -e '/-Xcc -DPROD_AGW_PUBLIC_KEY/,/-Xcc/ { /-Xcc/!d; }' -e '/-Xcc -DPROD_AGW_PUBLIC_KEY/d' | \
          sed -e '/-Xcc -DDEV_AGW_PUBLIC_KEY/,/-Xcc/ { /-Xcc/!d; }' -e '/-Xcc -DDEV_AGW_PUBLIC_KEY/d' | \
          sed -e '/-DPROD_AGW_PUBLIC_KEY/,/-D/ { /-D/!d; }' -e '/-DPROD_AGW_PUBLIC_KEY/d' | \
          sed -e '/-DDEV_AGW_PUBLIC_KEY/,/-D/ { /-D/!d; }' -e '/-DDEV_AGW_PUBLIC_KEY/d'
+      env:
+        IOS_TRUST_CERT_BASE64: ${{ secrets.IOS_TRUST_CERT_BASE64 }}
+        IOS_SIGNING_CERT_BASE64: ${{ secrets.IOS_SIGNING_CERT_BASE64 }}
+        IOS_SIGNING_CERT_PASSWORD: ${{ secrets.IOS_SIGNING_CERT_PASSWORD }}
+        APPSTORE_CONNECT_KEY_ID: ${{ secrets.APPSTORE_CONNECT_KEY_ID }}
+        APPSTORE_CONNECT_ISSUER_ID: ${{ secrets.APPSTORE_CONNECT_ISSUER_ID }}
+        APPSTORE_CONNECT_PRIVATE_KEY: ${{ secrets.APPSTORE_CONNECT_PRIVATE_KEY }}
+        IOS_APP_PROVISIONING_PROFILE: ${{ secrets.IOS_APP_PROVISIONING_PROFILE }}
+        IOS_NE_PROVISIONING_PROFILE: ${{ secrets.IOS_NE_PROVISIONING_PROFILE }}
+
+#    - name: 'Upload appstore .ipa and dSYMs to artifacts'
+#      uses: actions/upload-artifact@v4
+#      with:
+#        name: app-store ipa & dsyms
+#        path: |
+#          ${{ github.workspace }}/AmneziaVPN-iOS.ipa
+#          ${{ github.workspace }}/*.app.dSYM.zip
+#        retention-days: 7

 # ------------------------------------------------------

-  Bake-Prebuilts-MacOS:
+  Build-MacOS-old:
    runs-on: macos-latest

-    needs: Detect-Changes
-    if: needs.Detect-Changes.outputs.recipes_changed == 'true'
-
-    strategy:
-      matrix:
-        xcode-version: [16.2, 16.4]
-
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        submodules: 'true'
-        fetch-depth: 10
-    
-    - uses: actions/setup-python@v6
-      with:
-        python-version: 3.14
-
-    - uses: maxim-lobanov/setup-xcode@v1
-      with:
-        xcode-version: ${{ matrix.xcode-version }}
-
-    - name: 'Install conan'
-      run: pip install "conan==2.26.2"
-
-    - name: 'Build dependencies'
-      run: cmake -S . -B build -G Xcode -DPREBUILTS_ONLY=1
-    
-    - name: 'Authorize in remote'
-      run: conan remote login amnezia "${{ secrets.CONAN_USER }}" -p "${{ secrets.CONAN_PASSWORD }}"
-
-    - name: 'Upload baked prebuilts'
-      run: conan upload -r amnezia "*" -c
-
-# ------------------------------------------------------
-
-  Build-MacOS:
-    runs-on: macos-latest
-
-    needs: Bake-Prebuilts-MacOS
-    if: ${{ always() }}
-
    env:
-      QT_VERSION: 6.10.1
-      KEYCHAIN_PASSWORD: ""
+      # Keep compat with MacOS 10.15 aka Catalina by Qt 6.4
+      QT_VERSION: 6.4.3
+
+      MAC_TEAM_ID: ${{ secrets.MAC_TEAM_ID }}
+
+      MAC_APP_CERT_CERT: ${{ secrets.MAC_APP_CERT_CERT }}
+      MAC_SIGNER_ID: ${{ secrets.MAC_SIGNER_ID }}
+      MAC_APP_CERT_PW: ${{ secrets.MAC_APP_CERT_PW }}
+
+      MAC_INSTALLER_SIGNER_CERT: ${{ secrets.MAC_INSTALLER_SIGNER_CERT }}
+      MAC_INSTALLER_SIGNER_ID: ${{ secrets.MAC_INSTALLER_SIGNER_ID }}
+      MAC_INSTALL_CERT_PW: ${{ secrets.MAC_INSTALL_CERT_PW }}
+
+      APPLE_DEV_EMAIL: ${{ secrets.APPLE_DEV_EMAIL }}
+      APPLE_DEV_PASSWORD: ${{ secrets.APPLE_DEV_PASSWORD }}

      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -451,31 +325,83 @@ jobs:
      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}

    steps:
+    - name: 'Setup xcode'
+      uses: maxim-lobanov/setup-xcode@v1
+      with:
+        xcode-version: '15.4.0'
+
+    - name: 'Install Qt'
+      uses: jurplel/install-qt-action@v3
+      with:
+        version: ${{ env.QT_VERSION }}
+        host: 'mac'
+        target: 'desktop'
+        arch: 'clang_64'
+        modules: 'qtremoteobjects qt5compat qtshadertools'
+        dir: ${{ runner.temp }}
+        setup-python: 'true'
+        set-env: 'true'
+        extra: '--external 7z --base ${{ env.QT_MIRROR }}'
+
+
    - name: 'Get sources'
      uses: actions/checkout@v4
      with:
        submodules: 'true'
        fetch-depth: 10

-    - uses: ./.github/actions/apple-setup-keychain
-      id: setup-keychain
-      with:
-        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
+    # - name: 'Setup ccache'
+    #   uses: hendrikmuhs/ccache-action@v1.2

-    - uses: ./.github/actions/apple-install-cert
-      with:
-        keychain-path: ${{ steps.setup-keychain.outputs.keychain-path }}
-        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
-        cert-base64: ${{ secrets.MAC_APP_CERT_CERT }}
-        cert-password: ${{ secrets.MAC_APP_CERT_PW }}
+    - name: 'Build project'
+      run: |
+        export QT_BIN_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/macos/bin"
+        bash deploy/build_macos.sh -n

-    - uses: ./.github/actions/apple-install-cert
+    - name: 'Upload installer artifact'
+      uses: actions/upload-artifact@v4
      with:
-        keychain-path: ${{ steps.setup-keychain.outputs.keychain-path }}
-        keychain-password: ${{ env.KEYCHAIN_PASSWORD }}
-        cert-base64: ${{ secrets.MAC_INSTALLER_SIGNER_CERT }}
-        cert-password: ${{ secrets.MAC_INSTALL_CERT_PW }}
+        name: AmneziaVPN_MacOS_old_installer
+        path: deploy/build/pkg/AmneziaVPN.pkg
+        retention-days: 7

+    - name: 'Upload unpacked artifact'
+      uses: actions/upload-artifact@v4
+      with:
+        name: AmneziaVPN_MacOS_old_unpacked
+        path: deploy/build/client/AmneziaVPN.app
+        retention-days: 7
+
+# ------------------------------------------------------
+
+  Build-MacOS:
+    runs-on: macos-latest
+
+    env:
+      QT_VERSION: 6.10.1
+
+      MAC_TEAM_ID: ${{ secrets.MAC_TEAM_ID }}
+
+      MAC_APP_CERT_CERT: ${{ secrets.MAC_APP_CERT_CERT }}
+      MAC_SIGNER_ID: ${{ secrets.MAC_SIGNER_ID }}
+      MAC_APP_CERT_PW: ${{ secrets.MAC_APP_CERT_PW }}
+
+      MAC_INSTALLER_SIGNER_CERT: ${{ secrets.MAC_INSTALLER_SIGNER_CERT }}
+      MAC_INSTALLER_SIGNER_ID: ${{ secrets.MAC_INSTALLER_SIGNER_ID }}
+      MAC_INSTALL_CERT_PW: ${{ secrets.MAC_INSTALL_CERT_PW }}
+
+      APPLE_DEV_EMAIL: ${{ secrets.APPLE_DEV_EMAIL }}
+      APPLE_DEV_PASSWORD: ${{ secrets.APPLE_DEV_PASSWORD }}
+
+      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
+      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
+      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
+      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
+      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
+      FREE_V2_ENDPOINT: ${{ secrets.FREE_V2_ENDPOINT }}
+      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}
+
+    steps:
    - name: 'Setup xcode'
      uses: maxim-lobanov/setup-xcode@v1
      with:
@@ -494,79 +420,52 @@ jobs:
        set-env: 'true'
        aqtversion: '==3.3.0'       
        py7zrversion: '==0.22.*'  
-        extra: '--base ${{ env.QT_MIRROR }}'
+        extra: '--base ${{ env.QT_MIRROR }}' 

-    - name: 'Setup python'
-      uses: actions/setup-python@v6
-      with:
-        python-version: 3.14
-
-    - name: 'Install conan'
-      run: pip install "conan==2.26.2"
-
-    - name: 'Build project'
-      env:
-        QT_INSTALL_DIR: ${{ runner.temp }}
-        CODESIGN_SIGNATURE: ${{ secrets.MAC_SIGNER_ID }}
-        CODESIGN_INSTALLER_SIGNATURE: ${{ secrets.MAC_INSTALLER_SIGNER_ID }}
-        NOTARYTOOL_TEAM_ID: ${{ secrets.MAC_TEAM_ID }}
-        NOTARYTOOL_EMAIL: ${{ secrets.APPLE_DEV_EMAIL }}
-        NOTARYTOOL_PASSWORD: ${{ secrets.APPLE_DEV_PASSWORD }}
-      shell: bash
-      run: deploy/build.sh --generator Ninja --installer all
-
-    - name: 'Upload installer artifact'
-      uses: actions/upload-artifact@v7
-      with:
-        path: deploy/build/AmneziaVPN-*-Darwin.pkg
-        archive: false
-        retention-days: 7
-
-# ------------------------------------------------------
-
-  Bake-Prebuilts-MacOS-NE:
-    runs-on: macos-latest
-    needs: Detect-Changes
-    if: needs.Detect-Changes.outputs.recipes_changed == 'true'
-
-    strategy:
-      matrix:
-        xcode-version: [16.2, 16.4]
-
-    steps:
-    - uses: actions/checkout@v4
+    - name: 'Get sources'
+      uses: actions/checkout@v4
      with:
        submodules: 'true'
        fetch-depth: 10
-    
-    - uses: actions/setup-python@v6
+
+    - name: 'Get version from CMakeLists.txt'
+      id: get_version
+      run: |
+        VERSION=$(grep 'set(AMNEZIAVPN_VERSION' CMakeLists.txt | sed -E 's/.*AMNEZIAVPN_VERSION ([0-9]+.[0-9]+.[0-9]+.[0-9]+)\)/\1/')
+        echo "VERSION=$VERSION" >> $GITHUB_ENV
+        echo "Version: $VERSION"
+
+    # - name: 'Setup ccache'
+    #   uses: hendrikmuhs/ccache-action@v1.2
+
+    - name: 'Build project'
+      run: |
+        export QT_BIN_DIR="${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/macos/bin"
+        bash deploy/build_macos.sh -n
+
+    - name: 'Pack macOS installer'
+      run: |
+        cd deploy/build/pkg
+        zip -r ../../AmneziaVPN_${VERSION}_macos.zip AmneziaVPN.pkg
+        cd ../../..
+
+    - name: 'Upload installer artifact'
+      uses: actions/upload-artifact@v4
      with:
-        python-version: 3.14
+        name: AmneziaVPN_${{ env.VERSION }}_macos.zip
+        path: deploy/AmneziaVPN_${{ env.VERSION }}_macos.zip
+        retention-days: 7

-    - uses: maxim-lobanov/setup-xcode@v1
+    - name: 'Upload unpacked artifact'
+      uses: actions/upload-artifact@v4
      with:
-        xcode-version: ${{ matrix.xcode-version }}
-
-    - name: 'Install conan'
-      run: pip install "conan==2.26.2"
-
-    - name: 'Build dependencies'
-      run: cmake -S . -B build -G Xcode -DPREBUILTS_ONLY=1 -DMACOS_NE=TRUE
-    
-    - name: 'Authorize in remote'
-      run: conan remote login amnezia "${{ secrets.CONAN_USER }}" -p "${{ secrets.CONAN_PASSWORD }}"
-
-    - name: 'Upload baked prebuilts'
-      run: conan upload -r amnezia "*" -c
-
-# ------------------------------------------------------
+        name: AmneziaVPN_MacOS_unpacked
+        path: deploy/build/client/AmneziaVPN.app
+        retention-days: 7

  Build-MacOS-NE:
    runs-on: macos-latest

-    needs: Bake-Prebuilts-MacOS-NE
-    if: ${{ always() }}
-
    env:
      QT_VERSION: 6.10.1

@@ -578,7 +477,6 @@ jobs:

      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -586,14 +484,6 @@ jobs:
      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}

    steps:
-    - uses: ./.github/actions/apple-setup-provisioning-profile
-      with:
-        provisioning_profile_base64: ${{ secrets.MAC_APP_PROVISIONING_PROFILE }}
-
-    - uses: ./.github/actions/apple-setup-provisioning-profile
-      with:
-        provisioning_profile_base64: ${{ secrets.MAC_NE_PROVISIONING_PROFILE }}
-
    - name: 'Setup xcode'
      uses: maxim-lobanov/setup-xcode@v1
      with:
@@ -629,13 +519,8 @@ jobs:
        submodules: 'true'
        fetch-depth: 10

-    - name: 'Setup python'
-      uses: actions/setup-python@v6
-      with:
-        python-version: 3.14
-
-    - name: 'Install conan'
-      run: pip install "conan==2.26.2"
+    # - name: 'Setup ccache'
+    #   uses: hendrikmuhs/ccache-action@v1.2

    - name: 'Build project'
      run: |
@@ -649,74 +534,17 @@ jobs:
        path: deploy/build/client/AmneziaVPN.app
        retention-days: 7

-# ------------------------------------------------------
-
-  Bake-Prebuilts-Android:
-    runs-on: android-runner
-    needs: Detect-Changes
-    if: needs.Detect-Changes.outputs.recipes_changed == 'true'
-
-    env:
-      ANDROID_PLATFORM: android-28
-      NDK_VERSION: 27.0.11718014
-
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        submodules: 'true'
-        fetch-depth: 10
-    
-    - uses: actions/setup-python@v6
-      with:
-        python-version: 3.14
-
-    - name: 'Install conan'
-      run: pip install "conan==2.26.2"
-
-    - name: 'Setup Android SDK'
-      uses: android-actions/setup-android@v4
-      with:
-        packages: "platforms;${{ env.ANDROID_PLATFORM }} ndk;${{ env.NDK_VERSION }}"
-
-    - name: 'Build dependencies'
-      run: |
-        CMAKE_ANDROID_NDK="$ANDROID_HOME/ndk/$NDK_VERSION"
-        args=(
-          -G Ninja
-          -DPREBUILTS_ONLY=1
-          -DCMAKE_SYSTEM_NAME=Android
-          "-DANDROID_PLATFORM=$ANDROID_PLATFORM"
-          "-DCMAKE_ANDROID_NDK=$CMAKE_ANDROID_NDK"
-        )
-
-        for abi in arm64-v8a armeabi-v7a x86 x86_64; do
-          for build_type in Release Debug; do
-            cmake -S . -B build_${abi//-/_} "${args[@]}" "-DCMAKE_ANDROID_ARCH_ABI=$abi" "-DCMAKE_BUILD_TYPE=$build_type"
-          done
-        done
-
-    - name: 'Authorize in remote'
-      run: conan remote login amnezia "${{ secrets.CONAN_USER }}" -p "${{ secrets.CONAN_PASSWORD }}"
-
-    - name: 'Upload baked prebuilts'
-      run: conan upload -r amnezia "*" -c
-
 # ------------------------------------------------------

  Build-Android:
    runs-on: android-runner

-    needs: Bake-Prebuilts-Android
-    if: ${{ always() }}
-
    env:
-      ANDROID_PLATFORM: android-28
-      NDK_VERSION: 27.0.11718014
+      ANDROID_BUILD_PLATFORM: android-36
      QT_VERSION: 6.10.1
      QT_MODULES: 'qtremoteobjects qt5compat qtimageformats qtshadertools'
      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
@@ -724,11 +552,6 @@ jobs:
      PREM_V1_ENDPOINT: ${{ secrets.PREM_V1_ENDPOINT }}

    steps:
-    - name: 'Get sources'
-      uses: actions/checkout@v4
-      with:
-        submodules: 'true'
-
    - name: 'Install desktop Qt'
      uses: jurplel/install-qt-action@v4
      with:
@@ -789,24 +612,38 @@ jobs:
        py7zrversion: '==0.22.*'
        extra: '--base ${{ env.QT_MIRROR }}'

+    - name: 'Grant execute permission for qt-cmake'
+      shell: bash
+      run: |
+        chmod +x ${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/android_x86_64/bin/qt-cmake
+
+    - name: 'Get sources'
+      uses: actions/checkout@v4
+      with:
+        submodules: 'true'
+
+    - name: 'Get version from CMakeLists.txt'
+      id: get_version
+      run: |
+        VERSION=$(grep 'set(AMNEZIAVPN_VERSION' CMakeLists.txt | sed -E 's/.*AMNEZIAVPN_VERSION ([0-9]+.[0-9]+.[0-9]+.[0-9]+)\)/\1/')
+        echo "VERSION=$VERSION" >> $GITHUB_ENV
+        echo "Version: $VERSION"
+
+    # - name: 'Setup ccache'
+    #   uses: hendrikmuhs/ccache-action@v1.2
+
    - name: 'Setup Java'
      uses: actions/setup-java@v4
      with:
        distribution: 'temurin'
        java-version: '17'
+        # cache: 'gradle'

-    - name: 'Setup Android SDK'
-      uses: android-actions/setup-android@v4
+    - name: 'Setup Android NDK'
+      id: setup-ndk
+      uses: nttld/setup-ndk@v1
      with:
-        packages: "platforms;${{ env.ANDROID_PLATFORM }} ndk;${{ env.NDK_VERSION }}"
-
-    - name: 'Setup python'
-      uses: actions/setup-python@v6
-      with:
-        python-version: 3.14
-
-    - name: 'Install conan'
-      run: pip install "conan==2.26.2"
+        ndk-version: 'r26b'

    - name: 'Decode keystore secret to file'
      env:
@@ -817,64 +654,61 @@ jobs:

    - name: 'Build project'
      env:
-        QT_INSTALL_DIR: ${{ runner.temp }}
-        QT_ANDROID_KEYSTORE_PATH: ${{ github.workspace }}/android.keystore
-        QT_ANDROID_KEYSTORE_ALIAS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_KEY_ALIAS }}
-        QT_ANDROID_KEYSTORE_STORE_PASS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_KEY_PASS }}
+        ANDROID_NDK_ROOT: ${{ steps.setup-ndk.outputs.ndk-path }}
+        QT_HOST_PATH: ${{ runner.temp }}/Qt/${{ env.QT_VERSION }}/gcc_64
+        ANDROID_KEYSTORE_PATH: ${{ github.workspace }}/android.keystore
+        ANDROID_KEYSTORE_KEY_ALIAS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_KEY_ALIAS }}
+        ANDROID_KEYSTORE_KEY_PASS: ${{ secrets.ANDROID_RELEASE_KEYSTORE_KEY_PASS }}
      shell: bash
+      run: ./deploy/build_android.sh --aab --apk all --build-platform ${{ env.ANDROID_BUILD_PLATFORM }}
+
+    - name: 'Rename Android APKs'
      run: |
-        deploy/build.sh -t android --sign --aab
+        cd deploy/build
+        mv AmneziaVPN-x86_64-release.apk AmneziaVPN_${VERSION}_android9+_x86_64.apk
+        mv AmneziaVPN-x86-release.apk AmneziaVPN_${VERSION}_android9+_x86.apk
+        mv AmneziaVPN-arm64-v8a-release.apk AmneziaVPN_${VERSION}_android9+_arm64-v8a.apk
+        mv AmneziaVPN-armeabi-v7a-release.apk AmneziaVPN_${VERSION}_android9+_armeabi-v7a.apk
+        cd ../..

-        VERSION=$(grep CMAKE_PROJECT_VERSION:STATIC deploy/build/CMakeCache.txt | cut -d= -f2)
-
-        (cd deploy/build/client/android-build && mv AmneziaVPN.apk AmneziaVPN_${VERSION}_android9+_universal.apk)
-        (cd deploy/build/client/android-build/build/outputs/bundle/release && mv android-build-release.aab AmneziaVPN_${VERSION}.aab)
-
-        for abi in arm64-v8a armeabi-v7a x86 x86_64; do
-          deploy/build.sh -t android --sign --abi ${abi} --build ./deploy/build/${abi}
-          (cd deploy/build/${abi}/client/android-build && mv AmneziaVPN.apk AmneziaVPN_${VERSION}_android9+_${abi}.apk)
-        done
-
-    - name: 'Upload universal APK'
-      uses: actions/upload-artifact@v7
+    - name: 'Upload x86_64 apk'
+      uses: actions/upload-artifact@v4
      with:
-        path: deploy/build/client/android-build/*.apk
-        archive: false
+        name: AmneziaVPN_${{ env.VERSION }}_android9+_x86_64.apk
+        path: deploy/build/AmneziaVPN_${{ env.VERSION }}_android9+_x86_64.apk
+        compression-level: 0
        retention-days: 7

-    - name: 'Upload AAB'
-      uses: actions/upload-artifact@v7
+    - name: 'Upload x86 apk'
+      uses: actions/upload-artifact@v4
      with:
-        path: deploy/build/client/android-build/build/outputs/bundle/release/*.aab
-        archive: false
+        name: AmneziaVPN_${{ env.VERSION }}_android9+_x86.apk
+        path: deploy/build/AmneziaVPN_${{ env.VERSION }}_android9+_x86.apk
+        compression-level: 0
        retention-days: 7

-    - name: 'Upload arm64-v8a APK'
-      uses: actions/upload-artifact@v7
+    - name: 'Upload arm64-v8a apk'
+      uses: actions/upload-artifact@v4
      with:
-        path: deploy/build/arm64-v8a/client/android-build/*.apk
-        archive: false
+        name: AmneziaVPN_${{ env.VERSION }}_android9+_arm64-v8a.apk
+        path: deploy/build/AmneziaVPN_${{ env.VERSION }}_android9+_arm64-v8a.apk
+        compression-level: 0
        retention-days: 7

-    - name: 'Upload armeabi-v7a APK'
-      uses: actions/upload-artifact@v7
+    - name: 'Upload armeabi-v7a apk'
+      uses: actions/upload-artifact@v4
      with:
-        path: deploy/build/armeabi-v7a/client/android-build/*.apk
-        archive: false
+        name: AmneziaVPN_${{ env.VERSION }}_android9+_armeabi-v7a.apk
+        path: deploy/build/AmneziaVPN_${{ env.VERSION }}_android9+_armeabi-v7a.apk
+        compression-level: 0
        retention-days: 7

-    - name: 'Upload x86 APK'
-      uses: actions/upload-artifact@v7
+    - name: 'Upload aab'
+      uses: actions/upload-artifact@v4
      with:
-        path: deploy/build/x86/client/android-build/*.apk
-        archive: false
-        retention-days: 7
-
-    - name: 'Upload x86_64 APK'
-      uses: actions/upload-artifact@v7
-      with:
-        path: deploy/build/x86_64/client/android-build/*.apk
-        archive: false
+        name: AmneziaVPN-android
+        path: deploy/build/AmneziaVPN-release.aab
+        compression-level: 0
        retention-days: 7

  Extra:
--- a/.github/workflows/tag-deploy.yml
+++ b/.github/workflows/tag-deploy.yml
@@ -17,7 +17,6 @@ jobs:
      QIF_VERSION: 4.5
      PROD_AGW_PUBLIC_KEY: ${{ secrets.PROD_AGW_PUBLIC_KEY }}
      PROD_S3_ENDPOINT: ${{ secrets.PROD_S3_ENDPOINT }}
-      FALLBACK_S3_ENDPOINT: ${{ secrets.FALLBACK_S3_ENDPOINT }}
      DEV_AGW_PUBLIC_KEY: ${{ secrets.DEV_AGW_PUBLIC_KEY }}
      DEV_AGW_ENDPOINT: ${{ secrets.DEV_AGW_ENDPOINT }}
      DEV_S3_ENDPOINT: ${{ secrets.DEV_S3_ENDPOINT }}
--- a/.gitignore
+++ b/.gitignore
@@ -81,7 +81,6 @@ client/.DS_Store
 ._.DS_Store
 ._*
 *.dmg
-deploy/data/macos/pf/amn.400.allowPIA.conf

 # tmp files
 *.*~
--- a/.gitmodules
+++ b/.gitmodules
@@ -4,6 +4,10 @@
 [submodule "client/3rd/SortFilterProxyModel"]
 	path = client/3rd/SortFilterProxyModel
 	url = https://github.com/mitchcurtis/SortFilterProxyModel.git
+[submodule "client/3rd-prebuilt"]
+	path = client/3rd-prebuilt
+	url = https://github.com/amnezia-vpn/3rd-prebuilt
+	branch = feature/special-handshake
 [submodule "client/3rd/amneziawg-apple"]
 	path = client/3rd/amneziawg-apple
 	url = https://github.com/amnezia-vpn/amneziawg-apple
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,34 +1,18 @@
 cmake_minimum_required(VERSION 3.25.0 FATAL_ERROR)

-set(CMAKE_CXX_STANDARD 17)
-set(CMAKE_CXX_STANDARD_REQUIRED ON)
-
 set(PROJECT AmneziaVPN)
-set(AMNEZIAVPN_VERSION 4.9.0.2)
-
-set(QT_CREATOR_SKIP_PACKAGE_MANAGER_SETUP ON CACHE BOOL "" FORCE)
-set(CMAKE_PROJECT_TOP_LEVEL_INCLUDES
-    ${CMAKE_SOURCE_DIR}/cmake/platform_settings.cmake
-    ${CMAKE_SOURCE_DIR}/cmake/recipes_bootstrap.cmake
-    ${CMAKE_SOURCE_DIR}/cmake/conan_provider.cmake
-    CACHE STRING "" FORCE)
+set(AMNEZIAVPN_VERSION 4.8.13.0)

 project(${PROJECT} VERSION ${AMNEZIAVPN_VERSION}
        DESCRIPTION "AmneziaVPN"
        HOMEPAGE_URL "https://amnezia.org/"
 )

-if (PREBUILTS_ONLY)
-    # trigger conan to kick off `conan install`
-    find_package(OpenSSL REQUIRED)
-    return()
-endif()
-
 string(TIMESTAMP CURRENT_DATE "%Y-%m-%d")
 set(RELEASE_DATE "${CURRENT_DATE}")

 set(APP_MAJOR_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})
-set(APP_ANDROID_VERSION_CODE 2120)
+set(APP_ANDROID_VERSION_CODE 2106)

 if(${CMAKE_SYSTEM_NAME} STREQUAL "Linux")
    set(MZ_PLATFORM_NAME "linux")
@@ -45,34 +29,56 @@ elseif(${CMAKE_SYSTEM_NAME} STREQUAL "Emscripten")
 endif()

 set(QT_BUILD_TOOLS_WHEN_CROSS_COMPILING ON)
+set(CMAKE_CXX_STANDARD 17)
+set(CMAKE_CXX_STANDARD_REQUIRED ON)

-if(APPLE AND NOT IOS)
-    if(CMAKE_BUILD_TYPE STREQUAL "Debug")
-        set(AMN_PF_RULE_IDENTITY "user { root }")
+if(APPLE)
+    if(IOS)
+        set(CMAKE_OSX_ARCHITECTURES "arm64")
+    elseif(MACOS_NE)
+        set(CMAKE_OSX_ARCHITECTURES "arm64;x86_64")
    else()
-        set(AMN_PF_RULE_IDENTITY "group { amnvpn }")
+        set(CMAKE_OSX_ARCHITECTURES "x86_64")
    endif()
-
-    configure_file(
-        "${CMAKE_SOURCE_DIR}/deploy/data/pf-templates/amn.400.allowPIA.conf.in"
-        "${CMAKE_CURRENT_BINARY_DIR}/amn.400.allowPIA.conf"
-        @ONLY
-    )
-
-    file(COPY_FILE
-        "${CMAKE_CURRENT_BINARY_DIR}/amn.400.allowPIA.conf"
-        "${CMAKE_SOURCE_DIR}/deploy/data/macos/pf/amn.400.allowPIA.conf"
-        ONLY_IF_DIFFERENT
-    )
 endif()

-
 add_subdirectory(client)

 if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
    add_subdirectory(service)
+
+    include(${CMAKE_SOURCE_DIR}/deploy/installer/config.cmake)
 endif()

-if ((LINUX AND NOT ANDROID) OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (WIN32))
-    include(${CMAKE_SOURCE_DIR}/cmake/CPack.cmake)
+set(AMNEZIA_STAGE_DIR "${CMAKE_BINARY_DIR}/stage")
+
+if(WIN32 AND NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
+    file(TO_CMAKE_PATH "${AMNEZIA_STAGE_DIR}" AMNEZIA_STAGE_DIR_CMAKE)
+
+    set(CPACK_GENERATOR "WIX")
+    set(CPACK_WIX_VERSION 4)
+    set(CPACK_PACKAGE_NAME "AmneziaVPN")
+    set(CPACK_PACKAGE_VENDOR "AmneziaVPN")
+    set(CPACK_PACKAGE_VERSION ${AMNEZIAVPN_VERSION})
+    set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "AmneziaVPN client")
+    set(CPACK_PACKAGE_INSTALL_DIRECTORY "AmneziaVPN")
+    set(CPACK_PACKAGE_DIRECTORY "${CMAKE_BINARY_DIR}")
+    set(CPACK_PACKAGE_EXECUTABLES "AmneziaVPN" "AmneziaVPN")
+    set(CPACK_WIX_UPGRADE_GUID "{2D55AC62-96D6-4692-8C05-0D85BBF95485}")
+    set(CPACK_WIX_PRODUCT_ICON "${CMAKE_SOURCE_DIR}/client/images/app.ico")
+
+    # WiX patches
+    set(_AMNEZIA_WIX_PATCH_SERVICE "${CMAKE_SOURCE_DIR}/deploy/installer/wix/service_install_patch.xml")
+    set(_AMNEZIA_WIX_PATCH_CLOSE_APP "${CMAKE_SOURCE_DIR}/deploy/installer/wix/close_client_patch.xml")
+    file(TO_CMAKE_PATH "${_AMNEZIA_WIX_PATCH_SERVICE}" _AMNEZIA_WIX_PATCH_SERVICE_CMAKE)
+    file(TO_CMAKE_PATH "${_AMNEZIA_WIX_PATCH_CLOSE_APP}" _AMNEZIA_WIX_PATCH_CLOSE_APP_CMAKE)
+    set(CPACK_WIX_PATCH_FILE "${_AMNEZIA_WIX_PATCH_SERVICE_CMAKE};${_AMNEZIA_WIX_PATCH_CLOSE_APP_CMAKE}")
+
+    # WiX v4 Util extension for CloseApplication + namespace for util
+    set(CPACK_WIX_EXTENSIONS "${CPACK_WIX_EXTENSIONS};WixToolset.Util.wixext")
+    set(CPACK_WIX_CUSTOM_XMLNS "util=http://wixtoolset.org/schemas/v4/wxs/util")
+
+    set(CPACK_INSTALLED_DIRECTORIES "${AMNEZIA_STAGE_DIR_CMAKE};/")
+
+    include(CPack)
 endif()
--- a/README.md
+++ b/README.md
@@ -53,14 +53,24 @@ AmneziaVPN uses several open-source projects to work:

 - [OpenSSL](https://www.openssl.org/)
 - [OpenVPN](https://openvpn.net/)
+- [Shadowsocks](https://shadowsocks.org/)
 - [Qt](https://www.qt.io/)
- [LibSsh](https://libssh.org)
- [WireGuard](https://www.wireguard.com/)
- [Xray-core](https://xtls.github.io/en/)
- [Conan](https://conan.io/)
+- [LibSsh](https://libssh.org) - forked from Qt Creator
 - and more...

-## Help us with translations
+## Checking out the source code
+
+Make sure to pull all submodules after checking out the repo.
+
+```bash
+git submodule update --init --recursive
+```
+
+## Development
+
+Want to contribute? Welcome!
+
+### Help with translations

 Download the most actual translation files.

@@ -73,102 +83,103 @@ Each *.ts file contains strings for one corresponding language.
 Translate or correct some strings in one or multiple *.ts files and commit them back to this repository into the ``client/translations`` folder.
 You can do it via a web-interface or any other method you're familiar with.

-## Checking out the source code
+### Building sources and deployment

-Make sure to pull all submodules after checking out the repo.
+Check deploy folder for build scripts. 

+### How to build an iOS app from source code on MacOS
+
+1. First, make sure you have [XCode](https://developer.apple.com/xcode/) installed, at least version 14 or higher.
+
+2. We use QT to generate the XCode project. We need QT version 6.6.2. Install QT for MacOS [here](https://doc.qt.io/qt-6/macos.html) or [QT Online Installer](https://www.qt.io/download-open-source). Required modules:
+   - MacOS
+   - iOS
+   - Qt 5 Compatibility Module
+   - Qt Shader Tools
+   - Additional Libraries:
+     - Qt Image Formats
+     - Qt Multimedia
+     - Qt Remote Objects 
+
+3. Install CMake if required. We recommend CMake version 3.25. You can install CMake [here](https://cmake.org/download/)
+
+4. You also need to install go >= v1.16. If you don't have it installed already,
+download go from the [official website](https://golang.org/dl/) or use Homebrew. 
+The latest version is recommended. Install gomobile
 ```bash
-git submodule update --init --recursive
+export PATH=$PATH:~/go/bin
+go install golang.org/x/mobile/cmd/gomobile@latest
+gomobile init
 ```

-## Hacking guide
-
-Want to contribute? Welcome!
-
-### Build requirements
-
-* [`CMake`](https://cmake.org/download/)
-* Compiler and underlying build system, depending on the target:
-  - [Linux] Any of `make` and `gcc`
-  - [Apple] [`Xcode`](https://developer.apple.com/xcode/) or [`Xcode command line tools`](https://developer.apple.com/xcode/)
-  - [Windows] [`Visual Studio 2022`](https://aka.ms/vs/17/release/vs_community.exe) or [`VS 2022 Build Tools`](https://aka.ms/vs/17/release/vs_buildtools.exe)
-  - [Android] [`Android SDK`](#installing-android-sdk) and [`Ninja`](https://ninja-build.org/)
-* [`Qt 6.10+`](https://www.qt.io/download-open-source) with the following modules:
-  - Core module for targeting platform (Desktop/Android/iOS)
-  - Qt 5 Compatibility module
-  - Qt Remote Objects
-* [`Conan`](https://conan.io/downloads) package manager
-  - On MacOS is enough just to use `homebrew` or install it in `.venv` in project root
-  - Other systems must have it in `PATH`
-* (Optional) Installer dependencies:
-  - [Windows/Linux] [`Qt Installer Framework`](https://www.qt.io/download-open-source)
-  - [Windows] [`WIX toolset`](https://github.com/wixtoolset/wix/releases)
-
-### Building the project using scripts
-
-* Run scripts located in `deploy` directory
-* Basically, if dependencies are located in default installation paths, the scripts will find them automatically.
-* If they differ, specify them using the following variables:
-  - `QT_INSTALL_DIR` - Qt root installation folder
-  - `QT_ROOT_PATH`   - Qt framework root directory
-  - `QIF_ROOT_PATH`  - Qt Installer Framework root path
-  - `ANDROID_HOME`   - Path to Android SDK root folder
-  - and others. Check scripts for more
-
-Unix-like:
+5. Build the project
 ```bash
-# Build executables for the host platform
-deploy/build.sh
+export QT_BIN_DIR="<PATH-TO-QT-FOLDER>/Qt/<QT-VERSION>/ios/bin"
+export QT_MACOS_ROOT_DIR="<PATH-TO-QT-FOLDER>/Qt/<QT-VERSION>/macos"
+export QT_IOS_BIN=$QT_BIN_DIR
+export PATH=$PATH:~/go/bin
+mkdir build-ios
+$QT_IOS_BIN/qt-cmake . -B build-ios -GXcode -DQT_HOST_PATH=$QT_MACOS_ROOT_DIR
+```
+Replace PATH-TO-QT-FOLDER and QT-VERSION to your environment

-# Or just
-deploy/build.sh

-# Build executables and installers for the host platform
-deploy/build.sh --installer all
-
-# Build Android APK and AAB
-deploy/build.sh -t android --aab
-
-# Call for help
-deploy/build.sh -h
+If you get `gomobile: command not found` make sure to set PATH to the location 
+of the bin folder where gomobile was installed. Usually, it's in `GOPATH`.
+```bash
+export PATH=$(PATH):/path/to/GOPATH/bin
 ```

-Windows:
-```batch
-:: Build executables for Windows
-deploy/build.bat
+6. Open the XCode project. You can then run /test/archive/ship the app.

-:: Build executables with IFW installer for Windows
-deploy/build.bat --installer ifw
+If the build fails with the following error
+```
+make: *** 
+[$(PROJECTDIR)/client/build/AmneziaVPN.build/Debug-iphoneos/wireguard-go-bridge/goroot/.prepared] 
+Error 1
+```
+Add a user-defined variable to both AmneziaVPN and WireGuardNetworkExtension targets' build settings with
+key `PATH` and value `${PATH}/path/to/bin/folder/with/go/executable`, e.g. `${PATH}:/usr/local/go/bin`.

-:: Build executables with IFW and WIX installer for Windows
-deploy/build.bat --installer ifw --installer wix
-
-:: Or just
-deploy/build.bat --installer all
+if the above error persists on your M1 Mac, then most probably you need to install arch based CMake 
+```
+arch -arm64 brew install cmake
 ```

-### Developing the project in IDEs
+Build might fail with the "source files not found" error the first time you try it, because the modern XCode build system compiles dependencies in parallel, and some dependencies end up being built after the ones that
+require them. In this case, simply restart the build.

-* Basically, you can use any IDE that handles CMake and Qt kits properly to run configure and build steps, and to navigate through the code nicely. For example:
-  - `Qt Creator`
-  - `Visual Studio Code` with `Qt Extension Pack`
-  - and so on
+## How to build the Android app

-* To use `Xcode`, you have to configure project first by using `cmake`. The easiest way to do it is to use `Qt Creator` for configuration. Then open `AmneziaVPN.xcodeproj` file from the build folder by using `Xcode`. Note that none of the files changed are saved - the files actually getting changed in build directory. Copy them manually if necessary
+_Tested on Mac OS_

-* `Android studio` could be used in the same way - just configure the project by using `cmake` manually or by using `Qt Creator`. Open `<build-dir>/client/android-build` in `Android studio` then. Do not forget to copy the changes - everything you do is saved under the build directory actually.
+The Android app has the following requirements:
+* JDK 11
+* Android platform SDK 33
+* CMake 3.25.0

-### Installing Android SDK
+After you have installed QT, QT Creator, and Android Studio, you need to configure QT Creator correctly.

-* Android SDK could be installed using the following methods:
-  - Using `Qt Creator`. Use `Preferences`->`SDKs`
-  - Using `Android studio`. By default it installs necessary `SDKs` automatically during the installation
-  - Manually by using `sdk-manager`. Check [this](https://developer.android.com/tools) page for details
+- Click in the top menu bar on `QT Creator` -> `Preferences` -> `Devices` and select the tab `Android`.
+- Set path to JDK 11
+- Set path to Android SDK (`$ANDROID_HOME`)
+
+In case you get errors regarding missing SDK or 'SDK manager not running', you cannot fix them by correcting the paths. If you have some spare GBs on your disk, you can let QT Creator install all requirements by choosing an empty folder for `Android SDK location` and clicking on `Set Up SDK`. Be aware: This will install a second Android SDK and NDK on your machine! 
+Double-check that the right CMake version is configured:  Click on `QT Creator` -> `Preferences` and click on the side menu on `Kits`. Under the center content view's `Kits` tab, you'll find an entry for `CMake Tool`. If the default selected CMake version is lower than 3.25.0, install on your system CMake >= 3.25.0 and choose `System CMake at <path>` from the drop-down list. If this entry is missing, you either have not installed CMake yet or QT Creator hasn't found the path to it. In that case, click in the preferences window on the side menu item `CMake`, then on the tab `Tools` in the center content view, and finally on the button `Add` to set the path to your installed CMake. 
+Please make sure that you have selected Android Platform SDK 33 for your project: click in the main view's side menu on `Projects`, and on the left, you'll see a section `Build & Run` showing different Android build targets. You can select any of them, Amnezia VPN's project setup is designed in a way that all Android targets will be built. Click on the targets submenu item `Build` and scroll in the center content view to `Build Steps`. Click on `Details` at the end of the headline `Build Android APK` (the `Details` button might be hidden in case the QT Creator Window is not running in full screen!). Here we are: Choose `android-33` as `Android Build Platform SDK`.
+
+That's it! You should be ready to compile the project from QT Creator!
+
+### Development flow
+
+After you've hit the build button, QT-Creator copies the whole project to a folder in the repository parent directory. The folder should look something like `build-amnezia-client-Android_Qt_<version>_Clang_<architecture>-<BuildType>`.
+If you want to develop Amnezia VPNs Android components written in Kotlin, such as components using system APIs, you need to import the generated project in Android Studio with `build-amnezia-client-Android_Qt_<version>_Clang_<architecture>-<BuildType>/client/android-build` as the projects root directory. While you should be able to compile the generated project from Android Studio, you cannot work directly in the repository's Android project. So whenever you are confident with your work in the generated project, you'll need to copy and paste the affected files to the corresponding path in the repository's Android project so that you can add and commit your changes!
+
+You may face compiling issues in QT Creator after you've worked in Android Studio on the generated project. Just do a `./gradlew clean` in the generated project's root directory (`<path>/client/android-build/.`) and you should be good to go.

 ## License

-This project is licensed under the GNU General Public License v3.0 (see LICENSE) and also includes third-party components distributed under their own terms (see THIRD_PARTY_LICENSES.md).
+GPL v3.0

 ## Donate

--- a/README_RU.md
+++ b/README_RU.md
@@ -50,14 +50,23 @@ AmneziaVPN использует несколько проектов с откр

 - [OpenSSL](https://www.openssl.org/)
 - [OpenVPN](https://openvpn.net/)
+- [Shadowsocks](https://shadowsocks.org/)
 - [Qt](https://www.qt.io/)
 - [LibSsh](https://libssh.org)
- [WireGuard](https://www.wireguard.com/)
- [Xray-core](https://xtls.github.io/en/)
- [Conan](https://conan.io/)
 - и другие...

-## Помощь с переводами
+## Проверка исходного кода
+После клонирования репозитория обязательно загрузите все подмодули.
+
+```bash
+git submodule update --init --recursive
+```
+
+
+## Разработка
+Хотите внести свой вклад? Добро пожаловать!
+
+### Помощь с переводами

 Загрузите самые актуальные файлы перевода.

@@ -67,98 +76,90 @@ AmneziaVPN использует несколько проектов с откр

 Переведите или исправьте строки в одном или нескольких файлах *.ts и загрузите их обратно в этот репозиторий в папку ``client/translations``. Это можно сделать через веб-интерфейс или любым другим знакомым вам способом.

-## Проверка исходного кода
+### Сборка исходного кода и деплой
+Проверьте папку deploy для скриптов сборки.

-После клонирования репозитория обязательно загрузите все подмодули.
+### Как собрать iOS-приложение из исходного кода на MacOS
+1. Убедитесь, что у вас установлен Xcode версии 14 или выше.
+2. Для генерации проекта Xcode используется QT. Требуется версия QT 6.6.2. Установите QT для MacOS здесь или через QT Online Installer. Необходимые модули:
+- MacOS
+- iOS
+- Модуль совместимости с Qt 5
+- Qt Shader Tools
+- Дополнительные библиотеки:
+ - Qt Image Formats
+ - Qt Multimedia
+ - Qt Remote Objects
+
+   
+3. Установите CMake, если это необходимо. Рекомендуемая версия — 3.25. Скачать CMake можно здесь.
+4. Установите Go версии >= v1.16. Если Go ещё не установлен, скачайте его с  [официального сайта](https://golang.org/dl/) или используйте Homebrew. Установите gomobile:

 ```bash
-git submodule update --init --recursive
+export PATH=$PATH:~/go/bin
+go install golang.org/x/mobile/cmd/gomobile@latest
+gomobile init
 ```

-## Руководство по разработке
-
-Хотите внести свой вклад? Добро пожаловать!
-
-### Требования для сборки
-
-* [`CMake`](https://cmake.org/download/)
-* Компилятор и система сборки, в зависимости от таргета:
-  - [Linux] Любые `make` и `gcc`
-  - [Apple] [`Xcode`](https://developer.apple.com/xcode/) или [`Xcode command line tools`](https://developer.apple.com/xcode/)
-  - [Windows] [`Visual Studio 2022`](https://aka.ms/vs/17/release/vs_community.exe) или [`VS 2022 Build Tools`](https://aka.ms/vs/17/release/vs_buildtools.exe)
-  - [Android] [`Android SDK`](#установка-android-sdk) и [`Ninja`](https://ninja-build.org/)
-* [`Qt 6.10+`](https://www.qt.io/download-open-source) со следующими модулями:
-  - Основные модули для таргета (Desktop/Android/iOS)
-  - Qt 5 Compatibility module
-  - Qt Remote Objects
-* Пакетный менеджер [`Conan`](https://conan.io/downloads)
-  - На MacOS достаточно использовать `homebrew` или установить в `.venv` в корень проекта 
-  - Для остальных систем необходимо прописать пути в `PATH`
-* (Необязательно) Заивисимости для установщиков:
-  - [Windows/Linux] [`Qt Installer Framework`](https://www.qt.io/download-open-source)
-  - [Windows] [`WIX toolset`](https://github.com/wixtoolset/wix/releases)
-
-### Сборка проекта через скрипты
-
-* Запустите скрипты, находящиеся в папке `deploy`
-* Если все зависимости установлены в стандартных локациях, скрипт найдёт их самостоятельно
-* Если пути отличаются, их нужно явно указать используя:
-  - `QT_INSTALL_DIR` - корневая папка установки Qt
-  - `QT_ROOT_PATH`   - корневая папка Qt Framework
-  - `QIF_ROOT_PATH`  - корневая папка Qt Installer Framework
-  - `ANDROID_HOME`   - путь к Android SDK
-  - и другие. Их можно получить из вышеуказанных скриптов
-
-Unix-like:
+5. Соберите проект:
 ```bash
-# Build executables for the host platform
-deploy/build.sh
+export QT_BIN_DIR="<PATH-TO-QT-FOLDER>/Qt/<QT-VERSION>/ios/bin"
+export QT_MACOS_ROOT_DIR="<PATH-TO-QT-FOLDER>/Qt/<QT-VERSION>/macos"
+export QT_IOS_BIN=$QT_BIN_DIR
+export PATH=$PATH:~/go/bin
+mkdir build-ios
+$QT_IOS_BIN/qt-cmake . -B build-ios -GXcode -DQT_HOST_PATH=$QT_MACOS_ROOT_DIR
+```
+Замените <PATH-TO-QT-FOLDER> и <QT-VERSION> на ваши значения.

-# Or just
-deploy/build.sh
-
-# Build executables and installers for the host platform
-deploy/build.sh --installer all
-
-# Build Android APK and AAB
-deploy/build.sh -t android --aab
-
-# Call for help
-deploy/build.sh -h
+Если появляется ошибка gomobile: command not found, убедитесь, что PATH настроен на папку bin, где установлен gomobile:
+```bash
+export PATH=$(PATH):/path/to/GOPATH/bin
 ```

-Windows:
-```batch
-:: Build executables for Windows
-deploy/build.bat
+6. Откройте проект в Xcode. Теперь вы можете тестировать, архивировать или публиковать приложение.
+   
+Если сборка завершится с ошибкой:
+```
+make: *** 
+[$(PROJECTDIR)/client/build/AmneziaVPN.build/Debug-iphoneos/wireguard-go-bridge/goroot/.prepared] 
+Error 1
+```
+Добавьте пользовательскую переменную PATH в настройки сборки для целей AmneziaVPN и WireGuardNetworkExtension с ключом `PATH` и значением `${PATH}/path/to/bin/folder/with/go/executable`, e.g. `${PATH}:/usr/local/go/bin`.

-:: Build executables with IFW installer for Windows
-deploy/build.bat --installer ifw
-
-:: Build executables with IFW and WIX installer for Windows
-deploy/build.bat --installer ifw --installer wix
-
-:: Or just
-deploy/build.bat --installer all
+Если ошибка повторяется на Mac с M1, установите версию CMake для архитектуры ARM:
+```
+arch -arm64 brew install cmake
 ```

-### Разработка в IDE
+ При первой попытке сборка может завершиться с ошибкой source files not found. Это происходит из-за параллельной компиляции зависимостей в XCode. Просто перезапустите сборку.

-* Можно использовать любые IDE которые умеют работать с CMake и находить Qt Kits. Например:
-  - `Qt Creator`
-  - `Visual Studio Code` with `Qt Extension Pack`
-  - и так далее

-* Для использования `Xcode` нужно сконфигурировать проект с помощью `cmake`. Самый простой способ это сделать - использовать `Qt Creator` для конфигурации. Затем, нужно открыть файл `AmneziaVPN.xcodeproj` из папки сборки с помощью `Xcode`. Учтите, что никакие файлы фактически не сохраняются - они сохраняются в директории сборки. Если требуется, скопируйте файлы вручную
+## Как собрать Android-приложение
+Сборка тестировалась на MacOS. Требования:
+- JDK 11
+- Android SDK 33
+- CMake 3.25.0
+  
+Установите QT, QT Creator и Android Studio.
+Настройте QT Creator:

-* `Android studio` может быть использована подобным вышеуказанному способу - нужно использовать `cmake` вручную или через `Qt Creator` для конфигурации. Далее, откройте `<build-dir>/client/android-build` в `Android studio`. Не забудьте скопировать изменённые файлы в папку с исходным кодом - все файлы, изменённые в IDE, сохраняются фактически в папке сборки.
+- В меню QT Creator перейдите в  `QT Creator` -> `Preferences` -> `Devices` ->`Android`.
+- Укажите путь к JDK 11.
+- Укажите путь к Android SDK (`$ANDROID_HOME`)

-### Установка Android SDK
+Если вы сталкиваетесь с ошибками, связанными с отсутствием SDK или сообщением «SDK manager not running», их нельзя исправить просто корректировкой путей. Если у вас есть несколько свободных гигабайт на диске, вы можете позволить Qt Creator установить все необходимые компоненты, выбрав пустую папку для расположения Android SDK и нажав кнопку **Set Up SDK**. Учтите: это установит второй Android SDK и NDK на вашем компьютере!
+
+Убедитесь, что настроена правильная версия CMake: перейдите в **Qt Creator -> Preferences** и в боковом меню выберите пункт **Kits**. В центральной части окна, на вкладке **Kits**, найдите запись для инструмента **CMake Tool**. Если выбранная по умолчанию версия CMake ниже 3.25.0, установите на свою систему CMake версии 3.25.0 или выше, а затем выберите опцию **System CMake at <путь>** из выпадающего списка. Если этот пункт отсутствует, это может означать, что вы еще не установили CMake, или Qt Creator не смог найти путь к нему. В таком случае в окне **Preferences** перейдите в боковое меню **CMake**, затем во вкладку **Tools** в центральной части окна и нажмите кнопку **Add**, чтобы указать путь к установленному CMake.
+
+Убедитесь, что для вашего проекта выбрана Android Platform SDK 33: в главном окне на боковой панели выберите пункт **Projects**, и слева вы увидите раздел **Build & Run**, показывающий различные целевые Android-платформы. Вы можете выбрать любую из них, так как настройка проекта Amnezia VPN разработана таким образом, чтобы все Android-цели могли быть собраны. Перейдите в подраздел **Build** и прокрутите центральную часть окна до раздела **Build Steps**. Нажмите **Details** в заголовке **Build Android APK** (кнопка **Details** может быть скрыта, если окно Qt Creator не запущено в полноэкранном режиме!). Вот здесь выберите **android-33** в качестве Android Build Platform SDK.
+
+### Разработка Android-компонентов
+
+После сборки QT Creator копирует проект в отдельную папку, например, `build-amnezia-client-Android_Qt_<version>_Clang_<architecture>-<BuildType>`. Для разработки Android-компонентов откройте сгенерированный проект в Android Studio, указав папку `build-amnezia-client-Android_Qt_<version>_Clang_<architecture>-<BuildType>/client/android-build` в качестве корневой.
+Изменения в сгенерированном проекте нужно вручную перенести в репозиторий. После этого можно коммитить изменения.
+Если возникают проблемы со сборкой в QT Creator после работы в Android Studio, выполните команду `./gradlew clean` в корневой папке сгенерированного проекта (`<path>/client/android-build/.`).

-* Android SDK может быть установлен следующими способами:
-  - Используя `Qt Creator`, через настройки в пунктах `Preferences`->`SDKs`
-  - Используя `Android studio`. По умолчанию необходимые `SDK` устанавливаются автоматически.
-  - Вручную, используя `sdk-manager`. Подробности можно найти [здесь](https://developer.android.com/tools)

 ## Лицензия

--- a/THIRD_PARTY_LICENSES.md
+++ b/THIRD_PARTY_LICENSES.md
@@ -1,149 +0,0 @@
-# Third-Party Licenses
-
-This project is licensed under the GNU General Public License v3.0.
-This file lists third-party software components used by this repository.
-Each component is distributed under its own license as linked below.
-
---
-
-## QtKeychain
-
- Source: https://github.com/frankosterfeld/qtkeychain
- License: BSD License
- License Text: https://www.gnu.org/licenses/license-list.html#ModifiedBSD
-
---
-
-## QSimpleCrypto
-
- Source: https://github.com/n1flh31mur/QSimpleCrypto
- License: Apache License 2.0
- License Text: https://github.com/n1flh31mur/QSimpleCrypto/blob/master/LICENSE
-
---
-
-## SortFilterProxyModel
-
- Source: https://github.com/oKcerG/SortFilterProxyModel
- License: MIT License
- License Text: https://github.com/oKcerG/SortFilterProxyModel/blob/master/LICENSE
-
---
-
-## QJsonStruct
-
- Source: https://github.com/Qv2ray/QJsonStruct
- License: MIT License
- License Text: https://github.com/Qv2ray/QJsonStruct/blob/master/LICENSE
-
---
-
-## QR Code Generator (qrcodegen)
-
- Source: https://github.com/nayuki/QR-Code-generator
- License: MIT License
- License Text: https://www.nayuki.io/page/qr-code-generator-library
-
---
-
-## Qt Gamepad
-
- Source: https://github.com/qt/qtgamepad
- License: GNU General Public License v3.0 (GPL-3.0)
- License Text: https://www.gnu.org/licenses/gpl-3.0.en.html
-
---
-
-## AmneziaWG Apple (WireGuard)
-
- Source: https://github.com/amnezia-vpn/amneziawg-apple
- License: MIT License
- License Text: https://github.com/amnezia-vpn/amneziawg-apple/blob/master/COPYING
-
---
-
-## AmneziaWG Android
-
- Source: https://github.com/amnezia-vpn/amneziawg-go
- License: MIT License
- License Text: https://github.com/amnezia-vpn/amneziawg-go/blob/master/LICENSE
-
---
-
-## Xray Core
-
- Source: https://github.com/XTLS/Xray-core
- License: Mozilla Public License 2.0 (MPL-2.0)
- License Text: https://github.com/XTLS/Xray-core/blob/main/LICENSE
-
---
-
-## Cloak
-
- Source: https://github.com/cbeuw/Cloak
- License: GNU General Public License v3.0 (GPL-3.0)
- License Text: https://github.com/cbeuw/Cloak/blob/master/LICENSE
-
---
-
-## Shadowsocks
-
- Source: https://github.com/shadowsocks/shadowsocks-libev
- License: GPL-3.0-or-later
- License Text: http://www.gnu.org/licenses/
-
---
-
-## OpenSSL
-
- Source: https://github.com/openssl/openssl
- License: Apache License 2.0
- License Text: https://www.openssl.org/source/license.html
-
---
-
-## libssh
-
- Source: https://www.libssh.org/
- License: GNU Lesser General Public License (LGPL)
- License Text: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.html
-
---
-
-## OpenVPNAdapter
-
- Source: https://github.com/ss-abramchuk/OpenVPNAdapter
- License: GNU Affero General Public License v3.0 (AGPL-3.0)
- License Text: https://github.com/ss-abramchuk/OpenVPNAdapter/blob/master/LICENSE
-
---
-
-## Wintun
-
- Source: https://www.wintun.net/
- License: Prebuilt Binaries License
- License Text: https://github.com/WireGuard/wintun/blob/master/prebuilt-binaries-license.txt
-
---
-
-## Mullvad Split Tunnel Driver
-
- Source: https://github.com/mullvad/win-split-tunnel
- License: GNU General Public License v3.0 (GPL-3.0) and Mozilla Public License Version 2.0
- License Text: https://github.com/mullvad/win-split-tunnel/blob/master/LICENSE-GPL.md https://github.com/mullvad/win-split-tunnel/blob/master/LICENSE-MPL.txt
-
---
-
-## tun2socks
-
- Source: https://github.com/eycorsican/go-tun2socks
- License: MIT License
- License Text: https://github.com/eycorsican/go-tun2socks/blob/master/LICENSE
-
---
-
-## TAP-Windows Driver
-
- Source: https://github.com/OpenVPN/tap-windows6
- License: tap-windows6 license
- License Text: https://github.com/OpenVPN/tap-windows6/blob/master/COPYING
--- a/client/3rd-prebuilt
+++ b/client/3rd-prebuilt
--- a/client/CMakeLists.txt
+++ b/client/CMakeLists.txt
@@ -25,7 +25,6 @@ add_definitions(-DGIT_COMMIT_HASH="${GIT_COMMIT_HASH}")

 add_definitions(-DPROD_AGW_PUBLIC_KEY="$ENV{PROD_AGW_PUBLIC_KEY}")
 add_definitions(-DPROD_S3_ENDPOINT="$ENV{PROD_S3_ENDPOINT}")
-add_definitions(-DFALLBACK_S3_ENDPOINT="$ENV{FALLBACK_S3_ENDPOINT}")

 add_definitions(-DDEV_AGW_PUBLIC_KEY="$ENV{DEV_AGW_PUBLIC_KEY}")
 add_definitions(-DDEV_AGW_ENDPOINT="$ENV{DEV_AGW_ENDPOINT}")
@@ -38,6 +37,10 @@ if(WIN32 OR (APPLE AND NOT IOS) OR (LINUX AND NOT ANDROID))
    set(PACKAGES ${PACKAGES} Widgets)
 endif()

+if(LINUX AND NOT ANDROID)
+    list(APPEND PACKAGES QuickTemplates2 QmlModels OpenGL)
+endif()
+
 find_package(Qt6 REQUIRED COMPONENTS ${PACKAGES})

 set(LIBS ${LIBS}
@@ -53,6 +56,23 @@ endif()

 qt_standard_project_setup()
 qt_add_executable(${PROJECT} MANUAL_FINALIZATION)
+
+if(LINUX AND NOT ANDROID)
+    target_link_options(${PROJECT} PRIVATE "-Wl,--no-as-needed")
+    target_link_options(${PROJECT} PRIVATE "LINKER:--disable-new-dtags")
+    set_target_properties(${PROJECT} PROPERTIES
+        BUILD_RPATH "\$ORIGIN/../lib"
+        INSTALL_RPATH "\$ORIGIN/../lib"
+        INSTALL_RPATH_USE_LINK_PATH FALSE
+    )
+    set_property(TARGET ${PROJECT} PROPERTY BUILD_WITH_INSTALL_RPATH TRUE)
+
+    target_link_libraries(${PROJECT} PRIVATE
+        Qt6::QuickTemplates2
+        Qt6::QmlModels
+        Qt6::OpenGL
+    )
+endif()
 target_include_directories(${PROJECT} PUBLIC
    $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>
 )
@@ -60,17 +80,14 @@ target_include_directories(${PROJECT} PUBLIC
 if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))
    qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_interface.rep)
    qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_process_interface.rep)
+    qt_add_repc_replicas(${PROJECT} ${CMAKE_CURRENT_LIST_DIR}/../ipc/ipc_process_tun2socks.rep)
 endif()

-qt6_add_resources(QRC ${QRC}
-    ${CMAKE_CURRENT_LIST_DIR}/images/images.qrc
-    ${CMAKE_CURRENT_LIST_DIR}/images/flagKit.qrc
-    ${CMAKE_CURRENT_LIST_DIR}/client_scripts/clientScripts.qrc
-    ${CMAKE_CURRENT_LIST_DIR}/ui/qml/qml.qrc
-    ${CMAKE_CURRENT_LIST_DIR}/server_scripts/serverScripts.qrc
-)
+qt6_add_resources(QRC ${QRC} ${CMAKE_CURRENT_LIST_DIR}/resources.qrc)

 # -- i18n begin
+set(CMAKE_AUTORCC ON)
+
 set(AMNEZIAVPN_TS_FILES
    ${CMAKE_CURRENT_LIST_DIR}/translations/amneziavpn_ru_RU.ts
    ${CMAKE_CURRENT_LIST_DIR}/translations/amneziavpn_zh_CN.ts
@@ -82,10 +99,19 @@ set(AMNEZIAVPN_TS_FILES
    ${CMAKE_CURRENT_LIST_DIR}/translations/amneziavpn_hi_IN.ts
 )

-qt6_add_translations(${PROJECT}
-    TS_FILES ${AMNEZIAVPN_TS_FILES}
-    RESOURCE_PREFIX "/translations"
-)
+file(GLOB_RECURSE AMNEZIAVPN_TS_SOURCES *.qrc *.cpp *.h *.ui)
+
+qt_create_translation(AMNEZIAVPN_QM_FILES ${AMNEZIAVPN_TS_SOURCES} ${AMNEZIAVPN_TS_FILES})
+
+set(QM_FILE_LIST "")
+foreach(FILE ${AMNEZIAVPN_QM_FILES})
+    get_filename_component(QM_FILE_NAME ${FILE} NAME)
+    list(APPEND QM_FILE_LIST "<file>${QM_FILE_NAME}</file>")
+endforeach()
+string(REPLACE ";" "" QM_FILE_LIST ${QM_FILE_LIST})
+
+configure_file(${CMAKE_CURRENT_LIST_DIR}/translations/translations.qrc.in ${CMAKE_CURRENT_BINARY_DIR}/translations.qrc)
+qt6_add_resources(QRC ${I18NQRC} ${CMAKE_CURRENT_BINARY_DIR}/translations.qrc)
 # -- i18n end

 set(IS_CI ${CI})
@@ -164,10 +190,6 @@ if(APPLE)
    set(CMAKE_XCODE_GENERATE_SCHEME FALSE)
    set(CMAKE_XCODE_ATTRIBUTE_DEVELOPMENT_TEAM ${BUILD_VPN_DEVELOPMENT_TEAM})
    set(CMAKE_XCODE_ATTRIBUTE_GROUP_ID_IOS ${BUILD_IOS_GROUP_IDENTIFIER})
-    
-    if (BUILD_VPN_KEYCHAIN)
-        set(CMAKE_XCODE_ATTRIBUTE_OTHER_CODE_SIGN_FLAGS "--keychain ${BUILD_VPN_KEYCHAIN}")
-    endif()
 endif()

 if(LINUX AND NOT ANDROID)
@@ -193,15 +215,50 @@ elseif(APPLE)
    include(cmake/macos.cmake)
 endif()

-if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
-    add_subdirectory(tests)
+target_link_libraries(${PROJECT} PRIVATE ${LIBS})
+
+if(LINUX AND NOT ANDROID)
+    target_link_libraries(${PROJECT} PRIVATE
+        "-Wl,--push-state,--no-as-needed"
+        Qt6::QuickTemplates2
+        Qt6::QmlModels
+        Qt6::OpenGL
+        "-Wl,--pop-state"
+    )
 endif()

-list(APPEND SOURCES ${CMAKE_CURRENT_LIST_DIR}/main.cpp)
-
-target_link_libraries(${PROJECT} PRIVATE ${LIBS})
 target_compile_definitions(${PROJECT} PRIVATE "MZ_$<UPPER_CASE:${MZ_PLATFORM_NAME}>")

+# deploy artifacts required to run the application to the debug build folder
+if(WIN32)
+    if("${CMAKE_SIZEOF_VOID_P}" STREQUAL "8")
+        set(DEPLOY_PLATFORM_PATH "windows/x64")
+    else()
+        set(DEPLOY_PLATFORM_PATH "windows/x32")
+    endif()
+elseif(LINUX)
+    set(DEPLOY_PLATFORM_PATH "linux/client")
+elseif(APPLE AND NOT IOS)
+    set(DEPLOY_PLATFORM_PATH "macos")
+endif()
+
+if(NOT IOS AND NOT ANDROID AND NOT MACOS_NE)
+    add_custom_command(
+        TARGET ${PROJECT} POST_BUILD
+        COMMAND ${CMAKE_COMMAND} -E $<IF:$<CONFIG:Debug>,copy_directory,true>
+        ${CMAKE_SOURCE_DIR}/deploy/data/${DEPLOY_PLATFORM_PATH}
+        $<TARGET_FILE_DIR:${PROJECT}>
+        COMMAND_EXPAND_LISTS
+    )
+    add_custom_command(
+        TARGET ${PROJECT} POST_BUILD
+        COMMAND ${CMAKE_COMMAND} -E $<IF:$<CONFIG:Debug>,copy_directory,true>
+        ${CMAKE_SOURCE_DIR}/client/3rd-prebuilt/deploy-prebuilt/${DEPLOY_PLATFORM_PATH}
+        $<TARGET_FILE_DIR:${PROJECT}>
+        COMMAND_EXPAND_LISTS
+    )
+endif()
+
 target_sources(${PROJECT} PRIVATE ${SOURCES} ${HEADERS} ${RESOURCES} ${QRC} ${I18NQRC})

 # Finalize the executable so Qt can gather/deploy QML modules and plugins correctly (Android needs this).
@@ -213,51 +270,3 @@ if(COMMAND qt_finalize_executable)
 else()
    qt_finalize_target(${PROJECT})
 endif()
-
-install(TARGETS ${PROJECT}
-    DESTINATION ${CMAKE_INSTALL_BINDIR}
-    COMPONENT AmneziaVPN
-)
-install(FILES $<TARGET_RUNTIME_DLLS:${PROJECT}>
-    DESTINATION ${CMAKE_INSTALL_BINDIR}
-    COMPONENT AmneziaVPN
-)
-
-set(deploy_tool_options "")
-if(WIN32)
-    set(deploy_tool_options "--force-openssl --force")
-endif()
-
-qt_generate_deploy_qml_app_script(
-    TARGET ${PROJECT}
-    OUTPUT_SCRIPT QT_DEPLOY_SCRIPT
-    NO_UNSUPPORTED_PLATFORM_ERROR
-    DEPLOY_TOOL_OPTIONS ${deploy_tool_options}
-)
-install(SCRIPT ${QT_DEPLOY_SCRIPT}
-    COMPONENT AmneziaVPN
-)
-
-if (APPLE AND NOT IOS AND NOT MACOS_NE)
-    list(APPEND OVPN_SCRIPTS "${CMAKE_SOURCE_DIR}/deploy/data/macos/update-resolv-conf.sh")
-endif()
-if (LINUX AND NOT ANDROID)
-    list(APPEND OVPN_SCRIPTS "${CMAKE_SOURCE_DIR}/deploy/data/linux/update-resolv-conf.sh")
-endif()
-
-if(OVPN_SCRIPTS)
-    add_custom_command(TARGET ${PROJECT} POST_BUILD
-        COMMAND ${CMAKE_COMMAND} -E copy_if_different
-        ${OVPN_SCRIPTS}
-        "$<TARGET_FILE_DIR:${PROJECT}>"
-    )
-
-    install(FILES ${OVPN_SCRIPTS}
-        DESTINATION ${CMAKE_INSTALL_BINDIR}
-        COMPONENT AmneziaVPN
-        PERMISSIONS
-            OWNER_READ OWNER_EXECUTE
-            GROUP_READ GROUP_EXECUTE
-            WORLD_READ WORLD_EXECUTE
-    )
-endif()
--- a/client/amnezia_application.cpp
+++ b/client/amnezia_application.cpp
@@ -1,4 +1,4 @@
-#include "amneziaApplication.h"
+#include "amnezia_application.h"

 #include <QClipboard>
 #include <QFontDatabase>
@@ -15,17 +15,17 @@
 #include <QEvent>
 #include <QDir>
 #include <QSettings>
-#include <QtQuick/QQuickWindow>  
-#include <QWindow>     

-#include "core/protocols/qmlRegisterProtocols.h"
 #include "logger.h"
-#include "ui/controllers/qml/pageController.h"
+#include "ui/controllers/pageController.h"
 #include "ui/models/installedAppsModel.h"
 #include "version.h"

 #include "platforms/ios/QRCodeReaderBase.h"
-         
+
+#include "protocols/qml_register_protocols.h"
+#include <QtQuick/QQuickWindow>  // for QQuickWindow
+#include <QWindow>              // for qobject_cast<QWindow*>

 bool AmneziaApplication::m_forceQuit = false;

@@ -54,7 +54,7 @@ AmneziaApplication::AmneziaApplication(int &argc, char *argv[]) : AMNEZIA_BASE_C
    QFile::setPermissions(configLoc2, QFileDevice::ReadOwner | QFileDevice::WriteOwner);
 #endif

-    m_settings = new SecureQSettings(ORGANIZATION_NAME, APPLICATION_NAME, this);
+    m_settings = std::shared_ptr<Settings>(new Settings);
    m_nam = new QNetworkAccessManager(this);
 }

@@ -109,19 +109,6 @@ void AmneziaApplication::init()
            // install filter on main window
            if (auto win = qobject_cast<QQuickWindow*>(obj)) {
                win->installEventFilter(this);
-#if defined(Q_OS_ANDROID) || defined(Q_OS_IOS)
-                win->setDefaultAlphaBuffer(true);
-#endif
-#ifdef Q_OS_ANDROID
-                QObject::connect(win, &QQuickWindow::sceneGraphError,
-                    [](QQuickWindow::SceneGraphError, const QString &msg) {
-                        qWarning() << "Scene graph error (suppressed):" << msg;
-                    });
-                // Keep graphics context alive across hide/show cycles to avoid
-                // eglSwapBuffers/makeCurrent being called on a context Android has reclaimed.
-                win->setPersistentSceneGraph(true);
-                win->setPersistentGraphics(true);
-#endif
                win->show();
            }
        },
@@ -135,7 +122,7 @@ void AmneziaApplication::init()
    m_engine->rootContext()->setContextProperty("IsMacOsNeBuild", false);
 #endif

-    m_vpnConnection.reset(new VpnConnection(nullptr, nullptr));
+    m_vpnConnection.reset(new VpnConnection(m_settings));
    m_vpnConnection->moveToThread(&m_vpnConnectionThread);
    m_vpnConnectionThread.start();

@@ -156,6 +143,16 @@ void AmneziaApplication::init()

    m_coreController->setQmlRoot();

+    bool enabled = m_settings->isSaveLogs();
+#ifndef Q_OS_ANDROID
+    if (enabled) {
+        if (!Logger::init(false)) {
+            qWarning() << "Initialization of debug subsystem failed";
+        }
+    }
+#endif
+    Logger::setServiceLogsEnabled(enabled);
+
 #ifdef Q_OS_WIN //TODO
    if (m_parser.isSet(m_optAutostart))
        m_coreController->pageController()->showOnStartup();
@@ -200,11 +197,13 @@ void AmneziaApplication::registerTypes()
    qRegisterMetaType<ServerCredentials>("ServerCredentials");

    qRegisterMetaType<DockerContainer>("DockerContainer");
-    using namespace amnezia::ProtocolEnumNS;
    qRegisterMetaType<TransportProto>("TransportProto");
    qRegisterMetaType<Proto>("Proto");
    qRegisterMetaType<ServiceType>("ServiceType");

+    declareQmlProtocolEnum();
+    declareQmlContainerEnum();
+
    qmlRegisterType<QRCodeReader>("QRCodeReader", 1, 0, "QRCodeReader");

    m_containerProps.reset(new ContainerProps());
@@ -218,7 +217,6 @@ void AmneziaApplication::registerTypes()

    qmlRegisterType<InstalledAppsModel>("InstalledAppsModel", 1, 0, "InstalledAppsModel");

-    amnezia::declareQmlProtocolEnum();
    Vpn::declareQmlVpnConnectionStateEnum();
    PageLoader::declareQmlPageEnum();
 }
--- a/client/amnezia_application.h
+++ b/client/amnezia_application.h
@@ -14,10 +14,8 @@
 #include <QClipboard>

 #include "core/controllers/coreController.h"
-#include "secureQSettings.h"
-#include "vpnConnection.h"
-#include "ui/models/containerProps.h"
-#include "ui/models/protocolProps.h"
+#include "settings.h"
+#include "vpnconnection.h"

 #define amnApp (static_cast<AmneziaApplication *>(QCoreApplication::instance()))

@@ -53,7 +51,7 @@ public slots:
 private:
    static bool m_forceQuit;
    QQmlApplicationEngine *m_engine {};
-    SecureQSettings* m_settings;
+    std::shared_ptr<Settings> m_settings;

    QScopedPointer<CoreController> m_coreController;

--- a/client/android/build.gradle.kts
+++ b/client/android/build.gradle.kts
@@ -39,7 +39,6 @@ android {

        // keeps language resources for only the locales specified below
        resourceConfigurations += listOf("en", "ru", "b+zh+Hans")
-        ndk.abiFilters += qtTargetAbiList.split(",")
    }

    sourceSets {
@@ -53,12 +52,50 @@ android {
        }
    }

+    signingConfigs {
+        register("release") {
+            storeFile = providers.environmentVariable("ANDROID_KEYSTORE_PATH").orNull?.let { file(it) }
+            storePassword = providers.environmentVariable("ANDROID_KEYSTORE_KEY_PASS").orNull
+            keyAlias = providers.environmentVariable("ANDROID_KEYSTORE_KEY_ALIAS").orNull
+            keyPassword = providers.environmentVariable("ANDROID_KEYSTORE_KEY_PASS").orNull
+        }
+    }
+
    buildTypes {
        release {
            // exclude coroutine debug resource from release build
            packaging {
                resources.excludes += "DebugProbesKt.bin"
            }
+            signingConfig = signingConfigs["release"]
+        }
+
+        create("fdroid") {
+            initWith(getByName("release"))
+            signingConfig = null
+            matchingFallbacks += "release"
+        }
+    }
+
+    splits {
+        abi {
+            isEnable = true
+            reset()
+            include(*qtTargetAbiList.split(',').toTypedArray())
+            isUniversalApk = false
+        }
+    }
+
+    // fix for Qt Creator to allow deploying the application to a device
+    // to enable this fix, add the line outputBaseName=android-build to local.properties
+    if (outputBaseName.isNotEmpty()) {
+        applicationVariants.all {
+            outputs.map { it as BaseVariantOutputImpl }
+                .forEach { output ->
+                    if (output.outputFileName.endsWith(".apk")) {
+                        output.outputFileName = "$outputBaseName-${buildType.name}.apk"
+                    }
+                }
        }
    }

@@ -74,6 +111,7 @@ dependencies {
    implementation(project(":wireguard"))
    implementation(project(":awg"))
    implementation(project(":openvpn"))
+    implementation(project(":cloak"))
    implementation(project(":xray"))
    implementation(libs.androidx.core)
    implementation(libs.androidx.activity)
--- a/client/android/cloak/build.gradle.kts
+++ b/client/android/cloak/build.gradle.kts
@@ -0,0 +1,18 @@
+plugins {
+    id(libs.plugins.android.library.get().pluginId)
+    id(libs.plugins.kotlin.android.get().pluginId)
+}
+
+kotlin {
+    jvmToolchain(17)
+}
+
+android {
+    namespace = "org.amnezia.vpn.protocol.cloak"
+}
+
+dependencies {
+    compileOnly(project(":utils"))
+    compileOnly(project(":protocolApi"))
+    implementation(project(":openvpn"))
+}
--- a/client/android/cloak/src/main/kotlin/Cloak.kt
+++ b/client/android/cloak/src/main/kotlin/Cloak.kt
@@ -0,0 +1,45 @@
+package org.amnezia.vpn.protocol.cloak
+
+import android.util.Base64
+import net.openvpn.ovpn3.ClientAPI_Config
+import org.amnezia.vpn.protocol.openvpn.OpenVpn
+import org.amnezia.vpn.util.LibraryLoader.loadSharedLibrary
+import org.json.JSONObject
+
+class Cloak : OpenVpn() {
+
+    override fun internalInit() {
+        super.internalInit()
+        if (!isInitialized) loadSharedLibrary(context, "ck-ovpn-plugin")
+    }
+
+    override fun parseConfig(config: JSONObject): ClientAPI_Config {
+        val openVpnConfig = ClientAPI_Config()
+
+        val openVpnConfigStr = config.getJSONObject("openvpn_config_data").getString("config")
+        val cloakConfigJson = checkCloakJson(config.getJSONObject("cloak_config_data"))
+        val cloakConfigStr = Base64.encodeToString(cloakConfigJson.toString().toByteArray(), Base64.DEFAULT)
+
+        val configStr = "$openVpnConfigStr\n<cloak>\n$cloakConfigStr\n</cloak>\n"
+
+        openVpnConfig.usePluggableTransports = true
+        openVpnConfig.content = configStr
+        return openVpnConfig
+    }
+
+    private fun checkCloakJson(cloakConfigJson: JSONObject): JSONObject {
+        cloakConfigJson.put("NumConn", 1)
+        cloakConfigJson.put("ProxyMethod", "openvpn")
+        if (cloakConfigJson.has("port")) {
+            val port = cloakConfigJson["port"]
+            cloakConfigJson.remove("port")
+            cloakConfigJson.put("RemotePort", port)
+        }
+        if (cloakConfigJson.has("remote")) {
+            val remote = cloakConfigJson["remote"]
+            cloakConfigJson.remove("remote")
+            cloakConfigJson.put("RemoteHost", remote)
+        }
+        return cloakConfigJson
+    }
+}
--- a/client/android/gradle/libs.versions.toml
+++ b/client/android/gradle/libs.versions.toml
@@ -1,11 +1,11 @@
 [versions]
-agp = "8.6.1"
+agp = "8.5.2"
 kotlin = "1.9.24"
 androidx-core = "1.13.1"
 androidx-activity = "1.9.1"
 androidx-annotation = "1.8.2"
 androidx-biometric = "1.2.0-alpha05"
-androidx-camera = "1.5.3"
+androidx-camera = "1.3.4"
 androidx-fragment = "1.8.2"
 androidx-security-crypto = "1.1.0-alpha06"
 androidx-datastore = "1.1.1"
--- a/client/android/res/drawable/ic_pairing_back.xml
+++ b/client/android/res/drawable/ic_pairing_back.xml
@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<vector xmlns:android="http://schemas.android.com/apk/res/android"
-    android:width="24dp"
-    android:height="24dp"
-    android:viewportWidth="24"
-    android:viewportHeight="24">
-    <path
-        android:fillColor="#FFE8E8EC"
-        android:pathData="M20,11H7.83l5.59,-5.59L12,4l-8,8 8,8 1.41,-1.41L7.83,13H20v-2z" />
-</vector>
--- a/client/android/res/drawable/torch_fab_bg.xml
+++ b/client/android/res/drawable/torch_fab_bg.xml
@@ -1,5 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<shape xmlns:android="http://schemas.android.com/apk/res/android"
-    android:shape="oval">
-    <solid android:color="#38FFFFFF" />
-</shape>
--- a/client/android/res/layout/camera_preview.xml
+++ b/client/android/res/layout/camera_preview.xml
@@ -8,75 +8,4 @@
        android:layout_width="match_parent"
        android:layout_height="match_parent" />

-    <org.amnezia.vpn.PairingQrScanOverlayView
-        android:id="@+id/pairingScanOverlay"
-        android:layout_width="match_parent"
-        android:layout_height="match_parent"
-        android:visibility="gone" />
-
-    <LinearLayout
-        android:id="@+id/pairingChrome"
-        android:layout_width="match_parent"
-        android:layout_height="wrap_content"
-        android:layout_gravity="top"
-        android:background="@android:color/transparent"
-        android:orientation="horizontal"
-        android:paddingStart="8dp"
-        android:paddingTop="28dp"
-        android:paddingEnd="16dp"
-        android:paddingBottom="12dp"
-        android:visibility="gone">
-
-        <ImageButton
-            android:id="@+id/pairingBack"
-            android:layout_width="48dp"
-            android:layout_height="48dp"
-            android:layout_gravity="top"
-            android:background="?android:attr/selectableItemBackgroundBorderless"
-            android:contentDescription="@string/pairing_qr_camera_back"
-            android:padding="12dp"
-            android:scaleType="fitCenter"
-            android:src="@drawable/ic_pairing_back" />
-
-        <LinearLayout
-            android:layout_width="0dp"
-            android:layout_height="wrap_content"
-            android:layout_marginStart="4dp"
-            android:layout_weight="1"
-            android:orientation="vertical">
-
-            <TextView
-                android:id="@+id/pairingTitle"
-                android:layout_width="match_parent"
-                android:layout_height="wrap_content"
-                android:text="@string/pairing_qr_camera_title"
-                android:textColor="#FFE8E8EC"
-                android:textSize="20sp"
-                android:textStyle="bold" />
-
-            <TextView
-                android:id="@+id/pairingSubtitle"
-                android:layout_width="match_parent"
-                android:layout_height="wrap_content"
-                android:layout_marginTop="8dp"
-                android:text="@string/pairing_qr_camera_subtitle"
-                android:textColor="#FFB8B8C0"
-                android:textSize="14sp" />
-        </LinearLayout>
-    </LinearLayout>
-
-    <TextView
-        android:id="@+id/torchButton"
-        android:layout_width="56dp"
-        android:layout_height="56dp"
-        android:layout_gravity="bottom|center_horizontal"
-        android:layout_marginBottom="32dp"
-        android:background="@drawable/torch_fab_bg"
-        android:clickable="true"
-        android:focusable="true"
-        android:gravity="center"
-        android:text="🔦"
-        android:textSize="26sp"
-        android:contentDescription="@string/camera_torch" />
-
 </FrameLayout>
--- a/client/android/res/values-ru/strings.xml
+++ b/client/android/res/values-ru/strings.xml
@@ -24,13 +24,5 @@
    <string name="notificationSettingsDialogMessage">Для показа уведомлений необходимо включить уведомления в системных настройках</string>
    <string name="openNotificationSettings">Открыть настройки уведомлений</string>

-    <string name="cameraPermissionDialogTitle">Доступ к камере</string>
-    <string name="cameraPermissionDialogMessage">Чтобы отсканировать QR-код для добавления устройства, Amnezia VPN нужен доступ к камере.</string>
-    <string name="cameraPermissionContinue">Продолжить</string>
-    <string name="camera_torch">Фонарик</string>
-    <string name="pairing_qr_camera_title">Добавить устройство по QR</string>
-    <string name="pairing_qr_camera_subtitle">Отсканируйте QR сессии на устройстве, которое хотите добавить. Перед отправкой подписки будет подтверждение.</string>
-    <string name="pairing_qr_camera_back">Назад</string>
-
    <string name="tvNoFileBrowser">Пожалуйста, установите приложение для просмотра файлов</string>
 </resources>
--- a/client/android/res/values/strings.xml
+++ b/client/android/res/values/strings.xml
@@ -24,13 +24,5 @@
    <string name="notificationSettingsDialogMessage">To show notifications, you must enable notifications in the system settings</string>
    <string name="openNotificationSettings">Open notification settings</string>

-    <string name="cameraPermissionDialogTitle">Camera access</string>
-    <string name="cameraPermissionDialogMessage">To scan a QR code for device pairing, Amnezia VPN needs access to the camera.</string>
-    <string name="cameraPermissionContinue">Continue</string>
-    <string name="camera_torch">Flashlight</string>
-    <string name="pairing_qr_camera_title">Add device via QR</string>
-    <string name="pairing_qr_camera_subtitle">Scan the session QR shown on the device you want to add. You will confirm before the subscription is sent.</string>
-    <string name="pairing_qr_camera_back">Back</string>
-
    <string name="tvNoFileBrowser">Please install a file management utility to browse files</string>
 </resources>
--- a/client/android/settings.gradle.kts
+++ b/client/android/settings.gradle.kts
@@ -26,6 +26,7 @@ plugins {
    id("settings-property-delegate")
 }

+rootProject.name = "AmneziaVPN"
 rootProject.buildFileName = "build.gradle.kts"

 include(":qt")
@@ -34,6 +35,7 @@ include(":protocolApi")
 include(":wireguard")
 include(":awg")
 include(":openvpn")
+include(":cloak")
 include(":xray")
 include(":xray:libXray")

@@ -46,7 +48,15 @@ val qtMinSdkVersion: String by gradleProperties
 // set default values for all modules
 configure<SettingsExtension> {
    buildToolsVersion = androidBuildToolsVersion
-    compileSdk = androidCompileSdkVersion.split('-')[1].toInt()
+    compileSdk = androidCompileSdkVersion.substringAfter('-').toInt()
    minSdk = qtMinSdkVersion.toInt()
    ndkVersion = androidNdkVersion
 }
+
+// stop Gradle running by androiddeployqt
+gradle.taskGraph.whenReady {
+    if (providers.environmentVariable("ANDROIDDEPLOYQT_RUN").isPresent
+        && !providers.systemProperty("explicitRun").isPresent) {
+        allTasks.forEach { it.enabled = false }
+    }
+}
--- a/client/android/src/org/amnezia/vpn/AmneziaActivity.kt
+++ b/client/android/src/org/amnezia/vpn/AmneziaActivity.kt
@@ -42,9 +42,6 @@ import androidx.core.view.OnApplyWindowInsetsListener
 import androidx.core.view.ViewCompat
 import androidx.core.view.WindowInsetsCompat
 import androidx.core.view.WindowInsetsControllerCompat
-import androidx.lifecycle.Lifecycle
-import androidx.lifecycle.LifecycleOwner
-import androidx.lifecycle.LifecycleRegistry
 import java.io.IOException
 import kotlin.LazyThreadSafetyMode.NONE
 import kotlin.coroutines.CoroutineContext
@@ -76,18 +73,10 @@ private const val CHECK_VPN_PERMISSION_ACTION_CODE = 1
 private const val CREATE_FILE_ACTION_CODE = 2
 private const val OPEN_FILE_ACTION_CODE = 3
 private const val CHECK_NOTIFICATION_PERMISSION_ACTION_CODE = 4
-private const val CHECK_CAMERA_PERMISSION_ACTION_CODE = 5

 private const val PREFS_NOTIFICATION_PERMISSION_ASKED = "NOTIFICATION_PERMISSION_ASKED"
-private const val OPEN_FILE_AFTER_RESUME_DELAY_MS = 400L
-private const val KEY_PENDING_OPEN_FILE_URI = "pending_open_file_uri"

-class AmneziaActivity : QtActivity(), LifecycleOwner {
-
-    private val lifecycleRegistry = LifecycleRegistry(this)
-
-    override val lifecycle: Lifecycle
-        get() = lifecycleRegistry
+class AmneziaActivity : QtActivity() {

    private lateinit var mainScope: CoroutineScope
    private val qtInitialized = CompletableDeferred<Unit>()
@@ -102,14 +91,6 @@ class AmneziaActivity : QtActivity(), LifecycleOwner {
    private val actionResultHandlers = mutableMapOf<Int, ActivityResultHandler>()
    private val permissionRequestHandlers = mutableMapOf<Int, PermissionRequestHandler>()

-    private var isActivityResumed = false
-    private var hasWindowFocus = false
-    private val resumeHandler = Handler(Looper.getMainLooper())
-    private var pendingOpenFileUri: String? = null
-    private var openFileDeliveryScheduled = false
-
-    private var lastPairingQrReaderStartUptimeMs: Long = 0L
-
    private val vpnServiceEventHandler: Handler by lazy(NONE) {
        object : Handler(Looper.getMainLooper()) {
            override fun handleMessage(msg: Message) {
@@ -211,22 +192,17 @@ class AmneziaActivity : QtActivity(), LifecycleOwner {
                doBindService()
            }
        )
-        pendingOpenFileUri = savedInstanceState?.getString(KEY_PENDING_OPEN_FILE_URI)
-        openFileDeliveryScheduled = false
        registerBroadcastReceivers()
        intent?.let(::processIntent)
        runBlocking { vpnProto = proto.await() }
-        lifecycleRegistry.handleLifecycleEvent(Lifecycle.Event.ON_CREATE)
-    }
-
-    override fun onSaveInstanceState(outState: Bundle) {
-        super.onSaveInstanceState(outState)
-        pendingOpenFileUri?.let { outState.putString(KEY_PENDING_OPEN_FILE_URI, it) }
    }

    private fun loadLibs() {
        listOf(
-            "rsapss"
+            "rsapss",
+            "crypto_3",
+            "ssl_3",
+            "ssh"
        ).forEach {
            loadSharedLibrary(this.applicationContext, it)
        }
@@ -274,7 +250,6 @@ class AmneziaActivity : QtActivity(), LifecycleOwner {

    override fun onStart() {
        super.onStart()
-        lifecycleRegistry.handleLifecycleEvent(Lifecycle.Event.ON_START)
        Log.d(TAG, "Start Amnezia activity")
        mainScope.launch {
            qtInitialized.await()
@@ -287,74 +262,50 @@ class AmneziaActivity : QtActivity(), LifecycleOwner {
    }

    override fun onStop() {
-        isActivityResumed = false
-        hasWindowFocus = false
-        // Cancel all pending operations when activity stops
-        resumeHandler.removeCallbacksAndMessages(null)
-        openFileDeliveryScheduled = false
        Log.d(TAG, "Stop Amnezia activity")
        doUnbindService()
        mainScope.launch {
            qtInitialized.await()
            QtAndroidController.onServiceDisconnected()
        }
-        lifecycleRegistry.handleLifecycleEvent(Lifecycle.Event.ON_STOP)
        super.onStop()
    }

    override fun onWindowFocusChanged(hasFocus: Boolean) {
        super.onWindowFocusChanged(hasFocus)
-        hasWindowFocus = hasFocus
        Log.d(TAG, "Window focus changed: hasFocus=$hasFocus")
-
-        if (!hasFocus) {
-            // Cancel pending operations if window loses focus
-            resumeHandler.removeCallbacksAndMessages(null)
-        } else if (isActivityResumed && Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-            window.decorView.apply {
-                invalidate()
-                resumeHandler.postDelayed({
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        sendTouch(1f, 1f)
-                    }
-                }, 50)
-                resumeHandler.postDelayed({
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        sendTouch(2f, 2f)
-                        requestLayout()
-                        invalidate()
-                    }
-                }, 150)
-            }
-        }
    }

    override fun dispatchKeyEvent(event: KeyEvent): Boolean {
+        val deviceId = event.deviceId
        val keyCode = event.keyCode
        val pressed = event.action == KeyEvent.ACTION_DOWN
+        val source = event.source

-        when (keyCode) {
-            KeyEvent.KEYCODE_BUTTON_A,
-            KeyEvent.KEYCODE_BUTTON_B,
-            KeyEvent.KEYCODE_BUTTON_X,
-            KeyEvent.KEYCODE_BUTTON_Y,
-            KeyEvent.KEYCODE_BUTTON_START,
-            KeyEvent.KEYCODE_BUTTON_SELECT -> {
-                    nativeGamepadKeyEvent(0, keyCode, pressed)
+        if (deviceId < 0 && pressed) {
+            when (keyCode) {
+                KeyEvent.KEYCODE_BUTTON_A,
+                KeyEvent.KEYCODE_BUTTON_B,
+                KeyEvent.KEYCODE_BUTTON_X,
+                KeyEvent.KEYCODE_BUTTON_Y,
+                KeyEvent.KEYCODE_BUTTON_START,
+                KeyEvent.KEYCODE_BUTTON_SELECT,
+                KeyEvent.KEYCODE_DPAD_CENTER -> {
+                    nativeGamepadKeyEvent(0, keyCode, true)
+                    nativeGamepadKeyEvent(0, keyCode, false)
                    return true
+                }
            }
-            KeyEvent.KEYCODE_DPAD_CENTER,
-            KeyEvent.KEYCODE_DPAD_UP,
-            KeyEvent.KEYCODE_DPAD_DOWN,
-            KeyEvent.KEYCODE_DPAD_LEFT,
-            KeyEvent.KEYCODE_DPAD_RIGHT -> {
-                    val syntheticKeyCode = if (keyCode == KeyEvent.KEYCODE_DPAD_CENTER) KeyEvent.KEYCODE_ENTER else keyCode
-                    val synthetic = KeyEvent(
-                        event.downTime, event.eventTime, event.action, syntheticKeyCode,
-                        event.repeatCount, event.metaState, -1, event.scanCode,
-                        event.flags, InputDevice.SOURCE_KEYBOARD
-                    )
-                    return super.dispatchKeyEvent(synthetic)
+        }
+
+        // Real gamepad events (deviceId >= 0)
+        if (deviceId >= 0) {
+            val isGamepad = (source and InputDevice.SOURCE_GAMEPAD) == InputDevice.SOURCE_GAMEPAD
+            val isJoystick = (source and InputDevice.SOURCE_JOYSTICK) == InputDevice.SOURCE_JOYSTICK
+            val isDpad = (source and InputDevice.SOURCE_DPAD) == InputDevice.SOURCE_DPAD
+            if (isGamepad || isJoystick || isDpad) {
+                nativeGamepadKeyEvent(deviceId, keyCode, pressed)
+                return true
            }
        }

@@ -364,71 +315,31 @@ class AmneziaActivity : QtActivity(), LifecycleOwner {
    private external fun nativeGamepadKeyEvent(deviceId: Int, keyCode: Int, pressed: Boolean)

    override fun onPause() {
-        // Notify Qt to stop rendering BEFORE super.onPause() destroys the EGL surface.
-        // Using a coroutine here would be too late — the surface is gone by the time
-        // the coroutine runs. A direct synchronous call gives Qt's render thread the
-        // best chance to process visible=false before surface destruction.
-        if (qtInitialized.isCompleted) {
-            QtAndroidController.onActivityPaused()
-        }
-        lifecycleRegistry.handleLifecycleEvent(Lifecycle.Event.ON_PAUSE)
        super.onPause()
-        isActivityResumed = false
-        // Cancel all pending operations when activity pauses
-        resumeHandler.removeCallbacksAndMessages(null)
-        openFileDeliveryScheduled = false
        Log.d(TAG, "Pause Amnezia activity")
    }

    override fun onResume() {
        super.onResume()
-        lifecycleRegistry.handleLifecycleEvent(Lifecycle.Event.ON_RESUME)
-        isActivityResumed = true
-        Log.d(TAG, "Resume Amnezia activity")
-        if (qtInitialized.isCompleted) {
-            QtAndroidController.onActivityResumed()
-        }
-
-        if (pendingOpenFileUri != null && !openFileDeliveryScheduled) {
-            val uri = pendingOpenFileUri!!
-            openFileDeliveryScheduled = true
-            resumeHandler.postDelayed({
-                if (!isFinishing && !isDestroyed) {
-                    pendingOpenFileUri = null
-                    openFileDeliveryScheduled = false
-                    mainScope.launch {
-                        qtInitialized.await()
-                        QtAndroidController.onFileOpened(uri)
-                    }
-                }
-            }, OPEN_FILE_AFTER_RESUME_DELAY_MS)
-        }
-
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
+       /* if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
            window.decorView.apply {
                invalidate()

-                resumeHandler.postDelayed({
-                    // Check if activity is still resumed and has focus before executing
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        sendTouch(1f, 1f)
-                    }
+                postDelayed({
+                    sendTouch(1f, 1f)
                }, 100)
-
-                resumeHandler.postDelayed({
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        sendTouch(2f, 2f)
-                    }
+                
+                postDelayed({
+                    sendTouch(2f, 2f)
                }, 200)
-
-                resumeHandler.postDelayed({
-                    if (isActivityResumed && hasWindowFocus && !isFinishing && !isDestroyed) {
-                        requestLayout()
-                        invalidate()
-                    }
+                
+                postDelayed({
+                    requestLayout()
+                    invalidate()
                }, 250)
            }
-        }
+        }  */      
+        Log.d(TAG, "Resume Amnezia activity")
    }

    private fun configureWindowForEdgeToEdge() {
@@ -466,40 +377,35 @@ class AmneziaActivity : QtActivity(), LifecycleOwner {
        ViewCompat.setOnApplyWindowInsetsListener(window.decorView) { view, windowInsets ->
            val imeInsets = windowInsets.getInsets(WindowInsetsCompat.Type.ime())
            val imeVisible = windowInsets.isVisible(WindowInsetsCompat.Type.ime())
-
+            
            val imeHeight = if (imeVisible) imeInsets.bottom else 0

            val density = resources.displayMetrics.density
            val imeHeightDp = (imeHeight / density).toInt()
-
+            
            // Also track system bars (navigation bar, status bar) changes
            val systemBarsInsets = windowInsets.getInsets(WindowInsetsCompat.Type.systemBars())
            val navBarHeight = systemBarsInsets.bottom
            val navBarHeightDp = (navBarHeight / density).toInt()
            val statusBarHeight = systemBarsInsets.top
            val statusBarHeightDp = (statusBarHeight / density).toInt()
-
+            
            mainScope.launch {
                qtInitialized.await()
                QtAndroidController.onImeInsetsChanged(imeHeightDp)
                QtAndroidController.onSystemBarsInsetsChanged(navBarHeightDp, statusBarHeightDp)
            }
-
+            
            // Return windowInsets instead of CONSUMED to allow proper handling
            windowInsets
        }
    }

    override fun onDestroy() {
-        isActivityResumed = false
-        hasWindowFocus = false
-        // Cancel all pending operations when activity is destroyed
-        resumeHandler.removeCallbacksAndMessages(null)
        Log.d(TAG, "Destroy Amnezia activity")
        unregisterBroadcastReceiver(notificationStateReceiver)
        notificationStateReceiver = null
        mainScope.cancel()
-        lifecycleRegistry.handleLifecycleEvent(Lifecycle.Event.ON_DESTROY)
        super.onDestroy()
    }

@@ -821,13 +727,9 @@ class AmneziaActivity : QtActivity(), LifecycleOwner {
                            grantUriPermission(packageName, this, Intent.FLAG_GRANT_READ_URI_PERMISSION)
                        }?.toString() ?: ""
                        Log.v(TAG, "Open file: $uri")
-                        if (uri.isNotEmpty()) {
-                            pendingOpenFileUri = uri
-                        } else {
-                            mainScope.launch {
-                                qtInitialized.await()
-                                QtAndroidController.onFileOpened(uri)
-                            }
+                        mainScope.launch {
+                            qtInitialized.await()
+                            QtAndroidController.onFileOpened(uri)
                        }
                    }
                ))
@@ -856,7 +758,7 @@ class AmneziaActivity : QtActivity(), LifecycleOwner {
    @Suppress("unused")
    fun getFd(fileName: String): Int {
        Log.v(TAG, "Get fd for $fileName")
-        return blockingCall(Dispatchers.IO) {
+        return blockingCall {
            try {
                pfd = contentResolver.openFileDescriptor(Uri.parse(fileName), "r")
                pfd?.fd ?: -1
@@ -897,66 +799,6 @@ class AmneziaActivity : QtActivity(), LifecycleOwner {
    @SuppressLint("UnsupportedChromeOsCameraSystemFeature")
    fun isCameraPresent(): Boolean = applicationContext.packageManager.hasSystemFeature(PackageManager.FEATURE_CAMERA)

-    @Suppress("unused")
-    fun isCameraPermissionGranted(): Boolean =
-        ContextCompat.checkSelfPermission(this, Manifest.permission.CAMERA) == PackageManager.PERMISSION_GRANTED
-
-    @Suppress("unused")
-    fun requestCameraPermissionForQrPairing() {
-        if (isCameraPermissionGranted()) {
-            mainScope.launch {
-                qtInitialized.await()
-                QtAndroidController.onCameraPermissionResult(true)
-            }
-            return
-        }
-        runOnUiThread {
-            AlertDialog.Builder(this)
-                .setTitle(R.string.cameraPermissionDialogTitle)
-                .setMessage(R.string.cameraPermissionDialogMessage)
-                .setNegativeButton(R.string.cancel) { _, _ ->
-                    mainScope.launch {
-                        qtInitialized.await()
-                        QtAndroidController.onCameraPermissionResult(false)
-                    }
-                }
-                .setPositiveButton(R.string.cameraPermissionContinue) { _, _ ->
-                    requestPermission(
-                        Manifest.permission.CAMERA,
-                        CHECK_CAMERA_PERMISSION_ACTION_CODE,
-                        PermissionRequestHandler(
-                            onSuccess = {
-                                mainScope.launch {
-                                    qtInitialized.await()
-                                    QtAndroidController.onCameraPermissionResult(true)
-                                }
-                            },
-                            onFail = {
-                                mainScope.launch {
-                                    qtInitialized.await()
-                                    QtAndroidController.onCameraPermissionResult(false)
-                                }
-                            },
-                            onAny = {}
-                        )
-                    )
-                }
-                .show()
-        }
-    }
-
-    @Suppress("unused")
-    fun openApplicationDetailsSettings() {
-        try {
-            Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS).apply {
-                data = Uri.fromParts("package", packageName, null)
-                startActivity(this)
-            }
-        } catch (e: ActivityNotFoundException) {
-            Log.e(TAG, "openApplicationDetailsSettings: $e")
-        }
-    }
-
    @Suppress("unused")
    fun isOnTv(): Boolean = applicationContext.packageManager.hasSystemFeature(PackageManager.FEATURE_LEANBACK)

@@ -1005,19 +847,6 @@ class AmneziaActivity : QtActivity(), LifecycleOwner {
        }
    }

-    @Suppress("unused")
-    fun startPairingQrCodeReader() {
-        val now = SystemClock.uptimeMillis()
-        if (now - lastPairingQrReaderStartUptimeMs < 1200L) {
-            return
-        }
-        lastPairingQrReaderStartUptimeMs = now
-        Intent(this, CameraActivity::class.java).also {
-            it.putExtra(CameraActivity.EXTRA_PAIRING_QR_CAMERA, true)
-            startActivity(it)
-        }
-    }
-
    @Suppress("unused")
    fun setSaveLogs(enabled: Boolean) {
        Log.v(TAG, "Set save logs: $enabled")
@@ -1269,7 +1098,6 @@ class AmneziaActivity : QtActivity(), LifecycleOwner {
                CREATE_FILE_ACTION_CODE -> "CREATE_FILE"
                OPEN_FILE_ACTION_CODE -> "OPEN_FILE"
                CHECK_NOTIFICATION_PERMISSION_ACTION_CODE -> "CHECK_NOTIFICATION_PERMISSION"
-                CHECK_CAMERA_PERMISSION_ACTION_CODE -> "CHECK_CAMERA_PERMISSION"
                else -> actionCode.toString()
            }
    }
--- a/client/android/src/org/amnezia/vpn/CameraActivity.kt
+++ b/client/android/src/org/amnezia/vpn/CameraActivity.kt
@@ -2,384 +2,47 @@ package org.amnezia.vpn

 import android.Manifest
 import android.annotation.SuppressLint
-import android.content.Intent
 import android.content.pm.PackageManager
-import android.graphics.Color
-import android.graphics.drawable.GradientDrawable
 import android.os.Bundle
 import android.view.MotionEvent.ACTION_DOWN
 import android.view.MotionEvent.ACTION_UP
-import android.graphics.RectF
-import android.view.Gravity
-import android.view.View
-import android.widget.FrameLayout
 import android.widget.Toast
 import androidx.activity.ComponentActivity
-import androidx.activity.OnBackPressedCallback
 import androidx.activity.result.contract.ActivityResultContracts.RequestPermission
-import androidx.camera.core.Camera
 import androidx.camera.core.CameraSelector
 import androidx.camera.core.ExperimentalGetImage
 import androidx.camera.core.FocusMeteringAction
 import androidx.camera.core.FocusMeteringAction.FLAG_AE
 import androidx.camera.core.FocusMeteringAction.FLAG_AF
 import androidx.camera.core.ImageAnalysis
-import androidx.camera.core.ImageProxy
 import androidx.camera.core.Preview
 import androidx.camera.lifecycle.ProcessCameraProvider
-import androidx.camera.view.PreviewView
-import androidx.camera.view.TransformExperimental
-import androidx.camera.view.transform.CoordinateTransform
-import androidx.camera.view.transform.ImageProxyTransformFactory
-import androidx.camera.view.transform.OutputTransform
 import androidx.core.content.ContextCompat
-import androidx.core.view.ViewCompat
-import androidx.core.view.WindowCompat
-import androidx.core.view.WindowInsetsCompat
-import androidx.lifecycle.Observer
-import com.google.mlkit.vision.barcode.BarcodeScanner
 import com.google.mlkit.vision.barcode.BarcodeScannerOptions.Builder
 import com.google.mlkit.vision.barcode.BarcodeScanning
+import com.google.mlkit.vision.barcode.ZoomSuggestionOptions
 import com.google.mlkit.vision.barcode.common.Barcode
 import com.google.mlkit.vision.common.InputImage
 import org.amnezia.vpn.databinding.CameraPreviewBinding
 import org.amnezia.vpn.qt.QtAndroidController
 import org.amnezia.vpn.util.Log
-import java.util.concurrent.ExecutorService
-import java.util.concurrent.Executors
-import java.util.concurrent.atomic.AtomicBoolean
-import java.util.concurrent.atomic.AtomicReference
-import kotlin.math.roundToInt

 private const val TAG = "CameraActivity"

-@OptIn(TransformExperimental::class)
 class CameraActivity : ComponentActivity() {

-    companion object {
-        const val EXTRA_PAIRING_QR_CAMERA = "org.amnezia.vpn.extra.PAIRING_QR_CAMERA"
-    }
-
    private lateinit var viewBinding: CameraPreviewBinding
-    private var cameraProvider: ProcessCameraProvider? = null
-    private var boundCamera: Camera? = null
-    private var boundImageAnalysis: ImageAnalysis? = null
-    private var torchOn: Boolean = false
-
-    private var imageAnalysisExecutor: ExecutorService? = null
-
-    private val qrHandledOrClosing = AtomicBoolean(false)
-
-    private var pairingQrDeliveredToQt = false
-
-    private var pairingQrUserDismissedCamera = false
-
-    private var barcodeScanner: BarcodeScanner? = null
-
-    private val cachedPreviewOutputTransform = AtomicReference<OutputTransform?>(null)
-
-    private var previewTransformLayoutListener: View.OnLayoutChangeListener? = null
-
-    private var previewStreamStateObserver: Observer<PreviewView.StreamState>? = null
-
-    @Volatile
-    private var pairingGeomHeaderBottomPx = 0f
-
-    @Volatile
-    private var pairingGeomStatusBarTopPx = 0f
-
-    @Volatile
-    private var pairingGeomDensity = 1f
+    private lateinit var cameraProvider: ProcessCameraProvider

    @ExperimentalGetImage
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        viewBinding = CameraPreviewBinding.inflate(layoutInflater)
        setContentView(viewBinding.root)
-        viewBinding.viewFinder.scaleType = PreviewView.ScaleType.FILL_CENTER
-
-        if (intent.getBooleanExtra(EXTRA_PAIRING_QR_CAMERA, false)) {
-            WindowCompat.setDecorFitsSystemWindows(window, false)
-            val density = resources.displayMetrics.density
-            val padH = (8 * density).toInt()
-            val padTopBase = (28 * density).toInt()
-            val padBottom = (12 * density).toInt()
-            ViewCompat.setOnApplyWindowInsetsListener(viewBinding.pairingChrome) { v, windowInsets ->
-                val bars = windowInsets.getInsets(WindowInsetsCompat.Type.statusBars())
-                v.setPadding(padH, padTopBase + bars.top, (16 * density).toInt(), padBottom)
-                v.post { onPairingLayoutGeometryChanged() }
-                windowInsets
-            }
-            viewBinding.pairingScanOverlay.visibility = View.VISIBLE
-            viewBinding.pairingChrome.visibility = View.VISIBLE
-            viewBinding.root.addOnLayoutChangeListener { _, _, _, _, _, _, _, _, _ ->
-                viewBinding.root.post { onPairingLayoutGeometryChanged() }
-            }
-            viewBinding.root.post {
-                onPairingLayoutGeometryChanged()
-                applyPairingTorchButtonChrome()
-            }
-        }
-
-        viewBinding.pairingBack.setOnClickListener { releaseCameraAndFinish() }
-
-        onBackPressedDispatcher.addCallback(
-            this,
-            object : OnBackPressedCallback(true) {
-                override fun handleOnBackPressed() {
-                    releaseCameraAndFinish()
-                }
-            }
-        )
-
-        viewBinding.torchButton.setOnClickListener {
-            torchOn = !torchOn
-            try {
-                boundCamera?.cameraControl?.enableTorch(torchOn)
-            } catch (e: Exception) {
-                Log.e(TAG, "Torch: $e")
-            }
-            if (intent.getBooleanExtra(EXTRA_PAIRING_QR_CAMERA, false)) {
-                applyPairingTorchButtonChrome()
-            }
-        }

        checkPermissions(onSuccess = ::startCamera, onFail = ::finish)
    }

-    override fun onNewIntent(intent: Intent) {
-        super.onNewIntent(intent)
-        setIntent(intent)
-        if (!intent.getBooleanExtra(EXTRA_PAIRING_QR_CAMERA, false)) {
-            return
-        }
-        if (!::viewBinding.isInitialized) {
-            return
-        }
-        cleanupCameraResources()
-        qrHandledOrClosing.set(false)
-        pairingQrDeliveredToQt = false
-        pairingQrUserDismissedCamera = false
-        torchOn = false
-        viewBinding.pairingScanOverlay.visibility = View.VISIBLE
-        viewBinding.pairingChrome.visibility = View.VISIBLE
-        viewBinding.root.post {
-            onPairingLayoutGeometryChanged()
-            applyPairingTorchButtonChrome()
-        }
-        checkPermissions(onSuccess = ::startCamera, onFail = ::finish)
-    }
-
-    override fun onDestroy() {
-        cleanupCameraResources()
-        val pairing = intent.getBooleanExtra(EXTRA_PAIRING_QR_CAMERA, false)
-        if (pairing && !pairingQrDeliveredToQt && !pairingQrUserDismissedCamera) {
-            try {
-                QtAndroidController.onPairingQrCameraClosed()
-            } catch (t: Throwable) {
-                Log.e(TAG, "onPairingQrCameraClosed: $t")
-            }
-        }
-        super.onDestroy()
-    }
-
-    /** Idempotent: safe from back, successful decode, or process death. */
-    private fun cleanupCameraResources() {
-        qrHandledOrClosing.set(true)
-        try {
-            boundImageAnalysis?.clearAnalyzer()
-        } catch (_: Exception) {
-        }
-        boundImageAnalysis = null
-        try {
-            barcodeScanner?.close()
-        } catch (_: Exception) {
-        }
-        barcodeScanner = null
-        try {
-            boundCamera?.cameraControl?.enableTorch(false)
-        } catch (_: Exception) {
-        }
-        boundCamera = null
-        try {
-            cameraProvider?.unbindAll()
-        } catch (_: Exception) {
-        }
-        imageAnalysisExecutor?.let { ex ->
-            try {
-                ex.shutdown()
-            } catch (_: Exception) {
-            }
-        }
-        imageAnalysisExecutor = null
-        previewTransformLayoutListener?.let { listener ->
-            if (::viewBinding.isInitialized) {
-                viewBinding.viewFinder.removeOnLayoutChangeListener(listener)
-            }
-        }
-        previewTransformLayoutListener = null
-        previewStreamStateObserver?.let { obs ->
-            if (::viewBinding.isInitialized) {
-                viewBinding.viewFinder.previewStreamState.removeObserver(obs)
-            }
-        }
-        previewStreamStateObserver = null
-        cachedPreviewOutputTransform.set(null)
-    }
-
-    private fun refreshCachedPreviewOutputTransform() {
-        if (!::viewBinding.isInitialized) {
-            return
-        }
-        val vf = viewBinding.viewFinder
-        try {
-            val out = vf.outputTransform
-            cachedPreviewOutputTransform.set(out)
-        } catch (t: Throwable) {
-            Log.e(TAG, "refreshCachedPreviewOutputTransform: $t")
-            cachedPreviewOutputTransform.set(null)
-        }
-    }
-
-    private fun scheduleCachedPreviewOutputTransformRefresh() {
-        if (!::viewBinding.isInitialized) {
-            return
-        }
-        viewBinding.viewFinder.post { refreshCachedPreviewOutputTransform() }
-    }
-
-    private fun onPairingLayoutGeometryChanged() {
-        if (!::viewBinding.isInitialized || !intent.getBooleanExtra(EXTRA_PAIRING_QR_CAMERA, false)) {
-            return
-        }
-        val root = viewBinding.root
-        val chrome = viewBinding.pairingChrome
-        val w = root.width
-        val h = root.height
-        if (w <= 0 || h <= 0) {
-            return
-        }
-        val density = resources.displayMetrics.density
-        val headerBottom = if (chrome.visibility == View.VISIBLE) chrome.bottom.toFloat() else 0f
-        val insets = ViewCompat.getRootWindowInsets(root)
-        val statusTop = insets?.getInsets(WindowInsetsCompat.Type.statusBars())?.top?.toFloat() ?: 0f
-        val safeBottom = insets?.getInsets(WindowInsetsCompat.Type.systemBars())?.bottom?.toFloat() ?: 0f
-
-        pairingGeomHeaderBottomPx = headerBottom
-        pairingGeomStatusBarTopPx = statusTop
-        pairingGeomDensity = density
-
-        viewBinding.pairingScanOverlay.setPairingHeaderBottomPx(headerBottom)
-
-        val hole = PairingQrScanGeometry.pairingIosStyleHoleRectF(w, h, headerBottom, statusTop, density)
-        val torchCy = PairingQrScanGeometry.pairingIosStyleTorchCenterYPx(
-            hole.bottom,
-            h.toFloat(),
-            headerBottom,
-            safeBottom,
-            density
-        )
-        val torchSizePx = (56f * density).roundToInt().coerceAtLeast(1)
-        val topMargin = (torchCy - torchSizePx / 2f).roundToInt().coerceAtLeast(0)
-        val wantGravity = Gravity.TOP or Gravity.CENTER_HORIZONTAL
-        viewBinding.torchButton.post {
-            if (!::viewBinding.isInitialized || !intent.getBooleanExtra(EXTRA_PAIRING_QR_CAMERA, false)) {
-                return@post
-            }
-            val btn = viewBinding.torchButton
-            val lp = btn.layoutParams as FrameLayout.LayoutParams
-            if (lp.gravity == wantGravity && lp.topMargin == topMargin && lp.bottomMargin == 0) {
-                return@post
-            }
-            lp.gravity = wantGravity
-            lp.topMargin = topMargin
-            lp.bottomMargin = 0
-            btn.layoutParams = lp
-        }
-    }
-
-    private fun applyPairingTorchButtonChrome() {
-        if (!::viewBinding.isInitialized || !intent.getBooleanExtra(EXTRA_PAIRING_QR_CAMERA, false)) {
-            return
-        }
-        val btn = viewBinding.torchButton
-        val d = resources.displayMetrics.density
-        val alpha = if (torchOn) (0.42f * 255f).toInt() else (0.22f * 255f).toInt()
-        val bg = GradientDrawable().apply {
-            shape = GradientDrawable.OVAL
-            setColor(Color.argb(alpha, 255, 255, 255))
-            if (torchOn) {
-                setStroke((2f * d).roundToInt(), Color.rgb(255, 191, 115))
-            } else {
-                setStroke(0, 0)
-            }
-        }
-        btn.background = bg
-    }
-
-    private fun pairingHoleRectInImageSpace(
-        viewFinder: PreviewView,
-        imageProxy: ImageProxy,
-        imageWidth: Int,
-        imageHeight: Int
-    ): RectF {
-        val vw = viewFinder.width
-        val vh = viewFinder.height
-        fun geomFallback(): RectF =
-            PairingQrScanGeometry.pairingIosStyleHoleInImageCoords(
-                vw,
-                vh,
-                pairingGeomHeaderBottomPx,
-                pairingGeomStatusBarTopPx,
-                pairingGeomDensity,
-                imageWidth,
-                imageHeight
-            )
-        if (vw <= 0 || vh <= 0 || imageWidth <= 0 || imageHeight <= 0) {
-            return geomFallback()
-        }
-        return try {
-            val previewOut = cachedPreviewOutputTransform.get()
-            if (previewOut == null) {
-                geomFallback()
-            } else {
-                val imageFactory = ImageProxyTransformFactory().apply {
-                    setUsingRotationDegrees(true)
-                }
-                val imageOut = imageFactory.getOutputTransform(imageProxy)
-                val holeView = PairingQrScanGeometry.pairingIosStyleHoleRectF(
-                    vw,
-                    vh,
-                    pairingGeomHeaderBottomPx,
-                    pairingGeomStatusBarTopPx,
-                    pairingGeomDensity
-                )
-                if (holeView.width() <= 0f || holeView.height() <= 0f) {
-                    return geomFallback()
-                }
-                val hole = RectF(holeView)
-                CoordinateTransform(previewOut, imageOut).mapRect(hole)
-                hole
-            }
-        } catch (t: Throwable) {
-            Log.e(TAG, "pairingHoleRectInImageSpace: $t")
-            geomFallback()
-        }
-    }
-
-    private fun releaseCameraAndFinish() {
-        if (intent.getBooleanExtra(EXTRA_PAIRING_QR_CAMERA, false)) {
-            pairingQrUserDismissedCamera = true
-            try {
-                QtAndroidController.onPairingQrCameraUserDismissed()
-            } catch (t: Throwable) {
-                Log.e(TAG, "onPairingQrCameraUserDismissed: $t")
-            }
-        }
-        cleanupCameraResources()
-        finish()
-    }
-
    private fun checkPermissions(onSuccess: () -> Unit, onFail: () -> Unit) {
        if (checkSelfPermission(Manifest.permission.CAMERA) == PackageManager.PERMISSION_GRANTED) {
            onSuccess()
@@ -404,41 +67,26 @@ class CameraActivity : ComponentActivity() {

        cameraProviderFuture.addListener({
            cameraProvider = cameraProviderFuture.get()
-            bindCameraUseCases()
+            bindPreview()
+            bindImageAnalysis()
        }, ContextCompat.getMainExecutor(this))
    }

    @SuppressLint("ClickableViewAccessibility")
-    @ExperimentalGetImage
-    private fun bindCameraUseCases() {
-        val provider = cameraProvider ?: return
-        imageAnalysisExecutor?.shutdown()
-        imageAnalysisExecutor = Executors.newSingleThreadExecutor()
-
+    private fun bindPreview() {
        val viewFinder = viewBinding.viewFinder
        val preview = Preview.Builder().build().also {
            it.setSurfaceProvider(viewFinder.surfaceProvider)
        }

-        val imageAnalysis = ImageAnalysis.Builder()
-            .setBackpressureStrategy(ImageAnalysis.STRATEGY_KEEP_ONLY_LATEST)
-            .build()
-
-        val camera = provider.bindToLifecycle(
-            this,
-            CameraSelector.DEFAULT_BACK_CAMERA,
-            preview,
-            imageAnalysis
-        )
-        boundCamera = camera
-        boundImageAnalysis = imageAnalysis
+        val camera = cameraProvider.bindToLifecycle(this, CameraSelector.DEFAULT_BACK_CAMERA, preview)

        viewFinder.setOnTouchListener { _, motionEvent ->
            when (motionEvent.action) {
                ACTION_DOWN -> true
                ACTION_UP -> {
                    val point = viewFinder
-                        .meteringPointFactory.createPoint(motionEvent.x, motionEvent.y)
+                        .meteringPointFactory.createPoint(motionEvent.x, motionEvent.x)

                    val action = FocusMeteringAction
                        .Builder(point, FLAG_AF or FLAG_AE).build()
@@ -450,121 +98,58 @@ class CameraActivity : ComponentActivity() {
                else -> false
            }
        }
+    }

-        if (intent.getBooleanExtra(EXTRA_PAIRING_QR_CAMERA, false)) {
-            previewTransformLayoutListener?.let { viewFinder.removeOnLayoutChangeListener(it) }
-            val layoutListener = View.OnLayoutChangeListener { _, _, _, _, _, _, _, _, _ ->
-                viewFinder.post {
-                    scheduleCachedPreviewOutputTransformRefresh()
-                    onPairingLayoutGeometryChanged()
-                }
-            }
-            previewTransformLayoutListener = layoutListener
-            viewFinder.addOnLayoutChangeListener(layoutListener)
-            previewStreamStateObserver?.let { viewFinder.previewStreamState.removeObserver(it) }
-            val streamObserver = Observer<PreviewView.StreamState> { state ->
-                if (state == PreviewView.StreamState.STREAMING) {
-                    viewFinder.post {
-                        scheduleCachedPreviewOutputTransformRefresh()
-                        onPairingLayoutGeometryChanged()
-                    }
-                }
-            }
-            previewStreamStateObserver = streamObserver
-            viewFinder.previewStreamState.observe(this, streamObserver)
-            scheduleCachedPreviewOutputTransformRefresh()
-        }
+    @ExperimentalGetImage
+    private fun bindImageAnalysis() {
+        val imageAnalysis = ImageAnalysis.Builder().build()

-        try {
-            barcodeScanner?.close()
-        } catch (_: Exception) {
-        }
+        val camera = cameraProvider.bindToLifecycle(this, CameraSelector.DEFAULT_BACK_CAMERA, imageAnalysis)

-        barcodeScanner = BarcodeScanning.getClient(
+        val barcodeScanner = BarcodeScanning.getClient(
            Builder()
                .setBarcodeFormats(Barcode.FORMAT_QR_CODE)
-                .build()
+                .setZoomSuggestionOptions(
+                    ZoomSuggestionOptions.Builder { zoomLevel ->
+                        camera.cameraControl.setZoomRatio(zoomLevel)
+                        true
+                    }.apply {
+                        camera.cameraInfo.zoomState.value?.maxZoomRatio?.let { maxZoomRation ->
+                            setMaxSupportedZoomRatio(maxZoomRation)
+                        }
+                    }.build()
+                ).build()
        )

+        // optimization
        val checkedBarcodes = hashSetOf<String>()
-        val analysisExecutor = imageAnalysisExecutor!!
-        val mainExecutor = ContextCompat.getMainExecutor(this)
-        val pairingQrMode = intent.getBooleanExtra(EXTRA_PAIRING_QR_CAMERA, false)

-        imageAnalysis.setAnalyzer(analysisExecutor) { imageProxy ->
-            if (qrHandledOrClosing.get()) {
-                imageProxy.close()
-                return@setAnalyzer
-            }
-            val mediaImage = imageProxy.image
-            if (mediaImage == null) {
-                imageProxy.close()
-                return@setAnalyzer
-            }
-            val image = InputImage.fromMediaImage(mediaImage, imageProxy.imageInfo.rotationDegrees)
-            val viewW = viewFinder.width
-            val viewH = viewFinder.height
-            val pairingRoi = if (pairingQrMode) {
-                pairingHoleRectInImageSpace(viewFinder, imageProxy, image.width, image.height)
-            } else {
-                null
-            }
-            val scanner = barcodeScanner ?: run {
-                imageProxy.close()
-                return@setAnalyzer
-            }
-            scanner.process(image)
-                .addOnSuccessListener(mainExecutor) { barcodes ->
-                    if (qrHandledOrClosing.get()) {
-                        return@addOnSuccessListener
-                    }
-                    val barcode = if (pairingQrMode) {
-                        val roi = pairingRoi
-                            ?: PairingQrScanGeometry.pairingIosStyleHoleInImageCoords(
-                                viewW,
-                                viewH,
-                                pairingGeomHeaderBottomPx,
-                                pairingGeomStatusBarTopPx,
-                                pairingGeomDensity,
-                                image.width,
-                                image.height
-                            )
-                        barcodes.firstOrNull {
-                            PairingQrScanGeometry.barcodeMatchesPairingHole(
-                                roi,
-                                image.width,
-                                image.height,
-                                it
-                            )
-                        }
-                    } else {
-                        barcodes.firstOrNull()
-                    }
-                    barcode?.displayValue?.let { code ->
-                            if (code.isNotEmpty() && code !in checkedBarcodes) {
-                                checkedBarcodes.add(code)
-                                if (QtAndroidController.decodeQrCode(code)) {
-                                    if (qrHandledOrClosing.compareAndSet(false, true)) {
-                                        if (pairingQrMode) {
-                                            pairingQrDeliveredToQt = true
-                                        }
+        imageAnalysis.setAnalyzer(ContextCompat.getMainExecutor(this)) { imageProxy ->
+            imageProxy.image?.let { InputImage.fromMediaImage(it, imageProxy.imageInfo.rotationDegrees) }
+                ?.let { image ->
+                    barcodeScanner.process(image).addOnSuccessListener { barcodes ->
+                        barcodes.firstOrNull()?.let { barcode ->
+                            barcode.displayValue?.let { code ->
+                                if (code.isNotEmpty() && code !in checkedBarcodes) {
+                                    if (QtAndroidController.decodeQrCode(code)) {
+                                        barcodeScanner.close()
                                        stopCamera()
                                    }
+                                    checkedBarcodes.add(code)
                                }
                            }
+                        }
+                    }.addOnFailureListener {
+                        Log.e(TAG, "Processing QR code image failed: ${it.message}")
+                    }.addOnCompleteListener {
+                        imageProxy.close()
                    }
                }
-                .addOnFailureListener(mainExecutor) {
-                    Log.e(TAG, "Processing QR code image failed: ${it.message}")
-                }
-                .addOnCompleteListener(mainExecutor) {
-                    imageProxy.close()
-                }
        }
    }

    private fun stopCamera() {
-        cleanupCameraResources()
+        cameraProvider.unbindAll()
        finish()
    }
 }
--- a/client/android/src/org/amnezia/vpn/PairingQrScanBracketPaths.kt
+++ b/client/android/src/org/amnezia/vpn/PairingQrScanBracketPaths.kt
@@ -1,101 +0,0 @@
-package org.amnezia.vpn
-
-import android.graphics.Path
-import android.graphics.RectF
-import kotlin.math.PI
-import kotlin.math.atan2
-import kotlin.math.max
-import kotlin.math.min
-
-object PairingQrScanBracketPaths {
-
-    private fun Path.addCornerMinorArc(
-        cx: Float,
-        cy: Float,
-        r: Float,
-        sx: Float,
-        sy: Float,
-        ex: Float,
-        ey: Float
-    ) {
-        var asRad = atan2((sy - cy).toDouble(), (sx - cx).toDouble())
-        var aeRad = atan2((ey - cy).toDouble(), (ex - cx).toDouble())
-        while (aeRad - asRad > PI) {
-            aeRad -= 2.0 * PI
-        }
-        while (aeRad - asRad < -PI) {
-            aeRad += 2.0 * PI
-        }
-        val minor = aeRad - asRad
-        val startDeg = Math.toDegrees(asRad).toFloat()
-        val sweepDeg = Math.toDegrees(minor).toFloat()
-        addArc(RectF(cx - r, cy - r, cx + r, cy + r), startDeg, sweepDeg)
-    }
-
-    fun bracketStrokePath(corner: Int, x0: Float, y0: Float, s: Float, R: Float, L: Float, t: Float): Path {
-        val r = max(1.5f, R - t * 0.5f)
-        val p = Path()
-        val yy = y0 + t * 0.5f
-        val yyb = y0 + s - t * 0.5f
-        val xx = x0 + t * 0.5f
-        val xxb = x0 + s - t * 0.5f
-
-        when (corner) {
-            0 -> {
-                val cTLx = x0 + R
-                val cTLy = y0 + R
-                val sTLx = x0 + R
-                val sTLy = yy
-                val eTLx = xx
-                val eTLy = y0 + R
-                p.moveTo(x0 + R + L, yy)
-                p.lineTo(sTLx, sTLy)
-                p.addCornerMinorArc(cTLx, cTLy, r, sTLx, sTLy, eTLx, eTLy)
-                val yEndTL = min(y0 + R + L, y0 + s - R - t * 0.5f)
-                p.lineTo(xx, max(yEndTL, y0 + R + 2f))
-            }
-            1 -> {
-                val cTRx = x0 + s - R
-                val cTRy = y0 + R
-                val sTRx = x0 + s - R
-                val sTRy = yy
-                val eTRx = xxb
-                val eTRy = y0 + R
-                p.moveTo(x0 + s - R - L, yy)
-                p.lineTo(sTRx, sTRy)
-                p.addCornerMinorArc(cTRx, cTRy, r, sTRx, sTRy, eTRx, eTRy)
-                val yEndTR = min(y0 + R + L, y0 + s - R - t * 0.5f)
-                p.lineTo(xxb, max(yEndTR, y0 + R + 2f))
-            }
-            2 -> {
-                val cBLx = x0 + R
-                val cBLy = y0 + s - R
-                val sBLx = x0 + R
-                val sBLy = yyb
-                val eBLx = xx
-                val eBLy = y0 + s - R
-                p.moveTo(x0 + R + L, yyb)
-                p.lineTo(sBLx, sBLy)
-                p.addCornerMinorArc(cBLx, cBLy, r, sBLx, sBLy, eBLx, eBLy)
-                val yEndTopRef = max(min(y0 + R + L, y0 + s - R - t * 0.5f), y0 + R + 2f)
-                val yLegBL = y0 + s + y0 - yEndTopRef
-                p.lineTo(xx, yLegBL)
-            }
-            3 -> {
-                val cBRx = x0 + s - R
-                val cBRy = y0 + s - R
-                val sBRx = x0 + s - R
-                val sBRy = yyb
-                val eBRx = xxb
-                val eBRy = y0 + s - R
-                p.moveTo(x0 + s - R - L, yyb)
-                p.lineTo(sBRx, sBRy)
-                p.addCornerMinorArc(cBRx, cBRy, r, sBRx, sBRy, eBRx, eBRy)
-                val yEndTopRef = max(min(y0 + R + L, y0 + s - R - t * 0.5f), y0 + R + 2f)
-                val yLegBR = y0 + s + y0 - yEndTopRef
-                p.lineTo(xxb, yLegBR)
-            }
-        }
-        return p
-    }
-}
--- a/client/android/src/org/amnezia/vpn/PairingQrScanGeometry.kt
+++ b/client/android/src/org/amnezia/vpn/PairingQrScanGeometry.kt
@@ -1,152 +0,0 @@
-package org.amnezia.vpn
-
-import android.graphics.Rect
-import android.graphics.RectF
-import com.google.mlkit.vision.barcode.common.Barcode
-import kotlin.math.floor
-import kotlin.math.max
-import kotlin.math.min
-
-object PairingQrScanGeometry {
-    fun viewRectToInputImageRectFillCenter(
-        viewW: Int,
-        viewH: Int,
-        imageW: Int,
-        imageH: Int,
-        viewRect: RectF
-    ): RectF {
-        val scale = max(viewW / imageW.toFloat(), viewH / imageH.toFloat())
-        val drawLeft = (viewW - imageW * scale) / 2f
-        val drawTop = (viewH - imageH * scale) / 2f
-        return RectF(
-            (viewRect.left - drawLeft) / scale,
-            (viewRect.top - drawTop) / scale,
-            (viewRect.right - drawLeft) / scale,
-            (viewRect.bottom - drawTop) / scale
-        )
-    }
-
-    fun pairingIosStyleHoleCornerRadiusPx(sidePx: Float, density: Float): Float {
-        val d = density
-        var holeR = min(28f * d, max(10f * d, sidePx * 0.056f))
-        val half = 0.5f * sidePx
-        holeR = min(holeR, max(6f * d, half - 2f * d))
-        return max(holeR, 1f)
-    }
-
-    fun barcodeBoxOverlapFraction(roi: RectF, box: Rect): Float {
-        val bf = RectF(box)
-        val inter = RectF(roi)
-        if (!inter.intersect(bf)) return 0f
-        val interArea = inter.width() * inter.height()
-        val boxArea = bf.width() * bf.height()
-        return if (boxArea <= 0f) 0f else interArea / boxArea
-    }
-
-    fun barcodeMatchesPairingHole(
-        roiInImageSpace: RectF,
-        imageW: Int,
-        imageH: Int,
-        barcode: Barcode,
-        minOverlapFraction: Float = PAIRING_SEND_MIN_OVERLAP_BBOX_FALLBACK
-    ): Boolean {
-        if (imageW <= 0 || imageH <= 0) {
-            return false
-        }
-        val roi = RectF(roiInImageSpace)
-        val iw = imageW.toFloat()
-        val ih = imageH.toFloat()
-        roi.left = max(0f, roi.left)
-        roi.top = max(0f, roi.top)
-        roi.right = min(iw, roi.right)
-        roi.bottom = min(ih, roi.bottom)
-        if (roi.width() <= 0f || roi.height() <= 0f) {
-            return false
-        }
-
-        val corners = barcode.cornerPoints
-        if (corners != null && corners.size >= 4) {
-            for (p in corners) {
-                if (!roi.contains(p.x.toFloat(), p.y.toFloat())) {
-                    return false
-                }
-            }
-            return true
-        }
-
-        val box = barcode.boundingBox ?: return false
-        val cx = box.centerX().toFloat()
-        val cy = box.centerY().toFloat()
-        if (!roi.contains(cx, cy)) {
-            return false
-        }
-        return barcodeBoxOverlapFraction(roi, box) >= minOverlapFraction
-    }
-
-    private const val PAIRING_SEND_MIN_OVERLAP_BBOX_FALLBACK = 0.72f
-
-    fun pairingIosStyleHoleRectF(
-        viewW: Int,
-        viewH: Int,
-        headerBottomPx: Float,
-        statusBarTopPx: Float,
-        density: Float
-    ): RectF {
-        val w = viewW.toFloat()
-        val h = viewH.toFloat()
-        val d = density
-        if (w < 32f || h < 32f) {
-            return RectF()
-        }
-        var hdrBottom = headerBottomPx
-        if (hdrBottom < 8f * d) {
-            hdrBottom = 132f * d + statusBarTopPx
-        }
-        val sqSz = floor(min(w, h) * 0.72).toFloat()
-        var sqX = (w - sqSz) / 2f
-        var sqY = (h - sqSz) / 2f
-        sqY = max(sqY, hdrBottom + 8f * d)
-        val kBottomBand = 80f * d
-        val maxHoleBottom = h - kBottomBand
-        if (sqY + sqSz > maxHoleBottom) {
-            sqY = maxHoleBottom - sqSz
-            sqY = max(sqY, hdrBottom + 8f * d)
-        }
-        sqX = max(8f * d, min(sqX, w - sqSz - 8f * d))
-        sqY = max(hdrBottom + 4f * d, min(sqY, h - sqSz - 8f * d))
-        return RectF(sqX, sqY, sqX + sqSz, sqY + sqSz)
-    }
-
-    fun pairingIosStyleTorchCenterYPx(
-        holeBottomPx: Float,
-        bandBottomPx: Float,
-        headerBottomPx: Float,
-        safeBottomPx: Float,
-        density: Float
-    ): Float {
-        val torchH = 56f * density
-        val d = density
-        var torchCy = (holeBottomPx + bandBottomPx) * 0.5f
-        val minC = holeBottomPx + torchH * 0.5f + 6f * d
-        val maxC = bandBottomPx - torchH * 0.5f - max(6f * d, safeBottomPx)
-        torchCy = max(minC, min(maxC, torchCy))
-        if (minC > maxC) {
-            torchCy = (minC + maxC) * 0.5f
-        }
-        val hdr = headerBottomPx + torchH * 0.5f + 10f * d
-        return max(torchCy, hdr)
-    }
-
-    fun pairingIosStyleHoleInImageCoords(
-        viewW: Int,
-        viewH: Int,
-        headerBottomPx: Float,
-        statusBarTopPx: Float,
-        density: Float,
-        imageW: Int,
-        imageH: Int
-    ): RectF {
-        val hv = pairingIosStyleHoleRectF(viewW, viewH, headerBottomPx, statusBarTopPx, density)
-        return viewRectToInputImageRectFillCenter(viewW, viewH, imageW, imageH, hv)
-    }
-}
--- a/client/android/src/org/amnezia/vpn/PairingQrScanOverlayView.kt
+++ b/client/android/src/org/amnezia/vpn/PairingQrScanOverlayView.kt
@@ -1,115 +0,0 @@
-package org.amnezia.vpn
-
-import android.content.Context
-import android.graphics.Canvas
-import android.graphics.Paint
-import android.graphics.Path
-import android.graphics.RectF
-import android.util.AttributeSet
-import android.view.MotionEvent
-import android.view.View
-import androidx.core.view.ViewCompat
-import androidx.core.view.WindowInsetsCompat
-import kotlin.math.max
-
-class PairingQrScanOverlayView @JvmOverloads constructor(
-    context: Context,
-    attrs: AttributeSet? = null,
-    defStyleAttr: Int = 0
-) : View(context, attrs, defStyleAttr) {
-
-    init {
-        isClickable = false
-        isFocusable = false
-    }
-
-    @Suppress("ClickableViewAccessibility")
-    override fun onTouchEvent(event: MotionEvent): Boolean = false
-
-    private val dimPaint = Paint(Paint.ANTI_ALIAS_FLAG).apply {
-        color = 0x8C000000.toInt()
-        style = Paint.Style.FILL
-    }
-
-    private val bracketPaint = Paint(Paint.ANTI_ALIAS_FLAG).apply {
-        color = 0xFFE8E8EC.toInt()
-        style = Paint.Style.STROKE
-        strokeCap = Paint.Cap.ROUND
-        strokeJoin = Paint.Join.ROUND
-    }
-
-    private var hole = RectF()
-
-    private val bracketPaths = arrayOfNulls<Path>(4)
-
-    private val dimPath = Path()
-
-    private var pairingHeaderBottomPx = 0f
-
-    fun setPairingHeaderBottomPx(px: Float) {
-        if (pairingHeaderBottomPx == px) {
-            return
-        }
-        pairingHeaderBottomPx = px
-        recomputePairingHole()
-        invalidate()
-    }
-
-    private fun recomputePairingHole() {
-        val w = width
-        val h = height
-        if (w <= 0 || h <= 0) {
-            return
-        }
-        val topInset = ViewCompat.getRootWindowInsets(this)
-            ?.getInsets(WindowInsetsCompat.Type.statusBars())?.top?.toFloat() ?: 0f
-        val d = resources.displayMetrics.density
-        hole = PairingQrScanGeometry.pairingIosStyleHoleRectF(w, h, pairingHeaderBottomPx, topInset, d)
-        rebuildBracketPaths()
-    }
-
-    private fun rebuildBracketPaths() {
-        val s = hole.width()
-        if (s <= 0f) {
-            bracketPaths.fill(null)
-            return
-        }
-        val x0 = hole.left
-        val y0 = hole.top
-        val t = bracketPaint.strokeWidth
-        val d = resources.displayMetrics.density
-        val l = max(28f * d, s * 0.13f)
-        val r = PairingQrScanGeometry.pairingIosStyleHoleCornerRadiusPx(s, d)
-        for (i in 0..3) {
-            bracketPaths[i] = PairingQrScanBracketPaths.bracketStrokePath(i, x0, y0, s, r, l, t)
-        }
-    }
-
-    override fun onSizeChanged(w: Int, h: Int, oldw: Int, oldh: Int) {
-        super.onSizeChanged(w, h, oldw, oldh)
-        bracketPaint.strokeWidth = max(3f, 5f * resources.displayMetrics.density)
-        recomputePairingHole()
-    }
-
-    override fun onDraw(canvas: Canvas) {
-        super.onDraw(canvas)
-        val w = width.toFloat()
-        val h = height.toFloat()
-        val side = hole.width()
-        if (side > 0f) {
-            val d = resources.displayMetrics.density
-            val rx = PairingQrScanGeometry.pairingIosStyleHoleCornerRadiusPx(side, d)
-            dimPath.rewind()
-            dimPath.fillType = Path.FillType.EVEN_ODD
-            dimPath.addRect(0f, 0f, w, h, Path.Direction.CW)
-            dimPath.addRoundRect(hole, rx, rx, Path.Direction.CW)
-            canvas.drawPath(dimPath, dimPaint)
-        } else {
-            canvas.drawRect(0f, 0f, w, h, dimPaint)
-        }
-
-        for (i in 0..3) {
-            bracketPaths[i]?.let { canvas.drawPath(it, bracketPaint) }
-        }
-    }
-}
--- a/client/android/src/org/amnezia/vpn/TvFilePicker.kt
+++ b/client/android/src/org/amnezia/vpn/TvFilePicker.kt
@@ -33,10 +33,7 @@ class TvFilePicker : ComponentActivity() {
            return intent
        }
    }) {
-        setResult(RESULT_OK, Intent().apply {
-            data = it
-            addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
-        })
+        setResult(RESULT_OK, Intent().apply { data = it })
        finish()
    }

--- a/client/android/src/org/amnezia/vpn/VpnProto.kt
+++ b/client/android/src/org/amnezia/vpn/VpnProto.kt
@@ -2,6 +2,7 @@ package org.amnezia.vpn

 import org.amnezia.vpn.protocol.Protocol
 import org.amnezia.vpn.protocol.awg.Awg
+import org.amnezia.vpn.protocol.cloak.Cloak
 import org.amnezia.vpn.protocol.openvpn.OpenVpn
 import org.amnezia.vpn.protocol.wireguard.Wireguard
 import org.amnezia.vpn.protocol.xray.Xray
@@ -35,6 +36,14 @@ enum class VpnProto(
        override fun createProtocol(): Protocol = OpenVpn()
    },

+    CLOAK(
+        "Cloak",
+        "org.amnezia.vpn:amneziaOpenVpnService",
+        OpenVpnService::class.java
+    ) {
+        override fun createProtocol(): Protocol = Cloak()
+    },
+
    XRAY(
        "XRay",
        "org.amnezia.vpn:amneziaXrayService",
@@ -63,4 +72,4 @@ enum class VpnProto(
    companion object {
        fun get(protocolName: String): VpnProto = VpnProto.valueOf(protocolName.uppercase())
    }
-}
+}
--- a/client/android/src/org/amnezia/vpn/qt/QtAndroidController.kt
+++ b/client/android/src/org/amnezia/vpn/qt/QtAndroidController.kt
@@ -31,13 +31,4 @@ object QtAndroidController {

    external fun onImeInsetsChanged(heightDp: Int)
    external fun onSystemBarsInsetsChanged(navBarHeightDp: Int, statusBarHeightDp: Int)
-
-    external fun onActivityPaused()
-    external fun onActivityResumed()
-
-    external fun onCameraPermissionResult(granted: Boolean)
-
-    external fun onPairingQrCameraClosed()
-
-    external fun onPairingQrCameraUserDismissed()
 }
--- a/client/android/xray/src/main/kotlin/Xray.kt
+++ b/client/android/xray/src/main/kotlin/Xray.kt
@@ -4,9 +4,6 @@ import android.content.Context
 import android.net.VpnService.Builder
 import java.io.File
 import java.io.IOException
-import java.net.InetAddress
-import java.net.ServerSocket
-import java.util.UUID
 import go.Seq
 import org.amnezia.vpn.protocol.BadConfigException
 import org.amnezia.vpn.protocol.Protocol
@@ -22,32 +19,11 @@ import org.amnezia.vpn.util.Log
 import org.amnezia.vpn.util.net.InetNetwork
 import org.amnezia.vpn.util.net.ip
 import org.amnezia.vpn.util.net.parseInetAddress
-import org.json.JSONArray
 import org.json.JSONObject

 private const val TAG = "Xray"
 private const val LIBXRAY_TAG = "libXray"

-private fun findSocksInboundIndex(inbounds: JSONArray): Int {
-    for (i in 0 until inbounds.length()) {
-        val o = inbounds.optJSONObject(i) ?: continue
-        if (o.optString("protocol").equals("socks", ignoreCase = true)) {
-            return i
-        }
-    }
-    return -1
-}
-
-private fun acquireFreeLocalPort(): Int {
-    try {
-        ServerSocket(0, 1, InetAddress.getByName("127.0.0.1")).use { return it.localPort }
-    } catch (e: Exception) {
-        throw VpnStartException(
-            "Failed to acquire free TCP port on 127.0.0.1 for SOCKS inbound: ${e.message}"
-        )
-    }
-}
-
 class Xray : Protocol() {

    private var isRunning: Boolean = false
@@ -77,13 +53,9 @@ class Xray : Protocol() {
            return
        }

-        val xrayConfigData = config.optJSONObject("xray_config_data")
+        val xrayJsonConfig = config.optJSONObject("xray_config_data")
            ?: config.optJSONObject("ssxray_config_data")
            ?: throw BadConfigException("config_data not found")
-        val xrayJsonConfig = JSONObject(xrayConfigData.optString("config"))
-
-        // Inject SOCKS5 auth before starting xray. Re-uses existing credentials if present.
-        ensureInboundAuth(xrayJsonConfig)
        val xrayConfig = parseConfig(config, xrayJsonConfig)

        (xrayJsonConfig.optJSONObject("log") ?: JSONObject().also { xrayJsonConfig.put("log", it) })
@@ -125,22 +97,9 @@ class Xray : Protocol() {
                if (it.isNotBlank()) setMtu(it.toInt())
            }

-            val inbounds = xrayJsonConfig.getJSONArray("inbounds")
-            val socksIdx = findSocksInboundIndex(inbounds)
-            if (socksIdx < 0) {
-                throw BadConfigException("socks inbound not found")
-            }
-            val socksConfig = inbounds.getJSONObject(socksIdx)
+            val socksConfig = xrayJsonConfig.getJSONArray("inbounds")[0] as JSONObject
            socksConfig.getInt("port").let { setSocksPort(it) }

-            val socksSettings = socksConfig.optJSONObject("settings")
-            val accounts = socksSettings?.optJSONArray("accounts")
-            if (accounts != null && accounts.length() > 0) {
-                val account = accounts.getJSONObject(0)
-                setSocksUser(account.optString("user"))
-                setSocksPass(account.optString("pass"))
-            }
-
            configSplitTunneling(config)
            configAppSplitTunneling(config)
        }
@@ -203,10 +162,9 @@ class Xray : Protocol() {
    }

    private fun runTun2Socks(config: XrayConfig, fd: Int) {
-        val proxyUrl = "socks5://${config.socksUser}:${config.socksPass}@127.0.0.1:${config.socksPort}"
        val tun2SocksConfig = Tun2SocksConfig().apply {
            mtu = config.mtu.toLong()
-            proxy = proxyUrl
+            proxy = "socks5://127.0.0.1:${config.socksPort}"
            device = "fd://$fd"
            logLevel = "warn"
        }
@@ -215,37 +173,6 @@ class Xray : Protocol() {
        }
    }

-    // Ensures SOCKS5 auth is present on the socks inbound settings.
-    // Re-uses existing credentials if already configured; otherwise generates random ones.
-    private fun ensureInboundAuth(xrayConfig: JSONObject) {
-        val inbounds = xrayConfig.optJSONArray("inbounds") ?: return
-        val socksIdx = findSocksInboundIndex(inbounds)
-        if (socksIdx < 0) return
-
-        val inbound = inbounds.getJSONObject(socksIdx)
-        inbound.put("port", acquireFreeLocalPort())
-        val settings = inbound.optJSONObject("settings") ?: JSONObject().also { inbound.put("settings", it) }
-        val accounts = settings.optJSONArray("accounts")
-        if (accounts != null && accounts.length() > 0) {
-            val account = accounts.getJSONObject(0)
-            if (account.optString("user").isNotEmpty() && account.optString("pass").isNotEmpty()) {
-                // Ensure auth mode is enforced even for imported configs that had accounts
-                // but auth: "noauth" (or no auth field).
-                settings.put("auth", "password")
-                inbound.put("settings", settings)
-                inbounds.put(socksIdx, inbound)
-                return
-            }
-        }
-
-        val user = UUID.randomUUID().toString().replace("-", "").substring(0, 16)
-        val pass = UUID.randomUUID().toString().replace("-", "")
-        settings.put("auth", "password")
-        settings.put("accounts", JSONArray().put(JSONObject().put("user", user).put("pass", pass)))
-        inbound.put("settings", settings)
-        inbounds.put(socksIdx, inbound)
-    }
-
    companion object {
        val instance: Xray by lazy { Xray() }
    }
--- a/client/android/xray/src/main/kotlin/XrayConfig.kt
+++ b/client/android/xray/src/main/kotlin/XrayConfig.kt
@@ -9,16 +9,12 @@ private const val XRAY_DEFAULT_MAX_MEMORY: Long = 50 shl 20 // 50 MB
 class XrayConfig protected constructor(
    protocolConfigBuilder: ProtocolConfig.Builder,
    val socksPort: Int,
-    val socksUser: String,
-    val socksPass: String,
    val maxMemory: Long,
 ) : ProtocolConfig(protocolConfigBuilder) {

    protected constructor(builder: Builder) : this(
        builder,
        builder.socksPort,
-        builder.socksUser,
-        builder.socksPass,
        builder.maxMemory
    )

@@ -26,12 +22,6 @@ class XrayConfig protected constructor(
        internal var socksPort: Int = 0
            private set

-        internal var socksUser: String = ""
-            private set
-
-        internal var socksPass: String = ""
-            private set
-
        internal var maxMemory: Long = XRAY_DEFAULT_MAX_MEMORY
            private set

@@ -39,10 +29,6 @@ class XrayConfig protected constructor(

        fun setSocksPort(port: Int) = apply { socksPort = port }

-        fun setSocksUser(user: String) = apply { socksUser = user }
-
-        fun setSocksPass(pass: String) = apply { socksPass = pass }
-
        fun setMaxMemory(maxMemory: Long) = apply { this.maxMemory = maxMemory }

        override fun build(): XrayConfig = configBuild().run { XrayConfig(this@Builder) }
--- a/client/client_scripts/clientScripts.qrc
+++ b/client/client_scripts/clientScripts.qrc
@@ -1,5 +0,0 @@
-<RCC>
-    <qresource prefix="/client_scripts">
-        <file>mac_installer.sh</file>
-    </qresource>
-</RCC>
--- a/client/client_scripts/mac_installer.sh
+++ b/client/client_scripts/mac_installer.sh
@@ -1,42 +0,0 @@
-#!/bin/bash
-
-EXTRACT_DIR="$1"
-INSTALLER_PATH="$2"
-
-set -e
-
-echo "[AmneziaVPN] Installer package: $INSTALLER_PATH"
-
-if [ ! -f "$INSTALLER_PATH" ]; then
-    echo "[AmneziaVPN] ERROR: Installer package not found: $INSTALLER_PATH"
-    exit 1
-fi
-
-PKG_PATH="$INSTALLER_PATH"
-echo "[AmneziaVPN] Using PKG: $PKG_PATH"
-
-# Optional: basic signature/gatekeeper checks (non-fatal)
-if command -v pkgutil >/dev/null 2>&1; then
-    pkgutil --check-signature "$PKG_PATH" || true
-fi
-if command -v spctl >/dev/null 2>&1; then
-    spctl -a -vvv -t install "$PKG_PATH" || true
-fi
-
-# Run installer with admin privileges via AppleScript (prompts for password)
-echo "[AmneziaVPN] Running installer..."
-OSA_CMD='do shell script "/usr/sbin/installer -pkg '"$PKG_PATH"' -target /" with administrator privileges'
-osascript -e "$OSA_CMD"
-
-STATUS=$?
-if [ $STATUS -ne 0 ]; then
-    echo "[AmneziaVPN] ERROR: installer exited with status $STATUS"
-    exit $STATUS
-fi
-
-echo "[AmneziaVPN] Cleaning up..."
-rm -f "$INSTALLER_PATH" || true
-rm -rf "$EXTRACT_DIR" 2>/dev/null || true
-
-echo "[AmneziaVPN] Installation completed successfully"
-exit 0
--- a/client/cmake/3rdparty.cmake
+++ b/client/cmake/3rdparty.cmake
@@ -8,11 +8,81 @@ include(${CLIENT_ROOT_DIR}/cmake/QSimpleCrypto.cmake)

 include(${CLIENT_ROOT_DIR}/3rd/qrcodegen/qrcodegen.cmake)

+set(LIBSSH_ROOT_DIR "${CLIENT_ROOT_DIR}/3rd-prebuilt/3rd-prebuilt/libssh/")
+set(OPENSSL_ROOT_DIR "${CLIENT_ROOT_DIR}/3rd-prebuilt/3rd-prebuilt/openssl/")
+
+set(OPENSSL_LIBRARIES_DIR "${OPENSSL_ROOT_DIR}/lib")
+
+if(WIN32)
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/windows/include")
+    if("${CMAKE_SIZEOF_VOID_P}" STREQUAL "8")
+        set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/windows/x86_64/ssh.lib")
+        set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/windows/x86_64")
+        set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/windows/win64/libssl.lib")
+        set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/windows/win64/libcrypto.lib")
+    else()
+        set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/windows/x86/ssh.lib")
+        set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/windows/x86")
+        set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/windows/win32/libssl.lib")
+        set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/windows/win32/libcrypto.lib")
+    endif()
+elseif(APPLE AND NOT IOS)
+    if(MACOS_NE)
+        set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/universal2/libssh.a")
+        set(ZLIB_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/universal2/libz.a")
+        set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/macos/universal2")
+    else()
+        set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/x86_64/libssh.a")
+        set(ZLIB_LIB_PATH "${LIBSSH_ROOT_DIR}/macos/x86_64/libz.a")
+        set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/macos/x86_64")
+    endif()
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/macos/include")
+    set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/macos/lib/libssl.a")
+    set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/macos/lib/libcrypto.a")    
+elseif(IOS)
+    set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/ios/arm64")
+    set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/ios/arm64/libssh.a")
+    set(ZLIB_LIB_PATH "${LIBSSH_ROOT_DIR}/ios/arm64/libz.a")
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/ios/iphone/include")
+    set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/ios/iphone/lib/libssl.a")
+    set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/ios/iphone/lib/libcrypto.a")
+elseif(ANDROID)
+    set(abi ${CMAKE_ANDROID_ARCH_ABI})
+    set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/android/${abi}")
+    set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/android/${abi}/libssh.so")
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/android/include")
+    set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/android/${abi}/libssl.a")
+    set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/android/${abi}/libcrypto.a")
+    set(OPENSSL_LIBRARIES_DIR "${OPENSSL_ROOT_DIR}/android/${abi}")
+elseif(LINUX)
+    set(LIBSSH_INCLUDE_DIR "${LIBSSH_ROOT_DIR}/linux/x86_64")
+    set(ZLIB_LIB_PATH "${LIBSSH_ROOT_DIR}/linux/x86_64/libz.a")
+    set(LIBSSH_LIB_PATH "${LIBSSH_ROOT_DIR}/linux/x86_64/libssh.a")
+    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/linux/include")
+    set(OPENSSL_LIB_SSL_PATH "${OPENSSL_ROOT_DIR}/linux/x86_64/libssl.a")
+    set(OPENSSL_LIB_CRYPTO_PATH "${OPENSSL_ROOT_DIR}/linux/x86_64/libcrypto.a")
+endif()
+
+file(COPY ${OPENSSL_LIB_SSL_PATH} ${OPENSSL_LIB_CRYPTO_PATH}
+        DESTINATION ${OPENSSL_LIBRARIES_DIR})
+
+set(OPENSSL_USE_STATIC_LIBS TRUE)
+  
+set(LIBS ${LIBS} 
+    ${LIBSSH_LIB_PATH} 
+    ${ZLIB_LIB_PATH}
+)
+  
+set(LIBS ${LIBS}
+    ${OPENSSL_LIB_SSL_PATH}
+    ${OPENSSL_LIB_CRYPTO_PATH}
+)
+
 add_compile_definitions(_WINSOCKAPI_)

 set(BUILD_SHARED_LIBS OFF CACHE BOOL "" FORCE)
 set(BUILD_WITH_QT6 ON)
-add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtkeychain EXCLUDE_FROM_ALL)
+add_subdirectory(${CLIENT_ROOT_DIR}/3rd/qtkeychain)

 if(ANDROID)
    # Use qtgamepad from amnezia-vpn/qtgamepad repository
@@ -36,13 +106,12 @@ endif()
 set(LIBS ${LIBS} qt6keychain)

 include_directories(
+    ${OPENSSL_INCLUDE_DIR}
+    ${LIBSSH_INCLUDE_DIR}/include
+    ${LIBSSH_ROOT_DIR}/include
+    ${CLIENT_ROOT_DIR}/3rd/libssh/include
    ${CLIENT_ROOT_DIR}/3rd/QSimpleCrypto/src/include
    ${CLIENT_ROOT_DIR}/3rd/qtkeychain/qtkeychain
    ${CMAKE_CURRENT_BINARY_DIR}/3rd/qtkeychain
+    ${CMAKE_CURRENT_BINARY_DIR}/3rd/libssh/include
 )
-
-find_package(OpenSSL REQUIRED)
-list(APPEND LIBS OpenSSL::SSL OpenSSL::Crypto)
-
-find_package(libssh REQUIRED)
-list(APPEND LIBS ssh::ssh)
--- a/client/cmake/android.cmake
+++ b/client/cmake/android.cmake
@@ -31,25 +31,29 @@ link_directories(${CMAKE_CURRENT_SOURCE_DIR}/platforms/android)
 set(HEADERS ${HEADERS}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/android_controller.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/android_utils.h
-    ${CMAKE_CURRENT_SOURCE_DIR}/core/protocols/androidVpnProtocol.h
-    ${CMAKE_CURRENT_SOURCE_DIR}/core/utils/installedAppsImageProvider.h
+    ${CMAKE_CURRENT_SOURCE_DIR}/protocols/android_vpnprotocol.h
+    ${CMAKE_CURRENT_SOURCE_DIR}/core/installedAppsImageProvider.h
 )

 set(SOURCES ${SOURCES}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/android_controller.cpp
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/android/android_utils.cpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/core/protocols/androidVpnProtocol.cpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/core/utils/installedAppsImageProvider.cpp
+    ${CMAKE_CURRENT_SOURCE_DIR}/protocols/android_vpnprotocol.cpp
+    ${CMAKE_CURRENT_SOURCE_DIR}/core/installedAppsImageProvider.cpp
 )

+foreach(abi IN ITEMS ${QT_ANDROID_ABIS})
+    set_property(TARGET ${PROJECT} PROPERTY QT_ANDROID_EXTRA_LIBS
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/amneziawg/android/${abi}/libwg-go.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/android/${abi}/libck-ovpn-plugin.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/android/${abi}/libovpn3.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/android/${abi}/libovpnutil.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/android/${abi}/librsapss.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openssl/android/${abi}/libcrypto_3.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openssl/android/${abi}/libssl_3.so
+        ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/libssh/android/${abi}/libssh.so
+    )
+endforeach()

-find_package(awg-android REQUIRED)
-set(LIBS ${LIBS} amnezia::awg-android)
-set_property(TARGET ${PROJECT} APPEND PROPERTY QT_ANDROID_EXTRA_LIBS ${AMNEZIA_ANDROID_LIBWG_PATH} ${AMNEZIA_ANDROID_LIBWG_QUICK_PATH})
-
-find_package(amnezia-libxray REQUIRED)
-file(COPY ${AMNEZIA_LIBXRAY_PATH} DESTINATION ${CMAKE_CURRENT_SOURCE_DIR}/android/xray/libXray)
-
-find_package(openvpn-pt-android REQUIRED)
-set(LIBS ${LIBS} amnezia::openvpn-pt-android)
-set_property(TARGET ${PROJECT} APPEND PROPERTY QT_ANDROID_EXTRA_LIBS ${OPENVPN_PT_ANDROID_LIBCK_OVPN_PLUGIN_PATH})
+file(COPY ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/xray/android/libxray.aar
+        DESTINATION ${CMAKE_CURRENT_SOURCE_DIR}/android/xray/libXray)
--- a/client/cmake/ios.cmake
+++ b/client/cmake/ios.cmake
@@ -1,6 +1,8 @@
 message("Client iOS build")
+set(CMAKE_OSX_DEPLOYMENT_TARGET 13.0)
 set(APPLE_PROJECT_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})

+
 enable_language(OBJC)
 enable_language(OBJCXX)
 enable_language(Swift)
@@ -28,7 +30,6 @@ set(LIBS ${LIBS}


 set(HEADERS ${HEADERS}
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosPairingQrOverlayWindow.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/ios_controller_wrapper.h
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosnotificationhandler.h
@@ -45,8 +46,6 @@ set(SOURCES ${SOURCES}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosnotificationhandler.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosglue.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QRCodeReaderBase.mm
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosPairingCameraAccess.mm
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosPairingQrOverlayWindow.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/StoreKitController.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/AmneziaSceneDelegateHooks.mm
@@ -122,7 +121,6 @@ target_sources(${PROJECT} PRIVATE
    ${CLIENT_ROOT_DIR}/platforms/ios/LogRecord.swift
    ${CLIENT_ROOT_DIR}/platforms/ios/ScreenProtection.swift
    ${CLIENT_ROOT_DIR}/platforms/ios/VPNCController.swift
-    ${CLIENT_ROOT_DIR}/platforms/ios/StoreKit2Helper.swift
 )

 target_sources(${PROJECT} PRIVATE
@@ -133,8 +131,17 @@ target_sources(${PROJECT} PRIVATE

 set_property(TARGET ${PROJECT} APPEND PROPERTY RESOURCE
    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/AmneziaVPNLaunchScreen.storyboard
+    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/Media.xcassets
    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/PrivacyInfo.xcprivacy
 )

 add_subdirectory(ios/networkextension)
 add_dependencies(${PROJECT} networkextension)
+
+set_property(TARGET ${PROJECT} PROPERTY XCODE_EMBED_FRAMEWORKS
+    "${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-ios/OpenVPNAdapter.framework"
+)
+
+set(CMAKE_XCODE_ATTRIBUTE_FRAMEWORK_SEARCH_PATHS ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-ios/)
+target_link_libraries("networkextension" PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-ios/OpenVPNAdapter.framework")
+
--- a/client/cmake/macos.cmake
+++ b/client/cmake/macos.cmake
@@ -23,13 +23,16 @@ set_target_properties(${PROJECT} PROPERTIES
    MACOSX_BUNDLE_SHORT_VERSION_STRING "${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH}"
    MACOSX_BUNDLE_BUNDLE_VERSION "${CMAKE_PROJECT_VERSION_TWEAK}"
 )
+set(CMAKE_OSX_ARCHITECTURES "x86_64" CACHE INTERNAL "" FORCE)
+set(CMAKE_OSX_DEPLOYMENT_TARGET 10.15)
+

 set(HEADERS ${HEADERS}
-    ${CMAKE_CURRENT_SOURCE_DIR}/ui/utils/macosUtil.h
+    ${CMAKE_CURRENT_SOURCE_DIR}/ui/macos_util.h
 )

 set(SOURCES ${SOURCES}
-    ${CMAKE_CURRENT_SOURCE_DIR}/ui/utils/macosUtil.mm
+    ${CMAKE_CURRENT_SOURCE_DIR}/ui/macos_util.mm
 )


--- a/client/cmake/macos_ne.cmake
+++ b/client/cmake/macos_ne.cmake
@@ -1,6 +1,7 @@
 message("Client ==> MacOS NE build")

 set_target_properties(${PROJECT} PROPERTIES MACOSX_BUNDLE TRUE)
+set(CMAKE_OSX_DEPLOYMENT_TARGET 10.15)

 set(APPLE_PROJECT_VERSION ${CMAKE_PROJECT_VERSION_MAJOR}.${CMAKE_PROJECT_VERSION_MINOR}.${CMAKE_PROJECT_VERSION_PATCH})

@@ -49,7 +50,6 @@ set(SOURCES ${SOURCES}
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosglue.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QRCodeReaderBase.mm
    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/QtAppDelegate.mm
-    ${CMAKE_CURRENT_SOURCE_DIR}/platforms/ios/iosPairingCameraAccess_stub.cpp
 )

 set(ICON_FILE ${CMAKE_CURRENT_SOURCE_DIR}/images/app.icns)
@@ -131,7 +131,6 @@ target_sources(${PROJECT} PRIVATE
    ${CLIENT_ROOT_DIR}/platforms/ios/LogRecord.swift
    ${CLIENT_ROOT_DIR}/platforms/ios/ScreenProtection.swift
    ${CLIENT_ROOT_DIR}/platforms/ios/VPNCController.swift
-    ${CLIENT_ROOT_DIR}/platforms/ios/StoreKit2Helper.swift
 )

 target_sources(${PROJECT} PRIVATE
@@ -140,6 +139,7 @@ target_sources(${PROJECT} PRIVATE
 )

 set_property(TARGET ${PROJECT} APPEND PROPERTY RESOURCE
+    ${CMAKE_CURRENT_SOURCE_DIR}/macos/app/Images.xcassets
    ${CMAKE_CURRENT_SOURCE_DIR}/ios/app/PrivacyInfo.xcprivacy
 )

@@ -152,6 +152,19 @@ message(${QtCore_location})

 get_filename_component(QT_BIN_DIR_DETECTED "${QtCore_location}/../../../../../bin" ABSOLUTE)

-add_custom_command(TARGET ${PROJECT} POST_BUILD
-    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt $<TARGET_BUNDLE_DIR:AmneziaVPN> -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR}
+set_property(TARGET ${PROJECT} PROPERTY XCODE_EMBED_FRAMEWORKS
+    "${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-macos/OpenVPNAdapter.framework"
+)
+
+set(CMAKE_XCODE_ATTRIBUTE_FRAMEWORK_SEARCH_PATHS ${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-macos)
+target_link_libraries("AmneziaVPNNetworkExtension" PRIVATE "${CMAKE_CURRENT_SOURCE_DIR}/3rd-prebuilt/3rd-prebuilt/openvpn/apple/OpenVPNAdapter-macos/OpenVPNAdapter.framework")
+
+add_custom_command(TARGET ${PROJECT} POST_BUILD
+    COMMAND ${CMAKE_COMMAND} -E make_directory
+            $<TARGET_BUNDLE_DIR:AmneziaVPN>/Contents/Frameworks
+    COMMAND /usr/bin/find "$<TARGET_BUNDLE_DIR:AmneziaVPN>/Contents/Frameworks/OpenVPNAdapter.framework" -name "*.sha256" -delete
+    COMMAND /usr/bin/codesign --force --sign "Apple Distribution"
+            "$<TARGET_BUNDLE_DIR:AmneziaVPN>/Contents/Frameworks/OpenVPNAdapter.framework/Versions/Current/OpenVPNAdapter"
+    COMMAND ${QT_BIN_DIR_DETECTED}/macdeployqt $<TARGET_BUNDLE_DIR:AmneziaVPN> -appstore-compliant -qmldir=${CMAKE_CURRENT_SOURCE_DIR}
+    COMMENT "Signing OpenVPNAdapter framework"
 )
--- a/client/cmake/sources.cmake
+++ b/client/cmake/sources.cmake
@@ -1,73 +1,34 @@
 set(CLIENT_ROOT_DIR ${CMAKE_CURRENT_LIST_DIR}/..)

 set(HEADERS ${HEADERS}
-    ${CLIENT_ROOT_DIR}/core/utils/migrations.h
+    ${CLIENT_ROOT_DIR}/migrations.h
    ${CLIENT_ROOT_DIR}/../ipc/ipc.h
-    ${CLIENT_ROOT_DIR}/amneziaApplication.h
-    ${CLIENT_ROOT_DIR}/core/utils/errorCodes.h
-    ${CLIENT_ROOT_DIR}/core/utils/routeModes.h
-    ${CLIENT_ROOT_DIR}/core/utils/commonStructs.h
-    ${CLIENT_ROOT_DIR}/core/utils/containerEnum.h
-    ${CLIENT_ROOT_DIR}/core/utils/protocolEnum.h
-    ${CLIENT_ROOT_DIR}/core/utils/containers/containerUtils.h
-    ${CLIENT_ROOT_DIR}/core/protocols/protocolUtils.h
-    ${CLIENT_ROOT_DIR}/core/utils/constants/configKeys.h
-    ${CLIENT_ROOT_DIR}/core/utils/constants/protocolConstants.h
-    ${CLIENT_ROOT_DIR}/core/utils/constants/apiKeys.h
-    ${CLIENT_ROOT_DIR}/core/utils/constants/apiConstants.h
-    ${CLIENT_ROOT_DIR}/core/utils/errorStrings.h
-    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/scriptsRegistry.h
-    ${CLIENT_ROOT_DIR}/core/utils/qrCodeUtils.h
+    ${CLIENT_ROOT_DIR}/amnezia_application.h
+    ${CLIENT_ROOT_DIR}/containers/containers_defs.h
+    ${CLIENT_ROOT_DIR}/core/defs.h
+    ${CLIENT_ROOT_DIR}/core/errorstrings.h
+    ${CLIENT_ROOT_DIR}/core/scripts_registry.h
+    ${CLIENT_ROOT_DIR}/core/server_defs.h
+    ${CLIENT_ROOT_DIR}/core/api/apiDefs.h
+    ${CLIENT_ROOT_DIR}/core/qrCodeUtils.h
    ${CLIENT_ROOT_DIR}/core/controllers/coreController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/coreSignalHandlers.h
    ${CLIENT_ROOT_DIR}/core/controllers/gatewayController.h
-    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshSession.h
-    ${CLIENT_ROOT_DIR}/core/controllers/serversController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/usersController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/installController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/exportController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/importController.h
-    ${CLIENT_ROOT_DIR}/core/installers/installerBase.h
-    ${CLIENT_ROOT_DIR}/core/installers/awgInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/wireguardInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/openvpnInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/xrayInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/torInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/sftpInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/socks5Installer.h
-    ${CLIENT_ROOT_DIR}/core/installers/mtProxyInstaller.h
-    ${CLIENT_ROOT_DIR}/core/installers/telemtInstaller.h
-    ${CLIENT_ROOT_DIR}/core/controllers/appSplitTunnelingController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/ipSplitTunnelingController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/allowedDnsController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/exportController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/connectionController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/settingsController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/api/servicesCatalogController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/api/subscriptionController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/api/pairingController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/api/newsController.h
-    ${CLIENT_ROOT_DIR}/core/controllers/updateController.h
-    ${CLIENT_ROOT_DIR}/core/repositories/secureServersRepository.h
-    ${CLIENT_ROOT_DIR}/core/repositories/secureAppSettingsRepository.h
-    ${CLIENT_ROOT_DIR}/core/protocols/qmlRegisterProtocols.h
-    ${CLIENT_ROOT_DIR}/ui/utils/pages.h
-    ${CLIENT_ROOT_DIR}/ui/utils/qAutoStart.h
-    ${CLIENT_ROOT_DIR}/core/protocols/vpnProtocol.h
+    ${CLIENT_ROOT_DIR}/core/controllers/serverController.h
+    ${CLIENT_ROOT_DIR}/core/controllers/vpnConfigurationController.h
+    ${CLIENT_ROOT_DIR}/protocols/protocols_defs.h
+    ${CLIENT_ROOT_DIR}/protocols/qml_register_protocols.h
+    ${CLIENT_ROOT_DIR}/ui/pages.h
+    ${CLIENT_ROOT_DIR}/ui/qautostart.h
+    ${CLIENT_ROOT_DIR}/protocols/vpnprotocol.h
    ${CMAKE_CURRENT_BINARY_DIR}/version.h
-    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshClient.h
-    ${CLIENT_ROOT_DIR}/core/utils/networkUtilities.h
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/serialization.h
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/transfer.h
+    ${CLIENT_ROOT_DIR}/core/sshclient.h
+    ${CLIENT_ROOT_DIR}/core/networkUtilities.h
+    ${CLIENT_ROOT_DIR}/core/serialization/serialization.h
+    ${CLIENT_ROOT_DIR}/core/serialization/transfer.h
    ${CLIENT_ROOT_DIR}/../common/logger/logger.h
-    ${CLIENT_ROOT_DIR}/ui/utils/qmlUtils.h
-    ${CLIENT_ROOT_DIR}/core/utils/api/apiUtils.h
-    ${CLIENT_ROOT_DIR}/core/utils/osSignalHandler.h
-    ${CLIENT_ROOT_DIR}/core/utils/utilities.h
-    ${CLIENT_ROOT_DIR}/core/utils/managementServer.h
-    ${CLIENT_ROOT_DIR}/core/utils/constants.h
-    ${CLIENT_ROOT_DIR}/platforms/ios/iosPairingCameraAccess.h
-    ${CLIENT_ROOT_DIR}/platforms/ios/iosPairingQrOverlayWindow.h
+    ${CLIENT_ROOT_DIR}/utils/qmlUtils.h
+    ${CLIENT_ROOT_DIR}/core/api/apiUtils.h
+    ${CLIENT_ROOT_DIR}/core/osSignalHandler.h
 )

 # Mozilla headres
@@ -86,69 +47,39 @@ endif()

 if(NOT ANDROID)
    set(HEADERS ${HEADERS}
-        ${CLIENT_ROOT_DIR}/ui/utils/notificationHandler.h
+        ${CLIENT_ROOT_DIR}/ui/notificationhandler.h
    )
 endif()

 set(SOURCES ${SOURCES}
-    ${CLIENT_ROOT_DIR}/core/utils/migrations.cpp
-    ${CLIENT_ROOT_DIR}/amneziaApplication.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/errorStrings.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/containers/containerUtils.cpp
-    ${CLIENT_ROOT_DIR}/core/protocols/protocolUtils.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/scriptsRegistry.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/qrCodeUtils.cpp
+    ${CLIENT_ROOT_DIR}/migrations.cpp
+    ${CLIENT_ROOT_DIR}/amnezia_application.cpp
+    ${CLIENT_ROOT_DIR}/containers/containers_defs.cpp
+    ${CLIENT_ROOT_DIR}/core/errorstrings.cpp
+    ${CLIENT_ROOT_DIR}/core/scripts_registry.cpp
+    ${CLIENT_ROOT_DIR}/core/server_defs.cpp
+    ${CLIENT_ROOT_DIR}/core/qrCodeUtils.cpp
    ${CLIENT_ROOT_DIR}/core/controllers/coreController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/coreSignalHandlers.cpp
    ${CLIENT_ROOT_DIR}/core/controllers/gatewayController.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshSession.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/serversController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/usersController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/installController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/exportController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/importController.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/installerBase.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/awgInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/wireguardInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/openvpnInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/xrayInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/torInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/sftpInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/socks5Installer.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/mtProxyInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/installers/telemtInstaller.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/appSplitTunnelingController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/ipSplitTunnelingController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/allowedDnsController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/selfhosted/exportController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/connectionController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/settingsController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/api/servicesCatalogController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/api/subscriptionController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/api/pairingController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/api/newsController.cpp
-    ${CLIENT_ROOT_DIR}/core/controllers/updateController.cpp
-    ${CLIENT_ROOT_DIR}/core/repositories/secureServersRepository.cpp
-    ${CLIENT_ROOT_DIR}/core/repositories/secureAppSettingsRepository.cpp
-    ${CLIENT_ROOT_DIR}/ui/utils/qAutoStart.cpp
-    ${CLIENT_ROOT_DIR}/core/protocols/vpnProtocol.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/selfhosted/sshClient.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/networkUtilities.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/outbound.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/inbound.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/ss.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/ssd.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/vless.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/trojan.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/vmess.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serialization/vmess_new.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/serverController.cpp
+    ${CLIENT_ROOT_DIR}/core/controllers/vpnConfigurationController.cpp
+    ${CLIENT_ROOT_DIR}/protocols/protocols_defs.cpp
+    ${CLIENT_ROOT_DIR}/ui/qautostart.cpp
+    ${CLIENT_ROOT_DIR}/protocols/vpnprotocol.cpp
+    ${CLIENT_ROOT_DIR}/core/sshclient.cpp
+    ${CLIENT_ROOT_DIR}/core/networkUtilities.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/outbound.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/inbound.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/ss.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/ssd.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/vless.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/trojan.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/vmess.cpp
+    ${CLIENT_ROOT_DIR}/core/serialization/vmess_new.cpp
    ${CLIENT_ROOT_DIR}/../common/logger/logger.cpp
-    ${CLIENT_ROOT_DIR}/ui/utils/qmlUtils.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/api/apiUtils.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/serverConfigUtils.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/osSignalHandler.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/utilities.cpp
-    ${CLIENT_ROOT_DIR}/core/utils/managementServer.cpp
+    ${CLIENT_ROOT_DIR}/utils/qmlUtils.cpp
+    ${CLIENT_ROOT_DIR}/core/api/apiUtils.cpp
+    ${CLIENT_ROOT_DIR}/core/osSignalHandler.cpp
 )

 # Mozilla sources
@@ -161,7 +92,6 @@ set(SOURCES ${SOURCES}
 if(NOT IOS AND NOT MACOS_NE)
    set(SOURCES ${SOURCES}
        ${CLIENT_ROOT_DIR}/platforms/ios/QRCodeReaderBase.cpp
-        ${CLIENT_ROOT_DIR}/platforms/ios/iosPairingCameraAccess_stub.cpp
    )
 endif()

@@ -170,75 +100,56 @@ if(APPLE AND NOT IOS)
    list(APPEND HEADERS
        ${CLIENT_ROOT_DIR}/platforms/macos/macosutils.h
        ${CLIENT_ROOT_DIR}/platforms/macos/macosstatusicon.h
-        ${CLIENT_ROOT_DIR}/ui/utils/macosUtil.h
+        ${CLIENT_ROOT_DIR}/ui/macos_util.h
    )
    list(APPEND SOURCES
        ${CLIENT_ROOT_DIR}/platforms/macos/macosutils.mm
        ${CLIENT_ROOT_DIR}/platforms/macos/macosstatusicon.mm
-        ${CLIENT_ROOT_DIR}/ui/utils/macosUtil.mm
+        ${CLIENT_ROOT_DIR}/ui/macos_util.mm
    )
 endif()

 if(NOT ANDROID)
    set(SOURCES ${SOURCES}
-        ${CLIENT_ROOT_DIR}/ui/utils/notificationHandler.cpp
+        ${CLIENT_ROOT_DIR}/ui/notificationhandler.cpp
    )
 endif()

-set(COMMON_FILES_H
-    ${CLIENT_ROOT_DIR}/amneziaApplication.h
-    ${CLIENT_ROOT_DIR}/secureQSettings.h
-    ${CLIENT_ROOT_DIR}/vpnConnection.h
-)
-
-set(COMMON_FILES_CPP
-    ${CLIENT_ROOT_DIR}/amneziaApplication.cpp
-    ${CLIENT_ROOT_DIR}/secureQSettings.cpp
-    ${CLIENT_ROOT_DIR}/vpnConnection.cpp
-)
+file(GLOB COMMON_FILES_H CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/*.h)
+file(GLOB COMMON_FILES_CPP CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/*.cpp)

 file(GLOB_RECURSE PAGE_LOGIC_H CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/ui/pages_logic/*.h)
 file(GLOB_RECURSE PAGE_LOGIC_CPP CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/ui/pages_logic/*.cpp)

-file(GLOB CONFIGURATORS_H CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/core/configurators/*.h)
-file(GLOB CONFIGURATORS_CPP CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/core/configurators/*.cpp)
-
-file(GLOB_RECURSE CORE_MODELS_H CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/core/models/*.h)
-file(GLOB_RECURSE CORE_MODELS_CPP CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/core/models/*.cpp)
+file(GLOB CONFIGURATORS_H CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/configurators/*.h)
+file(GLOB CONFIGURATORS_CPP CONFIGURE_DEPENDS ${CLIENT_ROOT_DIR}/configurators/*.cpp)

 file(GLOB UI_MODELS_H CONFIGURE_DEPENDS
    ${CLIENT_ROOT_DIR}/ui/models/*.h
    ${CLIENT_ROOT_DIR}/ui/models/protocols/*.h
    ${CLIENT_ROOT_DIR}/ui/models/services/*.h
-    ${CLIENT_ROOT_DIR}/ui/models/utils/*.h
    ${CLIENT_ROOT_DIR}/ui/models/api/*.h
 )
 file(GLOB UI_MODELS_CPP CONFIGURE_DEPENDS
    ${CLIENT_ROOT_DIR}/ui/models/*.cpp
    ${CLIENT_ROOT_DIR}/ui/models/protocols/*.cpp
    ${CLIENT_ROOT_DIR}/ui/models/services/*.cpp
-    ${CLIENT_ROOT_DIR}/ui/models/utils/*.cpp
    ${CLIENT_ROOT_DIR}/ui/models/api/*.cpp
 )

 file(GLOB UI_CONTROLLERS_H CONFIGURE_DEPENDS
    ${CLIENT_ROOT_DIR}/ui/controllers/*.h
    ${CLIENT_ROOT_DIR}/ui/controllers/api/*.h
-    ${CLIENT_ROOT_DIR}/ui/controllers/qml/*.h
-    ${CLIENT_ROOT_DIR}/ui/controllers/selfhosted/*.h
 )
 file(GLOB UI_CONTROLLERS_CPP CONFIGURE_DEPENDS
    ${CLIENT_ROOT_DIR}/ui/controllers/*.cpp
    ${CLIENT_ROOT_DIR}/ui/controllers/api/*.cpp
-    ${CLIENT_ROOT_DIR}/ui/controllers/qml/*.cpp
-    ${CLIENT_ROOT_DIR}/ui/controllers/selfhosted/*.cpp
 )

 set(HEADERS ${HEADERS}
    ${COMMON_FILES_H}
    ${PAGE_LOGIC_H}
    ${CONFIGURATORS_H}
-    ${CORE_MODELS_H}
    ${UI_MODELS_H}
    ${UI_CONTROLLERS_H}
 )
@@ -246,18 +157,17 @@ set(SOURCES ${SOURCES}
    ${COMMON_FILES_CPP}
    ${PAGE_LOGIC_CPP}
    ${CONFIGURATORS_CPP}
-    ${CORE_MODELS_CPP}
    ${UI_MODELS_CPP}
    ${UI_CONTROLLERS_CPP}
 )

 if(WIN32)
    set(HEADERS ${HEADERS}
-        ${CLIENT_ROOT_DIR}/core/protocols/ikev2VpnProtocolWindows.h
+        ${CLIENT_ROOT_DIR}/protocols/ikev2_vpn_protocol_windows.h
    )

    set(SOURCES ${SOURCES}
-        ${CLIENT_ROOT_DIR}/core/protocols/ikev2VpnProtocolWindows.cpp
+        ${CLIENT_ROOT_DIR}/protocols/ikev2_vpn_protocol_windows.cpp
    )

    set(RESOURCES ${RESOURCES}
@@ -270,33 +180,39 @@ if(WIN32 OR (APPLE AND NOT IOS AND NOT MACOS_NE) OR (LINUX AND NOT ANDROID))
    add_compile_definitions(AMNEZIA_DESKTOP)

    set(HEADERS ${HEADERS}
-        ${CLIENT_ROOT_DIR}/core/utils/ipcClient.h
-        ${CLIENT_ROOT_DIR}/ui/utils/systemTrayNotificationHandler.h
-        ${CLIENT_ROOT_DIR}/core/protocols/openVpnProtocol.h
-        ${CLIENT_ROOT_DIR}/core/protocols/wireGuardProtocol.h
-        ${CLIENT_ROOT_DIR}/core/protocols/xrayProtocol.h
-        ${CLIENT_ROOT_DIR}/core/protocols/awgProtocol.h
+        ${CLIENT_ROOT_DIR}/core/ipcclient.h
+        ${CLIENT_ROOT_DIR}/core/privileged_process.h
+        ${CLIENT_ROOT_DIR}/ui/systemtray_notificationhandler.h
+        ${CLIENT_ROOT_DIR}/protocols/openvpnprotocol.h
+        ${CLIENT_ROOT_DIR}/protocols/openvpnovercloakprotocol.h
+        ${CLIENT_ROOT_DIR}/protocols/shadowsocksvpnprotocol.h
+        ${CLIENT_ROOT_DIR}/protocols/wireguardprotocol.h
+        ${CLIENT_ROOT_DIR}/protocols/xrayprotocol.h
+        ${CLIENT_ROOT_DIR}/protocols/awgprotocol.h
        ${CLIENT_ROOT_DIR}/mozilla/localsocketcontroller.h
    )

    set(SOURCES ${SOURCES}
-        ${CLIENT_ROOT_DIR}/core/utils/ipcClient.cpp
+        ${CLIENT_ROOT_DIR}/core/ipcclient.cpp
+        ${CLIENT_ROOT_DIR}/core/privileged_process.cpp
        ${CLIENT_ROOT_DIR}/mozilla/localsocketcontroller.cpp
-        ${CLIENT_ROOT_DIR}/ui/utils/systemTrayNotificationHandler.cpp
-        ${CLIENT_ROOT_DIR}/core/protocols/openVpnProtocol.cpp
-        ${CLIENT_ROOT_DIR}/core/protocols/wireGuardProtocol.cpp
-        ${CLIENT_ROOT_DIR}/core/protocols/xrayProtocol.cpp
-        ${CLIENT_ROOT_DIR}/core/protocols/awgProtocol.cpp
+        ${CLIENT_ROOT_DIR}/ui/systemtray_notificationhandler.cpp
+        ${CLIENT_ROOT_DIR}/protocols/openvpnprotocol.cpp
+        ${CLIENT_ROOT_DIR}/protocols/openvpnovercloakprotocol.cpp
+        ${CLIENT_ROOT_DIR}/protocols/shadowsocksvpnprotocol.cpp
+        ${CLIENT_ROOT_DIR}/protocols/wireguardprotocol.cpp
+        ${CLIENT_ROOT_DIR}/protocols/xrayprotocol.cpp
+        ${CLIENT_ROOT_DIR}/protocols/awgprotocol.cpp
    )
 endif()

 if(APPLE AND MACOS_NE)
    # Include only the tray notification handler in NE builds
    set(HEADERS ${HEADERS}
-        ${CLIENT_ROOT_DIR}/ui/utils/systemTrayNotificationHandler.h
+        ${CLIENT_ROOT_DIR}/ui/systemtray_notificationhandler.h
    )

    set(SOURCES ${SOURCES}
-        ${CLIENT_ROOT_DIR}/ui/utils/systemTrayNotificationHandler.cpp
+        ${CLIENT_ROOT_DIR}/ui/systemtray_notificationhandler.cpp
    )
 endif()
--- a/client/configurators/awg_configurator.cpp
+++ b/client/configurators/awg_configurator.cpp
@@ -0,0 +1,59 @@
+#include "awg_configurator.h"
+#include "protocols/protocols_defs.h"
+
+#include <QJsonDocument>
+#include <QJsonObject>
+
+AwgConfigurator::AwgConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent)
+    : WireguardConfigurator(settings, serverController, true, parent)
+{
+}
+
+QString AwgConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container, const QJsonObject &containerConfig,
+                                      ErrorCode &errorCode)
+{
+    QString config = WireguardConfigurator::createConfig(credentials, container, containerConfig, errorCode);
+
+    QJsonObject jsonConfig = QJsonDocument::fromJson(config.toUtf8()).object();
+    QString awgConfig = jsonConfig.value(config_key::config).toString();
+
+    QMap<QString, QString> configMap;
+    auto configLines = awgConfig.split("\n");
+    for (auto &line : configLines) {
+        auto trimmedLine = line.trimmed();
+        if (trimmedLine.startsWith("[") && trimmedLine.endsWith("]")) {
+            continue;
+        } else {
+            QStringList parts = trimmedLine.split(" = ");
+            if (parts.count() == 2) {
+                configMap.insert(parts[0].trimmed(), parts[1].trimmed());
+            }
+        }
+    }
+
+    jsonConfig[config_key::junkPacketCount] = configMap.value(config_key::junkPacketCount);
+    jsonConfig[config_key::junkPacketMinSize] = configMap.value(config_key::junkPacketMinSize);
+    jsonConfig[config_key::junkPacketMaxSize] = configMap.value(config_key::junkPacketMaxSize);
+    jsonConfig[config_key::initPacketJunkSize] = configMap.value(config_key::initPacketJunkSize);
+    jsonConfig[config_key::responsePacketJunkSize] = configMap.value(config_key::responsePacketJunkSize);
+    jsonConfig[config_key::initPacketMagicHeader] = configMap.value(config_key::initPacketMagicHeader);
+    jsonConfig[config_key::responsePacketMagicHeader] = configMap.value(config_key::responsePacketMagicHeader);
+    jsonConfig[config_key::underloadPacketMagicHeader] = configMap.value(config_key::underloadPacketMagicHeader);
+    jsonConfig[config_key::transportPacketMagicHeader] = configMap.value(config_key::transportPacketMagicHeader);
+
+    if (container == DockerContainer::Awg2) {
+        jsonConfig[config_key::cookieReplyPacketJunkSize] = configMap.value(config_key::cookieReplyPacketJunkSize);
+        jsonConfig[config_key::transportPacketJunkSize] = configMap.value(config_key::transportPacketJunkSize);
+    }
+
+    jsonConfig[config_key::specialJunk1] = configMap.value(amnezia::config_key::specialJunk1);
+    jsonConfig[config_key::specialJunk2] = configMap.value(amnezia::config_key::specialJunk2);
+    jsonConfig[config_key::specialJunk3] = configMap.value(amnezia::config_key::specialJunk3);
+    jsonConfig[config_key::specialJunk4] = configMap.value(amnezia::config_key::specialJunk4);
+    jsonConfig[config_key::specialJunk5] = configMap.value(amnezia::config_key::specialJunk5);
+
+    jsonConfig[config_key::mtu] =
+            containerConfig.value(ProtocolProps::protoToString(Proto::Awg)).toObject().value(config_key::mtu).toString(protocols::awg::defaultMtu);
+
+    return QJsonDocument(jsonConfig).toJson();
+}
--- a/client/configurators/awg_configurator.h
+++ b/client/configurators/awg_configurator.h
@@ -0,0 +1,18 @@
+#ifndef AWGCONFIGURATOR_H
+#define AWGCONFIGURATOR_H
+
+#include <QObject>
+
+#include "wireguard_configurator.h"
+
+class AwgConfigurator : public WireguardConfigurator
+{
+    Q_OBJECT
+public:
+    AwgConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    QString createConfig(const ServerCredentials &credentials, DockerContainer container,
+                         const QJsonObject &containerConfig, ErrorCode &errorCode);
+};
+
+#endif // AWGCONFIGURATOR_H
--- a/client/configurators/cloak_configurator.cpp
+++ b/client/configurators/cloak_configurator.cpp
@@ -0,0 +1,51 @@
+#include "cloak_configurator.h"
+
+#include <QFile>
+#include <QJsonDocument>
+#include <QJsonObject>
+
+#include "containers/containers_defs.h"
+#include "core/controllers/serverController.h"
+
+CloakConfigurator::CloakConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent)
+{
+}
+
+QString CloakConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container, const QJsonObject &containerConfig,
+                                        ErrorCode &errorCode)
+{
+    QString cloakPublicKey =
+            m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::cloak::ckPublicKeyPath, errorCode);
+    cloakPublicKey.replace("\n", "");
+
+    if (errorCode != ErrorCode::NoError) {
+        return "";
+    }
+
+    QString cloakBypassUid =
+            m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::cloak::ckBypassUidKeyPath, errorCode);
+    cloakBypassUid.replace("\n", "");
+
+    if (errorCode != ErrorCode::NoError) {
+        return "";
+    }
+
+    QJsonObject config;
+    config.insert("Transport", "direct");
+    config.insert("ProxyMethod", "openvpn");
+    config.insert("EncryptionMethod", "aes-gcm");
+    config.insert("UID", cloakBypassUid);
+    config.insert("PublicKey", cloakPublicKey);
+    config.insert("ServerName", "$FAKE_WEB_SITE_ADDRESS");
+    config.insert("NumConn", 1);
+    config.insert("BrowserSig", "chrome");
+    config.insert("StreamTimeout", 300);
+    config.insert("RemoteHost", credentials.hostName);
+    config.insert("RemotePort", "$CLOAK_SERVER_PORT");
+
+    QString textCfg = m_serverController->replaceVars(QJsonDocument(config).toJson(),
+                                                      m_serverController->genVarsForScript(credentials, container, containerConfig));
+
+    return textCfg;
+}
--- a/client/configurators/cloak_configurator.h
+++ b/client/configurators/cloak_configurator.h
@@ -0,0 +1,20 @@
+#ifndef CLOAK_CONFIGURATOR_H
+#define CLOAK_CONFIGURATOR_H
+
+#include <QObject>
+
+#include "configurator_base.h"
+
+using namespace amnezia;
+
+class CloakConfigurator : public ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    CloakConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    QString createConfig(const ServerCredentials &credentials, DockerContainer container,
+                         const QJsonObject &containerConfig, ErrorCode &errorCode);
+};
+
+#endif // CLOAK_CONFIGURATOR_H
--- a/client/configurators/configurator_base.cpp
+++ b/client/configurators/configurator_base.cpp
@@ -0,0 +1,26 @@
+#include "configurator_base.h"
+
+ConfiguratorBase::ConfiguratorBase(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent)
+    : QObject { parent }, m_settings(settings), m_serverController(serverController)
+{
+}
+
+QString ConfiguratorBase::processConfigWithLocalSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                                         QString &protocolConfigString)
+{
+    processConfigWithDnsSettings(dns, protocolConfigString);
+    return protocolConfigString;
+}
+
+QString ConfiguratorBase::processConfigWithExportSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                                          QString &protocolConfigString)
+{
+    processConfigWithDnsSettings(dns, protocolConfigString);
+    return protocolConfigString;
+}
+
+void ConfiguratorBase::processConfigWithDnsSettings(const QPair<QString, QString> &dns, QString &protocolConfigString)
+{
+    protocolConfigString.replace("$PRIMARY_DNS", dns.first);
+    protocolConfigString.replace("$SECONDARY_DNS", dns.second);
+}
--- a/client/configurators/configurator_base.h
+++ b/client/configurators/configurator_base.h
@@ -0,0 +1,33 @@
+#ifndef CONFIGURATORBASE_H
+#define CONFIGURATORBASE_H
+
+#include <QObject>
+
+#include "containers/containers_defs.h"
+#include "core/defs.h"
+#include "core/controllers/serverController.h"
+#include "settings.h"
+
+class ConfiguratorBase : public QObject
+{
+    Q_OBJECT
+public:
+    explicit ConfiguratorBase(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    virtual QString createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                 const QJsonObject &containerConfig, ErrorCode &errorCode) = 0;
+
+    virtual QString processConfigWithLocalSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                                   QString &protocolConfigString);
+    virtual QString processConfigWithExportSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                                    QString &protocolConfigString);
+
+protected:
+    void processConfigWithDnsSettings(const QPair<QString, QString> &dns, QString &protocolConfigString);
+
+    std::shared_ptr<Settings> m_settings;
+    QSharedPointer<ServerController> m_serverController;
+
+};
+
+#endif // CONFIGURATORBASE_H
--- a/client/core/configurators/ikev2Configurator.cpp
+++ b/client/core/configurators/ikev2Configurator.cpp
@@ -1,4 +1,4 @@
-#include "ikev2Configurator.h"
+#include "ikev2_configurator.h"

 #include <QDebug>
 #include <QJsonDocument>
@@ -8,16 +8,14 @@
 #include <QTemporaryFile>
 #include <QUuid>

-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/utils/selfhosted/scriptsRegistry.h"
-#include "core/utils/utilities.h"
-#include "core/models/protocols/ikev2ProtocolConfig.h"
+#include "containers/containers_defs.h"
+#include "core/controllers/serverController.h"
+#include "core/scripts_registry.h"
+#include "core/server_defs.h"
+#include "utilities.h"

-Ikev2Configurator::Ikev2Configurator(SshSession* sshSession, QObject *parent)
-    : ConfiguratorBase(sshSession, parent)
+Ikev2Configurator::Ikev2Configurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent)
 {
 }

@@ -27,6 +25,7 @@ Ikev2Configurator::ConnectionData Ikev2Configurator::prepareIkev2Config(const Se
    Ikev2Configurator::ConnectionData connData;
    connData.host = credentials.hostName;
    connData.clientId = Utils::getRandomString(16);
+    connData.password = Utils::getRandomString(16);
    connData.password = "";

    QString certFileName = "/opt/amnezia/ikev2/clients/" + connData.clientId + ".p12";
@@ -40,14 +39,14 @@ Ikev2Configurator::ConnectionData Ikev2Configurator::prepareIkev2Config(const Se
                                       "--extKeyUsage serverAuth,clientAuth -8 \"%1\"")
                                       .arg(connData.clientId);

-    errorCode = m_sshSession->runContainerScript(credentials, container, scriptCreateCert);
+    errorCode = m_serverController->runContainerScript(credentials, container, scriptCreateCert);

    QString scriptExportCert =
            QString("pk12util -W \"%1\" -d sql:/etc/ipsec.d -n \"%2\" -o \"%3\"").arg(connData.password).arg(connData.clientId).arg(certFileName);
-    errorCode = m_sshSession->runContainerScript(credentials, container, scriptExportCert);
+    errorCode = m_serverController->runContainerScript(credentials, container, scriptExportCert);

-    connData.clientCert = m_sshSession->getTextFileFromContainer(container, credentials, certFileName, errorCode);
-    connData.caCert = m_sshSession->getTextFileFromContainer(container, credentials, "/etc/ipsec.d/ca_cert_base64.p12", errorCode);
+    connData.clientCert = m_serverController->getTextFileFromContainer(container, credentials, certFileName, errorCode);
+    connData.caCert = m_serverController->getTextFileFromContainer(container, credentials, "/etc/ipsec.d/ca_cert_base64.p12", errorCode);

    qDebug() << "Ikev2Configurator::ConnectionData client cert size:" << connData.clientCert.size();
    qDebug() << "Ikev2Configurator::ConnectionData ca cert size:" << connData.caCert.size();
@@ -55,51 +54,26 @@ Ikev2Configurator::ConnectionData Ikev2Configurator::prepareIkev2Config(const Se
    return connData;
 }

-ProtocolConfig Ikev2Configurator::createConfig(const ServerCredentials &credentials, DockerContainer container, const ContainerConfig &containerConfig,
-                                               const DnsSettings &dnsSettings,
-                                               ErrorCode &errorCode)
+QString Ikev2Configurator::createConfig(const ServerCredentials &credentials, DockerContainer container, const QJsonObject &containerConfig,
+                                        ErrorCode &errorCode)
 {
-    const Ikev2ServerConfig* serverConfig = nullptr;
-    if (auto* ikev2Config = containerConfig.protocolConfig.as<Ikev2ProtocolConfig>()) {
-        serverConfig = &ikev2Config->serverConfig;
-    }
+    Q_UNUSED(containerConfig)

    ConnectionData connData = prepareIkev2Config(credentials, container, errorCode);
    if (errorCode != ErrorCode::NoError) {
-        return Ikev2ProtocolConfig{};
+        return "";
    }

-    QString configJson = genIkev2Config(connData);
-    QJsonDocument doc = QJsonDocument::fromJson(configJson.toUtf8());
-    QJsonObject configObj = doc.object();
-
-    Ikev2ProtocolConfig protocolConfig;
-    if (serverConfig) {
-        protocolConfig.serverConfig = *serverConfig;
-    } else {
-        protocolConfig.serverConfig.hostName = connData.host;
-    }
-    
-    Ikev2ClientConfig clientConfig;
-    clientConfig.nativeConfig = configJson;
-    clientConfig.hostName = connData.host;
-    clientConfig.userName = connData.clientId;
-    clientConfig.cert = QString(connData.clientCert.toBase64());
-    clientConfig.password = connData.password;
-    clientConfig.clientId = connData.clientId;
-    
-    protocolConfig.setClientConfig(clientConfig);
-    
-    return protocolConfig;
+    return genIkev2Config(connData);
 }

 QString Ikev2Configurator::genIkev2Config(const ConnectionData &connData)
 {
    QJsonObject config;
-    config[configKey::hostName] = connData.host;
-    config[configKey::userName] = connData.clientId;
-    config[configKey::cert] = QString(connData.clientCert.toBase64());
-    config[configKey::password] = connData.password;
+    config[config_key::hostName] = connData.host;
+    config[config_key::userName] = connData.clientId;
+    config[config_key::cert] = QString(connData.clientCert.toBase64());
+    config[config_key::password] = connData.password;

    return QJsonDocument(config).toJson();
 }
--- a/client/configurators/ikev2_configurator.h
+++ b/client/configurators/ikev2_configurator.h
@@ -0,0 +1,35 @@
+#ifndef IKEV2_CONFIGURATOR_H
+#define IKEV2_CONFIGURATOR_H
+
+#include <QObject>
+#include <QProcessEnvironment>
+
+#include "configurator_base.h"
+#include "core/defs.h"
+
+class Ikev2Configurator : public ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    Ikev2Configurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    struct ConnectionData {
+        QByteArray clientCert; // p12 client cert
+        QByteArray caCert; // p12 server cert
+        QString clientId;
+        QString password; // certificate password
+        QString host; // host ip
+    };
+
+    QString createConfig(const ServerCredentials &credentials, DockerContainer container,
+                         const QJsonObject &containerConfig, ErrorCode &errorCode);
+
+    QString genIkev2Config(const ConnectionData &connData);
+    QString genMobileConfig(const ConnectionData &connData);
+    QString genStrongSwanConfig(const ConnectionData &connData);
+
+    ConnectionData prepareIkev2Config(const ServerCredentials &credentials,
+        DockerContainer container, ErrorCode &errorCode);
+};
+
+#endif // IKEV2_CONFIGURATOR_H
--- a/client/core/configurators/openVpnConfigurator.cpp
+++ b/client/core/configurators/openVpnConfigurator.cpp
@@ -1,9 +1,8 @@
-#include "openVpnConfigurator.h"
+#include "openvpn_configurator.h"

 #include <QDebug>
 #include <QJsonDocument>
 #include <QJsonObject>
-#include <QRegularExpression>
 #include <QProcess>
 #include <QString>
 #include <QTemporaryDir>
@@ -14,34 +13,26 @@
    #include <QApplication>
 #endif

-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/utils/networkUtilities.h"
-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/utils/selfhosted/scriptsRegistry.h"
-#include "core/utils/utilities.h"
-#include "core/models/protocols/openVpnProtocolConfig.h"
-
-using namespace amnezia;
+#include "core/networkUtilities.h"
+#include "containers/containers_defs.h"
+#include "core/controllers/serverController.h"
+#include "core/scripts_registry.h"
+#include "settings.h"
+#include "utilities.h"

 #include <openssl/pem.h>
 #include <openssl/rsa.h>
 #include <openssl/x509.h>


-OpenVpnConfigurator::OpenVpnConfigurator(SshSession* sshSession, QObject *parent)
-    : ConfiguratorBase(sshSession, parent)
+OpenVpnConfigurator::OpenVpnConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController,
+                                         QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent)
 {
 }

 OpenVpnConfigurator::ConnectionData OpenVpnConfigurator::prepareOpenVpnConfig(const ServerCredentials &credentials,
-                                                                              DockerContainer container, 
-                                                                              const DnsSettings &dnsSettings,
-                                                                              ErrorCode &errorCode)
+                                                                              DockerContainer container, ErrorCode &errorCode)
 {
    OpenVpnConfigurator::ConnectionData connData = OpenVpnConfigurator::createCertRequest();
    connData.host = credentials.hostName;
@@ -53,26 +44,26 @@ OpenVpnConfigurator::ConnectionData OpenVpnConfigurator::prepareOpenVpnConfig(co

    QString reqFileName = QString("%1/%2.req").arg(amnezia::protocols::openvpn::clientsDirPath).arg(connData.clientId);

-    errorCode = m_sshSession->uploadTextFileToContainer(container, credentials, connData.request, reqFileName);
+    errorCode = m_serverController->uploadTextFileToContainer(container, credentials, connData.request, reqFileName);
    if (errorCode != ErrorCode::NoError) {
        return connData;
    }

-    errorCode = signCert(container, credentials, dnsSettings, connData.clientId);
+    errorCode = signCert(container, credentials, connData.clientId);
    if (errorCode != ErrorCode::NoError) {
        return connData;
    }

    connData.caCert =
-            m_sshSession->getTextFileFromContainer(container, credentials, amnezia::protocols::openvpn::caCertPath, errorCode);
-    connData.clientCert = m_sshSession->getTextFileFromContainer(
+            m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::openvpn::caCertPath, errorCode);
+    connData.clientCert = m_serverController->getTextFileFromContainer(
            container, credentials, QString("%1/%2.crt").arg(amnezia::protocols::openvpn::clientCertPath).arg(connData.clientId), errorCode);

    if (errorCode != ErrorCode::NoError) {
        return connData;
    }

-    connData.taKey = m_sshSession->getTextFileFromContainer(container, credentials, amnezia::protocols::openvpn::taKeyPath, errorCode);
+    connData.taKey = m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::openvpn::taKeyPath, errorCode);

    if (connData.caCert.isEmpty() || connData.clientCert.isEmpty() || connData.taKey.isEmpty()) {
        errorCode = ErrorCode::SshScpFailureError;
@@ -81,23 +72,15 @@ OpenVpnConfigurator::ConnectionData OpenVpnConfigurator::prepareOpenVpnConfig(co
    return connData;
 }

-ProtocolConfig OpenVpnConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
-                                                  const ContainerConfig &containerConfig,
-                                                  const DnsSettings &dnsSettings,
-                                                  ErrorCode &errorCode)
+QString OpenVpnConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                          const QJsonObject &containerConfig, ErrorCode &errorCode)
 {
-    const OpenVpnServerConfig* serverConfig = nullptr;
-    if (auto* openVpnProtocolConfig = containerConfig.getOpenVpnProtocolConfig()) {
-        serverConfig = &openVpnProtocolConfig->serverConfig;
-    }
-    
-    amnezia::ScriptVars vars = amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns);
-    vars.append(amnezia::genProtocolVarsForContainer(container, containerConfig));
-    QString config = m_sshSession->replaceVars(amnezia::scriptData(ProtocolScriptType::openvpn_template, container), vars);
+    QString config = m_serverController->replaceVars(amnezia::scriptData(ProtocolScriptType::openvpn_template, container),
+                                                     m_serverController->genVarsForScript(credentials, container, containerConfig));

-    ConnectionData connData = prepareOpenVpnConfig(credentials, container, dnsSettings, errorCode);
+    ConnectionData connData = prepareOpenVpnConfig(credentials, container, errorCode);
    if (errorCode != ErrorCode::NoError) {
-        return OpenVpnProtocolConfig{};
+        return "";
    }

    auto sanitizeStaticKey = [](const QString &key) {
@@ -133,45 +116,42 @@ ProtocolConfig OpenVpnConfigurator::createConfig(const ServerCredentials &creden
    config.replace("block-outside-dns", "");
 #endif

-    OpenVpnProtocolConfig protocolConfig;
-    if (serverConfig) {
-        protocolConfig.serverConfig = *serverConfig;
-    }
-    
-    OpenVpnClientConfig clientConfig;
-    clientConfig.nativeConfig = config;
-    clientConfig.clientId = connData.clientId;
-    clientConfig.blockOutsideDns = false;
-    
-    protocolConfig.setClientConfig(clientConfig);
-    
-    return protocolConfig;
+    QJsonObject jConfig;
+    jConfig[config_key::config] = config;
+
+    jConfig[config_key::clientId] = connData.clientId;
+
+    return QJsonDocument(jConfig).toJson();
 }

-ProtocolConfig OpenVpnConfigurator::processConfigWithLocalSettings(const ConnectionSettings &settings,
-                                                                   ProtocolConfig protocolConfig)
+QString OpenVpnConfigurator::processConfigWithLocalSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                                            QString &protocolConfigString)
 {
-    applyDnsToNativeConfig(settings.dns, protocolConfig);
+    processConfigWithDnsSettings(dns, protocolConfigString);

-    QString config = protocolConfig.nativeConfig();
+    QJsonObject json = QJsonDocument::fromJson(protocolConfigString.toUtf8()).object();
+    QString config = json[config_key::config].toString();

-    if (!settings.isApiConfig) {
+    if (!isApiConfig) {
        QRegularExpression regex("redirect-gateway.*");
        config.replace(regex, "");

-        if (settings.dns.primaryDns.contains(protocols::dns::amneziaDnsIp)) {
-            QRegularExpression dnsRegex("dhcp-option DNS " + settings.dns.secondaryDns);
+        // We don't use secondary DNS if primary DNS is AmneziaDNS
+        if (dns.first.contains(protocols::dns::amneziaDnsIp)) {
+            QRegularExpression dnsRegex("dhcp-option DNS " + dns.second);
            config.replace(dnsRegex, "");
        }

-        if (!settings.splitTunneling.isSitesSplitTunnelingEnabled) {
+        if (!m_settings->isSitesSplitTunnelingEnabled()) {
            config.append("\nredirect-gateway def1 ipv6 bypass-dhcp\n");
            config.append("block-ipv6\n");
-        } else if (settings.splitTunneling.routeMode == RouteMode::VpnOnlyForwardSites) {
-            // no redirect-gateway
-        } else if (settings.splitTunneling.routeMode == RouteMode::VpnAllExceptSites) {
+        } else if (m_settings->routeMode() == Settings::VpnOnlyForwardSites) {
+
+               // no redirect-gateway
+        } else if (m_settings->routeMode() == Settings::VpnAllExceptSites) {
 #if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS) && !defined(MACOS_NE)
            config.append("\nredirect-gateway ipv6 !ipv4 bypass-dhcp\n");
+            // Prevent ipv6 leak
 #endif
            config.append("block-ipv6\n");
        }
@@ -182,57 +162,64 @@ ProtocolConfig OpenVpnConfigurator::processConfigWithLocalSettings(const Connect
 #endif

 #if (defined(MZ_MACOS) || defined(MZ_LINUX))
-    config.append(QString("\nscript-security 2\n"
-                         "up %1/update-resolv-conf.sh\n"
-                         "down %1/update-resolv-conf.sh\n")
-                  .arg(qApp->applicationDirPath()));
+    QString dnsConf = QString("\nscript-security 2\n"
+                              "up %1/update-resolv-conf.sh\n"
+                              "down %1/update-resolv-conf.sh\n")
+                              .arg(qApp->applicationDirPath());
+
+    config.append(dnsConf);
 #endif

-    protocolConfig.setNativeConfig(config);
-    return protocolConfig;
+    json[config_key::config] = config;
+    return QJsonDocument(json).toJson();
 }

-ProtocolConfig OpenVpnConfigurator::processConfigWithExportSettings(const ExportSettings &settings,
-                                                                    ProtocolConfig protocolConfig)
+QString OpenVpnConfigurator::processConfigWithExportSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                                             QString &protocolConfigString)
 {
-    applyDnsToNativeConfig(settings.dns, protocolConfig);
+    processConfigWithDnsSettings(dns, protocolConfigString);

-    QString config = protocolConfig.nativeConfig();
+    QJsonObject json = QJsonDocument::fromJson(protocolConfigString.toUtf8()).object();
+    QString config = json[config_key::config].toString();

    QRegularExpression regex("redirect-gateway.*");
    config.replace(regex, "");

-    if (settings.dns.primaryDns.contains(protocols::dns::amneziaDnsIp)) {
-        QRegularExpression dnsRegex("dhcp-option DNS " + settings.dns.secondaryDns);
+    // We don't use secondary DNS if primary DNS is AmneziaDNS
+    if (dns.first.contains(protocols::dns::amneziaDnsIp)) {
+        QRegularExpression dnsRegex("dhcp-option DNS " + dns.second);
        config.replace(dnsRegex, "");
    }

    config.append("\nredirect-gateway def1 ipv6 bypass-dhcp\n");
+
+    // Prevent ipv6 leak
    config.append("block-ipv6\n");
+
+    // remove block-outside-dns for all exported configs
    config.replace("block-outside-dns", "");

-    protocolConfig.setNativeConfig(config);
-    return protocolConfig;
+    json[config_key::config] = config;
+    return QJsonDocument(json).toJson();
 }

-ErrorCode OpenVpnConfigurator::signCert(DockerContainer container, const ServerCredentials &credentials, 
-                                        const DnsSettings &dnsSettings, QString clientId)
+ErrorCode OpenVpnConfigurator::signCert(DockerContainer container, const ServerCredentials &credentials, QString clientId)
 {
    QString script_import = QString("sudo docker exec -i %1 bash -c \"cd /opt/amnezia/openvpn && "
                                    "easyrsa import-req %2/%3.req %3\"")
-                                    .arg(ContainerUtils::containerToString(container))
+                                    .arg(ContainerProps::containerToString(container))
                                    .arg(amnezia::protocols::openvpn::clientsDirPath)
                                    .arg(clientId);

    QString script_sign = QString("sudo docker exec -i %1 bash -c \"export EASYRSA_BATCH=1; cd /opt/amnezia/openvpn && "
                                  "easyrsa sign-req client %2\"")
-                                  .arg(ContainerUtils::containerToString(container))
+                                  .arg(ContainerProps::containerToString(container))
                                  .arg(clientId);

    QStringList scriptList { script_import, script_sign };
-    QString script = m_sshSession->replaceVars(scriptList.join("\n"), amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns));
+    QString script = m_serverController->replaceVars(scriptList.join("\n"), m_serverController->genVarsForScript(credentials, container));

-    return m_sshSession->runScript(credentials, script);
+    return m_serverController->runScript(credentials, script);
 }

 OpenVpnConfigurator::ConnectionData OpenVpnConfigurator::createCertRequest()
@@ -241,7 +228,7 @@ OpenVpnConfigurator::ConnectionData OpenVpnConfigurator::createCertRequest()
    connData.clientId = Utils::getRandomString(32);

    int ret = 0;
-    int nVersion = 0;
+    int nVersion = 1;

    QByteArray clientIdUtf8 = connData.clientId.toUtf8();

--- a/client/configurators/openvpn_configurator.h
+++ b/client/configurators/openvpn_configurator.h
@@ -0,0 +1,43 @@
+#ifndef OPENVPN_CONFIGURATOR_H
+#define OPENVPN_CONFIGURATOR_H
+
+#include <QObject>
+#include <QProcessEnvironment>
+
+#include "configurator_base.h"
+#include "core/defs.h"
+
+class OpenVpnConfigurator : public ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    OpenVpnConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    struct ConnectionData
+    {
+        QString clientId;
+        QString request;    // certificate request
+        QString privKey;    // client private key
+        QString clientCert; // client signed certificate
+        QString caCert;     // server certificate
+        QString taKey;      // tls-auth key
+        QString host;       // host ip
+    };
+
+    QString createConfig(const ServerCredentials &credentials, DockerContainer container,
+                         const QJsonObject &containerConfig, ErrorCode &errorCode);
+
+    QString processConfigWithLocalSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                           QString &protocolConfigString);
+    QString processConfigWithExportSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                            QString &protocolConfigString);
+
+    static ConnectionData createCertRequest();
+
+private:
+    ConnectionData prepareOpenVpnConfig(const ServerCredentials &credentials, DockerContainer container,
+                                        ErrorCode &errorCode);
+    ErrorCode signCert(DockerContainer container, const ServerCredentials &credentials, QString clientId);
+};
+
+#endif // OPENVPN_CONFIGURATOR_H
--- a/client/configurators/shadowsocks_configurator.cpp
+++ b/client/configurators/shadowsocks_configurator.cpp
@@ -0,0 +1,40 @@
+#include "shadowsocks_configurator.h"
+
+#include <QFile>
+#include <QJsonDocument>
+#include <QJsonObject>
+
+#include "containers/containers_defs.h"
+#include "core/controllers/serverController.h"
+
+ShadowSocksConfigurator::ShadowSocksConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController,
+                                                 QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent)
+{
+}
+
+QString ShadowSocksConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                              const QJsonObject &containerConfig, ErrorCode &errorCode)
+{
+    QString ssKey =
+            m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::shadowsocks::ssKeyPath, errorCode);
+    ssKey.replace("\n", "");
+
+    if (errorCode != ErrorCode::NoError) {
+        return "";
+    }
+
+    QJsonObject config;
+    config.insert("server", credentials.hostName);
+    config.insert("server_port", "$SHADOWSOCKS_SERVER_PORT");
+    config.insert("local_port", "$SHADOWSOCKS_LOCAL_PORT");
+    config.insert("password", ssKey);
+    config.insert("timeout", 60);
+    config.insert("method", "$SHADOWSOCKS_CIPHER");
+
+    QString textCfg = m_serverController->replaceVars(QJsonDocument(config).toJson(),
+                                                      m_serverController->genVarsForScript(credentials, container, containerConfig));
+
+    // qDebug().noquote() << textCfg;
+    return textCfg;
+}
--- a/client/configurators/shadowsocks_configurator.h
+++ b/client/configurators/shadowsocks_configurator.h
@@ -0,0 +1,19 @@
+#ifndef SHADOWSOCKS_CONFIGURATOR_H
+#define SHADOWSOCKS_CONFIGURATOR_H
+
+#include <QObject>
+
+#include "configurator_base.h"
+#include "core/defs.h"
+
+class ShadowSocksConfigurator : public ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    ShadowSocksConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    QString createConfig(const ServerCredentials &credentials, DockerContainer container,
+                         const QJsonObject &containerConfig, ErrorCode &errorCode);
+};
+
+#endif // SHADOWSOCKS_CONFIGURATOR_H
--- a/client/configurators/ssh_configurator.cpp
+++ b/client/configurators/ssh_configurator.cpp
@@ -0,0 +1,112 @@
+#include "ssh_configurator.h"
+
+#include <QDebug>
+#include <QObject>
+#include <QProcess>
+#include <QString>
+#include <QTemporaryDir>
+#include <QTemporaryFile>
+#include <QThread>
+#include <qtimer.h>
+#if defined(Q_OS_ANDROID) || defined(Q_OS_IOS) || defined(MACOS_NE)
+    #include <QGuiApplication>
+#else
+    #include <QApplication>
+#endif
+
+#include "core/server_defs.h"
+#include "utilities.h"
+
+SshConfigurator::SshConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent)
+{
+}
+
+QString SshConfigurator::convertOpenSShKey(const QString &key)
+{
+#if !defined(Q_OS_IOS) && !defined(MACOS_NE)
+    QProcess p;
+    p.setProcessChannelMode(QProcess::MergedChannels);
+
+    QTemporaryFile tmp;
+    #ifdef QT_DEBUG
+    tmp.setAutoRemove(false);
+    #endif
+    tmp.open();
+    tmp.write(key.toUtf8());
+    tmp.close();
+
+    // ssh-keygen -p -P "" -N "" -m pem -f id_ssh
+
+    #ifdef Q_OS_WIN
+    p.setProcessEnvironment(prepareEnv());
+    p.setProgram("cmd.exe");
+    p.setNativeArguments(QString("/C \"ssh-keygen.exe -p -P \"\" -N \"\" -m pem -f \"%1\"\"").arg(tmp.fileName()));
+    #else
+    p.setProgram("ssh-keygen");
+    p.setArguments(QStringList() << "-p"
+                                 << "-P"
+                                 << ""
+                                 << "-N"
+                                 << ""
+                                 << "-m"
+                                 << "pem"
+                                 << "-f" << tmp.fileName());
+    #endif
+
+    p.start();
+    p.waitForFinished();
+
+    qDebug().noquote() << "OpenVpnConfigurator::convertOpenSShKey" << p.exitCode() << p.exitStatus() << p.readAll();
+
+    tmp.open();
+
+    return tmp.readAll();
+#else
+    return key;
+#endif
+}
+
+// DEAD CODE.
+void SshConfigurator::openSshTerminal(const ServerCredentials &credentials)
+{
+#if !defined(Q_OS_IOS) && !defined(MACOS_NE)
+    QProcess *p = new QProcess();
+    p->setProcessChannelMode(QProcess::SeparateChannels);
+
+    #ifdef Q_OS_WIN
+    p->setProcessEnvironment(prepareEnv());
+    p->setProgram(qApp->applicationDirPath() + "\\cygwin\\putty.exe");
+
+    if (credentials.secretData.contains("PRIVATE KEY")) {
+        // todo: connect by key
+        //        p->setNativeArguments(QString("%1@%2")
+        //            .arg(credentials.userName).arg(credentials.hostName).arg(credentials.secretData));
+    } else {
+        p->setNativeArguments(QString("%1@%2 -pw %3").arg(credentials.userName).arg(credentials.hostName).arg(credentials.secretData));
+    }
+    #else
+    p->setProgram("/bin/bash");
+    #endif
+
+    p->startDetached();
+#endif
+}
+
+QProcessEnvironment SshConfigurator::prepareEnv()
+{
+    QProcessEnvironment env = QProcessEnvironment::systemEnvironment();
+    QString pathEnvVar = env.value("PATH");
+
+#ifdef Q_OS_WIN
+    pathEnvVar.clear();
+    pathEnvVar.prepend(QDir::toNativeSeparators(QApplication::applicationDirPath()) + "\\cygwin;");
+    pathEnvVar.prepend(QDir::toNativeSeparators(QApplication::applicationDirPath()) + "\\openvpn;");
+#elif defined(Q_OS_MACX) && !defined(MACOS_NE)
+    pathEnvVar.prepend(QDir::toNativeSeparators(QApplication::applicationDirPath()) + "/Contents/MacOS");
+#endif
+
+    env.insert("PATH", pathEnvVar);
+    // qDebug().noquote() << "ENV PATH" << pathEnvVar;
+    return env;
+}
--- a/client/configurators/ssh_configurator.h
+++ b/client/configurators/ssh_configurator.h
@@ -0,0 +1,22 @@
+#ifndef SSH_CONFIGURATOR_H
+#define SSH_CONFIGURATOR_H
+
+#include <QObject>
+#include <QProcessEnvironment>
+
+#include "configurator_base.h"
+#include "core/defs.h"
+
+class SshConfigurator : ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    SshConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    QProcessEnvironment prepareEnv();
+    QString convertOpenSShKey(const QString &key);
+    void openSshTerminal(const ServerCredentials &credentials);
+
+};
+
+#endif // SSH_CONFIGURATOR_H
--- a/client/core/configurators/wireguardConfigurator.cpp
+++ b/client/core/configurators/wireguardConfigurator.cpp
@@ -1,4 +1,4 @@
-#include "wireguardConfigurator.h"
+#include "wireguard_configurator.h"

 #include <QDebug>
 #include <QJsonDocument>
@@ -13,26 +13,17 @@
 #include <openssl/rsa.h>
 #include <openssl/x509.h>

-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/utils/selfhosted/scriptsRegistry.h"
-#include "core/utils/protocolEnum.h"
-#include "core/protocols/protocolUtils.h"
-#include "core/utils/constants/configKeys.h"
-#include "core/utils/constants/protocolConstants.h"
-#include "core/utils/utilities.h"
-#include "core/models/containerConfig.h"
-#include "core/models/protocols/wireGuardProtocolConfig.h"
-#include "core/models/protocols/awgProtocolConfig.h"
-#include <QJsonArray>
+#include "containers/containers_defs.h"
+#include "core/controllers/serverController.h"
+#include "core/scripts_registry.h"
+#include "core/server_defs.h"
+#include "settings.h"
+#include "utilities.h"

-using namespace amnezia;
-
-WireguardConfigurator::WireguardConfigurator(SshSession* sshSession, bool isAwg,
+WireguardConfigurator::WireguardConfigurator(std::shared_ptr<Settings> settings,
+                                             const QSharedPointer<ServerController> &serverController, bool isAwg,
                                             QObject *parent)
-    : ConfiguratorBase(sshSession, parent), m_isAwg(isAwg)
+    : ConfiguratorBase(settings, serverController, parent), m_isAwg(isAwg)
 {
    m_serverConfigPath =
            m_isAwg ? amnezia::protocols::awg::serverConfigPath : amnezia::protocols::wireguard::serverConfigPath;
@@ -42,8 +33,8 @@ WireguardConfigurator::WireguardConfigurator(SshSession* sshSession, bool isAwg,
            m_isAwg ? amnezia::protocols::awg::serverPskKeyPath : amnezia::protocols::wireguard::serverPskKeyPath;
    m_configTemplate = m_isAwg ? ProtocolScriptType::awg_template : ProtocolScriptType::wireguard_template;

-    m_protocolName = m_isAwg ? configKey::awg : configKey::wireguard;
-    m_defaultPort = m_isAwg ? protocols::awg::defaultPort : protocols::wireguard::defaultPort;
+    m_protocolName = m_isAwg ? config_key::awg : config_key::wireguard;
+    m_defaultPort = m_isAwg ? protocols::wireguard::defaultPort : protocols::awg::defaultPort;
 }

 WireguardConfigurator::ConnectionData WireguardConfigurator::genClientKeys()
@@ -100,21 +91,12 @@ QList<QHostAddress> WireguardConfigurator::getIpsFromConf(const QString &input)

 WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardConfig(const ServerCredentials &credentials,
                                                                                    DockerContainer container,
-                                                                                    const WireGuardServerConfig* serverConfig,
-                                                                                    const AwgServerConfig* awgServerConfig,
-                                                                                    const DnsSettings &dnsSettings,
+                                                                                    const QJsonObject &containerConfig,
                                                                                    ErrorCode &errorCode)
 {
    WireguardConfigurator::ConnectionData connData = WireguardConfigurator::genClientKeys();
    connData.host = credentials.hostName;
-    
-    QString portStr = m_defaultPort;
-    if (serverConfig && !serverConfig->port.isEmpty()) {
-        portStr = serverConfig->port;
-    } else if (awgServerConfig && !awgServerConfig->port.isEmpty()) {
-        portStr = awgServerConfig->port;
-    }
-    connData.port = portStr;
+    connData.port = containerConfig.value(m_protocolName).toObject().value(config_key::port).toString(m_defaultPort);

    if (connData.clientPrivKey.isEmpty() || connData.clientPubKey.isEmpty()) {
        errorCode = ErrorCode::InternalError;
@@ -132,7 +114,7 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
        return ErrorCode::NoError;
    };

-    errorCode = m_sshSession->runContainerScript(credentials, container, getIpsScript, cbReadStdOut);
+    errorCode = m_serverController->runContainerScript(credentials, container, getIpsScript, cbReadStdOut);
    if (errorCode != ErrorCode::NoError) {
        return connData;
    }
@@ -141,14 +123,11 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
    QHostAddress nextIp = [&] {
        QHostAddress result;
        QHostAddress lastIp;
-        QString subnetAddress = protocols::wireguard::defaultSubnetAddress;
-        if (serverConfig && !serverConfig->subnetAddress.isEmpty()) {
-            subnetAddress = serverConfig->subnetAddress;
-        } else if (awgServerConfig && !awgServerConfig->subnetAddress.isEmpty()) {
-            subnetAddress = awgServerConfig->subnetAddress;
-        }
        if (ips.empty()) {
-            lastIp.setAddress(subnetAddress);
+            lastIp.setAddress(containerConfig.value(m_protocolName)
+                                      .toObject()
+                                      .value(config_key::subnet_address)
+                                      .toString(protocols::wireguard::defaultSubnetAddress));
        } else {
            lastIp = ips.last();
        }
@@ -166,13 +145,13 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon

    // Get keys
    connData.serverPubKey =
-            m_sshSession->getTextFileFromContainer(container, credentials, m_serverPublicKeyPath, errorCode);
+            m_serverController->getTextFileFromContainer(container, credentials, m_serverPublicKeyPath, errorCode);
    connData.serverPubKey.replace("\n", "");
    if (errorCode != ErrorCode::NoError) {
        return connData;
    }

-    connData.pskKey = m_sshSession->getTextFileFromContainer(container, credentials, m_serverPskKeyPath, errorCode);
+    connData.pskKey = m_serverController->getTextFileFromContainer(container, credentials, m_serverPskKeyPath, errorCode);
    connData.pskKey.replace("\n", "");

    if (errorCode != ErrorCode::NoError) {
@@ -186,7 +165,7 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
                                 "AllowedIPs = %3/32\n\n")
                                 .arg(connData.clientPubKey, connData.pskKey, connData.clientIP);

-    errorCode = m_sshSession->uploadTextFileToContainer(container, credentials, configPart, configPath,
+    errorCode = m_serverController->uploadTextFileToContainer(container, credentials, configPart, configPath,
                                                              libssh::ScpOverwriteMode::ScpAppendToExisting);

    if (errorCode != ErrorCode::NoError) {
@@ -199,43 +178,23 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
    QString script = QString(
        "sudo docker exec -i $CONTAINER_NAME bash -c '%1 syncconf %2 <(%1-quick strip %3)'").arg(bin, iface, configPath);

-    errorCode = m_sshSession->runScript(
+    errorCode = m_serverController->runScript(
            credentials,
-            m_sshSession->replaceVars(script, amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns)));
+            m_serverController->replaceVars(script, m_serverController->genVarsForScript(credentials, container)));

    return connData;
 }

-ProtocolConfig WireguardConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
-                                                    const ContainerConfig &containerConfig,
-                                                    const DnsSettings &dnsSettings,
-                                                    ErrorCode &errorCode)
+QString WireguardConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                            const QJsonObject &containerConfig, ErrorCode &errorCode)
 {
-    const WireGuardServerConfig* wireguardServerConfig = nullptr;
-    const WireGuardClientConfig* wireguardClientConfig = nullptr;
-    const AwgServerConfig* awgServerConfig = nullptr;
-    const AwgClientConfig* awgClientConfig = nullptr;
-    
-    if (auto* wireGuardProtocolConfig = containerConfig.getWireGuardProtocolConfig()) {
-        wireguardServerConfig = &wireGuardProtocolConfig->serverConfig;
-        if (wireGuardProtocolConfig->clientConfig.has_value()) {
-            wireguardClientConfig = &wireGuardProtocolConfig->clientConfig.value();
-        }
-    } else if (auto* awgProtocolConfig = containerConfig.getAwgProtocolConfig()) {
-        awgServerConfig = &awgProtocolConfig->serverConfig;
-        if (awgProtocolConfig->clientConfig.has_value()) {
-            awgClientConfig = &awgProtocolConfig->clientConfig.value();
-        }
-    }
-    
-    amnezia::ScriptVars vars = amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns);
-    vars.append(amnezia::genProtocolVarsForContainer(container, containerConfig));
    QString scriptData = amnezia::scriptData(m_configTemplate, container);
-    QString config = m_sshSession->replaceVars(scriptData, vars);
+    QString config = m_serverController->replaceVars(
+            scriptData, m_serverController->genVarsForScript(credentials, container, containerConfig));

-    ConnectionData connData = prepareWireguardConfig(credentials, container, wireguardServerConfig, awgServerConfig, dnsSettings, errorCode);
+    ConnectionData connData = prepareWireguardConfig(credentials, container, containerConfig, errorCode);
    if (errorCode != ErrorCode::NoError) {
-        return WireGuardProtocolConfig{};
+        return "";
    }

    config.replace("$WIREGUARD_CLIENT_PRIVATE_KEY", connData.clientPrivKey);
@@ -243,46 +202,40 @@ ProtocolConfig WireguardConfigurator::createConfig(const ServerCredentials &cred
    config.replace("$WIREGUARD_SERVER_PUBLIC_KEY", connData.serverPubKey);
    config.replace("$WIREGUARD_PSK", connData.pskKey);

-    QString mtu = protocols::wireguard::defaultMtu;
-    if (wireguardClientConfig && !wireguardClientConfig->mtu.isEmpty()) {
-        mtu = wireguardClientConfig->mtu;
-    } else if (awgClientConfig && !awgClientConfig->mtu.isEmpty()) {
-        mtu = awgClientConfig->mtu;
-    }
-    
-    WireGuardProtocolConfig protocolConfig;
-    if (wireguardServerConfig) {
-        protocolConfig.serverConfig = *wireguardServerConfig;
-    }
-    
-    WireGuardClientConfig clientConfig;
-    clientConfig.nativeConfig = config;
-    clientConfig.hostName = connData.host;
-    clientConfig.port = connData.port.toInt();
-    clientConfig.clientIp = connData.clientIP;
-    clientConfig.clientPrivateKey = connData.clientPrivKey;
-    clientConfig.clientPublicKey = connData.clientPubKey;
-    clientConfig.serverPublicKey = connData.serverPubKey;
-    clientConfig.presharedKey = connData.pskKey;
-    clientConfig.clientId = connData.clientPubKey;
-    clientConfig.allowedIps = QStringList { "0.0.0.0/0", "::/0" };
-    clientConfig.persistentKeepAlive = "25";
-    clientConfig.mtu = mtu;
-    clientConfig.isObfuscationEnabled = false;
-    
-    protocolConfig.setClientConfig(clientConfig);
-    
-    return protocolConfig;
+    const QJsonObject &wireguarConfig = containerConfig.value(ProtocolProps::protoToString(Proto::WireGuard)).toObject();
+    QJsonObject jConfig;
+    jConfig[config_key::config] = config;
+
+    jConfig[config_key::hostName] = connData.host;
+    jConfig[config_key::port] = connData.port.toInt();
+    jConfig[config_key::client_priv_key] = connData.clientPrivKey;
+    jConfig[config_key::client_ip] = connData.clientIP;
+    jConfig[config_key::client_pub_key] = connData.clientPubKey;
+    jConfig[config_key::psk_key] = connData.pskKey;
+    jConfig[config_key::server_pub_key] = connData.serverPubKey;
+    jConfig[config_key::mtu] = wireguarConfig.value(config_key::mtu).toString(protocols::wireguard::defaultMtu);
+
+    jConfig[config_key::persistent_keep_alive] = "25";
+    QJsonArray allowedIps { "0.0.0.0/0", "::/0" };
+    jConfig[config_key::allowed_ips] = allowedIps;
+
+    jConfig[config_key::clientId] = connData.clientPubKey;
+
+    return QJsonDocument(jConfig).toJson();
 }

-ProtocolConfig WireguardConfigurator::processConfigWithLocalSettings(const ConnectionSettings &settings,
-                                                                     ProtocolConfig protocolConfig)
+QString WireguardConfigurator::processConfigWithLocalSettings(const QPair<QString, QString> &dns,
+                                                              const bool isApiConfig, QString &protocolConfigString)
 {
-    return ConfiguratorBase::processConfigWithLocalSettings(settings, protocolConfig);
+    processConfigWithDnsSettings(dns, protocolConfigString);
+
+    return protocolConfigString;
 }

-ProtocolConfig WireguardConfigurator::processConfigWithExportSettings(const ExportSettings &settings,
-                                                                      ProtocolConfig protocolConfig)
+QString WireguardConfigurator::processConfigWithExportSettings(const QPair<QString, QString> &dns,
+                                                               const bool isApiConfig, QString &protocolConfigString)
 {
-    return ConfiguratorBase::processConfigWithExportSettings(settings, protocolConfig);
+    processConfigWithDnsSettings(dns, protocolConfigString);
+
+    return protocolConfigString;
 }
--- a/client/configurators/wireguard_configurator.h
+++ b/client/configurators/wireguard_configurator.h
@@ -0,0 +1,54 @@
+#ifndef WIREGUARD_CONFIGURATOR_H
+#define WIREGUARD_CONFIGURATOR_H
+
+#include <QHostAddress>
+#include <QObject>
+#include <QProcessEnvironment>
+
+#include "configurator_base.h"
+#include "core/defs.h"
+#include "core/scripts_registry.h"
+
+class WireguardConfigurator : public ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    WireguardConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController,
+                          bool isAwg, QObject *parent = nullptr);
+
+    struct ConnectionData
+    {
+        QString clientPrivKey; // client private key
+        QString clientPubKey;  // client public key
+        QString clientIP;      // internal client IP address
+        QString serverPubKey;  // tls-auth key
+        QString pskKey;        // preshared key
+        QString host;          // host ip
+        QString port;
+    };
+
+    QString createConfig(const ServerCredentials &credentials, DockerContainer container,
+                         const QJsonObject &containerConfig, ErrorCode &errorCode);
+
+    QString processConfigWithLocalSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                           QString &protocolConfigString);
+    QString processConfigWithExportSettings(const QPair<QString, QString> &dns, const bool isApiConfig,
+                                            QString &protocolConfigString);
+
+    static ConnectionData genClientKeys();
+
+private:
+    QList<QHostAddress> getIpsFromConf(const QString &input);
+    ConnectionData prepareWireguardConfig(const ServerCredentials &credentials, DockerContainer container,
+                                          const QJsonObject &containerConfig, ErrorCode &errorCode);
+
+    bool m_isAwg;
+    QString m_serverConfigPath;
+    QString m_serverPublicKeyPath;
+    QString m_serverPskKeyPath;
+    amnezia::ProtocolScriptType m_configTemplate;
+    QString m_protocolName;
+    QString m_defaultPort;
+};
+
+#endif // WIREGUARD_CONFIGURATOR_H
--- a/client/configurators/xray_configurator.cpp
+++ b/client/configurators/xray_configurator.cpp
@@ -0,0 +1,173 @@
+#include "xray_configurator.h"
+
+#include <QFile>
+#include <QJsonDocument>
+#include <QJsonObject>
+#include <QUuid>
+#include "logger.h"
+
+#include "containers/containers_defs.h"
+#include "core/controllers/serverController.h"
+#include "core/scripts_registry.h"
+
+namespace {
+Logger logger("XrayConfigurator");
+}
+
+XrayConfigurator::XrayConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent)
+    : ConfiguratorBase(settings, serverController, parent)
+{
+}
+
+QString XrayConfigurator::prepareServerConfig(const ServerCredentials &credentials, DockerContainer container,
+                                               const QJsonObject &containerConfig, ErrorCode &errorCode)
+{
+    // Generate new UUID for client
+    QString clientId = QUuid::createUuid().toString(QUuid::WithoutBraces);
+    
+    // Get current server config
+    QString currentConfig = m_serverController->getTextFileFromContainer(
+        container, credentials, amnezia::protocols::xray::serverConfigPath, errorCode);
+    
+    if (errorCode != ErrorCode::NoError) {
+        logger.error() << "Failed to get server config file";
+        return "";
+    }
+
+    // Parse current config as JSON
+    QJsonDocument doc = QJsonDocument::fromJson(currentConfig.toUtf8());
+    if (doc.isNull() || !doc.isObject()) {
+        logger.error() << "Failed to parse server config JSON";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+
+    QJsonObject serverConfig = doc.object();
+    
+    // Validate server config structure
+    if (!serverConfig.contains("inbounds")) {
+        logger.error() << "Server config missing 'inbounds' field";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+
+    QJsonArray inbounds = serverConfig["inbounds"].toArray();
+    if (inbounds.isEmpty()) {
+        logger.error() << "Server config has empty 'inbounds' array";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+    
+    QJsonObject inbound = inbounds[0].toObject();
+    if (!inbound.contains("settings")) {
+        logger.error() << "Inbound missing 'settings' field";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+
+    QJsonObject settings = inbound["settings"].toObject();
+    if (!settings.contains("clients")) {
+        logger.error() << "Settings missing 'clients' field";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+
+    QJsonArray clients = settings["clients"].toArray();
+    
+    // Create configuration for new client
+    QJsonObject clientConfig {
+        {"id", clientId},
+        {"flow", "xtls-rprx-vision"}
+    };
+    
+    clients.append(clientConfig);
+    
+    // Update config
+    settings["clients"] = clients;
+    inbound["settings"] = settings;
+    inbounds[0] = inbound;
+    serverConfig["inbounds"] = inbounds;
+    
+    // Save updated config to server
+    QString updatedConfig = QJsonDocument(serverConfig).toJson();
+    errorCode = m_serverController->uploadTextFileToContainer(
+        container, 
+        credentials, 
+        updatedConfig,
+        amnezia::protocols::xray::serverConfigPath,
+        libssh::ScpOverwriteMode::ScpOverwriteExisting
+    );
+    if (errorCode != ErrorCode::NoError) {
+        logger.error() << "Failed to upload updated config";
+        return "";
+    }
+
+    // Restart container
+    QString restartScript = QString("sudo docker restart $CONTAINER_NAME");
+    errorCode = m_serverController->runScript(
+        credentials, 
+        m_serverController->replaceVars(restartScript, m_serverController->genVarsForScript(credentials, container))
+    );
+
+    if (errorCode != ErrorCode::NoError) {
+        logger.error() << "Failed to restart container";
+        return "";
+    }
+
+    return clientId;
+}
+
+QString XrayConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
+                                       const QJsonObject &containerConfig, ErrorCode &errorCode)
+{
+    // Get client ID from prepareServerConfig
+    QString xrayClientId = prepareServerConfig(credentials, container, containerConfig, errorCode);
+    if (errorCode != ErrorCode::NoError || xrayClientId.isEmpty()) {
+        logger.error() << "Failed to prepare server config";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+
+    QString config = m_serverController->replaceVars(amnezia::scriptData(ProtocolScriptType::xray_template, container),
+                                                     m_serverController->genVarsForScript(credentials, container, containerConfig));
+    
+    if (config.isEmpty()) {
+        logger.error() << "Failed to get config template";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+
+    QString xrayPublicKey =
+            m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::xray::PublicKeyPath, errorCode);
+    if (errorCode != ErrorCode::NoError || xrayPublicKey.isEmpty()) {
+        logger.error() << "Failed to get public key";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+    xrayPublicKey.replace("\n", "");
+    
+    QString xrayShortId =
+            m_serverController->getTextFileFromContainer(container, credentials, amnezia::protocols::xray::shortidPath, errorCode);
+    if (errorCode != ErrorCode::NoError || xrayShortId.isEmpty()) {
+        logger.error() << "Failed to get short ID";
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+    xrayShortId.replace("\n", "");
+
+    // Validate all required variables are present
+    if (!config.contains("$XRAY_CLIENT_ID") || !config.contains("$XRAY_PUBLIC_KEY") || !config.contains("$XRAY_SHORT_ID")) {
+        logger.error() << "Config template missing required variables:"
+                      << "XRAY_CLIENT_ID:" << !config.contains("$XRAY_CLIENT_ID")
+                      << "XRAY_PUBLIC_KEY:" << !config.contains("$XRAY_PUBLIC_KEY")
+                      << "XRAY_SHORT_ID:" << !config.contains("$XRAY_SHORT_ID");
+        errorCode = ErrorCode::InternalError;
+        return "";
+    }
+
+    config.replace("$XRAY_CLIENT_ID", xrayClientId);
+    config.replace("$XRAY_PUBLIC_KEY", xrayPublicKey);
+    config.replace("$XRAY_SHORT_ID", xrayShortId);
+
+    return config;
+}
--- a/client/configurators/xray_configurator.h
+++ b/client/configurators/xray_configurator.h
@@ -0,0 +1,23 @@
+#ifndef XRAY_CONFIGURATOR_H
+#define XRAY_CONFIGURATOR_H
+
+#include <QObject>
+
+#include "configurator_base.h"
+#include "core/defs.h"
+
+class XrayConfigurator : public ConfiguratorBase
+{
+    Q_OBJECT
+public:
+    XrayConfigurator(std::shared_ptr<Settings> settings, const QSharedPointer<ServerController> &serverController, QObject *parent = nullptr);
+
+    QString createConfig(const ServerCredentials &credentials, DockerContainer container, const QJsonObject &containerConfig,
+                         ErrorCode &errorCode);
+
+private:
+    QString prepareServerConfig(const ServerCredentials &credentials, DockerContainer container, const QJsonObject &containerConfig,
+                                ErrorCode &errorCode);
+};
+
+#endif // XRAY_CONFIGURATOR_H
--- a/client/core/utils/constants.h
+++ b/client/core/utils/constants.h
--- a/client/core/utils/containers/containerUtils.cpp
+++ b/client/core/utils/containers/containerUtils.cpp
@@ -1,12 +1,17 @@
-#include "containerUtils.h"
+#include "containers_defs.h"

-#include <QMetaEnum>
-#include <QObject>
-#include <QJsonDocument>
+#include "QJsonObject"
+#include "QJsonDocument"

-using namespace amnezia;
+QDebug operator<<(QDebug debug, const amnezia::DockerContainer &c)
+{
+    QDebugStateSaver saver(debug);
+    debug.nospace() << ContainerProps::containerToString(c);

-DockerContainer ContainerUtils::containerFromString(const QString &container)
+    return debug;
+}
+
+amnezia::DockerContainer ContainerProps::containerFromString(const QString &container)
 {
    QMetaEnum metaEnum = QMetaEnum::fromType<DockerContainer>();
    for (int i = 0; i < metaEnum.keyCount(); ++i) {
@@ -17,10 +22,12 @@ DockerContainer ContainerUtils::containerFromString(const QString &container)
    return DockerContainer::None;
 }

-QString ContainerUtils::containerToString(DockerContainer c)
+QString ContainerProps::containerToString(amnezia::DockerContainer c)
 {
    if (c == DockerContainer::None)
        return "none";
+    if (c == DockerContainer::Cloak)
+        return "amnezia-openvpn-cloak";
    if (c == DockerContainer::Awg)
        return "amnezia-awg";
    if (c == DockerContainer::Awg2)
@@ -31,7 +38,7 @@ QString ContainerUtils::containerToString(DockerContainer c)
    return "amnezia-" + containerKey.toLower();
 }

-QString ContainerUtils::containerTypeToString(DockerContainer c)
+QString ContainerProps::containerTypeToString(amnezia::DockerContainer c)
 {
    if (c == DockerContainer::None)
        return "none";
@@ -47,7 +54,36 @@ QString ContainerUtils::containerTypeToString(DockerContainer c)
    return containerKey.toLower();
 }

-QList<DockerContainer> ContainerUtils::allContainers()
+QVector<amnezia::Proto> ContainerProps::protocolsForContainer(amnezia::DockerContainer container)
+{
+    switch (container) {
+    case DockerContainer::None: return {};
+
+    case DockerContainer::OpenVpn: return { Proto::OpenVpn };
+
+    case DockerContainer::ShadowSocks: return { Proto::OpenVpn, Proto::ShadowSocks };
+
+    case DockerContainer::Cloak: return { Proto::OpenVpn, Proto::ShadowSocks, Proto::Cloak };
+
+    case DockerContainer::Ipsec: return { Proto::Ikev2 /*, Protocol::L2tp */ };
+
+    case DockerContainer::Xray: return { Proto::Xray };
+
+    case DockerContainer::SSXray: return { Proto::SSXray };
+
+    case DockerContainer::Dns: return { Proto::Dns };
+
+    case DockerContainer::Sftp: return { Proto::Sftp };
+
+    case DockerContainer::Socks5Proxy: return { Proto::Socks5Proxy };
+
+    case DockerContainer::Awg: return { Proto::Awg };
+    case DockerContainer::Awg2: return { Proto::Awg };
+    default: return { defaultProtocol(container) };
+    }
+}
+
+QList<DockerContainer> ContainerProps::allContainers()
 {
    QMetaEnum metaEnum = QMetaEnum::fromType<DockerContainer>();
    QList<DockerContainer> all;
@@ -58,10 +94,12 @@ QList<DockerContainer> ContainerUtils::allContainers()
    return all;
 }

-QMap<DockerContainer, QString> ContainerUtils::containerHumanNames()
+QMap<DockerContainer, QString> ContainerProps::containerHumanNames()
 {
    return { { DockerContainer::None, "Not installed" },
             { DockerContainer::OpenVpn, "OpenVPN" },
+             { DockerContainer::ShadowSocks, "OpenVPN over SS" },
+             { DockerContainer::Cloak, "OpenVPN over Cloak" },
             { DockerContainer::WireGuard, "WireGuard" },
             { DockerContainer::Awg, "AmneziaWG" },
             { DockerContainer::Awg2, "AmneziaWG" },
@@ -72,17 +110,19 @@ QMap<DockerContainer, QString> ContainerUtils::containerHumanNames()
             { DockerContainer::TorWebSite, QObject::tr("Website in Tor network") },
             { DockerContainer::Dns, QObject::tr("AmneziaDNS") },
             { DockerContainer::Sftp, QObject::tr("SFTP file sharing service") },
-             { DockerContainer::Socks5Proxy, QObject::tr("SOCKS5 proxy server") },
-             { DockerContainer::MtProxy, QObject::tr("MTProxy (Telegram)") },
-             { DockerContainer::Telemt, QObject::tr("Telemt (Telegram)") },
-    };
+             { DockerContainer::Socks5Proxy, QObject::tr("SOCKS5 proxy server") } };
 }

-QMap<DockerContainer, QString> ContainerUtils::containerDescriptions()
+QMap<DockerContainer, QString> ContainerProps::containerDescriptions()
 {
-    return {              { DockerContainer::OpenVpn,
+    return { { DockerContainer::OpenVpn,
               QObject::tr("OpenVPN is the most popular VPN protocol, with flexible configuration options. It uses its "
                           "own security protocol with SSL/TLS for key exchange.") },
+             { DockerContainer::ShadowSocks,
+               QObject::tr("Shadowsocks masks VPN traffic, making it resemble normal web traffic, but it may still be detected by certain analysis systems.") },
+             { DockerContainer::Cloak,
+               QObject::tr("OpenVPN over Cloak - OpenVPN with VPN masquerading as web traffic and protection against "
+                           "active-probing detection. It is very resistant to detection, but offers low speed.") },
             { DockerContainer::WireGuard,
               QObject::tr("WireGuard - popular VPN protocol with high performance, high speed and low power "
                           "consumption.") },
@@ -105,15 +145,10 @@ QMap<DockerContainer, QString> ContainerUtils::containerDescriptions()
             { DockerContainer::Sftp,
               QObject::tr("Create a file vault on your server to securely store and transfer files.") },
             { DockerContainer::Socks5Proxy,
-               QObject::tr("") },
-             { DockerContainer::MtProxy,
-               QObject::tr("Telegram MTProto proxy server") },
-             { DockerContainer::Telemt,
-               QObject::tr("Telegram MTProto proxy (Telemt, Rust)") },
-    };
+               QObject::tr("") } };
 }

-QMap<DockerContainer, QString> ContainerUtils::containerDetailedDescriptions()
+QMap<DockerContainer, QString> ContainerProps::containerDetailedDescriptions()
 {
    return {
        { DockerContainer::OpenVpn,
@@ -127,6 +162,28 @@ QMap<DockerContainer, QString> ContainerUtils::containerDetailedDescriptions()
                      "* Normal battery consumption on mobile devices\n"
                      "* Flexible customization for various devices and OS\n"
                      "* Operates over both TCP and UDP protocols") },
+        { DockerContainer::ShadowSocks,
+          QObject::tr("Shadowsocks is based on the SOCKS5 protocol and encrypts connections using AEAD cipher. "
+                      "Although designed to be discreet, it doesn't mimic a standard HTTPS connection and can be detected by some DPI systems. "
+                      "Due to limited support in Amnezia, we recommend using the AmneziaWG protocol.\n"
+                      "\nFeatures:\n"
+                      "* Available in AmneziaVPN only on desktop platforms\n"
+                      "* Customizable encryption protocol\n"
+                      "* Detectable by some DPI systems\n"
+                      "* Operates over TCP protocol\n") },
+        { DockerContainer::Cloak,
+          QObject::tr("This combination includes the OpenVPN protocol and the Cloak plugin, specifically designed to protect against blocking.\n"
+                      "\nOpenVPN securely encrypts all internet traffic between your device and the server.\n"
+                      "\nThe Cloak plugin further protects the connection from DPI detection. "
+                      "It modifies traffic metadata to disguise VPN traffic as regular web traffic and prevents detection through active probing. "
+                      "If an incoming connection fails authentication, Cloak serves a fake website, making your VPN invisible to traffic analysis systems.\n"
+                      "\nIn regions with heavy internet censorship, we strongly recommend using OpenVPN with Cloak from your first connection.\n"
+                      "\nFeatures:\n"
+                      "* Available on all AmneziaVPN platforms\n"
+                      "* High power consumption on mobile devices\n"
+                      "* Flexible configuration options\n"
+                      "* Undetectable by DPI systems\n"
+                      "* Operates over TCP protocol on port 443") },
        { DockerContainer::WireGuard,
          QObject::tr("WireGuard is a modern, streamlined VPN protocol offering stable connectivity and excellent performance across all devices. "
                      "It uses fixed encryption settings, delivering lower latency and higher data transfer speeds compared to OpenVPN. "
@@ -180,28 +237,22 @@ QMap<DockerContainer, QString> ContainerUtils::containerDetailedDescriptions()
                      "You will be able to access it using\n FileZilla or other SFTP clients, "
                      "as well as mount the disk on your device to access\n it directly from your device.\n\n"
                      "For more detailed information, you can\n find it in the support section under \"Create SFTP file storage.\" ") },
-        { DockerContainer::Socks5Proxy, QObject::tr("SOCKS5 proxy server") },
-        { DockerContainer::MtProxy,
-          QObject::tr("Telegram MTProto proxy server. "
-                      "Allows Telegram clients to connect through your server "
-                      "using the MTProto protocol. Supports FakeTLS mode for "
-                      "bypassing DPI-based blocking.") },
-        { DockerContainer::Telemt,
-          QObject::tr("Telegram MTProto proxy powered by Telemt (Rust). "
-                      "Supports secure and TLS fronting modes with optional traffic masking.") },
+        { DockerContainer::Socks5Proxy, QObject::tr("SOCKS5 proxy server") }
    };
 }

-ServiceType ContainerUtils::containerService(DockerContainer c)
+amnezia::ServiceType ContainerProps::containerService(DockerContainer c)
 {
-    return ProtocolUtils::protocolService(defaultProtocol(c));
+    return ProtocolProps::protocolService(defaultProtocol(c));
 }

-Proto ContainerUtils::defaultProtocol(DockerContainer c)
+Proto ContainerProps::defaultProtocol(DockerContainer c)
 {
    switch (c) {
-    case DockerContainer::None: return Proto::Unknown;
+    case DockerContainer::None: return Proto::Any;
    case DockerContainer::OpenVpn: return Proto::OpenVpn;
+    case DockerContainer::Cloak: return Proto::Cloak;
+    case DockerContainer::ShadowSocks: return Proto::ShadowSocks;
    case DockerContainer::WireGuard: return Proto::WireGuard;
    case DockerContainer::Awg2: return Proto::Awg;
    case DockerContainer::Awg: return Proto::Awg;
@@ -213,22 +264,20 @@ Proto ContainerUtils::defaultProtocol(DockerContainer c)
    case DockerContainer::Dns: return Proto::Dns;
    case DockerContainer::Sftp: return Proto::Sftp;
    case DockerContainer::Socks5Proxy: return Proto::Socks5Proxy;
-    case DockerContainer::MtProxy: return Proto::MtProxy;
-    case DockerContainer::Telemt: return Proto::Telemt;
-    default: return Proto::Unknown;
+    default: return Proto::Any;
    }
 }

-QString ContainerUtils::containerTypeToProtocolString(DockerContainer c)
+QString ContainerProps::containerTypeToProtocolString(DockerContainer c)
 {
    if (c == DockerContainer::None)
        return "none";

    Proto p = defaultProtocol(c);
-    return ProtocolUtils::protoToString(p);
+    return ProtocolProps::protoToString(p);
 }

-bool ContainerUtils::isSupportedByCurrentPlatform(DockerContainer c)
+bool ContainerProps::isSupportedByCurrentPlatform(DockerContainer c)
 {
 #ifdef Q_OS_WINDOWS
    return true;
@@ -241,24 +290,25 @@ bool ContainerUtils::isSupportedByCurrentPlatform(DockerContainer c)
    case DockerContainer::Awg2: return true;
    case DockerContainer::Awg: return true;
    case DockerContainer::Xray: return true;
+    case DockerContainer::Cloak: return true;
    case DockerContainer::SSXray: return true;
-    case DockerContainer::MtProxy: return true;
-    case DockerContainer::Telemt: return true;
+        //    case DockerContainer::ShadowSocks: return true;
    default:
        return false;
    }

 #elif defined(MACOS_NE)
-    // macOS build using Network Extension – allow OpenVPN for parity with iOS.
+    // macOS build using Network Extension – hide OpenVPN-based containers
    switch (c) {
-    case DockerContainer::OpenVpn: return true;
    case DockerContainer::WireGuard: return true;
    case DockerContainer::Awg2: return true;
    case DockerContainer::Awg: return true;
    case DockerContainer::Xray: return true;
    case DockerContainer::SSXray: return true;
-    case DockerContainer::MtProxy: return true;
-    case DockerContainer::Telemt: return true;
+    case DockerContainer::OpenVpn:
+    case DockerContainer::Cloak:
+    case DockerContainer::ShadowSocks:
+        return false;
    default:
        return false;
    }
@@ -273,12 +323,12 @@ bool ContainerUtils::isSupportedByCurrentPlatform(DockerContainer c)
    switch (c) {
    case DockerContainer::WireGuard: return true;
    case DockerContainer::OpenVpn: return true;
+    case DockerContainer::ShadowSocks: return false;
    case DockerContainer::Awg2: return true;
    case DockerContainer::Awg: return true;
+    case DockerContainer::Cloak: return true;
    case DockerContainer::Xray: return true;
    case DockerContainer::SSXray: return true;
-    case DockerContainer::MtProxy: return true;
-    case DockerContainer::Telemt: return true;
    default: return false;
    }

@@ -293,7 +343,7 @@ bool ContainerUtils::isSupportedByCurrentPlatform(DockerContainer c)
 #endif
 }

-QStringList ContainerUtils::fixedPortsForContainer(DockerContainer c)
+QStringList ContainerProps::fixedPortsForContainer(DockerContainer c)
 {
    switch (c) {
    case DockerContainer::Ipsec: return QStringList { "500", "4500" };
@@ -301,7 +351,7 @@ QStringList ContainerUtils::fixedPortsForContainer(DockerContainer c)
    }
 }

-bool ContainerUtils::isEasySetupContainer(DockerContainer container)
+bool ContainerProps::isEasySetupContainer(DockerContainer container)
 {
    switch (container) {
    case DockerContainer::Awg2: return true;
@@ -309,24 +359,24 @@ bool ContainerUtils::isEasySetupContainer(DockerContainer container)
    }
 }

-QString ContainerUtils::easySetupHeader(DockerContainer container)
+QString ContainerProps::easySetupHeader(DockerContainer container)
 {
    switch (container) {
-    case DockerContainer::Awg2: return QObject::tr("Automatic");
+    case DockerContainer::Awg2: return tr("Automatic");
    default: return "";
    }
 }

-QString ContainerUtils::easySetupDescription(DockerContainer container)
+QString ContainerProps::easySetupDescription(DockerContainer container)
 {
    switch (container) {
-    case DockerContainer::Awg2: return QObject::tr("AmneziaWG protocol will be installed. "
+    case DockerContainer::Awg2: return tr("AmneziaWG protocol will be installed. "
                                         "It provides high connection speed and ensures stable operation even in the most challenging network conditions.");
    default: return "";
    }
 }

-int ContainerUtils::easySetupOrder(DockerContainer container)
+int ContainerProps::easySetupOrder(DockerContainer container)
 {
    switch (container) {
    case DockerContainer::Awg2: return 1;
@@ -334,47 +384,44 @@ int ContainerUtils::easySetupOrder(DockerContainer container)
    }
 }

-bool ContainerUtils::isShareable(DockerContainer container)
+bool ContainerProps::isShareable(DockerContainer container)
 {
    switch (container) {
    case DockerContainer::TorWebSite: return false;
    case DockerContainer::Dns: return false;
    case DockerContainer::Sftp: return false;
    case DockerContainer::Socks5Proxy: return false;
-    case DockerContainer::MtProxy: return false;
-    case DockerContainer::Telemt: return false;
    default: return true;
    }
 }

-bool ContainerUtils::isAwgContainer(DockerContainer container)
+bool ContainerProps::isAwgContainer(DockerContainer container)
 {
    return container == DockerContainer::Awg || container == DockerContainer::Awg2;
 }

-QJsonObject ContainerUtils::getProtocolConfigFromContainer(const Proto protocol, const QJsonObject &containerConfig)
+
+QJsonObject ContainerProps::getProtocolConfigFromContainer(const Proto protocol, const QJsonObject &containerConfig)
 {
-    QString protocolConfigString = containerConfig.value(ProtocolUtils::protoToString(protocol))
+    QString protocolConfigString = containerConfig.value(ProtocolProps::protoToString(protocol))
    .toObject()
-            .value(configKey::lastConfig)
+            .value(config_key::last_config)
            .toString();

    return QJsonDocument::fromJson(protocolConfigString.toUtf8()).object();
 }

-int ContainerUtils::installPageOrder(DockerContainer container)
+int ContainerProps::installPageOrder(DockerContainer container)
 {
    switch (container) {
    case DockerContainer::OpenVpn: return 4;
+    case DockerContainer::Cloak: return 5;
+    case DockerContainer::ShadowSocks: return 6;
    case DockerContainer::WireGuard: return 2;
    case DockerContainer::Awg2: return 1;
    case DockerContainer::Xray: return 3;
    case DockerContainer::Ipsec: return 7;
    case DockerContainer::SSXray: return 8;
-    case DockerContainer::MtProxy:
-    case DockerContainer::Telemt:
-        return 20;
    default: return 0;
    }
 }
-
--- a/client/containers/containers_defs.h
+++ b/client/containers/containers_defs.h
@@ -0,0 +1,94 @@
+#ifndef CONTAINERS_DEFS_H
+#define CONTAINERS_DEFS_H
+
+#include <QObject>
+#include <QQmlEngine>
+
+#include "../protocols/protocols_defs.h"
+
+using namespace amnezia;
+
+namespace amnezia
+{
+
+    namespace ContainerEnumNS
+    {
+        Q_NAMESPACE
+        enum DockerContainer {
+            None = 0,
+            Awg,
+            Awg2,
+            WireGuard,
+            OpenVpn,
+            Cloak,
+            ShadowSocks,
+            Ipsec,
+            Xray,
+            SSXray,
+
+            // non-vpn
+            TorWebSite,
+            Dns,
+            Sftp,
+            Socks5Proxy
+        };
+        Q_ENUM_NS(DockerContainer)
+    } // namespace ContainerEnumNS
+
+    using namespace ContainerEnumNS;
+    using namespace ProtocolEnumNS;
+
+    class ContainerProps : public QObject
+    {
+        Q_OBJECT
+
+    public:
+        Q_INVOKABLE static amnezia::DockerContainer containerFromString(const QString &container);
+        Q_INVOKABLE static QString containerToString(amnezia::DockerContainer container);
+        Q_INVOKABLE static QString containerTypeToString(amnezia::DockerContainer c);
+        Q_INVOKABLE static QString containerTypeToProtocolString(amnezia::DockerContainer c);
+
+        Q_INVOKABLE static QList<amnezia::DockerContainer> allContainers();
+
+        Q_INVOKABLE static QMap<amnezia::DockerContainer, QString> containerHumanNames();
+        Q_INVOKABLE static QMap<amnezia::DockerContainer, QString> containerDescriptions();
+        Q_INVOKABLE static QMap<amnezia::DockerContainer, QString> containerDetailedDescriptions();
+
+        // these protocols will be displayed in container settings
+        Q_INVOKABLE static QVector<amnezia::Proto> protocolsForContainer(amnezia::DockerContainer container);
+
+        Q_INVOKABLE static amnezia::ServiceType containerService(amnezia::DockerContainer c);
+
+        // binding between Docker container and main protocol of given container
+        // it may be changed fot future containers :)
+        Q_INVOKABLE static amnezia::Proto defaultProtocol(amnezia::DockerContainer c);
+
+        Q_INVOKABLE static bool isSupportedByCurrentPlatform(amnezia::DockerContainer c);
+        Q_INVOKABLE static QStringList fixedPortsForContainer(amnezia::DockerContainer c);
+
+        static bool isEasySetupContainer(amnezia::DockerContainer container);
+        static QString easySetupHeader(amnezia::DockerContainer container);
+        static QString easySetupDescription(amnezia::DockerContainer container);
+        static int easySetupOrder(amnezia::DockerContainer container);
+
+        static bool isShareable(amnezia::DockerContainer container);
+
+        static bool isAwgContainer(amnezia::DockerContainer container);
+
+
+        static QJsonObject getProtocolConfigFromContainer(const amnezia::Proto protocol, const QJsonObject &containerConfig);
+
+        static int installPageOrder(amnezia::DockerContainer container);
+    };
+
+    static void declareQmlContainerEnum()
+    {
+        qmlRegisterUncreatableMetaObject(ContainerEnumNS::staticMetaObject, "ContainerEnum", 1, 0, "ContainerEnum",
+                                         "Error: only enums");
+    }
+
+} // namespace amnezia
+
+QDebug operator<<(QDebug debug, const amnezia::DockerContainer &c);
+
+#endif // CONTAINERS_DEFS_H
--- a/client/core/utils/constants/apiKeys.h
+++ b/client/core/utils/constants/apiKeys.h
@@ -1,58 +1,60 @@
-#ifndef APIKEYS_H
-#define APIKEYS_H
+#ifndef APIDEFS_H
+#define APIDEFS_H

-#include <QLatin1String>
+#include <QString>

 namespace apiDefs
 {
+    enum ConfigType {
+        AmneziaFreeV2 = 0,
+        AmneziaFreeV3,
+        AmneziaPremiumV1,
+        AmneziaPremiumV2,
+        SelfHosted,
+        ExternalPremium
+    };
+
+    enum ConfigSource {
+        Telegram = 1,
+        AmneziaGateway
+    };
+
    namespace key
    {
+        constexpr QLatin1String configVersion("config_version");
        constexpr QLatin1String apiEndpoint("api_endpoint");
        constexpr QLatin1String apiKey("api_key");
+        constexpr QLatin1String description("description");
+        constexpr QLatin1String name("name");
        constexpr QLatin1String protocol("protocol");
+
        constexpr QLatin1String apiConfig("api_config");
-        constexpr QLatin1String serviceType("service_type");
-        constexpr QLatin1String serviceInfo("service_info");
-        constexpr QLatin1String serviceProtocol("service_protocol");
-        constexpr QLatin1String vpnKey("vpn_key");
        constexpr QLatin1String stackType("stack_type");
+        constexpr QLatin1String serviceType("service_type");
        constexpr QLatin1String cliVersion("cli_version");
-        constexpr QLatin1String cliName("cli_name");
        constexpr QLatin1String supportedProtocols("supported_protocols");
-        constexpr QLatin1String availableCountries("available_countries");
+
+        constexpr QLatin1String vpnKey("vpn_key");
+        constexpr QLatin1String config("config");
+        constexpr QLatin1String configs("configs");
+
        constexpr QLatin1String installationUuid("installation_uuid");
-        constexpr QLatin1String uuid("installation_uuid");
-        constexpr QLatin1String qrUuid("qr_uuid");
-        constexpr QLatin1String osVersion("os_version");
-        constexpr QLatin1String userCountryCode("user_country_code");
-        constexpr QLatin1String serverCountryCode("server_country_code");
-        constexpr QLatin1String serverCountryName("server_country_name");
-        constexpr QLatin1String appVersion("app_version");
-        constexpr QLatin1String authData("auth_data");
-
-        constexpr QLatin1String aesKey("aes_key");
-        constexpr QLatin1String aesIv("aes_iv");
-        constexpr QLatin1String aesSalt("aes_salt");
-        constexpr QLatin1String apiPayload("api_payload");
-        constexpr QLatin1String keyPayload("key_payload");
-
-        constexpr QLatin1String services("services");
        constexpr QLatin1String workerLastUpdated("worker_last_updated");
        constexpr QLatin1String lastDownloaded("last_downloaded");
        constexpr QLatin1String sourceType("source_type");
+
+        constexpr QLatin1String serverCountryCode("server_country_code");
+        constexpr QLatin1String serverCountryName("server_country_name");
+
+        constexpr QLatin1String osVersion("os_version");
        constexpr QLatin1String appLanguage("app_language");

+        constexpr QLatin1String availableCountries("available_countries");
        constexpr QLatin1String activeDeviceCount("active_device_count");
        constexpr QLatin1String maxDeviceCount("max_device_count");
        constexpr QLatin1String subscriptionEndDate("subscription_end_date");
-        constexpr QLatin1String subscriptionExpiredByServer("subscription_expired_by_server");
-        constexpr QLatin1String subscriptionStatus("subscription_status");
-        constexpr QLatin1String subscription("subscription");
-        constexpr QLatin1String endDate("end_date");
        constexpr QLatin1String issuedConfigs("issued_configs");
        constexpr QLatin1String subscriptionDescription("subscription_description");
-        constexpr QLatin1String termsOfUseUrl("terms_of_use_url");
-        constexpr QLatin1String privacyPolicyUrl("privacy_policy_url");

        constexpr QLatin1String supportInfo("support_info");
        constexpr QLatin1String email("email");
@@ -64,25 +66,20 @@ namespace apiDefs
        constexpr QLatin1String id("id");
        constexpr QLatin1String orderId("order_id");
        constexpr QLatin1String migrationCode("migration_code");
+
        constexpr QLatin1String transactionId("transaction_id");
        constexpr QLatin1String isTestPurchase("is_test_purchase");
-        constexpr QLatin1String isInAppPurchase("is_in_app_purchase");
-        constexpr QLatin1String config("config");

+        constexpr QLatin1String userCountryCode("user_country_code");
+
+        constexpr QLatin1String serviceInfo("service_info");
        constexpr QLatin1String isAdVisible("is_ad_visible");
-        constexpr QLatin1String isRenewalAvailable("is_renewal_available");
        constexpr QLatin1String adHeader("ad_header");
        constexpr QLatin1String adDescription("ad_description");
        constexpr QLatin1String adEndpoint("ad_endpoint");
+    }

-        constexpr QLatin1String configs("configs");
+    const int requestTimeoutMsecs = 12 * 1000; // 12 secs
+}

-        constexpr QLatin1String publicKeyInfo("public_key");
-        constexpr QLatin1String publicKey("public_key");
-        constexpr QLatin1String expiresAt("expires_at");
-        constexpr QLatin1String isConnectEvent("is_connect_event");
-        constexpr QLatin1String certificate("certificate");
-    } // namespace key
-} // namespace apiDefs
-
-#endif // APIKEYS_H
+#endif // APIDEFS_H
--- a/client/core/api/apiUtils.cpp
+++ b/client/core/api/apiUtils.cpp
@@ -0,0 +1,224 @@
+#include "apiUtils.h"
+
+#include <QDateTime>
+#include <QJsonDocument>
+#include <QJsonObject>
+
+namespace
+{
+    const QByteArray AMNEZIA_CONFIG_SIGNATURE = QByteArray::fromHex("000000ff");
+
+    QString escapeUnicode(const QString &input)
+    {
+        QString output;
+        for (QChar c : input) {
+            if (c.unicode() < 0x20 || c.unicode() > 0x7E) {
+                output += QString("\\u%1").arg(QString::number(c.unicode(), 16).rightJustified(4, '0'));
+            } else {
+                output += c;
+            }
+        }
+        return output;
+    }
+}
+
+bool apiUtils::isSubscriptionExpired(const QString &subscriptionEndDate)
+{
+    QDateTime now = QDateTime::currentDateTimeUtc();
+    QDateTime endDate = QDateTime::fromString(subscriptionEndDate, Qt::ISODateWithMs);
+    return endDate < now;
+}
+
+bool apiUtils::isServerFromApi(const QJsonObject &serverConfigObject)
+{
+    auto configVersion = serverConfigObject.value(apiDefs::key::configVersion).toInt();
+    switch (configVersion) {
+    case apiDefs::ConfigSource::Telegram: return true;
+    case apiDefs::ConfigSource::AmneziaGateway: return true;
+    default: return false;
+    }
+}
+
+apiDefs::ConfigType apiUtils::getConfigType(const QJsonObject &serverConfigObject)
+{
+    auto configVersion = serverConfigObject.value(apiDefs::key::configVersion).toInt();
+
+    switch (configVersion) {
+    case apiDefs::ConfigSource::Telegram: {
+        constexpr QLatin1String freeV2Endpoint(FREE_V2_ENDPOINT);
+        constexpr QLatin1String premiumV1Endpoint(PREM_V1_ENDPOINT);
+
+        auto apiEndpoint = serverConfigObject.value(apiDefs::key::apiEndpoint).toString();
+
+        if (apiEndpoint.contains(premiumV1Endpoint)) {
+            return apiDefs::ConfigType::AmneziaPremiumV1;
+        } else if (apiEndpoint.contains(freeV2Endpoint)) {
+            return apiDefs::ConfigType::AmneziaFreeV2;
+        }
+    };
+    case apiDefs::ConfigSource::AmneziaGateway: {
+        constexpr QLatin1String servicePremium("amnezia-premium");
+        constexpr QLatin1String serviceFree("amnezia-free");
+        constexpr QLatin1String serviceExternalPremium("external-premium");
+
+        auto apiConfigObject = serverConfigObject.value(apiDefs::key::apiConfig).toObject();
+        auto serviceType = apiConfigObject.value(apiDefs::key::serviceType).toString();
+
+        if (serviceType == servicePremium) {
+            return apiDefs::ConfigType::AmneziaPremiumV2;
+        } else if (serviceType == serviceFree) {
+            return apiDefs::ConfigType::AmneziaFreeV3;
+        } else if (serviceType == serviceExternalPremium) {
+            return apiDefs::ConfigType::ExternalPremium;
+        }
+    }
+    default: {
+        return apiDefs::ConfigType::SelfHosted;
+    }
+    };
+}
+
+apiDefs::ConfigSource apiUtils::getConfigSource(const QJsonObject &serverConfigObject)
+{
+    return static_cast<apiDefs::ConfigSource>(serverConfigObject.value(apiDefs::key::configVersion).toInt());
+}
+
+amnezia::ErrorCode apiUtils::checkNetworkReplyErrors(const QList<QSslError> &sslErrors, const QString &replyErrorString,
+                                                     const QNetworkReply::NetworkError &replyError, const int httpStatusCode,
+                                                     const QByteArray &responseBody)
+{
+    const int httpStatusCodeConflict = 409;
+    const int httpStatusCodeNotFound = 404;
+    const int httpStatusCodeNotImplemented = 501;
+
+    if (!sslErrors.empty()) {
+        qDebug().noquote() << sslErrors;
+        return amnezia::ErrorCode::ApiConfigSslError;
+    } else if (replyError == QNetworkReply::NoError) {
+        return amnezia::ErrorCode::NoError;
+    } else if (replyError == QNetworkReply::NetworkError::OperationCanceledError
+               || replyError == QNetworkReply::NetworkError::TimeoutError) {
+        qDebug() << replyError;
+        return amnezia::ErrorCode::ApiConfigTimeoutError;
+    } else if (replyError == QNetworkReply::NetworkError::OperationNotImplementedError) {
+        qDebug() << replyError;
+        return amnezia::ErrorCode::ApiUpdateRequestError;
+    } else {
+        qDebug() << QString::fromUtf8(responseBody);
+        qDebug() << replyError;
+        qDebug() << replyErrorString;
+        qDebug() << httpStatusCode;
+
+        int httpStatusFromBody = -1;
+        QJsonDocument jsonDoc = QJsonDocument::fromJson(responseBody);
+        if (jsonDoc.isObject()) {
+            QJsonObject jsonObj = jsonDoc.object();
+            httpStatusFromBody = jsonObj.value("http_status").toInt(-1);
+        }
+
+        if (httpStatusFromBody == httpStatusCodeConflict) {
+            return amnezia::ErrorCode::ApiConfigLimitError;
+        } else if (httpStatusFromBody == httpStatusCodeNotFound) {
+            return amnezia::ErrorCode::ApiNotFoundError;
+        } else if (httpStatusFromBody == httpStatusCodeNotImplemented) {
+            return amnezia::ErrorCode::ApiUpdateRequestError;
+        }
+        return amnezia::ErrorCode::ApiConfigDownloadError;
+    }
+
+    qDebug() << "something went wrong";
+    return amnezia::ErrorCode::InternalError;
+}
+
+bool apiUtils::isPremiumServer(const QJsonObject &serverConfigObject)
+{
+    static const QSet<apiDefs::ConfigType> premiumTypes = { apiDefs::ConfigType::AmneziaPremiumV1, apiDefs::ConfigType::AmneziaPremiumV2,
+                                                            apiDefs::ConfigType::ExternalPremium };
+    return premiumTypes.contains(getConfigType(serverConfigObject));
+}
+
+QString apiUtils::getPremiumV1VpnKey(const QJsonObject &serverConfigObject)
+{
+    if (apiUtils::getConfigType(serverConfigObject) != apiDefs::ConfigType::AmneziaPremiumV1) {
+        return {};
+    }
+
+    QList<QPair<QString, QVariant>> orderedFields;
+    orderedFields.append(qMakePair(apiDefs::key::name, serverConfigObject[apiDefs::key::name].toString()));
+    orderedFields.append(qMakePair(apiDefs::key::description, serverConfigObject[apiDefs::key::description].toString()));
+    orderedFields.append(qMakePair(apiDefs::key::configVersion, serverConfigObject[apiDefs::key::configVersion].toDouble()));
+    orderedFields.append(qMakePair(apiDefs::key::protocol, serverConfigObject[apiDefs::key::protocol].toString()));
+    orderedFields.append(qMakePair(apiDefs::key::apiEndpoint, serverConfigObject[apiDefs::key::apiEndpoint].toString()));
+    orderedFields.append(qMakePair(apiDefs::key::apiKey, serverConfigObject[apiDefs::key::apiKey].toString()));
+
+    QString vpnKeyStr = "{";
+    for (int i = 0; i < orderedFields.size(); ++i) {
+        const auto &pair = orderedFields[i];
+        if (pair.second.typeId() == QMetaType::Type::QString) {
+            vpnKeyStr += "\"" + pair.first + "\": \"" + pair.second.toString() + "\"";
+        } else if (pair.second.typeId() == QMetaType::Type::Double || pair.second.typeId() == QMetaType::Type::Int) {
+            vpnKeyStr += "\"" + pair.first + "\": " + QString::number(pair.second.toDouble(), 'f', 1);
+        }
+
+        if (i < orderedFields.size() - 1) {
+            vpnKeyStr += ", ";
+        }
+    }
+    vpnKeyStr += "}";
+
+    QByteArray vpnKeyCompressed = escapeUnicode(vpnKeyStr).toUtf8();
+    vpnKeyCompressed = qCompress(vpnKeyCompressed, 6);
+    vpnKeyCompressed = vpnKeyCompressed.mid(4);
+
+    QByteArray signedData = AMNEZIA_CONFIG_SIGNATURE + vpnKeyCompressed;
+
+    return QString("vpn://%1").arg(QString(signedData.toBase64(QByteArray::Base64UrlEncoding)));
+}
+
+QString apiUtils::getPremiumV2VpnKey(const QJsonObject &serverConfigObject)
+{
+    if (apiUtils::getConfigType(serverConfigObject) != apiDefs::ConfigType::AmneziaPremiumV2) {
+        return {};
+    }
+
+    QString vpnKeyText = "";
+
+    auto apiConfig = serverConfigObject.value(apiDefs::key::apiConfig).toObject();
+    auto authData = serverConfigObject.value(QLatin1String("auth_data")).toObject();
+
+    const QString name = serverConfigObject.value(apiDefs::key::name).toString();
+    const QString description = serverConfigObject.value(apiDefs::key::description).toString();
+    const double configVersion = serverConfigObject.value(apiDefs::key::configVersion).toDouble();
+
+    const QString serviceType = apiConfig.value(apiDefs::key::serviceType).toString();
+    const QString serviceProtocol = apiConfig.value(QLatin1String("service_protocol")).toString();
+    const QString userCountryCode = apiConfig.value(QLatin1String("user_country_code")).toString();
+
+    const QString apiKey = authData.value(apiDefs::key::apiKey).toString();
+
+    QString vpnKeyStr = "{";
+    vpnKeyStr += "\"" + QString(apiDefs::key::name) + "\": \"" + name + "\", ";
+    vpnKeyStr += "\"" + QString(apiDefs::key::description) + "\": \"" + description + "\", ";
+    vpnKeyStr += "\"" + QString(apiDefs::key::configVersion) + "\": " + QString::number(static_cast<int>(configVersion)) + ", ";
+
+    vpnKeyStr += "\"" + QString(apiDefs::key::apiConfig) + "\": {";
+    vpnKeyStr += "\"" + QString(apiDefs::key::serviceType) + "\": \"" + serviceType + "\", ";
+    vpnKeyStr += "\"service_protocol\": \"" + serviceProtocol + "\", ";
+    vpnKeyStr += "\"user_country_code\": \"" + userCountryCode + "\"";
+    vpnKeyStr += "}, ";
+
+    vpnKeyStr += "\"auth_data\": {";
+    vpnKeyStr += "\"" + QString(apiDefs::key::apiKey) + "\": \"" + apiKey + "\"";
+    vpnKeyStr += "}";
+
+    vpnKeyStr += "}";
+
+    QByteArray vpnKeyCompressed = escapeUnicode(vpnKeyStr).toUtf8();
+    vpnKeyCompressed = qCompress(vpnKeyCompressed, 6);
+    vpnKeyCompressed = vpnKeyCompressed.mid(4);
+
+    QByteArray signedData = AMNEZIA_CONFIG_SIGNATURE + vpnKeyCompressed;
+    vpnKeyText = QString("vpn://%1").arg(QString(signedData.toBase64(QByteArray::Base64UrlEncoding)));
+
+    return vpnKeyText;
+}
--- a/client/core/utils/api/apiUtils.h
+++ b/client/core/utils/api/apiUtils.h
@@ -4,32 +4,26 @@
 #include <QNetworkReply>
 #include <QObject>

-#include "core/utils/serverConfigUtils.h"
-#include "core/utils/constants/apiKeys.h"
-#include "core/utils/constants/apiConstants.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
+#include "apiDefs.h"
+#include "core/defs.h"

 namespace apiUtils
 {
+    bool isServerFromApi(const QJsonObject &serverConfigObject);
+
    bool isSubscriptionExpired(const QString &subscriptionEndDate);

-    bool isSubscriptionExpiringSoon(const QString &subscriptionEndDate, int withinDays = 30);
-
    bool isPremiumServer(const QJsonObject &serverConfigObject);

+    apiDefs::ConfigType getConfigType(const QJsonObject &serverConfigObject);
+    apiDefs::ConfigSource getConfigSource(const QJsonObject &serverConfigObject);
+
    amnezia::ErrorCode checkNetworkReplyErrors(const QList<QSslError> &sslErrors, const QString &replyErrorString,
                                               const QNetworkReply::NetworkError &replyError, const int httpStatusCode,
                                               const QByteArray &responseBody);

-    amnezia::ErrorCode errorCodeFromGatewayJsonHttpStatus(const QJsonObject &jsonObj);
-
    QString getPremiumV1VpnKey(const QJsonObject &serverConfigObject);
    QString getPremiumV2VpnKey(const QJsonObject &serverConfigObject);
-
-    // ISO2-style segment for flagKit assets (e.g. US-WEST -> US). Do not use in API request bodies.
-    QString countryCodeBaseForFlag(const QString &fullCountryCode);
 }

 #endif // APIUTILS_H
--- a/client/core/configurators/awgConfigurator.cpp
+++ b/client/core/configurators/awgConfigurator.cpp
@@ -1,109 +0,0 @@
-#include "awgConfigurator.h"
-#include "core/utils/protocolEnum.h"
-#include "core/protocols/protocolUtils.h"
-#include "core/utils/constants/configKeys.h"
-#include "core/utils/constants/protocolConstants.h"
-#include "core/models/containerConfig.h"
-#include "core/models/protocols/awgProtocolConfig.h"
-
-#include <QJsonDocument>
-#include <QJsonObject>
-
-using namespace amnezia;
-
-AwgConfigurator::AwgConfigurator(SshSession* sshSession, QObject *parent)
-    : WireguardConfigurator(sshSession, true, parent)
-{
-}
-
-ProtocolConfig AwgConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container, const ContainerConfig &containerConfig,
-                                              const DnsSettings &dnsSettings,
-                                              ErrorCode &errorCode)
-{
-    const AwgServerConfig* serverConfig = nullptr;
-    const AwgClientConfig* clientConfig = nullptr;
-    
-    if (auto* awgProtocolConfig = containerConfig.getAwgProtocolConfig()) {
-        serverConfig = &awgProtocolConfig->serverConfig;
-        if (awgProtocolConfig->clientConfig.has_value()) {
-            clientConfig = &awgProtocolConfig->clientConfig.value();
-        }
-    }
-    
-    ProtocolConfig wireguardConfig = WireguardConfigurator::createConfig(credentials, container, containerConfig, dnsSettings, errorCode);
-    if (errorCode != ErrorCode::NoError) {
-        return AwgProtocolConfig{};
-    }
-    
-    WireGuardProtocolConfig* wgConfig = wireguardConfig.as<WireGuardProtocolConfig>();
-    if (!wgConfig || !wgConfig->clientConfig.has_value()) {
-        errorCode = ErrorCode::InternalError;
-        return AwgProtocolConfig{};
-    }
-    
-    QString awgConfig = wgConfig->clientConfig->nativeConfig;
-
-    QMap<QString, QString> configMap;
-    auto configLines = awgConfig.split("\n");
-    for (auto &line : configLines) {
-        auto trimmedLine = line.trimmed();
-        if (trimmedLine.startsWith("[") && trimmedLine.endsWith("]")) {
-            continue;
-        } else {
-            QStringList parts = trimmedLine.split(" = ");
-            if (parts.count() == 2) {
-                configMap.insert(parts[0].trimmed(), parts[1].trimmed());
-            }
-        }
-    }
-
-    AwgProtocolConfig protocolConfig;
-    if (serverConfig) {
-        protocolConfig.serverConfig = *serverConfig;
-    }
-    
-    AwgClientConfig newClientConfig;
-    newClientConfig.nativeConfig = awgConfig;
-    newClientConfig.hostName = wgConfig->clientConfig->hostName;
-    newClientConfig.port = wgConfig->clientConfig->port;
-    newClientConfig.clientIp = wgConfig->clientConfig->clientIp;
-    newClientConfig.clientPrivateKey = wgConfig->clientConfig->clientPrivateKey;
-    newClientConfig.clientPublicKey = wgConfig->clientConfig->clientPublicKey;
-    newClientConfig.serverPublicKey = wgConfig->clientConfig->serverPublicKey;
-    newClientConfig.presharedKey = wgConfig->clientConfig->presharedKey;
-    newClientConfig.clientId = wgConfig->clientConfig->clientId;
-    newClientConfig.allowedIps = wgConfig->clientConfig->allowedIps;
-    newClientConfig.persistentKeepAlive = wgConfig->clientConfig->persistentKeepAlive;
-    
-    QString mtu = protocols::awg::defaultMtu;
-    if (clientConfig && !clientConfig->mtu.isEmpty()) {
-        mtu = clientConfig->mtu;
-    }
-    newClientConfig.mtu = mtu;
-    
-    newClientConfig.junkPacketCount = configMap.value(configKey::junkPacketCount);
-    newClientConfig.junkPacketMinSize = configMap.value(configKey::junkPacketMinSize);
-    newClientConfig.junkPacketMaxSize = configMap.value(configKey::junkPacketMaxSize);
-    newClientConfig.initPacketJunkSize = configMap.value(configKey::initPacketJunkSize);
-    newClientConfig.responsePacketJunkSize = configMap.value(configKey::responsePacketJunkSize);
-    newClientConfig.initPacketMagicHeader = configMap.value(configKey::initPacketMagicHeader);
-    newClientConfig.responsePacketMagicHeader = configMap.value(configKey::responsePacketMagicHeader);
-    newClientConfig.underloadPacketMagicHeader = configMap.value(configKey::underloadPacketMagicHeader);
-    newClientConfig.transportPacketMagicHeader = configMap.value(configKey::transportPacketMagicHeader);
-    newClientConfig.specialJunk1 = configMap.value(configKey::specialJunk1);
-    newClientConfig.specialJunk2 = configMap.value(configKey::specialJunk2);
-    newClientConfig.specialJunk3 = configMap.value(configKey::specialJunk3);
-    newClientConfig.specialJunk4 = configMap.value(configKey::specialJunk4);
-    newClientConfig.specialJunk5 = configMap.value(configKey::specialJunk5);
-    
-    if (container == DockerContainer::Awg2) {
-        newClientConfig.cookieReplyPacketJunkSize = configMap.value(configKey::cookieReplyPacketJunkSize);
-        newClientConfig.transportPacketJunkSize = configMap.value(configKey::transportPacketJunkSize);
-    }
-    
-    newClientConfig.isObfuscationEnabled = false;
-    
-    protocolConfig.setClientConfig(newClientConfig);
-    
-    return protocolConfig;
-}
--- a/client/core/configurators/awgConfigurator.h
+++ b/client/core/configurators/awgConfigurator.h
@@ -1,20 +0,0 @@
-#ifndef AWGCONFIGURATOR_H
-#define AWGCONFIGURATOR_H
-
-#include <QObject>
-
-#include "wireguardConfigurator.h"
-
-class AwgConfigurator : public WireguardConfigurator
-{
-    Q_OBJECT
-public:
-    AwgConfigurator(SshSession* sshSession, QObject *parent = nullptr);
-
-    amnezia::ProtocolConfig createConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                const amnezia::ContainerConfig &containerConfig,
-                                const amnezia::DnsSettings &dnsSettings,
-                                amnezia::ErrorCode &errorCode) override;
-};
-
-#endif // AWGCONFIGURATOR_H
--- a/client/core/configurators/configuratorBase.cpp
+++ b/client/core/configurators/configuratorBase.cpp
@@ -1,50 +0,0 @@
-#include "configuratorBase.h"
-
-#include "core/configurators/awgConfigurator.h"
-#include "core/configurators/ikev2Configurator.h"
-#include "core/configurators/openVpnConfigurator.h"
-#include "core/configurators/wireguardConfigurator.h"
-#include "core/configurators/xrayConfigurator.h"
-
-using namespace amnezia;
-
-ConfiguratorBase::ConfiguratorBase(SshSession* sshSession, QObject *parent)
-    : QObject { parent }, m_sshSession(sshSession)
-{
-}
-
-QScopedPointer<ConfiguratorBase> ConfiguratorBase::create(Proto protocol,
-                                                          SshSession* sshSession)
-{
-    switch (protocol) {
-    case Proto::OpenVpn: return QScopedPointer<ConfiguratorBase>(new OpenVpnConfigurator(sshSession));
-    case Proto::WireGuard: return QScopedPointer<ConfiguratorBase>(new WireguardConfigurator(sshSession, false));
-    case Proto::Awg: return QScopedPointer<ConfiguratorBase>(new AwgConfigurator(sshSession));
-    case Proto::Ikev2: return QScopedPointer<ConfiguratorBase>(new Ikev2Configurator(sshSession));
-    case Proto::Xray: return QScopedPointer<ConfiguratorBase>(new XrayConfigurator(sshSession));
-    case Proto::SSXray: return QScopedPointer<ConfiguratorBase>(new XrayConfigurator(sshSession));
-    default: return QScopedPointer<ConfiguratorBase>();
-    }
-}
-
-ProtocolConfig ConfiguratorBase::processConfigWithLocalSettings(const ConnectionSettings &settings,
-                                                                 ProtocolConfig protocolConfig)
-{
-    applyDnsToNativeConfig(settings.dns, protocolConfig);
-    return protocolConfig;
-}
-
-ProtocolConfig ConfiguratorBase::processConfigWithExportSettings(const ExportSettings &settings,
-                                                                 ProtocolConfig protocolConfig)
-{
-    applyDnsToNativeConfig(settings.dns, protocolConfig);
-    return protocolConfig;
-}
-
-void ConfiguratorBase::applyDnsToNativeConfig(const DnsSettings &dns, ProtocolConfig &protocolConfig)
-{
-    QString config = protocolConfig.nativeConfig();
-    config.replace("$PRIMARY_DNS", dns.primaryDns);
-    config.replace("$SECONDARY_DNS", dns.secondaryDns);
-    protocolConfig.setNativeConfig(config);
-}
--- a/client/core/configurators/configuratorBase.h
+++ b/client/core/configurators/configuratorBase.h
@@ -1,43 +0,0 @@
-#ifndef CONFIGURATORBASE_H
-#define CONFIGURATORBASE_H
-
-#include <QObject>
-#include <QScopedPointer>
-
-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/models/containerConfig.h"
-#include "core/models/protocolConfig.h"
-
-class SshSession;
-
-class ConfiguratorBase : public QObject
-{
-    Q_OBJECT
-public:
-    explicit ConfiguratorBase(SshSession* sshSession, QObject *parent = nullptr);
-
-    static QScopedPointer<ConfiguratorBase> create(amnezia::Proto protocol,
-                                                   SshSession* sshSession);
-
-    virtual amnezia::ProtocolConfig createConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                        const amnezia::ContainerConfig &containerConfig,
-                                        const amnezia::DnsSettings &dnsSettings,
-                                        amnezia::ErrorCode &errorCode) = 0;
-
-    virtual amnezia::ProtocolConfig processConfigWithLocalSettings(const amnezia::ConnectionSettings &settings,
-                                                                   amnezia::ProtocolConfig protocolConfig);
-    virtual amnezia::ProtocolConfig processConfigWithExportSettings(const amnezia::ExportSettings &settings,
-                                                                     amnezia::ProtocolConfig protocolConfig);
-
-protected:
-    void applyDnsToNativeConfig(const amnezia::DnsSettings &dns, amnezia::ProtocolConfig &protocolConfig);
-
-    SshSession* m_sshSession;
-};
-
-#endif // CONFIGURATORBASE_H
--- a/client/core/configurators/ikev2Configurator.h
+++ b/client/core/configurators/ikev2Configurator.h
@@ -1,39 +0,0 @@
-#ifndef IKEV2_CONFIGURATOR_H
-#define IKEV2_CONFIGURATOR_H
-
-#include <QObject>
-#include <QProcessEnvironment>
-
-#include "configuratorBase.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-
-class Ikev2Configurator : public ConfiguratorBase
-{
-    Q_OBJECT
-public:
-    Ikev2Configurator(SshSession* sshSession, QObject *parent = nullptr);
-
-    struct ConnectionData {
-        QByteArray clientCert; // p12 client cert
-        QByteArray caCert; // p12 server cert
-        QString clientId;
-        QString password; // certificate password
-        QString host; // host ip
-    };
-
-    amnezia::ProtocolConfig createConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                const amnezia::ContainerConfig &containerConfig,
-                                const amnezia::DnsSettings &dnsSettings,
-                                amnezia::ErrorCode &errorCode) override;
-
-    QString genIkev2Config(const ConnectionData &connData);
-    QString genMobileConfig(const ConnectionData &connData);
-    QString genStrongSwanConfig(const ConnectionData &connData);
-
-    ConnectionData prepareIkev2Config(const amnezia::ServerCredentials &credentials,
-        amnezia::DockerContainer container, amnezia::ErrorCode &errorCode);
-};
-
-#endif // IKEV2_CONFIGURATOR_H
--- a/client/core/configurators/openVpnConfigurator.h
+++ b/client/core/configurators/openVpnConfigurator.h
@@ -1,49 +0,0 @@
-#ifndef OPENVPN_CONFIGURATOR_H
-#define OPENVPN_CONFIGURATOR_H
-
-#include <QObject>
-#include <QProcessEnvironment>
-
-#include "configuratorBase.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-
-class OpenVpnConfigurator : public ConfiguratorBase
-{
-    Q_OBJECT
-public:
-    OpenVpnConfigurator(SshSession* sshSession, QObject *parent = nullptr);
-
-    struct ConnectionData
-    {
-        QString clientId;
-        QString request;    // certificate request
-        QString privKey;    // client private key
-        QString clientCert; // client signed certificate
-        QString caCert;     // server certificate
-        QString taKey;      // tls-auth key
-        QString host;       // host ip
-    };
-
-    amnezia::ProtocolConfig createConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                               const amnezia::ContainerConfig &containerConfig,
-                               const amnezia::DnsSettings &dnsSettings,
-                               amnezia::ErrorCode &errorCode) override;
-
-    amnezia::ProtocolConfig processConfigWithLocalSettings(const amnezia::ConnectionSettings &settings,
-                                                           amnezia::ProtocolConfig protocolConfig) override;
-    amnezia::ProtocolConfig processConfigWithExportSettings(const amnezia::ExportSettings &settings,
-                                                            amnezia::ProtocolConfig protocolConfig) override;
-
-    static ConnectionData createCertRequest();
-
-private:
-    ConnectionData prepareOpenVpnConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                       const amnezia::DnsSettings &dnsSettings,
-                                       amnezia::ErrorCode &errorCode);
-    amnezia::ErrorCode signCert(amnezia::DockerContainer container, const amnezia::ServerCredentials &credentials, 
-                      const amnezia::DnsSettings &dnsSettings, QString clientId);
-};
-
-#endif // OPENVPN_CONFIGURATOR_H
--- a/client/core/configurators/wireguardConfigurator.h
+++ b/client/core/configurators/wireguardConfigurator.h
@@ -1,61 +0,0 @@
-#ifndef WIREGUARD_CONFIGURATOR_H
-#define WIREGUARD_CONFIGURATOR_H
-
-#include <QHostAddress>
-#include <QObject>
-#include <QProcessEnvironment>
-
-#include "configuratorBase.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/utils/selfhosted/scriptsRegistry.h"
-
-class WireguardConfigurator : public ConfiguratorBase
-{
-    Q_OBJECT
-public:
-    WireguardConfigurator(SshSession* sshSession,
-                          bool isAwg, QObject *parent = nullptr);
-
-    struct ConnectionData
-    {
-        QString clientPrivKey; // client private key
-        QString clientPubKey;  // client public key
-        QString clientIP;      // internal client IP address
-        QString serverPubKey;  // tls-auth key
-        QString pskKey;        // preshared key
-        QString host;          // host ip
-        QString port;
-    };
-
-    amnezia::ProtocolConfig createConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                const amnezia::ContainerConfig &containerConfig,
-                                const amnezia::DnsSettings &dnsSettings,
-                                amnezia::ErrorCode &errorCode) override;
-
-    amnezia::ProtocolConfig processConfigWithLocalSettings(const amnezia::ConnectionSettings &settings,
-                                                           amnezia::ProtocolConfig protocolConfig) override;
-    amnezia::ProtocolConfig processConfigWithExportSettings(const amnezia::ExportSettings &settings,
-                                                            amnezia::ProtocolConfig protocolConfig) override;
-
-    static ConnectionData genClientKeys();
-
-private:
-    QList<QHostAddress> getIpsFromConf(const QString &input);
-    ConnectionData prepareWireguardConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container,
-                                          const amnezia::WireGuardServerConfig* serverConfig,
-                                          const amnezia::AwgServerConfig* awgServerConfig,
-                                          const amnezia::DnsSettings &dnsSettings,
-                                          amnezia::ErrorCode &errorCode);
-
-    bool m_isAwg;
-    QString m_serverConfigPath;
-    QString m_serverPublicKeyPath;
-    QString m_serverPskKeyPath;
-    amnezia::ProtocolScriptType m_configTemplate;
-    QString m_protocolName;
-    QString m_defaultPort;
-};
-
-#endif // WIREGUARD_CONFIGURATOR_H
--- a/client/core/configurators/xrayConfigurator.cpp
+++ b/client/core/configurators/xrayConfigurator.cpp
@@ -1,533 +0,0 @@
-#include "xrayConfigurator.h"
-
-#include <QFile>
-#include <QJsonDocument>
-#include <QJsonObject>
-#include <QJsonArray>
-#include <QUuid>
-#include "logger.h"
-
-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/utils/selfhosted/scriptsRegistry.h"
-#include "core/utils/protocolEnum.h"
-#include "core/protocols/protocolUtils.h"
-#include "core/utils/constants/configKeys.h"
-#include "core/utils/constants/protocolConstants.h"
-#include "core/models/containerConfig.h"
-#include "core/models/protocols/xrayProtocolConfig.h"
-
-namespace {
-    Logger logger("XrayConfigurator");
-
-    QString normalizeXhttpMode(const QString &m) {
-        const QString t = m.trimmed();
-        if (t.isEmpty() || t.compare(QLatin1String("Auto"), Qt::CaseInsensitive) == 0) {
-            return QStringLiteral("auto");
-        }
-        if (t.compare(QLatin1String("Packet-up"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("packet-up");
-        if (t.compare(QLatin1String("Stream-up"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("stream-up");
-        if (t.compare(QLatin1String("Stream-one"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("stream-one");
-        return t.toLower();
-    }
-
-    // Xray-core: empty → path; "None" in UI → omit (core default path)
-    QString normalizeSessionSeqPlacement(const QString &p)
-    {
-        if (p.isEmpty() || p.compare(QLatin1String("None"), Qt::CaseInsensitive) == 0)
-            return {};
-        return p.toLower();
-    }
-
-    QString normalizeUplinkDataPlacement(const QString &p)
-    {
-        if (p.isEmpty() || p.compare(QLatin1String("Body"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("body");
-        if (p.compare(QLatin1String("Auto"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("auto");
-        if (p.compare(QLatin1String("Query"), Qt::CaseInsensitive) == 0)
-            // "Query" is not valid for uplink payload in splithttp; closest documented mode
-            return QStringLiteral("header");
-        return p.toLower();
-    }
-
-    // splithttp: cookie | header | query | queryInHeader (not "body")
-    QString normalizeXPaddingPlacement(const QString &p)
-    {
-        QString t = p.trimmed();
-        if (t.isEmpty())
-            return QString::fromLatin1(amnezia::protocols::xray::defaultXPaddingPlacement).toLower();
-        if (t.compare(QLatin1String("Body"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("queryInHeader");
-        if (t.contains(QLatin1String("queryInHeader"), Qt::CaseInsensitive)
-            || t.compare(QLatin1String("Query in header"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("queryInHeader");
-        return t.toLower();
-    }
-
-    // splithttp: repeat-x | tokenish
-    QString normalizeXPaddingMethod(const QString &m)
-    {
-        QString t = m.trimmed();
-        if (t.isEmpty() || t.compare(QLatin1String("Repeat-x"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("repeat-x");
-        if (t.compare(QLatin1String("Tokenish"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("tokenish");
-        if (t.compare(QLatin1String("Random"), Qt::CaseInsensitive) == 0
-            || t.compare(QLatin1String("Zero"), Qt::CaseInsensitive) == 0)
-            return QStringLiteral("repeat-x");
-        return t.toLower();
-    }
-
-    void putIntRangeIfAny(QJsonObject &obj, const char *key, QString minV, QString maxV, const char *fallbackMin,
-                          const char *fallbackMax)
-    {
-        if (minV.isEmpty() && maxV.isEmpty())
-            return;
-        if (minV.isEmpty())
-            minV = QString::fromLatin1(fallbackMin);
-        if (maxV.isEmpty())
-            maxV = QString::fromLatin1(fallbackMax);
-        QJsonObject r;
-        r[QStringLiteral("from")] = minV.toInt();
-        r[QStringLiteral("to")] = maxV.toInt();
-        obj[QString::fromUtf8(key)] = r;
-    }
-
-    // Desktop applies this in XrayProtocol::start(); iOS/Android pass JSON straight to libxray — same fixes here.
-    void sanitizeXrayNativeConfig(amnezia::ProtocolConfig &pc)
-    {
-        QString c = pc.nativeConfig();
-        if (c.isEmpty()) {
-            return;
-        }
-        bool changed = false;
-        if (c.contains(QLatin1String("Mozilla/5.0"), Qt::CaseInsensitive)) {
-            c.replace(QLatin1String("Mozilla/5.0"), QString::fromLatin1(amnezia::protocols::xray::defaultFingerprint),
-                      Qt::CaseInsensitive);
-            changed = true;
-        }
-        const QString legacyListen = QString::fromLatin1(amnezia::protocols::xray::defaultLocalAddr);
-        const QString listenOk = QString::fromLatin1(amnezia::protocols::xray::defaultLocalListenAddr);
-        if (c.contains(legacyListen)) {
-            c.replace(legacyListen, listenOk);
-            changed = true;
-        }
-        if (changed) {
-            pc.setNativeConfig(c);
-        }
-    }
-} // namespace
-
-XrayConfigurator::XrayConfigurator(SshSession* sshSession, QObject *parent)
-    : ConfiguratorBase(sshSession, parent)
-{
-}
-
-amnezia::ProtocolConfig XrayConfigurator::processConfigWithLocalSettings(const amnezia::ConnectionSettings &settings,
-                                                                         amnezia::ProtocolConfig protocolConfig)
-{
-    applyDnsToNativeConfig(settings.dns, protocolConfig);
-    sanitizeXrayNativeConfig(protocolConfig);
-    return protocolConfig;
-}
-
-QString XrayConfigurator::prepareServerConfig(const ServerCredentials &credentials, DockerContainer container,
-                                               const ContainerConfig &containerConfig,
-                                               const DnsSettings &dnsSettings,
-                                               ErrorCode &errorCode)
-{
-    // Generate new UUID for client
-    QString clientId = QUuid::createUuid().toString(QUuid::WithoutBraces);
-
-    // Get flow value from settings (default xtls-rprx-vision)
-    QString flowValue = "xtls-rprx-vision";
-    if (const auto *xrayCfg = containerConfig.protocolConfig.as<XrayProtocolConfig>()) {
-        if (!xrayCfg->serverConfig.flow.isEmpty()) {
-            flowValue = xrayCfg->serverConfig.flow;
-        }
-    }
-
-    // Get current server config
-    QString currentConfig = m_sshSession->getTextFileFromContainer(
-        container, credentials, amnezia::protocols::xray::serverConfigPath, errorCode);
-
-    if (errorCode != ErrorCode::NoError) {
-        logger.error() << "Failed to get server config file";
-        return "";
-    }
-
-    // Parse current config as JSON
-    QJsonDocument doc = QJsonDocument::fromJson(currentConfig.toUtf8());
-    if (doc.isNull() || !doc.isObject()) {
-        logger.error() << "Failed to parse server config JSON";
-        errorCode = ErrorCode::InternalError;
-        return "";
-    }
-
-    QJsonObject serverConfig = doc.object();
-
-    // Validate server config structure
-    if (!serverConfig.contains(amnezia::protocols::xray::inbounds)) {
-        logger.error() << "Server config missing 'inbounds' field";
-        errorCode = ErrorCode::InternalError;
-        return "";
-    }
-
-    QJsonArray inbounds = serverConfig[amnezia::protocols::xray::inbounds].toArray();
-    if (inbounds.isEmpty()) {
-        logger.error() << "Server config has empty 'inbounds' array";
-        errorCode = ErrorCode::InternalError;
-        return "";
-    }
-
-    QJsonObject inbound = inbounds[0].toObject();
-    if (!inbound.contains(amnezia::protocols::xray::settings)) {
-        logger.error() << "Inbound missing 'settings' field";
-        errorCode = ErrorCode::InternalError;
-        return "";
-    }
-
-    QJsonObject settings = inbound[amnezia::protocols::xray::settings].toObject();
-    if (!settings.contains(amnezia::protocols::xray::clients)) {
-        logger.error() << "Settings missing 'clients' field";
-        errorCode = ErrorCode::InternalError;
-        return "";
-    }
-
-    QJsonArray clients = settings[amnezia::protocols::xray::clients].toArray();
-
-    // Create configuration for new client
-    QJsonObject clientConfig {
-        {amnezia::protocols::xray::id, clientId},
-    };
-    clientConfig[amnezia::protocols::xray::id] = clientId;
-    if (!flowValue.isEmpty()) {
-        clientConfig[amnezia::protocols::xray::flow] = flowValue;
-    }
-
-    clients.append(clientConfig);
-
-    // Update config
-    settings[amnezia::protocols::xray::clients] = clients;
-    inbound[amnezia::protocols::xray::settings] = settings;
-    inbounds[0] = inbound;
-    serverConfig[amnezia::protocols::xray::inbounds] = inbounds;
-
-    // Save updated config to server
-    QString updatedConfig = QJsonDocument(serverConfig).toJson();
-    errorCode = m_sshSession->uploadTextFileToContainer(
-        container,
-        credentials,
-        updatedConfig,
-        amnezia::protocols::xray::serverConfigPath,
-        libssh::ScpOverwriteMode::ScpOverwriteExisting
-    );
-    if (errorCode != ErrorCode::NoError) {
-        logger.error() << "Failed to upload updated config";
-        return "";
-    }
-
-    // Restart container
-    QString restartScript = QString("sudo docker restart $CONTAINER_NAME");
-    errorCode = m_sshSession->runScript(
-        credentials,
-        m_sshSession->replaceVars(restartScript, amnezia::genBaseVars(credentials, container, dnsSettings.primaryDns, dnsSettings.secondaryDns))
-    );
-
-    if (errorCode != ErrorCode::NoError) {
-        logger.error() << "Failed to restart container";
-        return "";
-    }
-
-    return clientId;
-}
-
-QJsonObject XrayConfigurator::buildStreamSettings(const XrayServerConfig &srv, const QString &clientId) const
-{
-    QJsonObject streamSettings;
-    const auto &xhttp = srv.xhttp;
-    const auto &mkcp = srv.mkcp;
-    namespace px = amnezia::protocols::xray;
-
-    QString networkValue = QStringLiteral("tcp");
-    if (srv.transport == QLatin1String("xhttp"))
-        networkValue = QStringLiteral("xhttp");
-    else if (srv.transport == QLatin1String("mkcp"))
-        networkValue = QStringLiteral("kcp");
-    streamSettings[px::network] = networkValue;
-
-    streamSettings[px::security] = srv.security;
-
-    if (srv.security == QLatin1String("tls")) {
-        QJsonObject tlsSettings;
-        const QString sniEff = srv.sni.isEmpty() ? QString::fromLatin1(px::defaultSni) : srv.sni;
-        tlsSettings[px::serverName] = sniEff;
-        const QString alpnEff = srv.alpn.isEmpty() ? QString::fromLatin1(px::defaultAlpn) : srv.alpn;
-        QJsonArray alpnArray;
-        for (const QString &a : alpnEff.split(QLatin1Char(','))) {
-            const QString t = a.trimmed();
-            if (!t.isEmpty())
-                alpnArray.append(t);
-        }
-        if (!alpnArray.isEmpty())
-            tlsSettings[QStringLiteral("alpn")] = alpnArray;
-        const QString fpEff = srv.fingerprint.isEmpty() ? QString::fromLatin1(px::defaultFingerprint) : srv.fingerprint;
-        tlsSettings[px::fingerprint] = fpEff;
-        streamSettings[QStringLiteral("tlsSettings")] = tlsSettings;
-    }
-
-    if (srv.security == QLatin1String("reality")) {
-        QJsonObject realSettings;
-        const QString fpEff = srv.fingerprint.isEmpty() ? QString::fromLatin1(px::defaultFingerprint) : srv.fingerprint;
-        realSettings[px::fingerprint] = fpEff;
-        const QString sniEff = srv.sni.isEmpty() ? QString::fromLatin1(px::defaultSni) : srv.sni;
-        realSettings[px::serverName] = sniEff;
-        streamSettings[px::realitySettings] = realSettings;
-    }
-
-    // XHTTP — JSON must match Xray-core SplitHTTPConfig (flat xPadding fields, see transport_internet.go)
-    if (srv.transport == QLatin1String("xhttp")) {
-        QJsonObject xo;
-        const QString hostEff = xhttp.host.isEmpty() ? QString::fromLatin1(px::defaultXhttpHost) : xhttp.host;
-        xo[QStringLiteral("host")] = hostEff;
-        if (!xhttp.path.isEmpty())
-            xo[QStringLiteral("path")] = xhttp.path;
-        xo[QStringLiteral("mode")] = normalizeXhttpMode(xhttp.mode);
-
-        if (xhttp.headersTemplate.compare(QLatin1String("HTTP"), Qt::CaseInsensitive) == 0) {
-            QJsonObject headers;
-            headers[QStringLiteral("Host")] = hostEff;
-            xo[QStringLiteral("headers")] = headers;
-        }
-
-        const QString methodEff =
-                xhttp.uplinkMethod.isEmpty() ? QString::fromLatin1(px::defaultXhttpUplinkMethod) : xhttp.uplinkMethod;
-        xo[QStringLiteral("uplinkHTTPMethod")] = methodEff.toUpper();
-
-        xo[QStringLiteral("noGRPCHeader")] = xhttp.disableGrpc;
-        xo[QStringLiteral("noSSEHeader")] = xhttp.disableSse;
-
-        const QString sessPl = normalizeSessionSeqPlacement(xhttp.sessionPlacement);
-        if (!sessPl.isEmpty())
-            xo[QStringLiteral("sessionPlacement")] = sessPl;
-        const QString seqPl = normalizeSessionSeqPlacement(xhttp.seqPlacement);
-        if (!seqPl.isEmpty())
-            xo[QStringLiteral("seqPlacement")] = seqPl;
-        if (!xhttp.sessionKey.isEmpty())
-            xo[QStringLiteral("sessionKey")] = xhttp.sessionKey;
-        if (!xhttp.seqKey.isEmpty())
-            xo[QStringLiteral("seqKey")] = xhttp.seqKey;
-
-        xo[QStringLiteral("uplinkDataPlacement")] = normalizeUplinkDataPlacement(xhttp.uplinkDataPlacement);
-        if (!xhttp.uplinkDataKey.isEmpty())
-            xo[QStringLiteral("uplinkDataKey")] = xhttp.uplinkDataKey;
-
-        const QString ucs = xhttp.uplinkChunkSize.isEmpty() ? QString::fromLatin1(px::defaultXhttpUplinkChunkSize)
-                                                            : xhttp.uplinkChunkSize;
-        if (!ucs.isEmpty() && ucs != QLatin1String("0")) {
-            const int v = ucs.toInt();
-            QJsonObject chunkR;
-            chunkR[QStringLiteral("from")] = v;
-            chunkR[QStringLiteral("to")] = v;
-            xo[QStringLiteral("uplinkChunkSize")] = chunkR;
-        }
-
-        if (!xhttp.scMaxBufferedPosts.isEmpty())
-            xo[QStringLiteral("scMaxBufferedPosts")] = xhttp.scMaxBufferedPosts.toLongLong();
-
-        putIntRangeIfAny(xo, "scMaxEachPostBytes", xhttp.scMaxEachPostBytesMin, xhttp.scMaxEachPostBytesMax,
-                         px::defaultXhttpScMaxEachPostBytesMin, px::defaultXhttpScMaxEachPostBytesMax);
-        putIntRangeIfAny(xo, "scMinPostsIntervalMs", xhttp.scMinPostsIntervalMsMin, xhttp.scMinPostsIntervalMsMax,
-                         px::defaultXhttpScMinPostsIntervalMsMin, px::defaultXhttpScMinPostsIntervalMsMax);
-        putIntRangeIfAny(xo, "scStreamUpServerSecs", xhttp.scStreamUpServerSecsMin, xhttp.scStreamUpServerSecsMax,
-                         px::defaultXhttpScStreamUpServerSecsMin, px::defaultXhttpScStreamUpServerSecsMax);
-
-        const auto &pad = xhttp.xPadding;
-        xo[QStringLiteral("xPaddingObfsMode")] = pad.obfsMode;
-        if (pad.obfsMode) {
-            if (!pad.bytesMin.isEmpty() || !pad.bytesMax.isEmpty()) {
-                QJsonObject br;
-                br[QStringLiteral("from")] = pad.bytesMin.isEmpty() ? 1 : pad.bytesMin.toInt();
-                br[QStringLiteral("to")] = pad.bytesMax.isEmpty() ? (pad.bytesMin.isEmpty() ? 256 : pad.bytesMin.toInt())
-                                                                  : pad.bytesMax.toInt();
-                xo[QStringLiteral("xPaddingBytes")] = br;
-            }
-            xo[QStringLiteral("xPaddingKey")] = pad.key.isEmpty() ? QStringLiteral("x_padding") : pad.key;
-            xo[QStringLiteral("xPaddingHeader")] = pad.header.isEmpty() ? QStringLiteral("X-Padding") : pad.header;
-            xo[QStringLiteral("xPaddingPlacement")] = normalizeXPaddingPlacement(
-                    pad.placement.isEmpty() ? QString::fromLatin1(px::defaultXPaddingPlacement) : pad.placement);
-            xo[QStringLiteral("xPaddingMethod")] = normalizeXPaddingMethod(
-                    pad.method.isEmpty() ? QString::fromLatin1(px::defaultXPaddingMethod) : pad.method);
-        }
-
-        // xmux: Xray has no "enabled" flag; omit object when UI disables multiplex tuning.
-        if (xhttp.xmux.enabled) {
-            QJsonObject mux;
-            auto addMuxRange = [&](const char *key, const QString &a, const QString &b) {
-                if (a.isEmpty() && b.isEmpty())
-                    return;
-                QJsonObject r;
-                r[QStringLiteral("from")] = a.isEmpty() ? 0 : a.toInt();
-                r[QStringLiteral("to")] = b.isEmpty() ? 0 : b.toInt();
-                mux[QString::fromUtf8(key)] = r;
-            };
-            addMuxRange("maxConcurrency", xhttp.xmux.maxConcurrencyMin, xhttp.xmux.maxConcurrencyMax);
-            addMuxRange("maxConnections", xhttp.xmux.maxConnectionsMin, xhttp.xmux.maxConnectionsMax);
-            addMuxRange("cMaxReuseTimes", xhttp.xmux.cMaxReuseTimesMin, xhttp.xmux.cMaxReuseTimesMax);
-            addMuxRange("hMaxRequestTimes", xhttp.xmux.hMaxRequestTimesMin, xhttp.xmux.hMaxRequestTimesMax);
-            addMuxRange("hMaxReusableSecs", xhttp.xmux.hMaxReusableSecsMin, xhttp.xmux.hMaxReusableSecsMax);
-            if (!xhttp.xmux.hKeepAlivePeriod.isEmpty())
-                mux[QStringLiteral("hKeepAlivePeriod")] = xhttp.xmux.hKeepAlivePeriod.toLongLong();
-            if (!mux.isEmpty())
-                xo[QStringLiteral("xmux")] = mux;
-        }
-
-        streamSettings[QStringLiteral("xhttpSettings")] = xo;
-    }
-
-    if (srv.transport == QLatin1String("mkcp")) {
-        QJsonObject kcpObj;
-        const QString ttiEff = mkcp.tti.isEmpty() ? QString::fromLatin1(px::defaultMkcpTti) : mkcp.tti;
-        const QString upEff = mkcp.uplinkCapacity.isEmpty() ? QString::fromLatin1(px::defaultMkcpUplinkCapacity)
-                                                            : mkcp.uplinkCapacity;
-        const QString downEff = mkcp.downlinkCapacity.isEmpty() ? QString::fromLatin1(px::defaultMkcpDownlinkCapacity)
-                                                                : mkcp.downlinkCapacity;
-        const QString rbufEff = mkcp.readBufferSize.isEmpty() ? QString::fromLatin1(px::defaultMkcpReadBufferSize)
-                                                              : mkcp.readBufferSize;
-        const QString wbufEff = mkcp.writeBufferSize.isEmpty() ? QString::fromLatin1(px::defaultMkcpWriteBufferSize)
-                                                               : mkcp.writeBufferSize;
-        kcpObj[QStringLiteral("tti")] = ttiEff.toInt();
-        kcpObj[QStringLiteral("uplinkCapacity")] = upEff.toInt();
-        kcpObj[QStringLiteral("downlinkCapacity")] = downEff.toInt();
-        kcpObj[QStringLiteral("readBufferSize")] = rbufEff.toInt();
-        kcpObj[QStringLiteral("writeBufferSize")] = wbufEff.toInt();
-        kcpObj[QStringLiteral("congestion")] = mkcp.congestion;
-        streamSettings[QStringLiteral("kcpSettings")] = kcpObj;
-    }
-
-    return streamSettings;
-}
-
-ProtocolConfig XrayConfigurator::createConfig(const ServerCredentials &credentials, DockerContainer container,
-                                              const ContainerConfig &containerConfig,
-                                              const DnsSettings &dnsSettings,
-                                              ErrorCode &errorCode)
-{
-    const XrayServerConfig *serverConfig = nullptr;
-    if (const auto *xrayCfg = containerConfig.protocolConfig.as<XrayProtocolConfig>()) {
-        serverConfig = &xrayCfg->serverConfig;
-    }
-
-    if (!serverConfig) {
-        logger.error() << "No XrayProtocolConfig found";
-        errorCode = ErrorCode::InternalError;
-        return XrayProtocolConfig{};
-    }
-
-    const XrayServerConfig &srv = *serverConfig;
-
-    QString xrayClientId = prepareServerConfig(credentials, container, containerConfig, dnsSettings, errorCode);
-    if (errorCode != ErrorCode::NoError || xrayClientId.isEmpty()) {
-        logger.error() << "Failed to prepare server config";
-        if (errorCode == ErrorCode::NoError) {
-            errorCode = ErrorCode::InternalError;
-        }
-        return XrayProtocolConfig{};
-    }
-
-    // Fetch server keys (Reality only)
-    QString xrayPublicKey;
-    QString xrayShortId;
-
-    if (srv.security == "reality") {
-        xrayPublicKey = m_sshSession->getTextFileFromContainer(container, credentials,
-                                                               amnezia::protocols::xray::PublicKeyPath, errorCode);
-        if (errorCode != ErrorCode::NoError || xrayPublicKey.isEmpty()) {
-            logger.error() << "Failed to get public key";
-            if (errorCode == ErrorCode::NoError) {
-                errorCode = ErrorCode::InternalError;
-            }
-            return XrayProtocolConfig{};
-        }
-        xrayPublicKey.replace("\n", "");
-
-        xrayShortId = m_sshSession->getTextFileFromContainer(container, credentials,
-                                                             amnezia::protocols::xray::shortidPath, errorCode);
-        if (errorCode != ErrorCode::NoError || xrayShortId.isEmpty()) {
-            logger.error() << "Failed to get short ID";
-            if (errorCode == ErrorCode::NoError) {
-                errorCode = ErrorCode::InternalError;
-            }
-            return XrayProtocolConfig{};
-        }
-        xrayShortId.replace("\n", "");
-    }
-
-    // Build outbound
-    QJsonObject userObj;
-    userObj[amnezia::protocols::xray::id] = xrayClientId;
-    userObj[amnezia::protocols::xray::encryption] = "none";
-    if (!srv.flow.isEmpty()) {
-        userObj[amnezia::protocols::xray::flow] = srv.flow;
-    }
-
-    QJsonObject vnextEntry;
-    vnextEntry[amnezia::protocols::xray::address] = credentials.hostName;
-    vnextEntry[amnezia::protocols::xray::port] = srv.port.toInt();
-    vnextEntry[amnezia::protocols::xray::users] = QJsonArray { userObj };
-
-    QJsonObject outboundSettings;
-    outboundSettings[amnezia::protocols::xray::vnext] = QJsonArray { vnextEntry };
-
-    QJsonObject outbound;
-    outbound["protocol"] = "vless";
-    outbound[amnezia::protocols::xray::settings] = outboundSettings;
-
-    // Build streamSettings
-    QJsonObject streamObj = buildStreamSettings(srv, xrayClientId);
-
-    // Inject Reality keys
-    if (srv.security == "reality") {
-        QJsonObject rs = streamObj[amnezia::protocols::xray::realitySettings].toObject();
-        rs[amnezia::protocols::xray::publicKey] = xrayPublicKey;
-        rs[amnezia::protocols::xray::shortId] = xrayShortId;
-        rs[amnezia::protocols::xray::spiderX] = "";
-        streamObj[amnezia::protocols::xray::realitySettings] = rs;
-    }
-
-    outbound[amnezia::protocols::xray::streamSettings] = streamObj;
-
-    // Build full client config
-    QJsonObject inboundObj;
-    inboundObj["listen"] = amnezia::protocols::xray::defaultLocalListenAddr;
-    inboundObj[amnezia::protocols::xray::port] = amnezia::protocols::xray::defaultLocalProxyPort;
-    inboundObj["protocol"] = "socks";
-    inboundObj[amnezia::protocols::xray::settings] = QJsonObject { { "udp", true } };
-
-    QJsonObject clientJson;
-    clientJson["log"] = QJsonObject { { "loglevel", "error" } };
-    clientJson[amnezia::protocols::xray::inbounds] = QJsonArray { inboundObj };
-    clientJson[amnezia::protocols::xray::outbounds] = QJsonArray { outbound };
-
-    QString config = QString::fromUtf8(QJsonDocument(clientJson).toJson(QJsonDocument::Compact));
-
-    // Return
-    XrayProtocolConfig protocolConfig;
-    protocolConfig.serverConfig = srv;
-
-    XrayClientConfig clientConfig;
-    clientConfig.nativeConfig = config;
-    qDebug() << "config:" << config;
-    clientConfig.localPort = QString(amnezia::protocols::xray::defaultLocalProxyPort);
-    clientConfig.id = xrayClientId;
-
-    protocolConfig.setClientConfig(clientConfig);
-
-    return protocolConfig;
-}
--- a/client/core/configurators/xrayConfigurator.h
+++ b/client/core/configurators/xrayConfigurator.h
@@ -1,36 +0,0 @@
-#ifndef XRAY_CONFIGURATOR_H
-#define XRAY_CONFIGURATOR_H
-
-#include <QObject>
-#include <QJsonObject>
-
-#include "configuratorBase.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/models/protocols/xrayProtocolConfig.h"
-
-class XrayConfigurator : public ConfiguratorBase
-{
-    Q_OBJECT
-public:
-    XrayConfigurator(SshSession* sshSession, QObject *parent = nullptr);
-
-    amnezia::ProtocolConfig createConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container, const amnezia::ContainerConfig &containerConfig,
-                                const amnezia::DnsSettings &dnsSettings,
-                                amnezia::ErrorCode &errorCode) override;
-
-    amnezia::ProtocolConfig processConfigWithLocalSettings(const amnezia::ConnectionSettings &settings,
-                                                           amnezia::ProtocolConfig protocolConfig) override;
-
-private:
-    QString prepareServerConfig(const amnezia::ServerCredentials &credentials, amnezia::DockerContainer container, const amnezia::ContainerConfig &containerConfig,
-                                const amnezia::DnsSettings &dnsSettings,
-                                amnezia::ErrorCode &errorCode);
-
-    // Builds the native xray "streamSettings" JSON object from XrayServerConfig
-    QJsonObject buildStreamSettings(const amnezia::XrayServerConfig &srv,
-                                    const QString &clientId) const;
-};
-
-#endif // XRAY_CONFIGURATOR_H
--- a/client/core/controllers/allowedDnsController.cpp
+++ b/client/core/controllers/allowedDnsController.cpp
@@ -1,54 +0,0 @@
-#include "allowedDnsController.h"
-
-AllowedDnsController::AllowedDnsController(SecureAppSettingsRepository* appSettingsRepository)
-    : m_appSettingsRepository(appSettingsRepository)
-{
-    fillDnsServers();
-}
-
-bool AllowedDnsController::addDns(const QString &ip)
-{
-    if (m_dnsServers.contains(ip)) {
-        return false;
-    }
-
-    m_dnsServers.append(ip);
-    m_appSettingsRepository->setAllowedDnsServers(m_dnsServers);
-    return true;
-}
-
-void AllowedDnsController::addDnsList(const QStringList &dnsServers, bool replaceExisting)
-{
-    if (replaceExisting) {
-        m_dnsServers.clear();
-    }
-    
-    for (const QString &ip : dnsServers) {
-        if (!m_dnsServers.contains(ip)) {
-            m_dnsServers.append(ip);
-        }
-    }
-    
-    m_appSettingsRepository->setAllowedDnsServers(m_dnsServers);
-}
-
-void AllowedDnsController::removeDns(int index)
-{
-    if (index < 0 || index >= m_dnsServers.size()) {
-        return;
-    }
-
-    m_dnsServers.removeAt(index);
-    m_appSettingsRepository->setAllowedDnsServers(m_dnsServers);
-}
-
-QStringList AllowedDnsController::getCurrentDnsServers() const
-{
-    return m_dnsServers;
-}
-
-void AllowedDnsController::fillDnsServers()
-{
-    m_dnsServers = m_appSettingsRepository->getAllowedDnsServers();
-}
-
--- a/client/core/controllers/allowedDnsController.h
+++ b/client/core/controllers/allowedDnsController.h
@@ -1,26 +0,0 @@
-#ifndef ALLOWEDDNSCONTROLLER_H
-#define ALLOWEDDNSCONTROLLER_H
-
-#include <QStringList>
-
-#include "core/repositories/secureAppSettingsRepository.h"
-
-class AllowedDnsController
-{
-public:
-    explicit AllowedDnsController(SecureAppSettingsRepository* appSettingsRepository);
-
-    bool addDns(const QString &ip);
-    void addDnsList(const QStringList &dnsServers, bool replaceExisting);
-    void removeDns(int index);
-    QStringList getCurrentDnsServers() const;
-
-private:
-    void fillDnsServers();
-
-    SecureAppSettingsRepository* m_appSettingsRepository;
-    QStringList m_dnsServers;
-};
-
-#endif // ALLOWEDDNSCONTROLLER_H
-
--- a/client/core/controllers/api/newsController.cpp
+++ b/client/core/controllers/api/newsController.cpp
@@ -1,113 +0,0 @@
-#include "newsController.h"
-
-#include "core/controllers/gatewayController.h"
-#include "core/repositories/secureServersRepository.h"
-#include "core/utils/constants/apiKeys.h"
-#include "core/utils/constants/apiConstants.h"
-#include <QtConcurrent/QtConcurrent>
-#include <QJsonArray>
-#include <QJsonDocument>
-#include <QJsonObject>
-#include <QSet>
-#include <QSharedPointer>
-
-using namespace amnezia;
-
-NewsController::NewsController(SecureAppSettingsRepository *appSettingsRepository,
-                               SecureServersRepository *serversRepository)
-    : m_appSettingsRepository(appSettingsRepository),
-      m_serversRepository(serversRepository)
-{
-}
-
-QJsonObject NewsController::getServicesList() const
-{
-    if (!m_serversRepository) {
-        return {};
-    }
-    QSet<QString> userCountryCodes;
-    QSet<QString> serviceTypes;
-    const QVector<QString> ids = m_serversRepository->orderedServerIds();
-    for (const QString &id : ids) {
-        const auto apiV2 = m_serversRepository->apiV2Config(id);
-        if (!apiV2.has_value()) {
-            continue;
-        }
-        if (!apiV2->apiConfig.userCountryCode.isEmpty()) {
-            userCountryCodes.insert(apiV2->apiConfig.userCountryCode);
-        }
-        const QString serviceType = apiV2->serviceType();
-        if (!serviceType.isEmpty()) {
-            serviceTypes.insert(serviceType);
-        }
-    }
-    if (userCountryCodes.isEmpty() && serviceTypes.isEmpty()) {
-        return {};
-    }
-    QJsonObject json;
-
-    QJsonArray userCountryCodesArray;
-    for (const QString &code : userCountryCodes) {
-        userCountryCodesArray.append(code);
-    }
-    json[apiDefs::key::userCountryCode] = userCountryCodesArray;
-
-    QJsonArray serviceTypesArray;
-    for (const QString &type : serviceTypes) {
-        serviceTypesArray.append(type);
-    }
-    json[apiDefs::key::serviceType] = serviceTypesArray;
-
-    return json;
-}
-
-QFuture<QPair<ErrorCode, QJsonArray>> NewsController::fetchNews()
-{
-    if (!m_serversRepository) {
-        qWarning() << "SecureServersRepository is null, skip fetchNews";
-        return QtFuture::makeReadyFuture(qMakePair(ErrorCode::InternalError, QJsonArray()));
-    }
-
-    const QJsonObject services = getServicesList();
-    if (services.isEmpty()) {
-        qDebug() << "No Gateway stacks, skip fetchNews";
-        return QtFuture::makeReadyFuture(qMakePair(ErrorCode::NoError, QJsonArray()));
-    }
-
-    auto gatewayController = QSharedPointer<GatewayController>::create(
-            m_appSettingsRepository->getGatewayEndpoint(),
-            m_appSettingsRepository->isDevGatewayEnv(),
-            apiDefs::requestTimeoutMsecs,
-            m_appSettingsRepository->isStrictKillSwitchEnabled());
-
-    QJsonObject payload;
-    payload.insert("locale", m_appSettingsRepository->getAppLanguage().name().split("_").first());
-
-    if (services.contains(apiDefs::key::userCountryCode)) {
-        payload.insert(apiDefs::key::userCountryCode, services.value(apiDefs::key::userCountryCode));
-    }
-    if (services.contains(apiDefs::key::serviceType)) {
-        payload.insert(apiDefs::key::serviceType, services.value(apiDefs::key::serviceType));
-    }
-
-    auto future = gatewayController->postAsync(QString("%1v1/news"), payload, nullptr, gatewayController);
-    return future.then([gatewayController](QPair<ErrorCode, QByteArray> result) -> QPair<ErrorCode, QJsonArray> {
-        auto [errorCode, responseBody] = result;
-        if (errorCode != ErrorCode::NoError) {
-            return qMakePair(errorCode, QJsonArray());
-        }
-
-        QJsonDocument doc = QJsonDocument::fromJson(responseBody);
-        QJsonArray newsArray;
-        if (doc.isArray()) {
-            newsArray = doc.array();
-        } else if (doc.isObject()) {
-            QJsonObject obj = doc.object();
-            if (obj.value("news").isArray()) {
-                newsArray = obj.value("news").toArray();
-            }
-        }
-
-        return qMakePair(ErrorCode::NoError, newsArray);
-    });
-}
--- a/client/core/controllers/api/newsController.h
+++ b/client/core/controllers/api/newsController.h
@@ -1,30 +0,0 @@
-#ifndef NEWSCONTROLLER_H
-#define NEWSCONTROLLER_H
-
-#include <QFuture>
-#include <QJsonArray>
-#include <QJsonObject>
-#include <QPair>
-
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-#include "core/repositories/secureServersRepository.h"
-
-class NewsController
-{
-public:
-    explicit NewsController(SecureAppSettingsRepository* appSettingsRepository,
-                           SecureServersRepository* serversRepository);
-
-    QFuture<QPair<ErrorCode, QJsonArray>> fetchNews();
-
-private:
-    QJsonObject getServicesList() const;
-
-    SecureAppSettingsRepository* m_appSettingsRepository;
-    SecureServersRepository* m_serversRepository;
-};
-
-#endif // NEWSCONTROLLER_H
--- a/client/core/controllers/api/pairingController.cpp
+++ b/client/core/controllers/api/pairingController.cpp
@@ -1,204 +0,0 @@
-#include "pairingController.h"
-
-#include <QJsonDocument>
-#include <QSysInfo>
-#include "core/repositories/secureAppSettingsRepository.h"
-#include "core/utils/api/apiUtils.h"
-#include "core/utils/constants/apiConstants.h"
-#include "core/utils/constants/apiKeys.h"
-#include "version.h"
-
-using namespace amnezia;
-
-namespace
-{
-constexpr qsizetype kPairingMaxQrUuidChars = 128;
-constexpr qsizetype kPairingMaxVpnConfigChars = 256 * 1024;
-constexpr qsizetype kPairingMaxApiKeyChars = 8192;
-constexpr qsizetype kPairingMaxServiceTypeChars = 64;
-constexpr qsizetype kPairingMaxUserCountryCodeChars = 32;
-
-ErrorCode applyGatewayOrOpenApiGenerateError(const QJsonObject &obj, PairingController::QrPairingConfigPayload &outPayload)
-{
-    ErrorCode apiStatus = apiUtils::errorCodeFromGatewayJsonHttpStatus(obj);
-    if (apiStatus != ErrorCode::NoError) {
-        return apiStatus;
-    }
-
-    const QString config = obj.value(apiDefs::key::config).toString();
-    if (!config.isEmpty()) {
-        outPayload.config = config;
-        outPayload.serviceInfo = obj.value(apiDefs::key::serviceInfo).toObject();
-        outPayload.supportedProtocols = obj.value(apiDefs::key::supportedProtocols).toArray();
-        return ErrorCode::NoError;
-    }
-
-    if (obj.contains(QStringLiteral("detail"))) {
-        return ErrorCode::ApiConfigEmptyError;
-    }
-
-    const QString msg = obj.value(QStringLiteral("message")).toString();
-    if (msg.contains(QStringLiteral("timeout"), Qt::CaseInsensitive)) {
-        return ErrorCode::ApiConfigTimeoutError;
-    }
-    if (msg.contains(QStringLiteral("Too Many"), Qt::CaseInsensitive)) {
-        return ErrorCode::ApiPairingRateLimitedError;
-    }
-    if (msg.contains(QStringLiteral("Unavailable"), Qt::CaseInsensitive)) {
-        return ErrorCode::ApiPairingServiceUnavailableError;
-    }
-    if (!msg.isEmpty()) {
-        return ErrorCode::ApiConfigDownloadError;
-    }
-
-    return ErrorCode::ApiConfigEmptyError;
-}
-
-ErrorCode applyGatewayOrOpenApiScanError(const QJsonObject &obj)
-{
-    const QString msgProbe = obj.value(QStringLiteral("message")).toString();
-    if (msgProbe.contains(QStringLiteral("limit"), Qt::CaseInsensitive)
-        && (msgProbe.contains(QStringLiteral("device"), Qt::CaseInsensitive)
-            || msgProbe.contains(QStringLiteral("maximum"), Qt::CaseInsensitive)
-            || msgProbe.contains(QStringLiteral("max"), Qt::CaseInsensitive))) {
-        return ErrorCode::ApiConfigLimitError;
-    }
-
-    ErrorCode apiStatus = apiUtils::errorCodeFromGatewayJsonHttpStatus(obj);
-    if (apiStatus != ErrorCode::NoError) {
-        return apiStatus;
-    }
-
-    if (obj.value(QStringLiteral("message")).toString() == QLatin1String("OK")) {
-        return ErrorCode::NoError;
-    }
-
-    if (obj.contains(QStringLiteral("detail"))) {
-        return ErrorCode::ApiPairingForbiddenError;
-    }
-
-    const QString msg = obj.value(QStringLiteral("message")).toString();
-    if (msg.contains(QStringLiteral("QR session"), Qt::CaseInsensitive)
-        && (msg.contains(QStringLiteral("not found"), Qt::CaseInsensitive)
-            || msg.contains(QStringLiteral("expired"), Qt::CaseInsensitive))) {
-        return ErrorCode::ApiPairingSessionExpiredError;
-    }
-    if (msg.contains(QStringLiteral("not found"), Qt::CaseInsensitive) || msg.contains(QStringLiteral("expired"), Qt::CaseInsensitive)) {
-        return ErrorCode::ApiNotFoundError;
-    }
-    if (msg.contains(QStringLiteral("Conflict"), Qt::CaseInsensitive) || msg.contains(QStringLiteral("already"), Qt::CaseInsensitive)) {
-        return ErrorCode::ApiPairingConflictError;
-    }
-    if (msg.contains(QStringLiteral("Too Many"), Qt::CaseInsensitive)) {
-        return ErrorCode::ApiPairingRateLimitedError;
-    }
-    if (msg.contains(QStringLiteral("Unavailable"), Qt::CaseInsensitive)) {
-        return ErrorCode::ApiPairingServiceUnavailableError;
-    }
-    if (!msg.isEmpty()) {
-        return ErrorCode::ApiConfigDownloadError;
-    }
-
-    return ErrorCode::ApiConfigEmptyError;
-}
-
-ErrorCode interpretGenerateQrJson(const QJsonObject &obj, PairingController::QrPairingConfigPayload &outPayload)
-{
-    return applyGatewayOrOpenApiGenerateError(obj, outPayload);
-}
-
-ErrorCode interpretScanQrJson(const QJsonObject &obj)
-{
-    return applyGatewayOrOpenApiScanError(obj);
-}
-} // namespace
-
-ErrorCode PairingController::parseGenerateQrResponseBody(const QByteArray &responseBody, QrPairingConfigPayload &outPayload)
-{
-    outPayload = QrPairingConfigPayload {};
-    const QJsonObject obj = QJsonDocument::fromJson(responseBody).object();
-    return interpretGenerateQrJson(obj, outPayload);
-}
-
-ErrorCode PairingController::parseScanQrResponseBody(const QByteArray &responseBody, QString *outOptionalDisplayName)
-{
-    if (outOptionalDisplayName) {
-        outOptionalDisplayName->clear();
-    }
-    const QJsonObject obj = QJsonDocument::fromJson(responseBody).object();
-    const ErrorCode err = interpretScanQrJson(obj);
-    if (err != ErrorCode::NoError) {
-        return err;
-    }
-    if (outOptionalDisplayName) {
-        const QString deviceName = obj.value(QStringLiteral("device_name")).toString().trimmed();
-        if (!deviceName.isEmpty()) {
-            *outOptionalDisplayName = deviceName;
-        }
-    }
-    return ErrorCode::NoError;
-}
-
-ErrorCode PairingController::validatePairingScanFields(const QString &qrUuid, const QString &vpnConfig, const QString &apiKey,
-                                                       const QString &serviceType, const QString &userCountryCode)
-{
-    if (qrUuid.size() > kPairingMaxQrUuidChars) {
-        return ErrorCode::ApiConfigEmptyError;
-    }
-    if (vpnConfig.size() > kPairingMaxVpnConfigChars) {
-        return ErrorCode::ApiPairingPayloadTooLargeError;
-    }
-    if (apiKey.size() > kPairingMaxApiKeyChars) {
-        return ErrorCode::ApiPairingPayloadTooLargeError;
-    }
-    const QString st = serviceType.trimmed();
-    const QString cc = userCountryCode.trimmed();
-    if (st.isEmpty() || cc.isEmpty()) {
-        return ErrorCode::ApiPairingMissingMetadataError;
-    }
-    if (st.size() > kPairingMaxServiceTypeChars || cc.size() > kPairingMaxUserCountryCodeChars) {
-        return ErrorCode::ApiPairingPayloadTooLargeError;
-    }
-    return ErrorCode::NoError;
-}
-
-PairingController::PairingController(SecureAppSettingsRepository *appSettingsRepository)
-    : m_appSettingsRepository(appSettingsRepository)
-{
-}
-
-int PairingController::pairingLongPollTimeoutMsecs() const
-{
-    return 60 * 1000;
-}
-
-QJsonObject PairingController::buildGenerateQrPayload(const QString &qrUuid) const
-{
-    QJsonObject o;
-    o[apiDefs::key::qrUuid] = qrUuid;
-    o[apiDefs::key::installationUuid] = m_appSettingsRepository->getInstallationUuid(true);
-    o[apiDefs::key::appVersion] = QString(APP_VERSION);
-    o[apiDefs::key::osVersion] = QSysInfo::productType();
-    return o;
-}
-
-QJsonObject PairingController::buildScanQrPayload(const QString &qrUuid, const QString &vpnConfig, const QJsonObject &serviceInfo,
-                                                    const QJsonArray &supportedProtocols, const QString &apiKey,
-                                                    const QString &serviceType, const QString &userCountryCode) const
-{
-    QJsonObject auth;
-    auth[apiDefs::key::apiKey] = apiKey;
-
-    QJsonObject o;
-    o[apiDefs::key::qrUuid] = qrUuid;
-    o[apiDefs::key::config] = vpnConfig;
-    o[apiDefs::key::serviceInfo] = serviceInfo;
-    o[apiDefs::key::supportedProtocols] = supportedProtocols;
-    o[apiDefs::key::authData] = auth;
-    o[apiDefs::key::installationUuid] = m_appSettingsRepository->getInstallationUuid(true);
-    o[apiDefs::key::appVersion] = QString(APP_VERSION);
-    o[apiDefs::key::osVersion] = QSysInfo::productType();
-    o[apiDefs::key::serviceType] = serviceType.trimmed();
-    o[apiDefs::key::userCountryCode] = userCountryCode.trimmed();
-    return o;
-}
--- a/client/core/controllers/api/pairingController.h
+++ b/client/core/controllers/api/pairingController.h
@@ -1,41 +0,0 @@
-#ifndef PAIRINGCONTROLLER_H
-#define PAIRINGCONTROLLER_H
-
-#include <QJsonArray>
-#include <QJsonObject>
-#include <QString>
-
-#include "core/utils/errorCodes.h"
-
-class SecureAppSettingsRepository;
-
-class PairingController
-{
-public:
-    struct QrPairingConfigPayload
-    {
-        QString config;
-        QJsonObject serviceInfo;
-        QJsonArray supportedProtocols;
-    };
-
-    explicit PairingController(SecureAppSettingsRepository *appSettingsRepository);
-
-    int pairingLongPollTimeoutMsecs() const;
-
-    QJsonObject buildGenerateQrPayload(const QString &qrUuid) const;
-    QJsonObject buildScanQrPayload(const QString &qrUuid, const QString &vpnConfig, const QJsonObject &serviceInfo,
-                                   const QJsonArray &supportedProtocols, const QString &apiKey, const QString &serviceType,
-                                   const QString &userCountryCode) const;
-
-    static amnezia::ErrorCode parseGenerateQrResponseBody(const QByteArray &responseBody, QrPairingConfigPayload &outPayload);
-    static amnezia::ErrorCode parseScanQrResponseBody(const QByteArray &responseBody, QString *outOptionalDisplayName = nullptr);
-
-    static amnezia::ErrorCode validatePairingScanFields(const QString &qrUuid, const QString &vpnConfig, const QString &apiKey,
-                                                        const QString &serviceType, const QString &userCountryCode);
-
-private:
-    SecureAppSettingsRepository *m_appSettingsRepository;
-};
-
-#endif // PAIRINGCONTROLLER_H
--- a/client/core/controllers/api/servicesCatalogController.cpp
+++ b/client/core/controllers/api/servicesCatalogController.cpp
@@ -1,248 +0,0 @@
-#include "servicesCatalogController.h"
-
-#include <QJsonDocument>
-#include <QSysInfo>
-#include <QJsonArray>
-#include <QEventLoop>
-#include <QDebug>
-#include <QCoreApplication>
-#include <QHash>
-#include <QSet>
-#include <limits>
-
-#include "core/controllers/gatewayController.h"
-#include "core/utils/serverConfigUtils.h"
-#include "core/utils/constants/apiKeys.h"
-#include "core/utils/constants/apiConstants.h"
-#include "version.h"
-
-#if defined(Q_OS_IOS) || defined(MACOS_NE)
-#include "platforms/ios/ios_controller.h"
-#endif
-
-namespace
-{
-    namespace configKey
-    {
-        constexpr char serviceDescription[] = "service_description";
-        constexpr char subscriptionPlans[] = "subscription_plans";
-        constexpr char storeProductId[] = "store_product_id";
-        constexpr char priceLabel[] = "price_label";
-        constexpr char subtitle[] = "subtitle";
-        constexpr char isTrial[] = "is_trial";
-        constexpr char minPriceLabel[] = "min_price_label";
-    }
-
-    namespace serviceType
-    {
-        constexpr char amneziaPremium[] = "amnezia-premium";
-    }
-
-#if defined(Q_OS_IOS) || defined(MACOS_NE)
-    struct StoreKitPlanQuote {
-        QString displayPrice;
-        double priceAmount = 0.0;
-        double subscriptionBillingMonths = 0.0;
-        QString displayPricePerMonth;
-    };
-
-    constexpr double oneMonthThreshold = 1.0 + 1e-6;
-    constexpr double monthsFallbackThreshold = 1e-6;
-    constexpr double monthlyPriceEpsilon = 1e-9;
-
-    QStringList collectPremiumStoreProductIds(const QJsonArray &services)
-    {
-        QStringList productIds;
-        QSet<QString> seenProductIds;
-        for (const QJsonValue &serviceValue : services) {
-            const QJsonObject serviceObject = serviceValue.toObject();
-            if (serviceObject.value(apiDefs::key::serviceType).toString() != serviceType::amneziaPremium) {
-                continue;
-            }
-            const QJsonArray subscriptionPlans =
-                    serviceObject.value(configKey::serviceDescription).toObject().value(configKey::subscriptionPlans).toArray();
-            for (const QJsonValue &planValue : subscriptionPlans) {
-                if (!planValue.isObject()) {
-                    continue;
-                }
-                const QString storeProductId = planValue.toObject().value(configKey::storeProductId).toString();
-                if (storeProductId.isEmpty() || seenProductIds.contains(storeProductId)) {
-                    continue;
-                }
-                seenProductIds.insert(storeProductId);
-                productIds.append(storeProductId);
-            }
-        }
-        return productIds;
-    }
-
-    QHash<QString, StoreKitPlanQuote> buildStoreKitQuoteMap(const QList<QVariantMap> &fetchedProducts)
-    {
-        QHash<QString, StoreKitPlanQuote> quotesByProductId;
-        quotesByProductId.reserve(fetchedProducts.size());
-
-        for (const QVariantMap &productInfo : fetchedProducts) {
-            const QString productId = productInfo.value(QStringLiteral("productId")).toString();
-            if (productId.isEmpty()) {
-                continue;
-            }
-
-            QString displayPrice = productInfo.value(QStringLiteral("displayPrice")).toString();
-            if (displayPrice.isEmpty()) {
-                const QString price = productInfo.value(QStringLiteral("price")).toString();
-                const QString currencyCode = productInfo.value(QStringLiteral("currencyCode")).toString();
-                displayPrice = currencyCode.isEmpty() ? price : (price + QLatin1Char(' ') + currencyCode);
-            }
-
-            StoreKitPlanQuote quote;
-            quote.displayPrice = displayPrice;
-            quote.priceAmount = productInfo.value(QStringLiteral("priceAmount")).toDouble();
-            quote.subscriptionBillingMonths = productInfo.value(QStringLiteral("subscriptionBillingMonths")).toDouble();
-            quote.displayPricePerMonth = productInfo.value(QStringLiteral("displayPricePerMonth")).toString();
-            quotesByProductId.insert(productId, quote);
-        }
-
-        return quotesByProductId;
-    }
-
-    void mergeStoreKitPricesIntoPremiumPlans(QJsonObject &data)
-    {
-        QJsonArray services = data.value(apiDefs::key::services).toArray();
-        if (services.isEmpty()) {
-            return;
-        }
-
-        const QStringList productIds = collectPremiumStoreProductIds(services);
-        if (productIds.isEmpty()) {
-            qInfo().noquote() << "[IAP] No store_product_id in premium plans; skip StoreKit merge into services payload";
-            return;
-        }
-
-        QList<QVariantMap> fetchedProducts;
-        QEventLoop loop;
-        IosController::Instance()->fetchProducts(productIds,
-                                                 [&](const QList<QVariantMap> &products, const QStringList &invalidIds,
-                                                     const QString &errorString) {
-                                                     if (!errorString.isEmpty()) {
-                                                         qWarning().noquote() << "[IAP] StoreKit merge fetch:" << errorString;
-                                                     }
-                                                     if (!invalidIds.isEmpty()) {
-                                                         qWarning().noquote() << "[IAP] Unknown App Store product ids:" << invalidIds;
-                                                     }
-                                                     fetchedProducts = products;
-                                                     loop.quit();
-                                                 });
-        loop.exec();
-
-        const QHash<QString, StoreKitPlanQuote> quotesByProductId = buildStoreKitQuoteMap(fetchedProducts);
-
-        for (int serviceIndex = 0; serviceIndex < services.size(); ++serviceIndex) {
-            QJsonObject serviceObject = services.at(serviceIndex).toObject();
-            if (serviceObject.value(apiDefs::key::serviceType).toString() != serviceType::amneziaPremium) {
-                continue;
-            }
-
-            QJsonObject descriptionObject = serviceObject.value(configKey::serviceDescription).toObject();
-            const QJsonArray sourcePlans = descriptionObject.value(configKey::subscriptionPlans).toArray();
-
-            QJsonArray mergedPlans;
-            double minMonthlyAmount = std::numeric_limits<double>::infinity();
-            QString minMonthlyDisplay;
-
-            for (const QJsonValue &planValue : sourcePlans) {
-                if (!planValue.isObject()) {
-                    continue;
-                }
-
-                QJsonObject planObject = planValue.toObject();
-                const QString storeProductId = planObject.value(configKey::storeProductId).toString();
-                if (storeProductId.isEmpty()) {
-                    continue;
-                }
-
-                const auto quoteIterator = quotesByProductId.constFind(storeProductId);
-                if (quoteIterator == quotesByProductId.cend()) {
-                    continue;
-                }
-
-                const bool isTrialPlan = planObject.value(configKey::isTrial).toBool();
-                const StoreKitPlanQuote &quote = *quoteIterator;
-                planObject.insert(configKey::priceLabel, quote.displayPrice);
-
-                const double months = quote.subscriptionBillingMonths;
-                if (!isTrialPlan && months > oneMonthThreshold && !quote.displayPricePerMonth.isEmpty()) {
-                    planObject.insert(
-                            configKey::subtitle,
-                            QCoreApplication::translate("ServicesCatalogController", "%1/mo",
-                                                        "IAP: price per month in plan subtitle")
-                                    .arg(quote.displayPricePerMonth));
-                }
-
-                if (!isTrialPlan && quote.priceAmount > 0.0) {
-                    const double monthsForMin = months > monthsFallbackThreshold ? months : 1.0;
-                    const double monthly = quote.priceAmount / monthsForMin;
-                    if (monthly < minMonthlyAmount - monthlyPriceEpsilon) {
-                        minMonthlyAmount = monthly;
-                        minMonthlyDisplay = !quote.displayPricePerMonth.isEmpty() ? quote.displayPricePerMonth : quote.displayPrice;
-                    }
-                }
-
-                mergedPlans.append(planObject);
-            }
-
-            descriptionObject.insert(configKey::subscriptionPlans, mergedPlans);
-            if (minMonthlyAmount < std::numeric_limits<double>::infinity() && !minMonthlyDisplay.isEmpty()) {
-                descriptionObject.insert(configKey::minPriceLabel,
-                                         QCoreApplication::translate("ServicesCatalogController", "from %1 per month",
-                                                                     "IAP: card footer minimum monthly price from StoreKit")
-                                                 .arg(minMonthlyDisplay));
-            }
-            serviceObject.insert(configKey::serviceDescription, descriptionObject);
-            services.replace(serviceIndex, serviceObject);
-        }
-        data.insert(apiDefs::key::services, services);
-    }
-#endif
-}
-
-ServicesCatalogController::ServicesCatalogController(SecureAppSettingsRepository* appSettingsRepository)
-    : m_appSettingsRepository(appSettingsRepository)
-{
-}
-
-ErrorCode ServicesCatalogController::fillAvailableServices(QJsonObject &servicesData)
-{
-    QJsonObject apiPayload;
-    apiPayload[apiDefs::key::osVersion] = QSysInfo::productType();
-    apiPayload[apiDefs::key::appVersion] = QString(APP_VERSION);
-    apiPayload[apiDefs::key::cliName] = QString(APPLICATION_NAME);
-    apiPayload[apiDefs::key::appLanguage] = m_appSettingsRepository->getAppLanguage().name().split("_").first();
-
-    QByteArray responseBody;
-    ErrorCode errorCode = executeRequest(QString("%1v1/services"), apiPayload, responseBody);
-    if (errorCode == ErrorCode::NoError) {
-        if (!responseBody.contains(apiDefs::key::services.data())) {
-            errorCode = ErrorCode::ApiServicesMissingError;
-        }
-    }
-
-    if (errorCode != ErrorCode::NoError) {
-        return errorCode;
-    }
-
-    servicesData = QJsonDocument::fromJson(responseBody).object();
-
-#if defined(Q_OS_IOS) || defined(MACOS_NE)
-    mergeStoreKitPricesIntoPremiumPlans(servicesData);
-#endif
-
-    return ErrorCode::NoError;
-}
-
-ErrorCode ServicesCatalogController::executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody)
-{
-    GatewayController gatewayController(m_appSettingsRepository->getGatewayEndpoint(), m_appSettingsRepository->isDevGatewayEnv(), apiDefs::requestTimeoutMsecs,
-                                        m_appSettingsRepository->isStrictKillSwitchEnabled());
-    return gatewayController.post(endpoint, apiPayload, responseBody);
-}
-
--- a/client/core/controllers/api/servicesCatalogController.h
+++ b/client/core/controllers/api/servicesCatalogController.h
@@ -1,26 +0,0 @@
-#ifndef SERVICESCATALOGCONTROLLER_H
-#define SERVICESCATALOGCONTROLLER_H
-
-#include <QJsonObject>
-#include <QByteArray>
-
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-
-class ServicesCatalogController
-{
-public:
-    explicit ServicesCatalogController(SecureAppSettingsRepository* appSettingsRepository);
-
-    ErrorCode fillAvailableServices(QJsonObject &servicesData);
-
-private:
-    ErrorCode executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody);
-
-    SecureAppSettingsRepository* m_appSettingsRepository;
-};
-
-#endif // SERVICESCATALOGCONTROLLER_H
-
--- a/client/core/controllers/api/subscriptionController.cpp
+++ b/client/core/controllers/api/subscriptionController.cpp
--- a/client/core/controllers/api/subscriptionController.h
+++ b/client/core/controllers/api/subscriptionController.h
@@ -1,120 +0,0 @@
-#ifndef SUBSCRIPTIONCONTROLLER_H
-#define SUBSCRIPTIONCONTROLLER_H
-
-#include <QJsonArray>
-#include <QJsonObject>
-#include <QByteArray>
-#include <QFuture>
-#include <QList>
-#include <QVariantMap>
-
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/repositories/secureServersRepository.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-
-class ServersController;
-
-class SubscriptionController
-{
-public:
-    struct ProtocolData
-    {
-        QString certRequest;
-        QString certPrivKey;
-        QString wireGuardClientPrivKey;
-        QString wireGuardClientPubKey;
-        QString xrayUuid;
-    };
-
-    struct GatewayRequestData
-    {
-        QString osVersion;
-        QString appVersion;
-        QString appLanguage;
-        QString installationUuid;
-        QString userCountryCode;
-        QString serverCountryCode;
-        QString serviceType;
-        QString serviceProtocol;
-        QJsonObject authData;
-
-        QJsonObject toJsonObject() const;
-    };
-
-    explicit SubscriptionController(SecureServersRepository* serversRepository,
-                                     SecureAppSettingsRepository* appSettingsRepository);
-
-    ProtocolData generateProtocolData(const QString &protocol);
-    void appendProtocolDataToApiPayload(const QString &protocol, const ProtocolData &protocolData, QJsonObject &apiPayload);
-
-    ErrorCode importServiceFromGateway(const QString &userCountryCode, const QString &serviceType,
-                                      const QString &serviceProtocol, const ProtocolData &protocolData);
-    ErrorCode importTrialFromGateway(const QString &userCountryCode, const QString &serviceType,
-                                     const QString &serviceProtocol, const QString &email);
-
-    ErrorCode importServerFromQrPairingResponse(const QString &vpnConfigKey, const QJsonObject &serviceInfo,
-                                                const QJsonArray &supportedProtocols, int *duplicateServerIndex = nullptr);
-
-    ErrorCode importServiceFromAppStore(const QString &userCountryCode, const QString &serviceType,
-                                        const QString &serviceProtocol, const ProtocolData &protocolData,
-                                        const QString &transactionId, bool isTestPurchase,
-                                        int *duplicateServerIndex = nullptr);
-
-    ErrorCode updateServiceFromGateway(const QString &serverId, const QString &newCountryCode, bool isConnectEvent);
-
-    ErrorCode deactivateDevice(const QString &serverId);
-
-    ErrorCode deactivateExternalDevice(const QString &serverId, const QString &uuid, const QString &serverCountryCode);
-
-    ErrorCode exportNativeConfig(const QString &serverId, const QString &serverCountryCode, QString &nativeConfig);
-
-    ErrorCode revokeNativeConfig(const QString &serverId, const QString &serverCountryCode);
-
-    ErrorCode prepareVpnKeyExport(const QString &serverId, QString &vpnKey);
-
-    ErrorCode validateAndUpdateConfig(const QString &serverId, bool hasInstalledContainers);
-
-    void removeApiConfig(const QString &serverId);
-
-    bool removeServer(const QString &serverId);
-
-    void setCurrentProtocol(const QString &serverId, const QString &protocolName);
-    bool isVlessProtocol(const QString &serverId) const;
-
-    ErrorCode getAccountInfo(const QString &serverId, QJsonObject &accountInfo);
-    QFuture<QPair<ErrorCode, QString>> getRenewalLink(const QString &serverId);
-
-    struct AppStoreRestoreResult
-    {
-        bool hasInstalledConfig = false;
-        bool duplicateConfigAlreadyPresent = false;
-        int duplicateCount = 0;
-        int duplicateServerIndex = -1;
-        ErrorCode errorCode = ErrorCode::NoError;
-    };
-
-    ErrorCode processAppStorePurchase(const QString &userCountryCode, const QString &serviceType,
-                                     const QString &serviceProtocol, const QString &productId,
-                                     int *duplicateServerIndex = nullptr);
-
-    AppStoreRestoreResult processAppStoreRestore(const QString &userCountryCode, const QString &serviceType,
-                                                  const QString &serviceProtocol);
-
-private:
-    ErrorCode executeRequest(const QString &endpoint, const QJsonObject &apiPayload, QByteArray &responseBody, bool isTestPurchase = false);
-    bool isApiKeyExpired(const QString &serverId) const;
-    
-    ErrorCode extractServerConfigJsonFromResponse(const QByteArray &apiResponseBody, const QString &protocol, 
-                                                   const ProtocolData &protocolData, QJsonObject &serverConfigJson);
-    void updateApiConfigInJson(QJsonObject &serverConfigJson, const QString &serviceType, 
-                                const QString &serviceProtocol, const QString &userCountryCode,
-                                const QByteArray &apiResponseBody);
-
-    SecureServersRepository* m_serversRepository;
-    SecureAppSettingsRepository* m_appSettingsRepository;
-};
-
-#endif // SUBSCRIPTIONCONTROLLER_H
-
--- a/client/core/controllers/appSplitTunnelingController.cpp
+++ b/client/core/controllers/appSplitTunnelingController.cpp
@@ -1,70 +0,0 @@
-#include "appSplitTunnelingController.h"
-
-AppSplitTunnelingController::AppSplitTunnelingController(SecureAppSettingsRepository* appSettingsRepository)
-    : m_appSettingsRepository(appSettingsRepository)
-{
-    m_currentRouteMode = m_appSettingsRepository->appsRouteMode();
-    if (m_currentRouteMode == AppsRouteMode::VpnAllApps) { // for old split tunneling configs
-        m_currentRouteMode = AppsRouteMode::VpnAllExceptApps;
-        m_apps = m_appSettingsRepository->vpnApps(m_currentRouteMode);
-        m_appSettingsRepository->setAppsRouteMode(AppsRouteMode::VpnAllExceptApps);
-    } else {
-        m_apps = m_appSettingsRepository->vpnApps(m_currentRouteMode);
-    }
-}
-
-bool AppSplitTunnelingController::addApp(const amnezia::InstalledAppInfo &appInfo)
-{
-    if (m_apps.contains(appInfo)) {
-        return false;
-    }
-
-    m_apps.append(appInfo);
-    m_appSettingsRepository->setVpnApps(m_currentRouteMode, m_apps);
-
-    return true;
-}
-
-void AppSplitTunnelingController::removeApp(int index)
-{
-    if (index < 0 || index >= m_apps.size()) {
-        return;
-    }
-
-    m_apps.removeAt(index);
-    m_appSettingsRepository->setVpnApps(m_currentRouteMode, m_apps);
-}
-
-void AppSplitTunnelingController::clearAppsList()
-{
-    m_apps.clear();
-    m_appSettingsRepository->setVpnApps(m_currentRouteMode, m_apps);
-}
-
-void AppSplitTunnelingController::setRouteMode(AppsRouteMode routeMode)
-{
-    m_currentRouteMode = routeMode;
-    m_apps = m_appSettingsRepository->vpnApps(m_currentRouteMode);
-    m_appSettingsRepository->setAppsRouteMode(routeMode);
-}
-
-void AppSplitTunnelingController::toggleSplitTunneling(bool enabled)
-{
-    m_appSettingsRepository->setAppsSplitTunnelingEnabled(enabled);
-}
-
-AppsRouteMode AppSplitTunnelingController::getRouteMode() const
-{
-    return m_currentRouteMode;
-}
-
-bool AppSplitTunnelingController::isSplitTunnelingEnabled() const
-{
-    return m_appSettingsRepository->isAppsSplitTunnelingEnabled();
-}
-
-QVector<amnezia::InstalledAppInfo> AppSplitTunnelingController::getApps() const
-{
-    return m_apps;
-}
-
--- a/client/core/controllers/appSplitTunnelingController.h
+++ b/client/core/controllers/appSplitTunnelingController.h
@@ -1,32 +0,0 @@
-#ifndef APPSPLITTUNNELINGCONTROLLER_H
-#define APPSPLITTUNNELINGCONTROLLER_H
-
-#include <QVector>
-
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-
-class AppSplitTunnelingController
-{
-public:
-    explicit AppSplitTunnelingController(SecureAppSettingsRepository* appSettingsRepository);
-
-    bool addApp(const amnezia::InstalledAppInfo &appInfo);
-    void removeApp(int index);
-    void clearAppsList();
-    void setRouteMode(AppsRouteMode routeMode);
-    void toggleSplitTunneling(bool enabled);
-
-    AppsRouteMode getRouteMode() const;
-    bool isSplitTunnelingEnabled() const;
-    QVector<amnezia::InstalledAppInfo> getApps() const;
-
-private:
-    SecureAppSettingsRepository* m_appSettingsRepository;
-    AppsRouteMode m_currentRouteMode;
-    QVector<amnezia::InstalledAppInfo> m_apps;
-};
-
-#endif // APPSPLITTUNNELINGCONTROLLER_H
-
--- a/client/core/controllers/connectionController.cpp
+++ b/client/core/controllers/connectionController.cpp
@@ -1,248 +0,0 @@
-#include "connectionController.h"
-
-#include <QJsonDocument>
-
-#include "core/configurators/configuratorBase.h"
-#include "core/utils/protocolEnum.h"
-#include "core/protocols/protocolUtils.h"
-#include "core/utils/constants/configKeys.h"
-#include "core/utils/constants/protocolConstants.h"
-#include "core/utils/utilities.h"
-#include "core/utils/networkUtilities.h"
-#include "core/utils/serverConfigUtils.h"
-#include "version.h"
-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/models/containerConfig.h"
-#include "core/models/protocolConfig.h"
-
-using namespace amnezia;
-using namespace ProtocolUtils;
-
-ConnectionController::ConnectionController(SecureServersRepository* serversRepository,
-                                         SecureAppSettingsRepository* appSettingsRepository,
-                                         VpnConnection* vpnConnection,
-                                         QObject* parent)
-    : QObject(parent),
-      m_serversRepository(serversRepository),
-      m_appSettingsRepository(appSettingsRepository),
-      m_vpnConnection(vpnConnection)
-{
-    connect(m_vpnConnection, &VpnConnection::connectionStateChanged, this, &ConnectionController::connectionStateChanged);
-    connect(this, &ConnectionController::openConnectionRequested, m_vpnConnection, &VpnConnection::connectToVpn, Qt::QueuedConnection);
-    connect(this, &ConnectionController::closeConnectionRequested, m_vpnConnection, &VpnConnection::disconnectFromVpn, Qt::QueuedConnection);
-    connect(this, &ConnectionController::setConnectionStateRequested, m_vpnConnection, &VpnConnection::setConnectionState, Qt::QueuedConnection);
-    connect(this, &ConnectionController::killSwitchModeChangedRequested, m_vpnConnection, &VpnConnection::onKillSwitchModeChanged, Qt::QueuedConnection);
-#ifdef Q_OS_ANDROID
-    connect(this, &ConnectionController::restoreConnectionRequested, m_vpnConnection, &VpnConnection::restoreConnection, Qt::QueuedConnection);
-#endif
-}
-
-bool ConnectionController::isConnected() const
-{
-    return m_vpnConnection && m_vpnConnection->connectionState() == Vpn::ConnectionState::Connected;
-}
-
-void ConnectionController::setConnectionState(Vpn::ConnectionState state)
-{
-    if (m_vpnConnection) {
-        emit setConnectionStateRequested(state);
-    }
-}
-
-ErrorCode ConnectionController::prepareConnection(const QString &serverId,
-                                                 QJsonObject& vpnConfiguration,
-                                                 DockerContainer& container)
-{
-    if (!isServiceReady()) {
-        return ErrorCode::AmneziaServiceNotRunning;
-    }
-
-    ContainerConfig containerConfigModel;
-    QPair<QString, QString> dns;
-    QString hostName;
-    QString description;
-    int configVersion = 0;
-    bool isApiConfig = false;
-
-    const auto kind = m_serversRepository->serverKind(serverId);
-    switch (kind) {
-    case serverConfigUtils::ConfigType::SelfHostedAdmin: {
-        const auto cfg = m_serversRepository->selfHostedAdminConfig(serverId);
-        if (!cfg.has_value()) return ErrorCode::InternalError;
-        container = cfg->defaultContainer;
-        containerConfigModel = cfg->containerConfig(container);
-        dns = { cfg->dns1, cfg->dns2 };
-        hostName = cfg->hostName;
-        description = cfg->description;
-        break;
-    }
-    case serverConfigUtils::ConfigType::SelfHostedUser: {
-        const auto cfg = m_serversRepository->selfHostedUserConfig(serverId);
-        if (!cfg.has_value()) return ErrorCode::InternalError;
-        container = cfg->defaultContainer;
-        containerConfigModel = cfg->containerConfig(container);
-        dns = { cfg->dns1, cfg->dns2 };
-        hostName = cfg->hostName;
-        description = cfg->description;
-        break;
-    }
-    case serverConfigUtils::ConfigType::Native: {
-        const auto cfg = m_serversRepository->nativeConfig(serverId);
-        if (!cfg.has_value()) return ErrorCode::InternalError;
-        container = cfg->defaultContainer;
-        containerConfigModel = cfg->containerConfig(container);
-        dns = { cfg->dns1, cfg->dns2 };
-        hostName = cfg->hostName;
-        description = cfg->description;
-        break;
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV2:
-    case serverConfigUtils::ConfigType::AmneziaFreeV3:
-    case serverConfigUtils::ConfigType::ExternalPremium: {
-        const auto cfg = m_serversRepository->apiV2Config(serverId);
-        if (!cfg.has_value()) return ErrorCode::InternalError;
-        container = cfg->defaultContainer;
-        containerConfigModel = cfg->containerConfig(container);
-        dns = { cfg->dns1, cfg->dns2 };
-        hostName = cfg->hostName;
-        description = cfg->description;
-        configVersion = serverConfigUtils::ConfigSource::AmneziaGateway;
-        isApiConfig = true;
-        break;
-    }
-    case serverConfigUtils::ConfigType::AmneziaPremiumV1:
-    case serverConfigUtils::ConfigType::AmneziaFreeV2:
-        return ErrorCode::InternalError;
-    case serverConfigUtils::ConfigType::Invalid:
-    default:
-        return ErrorCode::InternalError;
-    }
-
-    if (!isContainerSupported(container)) {
-        return ErrorCode::NotSupportedOnThisPlatform;
-    }
-    if (dns.first.isEmpty() || !NetworkUtilities::checkIPv4Format(dns.first)) {
-        if (m_appSettingsRepository->useAmneziaDns()) {
-            dns.first = protocols::dns::amneziaDnsIp;
-        } else {
-            dns.first = m_appSettingsRepository->primaryDns();
-        }
-    }
-    if (dns.second.isEmpty() || !NetworkUtilities::checkIPv4Format(dns.second)) {
-        dns.second = m_appSettingsRepository->secondaryDns();
-    }
-
-    vpnConfiguration = createConnectionConfiguration(dns, isApiConfig, hostName, description, configVersion,
-                                                     containerConfigModel, container);
-
-    return ErrorCode::NoError;
-}
-
-ErrorCode ConnectionController::openConnection(const QString &serverId)
-{
-    QJsonObject vpnConfiguration;
-    DockerContainer container;
-
-    ErrorCode errorCode = prepareConnection(serverId, vpnConfiguration, container);
-    if (errorCode != ErrorCode::NoError) {
-        return errorCode;
-    }
-
-    emit openConnectionRequested(serverId, container, vpnConfiguration);
-    return ErrorCode::NoError;
-}
-
-void ConnectionController::closeConnection()
-{
-    if (m_vpnConnection) {
-        emit closeConnectionRequested();
-    }
-}
-
-#ifdef Q_OS_ANDROID
-void ConnectionController::restoreConnection()
-{
-    if (m_vpnConnection) {
-        emit restoreConnectionRequested();
-    }
-}
-#endif
-
-void ConnectionController::onKillSwitchModeChanged(bool enabled)
-{
-    if (m_vpnConnection) {
-        emit killSwitchModeChangedRequested(enabled);
-    }
-}
-
-ErrorCode ConnectionController::lastConnectionError() const
-{
-    return m_vpnConnection->lastError();
-}
-
-QJsonObject ConnectionController::createConnectionConfiguration(const QPair<QString, QString> &dns,
-                                                              bool isApiConfig,
-                                                              const QString &hostName,
-                                                              const QString &description,
-                                                              int configVersion,
-                                                              const ContainerConfig &containerConfig,
-                                                              DockerContainer container)
-{
-    QJsonObject vpnConfiguration {};
-
-    if (ContainerUtils::containerService(container) == ServiceType::Other) {
-        return vpnConfiguration;
-    }
-
-    Proto proto = ContainerUtils::defaultProtocol(container);
-
-    ConnectionSettings connectionSettings = {
-        { dns.first, dns.second },
-        isApiConfig,
-        {
-            m_appSettingsRepository->isSitesSplitTunnelingEnabled(),
-            m_appSettingsRepository->routeMode()
-        }
-    };
-
-    auto configurator = ConfiguratorBase::create(proto, nullptr);
-    ProtocolConfig processedConfig = configurator->processConfigWithLocalSettings(connectionSettings,
-                                                                                  containerConfig.protocolConfig);
-
-    QJsonObject vpnConfigData = processedConfig.getClientConfigJson();
-    if (ContainerUtils::isAwgContainer(container) || container == DockerContainer::WireGuard) {
-        if (vpnConfigData[configKey::mtu].toString().isEmpty()) {
-            vpnConfigData[configKey::mtu] =
-                    ContainerUtils::isAwgContainer(container) ? protocols::awg::defaultMtu :
-                    protocols::wireguard::defaultMtu;
-        }
-    }
-
-    vpnConfiguration.insert(ProtocolUtils::key_proto_config_data(proto), vpnConfigData);
-    vpnConfiguration[configKey::vpnProto] = ProtocolUtils::protoToString(proto);
-
-    vpnConfiguration[configKey::dns1] = dns.first;
-    vpnConfiguration[configKey::dns2] = dns.second;
-
-    vpnConfiguration[configKey::hostName] = hostName;
-    vpnConfiguration[configKey::description] = description;
-    vpnConfiguration[configKey::configVersion] = configVersion;
-
-    return vpnConfiguration;
-}
-
-bool ConnectionController::isServiceReady() const
-{
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS) && !defined(MACOS_NE)
-    return Utils::processIsRunning(Utils::executable(SERVICE_NAME, false), true);
-#else
-    return true;
-#endif
-}
-
-bool ConnectionController::isContainerSupported(DockerContainer container) const
-{
-    return ContainerUtils::isSupportedByCurrentPlatform(container);
-}
--- a/client/core/controllers/connectionController.h
+++ b/client/core/controllers/connectionController.h
@@ -1,81 +0,0 @@
-#ifndef CONNECTIONCONTROLLER_H
-#define CONNECTIONCONTROLLER_H
-
-#include <QObject>
-#include <QJsonObject>
-#include <QPair>
-#include <memory>
-
-#include "core/utils/containerEnum.h"
-#include "core/utils/containers/containerUtils.h"
-#include "core/utils/protocolEnum.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/repositories/secureServersRepository.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-#include "core/protocols/vpnProtocol.h"
-#include "vpnConnection.h"
-
-using namespace amnezia;
-
-class ConnectionController : public QObject
-{
-    Q_OBJECT
-
-public:
-    explicit ConnectionController(SecureServersRepository* serversRepository,
-                                 SecureAppSettingsRepository* appSettingsRepository,
-                                 VpnConnection* vpnConnection,
-                                 QObject* parent = nullptr);
-    ~ConnectionController() = default;
-
-    ErrorCode prepareConnection(const QString &serverId,
-                               QJsonObject& vpnConfiguration,
-                               DockerContainer& container);
-
-    ErrorCode openConnection(const QString &serverId);
-
-    void closeConnection();
-
-#ifdef Q_OS_ANDROID
-    void restoreConnection();
-#endif
-
-    void onKillSwitchModeChanged(bool enabled);
-
-    ErrorCode lastConnectionError() const;
-
-    bool isConnected() const;
-    void setConnectionState(Vpn::ConnectionState state);
-
-    QJsonObject createConnectionConfiguration(const QPair<QString, QString> &dns,
-                                             bool isApiConfig,
-                                             const QString &hostName,
-                                             const QString &description,
-                                             int configVersion,
-                                             const ContainerConfig &containerConfig,
-                                             DockerContainer container);
-
-    bool isServiceReady() const;
-
-    bool isContainerSupported(DockerContainer container) const;
-
-signals:
-    void connectionStateChanged(Vpn::ConnectionState state);
-    void openConnectionRequested(const QString &serverId, DockerContainer container, const QJsonObject &vpnConfiguration);
-    void closeConnectionRequested();
-    void setConnectionStateRequested(Vpn::ConnectionState state);
-    void killSwitchModeChangedRequested(bool enabled);
-
-#ifdef Q_OS_ANDROID
-    void restoreConnectionRequested();
-#endif
-
-private:
-    SecureServersRepository* m_serversRepository;
-    SecureAppSettingsRepository* m_appSettingsRepository;
-    VpnConnection* m_vpnConnection;
-};
-
-#endif
--- a/client/core/controllers/coreController.cpp
+++ b/client/core/controllers/coreController.cpp
@@ -2,17 +2,9 @@

 #include <QDirIterator>
 #include <QTranslator>
-#include <QTimer>
-
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/controllers/selfhosted/installController.h"
-#include "core/controllers/selfhosted/importController.h"
-#include "core/controllers/coreSignalHandlers.h"
-#include "logger.h"
-#include "secureQSettings.h"

 #if defined(Q_OS_ANDROID)
-    #include "core/utils/installedAppsImageProvider.h"
+    #include "core/installedAppsImageProvider.h"
    #include "platforms/android/android_controller.h"
 #endif

@@ -21,217 +13,149 @@
    #include <AmneziaVPN-Swift.h>
 #endif

-CoreController::CoreController(const QSharedPointer<VpnConnection> &vpnConnection, SecureQSettings* settings,
+CoreController::CoreController(const QSharedPointer<VpnConnection> &vpnConnection, const std::shared_ptr<Settings> &settings,
                               QQmlApplicationEngine *engine, QObject *parent)
    : QObject(parent), m_vpnConnection(vpnConnection), m_settings(settings), m_engine(engine)
 {
-    initRepositories();
-    initCoreControllers();
    initModels();
    initControllers();
    initSignalHandlers();

    initAndroidController();
    initAppleController();
-    initLogging();

-    m_translator = new QTranslator(this);
-    if (m_appSettingsRepository) {
-        updateTranslator(m_appSettingsRepository->getAppLanguage());
-    }
-}
+    initNotificationHandler();

-void CoreController::setQmlContextProperty(const QString &name, QObject *value)
-{
-    if (m_engine) {
-        m_engine->rootContext()->setContextProperty(name, value);
-    }
+    m_translator.reset(new QTranslator());
+    updateTranslator(m_settings->getAppLanguage());
 }

 void CoreController::initModels()
 {
-    m_containersModel = new ContainersModel(this);
-    setQmlContextProperty("ContainersModel", m_containersModel);
+    m_containersModel.reset(new ContainersModel(this));
+    m_engine->rootContext()->setContextProperty("ContainersModel", m_containersModel.get());

-    m_defaultServerContainersModel = new ContainersModel(this);
-    setQmlContextProperty("DefaultServerContainersModel", m_defaultServerContainersModel);
+    m_defaultServerContainersModel.reset(new ContainersModel(this));
+    m_engine->rootContext()->setContextProperty("DefaultServerContainersModel", m_defaultServerContainersModel.get());

-    m_serversModel = new ServersModel(this);
-    setQmlContextProperty("ServersModel", m_serversModel);
+    m_serversModel.reset(new ServersModel(m_settings, this));
+    m_engine->rootContext()->setContextProperty("ServersModel", m_serversModel.get());

-    m_languageModel = new LanguageModel(this);
-    setQmlContextProperty("LanguageModel", m_languageModel);
+    m_languageModel.reset(new LanguageModel(m_settings, this));
+    m_engine->rootContext()->setContextProperty("LanguageModel", m_languageModel.get());

-    m_ipSplitTunnelingModel = new IpSplitTunnelingModel(this);
-    setQmlContextProperty("IpSplitTunnelingModel", m_ipSplitTunnelingModel);
+    m_sitesModel.reset(new SitesModel(m_settings, this));
+    m_engine->rootContext()->setContextProperty("SitesModel", m_sitesModel.get());

-    m_allowedDnsModel = new AllowedDnsModel(this);
-    setQmlContextProperty("AllowedDnsModel", m_allowedDnsModel);
+    m_allowedDnsModel.reset(new AllowedDnsModel(m_settings, this));
+    m_engine->rootContext()->setContextProperty("AllowedDnsModel", m_allowedDnsModel.get());

-    m_appSplitTunnelingModel = new AppSplitTunnelingModel(this);
-    setQmlContextProperty("AppSplitTunnelingModel", m_appSplitTunnelingModel);
+    m_appSplitTunnelingModel.reset(new AppSplitTunnelingModel(m_settings, this));
+    m_engine->rootContext()->setContextProperty("AppSplitTunnelingModel", m_appSplitTunnelingModel.get());

-    m_protocolsModel = new ProtocolsModel(this);
-    setQmlContextProperty("ProtocolsModel", m_protocolsModel);
+    m_protocolsModel.reset(new ProtocolsModel(m_settings, this));
+    m_engine->rootContext()->setContextProperty("ProtocolsModel", m_protocolsModel.get());

-    m_openVpnConfigModel = new OpenVpnConfigModel(this);
-    setQmlContextProperty("OpenVpnConfigModel", m_openVpnConfigModel);
+    m_openVpnConfigModel.reset(new OpenVpnConfigModel(this));
+    m_engine->rootContext()->setContextProperty("OpenVpnConfigModel", m_openVpnConfigModel.get());

-    m_wireGuardConfigModel = new WireGuardConfigModel(this);
-    setQmlContextProperty("WireGuardConfigModel", m_wireGuardConfigModel);
+    m_shadowSocksConfigModel.reset(new ShadowSocksConfigModel(this));
+    m_engine->rootContext()->setContextProperty("ShadowSocksConfigModel", m_shadowSocksConfigModel.get());

-    m_awgConfigModel = new AwgConfigModel(this);
-    setQmlContextProperty("AwgConfigModel", m_awgConfigModel);
+    m_cloakConfigModel.reset(new CloakConfigModel(this));
+    m_engine->rootContext()->setContextProperty("CloakConfigModel", m_cloakConfigModel.get());

-    m_xrayConfigModel = new XrayConfigModel(this);
-    setQmlContextProperty("XrayConfigModel", m_xrayConfigModel);
+    m_wireGuardConfigModel.reset(new WireGuardConfigModel(this));
+    m_engine->rootContext()->setContextProperty("WireGuardConfigModel", m_wireGuardConfigModel.get());

-    m_xrayConfigSnapshotsModel = new XrayConfigSnapshotsModel(m_appSettingsRepository, m_xrayConfigModel, this);
-    setQmlContextProperty("XrayConfigSnapshotsModel", m_xrayConfigSnapshotsModel);
+    m_awgConfigModel.reset(new AwgConfigModel(this));
+    m_engine->rootContext()->setContextProperty("AwgConfigModel", m_awgConfigModel.get());

-    m_torConfigModel = new TorConfigModel(this);
-    setQmlContextProperty("TorConfigModel", m_torConfigModel);
+    m_xrayConfigModel.reset(new XrayConfigModel(this));
+    m_engine->rootContext()->setContextProperty("XrayConfigModel", m_xrayConfigModel.get());

 #ifdef Q_OS_WINDOWS
-    m_ikev2ConfigModel = new Ikev2ConfigModel(this);
-    setQmlContextProperty("Ikev2ConfigModel", m_ikev2ConfigModel);
+    m_ikev2ConfigModel.reset(new Ikev2ConfigModel(this));
+    m_engine->rootContext()->setContextProperty("Ikev2ConfigModel", m_ikev2ConfigModel.get());
 #endif

-    m_sftpConfigModel = new SftpConfigModel(this);
-    setQmlContextProperty("SftpConfigModel", m_sftpConfigModel);
+    m_sftpConfigModel.reset(new SftpConfigModel(this));
+    m_engine->rootContext()->setContextProperty("SftpConfigModel", m_sftpConfigModel.get());

-    m_socks5ConfigModel = new Socks5ProxyConfigModel(this);
-    setQmlContextProperty("Socks5ProxyConfigModel", m_socks5ConfigModel);
+    m_socks5ConfigModel.reset(new Socks5ProxyConfigModel(this));
+    m_engine->rootContext()->setContextProperty("Socks5ProxyConfigModel", m_socks5ConfigModel.get());

-    m_mtProxyConfigModel = new MtProxyConfigModel(this);
-    setQmlContextProperty("MtProxyConfigModel", m_mtProxyConfigModel);
+    m_clientManagementModel.reset(new ClientManagementModel(m_settings, this));
+    m_engine->rootContext()->setContextProperty("ClientManagementModel", m_clientManagementModel.get());

-    m_telemtConfigModel = new TelemtConfigModel(this);
-    setQmlContextProperty("TelemtConfigModel", m_telemtConfigModel);
+    m_apiServicesModel.reset(new ApiServicesModel(this));
+    m_engine->rootContext()->setContextProperty("ApiServicesModel", m_apiServicesModel.get());

-    m_clientManagementModel = new ClientManagementModel(this);
-    setQmlContextProperty("ClientManagementModel", m_clientManagementModel);
+    m_apiCountryModel.reset(new ApiCountryModel(this));
+    m_engine->rootContext()->setContextProperty("ApiCountryModel", m_apiCountryModel.get());

-    m_apiServicesModel = new ApiServicesModel(this);
-    setQmlContextProperty("ApiServicesModel", m_apiServicesModel);
+    m_apiAccountInfoModel.reset(new ApiAccountInfoModel(this));
+    m_engine->rootContext()->setContextProperty("ApiAccountInfoModel", m_apiAccountInfoModel.get());

-    m_apiCountryModel = new ApiCountryModel(this);
-    setQmlContextProperty("ApiCountryModel", m_apiCountryModel);
+    m_apiDevicesModel.reset(new ApiDevicesModel(m_settings, this));
+    m_engine->rootContext()->setContextProperty("ApiDevicesModel", m_apiDevicesModel.get());

-    m_apiSubscriptionPlansModel = new ApiSubscriptionPlansModel(this);
-    setQmlContextProperty("ApiSubscriptionPlansModel", m_apiSubscriptionPlansModel);
-
-    m_apiBenefitsModel = new ApiBenefitsModel(this);
-    setQmlContextProperty("ApiBenefitsModel", m_apiBenefitsModel);
-
-    m_apiAccountInfoModel = new ApiAccountInfoModel(this);
-    setQmlContextProperty("ApiAccountInfoModel", m_apiAccountInfoModel);
-
-    m_apiDevicesModel = new ApiDevicesModel(this);
-    setQmlContextProperty("ApiDevicesModel", m_apiDevicesModel);
-
-    m_newsModel = new NewsModel(m_appSettingsRepository, this);
-    setQmlContextProperty("NewsModel", m_newsModel);
-}
-
-void CoreController::initRepositories()
-{
-    m_serversRepository = new SecureServersRepository(m_settings, this);
-    m_appSettingsRepository = new SecureAppSettingsRepository(m_settings, this);
-
-    if (m_vpnConnection) {
-        m_vpnConnection->setRepositories(m_serversRepository, m_appSettingsRepository);
-    }
-}
-
-void CoreController::initCoreControllers()
-{
-    m_serversController = new ServersController(m_serversRepository, m_appSettingsRepository, this);
-    m_appSplitTunnelingController = new AppSplitTunnelingController(m_appSettingsRepository);
-    m_usersController = new UsersController(m_serversRepository, this);
-    m_ipSplitTunnelingController = new IpSplitTunnelingController(m_appSettingsRepository, this);
-    m_allowedDnsController = new AllowedDnsController(m_appSettingsRepository);
-    m_servicesCatalogController = new ServicesCatalogController(m_appSettingsRepository);
-    m_subscriptionController = new SubscriptionController(m_serversRepository, m_appSettingsRepository);
-    m_pairingController = new PairingController(m_appSettingsRepository);
-    m_newsController = new NewsController(m_appSettingsRepository, m_serversRepository);
-    m_updateController = new UpdateController(m_appSettingsRepository, this);
-    
-    m_installController = new InstallController(m_serversRepository, m_appSettingsRepository, this);
-    m_exportController = new ExportController(m_serversRepository, m_appSettingsRepository, this);
-    m_importCoreController = new ImportController(m_serversRepository, m_appSettingsRepository, this);
-    m_connectionController = new ConnectionController(m_serversRepository, m_appSettingsRepository, m_vpnConnection.get(), this);
-    m_settingsController = new SettingsController(m_serversRepository, m_appSettingsRepository, this);
+    m_newsModel.reset(new NewsModel(m_settings, this));
+    m_engine->rootContext()->setContextProperty("NewsModel", m_newsModel.get());
 }

 void CoreController::initControllers()
 {
-    m_connectionUiController = new ConnectionUiController(m_connectionController, m_serversController, this);
-    setQmlContextProperty("ConnectionController", m_connectionUiController);
+    m_connectionController.reset(
+            new ConnectionController(m_serversModel, m_containersModel, m_clientManagementModel, m_vpnConnection, m_settings));
+    m_engine->rootContext()->setContextProperty("ConnectionController", m_connectionController.get());

-    if (m_engine) {
-        m_focusController = new FocusController(m_engine, this);
-        setQmlContextProperty("FocusController", m_focusController);
-    }
+    m_pageController.reset(new PageController(m_serversModel, m_settings));
+    m_engine->rootContext()->setContextProperty("PageController", m_pageController.get());

-    m_installUiController = new InstallUiController(m_installController, m_serversController, m_settingsController, m_protocolsModel, m_usersController,
-                                                     m_awgConfigModel, m_wireGuardConfigModel, m_openVpnConfigModel, m_xrayConfigModel, m_torConfigModel,
-#ifdef Q_OS_WINDOWS
-                                                     m_ikev2ConfigModel,
-#endif
-                                                     m_sftpConfigModel, m_socks5ConfigModel, m_mtProxyConfigModel, m_telemtConfigModel, this);
-    setQmlContextProperty("InstallController", m_installUiController);
+    m_focusController.reset(new FocusController(m_engine, this));
+    m_engine->rootContext()->setContextProperty("FocusController", m_focusController.get());

-    m_importController = new ImportUiController(m_importCoreController, this);
-    setQmlContextProperty("ImportController", m_importController);
+    m_installController.reset(new InstallController(m_serversModel, m_containersModel, m_protocolsModel, m_clientManagementModel, m_settings));
+    m_engine->rootContext()->setContextProperty("InstallController", m_installController.get());

-    m_exportUiController = new ExportUiController(m_exportController, this);
-    setQmlContextProperty("ExportController", m_exportUiController);
+    connect(m_installController.get(), &InstallController::currentContainerUpdated, m_connectionController.get(),
+            &ConnectionController::onCurrentContainerUpdated); // TODO remove this

-    m_languageUiController = new LanguageUiController(m_settingsController, m_languageModel, this);
-    setQmlContextProperty("LanguageUiController", m_languageUiController);
+    connect(m_installController.get(), &InstallController::profileCleared,
+            m_protocolsModel.get(), &ProtocolsModel::updateModel);

-    m_settingsUiController = new SettingsUiController(m_settingsController, m_serversController, m_languageUiController, this);
-    setQmlContextProperty("SettingsController", m_settingsUiController);
+    m_importController.reset(new ImportController(m_serversModel, m_containersModel, m_settings));
+    m_engine->rootContext()->setContextProperty("ImportController", m_importController.get());

-    m_pageController = new PageController(m_serversController, m_settingsController, this);
-    setQmlContextProperty("PageController", m_pageController);
+    m_exportController.reset(new ExportController(m_serversModel, m_containersModel, m_clientManagementModel, m_settings));
+    m_engine->rootContext()->setContextProperty("ExportController", m_exportController.get());

-    m_serversUiController = new ServersUiController(m_serversController, m_settingsController, m_serversModel, m_containersModel, m_defaultServerContainersModel, this);
-    setQmlContextProperty("ServersUiController", m_serversUiController);
+    m_settingsController.reset(
+            new SettingsController(m_serversModel, m_containersModel, m_languageModel, m_sitesModel, m_appSplitTunnelingModel, m_settings));
+    m_engine->rootContext()->setContextProperty("SettingsController", m_settingsController.get());

-    m_ipSplitTunnelingUiController = new IpSplitTunnelingUiController(m_ipSplitTunnelingController, m_ipSplitTunnelingModel, this);
-    setQmlContextProperty("IpSplitTunnelingController", m_ipSplitTunnelingUiController);
+    m_sitesController.reset(new SitesController(m_settings, m_vpnConnection, m_sitesModel));
+    m_engine->rootContext()->setContextProperty("SitesController", m_sitesController.get());

-    m_allowedDnsUiController = new AllowedDnsUiController(m_allowedDnsController, m_allowedDnsModel, this);
-    setQmlContextProperty("AllowedDnsController", m_allowedDnsUiController);
+    m_allowedDnsController.reset(new AllowedDnsController(m_settings, m_allowedDnsModel));
+    m_engine->rootContext()->setContextProperty("AllowedDnsController", m_allowedDnsController.get());

-    m_appSplitTunnelingUiController = new AppSplitTunnelingUiController(m_appSplitTunnelingController, m_appSplitTunnelingModel, this);
-    setQmlContextProperty("AppSplitTunnelingController", m_appSplitTunnelingUiController);
+    m_appSplitTunnelingController.reset(new AppSplitTunnelingController(m_settings, m_appSplitTunnelingModel));
+    m_engine->rootContext()->setContextProperty("AppSplitTunnelingController", m_appSplitTunnelingController.get());

-    m_systemController = new SystemController(this);
-    setQmlContextProperty("SystemController", m_systemController);
+    m_systemController.reset(new SystemController(m_settings));
+    m_engine->rootContext()->setContextProperty("SystemController", m_systemController.get());

-    m_networkReachabilityController = new NetworkReachabilityController(this);
-    m_engine->rootContext()->setContextProperty("NetworkReachabilityController", m_networkReachabilityController);
-    m_engine->rootContext()->setContextProperty("NetworkReachability", m_networkReachabilityController);
+    m_apiSettingsController.reset(
+            new ApiSettingsController(m_serversModel, m_apiAccountInfoModel, m_apiCountryModel, m_apiDevicesModel, m_settings));
+    m_engine->rootContext()->setContextProperty("ApiSettingsController", m_apiSettingsController.get());

-    m_servicesCatalogUiController = new ServicesCatalogUiController(m_servicesCatalogController, m_apiServicesModel, this);
-    setQmlContextProperty("ServicesCatalogUiController", m_servicesCatalogUiController);
+    m_apiConfigsController.reset(new ApiConfigsController(m_serversModel, m_apiServicesModel, m_settings));
+    m_engine->rootContext()->setContextProperty("ApiConfigsController", m_apiConfigsController.get());

-    m_subscriptionUiController = new SubscriptionUiController(m_serversController, m_apiServicesModel, m_servicesCatalogController, m_subscriptionController,
-                                                              m_apiSubscriptionPlansModel, m_apiBenefitsModel, m_apiAccountInfoModel,
-                                                              m_apiCountryModel, m_apiDevicesModel, m_settingsController, this);
-    setQmlContextProperty("SubscriptionUiController", m_subscriptionUiController);
-
-    m_pairingUiController = new PairingUiController(m_pairingController, m_serversController, m_subscriptionController, m_appSettingsRepository, this);
-    setQmlContextProperty("PairingUiController", m_pairingUiController);
-
-    m_apiNewsUiController = new ApiNewsUiController(m_newsModel, m_newsController, this);
-    setQmlContextProperty("ApiNewsController", m_apiNewsUiController);
-
-    m_updateUiController = new UpdateUiController(m_updateController, this);
-    setQmlContextProperty("UpdateController", m_updateUiController);
+    m_apiNewsController.reset(new ApiNewsController(m_newsModel, m_settings, m_serversModel, this));
+    m_engine->rootContext()->setContextProperty("ApiNewsController", m_apiNewsController.get());
 }

 void CoreController::initAndroidController()
@@ -240,16 +164,33 @@ void CoreController::initAndroidController()
    if (!AndroidController::initLogging()) {
        qFatal("Android logging initialization failed");
    }
-    AndroidController::instance()->setSaveLogs(m_appSettingsRepository->isSaveLogs());
-    AndroidController::instance()->setScreenshotsEnabled(m_appSettingsRepository->isScreenshotsEnabled());
+    AndroidController::instance()->setSaveLogs(m_settings->isSaveLogs());
+    connect(m_settings.get(), &Settings::saveLogsChanged, AndroidController::instance(), &AndroidController::setSaveLogs);

+    AndroidController::instance()->setScreenshotsEnabled(m_settings->isScreenshotsEnabled());
+    connect(m_settings.get(), &Settings::screenshotsEnabledChanged, AndroidController::instance(), &AndroidController::setScreenshotsEnabled);
+
+    connect(m_settings.get(), &Settings::serverRemoved, AndroidController::instance(), &AndroidController::resetLastServer);
+
+    connect(m_settings.get(), &Settings::settingsCleared, []() { AndroidController::instance()->resetLastServer(-1); });
+
+    connect(AndroidController::instance(), &AndroidController::initConnectionState, this, [this](Vpn::ConnectionState state) {
+        m_connectionController->onConnectionStateChanged(state);
+        if (m_vpnConnection)
+            m_vpnConnection->restoreConnection();
+    });
    if (!AndroidController::instance()->initialize()) {
        qFatal("Android controller initialization failed");
    }

-    if (m_engine) {
-        m_engine->addImageProvider(QLatin1String("installedAppImage"), new InstalledAppsImageProvider);
-    }
+    connect(AndroidController::instance(), &AndroidController::importConfigFromOutside, this, [this](QString data) {
+        emit m_pageController->goToPageHome();
+        m_importController->extractConfigFromData(data);
+        data.clear();
+        emit m_pageController->goToPageViewConfig();
+    });
+
+    m_engine->addImageProvider(QLatin1String("installedAppImage"), new InstalledAppsImageProvider);
 #endif
 }

@@ -257,39 +198,63 @@ void CoreController::initAppleController()
 {
 #ifdef Q_OS_IOS
    IosController::Instance()->initialize();
-    QTimer::singleShot(0, this, [this]() { AmneziaVPN::toggleScreenshots(m_appSettingsRepository->isScreenshotsEnabled()); });
-#endif
-}
+    connect(IosController::Instance(), &IosController::importConfigFromOutside, this, [this](QString data) {
+        emit m_pageController->goToPageHome();
+        m_importController->extractConfigFromData(data);
+        emit m_pageController->goToPageViewConfig();
+    });

-void CoreController::initLogging()
-{
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    bool enabled = m_appSettingsRepository->isSaveLogs();
-    if (enabled) {
-        if (!Logger::init(false)) {
-            qWarning() << "Initialization of debug subsystem failed";
-        }
-    }
-    Logger::setServiceLogsEnabled(enabled);
+    connect(IosController::Instance(), &IosController::importBackupFromOutside, this, [this](QString filePath) {
+        emit m_pageController->goToPageHome();
+        m_pageController->goToPageSettingsBackup();
+        emit m_settingsController->importBackupFromOutside(filePath);
+    });
+
+    QTimer::singleShot(0, this, [this]() { AmneziaVPN::toggleScreenshots(m_settings->isScreenshotsEnabled()); });
+
+    connect(m_settings.get(), &Settings::screenshotsEnabledChanged, [](bool enabled) { AmneziaVPN::toggleScreenshots(enabled); });
 #endif
 }

 void CoreController::initSignalHandlers()
 {
-    m_signalHandlers = new CoreSignalHandlers(this, this);
-    m_signalHandlers->initAllHandlers();
+    initErrorMessagesHandler();

-    // Trigger initial update after handlers are connected
-    m_serversUiController->updateModel();
-    if (m_serversUiController->hasServersFromGatewayApi()) {
-        m_apiNewsUiController->fetchNews(false);
-    }
+    initApiCountryModelUpdateHandler();
+    initContainerModelUpdateHandler();
+    initAdminConfigRevokedHandler();
+    initPassphraseRequestHandler();
+    initTranslationsUpdatedHandler();
+    initAutoConnectHandler();
+    initAmneziaDnsToggledHandler();
+    initPrepareConfigHandler();
+    initStrictKillSwitchHandler();
+}
+
+void CoreController::initNotificationHandler()
+{
+#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
+    m_notificationHandler.reset(NotificationHandler::create(nullptr));
+
+    connect(m_vpnConnection.get(), &VpnConnection::connectionStateChanged, m_notificationHandler.get(),
+            &NotificationHandler::setConnectionState);
+
+    connect(m_notificationHandler.get(), &NotificationHandler::raiseRequested, m_pageController.get(), &PageController::raiseMainWindow);
+    connect(m_notificationHandler.get(), &NotificationHandler::connectRequested, m_connectionController.get(),
+            static_cast<void (ConnectionController::*)()>(&ConnectionController::openConnection));
+    connect(m_notificationHandler.get(), &NotificationHandler::disconnectRequested, m_connectionController.get(),
+            &ConnectionController::closeConnection);
+    connect(this, &CoreController::translationsUpdated, m_notificationHandler.get(), &NotificationHandler::onTranslationsUpdated);
+
+    auto* trayHandler = qobject_cast<SystemTrayNotificationHandler*>(m_notificationHandler.get());
+    connect(this, &CoreController::websiteUrlChanged, trayHandler, &SystemTrayNotificationHandler::updateWebsiteUrl);
+#endif    
 }

 void CoreController::updateTranslator(const QLocale &locale)
 {
    if (!m_translator->isEmpty()) {
-        QCoreApplication::removeTranslator(m_translator);
+        QCoreApplication::removeTranslator(m_translator.get());
    }

    QStringList availableTranslations;
@@ -310,49 +275,126 @@ void CoreController::updateTranslator(const QLocale &locale)
    }

    if (m_translator->load(strFileName)) {
-        QCoreApplication::installTranslator(m_translator);
-    } else {
-        if (m_translator->load(QString(":/translations/amneziavpn_en.qm"))) {
-            QCoreApplication::installTranslator(m_translator);
+        if (QCoreApplication::installTranslator(m_translator.get())) {
+            m_settings->setAppLanguage(locale);
        }
+    } else {
+        m_settings->setAppLanguage(QLocale::English);
    }

-    if (m_engine) {
-        m_engine->retranslate();
-    }
+    m_engine->retranslate();

    emit translationsUpdated();
-    if (m_languageUiController) {
-        emit websiteUrlChanged(m_languageUiController->getCurrentSiteUrl());
-    }
+    emit websiteUrlChanged(m_languageModel->getCurrentSiteUrl());
+}
+
+void CoreController::initErrorMessagesHandler()
+{
+    connect(m_connectionController.get(), &ConnectionController::connectionErrorOccurred, this, [this](ErrorCode errorCode) {
+        emit m_pageController->showErrorMessage(errorCode);
+        emit m_vpnConnection->connectionStateChanged(Vpn::ConnectionState::Disconnected);
+    });
+
+    connect(m_apiConfigsController.get(), &ApiConfigsController::errorOccurred, m_pageController.get(),
+            qOverload<ErrorCode>(&PageController::showErrorMessage));
 }

 void CoreController::setQmlRoot()
 {
-    if (m_engine && m_systemController) {
-        m_systemController->setQmlRoot(m_engine->rootObjects().value(0));
+    m_systemController->setQmlRoot(m_engine->rootObjects().value(0));
+}
+
+void CoreController::initApiCountryModelUpdateHandler()
+{
+    connect(m_serversModel.get(), &ServersModel::updateApiCountryModel, this, [this]() {
+        m_apiCountryModel->updateModel(m_serversModel->getProcessedServerData("apiAvailableCountries").toJsonArray(),
+                                       m_serversModel->getProcessedServerData("apiServerCountryCode").toString());
+    });
+}
+
+void CoreController::initContainerModelUpdateHandler()
+{
+    connect(m_serversModel.get(), &ServersModel::containersUpdated, m_containersModel.get(), &ContainersModel::updateModel);
+    connect(m_serversModel.get(), &ServersModel::defaultServerContainersUpdated, m_defaultServerContainersModel.get(),
+            &ContainersModel::updateModel);
+    connect(m_serversModel.get(), &ServersModel::gatewayStacksExpanded, this, [this]() {
+        if (m_serversModel->hasServersFromGatewayApi()) {
+            m_apiNewsController->fetchNews(false);
+        }
+    });
+    m_serversModel->resetModel();
+}
+
+void CoreController::initAdminConfigRevokedHandler()
+{
+    connect(m_clientManagementModel.get(), &ClientManagementModel::adminConfigRevoked, m_serversModel.get(),
+            &ServersModel::clearCachedProfile);
+}
+
+void CoreController::initPassphraseRequestHandler()
+{
+    connect(m_installController.get(), &InstallController::passphraseRequestStarted, m_pageController.get(),
+            &PageController::showPassphraseRequestDrawer);
+    connect(m_pageController.get(), &PageController::passphraseRequestDrawerClosed, m_installController.get(),
+            &InstallController::setEncryptedPassphrase);
+}
+
+void CoreController::initTranslationsUpdatedHandler()
+{
+    connect(m_languageModel.get(), &LanguageModel::updateTranslations, this, &CoreController::updateTranslator);
+    connect(this, &CoreController::translationsUpdated, m_languageModel.get(), &LanguageModel::translationsUpdated);
+    connect(this, &CoreController::translationsUpdated, m_connectionController.get(), &ConnectionController::onTranslationsUpdated);
+}
+
+void CoreController::initAutoConnectHandler()
+{
+    if (m_settingsController->isAutoConnectEnabled() && m_serversModel->getDefaultServerIndex() >= 0) {
+        QTimer::singleShot(1000, this, [this]() { m_connectionController->openConnection(); });
    }
 }

-PageController* CoreController::pageController() const
+void CoreController::initAmneziaDnsToggledHandler()
+{
+    connect(m_settingsController.get(), &SettingsController::amneziaDnsToggled, m_serversModel.get(), &ServersModel::toggleAmneziaDns);
+}
+
+void CoreController::initPrepareConfigHandler()
+{
+    connect(m_connectionController.get(), &ConnectionController::prepareConfig, this, [this]() {
+        emit m_vpnConnection->connectionStateChanged(Vpn::ConnectionState::Preparing);
+
+        if (!m_apiConfigsController->isConfigValid()) {
+            emit m_vpnConnection->connectionStateChanged(Vpn::ConnectionState::Disconnected);
+            return;
+        }
+
+        if (!m_installController->isConfigValid()) {
+            emit m_vpnConnection->connectionStateChanged(Vpn::ConnectionState::Disconnected);
+            return;
+        }
+
+        m_connectionController->openConnection();
+    });
+}
+
+void CoreController::initStrictKillSwitchHandler()
+{
+    connect(m_settingsController.get(), &SettingsController::strictKillSwitchEnabledChanged, m_vpnConnection.get(),
+            &VpnConnection::onKillSwitchModeChanged);
+}
+
+QSharedPointer<PageController> CoreController::pageController() const
 {
    return m_pageController;
 }

 void CoreController::openConnectionByIndex(int serverIndex)
 {
-    const QString serverId =
-        m_serversUiController ? m_serversUiController->getServerId(serverIndex) : QString();
-    if (serverId.isEmpty()) {
-        return;
-    }
    if (m_serversModel) {
        m_serversModel->setProcessedServerIndex(serverIndex);
+        m_serversModel->setDefaultServerIndex(serverIndex);
    }
-    if (m_serversController) {
-        m_serversController->setDefaultServer(serverId);
-    }
-    m_connectionUiController->toggleConnection();
+    m_connectionController->toggleConnection();
 }

 void CoreController::importConfigFromData(const QString &data)
--- a/client/core/controllers/coreController.h
+++ b/client/core/controllers/coreController.h
@@ -6,223 +6,148 @@
 #include <QThread>

 #if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    #include "ui/utils/systemTrayNotificationHandler.h"
+    #include "ui/systemtray_notificationhandler.h"
 #endif

-#include "ui/controllers/api/subscriptionUiController.h"
-#include "ui/controllers/api/pairingUiController.h"
-#include "core/controllers/api/pairingController.h"
-#include "ui/controllers/api/apiNewsUiController.h"
-#include "ui/controllers/appSplitTunnelingUiController.h"
-#include "ui/controllers/allowedDnsUiController.h"
-#include "ui/controllers/connectionUiController.h"
-#include "ui/controllers/selfhosted/exportUiController.h"
-#include "core/controllers/selfhosted/exportController.h"
-#include "ui/controllers/qml/focusController.h"
-#include "ui/controllers/importUiController.h"
-#include "core/controllers/selfhosted/importController.h"
-#include "ui/controllers/selfhosted/installUiController.h"
-#include "ui/controllers/qml/pageController.h"
-#include "ui/controllers/settingsUiController.h"
-#include "ui/controllers/serversUiController.h"
-#include "ui/controllers/ipSplitTunnelingUiController.h"
+#include "ui/controllers/api/apiConfigsController.h"
+#include "ui/controllers/api/apiSettingsController.h"
+#include "ui/controllers/api/apiNewsController.h"
+#include "ui/controllers/appSplitTunnelingController.h"
+#include "ui/controllers/allowedDnsController.h"
+#include "ui/controllers/connectionController.h"
+#include "ui/controllers/exportController.h"
+#include "ui/controllers/focusController.h"
+#include "ui/controllers/importController.h"
+#include "ui/controllers/installController.h"
+#include "ui/controllers/pageController.h"
+#include "ui/controllers/settingsController.h"
+#include "ui/controllers/sitesController.h"
 #include "ui/controllers/systemController.h"
-#include "ui/controllers/languageUiController.h"
-#include "ui/controllers/updateUiController.h"
-#include "ui/controllers/api/servicesCatalogUiController.h"
-#include "ui/controllers/networkReachabilityController.h"

-#include "core/controllers/serversController.h"
-#include "core/controllers/selfhosted/usersController.h"
-#include "core/controllers/appSplitTunnelingController.h"
-#include "core/controllers/ipSplitTunnelingController.h"
-#include "core/controllers/allowedDnsController.h"
-#include "core/controllers/api/servicesCatalogController.h"
-#include "core/controllers/api/subscriptionController.h"
-#include "core/controllers/api/newsController.h"
-#include "core/controllers/selfhosted/installController.h"
-#include "core/controllers/settingsController.h"
-#include "core/controllers/connectionController.h"
-#include "core/controllers/updateController.h"
-
-#include "core/repositories/secureServersRepository.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-#include "secureQSettings.h"
-
-#include "ui/models/allowedDnsModel.h"
-#include "ui/models/containersModel.h"
+#include "ui/models/allowed_dns_model.h"
+#include "ui/models/containers_model.h"
 #include "ui/models/languageModel.h"
+#include "ui/models/protocols/cloakConfigModel.h"
 #ifdef Q_OS_WINDOWS
    #include "ui/models/protocols/ikev2ConfigModel.h"
 #endif
 #include "ui/models/api/apiAccountInfoModel.h"
-#include "ui/models/api/apiBenefitsModel.h"
 #include "ui/models/api/apiCountryModel.h"
 #include "ui/models/api/apiDevicesModel.h"
 #include "ui/models/api/apiServicesModel.h"
-#include "ui/models/api/apiSubscriptionPlansModel.h"
 #include "ui/models/appSplitTunnelingModel.h"
 #include "ui/models/clientManagementModel.h"
 #include "ui/models/protocols/awgConfigModel.h"
 #include "ui/models/protocols/openvpnConfigModel.h"
+#include "ui/models/protocols/shadowsocksConfigModel.h"
 #include "ui/models/protocols/wireguardConfigModel.h"
 #include "ui/models/protocols/xrayConfigModel.h"
-#include "ui/models/protocols/xrayConfigSnapshotsModel.h"
-#include "ui/models/protocolsModel.h"
-#include "ui/models/services/torConfigModel.h"
-#include "ui/models/serversModel.h"
+#include "ui/models/protocols_model.h"
+#include "ui/models/servers_model.h"
 #include "ui/models/services/sftpConfigModel.h"
 #include "ui/models/services/socks5ProxyConfigModel.h"
-#include "ui/models/services/mtProxyConfigModel.h"
-#include "ui/models/services/telemtConfigModel.h"
-
-#include "ui/models/ipSplitTunnelingModel.h"
+#include "ui/models/sites_model.h"
 #include "ui/models/newsModel.h"

 #if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    #include "ui/utils/notificationHandler.h"
+    #include "ui/notificationhandler.h"
 #endif

-class CoreSignalHandlers;
-class TestMultipleImports;
-class TestAdminSelfHostedExport;
-class TestServerEdit;
-class TestDefaultServerChange;
-class TestServerEdgeCases;
-class TestSignalOrder;
-class TestServersModelSync;
-class TestComplexOperations;
-class TestSettingsSignals;
-class TestUiServersModelAndController;
-class TestSelfHostedServerSetup;
-
 class CoreController : public QObject
 {
    Q_OBJECT
-    friend class CoreSignalHandlers;
-    friend class TestMultipleImports;
-    friend class TestAdminSelfHostedExport;
-    friend class TestServerEdit;
-    friend class TestDefaultServerChange;
-    friend class TestServerEdgeCases;
-    friend class TestSignalOrder;
-    friend class TestServersModelSync;
-    friend class TestComplexOperations;
-    friend class TestSettingsSignals;
-    friend class TestUiServersModelAndController;
-    friend class TestSelfHostedServerSetup;

 public:
-    explicit CoreController(const QSharedPointer<VpnConnection> &vpnConnection, SecureQSettings* settings,
+    explicit CoreController(const QSharedPointer<VpnConnection> &vpnConnection, const std::shared_ptr<Settings> &settings,
                            QQmlApplicationEngine *engine, QObject *parent = nullptr);

-    PageController* pageController() const;
+    QSharedPointer<PageController> pageController() const;
    void setQmlRoot();

    void openConnectionByIndex(int serverIndex);
    void importConfigFromData(const QString &data);
-    void updateTranslator(const QLocale &locale);

 signals:
    void translationsUpdated();
    void websiteUrlChanged(const QString &newUrl);

 private:
-    void initRepositories();
-    void initCoreControllers();
    void initModels();
    void initControllers();
    void initAndroidController();
    void initAppleController();
-    void initLogging();
    void initSignalHandlers();
-    void setQmlContextProperty(const QString &name, QObject *value);
+
+    void initNotificationHandler();
+
+    void updateTranslator(const QLocale &locale);
+
+    void initErrorMessagesHandler();
+
+    void initApiCountryModelUpdateHandler();
+    void initContainerModelUpdateHandler();
+    void initAdminConfigRevokedHandler();
+    void initPassphraseRequestHandler();
+    void initTranslationsUpdatedHandler();
+    void initAutoConnectHandler();
+    void initAmneziaDnsToggledHandler();
+    void initPrepareConfigHandler();
+    void initStrictKillSwitchHandler();

    QQmlApplicationEngine *m_engine {}; // TODO use parent child system here?
-    SecureQSettings* m_settings;
+    std::shared_ptr<Settings> m_settings;
    QSharedPointer<VpnConnection> m_vpnConnection;
-    QTranslator* m_translator;
-
-    SecureServersRepository* m_serversRepository;
-    SecureAppSettingsRepository* m_appSettingsRepository;
+    QSharedPointer<QTranslator> m_translator;

 #if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    NotificationHandler* m_notificationHandler;
+    QScopedPointer<NotificationHandler> m_notificationHandler;
 #endif

    QMetaObject::Connection m_reloadConfigErrorOccurredConnection;

-    ConnectionUiController* m_connectionUiController;
-    FocusController* m_focusController;
-    PageController* m_pageController;
-    InstallUiController* m_installUiController;
-    ImportUiController* m_importController;
-    ImportController* m_importCoreController;
-    ExportUiController* m_exportUiController;
-    SettingsUiController* m_settingsUiController;
-    ServersUiController* m_serversUiController;
-    IpSplitTunnelingUiController* m_ipSplitTunnelingUiController;
-    SystemController* m_systemController;
-    NetworkReachabilityController* m_networkReachabilityController;
-    AppSplitTunnelingUiController* m_appSplitTunnelingUiController;
-    AllowedDnsUiController* m_allowedDnsUiController;
-    LanguageUiController* m_languageUiController;
-    UpdateUiController* m_updateUiController;
+    QScopedPointer<ConnectionController> m_connectionController;
+    QScopedPointer<FocusController> m_focusController;
+    QSharedPointer<PageController> m_pageController; // TODO
+    QScopedPointer<InstallController> m_installController;
+    QScopedPointer<ImportController> m_importController;
+    QScopedPointer<ExportController> m_exportController;
+    QScopedPointer<SettingsController> m_settingsController;
+    QScopedPointer<SitesController> m_sitesController;
+    QScopedPointer<SystemController> m_systemController;
+    QScopedPointer<AppSplitTunnelingController> m_appSplitTunnelingController;
+    QScopedPointer<AllowedDnsController> m_allowedDnsController;

-    SubscriptionUiController* m_subscriptionUiController;
-    PairingUiController* m_pairingUiController;
-    ApiNewsUiController* m_apiNewsUiController;
-    
-    ServicesCatalogUiController* m_servicesCatalogUiController;
+    QScopedPointer<ApiSettingsController> m_apiSettingsController;
+    QScopedPointer<ApiConfigsController> m_apiConfigsController;
+    QScopedPointer<ApiNewsController> m_apiNewsController;

-    ServersController* m_serversController;
-    UsersController* m_usersController;
-    AppSplitTunnelingController* m_appSplitTunnelingController;
-    IpSplitTunnelingController* m_ipSplitTunnelingController;
-    AllowedDnsController* m_allowedDnsController;
-    ServicesCatalogController* m_servicesCatalogController;
-    SubscriptionController* m_subscriptionController;
-    PairingController* m_pairingController;
-    NewsController* m_newsController;
-    UpdateController* m_updateController;
-    InstallController* m_installController;
-    ExportController* m_exportController;
-    ConnectionController* m_connectionController;
-    SettingsController* m_settingsController;
+    QSharedPointer<ContainersModel> m_containersModel;
+    QSharedPointer<ContainersModel> m_defaultServerContainersModel;
+    QSharedPointer<ServersModel> m_serversModel;
+    QSharedPointer<LanguageModel> m_languageModel;
+    QSharedPointer<ProtocolsModel> m_protocolsModel;
+    QSharedPointer<SitesModel> m_sitesModel;
+    QSharedPointer<NewsModel> m_newsModel;
+    QSharedPointer<AllowedDnsModel> m_allowedDnsModel;
+    QSharedPointer<AppSplitTunnelingModel> m_appSplitTunnelingModel;
+    QSharedPointer<ClientManagementModel> m_clientManagementModel;

-    ContainersModel* m_containersModel;
-    ContainersModel* m_defaultServerContainersModel;
-    ServersModel* m_serversModel;
-    LanguageModel* m_languageModel;
-    ProtocolsModel* m_protocolsModel;
-    IpSplitTunnelingModel* m_ipSplitTunnelingModel;
-    NewsModel* m_newsModel;
-    AllowedDnsModel* m_allowedDnsModel;
-    AppSplitTunnelingModel* m_appSplitTunnelingModel;
-    ClientManagementModel* m_clientManagementModel;
+    QSharedPointer<ApiServicesModel> m_apiServicesModel;
+    QSharedPointer<ApiCountryModel> m_apiCountryModel;
+    QSharedPointer<ApiAccountInfoModel> m_apiAccountInfoModel;
+    QSharedPointer<ApiDevicesModel> m_apiDevicesModel;

-    ApiServicesModel* m_apiServicesModel;
-    ApiSubscriptionPlansModel* m_apiSubscriptionPlansModel;
-    ApiBenefitsModel* m_apiBenefitsModel;
-    ApiCountryModel* m_apiCountryModel;
-    ApiAccountInfoModel* m_apiAccountInfoModel;
-    ApiDevicesModel* m_apiDevicesModel;
-
-    OpenVpnConfigModel* m_openVpnConfigModel;
-    XrayConfigModel* m_xrayConfigModel;
-    XrayConfigSnapshotsModel* m_xrayConfigSnapshotsModel;
-    TorConfigModel* m_torConfigModel;
-    WireGuardConfigModel* m_wireGuardConfigModel;
-    AwgConfigModel* m_awgConfigModel;
+    QScopedPointer<OpenVpnConfigModel> m_openVpnConfigModel;
+    QScopedPointer<ShadowSocksConfigModel> m_shadowSocksConfigModel;
+    QScopedPointer<CloakConfigModel> m_cloakConfigModel;
+    QScopedPointer<XrayConfigModel> m_xrayConfigModel;
+    QScopedPointer<WireGuardConfigModel> m_wireGuardConfigModel;
+    QScopedPointer<AwgConfigModel> m_awgConfigModel;
 #ifdef Q_OS_WINDOWS
-    Ikev2ConfigModel* m_ikev2ConfigModel;
+    QScopedPointer<Ikev2ConfigModel> m_ikev2ConfigModel;
 #endif
-    SftpConfigModel* m_sftpConfigModel;
-    Socks5ProxyConfigModel* m_socks5ConfigModel;
-    MtProxyConfigModel* m_mtProxyConfigModel;
-    TelemtConfigModel* m_telemtConfigModel;
-
-    CoreSignalHandlers* m_signalHandlers;
+    QScopedPointer<SftpConfigModel> m_sftpConfigModel;
+    QScopedPointer<Socks5ProxyConfigModel> m_socks5ConfigModel;
 };

 #endif // CORECONTROLLER_H
--- a/client/core/controllers/coreSignalHandlers.cpp
+++ b/client/core/controllers/coreSignalHandlers.cpp
@@ -1,450 +0,0 @@
-#include "coreSignalHandlers.h"
-
-#include <QTimer>
-
-#include "core/utils/selfhosted/sshSession.h"
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/controllers/coreController.h"
-#include "core/repositories/secureServersRepository.h"
-#include "core/utils/serverConfigUtils.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-#include "vpnConnection.h"
-#include "ui/controllers/qml/pageController.h"
-#include "ui/controllers/connectionUiController.h"
-#include "ui/controllers/settingsUiController.h"
-#include "ui/controllers/serversUiController.h"
-#include "ui/controllers/ipSplitTunnelingUiController.h"
-#include "ui/controllers/allowedDnsUiController.h"
-#include "ui/controllers/appSplitTunnelingUiController.h"
-#include "ui/controllers/languageUiController.h"
-#include "ui/controllers/selfhosted/installUiController.h"
-#include "ui/controllers/importUiController.h"
-#include "ui/controllers/api/subscriptionUiController.h"
-#include "ui/controllers/api/pairingUiController.h"
-#include "ui/controllers/updateUiController.h"
-#include "ui/models/serversModel.h"
-#include "core/controllers/serversController.h"
-#include "core/controllers/ipSplitTunnelingController.h"
-#include "core/controllers/appSplitTunnelingController.h"
-#include "core/controllers/selfhosted/usersController.h"
-#include "core/controllers/settingsController.h"
-#include "core/controllers/selfhosted/installController.h"
-#include "core/controllers/selfhosted/exportController.h"
-#include "core/controllers/connectionController.h"
-#include "ui/models/clientManagementModel.h"
-#include "ui/controllers/api/apiNewsUiController.h"
-#include "ui/models/api/apiCountryModel.h"
-#include "ui/models/containersModel.h"
-#include "core/utils/containerEnum.h"
-
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    #include "ui/utils/notificationHandler.h"
-    #include "ui/utils/systemTrayNotificationHandler.h"
-#endif
-
-#ifdef Q_OS_ANDROID
-    #include "platforms/android/android_controller.h"
-#endif
-
-#ifdef Q_OS_IOS
-    #include "platforms/ios/ios_controller.h"
-    #include <AmneziaVPN-Swift.h>
-#endif
-
-CoreSignalHandlers::CoreSignalHandlers(CoreController* coreController, QObject* parent)
-    : QObject(parent),
-      m_coreController(coreController)
-{
-}
-
-void CoreSignalHandlers::initAllHandlers()
-{
-    initErrorMessagesHandler();
-    initSettingsSplitTunnelingHandler();
-    initInstallControllerHandler();
-    initExportControllerHandler();
-    initImportControllerHandler();
-    initApiCountryModelUpdateHandler();
-    initSubscriptionRefreshHandler();
-    initAdminConfigRevokedHandler();
-    initPassphraseRequestHandler();
-    initTranslationsUpdatedHandler();
-    initLanguageHandler();
-    initAutoConnectHandler();
-    initAmneziaDnsToggledHandler();
-    initServersModelUpdateHandler();
-    initClientManagementModelUpdateHandler();
-    initSitesModelUpdateHandler();
-    initAllowedDnsModelUpdateHandler();
-    initAppSplitTunnelingModelUpdateHandler();
-    initPrepareConfigHandler();
-    initUnsupportedConnectDrawerHandler();
-    initStrictKillSwitchHandler();
-    initAndroidSettingsHandler();
-    initAndroidConnectionHandler();
-    initIosImportHandler();
-    initIosSettingsHandler();
-    initNotificationHandler();
-    initUpdateFoundHandler();
-}
-
-void CoreSignalHandlers::initErrorMessagesHandler()
-{
-    connect(m_coreController->m_connectionUiController, &ConnectionUiController::connectionErrorOccurred, this, [this](ErrorCode errorCode) {
-        emit m_coreController->m_pageController->showErrorMessage(errorCode);
-        m_coreController->m_connectionController->setConnectionState(Vpn::ConnectionState::Disconnected);
-    });
-
-    connect(m_coreController->m_subscriptionUiController, &SubscriptionUiController::errorOccurred, m_coreController->m_pageController,
-            qOverload<ErrorCode>(&PageController::showErrorMessage));
-
-    connect(m_coreController->m_pairingUiController, &PairingUiController::errorOccurred, m_coreController->m_pageController,
-            qOverload<ErrorCode>(&PageController::showErrorMessage));
-
-    connect(m_coreController->m_settingsUiController, &SettingsUiController::errorOccurred, m_coreController->m_pageController,
-            qOverload<ErrorCode>(&PageController::showErrorMessage));
-}
-
-void CoreSignalHandlers::initSettingsSplitTunnelingHandler()
-{
-    connect(m_coreController->m_settingsController, &SettingsController::siteSplitTunnelingRouteModeChanged, this, [this](RouteMode mode) {
-        m_coreController->m_ipSplitTunnelingController->setRouteMode(mode);
-    });
-    connect(m_coreController->m_settingsController, &SettingsController::siteSplitTunnelingToggled, this, [this](bool enabled) {
-        m_coreController->m_ipSplitTunnelingController->toggleSplitTunneling(enabled);
-    });
-    connect(m_coreController->m_settingsController, &SettingsController::appSplitTunnelingRouteModeChanged, this, [this](AppsRouteMode mode) {
-        m_coreController->m_appSplitTunnelingController->setRouteMode(mode);
-    });
-    connect(m_coreController->m_settingsController, &SettingsController::appSplitTunnelingToggled, this, [this](bool enabled) {
-        m_coreController->m_appSplitTunnelingController->toggleSplitTunneling(enabled);
-    });
-    connect(m_coreController->m_settingsController, &SettingsController::appSplitTunnelingClearAppsList, this, [this]() {
-        m_coreController->m_appSplitTunnelingController->clearAppsList();
-    });
-}
-
-void CoreSignalHandlers::initInstallControllerHandler()
-{
-    connect(m_coreController->m_installController, &InstallController::serverIsBusy, m_coreController->m_installUiController, &InstallUiController::serverIsBusy);
-    connect(m_coreController->m_installUiController, &InstallUiController::cancelInstallation, m_coreController->m_installController, &InstallController::cancelInstallation);
-    connect(m_coreController->m_serversUiController, &ServersUiController::processedServerIndexChanged,
-        m_coreController->m_installUiController, [this](int serverIndex) {
-        if (serverIndex >= 0) {
-            m_coreController->m_installUiController->clearProcessedServerCredentials();
-        }
-    });
-}
-
-void CoreSignalHandlers::initExportControllerHandler()
-{
-    connect(m_coreController->m_exportController, &ExportController::appendClientRequested, this,
-            [this](const QString &serverId, const QString &clientId, const QString &clientName, DockerContainer container) {
-                m_coreController->m_usersController->appendClient(serverId, clientId, clientName, container);
-            });
-    connect(m_coreController->m_exportController, &ExportController::updateClientsRequested, this,
-            [this](const QString &serverId, DockerContainer container) {
-                m_coreController->m_usersController->updateClients(serverId, container);
-            });
-    connect(m_coreController->m_exportController, &ExportController::revokeClientRequested, this,
-            [this](const QString &serverId, int row, DockerContainer container) {
-                m_coreController->m_usersController->revokeClient(serverId, row, container);
-            });
-    connect(m_coreController->m_exportController, &ExportController::renameClientRequested, this,
-            [this](const QString &serverId, int row, const QString &clientName, DockerContainer container) {
-                m_coreController->m_usersController->renameClient(serverId, row, clientName, container);
-            });
-}
-
-void CoreSignalHandlers::initImportControllerHandler()
-{
-    connect(m_coreController->m_importCoreController, &ImportController::importFinished, this, [this]() {
-        if (!m_coreController->m_connectionController->isConnected()) {
-            int newServerIndex = m_coreController->m_serversController->getServersCount() - 1;
-            const QString serverId = m_coreController->m_serversController->getServerId(newServerIndex);
-            if (!serverId.isEmpty()) {
-                m_coreController->m_serversController->setDefaultServer(serverId);
-            }
-            if (m_coreController->m_serversUiController) {
-                m_coreController->m_serversUiController->setProcessedServerId(serverId);
-            }
-        }
-    });
-}
-
-void CoreSignalHandlers::initApiCountryModelUpdateHandler()
-{
-    connect(m_coreController->m_serversUiController, &ServersUiController::updateApiCountryModel, this, [this]() {
-        const QString processedServerId = m_coreController->m_serversUiController->getProcessedServerId();
-        if (processedServerId.isEmpty()) {
-            return;
-        }
-        
-        QJsonArray availableCountries;
-        QString serverCountryCode;
-
-        const auto apiV2 = m_coreController->m_serversRepository->apiV2Config(processedServerId);
-        if (apiV2.has_value()) {
-            availableCountries = apiV2->apiConfig.availableCountries;
-            serverCountryCode = apiV2->apiConfig.serverCountryCode;
-        }
-        
-        m_coreController->m_apiCountryModel->updateModel(availableCountries, serverCountryCode);
-    });
-}
-
-void CoreSignalHandlers::initSubscriptionRefreshHandler()
-{
-    connect(m_coreController->m_subscriptionUiController, &SubscriptionUiController::subscriptionRefreshNeeded, this, [this]() {
-        const QString defaultServerId = m_coreController->m_serversController->getDefaultServerId();
-        if (!defaultServerId.isEmpty()) {
-            m_coreController->m_subscriptionUiController->getAccountInfo(defaultServerId, false);
-        }
-    });
-}
-
-void CoreSignalHandlers::initAdminConfigRevokedHandler()
-{
-    connect(m_coreController->m_installController, &InstallController::clientRevocationRequested, this,
-            [this](const QString &serverId, const ContainerConfig &containerConfig, DockerContainer container) {
-                m_coreController->m_usersController->revokeClient(serverId, containerConfig, container);
-            });
-
-    connect(m_coreController->m_installController, &InstallController::clientAppendRequested, this,
-            [this](const QString &serverId, const QString &clientId, const QString &clientName, DockerContainer container) {
-                m_coreController->m_usersController->appendClient(serverId, clientId, clientName, container);
-            });
-
-    connect(m_coreController->m_usersController, &UsersController::adminConfigRevoked, m_coreController->m_installController,
-            &InstallController::clearCachedProfile);
-}
-
-void CoreSignalHandlers::initPassphraseRequestHandler()
-{
-    connect(m_coreController->m_installUiController, &InstallUiController::passphraseRequestStarted, m_coreController->m_pageController,
-            &PageController::showPassphraseRequestDrawer);
-    connect(m_coreController->m_pageController, &PageController::passphraseRequestDrawerClosed, m_coreController->m_installUiController,
-            &InstallUiController::setEncryptedPassphrase);
-}
-
-void CoreSignalHandlers::initTranslationsUpdatedHandler()
-{
-    connect(m_coreController->m_languageUiController, &LanguageUiController::updateTranslations, m_coreController, &CoreController::updateTranslator);
-    connect(m_coreController, &CoreController::translationsUpdated, m_coreController->m_languageUiController, &LanguageUiController::translationsUpdated);
-    connect(m_coreController, &CoreController::translationsUpdated, m_coreController->m_connectionUiController, &ConnectionUiController::onTranslationsUpdated);
-}
-
-void CoreSignalHandlers::initLanguageHandler()
-{
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::appLanguageChanged, m_coreController->m_languageUiController, &LanguageUiController::onAppLanguageChanged);
-    connect(m_coreController->m_settingsUiController, &SettingsUiController::resetLanguageToSystem, m_coreController->m_languageUiController, [this]() {
-        m_coreController->m_languageUiController->changeLanguage(m_coreController->m_languageUiController->getSystemLanguageEnum());
-    });
-}
-
-void CoreSignalHandlers::initAutoConnectHandler()
-{
-    if (m_coreController->m_settingsUiController->isAutoConnectEnabled()
-        && !m_coreController->m_serversController->getDefaultServerId().isEmpty()) {
-        QTimer::singleShot(1000, this, [this]() { m_coreController->m_connectionUiController->openConnection(); });
-    }
-}
-
-void CoreSignalHandlers::initAmneziaDnsToggledHandler()
-{
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::useAmneziaDnsChanged, m_coreController->m_serversUiController, &ServersUiController::updateModel);
-}
-
-void CoreSignalHandlers::initServersModelUpdateHandler()
-{
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverAdded,
-            m_coreController->m_serversUiController, &ServersUiController::updateModel);
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverEdited,
-            m_coreController->m_serversUiController, &ServersUiController::updateModel);
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverRemoved,
-            m_coreController->m_serversUiController, &ServersUiController::updateModel);
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::defaultServerChanged,
-            m_coreController->m_serversUiController, &ServersUiController::onDefaultServerChanged);
-
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverAdded, this,
-            [this](const QString &serverId) {
-                if (m_coreController->m_serversRepository->apiV2Config(serverId).has_value()) {
-                    m_coreController->m_apiNewsUiController->fetchNews(false);
-                }
-            });
-
-    connect(m_coreController->m_settingsUiController, &SettingsUiController::restoreBackupFinished, this, [this]() {
-        m_coreController->m_serversUiController->updateModel();
-        if (m_coreController->m_serversUiController->hasServersFromGatewayApi()) {
-            m_coreController->m_apiNewsUiController->fetchNews(false);
-        }
-    });
-}
-
-void CoreSignalHandlers::initClientManagementModelUpdateHandler()
-{
-    connect(m_coreController->m_usersController, &UsersController::clientsUpdated,
-            m_coreController->m_clientManagementModel, &ClientManagementModel::updateModel);
-    connect(m_coreController->m_usersController, &UsersController::clientRenamed,
-            m_coreController->m_clientManagementModel, &ClientManagementModel::updateClientName);
-}
-
-void CoreSignalHandlers::initSitesModelUpdateHandler()
-{
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::sitesChanged, m_coreController->m_ipSplitTunnelingUiController, &IpSplitTunnelingUiController::updateModel);
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::sitesSplitTunnelingEnabledChanged, m_coreController->m_ipSplitTunnelingUiController, &IpSplitTunnelingUiController::updateModel);
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::routeModeChanged, m_coreController->m_ipSplitTunnelingUiController, &IpSplitTunnelingUiController::updateModel);
-}
-
-void CoreSignalHandlers::initAllowedDnsModelUpdateHandler()
-{
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::allowedDnsServersChanged, m_coreController->m_allowedDnsUiController, &AllowedDnsUiController::updateModel);
-}
-
-void CoreSignalHandlers::initAppSplitTunnelingModelUpdateHandler()
-{
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::appsChanged, m_coreController->m_appSplitTunnelingUiController, &AppSplitTunnelingUiController::updateModel);
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::appsSplitTunnelingEnabledChanged, m_coreController->m_appSplitTunnelingUiController, &AppSplitTunnelingUiController::updateModel);
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::appsRouteModeChanged, m_coreController->m_appSplitTunnelingUiController, &AppSplitTunnelingUiController::updateModel);
-}
-
-void CoreSignalHandlers::initPrepareConfigHandler()
-{
-    connect(m_coreController->m_connectionUiController, &ConnectionUiController::prepareConfig, this, [this]() {
-        m_coreController->m_connectionController->setConnectionState(Vpn::ConnectionState::Preparing);
-
-        const QString serverId = m_coreController->m_serversController->getDefaultServerId();
-        if (serverId.isEmpty()) {
-            m_coreController->m_connectionController->setConnectionState(Vpn::ConnectionState::Disconnected);
-            return;
-        }
-
-        const serverConfigUtils::ConfigType kind = m_coreController->m_serversRepository->serverKind(serverId);
-
-        if (serverConfigUtils::isApiV2Subscription(kind) || serverConfigUtils::isLegacyApiSubscription(kind)) {
-            m_coreController->m_subscriptionUiController->validateConfig();
-        } else {
-            m_coreController->m_installUiController->validateConfig();
-        }
-    });
-
-    connect(m_coreController->m_subscriptionUiController, &SubscriptionUiController::configValidated, this, [this](bool isValid) {
-        if (!isValid) {
-            m_coreController->m_connectionController->setConnectionState(Vpn::ConnectionState::Disconnected);
-            return;
-        }
-
-        m_coreController->m_connectionUiController->openConnection();
-    });
-
-    connect(m_coreController->m_installUiController, &InstallUiController::configValidated, this, [this](bool isValid) {
-        if (!isValid) {
-            m_coreController->m_connectionController->setConnectionState(Vpn::ConnectionState::Disconnected);
-            return;
-        }
-
-        m_coreController->m_connectionUiController->openConnection();
-    });
-}
-
-void CoreSignalHandlers::initUnsupportedConnectDrawerHandler()
-{
-    connect(m_coreController->m_subscriptionUiController, &SubscriptionUiController::unsupportedConnectDrawerRequested,
-            m_coreController->m_pageController, &PageController::unsupportedConnectDrawerRequested);
-}
-
-void CoreSignalHandlers::initStrictKillSwitchHandler()
-{
-    connect(m_coreController->m_settingsUiController, &SettingsUiController::strictKillSwitchEnabledChanged, m_coreController->m_connectionController,
-            &ConnectionController::onKillSwitchModeChanged);
-}
-
-void CoreSignalHandlers::initAndroidSettingsHandler()
-{
-#ifdef Q_OS_ANDROID
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::saveLogsChanged, AndroidController::instance(), &AndroidController::setSaveLogs);
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::screenshotsEnabledChanged, AndroidController::instance(), &AndroidController::setScreenshotsEnabled);
-    connect(m_coreController->m_serversRepository, &SecureServersRepository::serverRemoved, this,
-            [](const QString &/*serverId*/, int removedIndex) {
-                AndroidController::instance()->resetLastServer(removedIndex);
-            });
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::settingsCleared, []() { AndroidController::instance()->resetLastServer(-1); });
-#endif
-}
-
-void CoreSignalHandlers::initAndroidConnectionHandler()
-{
-#ifdef Q_OS_ANDROID
-    connect(AndroidController::instance(), &AndroidController::initConnectionState, this, [this](Vpn::ConnectionState state) {
-        m_coreController->m_connectionUiController->onConnectionStateChanged(state);
-        m_coreController->m_connectionController->restoreConnection();
-    });
-    connect(AndroidController::instance(), &AndroidController::importConfigFromOutside, this, [this](QString data) {
-        emit m_coreController->m_pageController->goToPageHome();
-        m_coreController->m_importController->extractConfigFromData(data);
-        data.clear();
-        emit m_coreController->m_pageController->goToPageViewConfig();
-    });
-#endif
-}
-
-void CoreSignalHandlers::initIosImportHandler()
-{
-#ifdef Q_OS_IOS
-    connect(IosController::Instance(), &IosController::importConfigFromOutside, this, [this](QString data) {
-        emit m_coreController->m_pageController->goToPageHome();
-        m_coreController->m_importController->extractConfigFromData(data);
-        emit m_coreController->m_pageController->goToPageViewConfig();
-    });
-    connect(IosController::Instance(), &IosController::importBackupFromOutside, this, [this](QString filePath) {
-        emit m_coreController->m_pageController->goToPageHome();
-        m_coreController->m_pageController->goToPageSettingsBackup();
-        emit m_coreController->m_settingsUiController->importBackupFromOutside(filePath);
-    });
-#endif
-}
-
-void CoreSignalHandlers::initIosSettingsHandler()
-{
-#ifdef Q_OS_IOS
-    connect(m_coreController->m_appSettingsRepository, &SecureAppSettingsRepository::screenshotsEnabledChanged, [](bool enabled) { AmneziaVPN::toggleScreenshots(enabled); });
-#endif
-}
-
-void CoreSignalHandlers::initNotificationHandler()
-{
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    m_coreController->m_notificationHandler = NotificationHandler::create(m_coreController);
-
-    connect(m_coreController->m_connectionController, &ConnectionController::connectionStateChanged, m_coreController->m_notificationHandler,
-            &NotificationHandler::setConnectionState);
-
-    connect(m_coreController->m_notificationHandler, &NotificationHandler::raiseRequested, m_coreController->m_pageController, &PageController::raiseMainWindow);
-    connect(m_coreController->m_notificationHandler, &NotificationHandler::connectRequested, m_coreController->m_connectionUiController,
-            static_cast<void (ConnectionUiController::*)()>(&ConnectionUiController::openConnection));
-    connect(m_coreController->m_notificationHandler, &NotificationHandler::disconnectRequested, m_coreController->m_connectionUiController,
-            &ConnectionUiController::closeConnection);
-    connect(m_coreController, &CoreController::translationsUpdated, m_coreController->m_notificationHandler, &NotificationHandler::onTranslationsUpdated);
-
-    auto* trayHandler = qobject_cast<SystemTrayNotificationHandler*>(m_coreController->m_notificationHandler);
-    connect(m_coreController, &CoreController::websiteUrlChanged, trayHandler, &SystemTrayNotificationHandler::updateWebsiteUrl);
-#endif    
-}
-
-void CoreSignalHandlers::initUpdateFoundHandler()
-{
-#if !defined(Q_OS_ANDROID) && !defined(Q_OS_IOS)
-    connect(m_coreController->m_apiNewsUiController, &ApiNewsUiController::fetchNewsFinished, m_coreController->m_updateUiController,
-            &UpdateUiController::checkForUpdates);
-
-    connect(m_coreController->m_updateUiController, &UpdateUiController::updateFound, this, [this]() {
-        const QString version = m_coreController->m_updateUiController->getVersion();
-        const QString updateId = version.isEmpty() ? QStringLiteral("update") : QStringLiteral("update-%1").arg(version);
-        m_coreController->m_newsModel->setUpdateNotification(
-                updateId, m_coreController->m_updateUiController->getHeaderText(), m_coreController->m_updateUiController->getChangelogText());
-        emit m_coreController->m_pageController->showChangelogDrawer();
-    });
-#endif
-}
-
--- a/client/core/controllers/coreSignalHandlers.h
+++ b/client/core/controllers/coreSignalHandlers.h
@@ -1,49 +0,0 @@
-#ifndef CORESIGNALHANDLERS_H
-#define CORESIGNALHANDLERS_H
-
-#include <QObject>
-#include "core/controllers/coreController.h"
-
-class CoreSignalHandlers : public QObject
-{
-    Q_OBJECT
-
-public:
-    explicit CoreSignalHandlers(CoreController* coreController, QObject* parent = nullptr);
-
-    void initAllHandlers();
-
-private:
-    void initErrorMessagesHandler();
-    void initSettingsSplitTunnelingHandler();
-    void initInstallControllerHandler();
-    void initExportControllerHandler();
-    void initImportControllerHandler();
-    void initApiCountryModelUpdateHandler();
-    void initSubscriptionRefreshHandler();
-    void initAdminConfigRevokedHandler();
-    void initPassphraseRequestHandler();
-    void initTranslationsUpdatedHandler();
-    void initLanguageHandler();
-    void initAutoConnectHandler();
-    void initAmneziaDnsToggledHandler();
-    void initServersModelUpdateHandler();
-    void initClientManagementModelUpdateHandler();
-    void initSitesModelUpdateHandler();
-    void initAllowedDnsModelUpdateHandler();
-    void initAppSplitTunnelingModelUpdateHandler();
-    void initPrepareConfigHandler();
-    void initUnsupportedConnectDrawerHandler();
-    void initStrictKillSwitchHandler();
-    void initAndroidSettingsHandler();
-    void initAndroidConnectionHandler();
-    void initIosImportHandler();
-    void initIosSettingsHandler();
-    void initNotificationHandler();
-    void initUpdateFoundHandler();
-
-    CoreController* m_coreController;
-};
-
-#endif // CORESIGNALHANDLERS_H
-
--- a/client/core/controllers/gatewayController.cpp
+++ b/client/core/controllers/gatewayController.cpp
@@ -10,35 +10,30 @@
 #include <QJsonObject>
 #include <QNetworkReply>
 #include <QPromise>
-#include <QTimer>
 #include <QUrl>

 #include "QBlockCipher.h"
 #include "QRsa.h"

-#include "amneziaApplication.h"
-#include "core/utils/api/apiUtils.h"
-#include "core/utils/constants/apiKeys.h"
-#include "core/utils/networkUtilities.h"
-#include "core/utils/utilities.h"
-
-#ifdef Q_OS_IOS
-    #include "platforms/ios/ios_controller.h"
-#endif
+#include "amnezia_application.h"
+#include "core/api/apiUtils.h"
+#include "core/networkUtilities.h"
+#include "utilities.h"

 #ifdef AMNEZIA_DESKTOP
-    #include "core/utils/ipcClient.h"
+    #include "core/ipcclient.h"
 #endif

 namespace
 {
-    void execNetworkWaitLoop(QEventLoop &wait)
+    namespace configKey
    {
-#ifdef Q_OS_IOS
-        wait.exec();
-#else
-        wait.exec(QEventLoop::ExcludeUserInputEvents);
-#endif
+        constexpr char aesKey[] = "aes_key";
+        constexpr char aesIv[] = "aes_iv";
+        constexpr char aesSalt[] = "aes_salt";
+
+        constexpr char apiPayload[] = "api_payload";
+        constexpr char keyPayload[] = "key_payload";
    }

    constexpr QLatin1String errorResponsePattern1("No active configuration found for");
@@ -49,31 +44,14 @@ namespace

    constexpr int httpStatusCodeNotFound = 404;
    constexpr int httpStatusCodeConflict = 409;
+
    constexpr int httpStatusCodeNotImplemented = 501;
-    constexpr int httpStatusCodePaymentRequired = 402;
-    constexpr int httpStatusCodeUnprocessableEntity = 422;
-
-    constexpr QLatin1String unprocessableSubscriptionMessage("Failed to retrieve subscription information. Is it activated?");
-
-    constexpr int proxyStorageRequestTimeoutMsecs = 3000;
-
-    QString normalizedGatewayBase(const QString &endpoint)
-    {
-        QString e = endpoint.trimmed();
-        if (e.isEmpty()) {
-            return e;
-        }
-        if (!e.endsWith(QLatin1Char('/'))) {
-            e.append(QLatin1Char('/'));
-        }
-        return e;
-    }
-} // namespace
+}

 GatewayController::GatewayController(const QString &gatewayEndpoint, const bool isDevEnvironment, const int requestTimeoutMsecs,
                                     const bool isStrictKillSwitchEnabled, QObject *parent)
    : QObject(parent),
-      m_gatewayEndpoint(normalizedGatewayBase(gatewayEndpoint)),
+      m_gatewayEndpoint(gatewayEndpoint),
      m_isDevEnvironment(isDevEnvironment),
      m_requestTimeoutMsecs(requestTimeoutMsecs),
      m_isStrictKillSwitchEnabled(isStrictKillSwitchEnabled)
@@ -116,9 +94,9 @@ GatewayController::EncryptedRequestData GatewayController::prepareRequest(const
    encRequestData.salt = blockCipher.generatePrivateSalt(8);

    QJsonObject keyPayload;
-    keyPayload[apiDefs::key::aesKey] = QString(encRequestData.key.toBase64());
-    keyPayload[apiDefs::key::aesIv] = QString(encRequestData.iv.toBase64());
-    keyPayload[apiDefs::key::aesSalt] = QString(encRequestData.salt.toBase64());
+    keyPayload[configKey::aesKey] = QString(encRequestData.key.toBase64());
+    keyPayload[configKey::aesIv] = QString(encRequestData.iv.toBase64());
+    keyPayload[configKey::aesSalt] = QString(encRequestData.salt.toBase64());

    QByteArray encryptedKeyPayload;
    QByteArray encryptedApiPayload;
@@ -150,8 +128,8 @@ GatewayController::EncryptedRequestData GatewayController::prepareRequest(const
    }

    QJsonObject requestBody;
-    requestBody[apiDefs::key::keyPayload] = QString(encryptedKeyPayload.toBase64());
-    requestBody[apiDefs::key::apiPayload] = QString(encryptedApiPayload.toBase64());
+    requestBody[configKey::keyPayload] = QString(encryptedKeyPayload.toBase64());
+    requestBody[configKey::apiPayload] = QString(encryptedApiPayload.toBase64());

    encRequestData.requestBody = QJsonDocument(requestBody).toJson();
    return encRequestData;
@@ -161,8 +139,6 @@ GatewayController::DecryptionResult GatewayController::tryDecryptResponseBody(co
                                                                              QNetworkReply::NetworkError replyError, const QByteArray &key,
                                                                              const QByteArray &iv, const QByteArray &salt)
 {
-    Q_UNUSED(replyError);
-
    DecryptionResult result;
    result.decryptedBody = encryptedResponseBody;
    result.isDecryptionSuccessful = false;
@@ -179,29 +155,6 @@ GatewayController::DecryptionResult GatewayController::tryDecryptResponseBody(co
    return result;
 }

-GatewayController::DecryptionResult GatewayController::resolveResponseBody(const QByteArray &responseBody,
-                                                                           QNetworkReply::NetworkError replyError, const QByteArray &key,
-                                                                           const QByteArray &iv, const QByteArray &salt)
-{
-    DecryptionResult result = tryDecryptResponseBody(responseBody, replyError, key, iv, salt);
-    if (result.isDecryptionSuccessful || !m_isDevEnvironment) {
-        return result;
-    }
-
-    const QByteArray trimmed = responseBody.trimmed();
-    if (trimmed.isEmpty() || trimmed.front() != '{') {
-        return result;
-    }
-
-    QJsonParseError parseError;
-    const QJsonDocument doc = QJsonDocument::fromJson(trimmed, &parseError);
-    if (parseError.error == QJsonParseError::NoError && doc.isObject()) {
-        result.decryptedBody = trimmed;
-        result.isDecryptionSuccessful = true;
-    }
-    return result;
-}
-
 ErrorCode GatewayController::post(const QString &endpoint, const QJsonObject apiPayload, QByteArray &responseBody)
 {
    EncryptedRequestData encRequestData = prepareRequest(endpoint, apiPayload);
@@ -216,7 +169,7 @@ ErrorCode GatewayController::post(const QString &endpoint, const QJsonObject api

    QList<QSslError> sslErrors;
    connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
-    execNetworkWaitLoop(wait);
+    wait.exec(QEventLoop::ExcludeUserInputEvents);

    QByteArray encryptedResponseBody = reply->readAll();
    QString replyErrorString = reply->errorString();
@@ -225,18 +178,8 @@ ErrorCode GatewayController::post(const QString &endpoint, const QJsonObject api

    reply->deleteLater();

-    if (encRequestData.isPlaintextLocalGateway) {
-        const auto errorCode =
-                apiUtils::checkNetworkReplyErrors(sslErrors, replyErrorString, replyError, httpStatusCode, encryptedResponseBody);
-        if (errorCode) {
-            return errorCode;
-        }
-        responseBody = encryptedResponseBody;
-        return ErrorCode::NoError;
-    }
-
    auto decryptionResult =
-            resolveResponseBody(encryptedResponseBody, replyError, encRequestData.key, encRequestData.iv, encRequestData.salt);
+            tryDecryptResponseBody(encryptedResponseBody, replyError, encRequestData.key, encRequestData.iv, encRequestData.salt);

    if (sslErrors.isEmpty() && shouldBypassProxy(replyError, decryptionResult.decryptedBody, decryptionResult.isDecryptionSuccessful)) {
        auto requestFunction = [&encRequestData, &encryptedResponseBody](const QString &url) {
@@ -252,7 +195,7 @@ ErrorCode GatewayController::post(const QString &endpoint, const QJsonObject api
            httpStatusCode = reply->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();

            decryptionResult =
-                    resolveResponseBody(encryptedResponseBody, replyError, encRequestData.key, encRequestData.iv, encRequestData.salt);
+                    tryDecryptResponseBody(encryptedResponseBody, replyError, encRequestData.key, encRequestData.iv, encRequestData.salt);

            if (!sslErrors.isEmpty()
                || shouldBypassProxy(replyError, decryptionResult.decryptedBody, decryptionResult.isDecryptionSuccessful)) {
@@ -282,15 +225,11 @@ ErrorCode GatewayController::post(const QString &endpoint, const QJsonObject api
    return ErrorCode::NoError;
 }

-QFuture<QPair<ErrorCode, QByteArray>> GatewayController::postAsync(const QString &endpoint, const QJsonObject &apiPayload,
-                                                                   QNetworkReply **activeReplyOut,
-                                                                   const QSharedPointer<GatewayController> &keepAlive)
+QFuture<QPair<ErrorCode, QByteArray>> GatewayController::postAsync(const QString &endpoint, const QJsonObject apiPayload)
 {
    auto promise = QSharedPointer<QPromise<QPair<ErrorCode, QByteArray>>>::create();
    promise->start();

-    const QSharedPointer<GatewayController> life = keepAlive;
-
    EncryptedRequestData encRequestData = prepareRequest(endpoint, apiPayload);
    if (encRequestData.errorCode != ErrorCode::NoError) {
        promise->addResult(qMakePair(encRequestData.errorCode, QByteArray()));
@@ -299,22 +238,12 @@ QFuture<QPair<ErrorCode, QByteArray>> GatewayController::postAsync(const QString
    }

    QNetworkReply *reply = amnApp->networkManager()->post(encRequestData.request, encRequestData.requestBody);
-    if (activeReplyOut) {
-        *activeReplyOut = reply;
-    }

    auto sslErrors = QSharedPointer<QList<QSslError>>::create();

    connect(reply, &QNetworkReply::sslErrors, [sslErrors](const QList<QSslError> &errors) { *sslErrors = errors; });

-    connect(reply, &QNetworkReply::finished, reply, [promise, sslErrors, encRequestData, endpoint, apiPayload, reply, life]() mutable {
-        if (!life) {
-            promise->addResult(qMakePair(ErrorCode::ApiConfigDecryptionError, QByteArray()));
-            promise->finish();
-            return;
-        }
-
-        GatewayController *const ctl = life.data();
+    connect(reply, &QNetworkReply::finished, reply, [promise, sslErrors, encRequestData, endpoint, apiPayload, reply, this]() mutable {
        QByteArray encryptedResponseBody = reply->readAll();
        QString replyErrorString = reply->errorString();
        auto replyError = reply->error();
@@ -322,20 +251,8 @@ QFuture<QPair<ErrorCode, QByteArray>> GatewayController::postAsync(const QString

        reply->deleteLater();

-        if (encRequestData.isPlaintextLocalGateway) {
-            const auto errorCode = apiUtils::checkNetworkReplyErrors(*sslErrors, replyErrorString, replyError, httpStatusCode,
-                                                                    encryptedResponseBody);
-            if (errorCode) {
-                promise->addResult(qMakePair(errorCode, QByteArray()));
-            } else {
-                promise->addResult(qMakePair(ErrorCode::NoError, encryptedResponseBody));
-            }
-            promise->finish();
-            return;
-        }
-
        auto decryptionResult =
-                ctl->resolveResponseBody(encryptedResponseBody, replyError, encRequestData.key, encRequestData.iv, encRequestData.salt);
+                tryDecryptResponseBody(encryptedResponseBody, replyError, encRequestData.key, encRequestData.iv, encRequestData.salt);

        auto processResponse = [promise, encRequestData](const GatewayController::DecryptionResult &decryptionResult,
                                                         const QList<QSslError> &sslErrors, QNetworkReply::NetworkError replyError,
@@ -360,60 +277,41 @@ QFuture<QPair<ErrorCode, QByteArray>> GatewayController::postAsync(const QString
            promise->finish();
        };

-        if (sslErrors->isEmpty() && ctl->shouldBypassProxy(replyError, decryptionResult.decryptedBody, decryptionResult.isDecryptionSuccessful)) {
+        if (sslErrors->isEmpty() && shouldBypassProxy(replyError, decryptionResult.decryptedBody, decryptionResult.isDecryptionSuccessful)) {
            auto serviceType = apiPayload.value(apiDefs::key::serviceType).toString("");
            auto userCountryCode = apiPayload.value(apiDefs::key::userCountryCode).toString("");

-            QStringList primaryBaseUrls;
-            QStringList fallbackBaseUrls;
-            if (ctl->m_isDevEnvironment) {
-                primaryBaseUrls = QString(DEV_S3_ENDPOINT).split(", ", Qt::SkipEmptyParts);
+            QStringList baseUrls;
+            if (m_isDevEnvironment) {
+                baseUrls = QString(DEV_S3_ENDPOINT).split(", ");
            } else {
-                primaryBaseUrls = QString(PROD_S3_ENDPOINT).split(", ", Qt::SkipEmptyParts);
-                fallbackBaseUrls = QString(FALLBACK_S3_ENDPOINT).split(", ", Qt::SkipEmptyParts);
+                baseUrls = QString(PROD_S3_ENDPOINT).split(", ");
            }
-            std::random_device randomDevice;
-            std::mt19937 generator(randomDevice());
-            std::shuffle(primaryBaseUrls.begin(), primaryBaseUrls.end(), generator);
-            std::shuffle(fallbackBaseUrls.begin(), fallbackBaseUrls.end(), generator);
-
-            auto appendStorageUrls = [&serviceType, &userCountryCode](const QStringList &baseUrls, QStringList &target) {
-                if (!serviceType.isEmpty()) {
-                    for (const auto &baseUrl : baseUrls) {
-                        QByteArray path = ("endpoints-" + serviceType + "-" + userCountryCode).toUtf8();
-                        target.push_back(baseUrl + path.toBase64(QByteArray::Base64UrlEncoding | QByteArray::OmitTrailingEquals) + ".json");
-                    }
-                }
-                for (const auto &baseUrl : baseUrls) {
-                    target.push_back(baseUrl + "endpoints.json");
-                }
-            };

            QStringList proxyStorageUrls;
-            appendStorageUrls(primaryBaseUrls, proxyStorageUrls);
-            appendStorageUrls(fallbackBaseUrls, proxyStorageUrls);
+            if (!serviceType.isEmpty()) {
+                for (const auto &baseUrl : baseUrls) {
+                    QByteArray path = ("endpoints-" + serviceType + "-" + userCountryCode).toUtf8();
+                    proxyStorageUrls.push_back(baseUrl + path.toBase64(QByteArray::Base64UrlEncoding | QByteArray::OmitTrailingEquals)
+                                               + ".json");
+                }
+            }
+            for (const auto &baseUrl : baseUrls)
+                proxyStorageUrls.push_back(baseUrl + "endpoints.json");

-            life->getProxyUrlsAsync(life, proxyStorageUrls, 0,
-                                    [life, encRequestData, endpoint, processResponse](const QStringList &proxyUrls) {
-                                        life->getProxyUrlAsync(life, proxyUrls, 0,
-                                                               [life, encRequestData, endpoint, processResponse](
-                                                                       const QString &proxyUrl) {
-                                                                   life->bypassProxyAsync(
-                                                                           life, endpoint, proxyUrl, encRequestData,
-                                                                           [processResponse](const QByteArray &decryptedBody,
-                                                                                             bool isDecryptionSuccessful,
-                                                                                             const QList<QSslError> &sslErrors,
-                                                                                             QNetworkReply::NetworkError replyError,
-                                                                                             const QString &replyErrorString,
-                                                                                             int httpStatusCode) {
-                                                                               GatewayController::DecryptionResult result;
-                                                                               result.decryptedBody = decryptedBody;
-                                                                               result.isDecryptionSuccessful = isDecryptionSuccessful;
-                                                                               processResponse(result, sslErrors, replyError,
-                                                                                               replyErrorString, httpStatusCode);
-                                                                           });
-                                                               });
-                                    });
+            getProxyUrlsAsync(proxyStorageUrls, 0, [this, encRequestData, endpoint, processResponse](const QStringList &proxyUrls) {
+                getProxyUrlAsync(proxyUrls, 0, [this, encRequestData, endpoint, processResponse](const QString &proxyUrl) {
+                    bypassProxyAsync(endpoint, proxyUrl, encRequestData,
+                                     [processResponse, this](const QByteArray &decryptedBody, bool isDecryptionSuccessful,
+                                                             const QList<QSslError> &sslErrors, QNetworkReply::NetworkError replyError,
+                                                             const QString &replyErrorString, int httpStatusCode) {
+                                         GatewayController::DecryptionResult result;
+                                         result.decryptedBody = decryptedBody;
+                                         result.isDecryptionSuccessful = isDecryptionSuccessful;
+                                         processResponse(result, sslErrors, replyError, replyErrorString, httpStatusCode);
+                                     });
+                });
+            });

        } else {
            processResponse(decryptionResult, *sslErrors, replyError, replyErrorString, httpStatusCode);
@@ -426,48 +324,31 @@ QFuture<QPair<ErrorCode, QByteArray>> GatewayController::postAsync(const QString
 QStringList GatewayController::getProxyUrls(const QString &serviceType, const QString &userCountryCode)
 {
    QNetworkRequest request;
-    request.setTransferTimeout(proxyStorageRequestTimeoutMsecs);
+    request.setTransferTimeout(m_requestTimeoutMsecs);
    request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");

    QEventLoop wait;
    QList<QSslError> sslErrors;
    QNetworkReply *reply;

-    QStringList primaryBaseUrls;
-    QStringList fallbackBaseUrls;
+    QStringList baseUrls;
    if (m_isDevEnvironment) {
-        primaryBaseUrls = QString(DEV_S3_ENDPOINT).split(", ", Qt::SkipEmptyParts);
+        baseUrls = QString(DEV_S3_ENDPOINT).split(", ");
    } else {
-        primaryBaseUrls = QString(PROD_S3_ENDPOINT).split(", ", Qt::SkipEmptyParts);
-        fallbackBaseUrls = QString(FALLBACK_S3_ENDPOINT).split(", ", Qt::SkipEmptyParts);
+        baseUrls = QString(PROD_S3_ENDPOINT).split(", ");
    }

-    std::random_device randomDevice;
-    std::mt19937 generator(randomDevice());
-    std::shuffle(primaryBaseUrls.begin(), primaryBaseUrls.end(), generator);
-    std::shuffle(fallbackBaseUrls.begin(), fallbackBaseUrls.end(), generator);
-
    QByteArray key = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;

-    auto appendStorageUrls = [&serviceType, &userCountryCode](const QStringList &baseUrls, QStringList &target) {
-        if (!serviceType.isEmpty()) {
-            for (const auto &baseUrl : baseUrls) {
-                QByteArray path = ("endpoints-" + serviceType + "-" + userCountryCode).toUtf8();
-                target.push_back(baseUrl + path.toBase64(QByteArray::Base64UrlEncoding | QByteArray::OmitTrailingEquals) + ".json");
-            }
-        }
-        for (const auto &baseUrl : baseUrls) {
-            target.push_back(baseUrl + "endpoints.json");
-        }
-    };
-
    QStringList proxyStorageUrls;
-    appendStorageUrls(primaryBaseUrls, proxyStorageUrls);
-    appendStorageUrls(fallbackBaseUrls, proxyStorageUrls);
-
-    if (proxyStorageUrls.empty()) {
-        qDebug() << "empty storage endpoint list";
-        return {};
+    if (!serviceType.isEmpty()) {
+        for (const auto &baseUrl : baseUrls) {
+            QByteArray path = ("endpoints-" + serviceType + "-" + userCountryCode).toUtf8();
+            proxyStorageUrls.push_back(baseUrl + path.toBase64(QByteArray::Base64UrlEncoding | QByteArray::OmitTrailingEquals) + ".json");
+        }
+    }
+    for (const auto &baseUrl : baseUrls) {
+        proxyStorageUrls.push_back(baseUrl + "endpoints.json");
    }

    for (const auto &proxyStorageUrl : proxyStorageUrls) {
@@ -476,7 +357,7 @@ QStringList GatewayController::getProxyUrls(const QString &serviceType, const QS

        connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
        connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
-        execNetworkWaitLoop(wait);
+        wait.exec(QEventLoop::ExcludeUserInputEvents);

        if (reply->error() == QNetworkReply::NetworkError::NoError) {
            auto encryptedResponseBody = reply->readAll();
@@ -529,20 +410,14 @@ QStringList GatewayController::getProxyUrls(const QString &serviceType, const QS
 bool GatewayController::shouldBypassProxy(const QNetworkReply::NetworkError &replyError, const QByteArray &decryptedResponseBody,
                                          bool isDecryptionSuccessful)
 {
-    if (m_isDevEnvironment) {
-        return false;
-    }
-
    const QByteArray &responseBody = decryptedResponseBody;

-    int apiHttpStatus = -1;
-    QString apiErrorMessage;
+    int httpStatus = -1;
    if (isDecryptionSuccessful) {
        QJsonDocument jsonDoc = QJsonDocument::fromJson(responseBody);
        if (jsonDoc.isObject()) {
            QJsonObject jsonObj = jsonDoc.object();
-            apiHttpStatus = jsonObj.value("http_status").toInt(-1);
-            apiErrorMessage = jsonObj.value(QStringLiteral("message")).toString().trimmed();
+            httpStatus = jsonObj.value("http_status").toInt(-1);
        }
    } else {
        qDebug() << "failed to decrypt the data";
@@ -553,12 +428,10 @@ bool GatewayController::shouldBypassProxy(const QNetworkReply::NetworkError &rep
        qDebug() << "timeout occurred";
        qDebug() << replyError;
        return true;
-    } 
-    if (responseBody.contains("html")) {
+    } else if (responseBody.contains("html")) {
        qDebug() << "the response contains an html tag";
        return true;
-    } 
-    if (apiHttpStatus == httpStatusCodeNotFound) {
+    } else if (httpStatus == httpStatusCodeNotFound) {
        if (responseBody.contains(errorResponsePattern1) || responseBody.contains(errorResponsePattern2)
            || responseBody.contains(errorResponsePattern3)) {
            return false;
@@ -566,25 +439,16 @@ bool GatewayController::shouldBypassProxy(const QNetworkReply::NetworkError &rep
            qDebug() << replyError;
            return true;
        }
-    } 
-    if (apiHttpStatus == httpStatusCodeNotImplemented) {
+    } else if (httpStatus == httpStatusCodeNotImplemented) {
        if (responseBody.contains(updateRequestResponsePattern)) {
            return false;
        } else {
            qDebug() << replyError;
            return true;
        }
-    } 
-    if (apiHttpStatus == httpStatusCodeConflict) {
+    } else if (httpStatus == httpStatusCodeConflict) {
        return false;
-    } 
-    if (apiHttpStatus == httpStatusCodePaymentRequired) {
-        return false;
-    } 
-    if (apiHttpStatus == httpStatusCodeUnprocessableEntity) {
-        return apiErrorMessage != unprocessableSubscriptionMessage;
-    } 
-    if (replyError != QNetworkReply::NetworkError::NoError) {
+    } else if (replyError != QNetworkReply::NetworkError::NoError) {
        qDebug() << replyError;
        return true;
    }
@@ -613,7 +477,7 @@ void GatewayController::bypassProxy(const QString &endpoint, const QString &serv

        QObject::connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
        connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
-        execNetworkWaitLoop(wait);
+        wait.exec(QEventLoop::ExcludeUserInputEvents);

        auto result = replyProcessingFunction(reply, sslErrors);
        reply->deleteLater();
@@ -635,7 +499,7 @@ void GatewayController::bypassProxy(const QString &endpoint, const QString &serv

            connect(reply, &QNetworkReply::finished, &wait, &QEventLoop::quit);
            connect(reply, &QNetworkReply::sslErrors, [this, &sslErrors](const QList<QSslError> &errors) { sslErrors = errors; });
-            execNetworkWaitLoop(wait);
+            wait.exec(QEventLoop::ExcludeUserInputEvents);

            if (reply->error() == QNetworkReply::NetworkError::NoError) {
                reply->deleteLater();
@@ -664,43 +528,32 @@ void GatewayController::bypassProxy(const QString &endpoint, const QString &serv
    }
 }

-void GatewayController::getProxyUrlsAsync(const QSharedPointer<GatewayController> &life, const QStringList &proxyStorageUrls,
-                                          const int currentProxyStorageIndex, const std::function<void(const QStringList &)> &onComplete)
+void GatewayController::getProxyUrlsAsync(const QStringList proxyStorageUrls, const int currentProxyStorageIndex,
+                                          std::function<void(const QStringList &)> onComplete)
 {
-    if (!life) {
-        onComplete({});
-        return;
-    }
-
    if (currentProxyStorageIndex >= proxyStorageUrls.size()) {
        onComplete({});
        return;
    }

    QNetworkRequest request;
-    request.setTransferTimeout(proxyStorageRequestTimeoutMsecs);
+    request.setTransferTimeout(m_requestTimeoutMsecs);
    request.setHeader(QNetworkRequest::ContentTypeHeader, "application/json");
    request.setUrl(proxyStorageUrls[currentProxyStorageIndex]);

    QNetworkReply *reply = amnApp->networkManager()->get(request);

-    connect(reply, &QNetworkReply::finished, reply, [life, proxyStorageUrls, currentProxyStorageIndex, onComplete, reply]() {
-        if (!life) {
-            onComplete({});
-            reply->deleteLater();
-            return;
-        }
-
-        GatewayController *const ctl = life.data();
+    // connect(reply, &QNetworkReply::sslErrors, this, [state](const QList<QSslError> &e) { *(state->sslErrors) = e; });

+    connect(reply, &QNetworkReply::finished, this, [this, proxyStorageUrls, currentProxyStorageIndex, onComplete, reply]() {
        if (reply->error() == QNetworkReply::NoError) {
            QByteArray encrypted = reply->readAll();
            reply->deleteLater();

            QByteArray responseBody;
            try {
-                QByteArray key = ctl->m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
-                if (!ctl->m_isDevEnvironment) {
+                QByteArray key = m_isDevEnvironment ? DEV_AGW_PUBLIC_KEY : PROD_AGW_PUBLIC_KEY;
+                if (!m_isDevEnvironment) {
                    QCryptographicHash hash(QCryptographicHash::Sha512);
                    hash.addData(key);
                    QByteArray h = hash.result().toHex();
@@ -717,21 +570,15 @@ void GatewayController::getProxyUrlsAsync(const QSharedPointer<GatewayController
            } catch (...) {
                Utils::logException();
                qCritical() << "error decrypting payload";
-                QTimer::singleShot(0, ctl, [life, proxyStorageUrls, currentProxyStorageIndex, onComplete]() {
-                    if (life) {
-                        life->getProxyUrlsAsync(life, proxyStorageUrls, currentProxyStorageIndex + 1, onComplete);
-                    } else {
-                        onComplete({});
-                    }
-                });
+                QMetaObject::invokeMethod(
+                        this, [=]() { getProxyUrlsAsync(proxyStorageUrls, currentProxyStorageIndex + 1, onComplete); }, Qt::QueuedConnection);
                return;
            }

            QJsonArray endpointsArray = QJsonDocument::fromJson(responseBody).array();
            QStringList endpoints;
-            for (const QJsonValue &endpoint : endpointsArray) {
+            for (const QJsonValue &endpoint : endpointsArray)
                endpoints.push_back(endpoint.toString());
-            }

            QStringList shuffled = endpoints;
            std::random_device randomDevice;
@@ -746,26 +593,16 @@ void GatewayController::getProxyUrlsAsync(const QSharedPointer<GatewayController
        qDebug() << httpStatusCode;
        qDebug() << "go to the next storage endpoint";
        reply->deleteLater();
-        QTimer::singleShot(0, ctl, [life, proxyStorageUrls, currentProxyStorageIndex, onComplete]() {
-            if (life) {
-                life->getProxyUrlsAsync(life, proxyStorageUrls, currentProxyStorageIndex + 1, onComplete);
-            } else {
-                onComplete({});
-            }
-        });
+        QMetaObject::invokeMethod(
+                this, [=]() { getProxyUrlsAsync(proxyStorageUrls, currentProxyStorageIndex + 1, onComplete); }, Qt::QueuedConnection);
    });
 }

-void GatewayController::getProxyUrlAsync(const QSharedPointer<GatewayController> &life, const QStringList &proxyUrls,
-                                         const int currentProxyIndex, const std::function<void(const QString &)> &onComplete)
+void GatewayController::getProxyUrlAsync(const QStringList proxyUrls, const int currentProxyIndex,
+                                         std::function<void(const QString &)> onComplete)
 {
-    if (!life) {
-        onComplete(QString());
-        return;
-    }
-
    if (currentProxyIndex >= proxyUrls.size()) {
-        onComplete(QString());
+        onComplete("");
        return;
    }

@@ -776,16 +613,13 @@ void GatewayController::getProxyUrlAsync(const QSharedPointer<GatewayController>

    QNetworkReply *reply = amnApp->networkManager()->get(request);

-    connect(reply, &QNetworkReply::finished, reply, [life, proxyUrls, currentProxyIndex, onComplete, reply]() {
+    // connect(reply, &QNetworkReply::sslErrors, this, [state](const QList<QSslError> &e) {
+    //     *(state->sslErrors) = e;
+    // });
+
+    connect(reply, &QNetworkReply::finished, this, [this, proxyUrls, currentProxyIndex, onComplete, reply]() {
        reply->deleteLater();

-        if (!life) {
-            onComplete(QString());
-            return;
-        }
-
-        GatewayController *const ctl = life.data();
-
        if (reply->error() == QNetworkReply::NoError) {
            m_proxyUrl = proxyUrls[currentProxyIndex];
            onComplete(m_proxyUrl);
@@ -793,28 +627,15 @@ void GatewayController::getProxyUrlAsync(const QSharedPointer<GatewayController>
        }

        qDebug() << "go to the next proxy endpoint";
-        QTimer::singleShot(0, ctl, [life, proxyUrls, currentProxyIndex, onComplete]() {
-            if (life) {
-                life->getProxyUrlAsync(life, proxyUrls, currentProxyIndex + 1, onComplete);
-            } else {
-                onComplete(QString());
-            }
-        });
+        QMetaObject::invokeMethod(this, [=]() { getProxyUrlAsync(proxyUrls, currentProxyIndex + 1, onComplete); }, Qt::QueuedConnection);
    });
 }

 void GatewayController::bypassProxyAsync(
-        const QSharedPointer<GatewayController> &life, const QString &endpoint, const QString &proxyUrl,
-        const EncryptedRequestData &encRequestData,
-        const std::function<void(const QByteArray &, bool, const QList<QSslError> &, QNetworkReply::NetworkError, const QString &, int)>
-                &onComplete)
+        const QString &endpoint, const QString &proxyUrl, EncryptedRequestData encRequestData,
+        std::function<void(const QByteArray &, bool, const QList<QSslError> &, QNetworkReply::NetworkError, const QString &, int)> onComplete)
 {
    auto sslErrors = QSharedPointer<QList<QSslError>>::create();
-    if (!life) {
-        onComplete(QByteArray(), false, *sslErrors, QNetworkReply::InternalServerError, QStringLiteral("gateway gone"), 0);
-        return;
-    }
-
    if (proxyUrl.isEmpty()) {
        onComplete(QByteArray(), false, *sslErrors, QNetworkReply::InternalServerError, "empty proxy url", 0);
        return;
@@ -825,9 +646,9 @@ void GatewayController::bypassProxyAsync(

    QNetworkReply *reply = amnApp->networkManager()->post(request, encRequestData.requestBody);

-    connect(reply, &QNetworkReply::sslErrors, reply, [sslErrors](const QList<QSslError> &errors) { *sslErrors = errors; });
+    connect(reply, &QNetworkReply::sslErrors, this, [sslErrors](const QList<QSslError> &errors) { *sslErrors = errors; });

-    connect(reply, &QNetworkReply::finished, reply, [life, sslErrors, onComplete, encRequestData, reply]() {
+    connect(reply, &QNetworkReply::finished, this, [sslErrors, onComplete, encRequestData, reply, this]() {
        QByteArray encryptedResponseBody = reply->readAll();
        QString replyErrorString = reply->errorString();
        auto replyError = reply->error();
@@ -835,13 +656,8 @@ void GatewayController::bypassProxyAsync(

        reply->deleteLater();

-        if (!life) {
-            onComplete(QByteArray(), false, *sslErrors, QNetworkReply::InternalServerError, QStringLiteral("gateway gone"), 0);
-            return;
-        }
-
-        auto decryptionResult = life->resolveResponseBody(encryptedResponseBody, replyError, encRequestData.key, encRequestData.iv,
-                                                            encRequestData.salt);
+        auto decryptionResult =
+                tryDecryptResponseBody(encryptedResponseBody, replyError, encRequestData.key, encRequestData.iv, encRequestData.salt);

        onComplete(decryptionResult.decryptedBody, decryptionResult.isDecryptionSuccessful, *sslErrors, replyError, replyErrorString,
                   httpStatusCode);
--- a/client/core/controllers/gatewayController.h
+++ b/client/core/controllers/gatewayController.h
@@ -1,8 +1,6 @@
 #ifndef GATEWAYCONTROLLER_H
 #define GATEWAYCONTROLLER_H

-#include <functional>
-
 #include <QFuture>
 #include <QNetworkReply>
 #include <QObject>
@@ -10,9 +8,7 @@
 #include <QPromise>
 #include <QSharedPointer>

-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
+#include "core/defs.h"

 #ifdef Q_OS_IOS
    #include "platforms/ios/ios_controller.h"
@@ -27,9 +23,7 @@ public:
                               const bool isStrictKillSwitchEnabled, QObject *parent = nullptr);

    amnezia::ErrorCode post(const QString &endpoint, const QJsonObject apiPayload, QByteArray &responseBody);
-    QFuture<QPair<amnezia::ErrorCode, QByteArray>> postAsync(const QString &endpoint, const QJsonObject &apiPayload,
-                                                            QNetworkReply **activeReplyOut = nullptr,
-                                                            const QSharedPointer<GatewayController> &keepAlive = {});
+    QFuture<QPair<amnezia::ErrorCode, QByteArray>> postAsync(const QString &endpoint, const QJsonObject apiPayload);

 private:
    struct EncryptedRequestData
@@ -40,7 +34,6 @@ private:
        QByteArray iv;
        QByteArray salt;
        amnezia::ErrorCode errorCode;
-        bool isPlaintextLocalGateway = false;
    };

    struct DecryptionResult
@@ -52,8 +45,6 @@ private:
    EncryptedRequestData prepareRequest(const QString &endpoint, const QJsonObject &apiPayload);
    DecryptionResult tryDecryptResponseBody(const QByteArray &encryptedResponseBody, QNetworkReply::NetworkError replyError,
                                            const QByteArray &key, const QByteArray &iv, const QByteArray &salt);
-    DecryptionResult resolveResponseBody(const QByteArray &responseBody, QNetworkReply::NetworkError replyError, const QByteArray &key,
-                                         const QByteArray &iv, const QByteArray &salt);

    QStringList getProxyUrls(const QString &serviceType, const QString &userCountryCode);
    bool shouldBypassProxy(const QNetworkReply::NetworkError &replyError, const QByteArray &decryptedResponseBody, bool isDecryptionSuccessful);
@@ -61,13 +52,12 @@ private:
                     std::function<QNetworkReply *(const QString &url)> requestFunction,
                     std::function<bool(QNetworkReply *reply, const QList<QSslError> &sslErrors)> replyProcessingFunction);

-    void getProxyUrlsAsync(const QSharedPointer<GatewayController> &life, const QStringList &proxyStorageUrls, int currentProxyStorageIndex,
-                           const std::function<void(const QStringList &)> &onComplete);
-    void getProxyUrlAsync(const QSharedPointer<GatewayController> &life, const QStringList &proxyUrls, int currentProxyIndex,
-                          const std::function<void(const QString &)> &onComplete);
+    void getProxyUrlsAsync(const QStringList proxyStorageUrls, const int currentProxyStorageIndex,
+                           std::function<void(const QStringList &)> onComplete);
+    void getProxyUrlAsync(const QStringList proxyUrls, const int currentProxyIndex, std::function<void(const QString &)> onComplete);
    void bypassProxyAsync(
-            const QSharedPointer<GatewayController> &life, const QString &endpoint, const QString &proxyUrl, const EncryptedRequestData &encRequestData,
-            const std::function<void(const QByteArray &, bool, const QList<QSslError> &, QNetworkReply::NetworkError, const QString &, int)> &onComplete);
+            const QString &endpoint, const QString &proxyUrl, EncryptedRequestData encRequestData,
+            std::function<void(const QByteArray &, bool, const QList<QSslError> &, QNetworkReply::NetworkError, const QString &, int)> onComplete);

    int m_requestTimeoutMsecs;
    QString m_gatewayEndpoint;
--- a/client/core/controllers/ipSplitTunnelingController.cpp
+++ b/client/core/controllers/ipSplitTunnelingController.cpp
@@ -1,245 +0,0 @@
-#include "ipSplitTunnelingController.h"
-#include "core/utils/networkUtilities.h"
-#include <QJsonObject>
-
-IpSplitTunnelingController::IpSplitTunnelingController(SecureAppSettingsRepository* appSettingsRepository, QObject* parent)
-    : QObject(parent),
-      m_appSettingsRepository(appSettingsRepository)
-{
-    m_currentRouteMode = m_appSettingsRepository->routeMode();
-    if (m_currentRouteMode == RouteMode::VpnAllSites) { // for old split tunneling configs
-        m_appSettingsRepository->setRouteMode(RouteMode::VpnOnlyForwardSites);
-        m_currentRouteMode = RouteMode::VpnOnlyForwardSites;
-    }
-    fillSites();
-}
-
-bool IpSplitTunnelingController::addSiteInternal(const QString &hostname, const QString &ip)
-{
-    QVariantMap existing = m_appSettingsRepository->vpnSites(m_currentRouteMode);
-    if (existing.contains(hostname) && ip.isEmpty()) {
-        return false;
-    }
-
-    for (int i = 0; i < m_sites.size(); i++) {
-        if (m_sites[i].first == hostname && (m_sites[i].second.isEmpty() && !ip.isEmpty())) {
-            m_sites[i].second = ip;
-            m_appSettingsRepository->addVpnSite(m_currentRouteMode, hostname, ip);
-            return true;
-        } else if (m_sites[i].first == hostname && (m_sites[i].second == ip)) {
-            return false;
-        }
-    }
-    m_sites.append(qMakePair(hostname, ip));
-    m_appSettingsRepository->addVpnSite(m_currentRouteMode, hostname, ip);
-    return true;
-}
-
-void IpSplitTunnelingController::addSites(const QMap<QString, QString> &sites, bool replaceExisting)
-{
-    if (replaceExisting) {
-        m_sites.clear();
-    }
-    for (auto it = sites.constBegin(); it != sites.constEnd(); ++it) {
-        const QString &hostname = it.key();
-        const QString &ip = it.value();
-        bool found = false;
-        for (int i = 0; i < m_sites.size(); i++) {
-            if (m_sites[i].first == hostname) {
-                if (!ip.isEmpty()) {
-                    m_sites[i].second = ip;
-                }
-                found = true;
-                break;
-            }
-        }
-        if (!found) {
-            m_sites.append(qMakePair(hostname, ip));
-        }
-    }
-    if (replaceExisting) {
-        m_appSettingsRepository->removeAllVpnSites(m_currentRouteMode);
-    }
-    m_appSettingsRepository->addVpnSites(m_currentRouteMode, sites);
-}
-
-bool IpSplitTunnelingController::addSite(const QString &hostname)
-{
-    QString normalizedHostname = normalizeHostname(hostname);
-    
-    if (!validateHostname(normalizedHostname)) {
-        return false;
-    }
-    
-    if (NetworkUtilities::ipAddressWithSubnetRegExp().exactMatch(normalizedHostname)) {
-        processSite(normalizedHostname, "");
-        return true;
-    }
-    
-    if (addSiteInternal(normalizedHostname, "")) {
-        QHostInfo::lookupHost(normalizedHostname, this, SLOT(onHostResolved(QHostInfo)));
-        return true;
-    }
-    
-    return false;
-}
-
-bool IpSplitTunnelingController::removeSite(const QString &hostname)
-{
-    for (int i = 0; i < m_sites.size(); i++) {
-        if (m_sites[i].first == hostname) {
-            m_sites.removeAt(i);
-            m_appSettingsRepository->removeVpnSite(m_currentRouteMode, hostname);
-            return true;
-        }
-    }
-    return false;
-}
-
-void IpSplitTunnelingController::removeSites()
-{
-    m_sites.clear();
-    m_appSettingsRepository->removeAllVpnSites(m_currentRouteMode);
-}
-
-void IpSplitTunnelingController::setRouteMode(RouteMode routeMode)
-{
-    m_currentRouteMode = routeMode;
-    fillSites();
-    m_appSettingsRepository->setRouteMode(routeMode);
-}
-
-void IpSplitTunnelingController::toggleSplitTunneling(bool enabled)
-{
-    m_appSettingsRepository->setSitesSplitTunnelingEnabled(enabled);
-}
-
-RouteMode IpSplitTunnelingController::getRouteMode() const
-{
-    return m_currentRouteMode;
-}
-
-bool IpSplitTunnelingController::isSplitTunnelingEnabled() const
-{
-    return m_appSettingsRepository->isSitesSplitTunnelingEnabled();
-}
-
-QVector<QPair<QString, QString>> IpSplitTunnelingController::getCurrentSites() const
-{
-    return m_sites;
-}
-
-void IpSplitTunnelingController::fillSites()
-{
-    QVariantMap sitesMap = m_appSettingsRepository->vpnSites(m_currentRouteMode);
-    m_sites.clear();
-    for (auto it = sitesMap.begin(); it != sitesMap.end(); ++it) {
-        m_sites.append(qMakePair(it.key(), it.value().toString()));
-    }
-}
-
-QString IpSplitTunnelingController::normalizeHostname(const QString &hostname) const
-{
-    QString normalized = hostname;
-    normalized.replace("https://", "");
-    normalized.replace("http://", "");
-    normalized.replace("ftp://", "");
-    normalized = normalized.split("/", Qt::SkipEmptyParts).first();
-    return normalized;
-}
-
-bool IpSplitTunnelingController::validateHostname(const QString &hostname) const
-{
-    if (hostname.isEmpty()) {
-        return false;
-    }
-    if (!hostname.contains(".") && !NetworkUtilities::ipAddressWithSubnetRegExp().exactMatch(hostname)) {
-        return false;
-    }
-    return true;
-}
-
-
-void IpSplitTunnelingController::onHostResolved(const QHostInfo &hostInfo)
-{
-    const QList<QHostAddress> &addresses = hostInfo.addresses();
-    QString hostname = hostInfo.hostName();
-    
-    for (const QHostAddress &addr : addresses) {
-        if (addr.protocol() == QAbstractSocket::NetworkLayerProtocol::IPv4Protocol) {
-            processSiteAfterResolve(hostname, addr.toString());
-            break;
-        }
-    }
-}
-
-void IpSplitTunnelingController::processSiteAfterResolve(const QString &hostname, const QString &ip)
-{
-    for (int i = 0; i < m_sites.size(); i++) {
-        if (m_sites[i].first == hostname && m_sites[i].second.isEmpty()) {
-            m_sites[i].second = ip;
-            m_appSettingsRepository->addVpnSite(m_currentRouteMode, hostname, ip);
-            break;
-        }
-    }
-}
-
-void IpSplitTunnelingController::processSite(const QString &hostname, const QString &ip)
-{
-    addSiteInternal(hostname, ip);
-}
-
-bool IpSplitTunnelingController::importSitesFromJson(const QByteArray& jsonData, bool replaceExisting, QString &errorMessage)
-{
-    QJsonParseError parseError;
-    QJsonDocument jsonDocument = QJsonDocument::fromJson(jsonData, &parseError);
-    
-    if (parseError.error != QJsonParseError::NoError) {
-        errorMessage = tr("Failed to parse JSON data: %1").arg(parseError.errorString());
-        return false;
-    }
-    
-    if (!jsonDocument.isArray()) {
-        errorMessage = tr("The JSON data is not an array");
-        return false;
-    }
-    
-    QJsonArray jsonArray = jsonDocument.array();
-    QMap<QString, QString> sites;
-    
-    for (auto jsonValue : jsonArray) {
-        QJsonObject jsonObject = jsonValue.toObject();
-        QString hostname = jsonObject.value("hostname").toString("");
-        QString ip = jsonObject.value("ip").toString("");
-        
-        QString normalizedHostname = normalizeHostname(hostname);
-        
-        if (!validateHostname(normalizedHostname)) {
-            qDebug() << normalizedHostname << " not look like ip adress or domain name";
-            continue;
-        }
-        
-        sites.insert(normalizedHostname, ip);
-    }
-    
-    addSites(sites, replaceExisting);
-    
-    return true;
-}
-
-QByteArray IpSplitTunnelingController::exportSitesToJson() const
-{
-    QVector<QPair<QString, QString>> sites = getCurrentSites();
-    QJsonArray jsonArray;
-    
-    for (const auto &site : sites) {
-        QJsonObject jsonObject;
-        jsonObject["hostname"] = site.first;
-        jsonObject["ip"] = site.second;
-        jsonArray.append(jsonObject);
-    }
-    
-    QJsonDocument jsonDocument(jsonArray);
-    return jsonDocument.toJson();
-}
-
--- a/client/core/controllers/ipSplitTunnelingController.h
+++ b/client/core/controllers/ipSplitTunnelingController.h
@@ -1,58 +0,0 @@
-#ifndef IPSPLITTUNNELINGCONTROLLER_H
-#define IPSPLITTUNNELINGCONTROLLER_H
-
-#include <QObject>
-#include <QVector>
-#include <QMap>
-#include <QPair>
-#include <QStringList>
-#include <QJsonDocument>
-#include <QJsonArray>
-#include <QHostInfo>
-
-#include "core/utils/errorCodes.h"
-#include "core/utils/routeModes.h"
-#include "core/utils/commonStructs.h"
-#include "core/repositories/secureAppSettingsRepository.h"
-
-using namespace amnezia;
-
-class IpSplitTunnelingController : public QObject
-{
-    Q_OBJECT
-
-public:
-    explicit IpSplitTunnelingController(SecureAppSettingsRepository* appSettingsRepository, QObject* parent = nullptr);
-
-    bool addSite(const QString &hostname);
-    void addSites(const QMap<QString, QString> &sites, bool replaceExisting);
-    bool removeSite(const QString &hostname);
-    void removeSites();
-    void setRouteMode(RouteMode routeMode);
-    void toggleSplitTunneling(bool enabled);
-
-    RouteMode getRouteMode() const;
-    bool isSplitTunnelingEnabled() const;
-    QVector<QPair<QString, QString>> getCurrentSites() const;
-
-    bool importSitesFromJson(const QByteArray& jsonData, bool replaceExisting, QString &errorMessage);
-    QByteArray exportSitesToJson() const;
-
-private slots:
-    void onHostResolved(const QHostInfo &hostInfo);
-
-private:
-    void fillSites();
-    bool addSiteInternal(const QString &hostname, const QString &ip);
-    QString normalizeHostname(const QString &hostname) const;
-    bool validateHostname(const QString &hostname) const;
-    void processSiteAfterResolve(const QString &hostname, const QString &ip);
-    void processSite(const QString &hostname, const QString &ip);
-
-    SecureAppSettingsRepository* m_appSettingsRepository;
-    RouteMode m_currentRouteMode;
-    QVector<QPair<QString, QString>> m_sites;
-};
-
-#endif // IPSPLITTUNNELINGCONTROLLER_H
-
--- a/Show More
+++ b/Show More